wangjia
a5e25b444f
实现 server/internal/auth 控制面鉴权底座，对应 doc/02 §4.1、doc/06 §3：
- POST /v1/auth/code：IP+邮箱双维度 Redis 滑窗限频（同邮箱 1/min、同 IP 10/h）
+ 一次性邮箱域黑名单（embed 词表）→ 6 位数字码写 auth:code:{email} TTL 10min
→ 异步发信（SMTP / 开发态 log mailer）。
- POST /v1/auth/register：验码（一次性，删 key；超次数烧码）→ 单事务建号
（uuid + dp_uuid 应用层生成、argon2id）+ 7 天 PRO 试用（source='trial'）→ 签发 JWT。
- POST /v1/auth/login：argon2id 校验（失败恒定时、未知用户走 dummy hash）；
失败计数限流 rl:login:{email} + 锁定；banned 拒绝。
- POST /v1/auth/refresh：RS256，access 15min + refresh 30d 落 Redis 白名单
jwt:refresh:{jti}，旋转时删旧写新；JWT 头带 kid，验证端接受新旧公钥支持轮换。
- RequireAuth 中间件：解析 Bearer access，注入 user id（复用 codes.CtxKeyUserID
避免循环依赖）+ uuid + claims 到 context。
- 错误体统一走 internal/apierr 的 {code, message_zh, message_en}，文案双语脱敏。
- 文件拆分：handler/service/password/token/ratelimit/emailcheck/store/mailer/
middleware/errors/keyloader；config 增加可选 JWT PEM 路径/kid 加载。
测试：password/token/ratelimit/emailcheck/service/handler/middleware 单测
（miniredis，含注册全流程、重复邮箱 409、验证码错误/过期/复用/烧码、限频 429
带 Retry-After、登录失败锁定、banned 拒绝、refresh 旋转后旧 token 失效），
go test -race 通过；集成测试 integration_test.go（testcontainers MySQL8+Redis，
register→login→refresh→受保护接口全链路，构建 tag integration）与 codes 模块同构。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
1.0 KiB
Plaintext
64 lines
1.0 KiB
Plaintext
# Disposable / temporary email domains blocklist.
|
|
# One domain per line, lowercase, no leading dot. Lines starting with '#' and
|
|
# blank lines are ignored. Extend as new throwaway providers appear.
|
|
0-mail.com
|
|
10minutemail.com
|
|
10minutemail.net
|
|
20minutemail.com
|
|
33mail.com
|
|
guerrillamail.com
|
|
guerrillamail.net
|
|
guerrillamail.org
|
|
guerrillamailblock.com
|
|
sharklasers.com
|
|
grr.la
|
|
spam4.me
|
|
mailinator.com
|
|
mailinator.net
|
|
mailinator2.com
|
|
maildrop.cc
|
|
mintemail.com
|
|
mohmal.com
|
|
temp-mail.org
|
|
tempmail.com
|
|
tempmailo.com
|
|
tempr.email
|
|
tempinbox.com
|
|
throwawaymail.com
|
|
trashmail.com
|
|
trashmail.net
|
|
trashmail.de
|
|
dispostable.com
|
|
fakeinbox.com
|
|
getnada.com
|
|
nada.email
|
|
yopmail.com
|
|
yopmail.net
|
|
yopmail.fr
|
|
mailnesia.com
|
|
emailondeck.com
|
|
moakt.com
|
|
mytemp.email
|
|
tmpmail.org
|
|
tmpmail.net
|
|
tmpeml.com
|
|
inboxkitten.com
|
|
burnermail.io
|
|
spamgourmet.com
|
|
mailcatch.com
|
|
fakemailgenerator.com
|
|
mvrht.com
|
|
discard.email
|
|
discardmail.com
|
|
mail-temp.com
|
|
luxusmail.org
|
|
1secmail.com
|
|
1secmail.net
|
|
1secmail.org
|
|
emailfake.com
|
|
tempmailaddress.com
|
|
mailpoof.com
|
|
harakirimail.com
|
|
spambox.us
|
|
jetable.org
|