From 296699308891a11098f4eaf2b9dd2d0ce8f0bb64 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Sun, 16 Aug 2026 18:28:12 +0800
Subject: [PATCH] =?UTF-8?q?fix(rbac):=20=E8=B4=A6=E6=88=B7=E9=94=81?=
 =?UTF-8?q?=E5=AE=9A=E5=9C=BA=E6=99=AF=E8=A1=A5=20login=5Ffail=20=E5=AE=A1?=
 =?UTF-8?q?=E8=AE=A1=EF=BC=88result=3Dlocked=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

up_login.dspy 锁定分支(fail_count>=3 且 5分钟内)之前直接 return，未写审计。
补 _audit_login(..., 'login_fail', 'locked')，补全失败登录审计三路径：
用户不存在/密码错误/账户锁定。
---
 wwwroot/user/up_login.dspy | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/wwwroot/user/up_login.dspy b/wwwroot/user/up_login.dspy
index 9da3e80..38cf470 100644
--- a/wwwroot/user/up_login.dspy
+++ b/wwwroot/user/up_login.dspy
@@ -46,11 +46,12 @@ async with db.sqlorContext(dbname) as sor:
 			stored = datetime.datetime.strptime(str(last_fail), '%Y-%m-%d %H:%M:%S')
 			elapsed = (datetime.datetime.now() - stored).total_seconds()
 			if elapsed < 300:
+				await _audit_login(sor, user.id, ns['username'], 'login_fail', 'locked')
 				return {
-			"status": "error",
-			"data": {
-				"message": "Account locked due to too many failed login attempts. Please try again in 5 minutes."
-			},
+				"status": "error",
+				"data": {
+					"message": "Account locked due to too many failed login attempts. Please try again in 5 minutes."
+				},
 					"widgettype":"Error",
 					"options":{
 						"timeout":5,