fix: stabilize console scrolling and protect administrator login

internal/config/console_login.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"fmt"
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"net/netip"
+	"strconv"
+	"strings"
+	"time"
+)
+
+func loginPolicyFromEnv(get func(string) string) (consoleauth.LoginPolicy, error) {
+	p := consoleauth.DefaultLoginPolicy()
+	for _, f := range []struct {
+		name string
+		dst  *int
+	}{
+		{"ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT", &p.FailureLimit},
+		{"ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT", &p.AccountLimit},
+		{"ORBIT_CONSOLE_LOGIN_IP_LIMIT", &p.IPLimit},
+		{"ORBIT_CONSOLE_LOGIN_AUDIT_DAYS", &p.AuditDays},
+	} {
+		if raw := get(f.name); raw != "" {
+			n, err := strconv.Atoi(raw)
+			if err != nil {
+				return p, fmt.Errorf("invalid %s", f.name)
+			}
+			*f.dst = n
+		}
+	}
+	for _, f := range []struct {
+		name string
+		dst  *time.Duration
+	}{
+		{"ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW", &p.FailureWindow},
+		{"ORBIT_CONSOLE_LOGIN_LOCK_DURATION", &p.LockDuration},
+		{"ORBIT_CONSOLE_LOGIN_RATE_WINDOW", &p.RateWindow},
+	} {
+		if raw := get(f.name); raw != "" {
+			d, err := time.ParseDuration(raw)
+			if err != nil {
+				return p, fmt.Errorf("invalid %s", f.name)
+			}
+			*f.dst = d
+		}
+	}
+	if raw := get("ORBIT_CONSOLE_TRUSTED_PROXIES"); raw != "" {
+		for _, item := range strings.Split(raw, ",") {
+			prefix, err := netip.ParsePrefix(strings.TrimSpace(item))
+			if err != nil {
+				return p, fmt.Errorf("invalid ORBIT_CONSOLE_TRUSTED_PROXIES CIDR")
+			}
+			p.TrustedProxies = append(p.TrustedProxies, prefix.Masked())
+		}
+	}
+	return p, p.Validate()
+}