docs: record login protection and scrolling acceptance

CHANGELOG.md

@@ -4,6 +4,9 @@
 
 ## main — 2026-09-29
 
+- 登录增加 MySQL 持久失败计数、临时锁定、账号/IP 限流、可信代理解析与审计查询，阈值及时间可配置；迁移 000035，无外键。
+- 补齐根页面和实际滚动区的边界回弹限制，修复侧栏与内容随触控板弹动。
+
 - 修复长页面滚动体验：固定导航与页头、内容独立滚动，应用详情后台刷新避免重建相同快照及打断交互。
 
 - 筛选范围改为可搜索的浅色菜单；四个资源列表默认每页 10 条，登录页大屏内容居中，统一筛选区与表格间距。
@@ -11,7 +14,7 @@
 - 管理端统一浅色工作台、分组导航、紧凑总览、中文状态和移动端布局。
 - 任务/流程增加服务端状态、精确业务键和时间筛选；任务、计划、流程、订阅增加游标分页、页大小与 ID 定位。刷新保留查询，迟到响应不覆盖新结果。
 - 应用搜索、接入配置集中展示、低频操作折叠；详情支持复制 ID、键盘焦点与返回入口，Token 查看/复制及原有审计规则保持。
-- 本批只更新控制台及说明，不修改 API、SDK 或数据库结构。SDK 继续使用 v0.1.2，Outbox 继续使用 v0.1.1。[验收记录](docs/reports/console-refresh.md)。
+- 此前浅色工作台改版只更新控制台；本次登录保护增加管理接口与迁移 000035，业务 SDK 协议不变。SDK 继续使用 v0.1.2，Outbox 继续使用 v0.1.1。[验收记录](docs/reports/console-refresh.md)。
 
 ## v0.1.2 — 2026-09-27
 

README.md

@@ -4,7 +4,7 @@
 
 - **Pulse · 脉动**：异步任务、延迟执行、定时计划、执行授权、重试与结果订阅。
 - **Weave · 织流**：研发定义并发布流程，支持顺序、并行、条件分支、等待信号、有界查询和人工恢复。
-- **Console**：账号密码登录的管理工作台，按应用与环境查看运行快照；支持任务/流程筛选、资源分页、ID 定位、审计与接入配置复制。[控制台使用说明](docs/console.md)。
+- **Console**：账号密码登录的管理工作台，按应用与环境查看运行快照；支持任务/流程筛选、资源分页、ID 定位、审计与接入配置复制；具备连续错误临时锁定、账号/IP 限流及登录审计。[控制台使用说明](docs/console.md) · [登录保护配置](docs/console-login-security.md)。
 
 主分支：`main`。当前版本：**`v0.1.2`**。源码、SDK 和 Outbox 适配包采用固定版本发布，已发布标签不覆盖。变更见 [CHANGELOG](CHANGELOG.md)。
 

cmd/orbit/main.go

@@ -93,7 +93,29 @@ func run() error {
 		txStats := mysql.ReadTransactionStats()
 		metrics.RecordTransactionStats(observability.TransactionStats{Retries: txStats.Retries, Exhausted: txStats.Exhausted})
 	}
-	consoleAuth := mysql.NewConsoleAuthStore(db)
+	consoleAuth := mysql.NewConsoleAuthStore(db, cfg.ConsoleLogin)
+	// 登录安全记录独立保留，每分钟有界清理，关闭时等待清理器退出。
+	loginCleanupCtx, stopLoginCleanup := context.WithCancel(root)
+	loginCleanupDone := make(chan struct{})
+	go func() {
+		defer close(loginCleanupDone)
+		ticker := time.NewTicker(time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-loginCleanupCtx.Done():
+				return
+			case <-ticker.C:
+				call, cancel := context.WithTimeout(loginCleanupCtx, 5*time.Second)
+				err := consoleAuth.CleanupLoginSecurity(call)
+				cancel()
+				if err != nil && loginCleanupCtx.Err() == nil {
+					slog.Error("console login security cleanup failed")
+				}
+			}
+		}
+	}()
+	defer func() { stopLoginCleanup(); <-loginCleanupDone }()
 	retentionStore := mysql.NewRetentionPolicyStore(db, cfg.RetentionDefaults)
 	server := httpserver.NewWithConsoleAuth(cfg.HTTPAddr, readiness.Check, consoleAuth, service.New(mysql.NewTaskStore(db)))
 	httpserver.RegisterApplicationResources(server, resources.New(mysql.NewTaskStore(db)))

deploy/docker-compose.ha.yml

@@ -25,6 +25,14 @@ x-orbit-environment: &orbit-environment
   ORBIT_RETENTION_AUDIT_DAYS: ${ORBIT_RETENTION_AUDIT_DAYS:-2555}
   ORBIT_CONSOLE_QUEUE_ID: ${ORBIT_CONSOLE_QUEUE_ID:-}
   ORBIT_CONSOLE_APPLICATION_ADMIN: ${ORBIT_CONSOLE_APPLICATION_ADMIN:-}
+  ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT: ${ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT:-5}
+  ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW: ${ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW:-15m}
+  ORBIT_CONSOLE_LOGIN_LOCK_DURATION: ${ORBIT_CONSOLE_LOGIN_LOCK_DURATION:-15m}
+  ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT: ${ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT:-10}
+  ORBIT_CONSOLE_LOGIN_IP_LIMIT: ${ORBIT_CONSOLE_LOGIN_IP_LIMIT:-30}
+  ORBIT_CONSOLE_LOGIN_RATE_WINDOW: ${ORBIT_CONSOLE_LOGIN_RATE_WINDOW:-1m}
+  ORBIT_CONSOLE_LOGIN_AUDIT_DAYS: ${ORBIT_CONSOLE_LOGIN_AUDIT_DAYS:-90}
+  ORBIT_CONSOLE_TRUSTED_PROXIES: ${ORBIT_CONSOLE_TRUSTED_PROXIES:-}
   ORBIT_METRICS_ADDR: ${ORBIT_METRICS_ADDR:-}
 
 services:

deploy/docker-compose.yml

@@ -93,6 +93,14 @@ services:
       ORBIT_RETENTION_INBOX_DAYS: ${ORBIT_RETENTION_INBOX_DAYS:-90}
       ORBIT_RETENTION_AUDIT_DAYS: ${ORBIT_RETENTION_AUDIT_DAYS:-2555}
       ORBIT_CONSOLE_APPLICATION_ADMIN: ${ORBIT_CONSOLE_APPLICATION_ADMIN:-}
+      ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT: ${ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT:-5}
+      ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW: ${ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW:-15m}
+      ORBIT_CONSOLE_LOGIN_LOCK_DURATION: ${ORBIT_CONSOLE_LOGIN_LOCK_DURATION:-15m}
+      ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT: ${ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT:-10}
+      ORBIT_CONSOLE_LOGIN_IP_LIMIT: ${ORBIT_CONSOLE_LOGIN_IP_LIMIT:-30}
+      ORBIT_CONSOLE_LOGIN_RATE_WINDOW: ${ORBIT_CONSOLE_LOGIN_RATE_WINDOW:-1m}
+      ORBIT_CONSOLE_LOGIN_AUDIT_DAYS: ${ORBIT_CONSOLE_LOGIN_AUDIT_DAYS:-90}
+      ORBIT_CONSOLE_TRUSTED_PROXIES: ${ORBIT_CONSOLE_TRUSTED_PROXIES:-}
       ORBIT_CREDENTIAL_KEY_FILE: ${ORBIT_CREDENTIAL_KEY_FILE:-}
       ORBIT_CONSOLE_QUEUE_ID: ${ORBIT_CONSOLE_QUEUE_ID:-}
       ORBIT_METRICS_ADDR: ${ORBIT_METRICS_ADDR:-}

deploy/nginx/orbit.conf.example

@@ -81,6 +81,7 @@ server {
     }
 
     # 控制台登录额外限制来源 IP 的尝试速率；业务任务速率仍由 Orbit 的持久化配额和授权决定。
+    # Orbit 另有数据库持久化账号/IP 保护；配置 ORBIT_CONSOLE_TRUSTED_PROXIES 为此代理的实际地址。
     location = /console/auth/login {
         limit_req zone=orbit_console_login burst=5 nodelay;
         proxy_pass http://orbit_backend;

docs/08-development-plan.md

@@ -342,5 +342,14 @@ A04派发已提交而消息尚未到达Worker的精确进程故障已通过[专
 
 - [x] 控制台独立内容滚动，固定导航与页头，保留移动端导航和表格横向滚动。
 - [x] 应用详情相同快照不重建，后台刷新在滚动/编辑/展开详情时让位，检查请求返回时的交互状态。
-- [x] 核对登录实现：当前没有失败次数封控或登录限流，明确记录缺口。
+- [x] 核对当时登录实现的失败次数封控和登录限流缺口；后续已在下方专项补齐。
 - [x] 浏览器滚动、刷新和切页回归，基础检查及持久 Docker 部署；验收见[管理端改版记录](reports/console-refresh.md)。
+
+## 2026-09-30：滚动边界补修与登录保护
+
+- [x] 关闭根页面、侧栏及各内容滚动区的边界回弹；验证连续滚动与短屏导航。
+- [x] MySQL 持久化失败窗口、临时锁定及账号/IP 限流，配置校验、可信代理识别。
+- [x] 登录成功/失败/拒绝审计，单管理员查询、保留期及有界清理，登录页等待提示。
+- [x] 真实 MySQL 并发/跨实例/恢复/审计失败回归，基础检查、浏览器验证、Docker 部署与文档同步。
+
+本地部署修订 `f56f233704700d43c6733b7f0fa14d67e1feddf7`，Schema 35，无外键。基础检查、真实 MySQL、双节点登录与控制台端到端通过；广泛集成在 Docker 暂时无响应处中断，原参数补跑剩余链路全部通过。证据与验证边界见[验收记录](reports/console-refresh.md)，默认策略和部署配置见[登录保护](console-login-security.md)。

docs/console-login-security.md

@@ -0,0 +1,65 @@
+# 控制台登录保护
+
+从 main 的数据库迁移 `000035` 开始启用。仅保护管理端账号密码登录，不改变业务 SDK Token、Worker 或结果订阅认证。保持单管理员，不引入角色管理系统。
+
+## 默认行为
+
+- 15 分钟失败窗口内连续失败 5 次，临时锁定 15 分钟。成功登录清空失败计数；失败窗口或锁定自然到期后重新计数。锁定期间尝试正确密码也不能登录，继续请求不会延长锁定。
+- 同一账号每分钟最多受理 10 次，同一来源 IP 每分钟最多 30 次。固定窗口从首次尝试开始；成功登录不清空限流计数。任意一项触发就拒绝。
+- 账号不存在、停用、密码错误或绑定凭据失效，正常拒绝均为 401。未知账号也参与相同限流/锁定，使用相同成本的 bcrypt 校验。既有账号按规范用户 ID 计数，避免等价 Unicode 登录名绕过限制。
+- 触发锁定或限流返回 429，响应包含 `Retry-After` 秒数。登录页显示原因和倒计时；刷新页面不能绕过服务端限制。已登录会话不受一次新登录锁定影响，不中断业务服务。
+- 数据库或审计提交失败返回 503，不签发 Cookie。跨站登录请求为 403；非法/过大的 JSON 为 400。
+
+所有保护状态存放 MySQL，多节点共用，重启不归零。昂贵的密码校验在事务外执行：先用短事务占用请求预算，校验结束后再次锁定账号保护行；失败计数、锁定、成功会话和最终审计在同一事务提交。并发结果不能越过已经生效的账号锁定。校验进程异常退出的审计保留 PENDING，超过 10 分钟由清理器标 ERROR；不将未知结果当作密码错误。
+
+## 部署配置
+
+所有 Orbit 节点必须使用一致配置；不允许用 0 关闭保护。修改部署配置并重启服务后生效，不重置已有计数或已记录的锁定截止。降低阈值后按新阈值检查。
+
+| 环境变量 | 默认值 | 约束 / 含义 |
+| --- | --- | --- |
+| `ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT` | `5` | 1–100 次，触发临时锁定 |
+| `ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW` | `15m` | 1s–24h，连续失败窗口 |
+| `ORBIT_CONSOLE_LOGIN_LOCK_DURATION` | `15m` | 1s–24h，新触发锁定时长 |
+| `ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT` | `10` | 1–1000 次 / 账号 / 限流窗口 |
+| `ORBIT_CONSOLE_LOGIN_IP_LIMIT` | `30` | 1–10000 次 / IP / 限流窗口 |
+| `ORBIT_CONSOLE_LOGIN_RATE_WINDOW` | `1m` | 1s–24h，固定限流窗口 |
+| `ORBIT_CONSOLE_LOGIN_AUDIT_DAYS` | `90` | 1–3650 天，登录审计独立保留期 |
+| `ORBIT_CONSOLE_TRUSTED_PROXIES` | 空 | 明确信任的代理 CIDR，逗号分隔 |
+
+普通 Compose 和 HA Compose 均透传这些变量。本地测试环境在 `.local/compose-test/compose.env` 修改所需配置，再执行 `python3 scripts/orbit-local.py up`。此文件含其他私密配置，不提交仓库；不能仅在启动脚本外 export，脚本会隔离外部项目环境变量。
+
+默认只使用 TCP 对端 IP，忽略客户端自带的 X-Forwarded-For、X-Real-IP。部署域名反向代理时，将实际代理的地址或精确网段填入 `ORBIT_CONSOLE_TRUSTED_PROXIES`，例如同机代理 `127.0.0.1/32,::1/128`。只在直连对端可信时解析 X-Forwarded-For，从右向左剥离可信代理；遇到第一个非可信地址停止。格式非法或跳数过多时退回 TCP 对端。代理应覆盖或按可信链追加转发头，不能把所有互联网地址都配置为受信代理。未配置时所有经代理的请求共用代理 IP 配额，账号维度仍独立生效。
+
+## 查看审计
+
+管理端右上角“登录审计”，仅部署指定的 `ORBIT_CONSOLE_APPLICATION_ADMIN` 可查看，默认每页 10 条。显示时间、登录名、来源 IP、结果和可重试时间；记录用户名不代表该账号一定存在。SDK Bearer、未登录或普通控制台账号无权读取全局记录。
+
+接口：`GET /console/auth/audit?before=<上页next>`，认证为有效 HttpOnly 管理员会话 Cookie。响应：
+
+```json
+{"data":{"items":[{"id":"42","username":"operator","remote_ip":"192.0.2.1","user_agent":"browser","outcome":"LOCKED","created_at":"2026-09-29T12:00:00Z","finished_at":"2026-09-29T12:00:00Z","retry_at":"2026-09-29T12:15:00Z"}],"next":"42"}}
+```
+
+`next` 仅在还有下一页时提供，是倒序分页的排他上界；无全库计数、不承诺跨页快照。结果类型：SUCCESS、INVALID、LOCKED、ACCOUNT_LIMIT、IP_LIMIT、PENDING、ERROR。审计从不保存密码、Cookie、Token 或这些秘密的摘要，浏览器列表不会自动拉取接入 Token。
+
+登录拒绝示例：
+
+```http
+HTTP/1.1 429 Too Many Requests
+Retry-After: 900
+Cache-Control: no-store
+Content-Type: application/json
+
+```
+
+限流代码为 `LOGIN_RATE_LIMITED`。不要让客户端自动循环重试账号密码登录。
+
+## 保留与升级
+
+迁移只新增 `orbit_console_login_guards` 与 `orbit_console_login_audit`，无外键，不更改已有用户、密码、会话、凭据及业务记录。先备份，停止旧节点，再前向迁移和统一部署；旧版没有保护，不能和新版混跑。
+
+每分钟清理一次，每种语句最多处理 500 行：48 小时未更新的保护状态、超过配置天数的登录审计，以及超时 PENDING 的状态归类。有效保护窗口最长 24 小时，48 小时非活动清理不会提前解除有效锁定。清理有索引、有截止时间，失败保留记录并写错误日志；这不会缩小数据库已分配磁盘，也不替代备份。业务“保留策略”管理的是命名空间历史，登录审计的全局保留时间由上述独立配置管理。
+
+锁定自然到期后使用正确密码登录即可；不自动改密码、撤销业务 Token 或踢出已有会话。若持续遭受攻击，管理员应按审计中的来源限制访问并核对反向代理配置，不能通过关闭计数绕过保护。
+锁定自然到期后使用正确密码登录即可；不自动改密码、撤销业务 Token 或踢出已有会话。若持续遭受攻击，管理员应按审计中的来源限制访问并核对反向代理配置，不能通过关闭计数绕过保护。

docs/console.md

@@ -75,7 +75,7 @@ export ORBIT_CONSOLE_QUEUE_ID='queue_xxx'
 
 ## 安全边界
 
-当前登录接口尚未实现连续密码错误计数、临时锁定或账号/IP 登录限流。错误统一返回 401，密码使用 bcrypt 存储；这些措施不能替代防暴力尝试封控。此项是待补能力，不能视为已具备。
+登录已具备持久化失败计数、临时锁定、账号/IP 限流和单管理员登录审计。默认 15 分钟内连续失败 5 次锁定 15 分钟，账号/IP 每分钟分别最多尝试 10/30 次；阈值、窗口、审计保留期和可信代理均可配置。页面显示 429 原因及倒计时，服务重启不清空保护状态。配置与接口见[登录保护](console-login-security.md)。
 
 控制台通过服务端授权访问数据库。登录会话只保存令牌摘要，服务端每次请求都会校验账号、会话、命名空间、应用启停和凭据权限。取消和人工重试会使用当前任务版本生成一次性幂等键；网络结果不明时不要重复点击，应使用原始操作身份通过 API/SDK 核对。`NEEDS_REVIEW` 任务仍须使用带证据的核查 API/SDK 完成最终裁决。普通账号不自动获得跨命名空间权限；部署指定的单管理员可显式选择应用范围，每个业务事务重新核验原会话及目标应用。各应用分别展示，SDK 权限不变。
 

docs/reports/console-refresh.md

@@ -61,6 +61,28 @@ SDK、数据库 Schema 34、原应用与凭据保持。部署未重新 bootstrap
 
 浏览器验证：1440×900 与 390×844 下，document 不滚动，页头和导航坐标固定；鼠标点击页头刷新前后内容 scrollTop 均为 293、scrollHeight 均为 1193；展开状态不因相同快照刷新被折叠；手机切页归零、详情打开/关闭和菜单定位通过，无横向页面溢出或 JS 错误。基础 test/vet/build、console-check/docs-check 通过。
 
-登录保护核对：`ConsoleAuthStore.Login` 与 HTTP 登录路由目前没有失败计数、临时锁定和登录限流；本轮如实记录缺口，没有改动账号密码或认证策略。
+第三轮当时的登录保护核对：`ConsoleAuthStore.Login` 与 HTTP 登录路由没有失败计数、临时锁定和登录限流；当时仅记录缺口。下方 2026-09-30 专项已补齐这些能力。
 
 第三轮持久部署已核验：`/version` 修订 `23db3d8fe0de352be9e756f932b12559ea746ff3`，`/health/ready` 为 200 ready。实际 18080 应用页内容 scrollTop=293 时，document scrollY=0、导航和页头 top=0。服务原账号、SDK、Token 和数据库保持不变。
+
+## 2026-09-30：边界回弹与登录保护
+
+上一轮键盘翻页和静态位置检查没有覆盖触控板滚到边界的回弹。原 `overscroll-behavior: contain` 只阻止滚动传递，仍允许元素回弹（[MDN 属性说明](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/overscroll-behavior#values)）。本轮在控制台根节点、侧栏、内容、应用列表及弹层的实际滚动容器设置 `none`，并固定根工作区；保留内容正常滚动和短屏菜单可达性。
+
+浏览器预览验证：
+
+- 1440×900，用滚动操作连续冲顶部、底部并反向：根 scrollY=0，侧栏 y=0、品牌 y=28、页头 y=0；内容 scrollTop 在 0–293 内移动。
+- 1100×600，菜单在 0–198 内滚动，内容在 0–593 内独立滚动，另一侧不被拖动，页头 y=0。
+- 390×844，顶部导航固定，内容滚动至 1112；根 scrollY=0、文档宽度 390，无根横向溢出。工具滚动不等同于所有设备的物理触控板惯性手势，以上为实际验证范围。
+
+登录保护实现、配置和 API 见[控制台登录保护](../console-login-security.md)。已有真实 MySQL 回归覆盖失败/成功计数重置、两个存储实例与重建实例共用锁定、锁定不续期与自然到期、并发 6 次失败精确计数、账号/IP 配额、未知账号、失败窗口、审计提交失败回滚会话、管理员权限/分页、日志保留和零外键。独立 Docker 双服务实测还覆盖轮流失败、重启服务仍拒绝、已登录会话仍有效、伪造代理头无效、自然到期后登录成功。
+
+端到端首轮旧管理查询曾超时；复跑该链路通过，未放宽断言。双节点测试首次重启后因 Docker 重新分配随机发布端口无法就绪，测试工具改为重读实际端口后通过，未修改锁定逻辑或删除状态。最终 `make console-e2e` 全链路通过，含任务执行、重试、定时计划、归档及退出登录。
+
+本地持久 Compose 部署版本 `f56f233704700d43c6733b7f0fa14d67e1feddf7`，数据库 Schema 35、0 外键，readiness 为 ready。已有账号、密码、会话、凭据与业务记录未重新初始化。实际 18080 浏览器验证：独立的未知测试登录名在第 5 次错误后显示 15 分钟倒计时；真实管理员正常登录，回到原应用页，审计显示失败、锁定与成功。正式页面滚动至 293 时，根 y=0、侧栏 y=0、品牌 y=28、页头 y=0，无浏览器 JS 错误。
+
+截图存放在本地忽略目录 `.local/console-ui-check/`：`login-locked.png`、`login-audit.png`、`scroll-boundary-fixed.png`，不含密码/Token 原文。
+
+基础 `make test vet build console-check docs-check` 通过；真实 MySQL 存储全套通过，包含新保护专项 6 个子场景；独立 `make console-e2e` 通过。广泛 `make integration` 执行至 SDK 调度容量样本时，Docker 引擎读操作及旧服务健康请求均超时，样本未完成，因此这一次命令不记为通过。引擎自行恢复，部署完成，未重启 Docker 或其他项目。中断位置起使用相同脚本命令及参数在新的一次性数据库补跑。
+
+尾段补跑完成：调度样本 6/6 触发并成功，流程样本 6/6 成功；其余 SDK、可运行示例、事务 Outbox/结果 Inbox、嵌入 HTTP 服务生命周期及真实进程恢复回归全部通过。覆盖租约恢复、ACK 丢响应、慢消费者、跨节点重连、优先级/并发控制、重试与截止恢复、定时计划恢复和流程暂停恢复。日志保留于 `.local/console-ui-check/security-integration-tail.log`；首段与该次补跑共同覆盖原集成脚本范围，不描述为单次全量命令通过。

internal/config/config.go

@@ -10,10 +10,12 @@ import (
 	"strconv"
 	"time"
 
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
 	"git.yuntuo.hk/k2safe/orbit/internal/retention"
 )
 
 type Config struct {
+	ConsoleLogin            consoleauth.LoginPolicy // ConsoleLogin 登录保护策略，所有服务节点使用一致配置。
 	ConsoleApplicationAdmin string                  // ConsoleApplicationAdmin 可跨应用管理接入的唯一控制台登录名；空时禁用。
 	CredentialKeyFile       string                  // CredentialKeyFile 管理员 Token 保管密钥文件路径；所有服务节点共用同一密钥环。
 	ArchiveRoot             string                  // ArchiveRoot 私有持久归档卷绝对路径，空表示关闭后台执行器。
@@ -39,7 +41,12 @@ type Config struct {
 
 func Load() (Config, error) { return FromEnv(os.Getenv) }
 func FromEnv(get func(string) string) (Config, error) {
+	loginPolicy, err := loginPolicyFromEnv(get)
+	if err != nil {
+		return Config{}, err
+	}
 	c := Config{
+		ConsoleLogin:            loginPolicy,
 		ConsoleApplicationAdmin: get("ORBIT_CONSOLE_APPLICATION_ADMIN"),
 		CredentialKeyFile:       get("ORBIT_CREDENTIAL_KEY_FILE"),
 		ArchiveRoot:             get("ORBIT_ARCHIVE_ROOT"), ArchiveStorageID: core.ID(get("ORBIT_ARCHIVE_STORAGE_ID")), ArchiveMaxBytes: 10 << 30, ArchiveTickInterval: 10 * time.Second,
@@ -154,7 +161,6 @@ func FromEnv(get func(string) string) (Config, error) {
 		}
 		c.ArchiveTickInterval = d
 	}
-	var err error
 	c.RetentionDefaults, err = retention.FromEnv(get)
 	if err != nil {
 		return Config{}, err

internal/config/console_login.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"fmt"
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"net/netip"
+	"strconv"
+	"strings"
+	"time"
+)
+
+func loginPolicyFromEnv(get func(string) string) (consoleauth.LoginPolicy, error) {
+	p := consoleauth.DefaultLoginPolicy()
+	for _, f := range []struct {
+		name string
+		dst  *int
+	}{
+		{"ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT", &p.FailureLimit},
+		{"ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT", &p.AccountLimit},
+		{"ORBIT_CONSOLE_LOGIN_IP_LIMIT", &p.IPLimit},
+		{"ORBIT_CONSOLE_LOGIN_AUDIT_DAYS", &p.AuditDays},
+	} {
+		if raw := get(f.name); raw != "" {
+			n, err := strconv.Atoi(raw)
+			if err != nil {
+				return p, fmt.Errorf("invalid %s", f.name)
+			}
+			*f.dst = n
+		}
+	}
+	for _, f := range []struct {
+		name string
+		dst  *time.Duration
+	}{
+		{"ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW", &p.FailureWindow},
+		{"ORBIT_CONSOLE_LOGIN_LOCK_DURATION", &p.LockDuration},
+		{"ORBIT_CONSOLE_LOGIN_RATE_WINDOW", &p.RateWindow},
+	} {
+		if raw := get(f.name); raw != "" {
+			d, err := time.ParseDuration(raw)
+			if err != nil {
+				return p, fmt.Errorf("invalid %s", f.name)
+			}
+			*f.dst = d
+		}
+	}
+	if raw := get("ORBIT_CONSOLE_TRUSTED_PROXIES"); raw != "" {
+		for _, item := range strings.Split(raw, ",") {
+			prefix, err := netip.ParsePrefix(strings.TrimSpace(item))
+			if err != nil {
+				return p, fmt.Errorf("invalid ORBIT_CONSOLE_TRUSTED_PROXIES CIDR")
+			}
+			p.TrustedProxies = append(p.TrustedProxies, prefix.Masked())
+		}
+	}
+	return p, p.Validate()
+}

internal/config/console_login_test.go

@@ -0,0 +1,30 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+func TestConsoleLoginConfiguration(t *testing.T) {
+	p, err := loginPolicyFromEnv(func(string) string { return "" })
+	if err != nil || p.FailureLimit != 5 || p.LockDuration != 15*time.Minute || p.AuditDays != 90 {
+		t.Fatalf("defaults: %+v %v", p, err)
+	}
+	env := map[string]string{"ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT": "3", "ORBIT_CONSOLE_LOGIN_LOCK_DURATION": "20m", "ORBIT_CONSOLE_TRUSTED_PROXIES": "127.0.0.1/32, ::1/128"}
+	p, err = loginPolicyFromEnv(func(k string) string { return env[k] })
+	if err != nil || p.FailureLimit != 3 || len(p.TrustedProxies) != 2 {
+		t.Fatalf("configured: %+v %v", p, err)
+	}
+	for k, v := range map[string]string{"ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT": "0", "ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT": "-1", "ORBIT_CONSOLE_LOGIN_IP_LIMIT": "10001", "ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW": "0s", "ORBIT_CONSOLE_LOGIN_LOCK_DURATION": "25h", "ORBIT_CONSOLE_LOGIN_RATE_WINDOW": "bad", "ORBIT_CONSOLE_LOGIN_AUDIT_DAYS": "0", "ORBIT_CONSOLE_TRUSTED_PROXIES": "all"} {
+		t.Run(k, func(t *testing.T) {
+			if _, err := loginPolicyFromEnv(func(name string) string {
+				if name == k {
+					return v
+				}
+				return ""
+			}); err == nil {
+				t.Fatal("invalid policy accepted")
+			}
+		})
+	}
+}

internal/consoleauth/login_policy.go

@@ -0,0 +1,73 @@
+package consoleauth
+
+import (
+	"context"
+	"errors"
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+	"net/netip"
+	"time"
+)
+
+// LoginPolicy 是所有节点统一配置的登录保护策略；计数及锁定保存在数据库。
+type LoginPolicy struct {
+	FailureLimit   int            // FailureLimit 失败窗口内允许的连续失败次数，达到后锁定。
+	FailureWindow  time.Duration  // FailureWindow 连续失败的统计窗口。
+	LockDuration   time.Duration  // LockDuration 临时锁定时长，锁定期间请求不续期。
+	AccountLimit   int            // AccountLimit 每个限流窗口最多接受的账号登录尝试数。
+	IPLimit        int            // IPLimit 每个限流窗口最多接受的来源 IP 登录尝试数。
+	RateWindow     time.Duration  // RateWindow 固定限流窗口；成功登录不清空流量计数。
+	AuditDays      int            // AuditDays 登录审计保留天数，与业务数据策略独立。
+	TrustedProxies []netip.Prefix // TrustedProxies 明确信任的反向代理网段；空时忽略所有转发头。
+}
+
+func DefaultLoginPolicy() LoginPolicy {
+	return LoginPolicy{FailureLimit: 5, FailureWindow: 15 * time.Minute, LockDuration: 15 * time.Minute, AccountLimit: 10, IPLimit: 30, RateWindow: time.Minute, AuditDays: 90}
+}
+func (p LoginPolicy) Validate() error {
+	if p.FailureLimit < 1 || p.FailureLimit > 100 || p.AccountLimit < 1 || p.AccountLimit > 1000 || p.IPLimit < 1 || p.IPLimit > 10000 {
+		return errors.New("console login limits out of range")
+	}
+	for _, d := range []time.Duration{p.FailureWindow, p.LockDuration, p.RateWindow} {
+		if d < time.Second || d > 24*time.Hour {
+			return errors.New("console login durations must be 1s–24h")
+		}
+	}
+	if p.AuditDays < 1 || p.AuditDays > 3650 {
+		return errors.New("console login audit retention must be 1–3650 days")
+	}
+	for _, n := range p.TrustedProxies {
+		if !n.IsValid() {
+			return errors.New("invalid console trusted proxy CIDR")
+		}
+	}
+	return nil
+}
+
+// LoginBlocked 对外不区分账号是否存在，只给出拒绝类型和最短等待时间。
+type LoginBlocked struct {
+	Locked     bool          // Locked 表示临时锁定，否则为请求限流。
+	RetryAfter time.Duration // RetryAfter 按数据库时钟计算的剩余等待时间。
+}
+
+func (*LoginBlocked) Error() string { return "console login temporarily blocked" }
+
+// LoginAuditEntry 是脱敏的登录审计；从不记录密码、Cookie、Token 或它们的摘要。
+type LoginAuditEntry struct {
+	ID         uint64     `json:"id,string"`             // ID 审计游标，按插入序号倒序分页。
+	Username   string     `json:"username"`              // Username 提交的有界登录名，不证明账号存在。
+	RemoteIP   string     `json:"remote_ip"`             // RemoteIP 经可信代理规则解析的来源地址。
+	UserAgent  string     `json:"user_agent"`            // UserAgent 截断为最多 512 字节的浏览器信息。
+	Outcome    string     `json:"outcome"`               // Outcome PENDING、SUCCESS、INVALID、LOCKED、ACCOUNT_LIMIT、IP_LIMIT 或 ERROR。
+	CreatedAt  time.Time  `json:"created_at"`            // CreatedAt 尝试时间，UTC。
+	FinishedAt *time.Time `json:"finished_at,omitempty"` // FinishedAt 完成时间；空表示尚未确认结果。
+	RetryAt    *time.Time `json:"retry_at,omitempty"`    // RetryAt 拒绝时建议最早重试时间，UTC。
+}
+
+// LoginAuditPage 固定每页 10 条，Next 是下一页排他上界；不承诺跨页快照。
+type LoginAuditPage struct {
+	Items []LoginAuditEntry `json:"items"`          // Items 当前页脱敏记录。
+	Next  string            `json:"next,omitempty"` // Next 下一页游标，无更多时为空。
+}
+type LoginAuditor interface {
+	ListLoginAudit(context.Context, auth.Token, string) (LoginAuditPage, error)
+}

internal/storage/mysql/application_resources_upgrade_integration_test.go

@@ -96,7 +96,7 @@ func TestIntegrationApplicationResourcesUpgrade(t *testing.T) {
 	f.exec(`ALTER TABLE pulse_worker_sessions DROP COLUMN concurrency_keys`)
 	// 新增的控制台和保留策略迁移也要还原到历史 v9，避免升级测试把
 	// 已经存在的 v29/v30 表误当成迁移重复执行。
-	f.exec(`DROP TABLE orbit_archive_jobs,orbit_archive_plans,orbit_retention_policies,orbit_console_sessions,orbit_console_users`)
+	f.exec(`DROP TABLE orbit_console_login_audit,orbit_console_login_guards,orbit_archive_jobs,orbit_archive_plans,orbit_retention_policies,orbit_console_sessions,orbit_console_users`)
 	f.exec(`ALTER TABLE orbit_credentials DROP CHECK ck_credential_overlap, DROP COLUMN previous_secret_digest, DROP COLUMN previous_valid_until`)
 	f.exec(`ALTER TABLE orbit_credentials DROP CHECK ck_credential_ciphertext, DROP COLUMN secret_key_id, DROP COLUMN secret_ciphertext`)
 	f.exec(`DELETE FROM orbit_schema_migrations WHERE version>=10`)

internal/storage/mysql/baseline.sql

@@ -943,3 +943,33 @@ ALTER TABLE orbit_subscriptions
  ADD retired_sequence BIGINT UNSIGNED NULL COMMENT '退役事务锁定的结果流提交水位；NULL表示未退役，之后的事件不再订阅',
  ADD KEY ix_subscription_active(namespace_id,retired_at),
  ADD CONSTRAINT ck_subscription_retired CHECK ((retired_at IS NULL AND retired_sequence IS NULL) OR (retired_at IS NOT NULL AND retired_sequence IS NOT NULL AND enabled=FALSE AND pending_count=0));
+
+-- 登录保护独立于业务凭据和命名空间；没有外键，不改变已有密码、会话或 Token。
+CREATE TABLE orbit_console_login_guards (
+    kind VARCHAR(8) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'IP 或 ACCOUNT，固定先 IP 后账号加锁',
+    subject CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'IP 或规范账号身份的 SHA-256 十六进制键，不包含密码或 Token',
+    window_start DATETIME(6) NOT NULL COMMENT '固定请求限流窗口起点，UTC',
+    requests INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '当前窗口内已受理的尝试数，成功不归零',
+    failures INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '连续失败窗口内的失败数，成功后归零',
+    first_failed_at DATETIME(6) NULL COMMENT '失败窗口起点；空表示无连续失败',
+    locked_until DATETIME(6) NULL COMMENT '临时锁定截止；锁内请求不延长此时间',
+    expires_at DATETIME(6) NOT NULL COMMENT '非活动状态清理截止，晚于所有保护窗口',
+    PRIMARY KEY(kind,subject),
+    KEY ix_console_guard_expiry(expires_at),
+    CONSTRAINT ck_console_guard_kind CHECK(kind IN ('IP','ACCOUNT'))
+) ENGINE=InnoDB COMMENT='跨节点持久登录限流及临时锁定状态';
+
+CREATE TABLE orbit_console_login_audit (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT COMMENT '审计序号，仅用于有界倒序分页',
+    username VARCHAR(128) NOT NULL COMMENT '请求中的登录名，不证明账号存在',
+    remote_ip VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT '实际连接或受信代理解析出的规范 IP',
+    user_agent VARCHAR(512) NOT NULL COMMENT '有界浏览器标识，不保存请求正文或认证头',
+    outcome VARCHAR(16) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'PENDING/SUCCESS/INVALID/LOCKED/ACCOUNT_LIMIT/IP_LIMIT/ERROR',
+    created_at DATETIME(6) NOT NULL COMMENT '开始时间，UTC',
+    finished_at DATETIME(6) NULL COMMENT '结果确认时间，空为未完成；异常中断由清理器标 ERROR',
+    retry_at DATETIME(6) NULL COMMENT '被锁定或限流时的最早重试时间；否则为空',
+    PRIMARY KEY(id),
+    KEY ix_console_login_audit_time(created_at),
+    KEY ix_console_login_audit_pending(outcome,created_at),
+    CONSTRAINT ck_console_login_outcome CHECK(outcome IN ('PENDING','SUCCESS','INVALID','LOCKED','ACCOUNT_LIMIT','IP_LIMIT','ERROR'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_as_cs COMMENT='全局登录审计，不含密码、Cookie 或 Token，仅管理员可查询';

internal/storage/mysql/console_auth.go

@@ -25,10 +25,20 @@ const (
 // ConsoleAuthStore 管理控制台的人类账号和 HttpOnly 会话。
 // 账号绑定一个已有的 Orbit 业务凭据，登录后沿用该凭据的权限范围；
 // 因此控制台登录不会改变 SDK 令牌，也不会绕过原有的 API 授权。
-type ConsoleAuthStore struct{ db *sql.DB }
+type ConsoleAuthStore struct {
+	db     *sql.DB
+	policy consoleauth.LoginPolicy
+}
 
 // NewConsoleAuthStore 创建控制台认证存储。
-func NewConsoleAuthStore(db *sql.DB) *ConsoleAuthStore { return &ConsoleAuthStore{db: db} }
+func NewConsoleAuthStore(db *sql.DB, policies ...consoleauth.LoginPolicy) *ConsoleAuthStore {
+	policy := consoleauth.DefaultLoginPolicy()
+	if len(policies) > 0 {
+		policy = policies[0]
+	}
+	return &ConsoleAuthStore{db: db, policy: policy}
+}
+func (s *ConsoleAuthStore) LoginPolicy() consoleauth.LoginPolicy { return s.policy }
 
 var _ consoleauth.Store = (*ConsoleAuthStore)(nil)
 
@@ -108,59 +118,6 @@ func (s *ConsoleAuthStore) CreateConsoleUser(ctx context.Context, in ConsoleUser
 	return ConsoleUser{ID: string(id), Username: in.Username, DisplayName: name}, nil
 }
 
-// Login 校验账号密码并建立一个独立会话。失败时统一返回未认证，避免泄露账号存在性。
-func (s *ConsoleAuthStore) Login(ctx context.Context, username, password, userAgent, remoteAddr string) (ConsoleLogin, error) {
-	if s == nil || s.db == nil || username == "" || password == "" || len(password) > 1024 {
-		return ConsoleLogin{}, fault.Unauthorized
-	}
-	var user ConsoleUser
-	var userID core.ID
-	var namespace, credential core.ID
-	var hash string
-	var enabled bool
-	err := s.db.QueryRowContext(ctx, `SELECT u.id,u.username,u.display_name,u.password_hash,u.enabled,u.namespace_id,u.credential_id
-        FROM orbit_console_users u
-        JOIN orbit_credentials c ON c.namespace_id=u.namespace_id AND c.id=u.credential_id
-        JOIN orbit_namespaces n ON n.id=u.namespace_id
-        JOIN orbit_applications a ON a.id=n.application_id
-        WHERE u.username=? AND c.revoked_at IS NULL
-          AND (c.expires_at IS NULL OR c.expires_at>UTC_TIMESTAMP(6))
-          AND n.enabled=TRUE AND a.enabled=TRUE`, username).
-		Scan(&userID, &user.Username, &user.DisplayName, &hash, &enabled, &namespace, &credential)
-	if err != nil || !enabled || bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
-		return ConsoleLogin{}, fault.Unauthorized
-	}
-	user.ID = string(userID)
-	token, secretDigest, err := auth.Issue(namespace, credential)
-	if err != nil {
-		return ConsoleLogin{}, err
-	}
-	var now time.Time
-	if err := s.db.QueryRowContext(ctx, "SELECT UTC_TIMESTAMP(6)").Scan(&now); err != nil {
-		return ConsoleLogin{}, err
-	}
-	now = now.UTC()
-	expires := now.Add(ConsoleSessionLifetime)
-	sessionID, err := core.NewID()
-	if err != nil {
-		return ConsoleLogin{}, err
-	}
-	if len(userAgent) > 512 {
-		userAgent = userAgent[:512]
-	}
-	if len(remoteAddr) > 64 {
-		remoteAddr = remoteAddr[:64]
-	}
-	_, err = s.db.ExecContext(ctx, `INSERT INTO orbit_console_sessions
-        (id,user_id,namespace_id,credential_id,token_digest,expires_at,last_seen_at,user_agent,remote_addr)
-        VALUES (?,?,?,?,?,?,UTC_TIMESTAMP(6),?,?)`,
-		sessionID, userID, namespace, credential, secretDigest, expires, userAgent, remoteAddr)
-	if err != nil {
-		return ConsoleLogin{}, err
-	}
-	return ConsoleLogin{User: user, Token: token, ExpiresAt: expires}, nil
-}
-
 // ValidateSession 检查会话是否仍然有效，并更新最近使用时间。
 // API 授权还会再次读取该会话对应凭据的权限，不信任浏览器提交的身份字段。
 func (s *ConsoleAuthStore) ValidateSession(ctx context.Context, token auth.Token) error {

internal/storage/mysql/console_login.go

@@ -0,0 +1,337 @@
+package mysql
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"net/netip"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"git.yuntuo.hk/k2safe/orbit/internal/fault"
+	core "git.yuntuo.hk/k2safe/orbit/model"
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// 不存在/停用的账号仍走相同成本校验，限流先于昂贵的密码计算。
+var consoleDummyHash = func() []byte {
+	hash, err := bcrypt.GenerateFromPassword([]byte("orbit-dummy-login-password"), consolePasswordCost)
+	if err != nil {
+		panic(err)
+	}
+	return hash
+}()
+
+// loginGuard 对应持久限流行；所有字段的时间均由 MySQL UTC 时钟决定。
+type loginGuard struct {
+	Kind        string       // Kind 为 IP 或 ACCOUNT，跨维度固定先 IP 后账号加锁。
+	Subject     string       // Subject 为规范身份的 SHA-256，不含秘密。
+	WindowStart time.Time    // WindowStart 请求窗口起点。
+	Requests    int          // Requests 已受理请求数，拒绝时不增加以免溢出。
+	Failures    int          // Failures 连续失败计数。
+	FirstFailed sql.NullTime // FirstFailed 失败窗口起点，空表示无失败。
+	LockedUntil sql.NullTime // LockedUntil 锁定截止，空表示未锁定。
+}
+
+func loginSubject(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(sum[:])
+}
+func loginText(s string, max int) string {
+	s = strings.ToValidUTF8(s, "")
+	if len(s) > max {
+		s = s[:max]
+		for !utf8.ValidString(s) {
+			s = s[:len(s)-1]
+		}
+	}
+	return s
+}
+func loginNow(ctx context.Context, tx *sql.Tx) (time.Time, error) {
+	var now time.Time
+	err := tx.QueryRowContext(ctx, "SELECT UTC_TIMESTAMP(6)").Scan(&now)
+	return now.UTC(), err
+}
+func loadLoginGuard(ctx context.Context, tx *sql.Tx, kind, key string, now time.Time) (loginGuard, error) {
+	g := loginGuard{Kind: kind, Subject: key}
+	_, err := tx.ExecContext(ctx, `INSERT INTO orbit_console_login_guards(kind,subject,window_start,expires_at) VALUES(?,?,?,?) ON DUPLICATE KEY UPDATE subject=VALUES(subject)`, kind, key, now, now.Add(48*time.Hour))
+	if err != nil {
+		return g, err
+	}
+	err = tx.QueryRowContext(ctx, `SELECT window_start,requests,failures,first_failed_at,locked_until FROM orbit_console_login_guards WHERE kind=? AND subject=? FOR UPDATE`, kind, key).Scan(&g.WindowStart, &g.Requests, &g.Failures, &g.FirstFailed, &g.LockedUntil)
+	return g, err
+}
+func saveLoginGuard(ctx context.Context, tx *sql.Tx, g loginGuard, now time.Time) error {
+	_, err := tx.ExecContext(ctx, `UPDATE orbit_console_login_guards SET window_start=?,requests=?,failures=?,first_failed_at=?,locked_until=?,expires_at=? WHERE kind=? AND subject=?`, g.WindowStart, g.Requests, g.Failures, g.FirstFailed, g.LockedUntil, now.Add(48*time.Hour), g.Kind, g.Subject)
+	return err
+}
+func (g *loginGuard) resetExpired(now time.Time, p consoleauth.LoginPolicy) {
+	if !now.Before(g.WindowStart.Add(p.RateWindow)) {
+		g.WindowStart = now
+		g.Requests = 0
+	}
+	if g.LockedUntil.Valid && !now.Before(g.LockedUntil.Time) {
+		g.LockedUntil = sql.NullTime{}
+		g.FirstFailed = sql.NullTime{}
+		g.Failures = 0
+	}
+	if !g.LockedUntil.Valid && g.FirstFailed.Valid && !now.Before(g.FirstFailed.Time.Add(p.FailureWindow)) {
+		g.FirstFailed = sql.NullTime{}
+		g.Failures = 0
+	}
+}
+
+// Login 先在短事务中占用账号/IP 请求预算，再在事务外计算 bcrypt。
+// 最终事务重新锁定账号保护行，失败、锁定、成功会话及审计原子提交；并发校验不能穿过已生效的锁定。
+func (s *ConsoleAuthStore) Login(ctx context.Context, username, password, userAgent, remoteAddr string) (ConsoleLogin, error) {
+	if s == nil || s.db == nil {
+		return ConsoleLogin{}, errors.New("console authentication unavailable")
+	}
+	if err := s.policy.Validate(); err != nil {
+		return ConsoleLogin{}, err
+	}
+	if username == "" || len(username) > 128 || !utf8.ValidString(username) || password == "" || len(password) > 1024 {
+		return ConsoleLogin{}, fault.Unauthorized
+	}
+	ip, err := netip.ParseAddr(remoteAddr)
+	if err != nil {
+		return ConsoleLogin{}, fault.Invalid("invalid login source address")
+	}
+	remoteAddr = ip.Unmap().String()
+	userAgent = loginText(userAgent, 512)
+	var user ConsoleUser
+	var userID, namespace, credential core.ID
+	var hash string
+	var enabled bool
+	err = s.db.QueryRowContext(ctx, `SELECT id,username,display_name,password_hash,enabled,namespace_id,credential_id FROM orbit_console_users WHERE username=?`, username).Scan(&userID, &user.Username, &user.DisplayName, &hash, &enabled, &namespace, &credential)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return ConsoleLogin{}, err
+	}
+	exists := err == nil
+	// 使用已存在账号的 ID，避免 Unicode 等价拼写绕过 MySQL 登录名匹配对应的限额。
+	accountKey := loginSubject("unknown:" + username)
+	if exists {
+		accountKey = loginSubject("user:" + string(userID))
+	}
+	var attemptID int64
+	var blocked *consoleauth.LoginBlocked
+	err = WithTx(ctx, s.db, func(tx *sql.Tx) error {
+		blocked = nil
+		now, err := loginNow(ctx, tx)
+		if err != nil {
+			return err
+		}
+		ipGuard, err := loadLoginGuard(ctx, tx, "IP", loginSubject(remoteAddr), now)
+		if err != nil {
+			return err
+		}
+		ipGuard.resetExpired(now, s.policy)
+		outcome := "PENDING"
+		var retryAt *time.Time
+		reject := func(reason string, until time.Time, locked bool) {
+			outcome = reason
+			retryAt = &until
+			blocked = &consoleauth.LoginBlocked{Locked: locked, RetryAfter: until.Sub(now)}
+		}
+		if ipGuard.Requests >= s.policy.IPLimit {
+			reject("IP_LIMIT", ipGuard.WindowStart.Add(s.policy.RateWindow), false)
+		} else {
+			ipGuard.Requests++
+			account, err := loadLoginGuard(ctx, tx, "ACCOUNT", accountKey, now)
+			if err != nil {
+				return err
+			}
+			account.resetExpired(now, s.policy)
+			if account.LockedUntil.Valid {
+				reject("LOCKED", account.LockedUntil.Time, true)
+			} else if account.Requests >= s.policy.AccountLimit {
+				reject("ACCOUNT_LIMIT", account.WindowStart.Add(s.policy.RateWindow), false)
+			} else {
+				account.Requests++
+			}
+			if err = saveLoginGuard(ctx, tx, account, now); err != nil {
+				return err
+			}
+		}
+		if err = saveLoginGuard(ctx, tx, ipGuard, now); err != nil {
+			return err
+		}
+		var finished *time.Time
+		if blocked != nil {
+			finished = &now
+		}
+		result, err := tx.ExecContext(ctx, `INSERT INTO orbit_console_login_audit(username,remote_ip,user_agent,outcome,created_at,finished_at,retry_at) VALUES(?,?,?,?,?,?,?)`, username, remoteAddr, userAgent, outcome, now, finished, retryAt)
+		if err != nil {
+			return err
+		}
+		attemptID, err = result.LastInsertId()
+		return err
+	})
+	if err != nil {
+		return ConsoleLogin{}, err
+	}
+	if blocked != nil {
+		return ConsoleLogin{}, blocked
+	}
+	checkHash := consoleDummyHash
+	if exists && enabled {
+		checkHash = []byte(hash)
+	}
+	valid := bcrypt.CompareHashAndPassword(checkHash, []byte(password)) == nil && exists && enabled
+	var out ConsoleLogin
+	var rejected error
+	err = WithTx(ctx, s.db, func(tx *sql.Tx) error {
+		out = ConsoleLogin{}
+		rejected = nil
+		now, err := loginNow(ctx, tx)
+		if err != nil {
+			return err
+		}
+		guard, err := loadLoginGuard(ctx, tx, "ACCOUNT", accountKey, now)
+		if err != nil {
+			return err
+		}
+		guard.resetExpired(now, s.policy)
+		outcome := "INVALID"
+		var retryAt *time.Time
+		if guard.LockedUntil.Valid {
+			outcome = "LOCKED"
+			until := guard.LockedUntil.Time
+			retryAt = &until
+			rejected = &consoleauth.LoginBlocked{Locked: true, RetryAfter: until.Sub(now)}
+		} else {
+			stillValid := valid
+			if stillValid {
+				var currentHash string
+				// 密码/账号/关联权限在最终事务中复查；停用、换密和失效凭据不能签发新会话。
+				err = tx.QueryRowContext(ctx, `SELECT u.password_hash FROM orbit_console_users u JOIN orbit_credentials c ON c.namespace_id=u.namespace_id AND c.id=u.credential_id JOIN orbit_namespaces n ON n.id=u.namespace_id JOIN orbit_applications a ON a.id=n.application_id WHERE u.id=? AND u.namespace_id=? AND u.credential_id=? AND u.enabled=TRUE AND c.revoked_at IS NULL AND (c.expires_at IS NULL OR c.expires_at>UTC_TIMESTAMP(6)) AND n.enabled=TRUE AND a.enabled=TRUE FOR SHARE`, userID, namespace, credential).Scan(&currentHash)
+				if err != nil && !errors.Is(err, sql.ErrNoRows) {
+					return err
+				}
+				stillValid = err == nil && currentHash == hash
+			}
+			if stillValid {
+				token, digest, err := auth.Issue(namespace, credential)
+				if err != nil {
+					return err
+				}
+				sessionID, err := core.NewID()
+				if err != nil {
+					return err
+				}
+				expires := now.Add(ConsoleSessionLifetime)
+				_, err = tx.ExecContext(ctx, `INSERT INTO orbit_console_sessions(id,user_id,namespace_id,credential_id,token_digest,expires_at,last_seen_at,user_agent,remote_addr) VALUES(?,?,?,?,?,?,?,?,?)`, sessionID, userID, namespace, credential, digest, expires, now, userAgent, remoteAddr)
+				if err != nil {
+					return err
+				}
+				user.ID = string(userID)
+				out = ConsoleLogin{User: user, Token: token, ExpiresAt: expires}
+				outcome = "SUCCESS"
+				guard.Failures = 0
+				guard.FirstFailed = sql.NullTime{}
+				guard.LockedUntil = sql.NullTime{}
+			} else {
+				rejected = fault.Unauthorized
+				if !guard.FirstFailed.Valid {
+					guard.FirstFailed = sql.NullTime{Time: now, Valid: true}
+				}
+				guard.Failures++
+				if guard.Failures >= s.policy.FailureLimit {
+					until := now.Add(s.policy.LockDuration)
+					guard.LockedUntil = sql.NullTime{Time: until, Valid: true}
+					outcome = "LOCKED"
+					retryAt = &until
+					rejected = &consoleauth.LoginBlocked{Locked: true, RetryAfter: s.policy.LockDuration}
+				}
+			}
+		}
+		if err = saveLoginGuard(ctx, tx, guard, now); err != nil {
+			return err
+		}
+		result, err := tx.ExecContext(ctx, `UPDATE orbit_console_login_audit SET outcome=?,finished_at=?,retry_at=? WHERE id=? AND outcome='PENDING'`, outcome, now, retryAt, attemptID)
+		if err != nil {
+			return err
+		}
+		n, err := result.RowsAffected()
+		if err != nil {
+			return err
+		}
+		if n != 1 {
+			return errors.New("login audit result not confirmed")
+		}
+		return nil
+	})
+	if err != nil {
+		return ConsoleLogin{}, err
+	}
+	return out, rejected
+}
+
+// CleanupLoginSecurity 每批最多清理 500 行，过期时间有索引，不触碰业务审计或有效锁定。
+func (s *ConsoleAuthStore) CleanupLoginSecurity(ctx context.Context) error {
+	if err := s.policy.Validate(); err != nil {
+		return err
+	}
+	for _, q := range []struct {
+		sql  string
+		args []any
+	}{
+		{`UPDATE orbit_console_login_audit SET outcome='ERROR',finished_at=UTC_TIMESTAMP(6) WHERE outcome='PENDING' AND created_at<UTC_TIMESTAMP(6)-INTERVAL 10 MINUTE ORDER BY created_at LIMIT 500`, nil},
+		{`DELETE FROM orbit_console_login_guards WHERE expires_at<UTC_TIMESTAMP(6) ORDER BY expires_at LIMIT 500`, nil},
+		{`DELETE FROM orbit_console_login_audit WHERE created_at<UTC_TIMESTAMP(6)-INTERVAL ? DAY ORDER BY created_at LIMIT 500`, []any{s.policy.AuditDays}},
+	} {
+		if _, err := s.db.ExecContext(ctx, q.sql, q.args...); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ListLoginAudit 仅沿用部署指定的单管理员权限；普通会话及 SDK Token 不能读取全局登录记录。
+func (s *ConsoleApplicationStore) ListLoginAudit(ctx context.Context, token auth.Token, before string) (consoleauth.LoginAuditPage, error) {
+	out := consoleauth.LoginAuditPage{Items: []consoleauth.LoginAuditEntry{}}
+	var cursor uint64
+	if before != "" {
+		var err error
+		cursor, err = strconv.ParseUint(before, 10, 64)
+		if err != nil || cursor == 0 {
+			return out, fault.Invalid("invalid login audit cursor")
+		}
+	}
+	err := WithTx(ctx, s.db, func(tx *sql.Tx) error {
+		if _, err := s.admin(ctx, tx, token); err != nil {
+			return err
+		}
+		q := `SELECT id,username,remote_ip,user_agent,outcome,created_at,finished_at,retry_at FROM orbit_console_login_audit`
+		args := []any{}
+		if cursor != 0 {
+			q += ` WHERE id<?`
+			args = append(args, cursor)
+		}
+		rows, err := tx.QueryContext(ctx, q+` ORDER BY id DESC LIMIT 11`, args...)
+		if err != nil {
+			return err
+		}
+		defer rows.Close()
+		out.Items = []consoleauth.LoginAuditEntry{}
+		for rows.Next() {
+			var e consoleauth.LoginAuditEntry
+			if err = rows.Scan(&e.ID, &e.Username, &e.RemoteIP, &e.UserAgent, &e.Outcome, &e.CreatedAt, &e.FinishedAt, &e.RetryAt); err != nil {
+				return err
+			}
+			out.Items = append(out.Items, e)
+		}
+		if len(out.Items) > 10 {
+			out.Items = out.Items[:10]
+			out.Next = strconv.FormatUint(out.Items[9].ID, 10)
+		}
+		return rows.Err()
+	})
+	return out, err
+}

internal/storage/mysql/console_login_integration_test.go

@@ -0,0 +1,262 @@
+package mysql
+
+import (
+	"context"
+	"errors"
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"git.yuntuo.hk/k2safe/orbit/internal/fault"
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestIntegrationConsoleLoginProtection(t *testing.T) {
+	dsn := os.Getenv("ORBIT_TEST_MYSQL_DSN")
+	if dsn == "" {
+		t.Skip("requires disposable MySQL")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+	db, err := Open(ctx, dsn, 16, 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err = Migrate(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	username := "login-" + string(testID(t))
+	password := "login-protection-test-12345"
+	var boot BootstrapResult
+	if err = Bootstrap(ctx, db, BootstrapInput{Application: username, Namespace: "default", Environment: "test", Queue: "work", ConsoleUsername: username, ConsolePassword: password}, func(v BootstrapResult) error { boot = v; return nil }); err != nil {
+		t.Fatal(err)
+	}
+	p := consoleauth.DefaultLoginPolicy()
+	p.FailureLimit = 3
+	p.IPLimit = 1000
+	p.AccountLimit = 100
+	p.LockDuration = time.Second
+	first, second := NewConsoleAuthStore(db, p), NewConsoleAuthStore(db, p)
+	exec := func(q string, args ...any) {
+		t.Helper()
+		if _, err := db.ExecContext(ctx, q, args...); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var userID string
+	if err = db.QueryRowContext(ctx, `SELECT LOWER(HEX(id)) FROM orbit_console_users WHERE username=?`, username).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	key := loginSubject("user:" + userID)
+	clear := func() { exec(`DELETE FROM orbit_console_login_guards WHERE kind='ACCOUNT' AND subject=?`, key) }
+	login := func(s *ConsoleAuthStore, pass, ip string) error {
+		t.Helper()
+		_, err := s.Login(ctx, username, pass, "login-regression", ip)
+		return err
+	}
+	expectBlocked := func(err error, locked bool) {
+		t.Helper()
+		var b *consoleauth.LoginBlocked
+		if !errors.As(err, &b) || b.Locked != locked || b.RetryAfter <= 0 {
+			t.Fatalf("expected block locked=%v got %v", locked, err)
+		}
+	}
+	t.Run("failure_success_reset_cross_node_and_expiry", func(t *testing.T) {
+		if err = login(first, "wrong", "192.0.2.10"); !errors.Is(err, fault.Unauthorized) {
+			t.Fatal(err)
+		}
+		if err = login(second, password, "192.0.2.11"); err != nil {
+			t.Fatal(err)
+		}
+		for i := 0; i < 2; i++ {
+			if err = login(first, "wrong", "192.0.2.10"); !errors.Is(err, fault.Unauthorized) {
+				t.Fatal(err)
+			}
+		}
+		expectBlocked(login(second, "wrong", "192.0.2.11"), true)
+		var until, after time.Time
+		if err = db.QueryRowContext(ctx, `SELECT locked_until FROM orbit_console_login_guards WHERE kind='ACCOUNT' AND subject=?`, key).Scan(&until); err != nil {
+			t.Fatal(err)
+		}
+		expectBlocked(login(NewConsoleAuthStore(db, p), password, "192.0.2.12"), true)
+		if err = db.QueryRowContext(ctx, `SELECT locked_until FROM orbit_console_login_guards WHERE kind='ACCOUNT' AND subject=?`, key).Scan(&after); err != nil || !until.Equal(after) {
+			t.Fatal("lock was extended", err)
+		}
+		// 使用数据库自身时钟等待真实截止，重建存储实例不能提前解除锁定。
+		for {
+			var elapsed bool
+			if err = db.QueryRowContext(ctx, "SELECT UTC_TIMESTAMP(6)>=?", until).Scan(&elapsed); err != nil {
+				t.Fatal(err)
+			}
+			if elapsed {
+				break
+			}
+			select {
+			case <-ctx.Done():
+				t.Fatal(ctx.Err())
+			case <-time.After(25 * time.Millisecond):
+			}
+		}
+		if err = login(second, password, "192.0.2.12"); err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("concurrent_failures_serialize_and_lock", func(t *testing.T) {
+		clear()
+		policy := p
+		policy.LockDuration = time.Minute
+		a, b := NewConsoleAuthStore(db, policy), NewConsoleAuthStore(db, policy)
+		results := make(chan error, 6)
+		var wg sync.WaitGroup
+		start := make(chan struct{})
+		for i := 0; i < 6; i++ {
+			wg.Add(1)
+			go func(i int) {
+				defer wg.Done()
+				<-start
+				s := a
+				if i%2 == 1 {
+					s = b
+				}
+				results <- login(s, "wrong", "192.0.2.20")
+			}(i)
+		}
+		close(start)
+		wg.Wait()
+		close(results)
+		invalid, blocked := 0, 0
+		for err := range results {
+			var v *consoleauth.LoginBlocked
+			if errors.As(err, &v) && v.Locked {
+				blocked++
+			} else if errors.Is(err, fault.Unauthorized) {
+				invalid++
+			} else {
+				t.Fatal(err)
+			}
+		}
+		if invalid != 2 || blocked != 4 {
+			t.Fatalf("invalid=%d blocked=%d", invalid, blocked)
+		}
+		expectBlocked(login(a, password, "192.0.2.21"), true)
+		var count int
+		if err = db.QueryRowContext(ctx, `SELECT failures FROM orbit_console_login_guards WHERE kind='ACCOUNT' AND subject=?`, key).Scan(&count); err != nil || count != 3 {
+			t.Fatalf("failure count=%d %v", count, err)
+		}
+	})
+	t.Run("account_and_ip_limits", func(t *testing.T) {
+		clear()
+		policy := p
+		policy.AccountLimit = 2
+		s := NewConsoleAuthStore(db, policy)
+		for _, ip := range []string{"192.0.2.30", "192.0.2.31"} {
+			if err = login(s, password, ip); err != nil {
+				t.Fatal(err)
+			}
+		}
+		expectBlocked(login(NewConsoleAuthStore(db, policy), password, "192.0.2.32"), false)
+		clear()
+		policy.IPLimit = 2
+		s = NewConsoleAuthStore(db, policy)
+		for i := 0; i < 2; i++ {
+			_, err = s.Login(ctx, "unknown-"+string(testID(t)), "wrong", "test", "192.0.2.40")
+			if !errors.Is(err, fault.Unauthorized) {
+				t.Fatal(err)
+			}
+		}
+		expectBlocked(login(s, password, "192.0.2.40"), false)
+		exec(`UPDATE orbit_console_login_guards SET window_start=UTC_TIMESTAMP(6)-INTERVAL 2 MINUTE WHERE kind='IP' AND subject=?`, loginSubject("192.0.2.40"))
+		if err = login(s, password, "192.0.2.40"); err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("unknown_account_and_failure_window", func(t *testing.T) {
+		unknown := "unknown-" + string(testID(t))
+		policy := p
+		policy.FailureLimit = 2
+		s := NewConsoleAuthStore(db, policy)
+		_, err = s.Login(ctx, unknown, "wrong", "test", "192.0.2.50")
+		if !errors.Is(err, fault.Unauthorized) {
+			t.Fatal(err)
+		}
+		_, err = s.Login(ctx, unknown, "wrong", "test", "192.0.2.50")
+		expectBlocked(err, true)
+		clear()
+		if err = login(first, "wrong", "192.0.2.51"); !errors.Is(err, fault.Unauthorized) {
+			t.Fatal(err)
+		}
+		exec(`UPDATE orbit_console_login_guards SET failures=2,first_failed_at=UTC_TIMESTAMP(6)-INTERVAL 1 HOUR WHERE kind='ACCOUNT' AND subject=?`, key)
+		if err = login(second, "wrong", "192.0.2.51"); !errors.Is(err, fault.Unauthorized) {
+			t.Fatal(err)
+		}
+	})
+	t.Run("audit_failure_cannot_issue_session", func(t *testing.T) {
+		clear()
+		var before, after int
+		db.QueryRowContext(ctx, `SELECT COUNT(*) FROM orbit_console_sessions WHERE user_id=UNHEX(?)`, userID).Scan(&before)
+		trigger := "login_audit_" + string(testID(t))
+		exec(`CREATE TRIGGER ` + trigger + ` BEFORE UPDATE ON orbit_console_login_audit FOR EACH ROW BEGIN IF NEW.username='` + username + `' AND NEW.outcome='SUCCESS' THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='test audit unavailable'; END IF; END`)
+		defer exec("DROP TRIGGER " + trigger)
+		if err = login(first, password, "192.0.2.60"); err == nil {
+			t.Fatal("audit failure issued session")
+		}
+		db.QueryRowContext(ctx, `SELECT COUNT(*) FROM orbit_console_sessions WHERE user_id=UNHEX(?)`, userID).Scan(&after)
+		if before != after {
+			t.Fatal("session survived failed audit")
+		}
+	})
+	t.Run("audit_admin_pagination_secrets_and_cleanup", func(t *testing.T) {
+		clear()
+		result, err := first.Login(ctx, username, password, "test", "192.0.2.70")
+		if err != nil {
+			t.Fatal(err)
+		}
+		session, _ := auth.Parse(result.Token)
+		sdk, _ := auth.Parse(boot.Token)
+		store := NewConsoleApplicationStore(db, username)
+		if _, err = store.ListLoginAudit(ctx, sdk, ""); !errors.Is(err, fault.Forbidden) {
+			t.Fatal("SDK read login audit", err)
+		}
+		if _, err = NewConsoleApplicationStore(db, "another-admin").ListLoginAudit(ctx, session, ""); !errors.Is(err, fault.Forbidden) {
+			t.Fatal("non-admin read audit", err)
+		}
+		page, err := store.ListLoginAudit(ctx, session, "")
+		if err != nil || len(page.Items) != 10 || page.Next == "" {
+			t.Fatalf("page: %+v %v", page, err)
+		}
+		next, err := store.ListLoginAudit(ctx, session, page.Next)
+		if err != nil || len(next.Items) == 0 || next.Items[0].ID >= page.Items[9].ID {
+			t.Fatal("audit pagination", err)
+		}
+		rows, err := db.QueryContext(ctx, `SELECT CONCAT(username,remote_ip,user_agent,outcome) FROM orbit_console_login_audit WHERE username=?`, username)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for rows.Next() {
+			var value string
+			if err = rows.Scan(&value); err != nil {
+				t.Fatal(err)
+			}
+			if strings.Contains(value, password) || strings.Contains(value, result.Token) {
+				t.Fatal("audit contains secret")
+			}
+		}
+		rows.Close()
+		exec(`UPDATE orbit_console_login_audit SET created_at=UTC_TIMESTAMP(6)-INTERVAL 91 DAY WHERE username=? AND outcome='INVALID'`, username)
+		exec(`UPDATE orbit_console_login_audit SET created_at=UTC_TIMESTAMP(6)-INTERVAL 11 MINUTE WHERE username=? AND outcome='PENDING'`, username)
+		exec(`UPDATE orbit_console_login_guards SET expires_at=UTC_TIMESTAMP(6)-INTERVAL 1 DAY WHERE kind='IP' AND subject=?`, loginSubject("192.0.2.70"))
+		if err = first.CleanupLoginSecurity(ctx); err != nil {
+			t.Fatal(err)
+		}
+		var n int
+		if err = db.QueryRowContext(ctx, `SELECT COUNT(*) FROM orbit_console_login_audit WHERE username=? AND (outcome='PENDING' OR created_at<UTC_TIMESTAMP(6)-INTERVAL 90 DAY)`, username).Scan(&n); err != nil || n != 0 {
+			t.Fatal("audit cleanup", n, err)
+		}
+		if err = db.QueryRowContext(ctx, `SELECT COUNT(*) FROM information_schema.REFERENTIAL_CONSTRAINTS WHERE CONSTRAINT_SCHEMA=DATABASE()`).Scan(&n); err != nil || n != 0 {
+			t.Fatal("foreign keys", n, err)
+		}
+	})
+}

internal/storage/mysql/migrate.go

@@ -26,7 +26,7 @@ var migrationFiles embed.FS
 //go:embed baseline.sql
 var freshInstallBaseline string
 
-const freshInstallBaselineVersion uint64 = 34
+const freshInstallBaselineVersion uint64 = 35
 
 type Migration struct {
 	Version  uint64

internal/storage/mysql/migrations/000035_console_login_protection.up.sql

@@ -0,0 +1,29 @@
+-- 登录保护独立于业务凭据和命名空间；没有外键，不改变已有密码、会话或 Token。
+CREATE TABLE orbit_console_login_guards (
+    kind VARCHAR(8) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'IP 或 ACCOUNT，固定先 IP 后账号加锁',
+    subject CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'IP 或规范账号身份的 SHA-256 十六进制键，不包含密码或 Token',
+    window_start DATETIME(6) NOT NULL COMMENT '固定请求限流窗口起点，UTC',
+    requests INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '当前窗口内已受理的尝试数，成功不归零',
+    failures INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '连续失败窗口内的失败数，成功后归零',
+    first_failed_at DATETIME(6) NULL COMMENT '失败窗口起点；空表示无连续失败',
+    locked_until DATETIME(6) NULL COMMENT '临时锁定截止；锁内请求不延长此时间',
+    expires_at DATETIME(6) NOT NULL COMMENT '非活动状态清理截止，晚于所有保护窗口',
+    PRIMARY KEY(kind,subject),
+    KEY ix_console_guard_expiry(expires_at),
+    CONSTRAINT ck_console_guard_kind CHECK(kind IN ('IP','ACCOUNT'))
+) ENGINE=InnoDB COMMENT='跨节点持久登录限流及临时锁定状态';
+
+CREATE TABLE orbit_console_login_audit (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT COMMENT '审计序号，仅用于有界倒序分页',
+    username VARCHAR(128) NOT NULL COMMENT '请求中的登录名，不证明账号存在',
+    remote_ip VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT '实际连接或受信代理解析出的规范 IP',
+    user_agent VARCHAR(512) NOT NULL COMMENT '有界浏览器标识，不保存请求正文或认证头',
+    outcome VARCHAR(16) CHARACTER SET ascii COLLATE ascii_bin NOT NULL COMMENT 'PENDING/SUCCESS/INVALID/LOCKED/ACCOUNT_LIMIT/IP_LIMIT/ERROR',
+    created_at DATETIME(6) NOT NULL COMMENT '开始时间，UTC',
+    finished_at DATETIME(6) NULL COMMENT '结果确认时间，空为未完成；异常中断由清理器标 ERROR',
+    retry_at DATETIME(6) NULL COMMENT '被锁定或限流时的最早重试时间；否则为空',
+    PRIMARY KEY(id),
+    KEY ix_console_login_audit_time(created_at),
+    KEY ix_console_login_audit_pending(outcome,created_at),
+    CONSTRAINT ck_console_login_outcome CHECK(outcome IN ('PENDING','SUCCESS','INVALID','LOCKED','ACCOUNT_LIMIT','IP_LIMIT','ERROR'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_as_cs COMMENT='全局登录审计，不含密码、Cookie 或 Token，仅管理员可查询';

internal/storage/mysql/no_foreign_keys_integration_test.go

@@ -147,7 +147,7 @@ func TestIntegrationNoForeignKeysUpgrade(t *testing.T) {
 	indexes := func() []string {
 		t.Helper()
 		// 排除后续新增/替换索引；原有项在此逐项比较，v24/v25新增项由对应Query/Timeline升级测试核对。
-		rows, err := db.QueryContext(ctx, `SELECT CONCAT_WS(':',TABLE_NAME,INDEX_NAME,NON_UNIQUE,SEQ_IN_INDEX,COLUMN_NAME,COALESCE(SUB_PART,0),INDEX_TYPE,IS_VISIBLE) FROM information_schema.STATISTICS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME NOT IN ('orbit_application_resources','orbit_event_streams','orbit_result_events','orbit_console_users','orbit_console_sessions','orbit_retention_policies','orbit_archive_jobs','orbit_archive_plans','weave_version_scopes') AND INDEX_NAME NOT IN ('ix_subscription_active','ix_task_priority_dispatch','ix_delivery_subscription_due','ix_delivery_subscription_lease','ix_delivery_history','ix_delivery_state_history','uq_task_retry_parent','fk_pulse_tasks_3','ix_task_queue_business_created','ix_task_queue_business_state_created','uq_weave_task_result','ix_signal_expiry','ix_signal_activation','uq_wait_winner_signal','ix_task_workflow_owner','ix_signal_history','ix_event_workflow_history','ix_workflow_created','ix_workflow_state_created','ix_workflow_business_state_created','ix_workflow_definition_created','ix_workflow_definition_state_created','ix_workflow_definition_business_created','ix_workflow_definition_business_state_created','ix_task_observe_state_available','ix_delivery_observe_state_available','ix_workflow_observe_state_updated','ix_event_observe_type_occurred','ix_task_observe_terminal_completed','ix_workflow_observe_terminal_completed') ORDER BY TABLE_NAME,INDEX_NAME,SEQ_IN_INDEX`)
+		rows, err := db.QueryContext(ctx, `SELECT CONCAT_WS(':',TABLE_NAME,INDEX_NAME,NON_UNIQUE,SEQ_IN_INDEX,COLUMN_NAME,COALESCE(SUB_PART,0),INDEX_TYPE,IS_VISIBLE) FROM information_schema.STATISTICS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME NOT IN ('orbit_console_login_audit','orbit_console_login_guards','orbit_application_resources','orbit_event_streams','orbit_result_events','orbit_console_users','orbit_console_sessions','orbit_retention_policies','orbit_archive_jobs','orbit_archive_plans','weave_version_scopes') AND INDEX_NAME NOT IN ('ix_subscription_active','ix_task_priority_dispatch','ix_delivery_subscription_due','ix_delivery_subscription_lease','ix_delivery_history','ix_delivery_state_history','uq_task_retry_parent','fk_pulse_tasks_3','ix_task_queue_business_created','ix_task_queue_business_state_created','uq_weave_task_result','ix_signal_expiry','ix_signal_activation','uq_wait_winner_signal','ix_task_workflow_owner','ix_signal_history','ix_event_workflow_history','ix_workflow_created','ix_workflow_state_created','ix_workflow_business_state_created','ix_workflow_definition_created','ix_workflow_definition_state_created','ix_workflow_definition_business_created','ix_workflow_definition_business_state_created','ix_task_observe_state_available','ix_delivery_observe_state_available','ix_workflow_observe_state_updated','ix_event_observe_type_occurred','ix_task_observe_terminal_completed','ix_workflow_observe_terminal_completed') ORDER BY TABLE_NAME,INDEX_NAME,SEQ_IN_INDEX`)
 		if err != nil {
 			t.Fatal(err)
 		}

internal/transport/httpserver/console.go

@@ -4,11 +4,14 @@ import (
 	"context"
 	"embed"
 	"encoding/json"
+	"errors"
 	"io/fs"
+	"math"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -64,6 +67,12 @@ func RegisterConsole(server *http.Server, authStores ...consoleauth.Store) {
 		writeConsoleJSON(w, http.StatusOK, map[string]any{"authenticated": true})
 	})
 	mux.HandleFunc("POST /console/auth/login", func(w http.ResponseWriter, r *http.Request) {
+		if err := http.NewCrossOriginProtection().Check(r); err != nil {
+			writeConsoleJSON(w, http.StatusForbidden, map[string]any{"error": map[string]string{"code": "PERMISSION_DENIED", "message": "不允许跨站登录请求"}})
+			return
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, 8<<10)
+
 		if consoleAuth == nil {
 			writeConsoleJSON(w, http.StatusServiceUnavailable, map[string]any{"error": map[string]string{"code": "UNAVAILABLE", "message": "console authentication is not configured"}})
 			return
@@ -78,10 +87,23 @@ func RegisterConsole(server *http.Server, authStores ...consoleauth.Store) {
 		}
 		ctx, cancel := context.WithTimeout(r.Context(), 8*time.Second)
 		defer cancel()
-		login, err := consoleAuth.Login(ctx, in.Username, in.Password, r.UserAgent(), remoteAddress(r))
+		login, err := consoleAuth.Login(ctx, in.Username, in.Password, r.UserAgent(), loginRemoteAddress(r, consoleAuth))
 		if err != nil {
-			// 账号不存在、密码错误、账号停用和绑定凭据失效统一返回，避免账号枚举。
+			var blocked *consoleauth.LoginBlocked
+			if errors.As(err, &blocked) {
+				seconds := max(1, int(math.Ceil(blocked.RetryAfter.Seconds())))
+				code, message := "LOGIN_RATE_LIMITED", "登录尝试过于频繁，请稍后重试"
+				if blocked.Locked {
+					code, message = "LOGIN_LOCKED", "连续登录失败，已临时锁定，请稍后重试"
+				}
+				w.Header().Set("Retry-After", strconv.Itoa(seconds))
+				writeConsoleJSON(w, http.StatusTooManyRequests, map[string]any{"error": map[string]any{"code": code, "message": message, "retry_after_seconds": seconds}})
+			} else if errors.Is(err, fault.Unauthorized) {
 				writeConsoleJSON(w, http.StatusUnauthorized, map[string]any{"error": map[string]string{"code": "UNAUTHENTICATED", "message": "用户名或密码错误"}})
+			} else {
+				// 存储或审计不可用时不发 Cookie，不将基础设施故障伪装成密码错误。
+				writeConsoleJSON(w, http.StatusServiceUnavailable, map[string]any{"error": map[string]string{"code": "UNAVAILABLE", "message": "登录服务暂不可用，请稍后重试"}})
+			}
 			return
 		}
 		http.SetCookie(w, &http.Cookie{Name: consoleSessionCookie, Value: login.Token, Path: "/", HttpOnly: true, Secure: r.TLS != nil, SameSite: http.SameSiteLaxMode, Expires: login.ExpiresAt, MaxAge: int(time.Until(login.ExpiresAt).Seconds())})

internal/transport/httpserver/console/app.js

@@ -12,6 +12,26 @@
     const toast = $('toast'); toast.textContent = message; toast.classList.add('show');
     clearTimeout(showToast.timer); showToast.timer = setTimeout(() => toast.classList.remove('show'), 2800);
   }
+  let loginAuditCursor = '', loginAuditPage = 1, loginAuditLoading = false;
+  async function loadLoginAudit(first = false) {
+    if (loginAuditLoading) return;
+    loginAuditLoading = true;
+    $('login-audit-first').disabled = true; $('login-audit-next').disabled = true;
+    text('login-audit-status', '正在读取…');
+    try {
+      const cursor = first ? '' : loginAuditCursor;
+      const page = extractData(await request(`/console/auth/audit${cursor ? `?before=${encodeURIComponent(cursor)}` : ''}`));
+      const labels = { SUCCESS: '登录成功', INVALID: '账号或密码错误', LOCKED: '临时锁定', ACCOUNT_LIMIT: '账号限流', IP_LIMIT: 'IP 限流', PENDING: '校验中', ERROR: '未完成 / 服务异常' };
+      $('login-audit-rows').innerHTML = (page.items || []).map(row => `<tr><td>${escapeHTML(formatTime(row.created_at))}</td><td>${escapeHTML(row.username)}</td><td>${escapeHTML(row.remote_ip)}</td><td>${escapeHTML(labels[row.outcome] || row.outcome)}</td><td>${escapeHTML(formatTime(row.retry_at))}</td></tr>`).join('');
+      loginAuditPage = first ? 1 : loginAuditPage + 1; loginAuditCursor = page.next || '';
+      text('login-audit-page', `第 ${loginAuditPage} 页`); text('login-audit-status', page.items?.length ? '' : '暂无登录记录');
+    } catch (error) { text('login-audit-status', `读取失败：${error.message}`); }
+    finally { loginAuditLoading = false; $('login-audit-first').disabled = false; $('login-audit-next').disabled = !loginAuditCursor; }
+  }
+  $('login-audit-open').addEventListener('click', () => { $('login-audit-dialog').showModal(); loadLoginAudit(true); });
+  $('login-audit-close').addEventListener('click', () => $('login-audit-dialog').close());
+  $('login-audit-first').addEventListener('click', () => loadLoginAudit(true));
+  $('login-audit-next').addEventListener('click', () => loadLoginAudit());
   function formatTime(value) {
     if (!value) return '—';
     const date = new Date(value); if (Number.isNaN(date.getTime())) return String(value);
@@ -137,6 +157,7 @@
       appendScopeOptions($('scope-application'), scopeUI.applications, scope.entry.namespace_id, '', 'application');
       appendScopeOptions($('scope-queue'), queues, state.queue, scopeUI.nextQueue, 'queue');
       $('scope-application').disabled = !scope.can_switch;
+      $('login-audit-open').hidden = !scope.can_switch;
       $('scope-queue').disabled = !queues.length;
       if (scope.can_switch) {
         try { await loadScopeApplications(); } catch (error) { text('scope-error', '应用目录读取失败：' + error.message); }

internal/transport/httpserver/console/index.html

@@ -1,5 +1,5 @@
 <!doctype html>
-<html lang="zh-CN">
+<html lang="zh-CN" class="console-document">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -42,6 +42,7 @@
         <div class="topbar-actions"><label class="auto-refresh"><input type="checkbox" id="auto-refresh" checked>自动刷新</label>
           <span class="live-chip"><i></i><span id="live-label">本地环境</span></span>
           <span class="last-updated" id="last-updated" aria-live="polite">尚未刷新</span>
+          <button class="secondary-button compact" id="login-audit-open" hidden>登录审计</button>
           <button class="icon-button" id="logout-button" title="退出登录" aria-label="退出登录">↪</button>
           <button class="icon-button" id="refresh-button" title="刷新数据" aria-label="刷新数据">↻</button>
         </div>
@@ -357,6 +358,14 @@
     </aside>
   </div>
   <div class="toast" id="toast" role="status"></div>
+  <dialog id="login-audit-dialog" class="access-dialog login-audit-dialog" aria-labelledby="login-audit-title">
+    <div class="access-dialog-top"><button type="button" class="icon-button" id="login-audit-close" aria-label="关闭登录审计">×</button></div>
+    <h2 id="login-audit-title">登录审计</h2>
+    <p class="panel-description">记录登录成功、失败、临时锁定与限流。每页 10 条，时间为当前时区。</p>
+    <p id="login-audit-status" role="status"></p>
+    <div class="table-wrap"><table><thead><tr><th>时间</th><th>账号</th><th>来源 IP</th><th>结果</th><th>可重试时间</th></tr></thead><tbody id="login-audit-rows"></tbody></table></div>
+    <div class="audit-pagination"><button class="secondary-button compact" id="login-audit-first">最新记录</button><span id="login-audit-page">第 1 页</span><button class="secondary-button compact" id="login-audit-next" disabled>下一页 →</button></div>
+  </dialog>
   <dialog id="access-dialog" class="access-dialog">
     <div class="access-dialog-top"><button type="button" class="icon-button" id="access-close" aria-label="关闭应用接入">×</button></div>
     <h2 id="access-form-title">新建应用</h2><p class="panel-description" id="access-form-note">为应用创建独立的环境、队列与调用凭据。</p>

internal/transport/httpserver/console/login.html

@@ -69,7 +69,31 @@
       // 初次访问时 URL 片段不会发给服务端，浏览器会把它保留在跳转后的登录地址上。
       if (!returnTo.includes('#') && /^#\/(overview|tasks|schedules|workflows|subscriptions|retention|archives|applications)$/.test(location.hash)) returnTo += location.hash;
       fetch('/console/auth/session', { headers: { Accept: 'application/json' }, credentials: 'same-origin', cache: 'no-store' }).then(response => response.json()).then(body => { if (body.authenticated) location.replace(returnTo); }).catch(() => {});
-      form.addEventListener('submit', async event => { event.preventDefault(); error.textContent = ''; submit.disabled = true; submit.textContent = '正在登录…'; try { const response = await fetch('/console/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: 'application/json' }, credentials: 'same-origin', body: JSON.stringify({ username: username.value.trim(), password: password.value }) }); const body = await response.json().catch(() => ({})); if (!response.ok) throw new Error(body?.error?.message || '登录失败，请检查用户名和密码'); location.replace(returnTo); } catch (loginError) { error.textContent = loginError.message || '登录失败，请稍后重试'; password.select(); } finally { submit.disabled = false; submit.textContent = '登录 Orbit →'; } });
+      let retryUntil = 0, retryTimer;
+      function showRetry() {
+        const remaining = Math.max(0, Math.ceil((retryUntil - Date.now()) / 1000));
+        submit.disabled = remaining > 0;
+        submit.textContent = remaining ? `请等待 ${Math.floor(remaining / 60)}分 ${remaining % 60}秒` : '登录 Orbit →';
+        if (!remaining) clearInterval(retryTimer);
+      }
+      form.addEventListener('submit', async event => {
+        event.preventDefault(); if (Date.now() < retryUntil) return;
+        error.textContent = ''; submit.disabled = true; submit.textContent = '正在登录…';
+        try {
+          const response = await fetch('/console/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: 'application/json' }, credentials: 'same-origin', body: JSON.stringify({ username: username.value.trim(), password: password.value }) });
+          const body = await response.json().catch(() => ({}));
+          if (!response.ok) {
+            const seconds = Number(body?.error?.retry_after_seconds);
+            if (response.status === 429 && Number.isFinite(seconds) && seconds > 0) {
+              retryUntil = Date.now() + seconds * 1000;
+              clearInterval(retryTimer); retryTimer = setInterval(showRetry, 1000);
+            }
+            throw new Error(body?.error?.message || '登录失败，请稍后重试');
+          }
+          location.replace(returnTo);
+        } catch (loginError) { error.textContent = loginError.message || '登录失败，请稍后重试'; password.select(); }
+        finally { showRetry(); }
+      });
     })();
   </script>
 </body>

internal/transport/httpserver/console/styles.css

@@ -136,14 +136,18 @@ input:focus-visible,textarea:focus-visible { outline:none; }
 @media(max-width:1200px){.scope-field{flex:1;min-width:160px}.scope-note{margin-left:0}}
 @media(max-width:920px){.application-scope{gap:12px}.scope-note{flex-basis:100%;margin-top:-4px}.list-filters{grid-template-columns:145px minmax(160px,1fr)}.filter-more{grid-column:1;grid-row:2}.filter-actions{grid-column:2;grid-row:2}.login-brand{padding:40px}.login-intro h1{font-size:40px}}
 @media(max-width:640px){.application-scope{padding:14px;gap:12px}.scope-field{flex:1 1 100%;min-width:0}.scope-note{display:none}.scope-field>span{margin-bottom:5px}.list-filters{padding:16px;grid-template-columns:1fr 1fr;gap:14px}.list-filters>label{grid-column:1/-1;min-width:0!important}.filter-more{grid-column:1;grid-row:3}.filter-actions{grid-column:2;grid-row:3;gap:7px}.filter-actions button{flex:1;padding:0 11px}.filter-dates{grid-row:4;gap:14px}.filter-dates label{flex:1 1 100%;min-width:0}.filter-dates small{padding:0}.list-pagination{padding:14px 10px;gap:12px}.list-pagination>div{gap:6px}.list-pagination .select-trigger{width:65px;height:32px}.login-brand{padding:28px}.login-brand>*{width:100%;max-width:380px}.login-intro{margin:30px auto 8px}.login-intro h1{font-size:28px}.login-card{width:100%}}
-/* 工作台只滚动内容区，导航和页头保持原位；避免整页滚动、回弹及滚动条切换造成错位。 */
+/* none 同时关闭边界回弹和滚动传递；contain 仍会让 macOS 上的菜单和内容弹动。
-.console-body { height:100dvh; overflow:hidden; overscroll-behavior:none; }
+   根视口与各实际滚动容器分别设置，保留短屏导航、内容和弹层的正常滚动。 */
-.console-body .app-shell { height:100dvh; min-height:0; overflow:hidden; grid-template-rows:minmax(0,1fr); }
+.console-document, .console-body { height:100%; overflow:hidden; overscroll-behavior:none; }
-.console-body .sidebar { position:relative; height:100%; min-height:0; overscroll-behavior:contain; }
+.console-body .app-shell { position:fixed; inset:0; height:100%; min-height:0; overflow:hidden; grid-template-rows:minmax(0,1fr); }
-.console-body .main-content { height:100%; min-height:0; overflow-y:auto; overflow-x:hidden; overscroll-behavior:contain; scrollbar-gutter:stable; scroll-padding-top:100px; }
+.console-body .sidebar { position:relative; height:100%; min-height:0; overscroll-behavior:none; }
+.console-body .main-content { height:100%; min-height:0; overflow-y:auto; overflow-x:hidden; overscroll-behavior:none; scrollbar-gutter:stable; scroll-padding-top:100px; }
 .console-body .topbar { position:sticky; top:0; z-index:20; background:var(--bg); }
-@media(min-width:921px){.access-list-panel{position:sticky;top:100px;max-height:calc(100dvh - 124px);overflow:auto;overscroll-behavior:contain}}
+.console-body :is(.select-options,.table-wrap,.task-drawer,.access-dialog){overscroll-behavior:none}
-@media(max-width:640px){.console-body .app-shell{display:flex;flex-direction:column}.console-body .sidebar{height:auto;flex:0 0 auto;overflow:visible}.console-body .main-content{flex:1;scroll-padding-top:78px}.nav-list{overscroll-behavior-x:contain}}
+@media(min-width:921px){.access-list-panel{position:sticky;top:100px;max-height:calc(100dvh - 124px);overflow:auto;overscroll-behavior:none}}
+@media(max-width:640px){.console-body .app-shell{display:flex;flex-direction:column}.console-body .sidebar{height:auto;flex:0 0 auto;overflow:visible}.console-body .main-content{flex:1;scroll-padding-top:78px}.nav-list{overscroll-behavior:none}}
 @media(prefers-reduced-motion:reduce){*{scroll-behavior:auto!important;transition:none!important;animation:none!important}}
 
 @media(max-width:640px){.data-panel .table-wrap::before{content:"左右滑动查看完整表格 →";display:block;padding:0 15px 10px;color:var(--muted);font-size:10px}.retention-panel{max-width:none}}
+
+.login-audit-dialog{width:min(960px,calc(100vw - 32px))}.login-audit-dialog .table-wrap{margin:20px 0}.login-audit-dialog th,.login-audit-dialog td{padding:12px;text-align:left;white-space:nowrap}.login-audit-dialog .audit-pagination{display:flex;align-items:center;justify-content:space-between;gap:12px}

internal/transport/httpserver/console_applications.go

@@ -44,6 +44,20 @@ func RegisterConsoleApplications(server *http.Server, consoleAuth consoleauth.St
 		}
 		return token, true
 	}
+	if auditor, ok := store.(consoleauth.LoginAuditor); ok {
+		mux.HandleFunc("GET /console/auth/audit", func(w http.ResponseWriter, r *http.Request) {
+			token, ok := check(w, r)
+			if !ok {
+				return
+			}
+			out, err := auditor.ListLoginAudit(r.Context(), token, r.URL.Query().Get("before"))
+			if err != nil {
+				writeError(w, "", err)
+				return
+			}
+			writeConsoleJSON(w, 200, map[string]any{"data": out})
+		})
+	}
 	mux.HandleFunc("GET /console/applications", func(w http.ResponseWriter, r *http.Request) {
 		token, ok := check(w, r)
 		if !ok {

internal/transport/httpserver/console_auth_test.go

@@ -2,8 +2,11 @@ package httpserver
 
 import (
 	"context"
+	"errors"
+	"git.yuntuo.hk/k2safe/orbit/internal/fault"
 	"net/http"
 	"net/http/httptest"
+	"net/netip"
 	"strings"
 	"testing"
 	"time"
@@ -16,10 +19,11 @@ import (
 type fakeConsoleAuth struct {
 	valid      bool
 	login      consoleauth.LoginResult
+	loginError error
 }
 
 func (f *fakeConsoleAuth) Login(context.Context, string, string, string, string) (consoleauth.LoginResult, error) {
-	return f.login, nil
+	return f.login, f.loginError
 }
 func (f *fakeConsoleAuth) ValidateSession(context.Context, auth.Token) error {
 	if !f.valid {
@@ -82,3 +86,69 @@ func TestConsoleLoginSetsRootScopedHttpOnlyCookie(t *testing.T) {
 		t.Fatalf("cookie path/httpOnly = %q/%v", cookie.Path, cookie.HttpOnly)
 	}
 }
+
+func TestConsoleLoginRejectsWithRetryAndNoCookie(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		err    error
+		status int
+		code   string
+	}{
+		{"password", fault.Unauthorized, 401, "UNAUTHENTICATED"},
+		{"locked", &consoleauth.LoginBlocked{Locked: true, RetryAfter: 1500 * time.Millisecond}, 429, "LOGIN_LOCKED"},
+		{"rate", &consoleauth.LoginBlocked{RetryAfter: 1500 * time.Millisecond}, 429, "LOGIN_RATE_LIMITED"},
+		{"storage", errors.New("private database error"), 503, "UNAVAILABLE"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := NewWithConsoleAuth("127.0.0.1:0", nil, &fakeConsoleAuth{loginError: tc.err})
+			req := httptest.NewRequest("POST", "/console/auth/login", strings.NewReader(`{"username":"admin","password":"password-password"}`))
+			req.Header.Set("Content-Type", "application/json")
+			w := httptest.NewRecorder()
+			server.Handler.ServeHTTP(w, req)
+			if w.Code != tc.status || !strings.Contains(w.Body.String(), tc.code) || len(w.Result().Cookies()) != 0 || strings.Contains(w.Body.String(), "private database") {
+				t.Fatalf("response: %d %s", w.Code, w.Body.String())
+			}
+			if w.Code == 429 && w.Header().Get("Retry-After") != "2" {
+				t.Fatal("missing rounded Retry-After")
+			}
+		})
+	}
+}
+
+type policyConsoleAuth struct {
+	fakeConsoleAuth
+	policy consoleauth.LoginPolicy
+}
+
+func (s *policyConsoleAuth) LoginPolicy() consoleauth.LoginPolicy { return s.policy }
+func TestLoginSourceOnlyTrustsConfiguredProxyChain(t *testing.T) {
+	s := &policyConsoleAuth{policy: consoleauth.DefaultLoginPolicy()}
+	s.policy.TrustedProxies = []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8"), netip.MustParsePrefix("::1/128")}
+	for _, tc := range []struct{ peer, forward, want string }{
+		{"192.0.2.1:1234", "198.51.100.7", "192.0.2.1"},
+		{"10.0.0.1:1234", "198.51.100.7, 10.0.0.2", "198.51.100.7"},
+		{"10.0.0.1:1234", "203.0.113.99, 198.51.100.7", "198.51.100.7"},
+		{"10.0.0.1:1234", "garbage, 10.0.0.2", "10.0.0.1"},
+		{"[::1]:1234", "::ffff:192.0.2.1", "192.0.2.1"},
+	} {
+		r := httptest.NewRequest("POST", "/console/auth/login", nil)
+		r.RemoteAddr = tc.peer
+		r.Header.Set("X-Forwarded-For", tc.forward)
+		r.Header.Set("X-Real-IP", "203.0.113.123")
+		if got := loginRemoteAddress(r, s); got != tc.want {
+			t.Fatalf("%s / %s: got %s", tc.peer, tc.forward, got)
+		}
+	}
+}
+
+func TestConsoleLoginRejectsCrossSite(t *testing.T) {
+	server := NewWithConsoleAuth("127.0.0.1:0", nil, &fakeConsoleAuth{})
+	r := httptest.NewRequest("POST", "/console/auth/login", strings.NewReader(`{"username":"admin","password":"wrong"}`))
+	r.Header.Set("Content-Type", "application/json")
+	r.Header.Set("Origin", "https://evil.invalid")
+	w := httptest.NewRecorder()
+	server.Handler.ServeHTTP(w, r)
+	if w.Code != 403 || len(w.Result().Cookies()) != 0 {
+		t.Fatalf("cross-site response: %d", w.Code)
+	}
+}

internal/transport/httpserver/console_login.go

@@ -0,0 +1,57 @@
+package httpserver
+
+import (
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"net/http"
+	"net/netip"
+	"strings"
+)
+
+// loginRemoteAddress 默认只信任 TCP 对端；仅受信反代可提供 X-Forwarded-For。
+// 从右往左剥离可信跳点，遇到首个非可信地址即停止；不接受任意客户端伪造的首项。
+func loginRemoteAddress(r *http.Request, store consoleauth.Store) string {
+	peer, err := netip.ParseAddr(remoteAddress(r))
+	if err != nil {
+		return ""
+	}
+	peer = peer.Unmap()
+	policyStore, ok := store.(interface {
+		LoginPolicy() consoleauth.LoginPolicy
+	})
+	if !ok {
+		return peer.String()
+	}
+	trusted := policyStore.LoginPolicy().TrustedProxies
+	isTrusted := func(ip netip.Addr) bool {
+		for _, n := range trusted {
+			if n.Contains(ip) {
+				return true
+			}
+		}
+		return false
+	}
+	if !isTrusted(peer) {
+		return peer.String()
+	}
+	raw := strings.Join(r.Header.Values("X-Forwarded-For"), ",")
+	if raw == "" || len(raw) > 2048 {
+		return peer.String()
+	}
+	hops := strings.Split(raw, ",")
+	if len(hops) > 32 {
+		return peer.String()
+	}
+	addresses := make([]netip.Addr, len(hops))
+	for i, h := range hops {
+		a, e := netip.ParseAddr(strings.TrimSpace(h))
+		if e != nil {
+			return peer.String()
+		}
+		addresses[i] = a.Unmap()
+	}
+	current := peer
+	for i := len(addresses) - 1; i >= 0 && isTrusted(current); i-- {
+		current = addresses[i]
+	}
+	return current.String()
+}

scripts/test-console-e2e.sh

@@ -8,13 +8,14 @@ E2E_IMAGE=${ORBIT_E2E_IMAGE:-orbit:e2e}
 E2E_SUFFIX=$$
 E2E_MYSQL="orbit-e2e-mysql-$E2E_SUFFIX"
 E2E_ORBIT="orbit-e2e-server-$E2E_SUFFIX"
+E2E_ORBIT_SECOND="orbit-e2e-login-peer-$E2E_SUFFIX"
 E2E_DIR=$(mktemp -d "${TMPDIR:-/tmp}/orbit-console-e2e.XXXXXX")
 E2E_PASSWORD_FILE="$E2E_DIR/console-password"
 E2E_CREDENTIALS_FILE="$E2E_DIR/credentials.json"
 
 cleanup() {
-    "$E2E_DOCKER" stop "$E2E_ORBIT" "$E2E_MYSQL" >/dev/null 2>&1 || true
+    "$E2E_DOCKER" stop "$E2E_ORBIT_SECOND" "$E2E_ORBIT" "$E2E_MYSQL" >/dev/null 2>&1 || true
-    "$E2E_DOCKER" container rm "$E2E_ORBIT" "$E2E_MYSQL" >/dev/null 2>&1 || true
+    "$E2E_DOCKER" container rm "$E2E_ORBIT_SECOND" "$E2E_ORBIT" "$E2E_MYSQL" >/dev/null 2>&1 || true
     if [ -d "$E2E_DIR/archive-job" ]; then
         for e2e_artifact in "$E2E_DIR/archive-job"/.lock "$E2E_DIR/archive-job"/manifest.json "$E2E_DIR/archive-job"/batch-000001.json; do
             if [ -f "$e2e_artifact" ]; then unlink "$e2e_artifact"; fi
@@ -115,6 +116,9 @@ printf '%s\n' "[4/8] start Orbit container"
     --env ORBIT_MYSQL_DSN="$E2E_DSN" \
     --env ORBIT_HTTP_ADDR=0.0.0.0:8080 \
     --env ORBIT_CONSOLE_QUEUE_ID="$E2E_QUEUE" \
+    --env ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT=3 \
+    --env ORBIT_CONSOLE_LOGIN_LOCK_DURATION=10s \
+    --env ORBIT_CONSOLE_LOGIN_RATE_WINDOW=2s \
     --env ORBIT_CONSOLE_APPLICATION_ADMIN="$E2E_ADMIN" \
     --env ORBIT_CREDENTIAL_KEY_FILE=/run/credential-keys.json \
     --volume "$E2E_DIR/credential-keys.json:/run/credential-keys.json:ro" \
@@ -199,6 +203,22 @@ assert status == 200, status
 print("console_login=ok protected_page=ok")
 PY
 
+printf '%s\n' "[login] cross-node rejection, restart and recovery"
+"$E2E_DOCKER" run -d --name "$E2E_ORBIT_SECOND" --network bridge --link "$E2E_MYSQL:mysql" \
+    --env ORBIT_MYSQL_DSN="$E2E_DSN" --env ORBIT_HTTP_ADDR=0.0.0.0:8080 \
+    --env ORBIT_CONSOLE_APPLICATION_ADMIN="$E2E_ADMIN" \
+    --env ORBIT_CREDENTIAL_KEY_FILE=/run/credential-keys.json \
+    --env ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT=3 \
+    --env ORBIT_CONSOLE_LOGIN_LOCK_DURATION=10s \
+    --env ORBIT_CONSOLE_LOGIN_RATE_WINDOW=2s \
+    --volume "$E2E_DIR/credential-keys.json:/run/credential-keys.json:ro" \
+    --publish 127.0.0.1::8080 "$E2E_IMAGE" >/dev/null
+E2E_SECOND_PORT=$("$E2E_DOCKER" port "$E2E_ORBIT_SECOND" 8080/tcp | sed -n 's/.*:\([0-9][0-9]*\)$/\1/p' | head -n 1)
+ORBIT_E2E_URL="$E2E_URL" ORBIT_E2E_SECOND_URL="http://127.0.0.1:$E2E_SECOND_PORT" \
+    ORBIT_E2E_SECOND_CONTAINER="$E2E_ORBIT_SECOND" ORBIT_E2E_USER="$E2E_ADMIN" \
+    ORBIT_E2E_PASSWORD_FILE="$E2E_PASSWORD_FILE" DOCKER="$E2E_DOCKER" python3 scripts/test-console-login.py
+"$E2E_DOCKER" stop "$E2E_ORBIT_SECOND" >/dev/null
+
 printf '%s\n' "[6/8] WebSocket Worker task execution"
 (cd examples && ORBIT_URL="$E2E_URL" ORBIT_CREDENTIALS_FILE="$E2E_CREDENTIALS_FILE" \
     "$E2E_GO" run ./worker) | tee "$E2E_DIR/worker.log"

scripts/test-console-login.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""由 console-e2e 调用，在一次性双节点环境核验登录保护；不输出密码或 Cookie。"""
+import http.cookiejar
+import json
+import os
+import pathlib
+import subprocess
+import time
+import urllib.error
+import urllib.request
+
+base = os.environ['ORBIT_E2E_URL']
+peer = os.environ['ORBIT_E2E_SECOND_URL']
+username = os.environ['ORBIT_E2E_USER']
+password = pathlib.Path(os.environ['ORBIT_E2E_PASSWORD_FILE']).read_text().strip()
+jar = http.cookiejar.CookieJar()
+client = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
+
+
+def call(url, path, body=None, headers=None):
+    req = urllib.request.Request(url + path, data=None if body is None else json.dumps(body).encode(), headers={'Content-Type': 'application/json', **(headers or {})})
+    try:
+        with client.open(req, timeout=8) as response:
+            return response.status, json.load(response), response.headers
+    except urllib.error.HTTPError as response:
+        return response.code, json.load(response), response.headers
+
+
+def ready(url):
+    for _ in range(30):
+        try:
+            if call(url, '/health/ready')[0] == 200:
+                return
+        except (OSError, ValueError):
+            pass
+        time.sleep(.2)
+    raise AssertionError('test peer not ready')
+
+
+ready(peer)
+assert call(base, '/console/auth/login', {'username': username, 'password': password})[0] == 200
+for url in (base, peer):
+    status, data, headers = call(url, '/console/auth/login', {'username': username, 'password': 'wrong-test-only'})
+    assert status == 401 and not headers.get('Set-Cookie'), status
+status, data, headers = call(base, '/console/auth/login', {'username': username, 'password': 'wrong-test-only'})
+assert status == 429 and data['error']['code'] == 'LOGIN_LOCKED' and int(headers['Retry-After']) > 0
+assert not headers.get('Set-Cookie')
+assert call(peer, '/console/auth/session')[1]['authenticated'] is True, 'lock killed existing session'
+status, body, _ = call(peer, '/console/auth/audit')
+assert status == 200 and any(e['outcome'] == 'LOCKED' for e in body['data']['items'])
+until = next(e['retry_at'] for e in body['data']['items'] if e['outcome'] == 'LOCKED')
+subprocess.run([os.environ.get('DOCKER', 'docker'), 'restart', os.environ['ORBIT_E2E_SECOND_CONTAINER']], check=True, stdout=subprocess.DEVNULL)
+# 随机发布端口在 Docker 重启后可能重新分配，读取实际端口再验证同一节点。
+published = subprocess.check_output([os.environ.get('DOCKER', 'docker'), 'port', os.environ['ORBIT_E2E_SECOND_CONTAINER'], '8080/tcp'], text=True).strip().splitlines()[0]
+peer = 'http://127.0.0.1:' + published.rsplit(':', 1)[1]
+ready(peer)
+status, data, headers = call(peer, '/console/auth/login', {'username': username, 'password': password}, {'X-Forwarded-For': '203.0.113.88'})
+assert status == 429 and data['error']['code'] == 'LOGIN_LOCKED', 'restart bypassed lock'
+body = call(base, '/console/auth/audit')[1]
+latest = body['data']['items'][0]
+assert latest['retry_at'] == until and latest['remote_ip'] != '203.0.113.88', 'lock extended or untrusted header accepted'
+# 仅按真实返回的截止等待；不修改数据库时间或删除锁定记录。
+time.sleep(int(headers['Retry-After']) + .1)
+assert call(peer, '/console/auth/login', {'username': username, 'password': password})[0] == 200
+body = call(base, '/console/auth/audit')[1]
+assert body['data']['items'][0]['outcome'] == 'SUCCESS'
+assert password not in json.dumps(body)
+print('console_login_security=passed cross_node=locked restart=locked existing_session=valid forged_ip=ignored expiry=success audit=confirmed')