功能：完善通用云管工作台、审计与诊断能力

platform/internal/server/login_limits.go

@@ -14,6 +14,9 @@ import (
 // Count attempts before password hashing. Shared storage keeps the budget across
 // API replicas and restarts; neither passwords nor cleartext account/IP keys persist.
 func (s *Server) allowLoginAttempt(c *gin.Context, username string) bool {
+	return s.allowAuthAttempt(c, username, "login")
+}
+func (s *Server) allowAuthAttempt(c *gin.Context, username, purpose string) bool {
 	tx, err := s.DB.BeginTxx(c.Request.Context(), nil)
 	if err != nil {
 		s.dbError(c, err)
@@ -26,7 +29,11 @@ func (s *Server) allowLoginAttempt(c *gin.Context, username string) bool {
 		max int
 	}{{"account:" + strings.ToLower(strings.TrimSpace(username)), 10}, {"ip:" + c.ClientIP(), 30}} {
 		mac := hmac.New(sha256.New, []byte(s.Config.JWTSecret))
-		mac.Write([]byte("login-limit:" + limit.key))
+		prefix := "login-limit:"
+		if purpose != "login" {
+			prefix = purpose + "-limit:"
+		}
+		mac.Write([]byte(prefix + limit.key))
 		key := hex.EncodeToString(mac.Sum(nil))
 		var row struct {
 			Attempts int       `db:"attempts"`
@@ -52,7 +59,11 @@ func (s *Server) allowLoginAttempt(c *gin.Context, username string) bool {
 	}
 	if retry > 0 {
 		c.Header("Retry-After", strconv.Itoa(retry))
-		s.fail(c, 429, "login_rate_limited", "登录尝试过于频繁，请在 "+strconv.Itoa(retry)+" 秒后重试")
+		code, label := "login_rate_limited", "登录"
+		if purpose != "login" {
+			code, label = "authentication_rate_limited", "验证"
+		}
+		s.fail(c, 429, code, label+"尝试过于频繁，请在 "+strconv.Itoa(retry)+" 秒后重试")
 		return false
 	}
 	return true