ZhuLinsen#602 [PR 3] 认证安全与初始化流程 (Auth & Security) (ZhuLinsen#639)

* feat(auth): add runtime auth settings endpoint

* feat(auth): robust runtime auth settings and security hardening

- Added '/api/v1/auth/settings' to enable/disable Web authentication at runtime
- Implemented session secret rotation (HMAC invalidation) on any auth toggle
- Fixed TOCTOU race condition in settings update via mandatory session validation
- Added comprehensive integration tests for auth re-enablement and rate limiting
- Improved credential persistence: added 'ENV_FILE' support and atomic 'replace' operations
- Refactored auth initialization flow to prevent password overwrites and ensure rollback on failure

* fix(auth): harden auth settings race checks

* fix(auth): share config writer and propagate rotation failures

* fix(auth): order toggle persistence and document worker scope

* fix(auth): enhance error handling and logging for auth toggle application

---------

Co-authored-by: mumu <42829555+ZhuLinsen@users.noreply.github.com>

Author: Activer007

README.md

@@ -44,6 +44,9 @@
 
 > 历史报告详情会优先展示 AI 返回的原始「狙击点位」文本，避免区间价、条件说明等复杂内容在历史回看时被压缩成单个数字。
 
+> Web 管理认证支持运行时开关；如果系统中已保留管理员密码，重新开启认证时必须提供当前密码，避免在认证关闭窗口内直接获取新的管理员会话。
+> 多进程/多 worker 部署时，认证开关仅在当前进程即时生效；需重启或滚动重启全部 worker 以统一状态。
+
 ### 技术栈与数据来源
 
 | 类型 | 支持 |
@@ -294,7 +297,7 @@ LITELLM_MODEL=openai/deepseek-chat
 
 包含完整的配置管理、任务监控和手动分析功能。
 
-**可选密码保护**：在 `.env` 中设置 `ADMIN_AUTH_ENABLED=true` 可启用 Web 登录，首次访问在网页设置初始密码，保护 Settings 中的 API 密钥等敏感配置。详见 [完整指南](docs/full-guide.md)。
+**可选密码保护**：在 `.env` 中设置 `ADMIN_AUTH_ENABLED=true` 可启用 Web 登录，首次访问在网页设置初始密码，保护 Settings 中的 API 密钥等敏感配置。系统设置现支持运行时开启或关闭认证；关闭认证不会删除已保存密码，后续可直接重新启用。详见 [完整指南](docs/full-guide.md)。
 
 ### 智能导入
 

api/v1/endpoints/auth.py

@@ -10,6 +10,7 @@
 from fastapi.responses import JSONResponse, Response
 from pydantic import BaseModel, Field
 
+from api.deps import get_system_config_service
 from src.auth import (
     COOKIE_NAME,
     SESSION_MAX_AGE_HOURS_DEFAULT,
@@ -18,14 +19,20 @@
     clear_rate_limit,
     create_session,
     get_client_ip,
+    has_stored_password,
     is_auth_enabled,
     is_password_changeable,
     is_password_set,
     record_login_failure,
+    refresh_auth_state,
+    rotate_session_secret,
     set_initial_password,
     verify_password,
+    verify_stored_password,
     verify_session,
 )
+from src.config import Config, setup_env
+from src.core.config_manager import ConfigManager
 
 logger = logging.getLogger(__name__)
 
@@ -51,6 +58,17 @@ class ChangePasswordRequest(BaseModel):
     new_password_confirm: str = Field(default="", alias="newPasswordConfirm")
 
 
+class AuthSettingsRequest(BaseModel):
+    """Update auth enablement and initial password settings."""
+
+    model_config = {"populate_by_name": True}
+
+    auth_enabled: bool = Field(alias="authEnabled")
+    password: str = Field(default="")
+    password_confirm: str | None = Field(default=None, alias="passwordConfirm")
+    current_password: str = Field(default="", alias="currentPassword")
+
+
 def _cookie_params(request: Request) -> dict:
     """Build cookie params including Secure based on request."""
     secure = False
@@ -76,6 +94,66 @@ def _cookie_params(request: Request) -> dict:
     }
 
 
+def _apply_auth_enabled(enabled: bool, request: Request | None = None) -> bool:
+    """Persist auth toggle to .env and reload runtime config."""
+    manager_applied = False
+    if request is not None:
+        try:
+            service = get_system_config_service(request)
+            service.apply_simple_updates(
+                updates=[("ADMIN_AUTH_ENABLED", "true" if enabled else "false")],
+                mask_token="******",
+            )
+            manager_applied = True
+        except Exception as exc:
+            logger.warning(
+                "Failed to apply auth toggle via shared SystemConfigService, falling back: %s",
+                exc,
+                exc_info=True,
+            )
+            manager_applied = False
+
+    if not manager_applied:
+        try:
+            manager = ConfigManager()
+            manager.apply_updates(
+                updates=[("ADMIN_AUTH_ENABLED", "true" if enabled else "false")],
+                sensitive_keys=set(),
+                mask_token="******",
+            )
+            manager_applied = True
+        except Exception as exc:
+            logger.error("Failed to apply auth toggle via ConfigManager: %s", exc, exc_info=True)
+            manager_applied = False
+
+    if not manager_applied:
+        return False
+
+    Config.reset_instance()
+    setup_env(override=True)
+    refresh_auth_state()
+    return True
+
+
+def _password_set_for_response(auth_enabled: bool) -> bool:
+    """Avoid exposing stored-password state when auth is disabled."""
+    return is_password_set() if auth_enabled else False
+
+
+def _set_session_cookie(response: Response, session_value: str, request: Request) -> None:
+    """Attach the admin session cookie to a response."""
+    params = _cookie_params(request)
+    response.set_cookie(
+        key=COOKIE_NAME,
+        value=session_value,
+        httponly=params["httponly"],
+        samesite=params["samesite"],
+        secure=params["secure"],
+        path=params["path"],
+        max_age=params["max_age"],
+    )
+
+
 @router.get(
     "/status",
     summary="Get auth status",
@@ -91,11 +169,182 @@ async def auth_status(request: Request):
     return {
         "authEnabled": auth_enabled,
         "loggedIn": logged_in,
-        "passwordSet": is_password_set() if auth_enabled else False,
+        "passwordSet": _password_set_for_response(auth_enabled),
         "passwordChangeable": is_password_changeable() if auth_enabled else False,
     }
 
 
+@router.post(
+    "/settings",
+    summary="Update auth settings",
+    description=(
+        "Enable or disable password login. When enabling without an existing password, "
+        "password + passwordConfirm are required. When re-enabling with a stored password, "
+        "currentPassword is required."
+    ),
+)
+async def auth_update_settings(request: Request, body: AuthSettingsRequest):
+    """Manage auth enablement from the settings page."""
+    target_enabled = body.auth_enabled
+    current_enabled = is_auth_enabled()
+    stored_password_exists = has_stored_password()
+
+    password = (body.password or "").strip()
+    confirm = (body.password_confirm or "").strip()
+    current_password = (body.current_password or "").strip()
+
+    if target_enabled:
+        if password or confirm:
+            if stored_password_exists:
+                return JSONResponse(
+                    status_code=400,
+                    content={
+                        "error": "password_already_set",
+                        "message": "已存在管理员密码，请启用认证后通过修改密码功能更新",
+                    },
+                )
+            if not password:
+                return JSONResponse(
+                    status_code=400,
+                    content={"error": "password_required", "message": "请输入要设置的管理员密码"},
+                )
+            if password != confirm:
+                return JSONResponse(
+                    status_code=400,
+                    content={"error": "password_mismatch", "message": "两次输入的密码不一致"},
+                )
+            if has_stored_password():
+                return JSONResponse(
+                    status_code=400,
+                    content={
+                        "error": "password_already_set",
+                        "message": "已存在管理员密码，请启用认证后通过修改密码功能更新",
+                    },
+                )
+            err = set_initial_password(password)
+            if err:
+                return JSONResponse(
+                    status_code=400,
+                    content={"error": "invalid_password", "message": err},
+                )
+        elif not stored_password_exists:
+            return JSONResponse(
+                status_code=400,
+                content={"error": "password_required", "message": "开启密码登录前请先设置密码"},
+            )
+        else:
+            # P1 Vulnerability Fix: Enforce current-password check independent of global cached flag
+            # We must verify they actually possess a valid admin session, otherwise an attacker
+            # could hit a race condition when auth becomes enabled mid-flight.
+            # This triggers whenever trying to enable/keep enabled an existing auth setup.
+            cookie_val = request.cookies.get(COOKIE_NAME)
+            # if target_enabled is True here, they are requesting to enable or keep auth enabled
+            is_valid_session = cookie_val and verify_session(cookie_val)
+            
+            if not is_valid_session:
+                if not current_password:
+                    return JSONResponse(
+                        status_code=400,
+                        content={"error": "current_required", "message": "重新开启认证前请输入当前密码"},
+                    )
+                ip = get_client_ip(request)
+                if not check_rate_limit(ip):
+                    return JSONResponse(
+                        status_code=429,
+                        content={
+                            "error": "rate_limited",
+                            "message": "Too many failed attempts. Please try again later.",
+                        },
+                    )
+                if not verify_stored_password(current_password):
+                    record_login_failure(ip)
+                    return JSONResponse(
+                        status_code=401,
+                        content={"error": "invalid_password", "message": "当前密码错误"},
+                    )
+                clear_rate_limit(ip)
+    else:
+        if current_enabled:
+            cookie_val = request.cookies.get(COOKIE_NAME)
+            is_valid_session = cookie_val and verify_session(cookie_val)
+
+            if not is_valid_session:
+                if not current_password:
+                    return JSONResponse(
+                        status_code=400,
+                        content={"error": "current_required", "message": "关闭认证前请输入当前密码"},
+                    )
+                ip = get_client_ip(request)
+                if not check_rate_limit(ip):
+                    return JSONResponse(
+                        status_code=429,
+                        content={
+                            "error": "rate_limited",
+                            "message": "Too many failed attempts. Please try again later.",
+                        },
+                    )
+                if not verify_stored_password(current_password):
+                    record_login_failure(ip)
+                    return JSONResponse(
+                        status_code=401,
+                        content={"error": "invalid_password", "message": "当前密码错误"},
+                    )
+                clear_rate_limit(ip)
+
+    if target_enabled != current_enabled:
+        if not _apply_auth_enabled(target_enabled, request=request):
+            return JSONResponse(
+                status_code=500,
+                content={"error": "internal_error", "message": "Failed to update auth settings"},
+            )
+        if not rotate_session_secret():
+            rollback_ok = _apply_auth_enabled(current_enabled, request=request)
+            if not rollback_ok:
+                logger.error("Failed to roll back auth state after session secret rotation failure")
+            return JSONResponse(
+                status_code=500,
+                content={"error": "internal_error", "message": "Failed to rotate session secret"},
+            )
+    else:
+        if not _apply_auth_enabled(target_enabled, request=request):
+            return JSONResponse(
+                status_code=500,
+                content={"error": "internal_error", "message": "Failed to update auth settings"},
+            )
+
+    if target_enabled:
+        session_val = create_session()
+        if not session_val:
+            rollback_ok = _apply_auth_enabled(current_enabled, request=request)
+            if not rollback_ok:
+                logger.error("Failed to roll back auth state after session creation failure")
+            return JSONResponse(
+                status_code=500,
+                content={"error": "internal_error", "message": "Failed to create session"},
+            )
+        resp = JSONResponse(
+            content={
+                "authEnabled": True,
+                "loggedIn": True,
+                "passwordSet": _password_set_for_response(True),
+                "passwordChangeable": True,
+            }
+        )
+        _set_session_cookie(resp, session_val, request)
+        return resp
+
+    resp = JSONResponse(
+        content={
+            "authEnabled": False,
+            "loggedIn": False,
+            "passwordSet": _password_set_for_response(False),
+            "passwordChangeable": False,
+        }
+    )
+    resp.delete_cookie(key=COOKIE_NAME, path="/")
+    return resp
+
+
 @router.post(
     "/login",
     summary="Login or set initial password",
@@ -161,16 +410,7 @@ async def auth_login(request: Request, body: LoginRequest):
         )
 
     resp = JSONResponse(content={"ok": True})
-    params = _cookie_params(request)
-    resp.set_cookie(
-        key=COOKIE_NAME,
-        value=session_val,
-        httponly=params["httponly"],
-        samesite=params["samesite"],
-        secure=params["secure"],
-        path=params["path"],
-        max_age=params["max_age"],
-    )
+    _set_session_cookie(resp, session_val, request)
     return resp
 
 

apps/dsa-web/src/api/auth.ts

@@ -13,6 +13,31 @@ export const authApi = {
     return data;
   },
 
+  async updateSettings(
+    authEnabled: boolean,
+    password?: string,
+    passwordConfirm?: string,
+    currentPassword?: string
+  ): Promise<AuthStatusResponse> {
+    const body: {
+      authEnabled: boolean;
+      password?: string;
+      passwordConfirm?: string;
+      currentPassword?: string;
+    } = { authEnabled };
+    if (password !== undefined) {
+      body.password = password;
+    }
+    if (passwordConfirm !== undefined) {
+      body.passwordConfirm = passwordConfirm;
+    }
+    if (currentPassword !== undefined) {
+      body.currentPassword = currentPassword;
+    }
+    const { data } = await apiClient.post<AuthStatusResponse>('/api/v1/auth/settings', body);
+    return data;
+  },
+
   async login(password: string, passwordConfirm?: string): Promise<void> {
     const body: { password: string; passwordConfirm?: string } = { password };
     if (passwordConfirm !== undefined) {

docs/CHANGELOG.md

@@ -10,6 +10,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 ## [Unreleased]
 
 ### Added
+- 🔐 **Auth settings API** — new `POST /api/v1/auth/settings` endpoint to enable or disable Web authentication at runtime and set the initial admin password when needed
+
+### Changed
+- 🔐 **Auth password state semantics** — stored password existence is now tracked independently from auth enablement; when auth is disabled, `/api/v1/auth/status` returns `passwordSet=false` while preserving the saved password for future re-enable
+- 🔐 **Auth settings re-enable hardening** — re-enabling auth with a stored password now requires `currentPassword`, and failed session creation rolls back the auth toggle to avoid lockout
+
+### Fixed
+- 🐛 **Session secret rotation on Windows** — use atomic replace so auth toggles invalidate existing sessions even when `.session_secret` already exists
+- 🐛 **Auth toggle atomicity** — persist `ADMIN_AUTH_ENABLED` before rotating session secret; on rotation failure, roll back to the previous auth state
 - openclaw Skill 集成指南 — 新增 [docs/openclaw-skill-integration.md](openclaw-skill-integration.md)，说明如何通过 openclaw Skill 调用 DSA API
 - ⚙️ **LLM channel protocol/test UX** — `.env` and Web settings now share the same channel shape (`LLM_CHANNELS` + `LLM_<NAME>_PROTOCOL/BASE_URL/API_KEY/MODELS/ENABLED`); settings page adds per-channel connection testing, primary/fallback/vision model selection, and protocol-aware model prefixing
 
@@ -18,6 +27,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - 🐛 **P0 基本面聚合稳定性修复** (#614) — 修复 `get_stock_info` 板块语义回归（新增 `belong_boards` 并保留 `boards` 兼容别名）、引入基本面上下文精简返回以控制 token、为基本面缓存增加最大条目淘汰，并补齐 ETF 总体状态聚合与 NaN 板块字段过滤，保证 fail-open 与最小入侵。
 - 🔧 **GitHub Actions 搜索引擎环境变量补充** — 工作流新增 `MINIMAX_API_KEYS`、`BRAVE_API_KEYS`、`SEARXNG_BASE_URLS` 环境变量映射，使 GitHub Actions 用户可配置 MiniMax、Brave、SearXNG 搜索服务（此前 v3.5.0 已添加 provider 实现但缺少工作流配置）
 
+### Notes
+- ⚠️ **Multi-worker auth toggles** — runtime auth updates are process-local; multi-worker deployments must restart/roll workers to keep auth state consistent
+
 ## [3.5.0] - 2026-03-12
 
 ### Added