koishijs / koishijs/webui

auth:部分数据库下user表中出现重复的管理员账号

Open
#365 1 comment 0 reactions 0 assignees View on GitHub
bug plugin: auth
Dominant language
Vue
Stars
40
Forks
22
PR merge metrics
No merged PRs in 30d

Description

## 预期行为

打开 auth 插件的“启用管理员账号”,user 表中始终只会有一条管理员用户的数据,管理员只有一个用户ID。

## 实际行为

使用MySQL时,每次启用 auth 插件都会在 user 表创建一条管理员用户的记录。

## 临时解决方案

只在“启用管理员账号”开启的情况下启用一次 auth 插件,随后关闭“启用管理员账号”,auth插件就不会再创建重复的记录。

## 代码分析

https://github.com/koishijs/webui/blob/896882b50cc91d16f522a52ded9644045d461c26/plugins/auth/src/index.ts#L122-L133

实测有些数据库会直接忽略这个 id=0,直接分配一个新的 id:

> ~~~sql
> select @@version;
> ~~~
>
> | @@⁠version |
> |-------------|
> | 11.4.7-MariaDB |
>
> ~~~sql
> create table lnntest251223 (
> id int primary key auto_increment,
> name varchar(255),
> password varchar(255)
> );
>
> insert into lnntest251223 ( id, name, password )
> values ( 0, '114514', '1919810' )
> on duplicate key update
> name = values(name),
> password = values(password);
>
> select * from lnntest251223;
> ~~~
>
> | id | name | password |
> |---|---|---|
> | 1 | 114514 | 1919810 |
>
> ~~~sql
> insert into lnntest251223 ( id, name, password )
> values ( 0, '114514', '1919810' )
> on duplicate key update
> name = values(name),
> password = values(password);
>
> select * from lnntest251223;
> ~~~
>
> | id | name | password |
> |---|---|---|
> | 1 | 114514 | 1919810 |
> | 2 | 114514 | 1919810 |

使用正整数id则没有问题。

> ~~~sql
> insert into lnntest251223 ( id, name, password )
> values ( 114, '114514', '1919810' )
> on duplicate key update
> name = values(name),
> password = values(password);
>
> select * from lnntest251223;
> ~~~
>
> | id | name | password |
> |---|---|---|
> | 1 | 114514 | 1919810 |
> | 2 | 114514 | 1919810 |
> | 114 | 114514 | 1919810 |

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at plugins/auth/src/index.ts lines 122-133 and inspect how the administrator record is inserted or updated when the auth plugin is enabled. Reproduce the behavior with MySQL or MariaDB, then verify that enabling the administrator account repeatedly leaves exactly one administrator row and one user ID in the user table.

Written by the indexing model from the issue text.

Assessment

Tech stack
mariadb, mysql, typescript
Domain
authentication, backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.