From ce1a23220848ed6fafa4e214e8c36647b94b0093 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Scout=E5=BC=80=E5=8F=91=E8=80=85?= <scout@localhost>
Date: Mon, 31 Aug 2026 00:06:58 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8E=A5=E5=85=A5=E6=8E=A5=E5=8F=A3=E5=AE=89?=
 =?UTF-8?q?=E5=85=A8=E4=B8=AD=E9=97=B4=E4=BB=B6=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 internal/httpapi/server.go | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index 846796a..ad15e4f 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -21,15 +21,21 @@ import (
 )
 
 type Server struct {
-	Registry        *registry.Registry
-	DeveloperToken  string
-	MaxUploadBytes  int64
-	Users           *users.Store
-	Mailer          notify.Sender
-	SessionDuration time.Duration
-	Logger          *log.Logger
-	resetMu         sync.Mutex
-	resetTokens     map[string]resetToken
+	Registry           *registry.Registry
+	DeveloperToken     string
+	MaxUploadBytes     int64
+	Users              *users.Store
+	Mailer             notify.Sender
+	SessionDuration    time.Duration
+	AllowedOrigins     []string
+	AllowedHosts       []string
+	ForceHTTPS         bool
+	TrustProxy         bool
+	AllowLegacyToken   bool
+	RateLimitPerMinute int
+	Logger             *log.Logger
+	resetMu            sync.Mutex
+	resetTokens        map[string]resetToken
 }
 
 type resetToken struct {
@@ -69,7 +75,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/v1/updates/stream", s.stream)
 	mux.HandleFunc("GET /api/v1/packages", s.packageList)
 	mux.HandleFunc("GET /api/v1/packages/", s.packageRoute)
-	return cors(logging(mux))
+	return securityHeaders(s.hostGuard(s.rateLimit(s.cors(logging(mux)))))
 }
 
 func (s *Server) health(writer http.ResponseWriter, _ *http.Request) {
@@ -407,7 +413,7 @@ func (s *Server) authenticatedUser(request *http.Request) (users.User, bool) {
 }
 
 func (s *Server) uploadUser(request *http.Request) (users.User, bool) {
-	if s.DeveloperToken != "" {
+	if s.DeveloperToken != "" && (s.AllowLegacyToken || (s.AllowedHosts == nil && s.AllowedOrigins == nil)) {
 		value := request.Header.Get("Authorization")
 		if strings.HasPrefix(value, "Bearer ") && strings.TrimPrefix(value, "Bearer ") == s.DeveloperToken {
 			return users.User{ID: "legacy-token", Email: "", Name: "兼容令牌", Role: users.RoleDeveloper, Active: true}, true