From aba8a8174da249753c3f1aa08ae69c365e46825e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <Dorowolf314@gmail.com>
Date: Sat, 21 Dec 2024 19:47:40 +0800
Subject: [PATCH 01/18] Update server.py

---
 modules/mcserver/server.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/mcserver/server.py b/modules/mcserver/server.py
index e54807aaed..824661d544 100644
--- a/modules/mcserver/server.py
+++ b/modules/mcserver/server.py
@@ -13,7 +13,7 @@ async def query_java_server(
 ) -> str:
     match_object = re.match(r"(.*)[\s:](\d*)", address, re.M | re.I)
     serip = match_object.group(1) if match_object else address
-    port = int(match_object.group(2)) if match_object else 25565
+    port = match_object.group(2)if match_object else 25565
     servers = []
 
     try:
@@ -65,7 +65,7 @@ async def query_java_server(
 async def query_bedrock_server(msg, address, raw=False):
     match_object = re.match(r"(.*)[\s:](\d*)", address, re.M | re.I)
     serip = match_object.group(1) if match_object else address
-    port = int(match_object.group(2)) if match_object else 19132
+    port = match_object.group(2) if match_object else 19132
     servers = []
 
     try:

From 1b8afc75502dcc03d393633eaca85254b0d0a4e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <Dorowolf314@gmail.com>
Date: Sun, 22 Dec 2024 00:12:06 +0800
Subject: [PATCH 02/18] Create nightly-build.yml

Delete .github/workflows/weekly-release.yml
---
 .../workflows/docker-build-and-publish.yml    |  8 ++--
 .github/workflows/nightly-build.yml           | 39 +++++++++++++++++++
 .github/workflows/weekly-release.yml          | 22 -----------
 3 files changed, 43 insertions(+), 26 deletions(-)
 create mode 100644 .github/workflows/nightly-build.yml
 delete mode 100644 .github/workflows/weekly-release.yml

diff --git a/.github/workflows/docker-build-and-publish.yml b/.github/workflows/docker-build-and-publish.yml
index 688ef7f642..1f35156357 100644
--- a/.github/workflows/docker-build-and-publish.yml
+++ b/.github/workflows/docker-build-and-publish.yml
@@ -1,9 +1,9 @@
-name: Docker Build and Publish
+name: "Docker Build and Publish (3:00, UTC+8)"
 
 on:
-  push:
-    branches: [master]
-
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
new file mode 100644
index 0000000000..c9ddb91a5d
--- /dev/null
+++ b/.github/workflows/nightly-build.yml
@@ -0,0 +1,39 @@
+name: "Nightly Build and Release (3:00, UTC+8)"
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  nightly:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Delete and recreate nightly tag
+        run: |
+          if git rev-parse refs/tags/nightly >/dev/null 2>&1; then
+            git tag -d nightly
+            git push origin --delete nightly
+          fi
+          git tag nightly
+          git push origin nightly
+
+      - name: Update release version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          release_exists=$(gh release list --json tagName --jq '.[] | select(.tagName=="nightly") | .tagName')
+          if [ -n "$release_exists" ]; then
+            gh release delete nightly -y
+          fi
+          gh release create nightly \
+            --title "Nightly Release" \
+            --notes "> 这是 Nightly 版本，由于无法及时同步代码和验证版本的稳定性，本项目已不再提供正式版本。请点击 Assets -> Source code 下载当前最新源代码。"
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
deleted file mode 100644
index 25fa8e6fda..0000000000
--- a/.github/workflows/weekly-release.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: "Weekly Release"
-
-on:
-  schedule:
-    - cron: "0 0 * * 1"
-  workflow_dispatch:
-
-jobs:
-  weekly-release:
-    name: Weekly Release
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: master
-
-      - uses: rui-costa/action-automatic-semver-releases@v1
-        with:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SEMVER: PATCH

From dad5f12efe032aa5ce395ff92ff41cca31c928a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Tue, 24 Dec 2024 11:23:53 +0800
Subject: [PATCH 03/18] locale

---
 modules/nintendo_err/__init__.py        | 31 +++++++------------------
 modules/nintendo_err/locales/zh_cn.json |  7 ++++++
 2 files changed, 16 insertions(+), 22 deletions(-)
 create mode 100644 modules/nintendo_err/locales/zh_cn.json

diff --git a/modules/nintendo_err/__init__.py b/modules/nintendo_err/__init__.py
index 20e01bc751..46cbaed48a 100644
--- a/modules/nintendo_err/__init__.py
+++ b/modules/nintendo_err/__init__.py
@@ -75,35 +75,22 @@ def is_hex(user_input):
     @staticmethod
     def check_meme(err: str) -> str:
         memes = {
-            "0xdeadbeef": "都坏掉了，不能吃了。",
-            "0xdeadbabe": "我觉得你有问题。",
-            "0x8badf00d": "记得垃圾分类。",
+            "0xdeadbeef": "nintendo_err.message.meme.0xdeadbeef",
+            "0xdeadbabe": "nintendo_err.message.meme.0xdeadbabe",
+            "0x8badf00d": "nintendo_err.message.meme.0xbadf00d",
         }
         return memes.get(err.casefold())
 
 
-e = module("err", developers=["OasisAkari", "kurisu"], doc=True)
+e = module("nintendo_err", alias=["err"], developers=["OasisAkari", "kurisu"], doc=True)
 
 
-@e.command("<errcode> {解析任天堂系列主机的报错码并给出原因。}")
-async def _(msg: Bot.MessageSession):
-    """
-    Displays information on game console result codes, with a fancy embed.
-    0x prefix is not required for hex input.
-
-    Examples:
-      .err 0xD960D02B
-      .err D960D02B
-      .err 022-2634
-      .err 102-2804
-      .err 2168-0002
-      .err 2-ARVHA-0000
-    """
+@e.command("<err_code> {{nintendo_err.help}}")
+async def _(msg: Bot.MessageSession, err_code: str):
     results = Results()
-    err = msg.parsed_msg["<errcode>"]
-    err = results.fixup_input(err)
+    err = results.fixup_input(err_code)
     if meme := results.check_meme(err):
-        await msg.finish(meme)
+        await msg.finish(msg.locale.t(meme))
     try:
         ret = results.fetch(err)
     except ValueError:
@@ -117,4 +104,4 @@ async def _(msg: Bot.MessageSession):
             embed.add_field(name=field.field_name, value=field.message, inline=False)
         await msg.finish(convert_discord_embed(embed))
     else:
-        await msg.finish("你输入的代码是无效的，或者此功能不支持你使用的主机。")
+        await msg.finish(msg.locale.t("nintendo_err.message.invalid"))
diff --git a/modules/nintendo_err/locales/zh_cn.json b/modules/nintendo_err/locales/zh_cn.json
new file mode 100644
index 0000000000..d318354d52
--- /dev/null
+++ b/modules/nintendo_err/locales/zh_cn.json
@@ -0,0 +1,7 @@
+{
+"nintendo_err.help": "解析任天堂系列主机的报错码并给出原因。",
+"nintendo_err.message.invalid": "你输入的代码是无效的，或者此功能不支持你使用的主机。",
+"nintendo_err.message.meme.0xdeadbeef": "都坏掉了，不能吃了。",
+"nintendo_err.message.meme.0xdeadbabe": "我觉得你有问题。",
+"nintendo_err.message.meme.0xbadf00d": "记得垃圾分类。"
+}
\ No newline at end of file

From 3707eee05edb868fd691467ecd1ecb488f5b3ffe Mon Sep 17 00:00:00 2001
From: yzhh <31803608+OasisAkari@users.noreply.github.com>
Date: Tue, 24 Dec 2024 22:27:55 +0800
Subject: [PATCH 04/18] u

---
 .gitignore                    |  5 ++++-
 bots/discord/slash_message.py | 11 -----------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/.gitignore b/.gitignore
index 14d5388277..1e657cde77 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,7 +8,10 @@ config/*.toml*
 test*
 *.db
 cache/*
+assets/arcaea*
+assets/maimai*
 assets/modules/arcaea
+assets/arc.apk
 assets/modules/maimai*
 !assets/modules/maimai/mai_utage_info.json
 !assets/modules/maimai/mai_grade_info.json
@@ -27,4 +30,4 @@ output/*
 assets/bots_list.json
 assets/discord_slash_list.json
 assets/modules_list.json
-assets/schedulers_list.json
\ No newline at end of file
+assets/schedulers_list.json
diff --git a/bots/discord/slash_message.py b/bots/discord/slash_message.py
index 45ba32f364..1617b8e33f 100644
--- a/bots/discord/slash_message.py
+++ b/bots/discord/slash_message.py
@@ -101,17 +101,6 @@ async def send_message(
 
         return FinishedSession(self, msg_ids, send)
 
-    async def check_permission(self):
-        if (
-            self.session.message.channel.permissions_for(
-                self.session.message.author
-            ).administrator
-            or isinstance(self.session.message.channel, discord.DMChannel)
-            or self.info.is_super_user
-            or self.info.check_TargetAdmin(self.target.target_id)
-        ):
-            return True
-        return False
 
     async def check_native_permission(self):
         if self.session.message.channel.permissions_for(

From 805657a87b331c4c2bcbb734babed88bb1bc387f Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 25 Dec 2024 15:28:00 +0800
Subject: [PATCH 05/18] Update dependency jinja2 to v3.1.5 [SECURITY] (#1506)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 poetry.lock      | 6 +++---
 requirements.txt | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index eb399fb1be..638d2b7e9e 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1628,13 +1628,13 @@ test = ["portend", "pytest (>=6,!=8.1.*)", "pytest-checkdocs (>=2.4)", "pytest-c
 
 [[package]]
 name = "jinja2"
-version = "3.1.4"
+version = "3.1.5"
 description = "A very fast and expressive template engine."
 optional = false
 python-versions = ">=3.7"
 files = [
-    {file = "jinja2-3.1.4-py3-none-any.whl", hash = "sha256:bc5dd2abb727a5319567b7a813e6a2e7318c39f4f487cfe6c89c6f9c7d25197d"},
-    {file = "jinja2-3.1.4.tar.gz", hash = "sha256:4a3aee7acbbe7303aede8e9648d13b8bf88a429282aa6122a993f0ac800cb369"},
+    {file = "jinja2-3.1.5-py3-none-any.whl", hash = "sha256:aba0f4dc9ed8013c424088f68a5c226f7d6097ed89b246d7749c2ec4175c6adb"},
+    {file = "jinja2-3.1.5.tar.gz", hash = "sha256:8fefff8dc3034e27bb80d67c671eb8a9bc424c0ef4c0826edbff304cceff43bb"},
 ]
 
 [package.dependencies]
diff --git a/requirements.txt b/requirements.txt
index e79799b3a2..f8398a97f7 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -62,7 +62,7 @@ inputimeout==1.0.4 ; python_full_version >= "3.12.0" and python_full_version < "
 iso639-lang==2.5.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 itsdangerous==2.2.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 jaraco-context==6.0.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
-jinja2==3.1.4 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
+jinja2==3.1.5 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 jiter==0.7.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 jsonpatch==1.33 ; python_full_version >= "3.12.0" and python_version < "4.0"
 jsonpointer==3.0.0 ; python_full_version >= "3.12.0" and python_version < "4.0"

From 8b2929ff89aa30ef22f8528e92baafd59b089d13 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 25 Dec 2024 15:28:09 +0800
Subject: [PATCH 06/18] Bump jinja2 from 3.1.4 to 3.1.5 (#1505)

Bumps [jinja2](https://github.com/pallets/jinja) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](https://github.com/pallets/jinja/compare/3.1.4...3.1.5)

---
updated-dependencies:
- dependency-name: jinja2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 poetry.lock    | 4 ++--
 pyproject.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 638d2b7e9e..ea5dc18bd1 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.4 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
 [[package]]
 name = "aiocqhttp"
@@ -4537,4 +4537,4 @@ propcache = ">=0.2.0"
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12.0"
-content-hash = "78bd3610a1b3fc1005ea68cf7bf4f181df6a14bc9cfacef8ede379835fc559c5"
+content-hash = "9c98494aec57da701cba72db281f4a589564bb45d66a324c3f468aba2dfeebed"
diff --git a/pyproject.toml b/pyproject.toml
index c3ea64953e..0ae82b4362 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -64,7 +64,7 @@ emoji = "^2.12.1"
 langconv = {git = "https://github.com/OasisAkari/langconv.py.git"}
 ff3 = "^1.0.2"
 orjson = "^3.10.9"
-jinja2 = "^3.1.4"
+jinja2 = "^3.1.5"
 mcstatus = "^11.1.1"
 qq-botpy = "^1.2.1"
 botpy = {git = "https://github.com/Teahouse-Studios/botpy.git"}

From d0e3dccfc3078a46bcaa262861e71cb2071b0e29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Fri, 27 Dec 2024 14:10:02 +0800
Subject: [PATCH 07/18] remove jwt

---
 assets/config_store/en_us/bot_api.toml   |   4 --
 assets/config_store/en_us/bot_qqbot.toml |   2 +-
 assets/config_store/en_us/config.toml    |   6 +-
 assets/config_store/zh_cn/bot_api.toml   |   4 --
 assets/config_store/zh_tw/bot_api.toml   |   4 --
 assets/config_store/zh_tw/config.toml    |   6 +-
 assets/config_store_packed/en_us.zip     | Bin 14840 -> 14530 bytes
 assets/config_store_packed/zh_cn.zip     | Bin 13513 -> 13254 bytes
 assets/config_store_packed/zh_tw.zip     | Bin 13480 -> 13227 bytes
 bots/api/bot.py                          |  72 ++++++++++++++++++++---
 core/config/update.py                    |   1 -
 core/locales/en_us.json                  |   1 -
 core/locales/zh_cn.json                  |   1 -
 core/locales/zh_tw.json                  |   1 -
 modules/core/utils.py                    |  23 --------
 poetry.lock                              |  24 +-------
 pyproject.toml                           |   1 -
 requirements.txt                         |   1 -
 18 files changed, 72 insertions(+), 79 deletions(-)

diff --git a/assets/config_store/en_us/bot_api.toml b/assets/config_store/en_us/bot_api.toml
index b4a89e255c..d1f2b3c011 100644
--- a/assets/config_store/en_us/bot_api.toml
+++ b/assets/config_store/en_us/bot_api.toml
@@ -2,10 +2,6 @@
 # NOTE: TOML is not like Python. Do not use Python syntax here.
 # EXAMPLE: Boolean values in TOML must be lowercase.
 
-[bot_api_secret]
-# The secret config section of the platform. The bot will try to intercept if the value here accidentally appears in the message sent, but be careful to prevent leakage.
-jwt_secret = "<Replace me with str value>" # The authentication key for the built-in API, it can be filled in at will.
-
 [bot_api]
 # The basic config section of the platform. The value ​​filled in here can be displayed in the message. Please do not fill in sensitive information in this section.
 enable = true # Whether to enable this platform.
diff --git a/assets/config_store/en_us/bot_qqbot.toml b/assets/config_store/en_us/bot_qqbot.toml
index 027492b99f..0bb4575a5b 100644
--- a/assets/config_store/en_us/bot_qqbot.toml
+++ b/assets/config_store/en_us/bot_qqbot.toml
@@ -6,7 +6,7 @@
 # The basic config section of the platform. The value ​​filled in here can be displayed in the message. Please do not fill in sensitive information in this section.
 qq_bot_appid = "<Replace me with (int, str) value>" # The QQ official robot AppID.
 enable = false # Whether to enable this platform.
-qq_private_bot = false # Whether it is a private robot when using the QQ official robot.
+qq_private_bot = false # Whether it is a private robot when using the QQ official bot.
 qq_bot_enable_send_url = false # Whether to enable sending URLs when using QQ official robot.
 qq_typing_emoji = 181 # When using QQ related protocol terminals, the response emoji ID attached to the message when processing the message. It needs to be supported by the protocol terminal. For details of emoji ID, see: https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji
 
diff --git a/assets/config_store/en_us/config.toml b/assets/config_store/en_us/config.toml
index 8c2af14049..179070552e 100644
--- a/assets/config_store/en_us/config.toml
+++ b/assets/config_store/en_us/config.toml
@@ -57,7 +57,7 @@ dice_output_len = 200 # The maximum length output of dice module.
 dice_roll_limit = 10 # The maximum number of dice rolled per command of dice module.
 dice_detail_count = 5 # The total number of dice rolled n times of dice module, it will no longer show details when this value is exceeded.
 dice_count_limit = 10 # The maximum number of items in dice expressions of dice module.
-ncmusic_enable_card = false # Whether enables card messages of ncmusic module. (Only valid on QQ platform)
+ncmusic_enable_card = false # Whether enables card messages of ncmusic module. (Only valid on QQ)
 wiki_whitelist_url = "<Replace me with str value>" # Wiki whitelist application URL.
 wordle_disable_image = false # Whether to disable images of wordle module.
 slower_schedule = false # Whether to enable a slower scheduled task scheduler. (To reduce request pressure)
@@ -73,8 +73,8 @@ ff3_tweak = "1E915EC4922E78" # The key tweak used to encrypt sensitive informati
 web_render = "<Replace me with str value>" # WebRender service URL.
 openai_api_key = "<Replace me with str value>" # OpenAI API Key. (For ask modules etc.)
 exchange_rate_api_key = "<Replace me with str value>" # API Key for ExchangeRate-API. (For exchange_rate module and exchange rate calculation)
-wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha AppID. (For wolframalpha module)
+wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha 的 AppID。（用于 wolframalpha 模块）
 diving_fish_developer_token = "<Replace me with str value>" # Developer token for Diving Fish prober. (For maimai module)
 curseforge_api_key = "<Replace me with str value>" # CurseForge API key. (For mod_dl module)
 ncmusic_api = "<Replace me with str value>" # API address of NetEase Cloud Music API. (For ncmusic module)
-osu_api_key = "<Replace me with str value>" # osu! API Key (for osu module)
+osu_api_key = "<Replace me with str value>" # Osu! API Key (for osu module)
diff --git a/assets/config_store/zh_cn/bot_api.toml b/assets/config_store/zh_cn/bot_api.toml
index c879b46dee..778eed465a 100644
--- a/assets/config_store/zh_cn/bot_api.toml
+++ b/assets/config_store/zh_cn/bot_api.toml
@@ -2,10 +2,6 @@
 # 注意：TOML 不是 Python。请不要在此处使用 Python 语法。
 # 例如：TOML 中的布尔值必须是小写。
 
-[bot_api_secret]
-# 平台端的密钥配置部分，此处的值若意外出现在发送的消息中，机器人会尝试拦截。但请务必提防泄露。
-jwt_secret = "<Replace me with str value>" # 内置 API 的认证密钥，随意填写即可。
-
 [bot_api]
 # 平台端的配置部分，此处填写的值可在消息中以明文形式展示。请不要在此部分填写敏感信息。
 enable = true # 是否启用此平台。
diff --git a/assets/config_store/zh_tw/bot_api.toml b/assets/config_store/zh_tw/bot_api.toml
index abd835d404..8ee0f86e36 100644
--- a/assets/config_store/zh_tw/bot_api.toml
+++ b/assets/config_store/zh_tw/bot_api.toml
@@ -2,10 +2,6 @@
 # 注意：TOML 不是 Python。請不要在此處使用 Python 語法。
 # 例如：TOML 中的布林值必須是小寫。
 
-[bot_api_secret]
-# 平台端的金鑰設定部分，此處的值若意外出現在傳送的訊息中，機器人會嘗試攔截。但請務必提防洩漏。
-jwt_secret = "<Replace me with str value>" # 內建 API 的認證金鑰，隨意填寫即可。
-
 [bot_api]
 # 平台端的設定部分，此處填寫的值可在訊息中以明文顯示。請不要在此部分填寫敏感資訊。
 enable = true # 是否啟用此平台。
diff --git a/assets/config_store/zh_tw/config.toml b/assets/config_store/zh_tw/config.toml
index ea0a47f760..86eaab2bc4 100644
--- a/assets/config_store/zh_tw/config.toml
+++ b/assets/config_store/zh_tw/config.toml
@@ -35,7 +35,7 @@ enable_get_petal = false # 是否允許取得花瓣。
 gained_petal_limit = 0 # 單日取得花瓣上限。
 lost_petal_limit = 0 # 單日失去花瓣上限。
 use_secrets_random = false # 是否使用基於 secrets 庫的隨機數產生器。
-web_render_local = "<Replace me with str value>" # 本地 WebRender 位址。
+web_render_local = "<Replace me with str value>" # 本地 WebRender 服務位址。
 enable_langsmith = "<Replace me>"
 langsmith_endpoint = "<Replace me>"
 langsmith_project = "<Replace me>"
@@ -59,7 +59,7 @@ dice_detail_count = 5 # dice 模組 n 次投擲的骰子的總量超過該值時
 dice_count_limit = 10 # dice 模組骰子表示式項數上限。
 ncmusic_enable_card = false # ncmusic 模組是否啟用卡片訊息。（僅在 QQ 平台有效）
 wiki_whitelist_url = "<Replace me with str value>" # Wiki 白名單申請網址。
-wordle_disable_image = false # wordle 模組是否停用圖片。
+wordle_disable_image = false # wordle 模块是否禁用图片。
 slower_schedule = false # 是否啟用更慢的排程任務調度器。（減少請求壓力用）
 
 [secret]
@@ -77,4 +77,4 @@ wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha 的 AppID。
 diving_fish_developer_token = "<Replace me with str value>" # Diving Fish 查分器的開發者令牌。（用於 maimai 模組）
 curseforge_api_key = "<Replace me with str value>" # CurseForge 的 API Key。（用於 mod_dl 模組）
 ncmusic_api = "<Replace me with str value>" # 網易雲音樂 API 的 API 位址。（用於 ncmusic 模組）
-osu_api_key = "<Replace me with str value>" # osu! 的 API Key。（用於 osu 模組）
+osu_api_key = "<Replace me with str value>" # osu! 的 API Key。（用于 osu 模块）
diff --git a/assets/config_store_packed/en_us.zip b/assets/config_store_packed/en_us.zip
index 55b1ec5619064901cc56e8343a7c09408c42ad60..db6f6d0c6992c64b87aaa55d19437ade223debe5 100644
GIT binary patch
delta 440
zcmexSe5jB&z?+#xgaHKp6wKbpYr(+`q&ItTY-8dBG9s_D@6z1D$iT3LaWW70hRvUO
z6d1t@#Q3%_ff;87mO>b%!f`CTAT3FrjlPFi7#I$1ejskmv{_ba853As^yH@t3epS=
z3Y#y;%oW~TW^k2N=lQG_1;>H{PnX9HP4D+~JfE`S$*w+y^8B2%qQu<9oPvx*g=Z@k
zKAk)L{hrRv*=D7TjQ*1!nrne<p3G-q3#R=ntkIo1-9jf0<dju=lU8&xF))Cz0N9fd
zVq4=S9tMV_{F3;T%;Mzyq7=Q7{M?)XZ$>5&26$jZp1f}0Sqsz&!n`QDJNYLoT1ta$
zx3`pLG8CE|V=1eE;(1^I@S*6LBsO`brHnI35j-S-p}~!!r~xRFoS&DLnGSUkD;r3j
O0|*}jW8tJ3hz9_hnU6C7

delta 455
zcmX?9_@kINz?+#xgaHKFCQsPNYr(+`q&ItTY-8dBG9u+p{oM1KiGkrY(_|j*4U_+~
zZDr0XFPXf-P)|Lvv?L=nuOu@$u_QA;Pa!+CQXwtBNC7CQkW`wPQ=*%hr{EaiIeC|e
z`sSV7%8X!x@AGV70yC!ZFNHAdgyL9uK~`;IWl}l9!oYB3^GY#mCZ?kN%}*qjF@dF6
zcj;HlN;5FXZk{eZSC~_wASbZ|XjkrL6aA~K3XTN@o-TR{8g4+_%ky*6iV|}Za|$vN
z6>{@aN^?>*H=CN4GBV~*UTvlYvU>6jGg~k%VQ!7?$3$}-u+#)|X(mp-$!pE!z}#~{
z?g4?xug#^wTuuw=`V3(PhNS$G_}s*jqRa}tlKkA90B=Sn5e9f*B0L226dyQ<A;h-E
mlj0D~g@r&Pu<C{T80c$m6umoT7#NcCCoi^;WczOpk^umzwvfC4

diff --git a/assets/config_store_packed/zh_cn.zip b/assets/config_store_packed/zh_cn.zip
index b1bc15648d4c9819302df532b8489d286df4b539..5d0fd22d198b8caad88ddc58e95f7b1207dffc43 100644
GIT binary patch
delta 347
zcmX?^c`Thbz?+#xgaHJ87tG$s`-Y7fNN@hbR>33<WJL1HPrlX2$iM)?JU~TB`6cm*
z1(}l_d6rMM<bDZOtjbfy1ZK?RONTHx1YKCbBL1Se5XOE<SxJz{<oiapU|QbTnh({2
z$r;8v^&p{zm#QSanHU&ASODxa2(hhElpErLl+5Df{Gt@SlKkA90B=Sn5eB#yB9}f{
zY+(=73BtT6y8D1!ko&Xq^RuyPEtH%rY$Cz*gMYHFi7eQaz9!O4_9BzBOk}{^P7`U>
e^%4vW$@zI{ndwk7SlK|fZ~)<BU?80}1n~et^k(t^

delta 406
zcmX?>eln9cz?+#xgaHKFCQsPN`-Y7fNN@hbR>33<WJCtrYg@K3F))BI4^UB3eo1^{
zLFQxyf#u8~daw8l=B)CP$#ZnH^q;o1KHs}e!7;#7;rXnV7weY1Sl{?`ecQ`POW*J5
zc{!{9Sxf)Zg{z;o&3xLs`Dy?9$y!`r!Imj;mob4Evw71Y3|0Xb7O;qqNG^o2M?zK-
zBr^Gqp)Ht}F|y`Eb>QSwBOL{h(85bqlHNe~g0KMCYY<{vqXf_7jYe`{MN6M7wy*~(
z0AXGfMHBfZzc-QwTf%EB&GcJfvX-$dnCoRMo#-SA353EzU{L6l<mcuDcr!AIFu=nw
s^0!>L=~oE`1`y^(F?o|D14D9tURq{4R3j@JNS*@-A2TvATrdLh0G=p<{{R30

diff --git a/assets/config_store_packed/zh_tw.zip b/assets/config_store_packed/zh_tw.zip
index 90e69be32be45057bf307d64f17d6cd9d268cf3f..bc99acdad485813e0c557a4045bda597e4be98c5 100644
GIT binary patch
delta 408
zcmZ3HxjLOUz?+#xgaHJ87tG$s`;?6tNN@hiR>Z^yWJIP3*#50!WMHUcoLtJeeX>6H
zW3ap^PXQB{(ZQDpVZ0G=WC4p9h-R?xg0x2c>R<6sf`Q@R=B1J!x!Io0>3!NgbMrJ+
zGd7{8bEiL>vHt0VWzUy2KA*DU>Fj-*?`iL2Q+l$iPa(g!RN>i*g+L|m_jK}d1$Z+u
zi7>!jIC-CuEy$Y5|BS5B9q4YX69=+*`hg8@u1pLJAS?j(8id%^$jZ&Ykd$8%pORUe
zoL`ipSCXHbgJwbGvH$#cEP*;fm={HN1@GjG#?oNh-y2Ia-Ql0iV<HRY>X=9~DTqw=
rG?8&e@j1}<KpWv;TVpp+Bso7XEi)ZzH!B-RmIDYM14DU}A&3V6FU^ZM

delta 451
zcmZ3Tz9N%1z?+#xgaHKFCQsPN`;?6tNN@hiR>Z^yWJEseUDVyk#K6$VG`W;>`{aLo
zGnli=OD0dy(b9j~y8P+xT?&o?o(j)rwY*r>`(kb9%l3&cCvJGZr|0FY70+7wpDtYe
zbp7h5y_=u*ub(W-^$BdY5O)C+n9<6c2w}YBcVq#J=!#^pNP(<n5vV%$LxO<;gt>uk
zOU}<r%S@jv$i8TEprjM`=9wyHY(meswmh4${^^8ePaEevpR(fVoN1dMYVBiFdNys3
zLVj_n!m||%flA)*>Ez`K@MdHZVSxK{@<BsekcE>OjjYkV>1Ct?mZ~(8X5!$PJk3Zh
z8sws5|M~A&0s{hsdBNcYA+|ME^D!_a<(I@~=jUhZmE`B<pjj5#7H#Du&ceU|!u%*&
q?+Z-kH<krkr*ACHq%1nw$5=)ITL8ecZENh4oZMk7%eLMKBm@9oXrB52

diff --git a/bots/api/bot.py b/bots/api/bot.py
index 25d64fa228..349d1d2a66 100644
--- a/bots/api/bot.py
+++ b/bots/api/bot.py
@@ -1,10 +1,15 @@
+from datetime import datetime
 import os
+import platform
 import sys
 import time
 
-import jwt
+import hashlib
+import psutil
 import uvicorn
-from fastapi import FastAPI, Request
+from cpuinfo import get_cpu_info
+from fastapi import FastAPI, Request, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 
 from bots.api.info import client_name
@@ -15,7 +20,9 @@
 sys.path.append(os.getcwd())
 
 from core.bot_init import init_async  # noqa: E402
+from core.builtins import PrivateAssets  # noqa: E402
 from core.config import Config  # noqa: E402
+from core.constants.path import assets_path  # noqa: E402
 from core.database import BotDBUtil  # noqa: E402
 from core.extra.scheduler import load_extra_schedulers  # noqa: E402
 from core.loader import ModulesManager  # noqa: E402
@@ -24,8 +31,23 @@
 from modules.wiki.utils.dbutils import WikiTargetInfo  # noqa: E402
 
 
+PrivateAssets.set(os.path.join(assets_path, "private", "api"))
 app = FastAPI()
-jwt_secret = Config("jwt_secret", cfg_type=str, secret=True, table_name="bot_api")
+started_time = datetime.now()
+
+origins = [
+    "http://localhost:8080",  # Vue 前端的地址
+    "http://127.0.0.1:8080",  # 如果是从本地开发环境发出的请求
+]
+
+# 将 CORSMiddleware 中间件添加到 FastAPI 应用
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=origins,  # 允许的源
+    allow_credentials=True,
+    allow_methods=["*"],    # 允许所有 HTTP 方法（GET、POST 等）
+    allow_headers=["*"],    # 允许所有 HTTP 头
+)
 
 
 @app.on_event("startup")
@@ -37,12 +59,44 @@ async def startup_event():
     await JobQueue.web_render_status()
 
 
-@app.get("/auth/{token}")
-async def auth(token: str):
-    try:
-        return jwt.decode(token, jwt_secret, algorithms=["HS256"])
-    except jwt.InvalidSignatureError:
-        return JSONResponse(status_code=403, content={"token": token, "invalid": True})
+@app.post("/auth")
+async def auth(request: Request):
+    password_path = os.path.join(PrivateAssets.path, ".password")
+    if not os.path.exists(password_path):
+        return {"message": "success"}
+
+    with open(password_path, "r") as file:
+        stored_password = file.read().strip()
+
+    body = await request.json()
+    password = body["password"]
+    password = hashlib.sha256(password.encode()).hexdigest()
+    if stored_password != password:
+        raise HTTPException(status_code=401, detail="Invalid password")
+    return {"message": "success"}
+
+
+@app.get("/serverinfo")
+async def get_server_info():
+    timediff = str(datetime.now() - started_time).split(".")[0]
+    python_version = str(platform.python_version())
+    cpu_brand = get_cpu_info()["brand_raw"]
+    cpu_usage = psutil.cpu_percent()
+    ram = int(psutil.virtual_memory().total / (1024 * 1024))
+    swap = int(psutil.swap_memory().total / (1024 * 1024))
+    disk = int(psutil.disk_usage("/").used / (1024 * 1024 * 1024))
+    disk_total = int(psutil.disk_usage("/").total / (1024 * 1024 * 1024))
+    return {
+        "message": "Success",
+        "timeDiff": timediff,
+        "pythonVersion": python_version,
+        "cpuBrand": cpu_brand,
+        "cpuUsage": cpu_usage,
+        "ram": ram,
+        "swap": swap,
+        "disk": disk,
+        "diskTotal": disk_total,
+    }
 
 
 @app.get("/target/{target_id}")
diff --git a/core/config/update.py b/core/config/update.py
index 1339b526e1..efd763adf2 100644
--- a/core/config/update.py
+++ b/core/config/update.py
@@ -194,7 +194,6 @@ def bot_add_enabled_flag(cls):
         Reorganize.table = 'api'
         Reorganize.bot_add_enabled_flag()
         Reorganize.reorganize_bot_key('api_port')
-        Reorganize.reorganize_bot_key('jwt_secret', True)
 
         # discord
 
diff --git a/core/locales/en_us.json b/core/locales/en_us.json
index 7d5cedad9e..325a609192 100644
--- a/core/locales/en_us.json
+++ b/core/locales/en_us.json
@@ -35,7 +35,6 @@
     "config.comments.help_url": "Help document URL.",
     "config.comments.ignored_sender": "Ignore user list. Users matching this list will be ignored.",
     "config.comments.issue_url": "Issue feedback URL.",
-    "config.comments.jwt_secret": "The authentication key for the built-in API, it can be filled in at will.",
     "config.comments.kook_token": "KOOK bot token.",
     "config.comments.locale_url": "Localized project URL.",
     "config.comments.lost_petal_limit": "The maximum number of petals users can lose per day.",
diff --git a/core/locales/zh_cn.json b/core/locales/zh_cn.json
index 58e3f46454..8e637319fd 100644
--- a/core/locales/zh_cn.json
+++ b/core/locales/zh_cn.json
@@ -35,7 +35,6 @@
     "config.comments.help_url": "帮助文档网址。",
     "config.comments.ignored_sender": "无视的用户列表，匹配到此列表中的用户将会被忽略。",
     "config.comments.issue_url": "问题反馈网址。",
-    "config.comments.jwt_secret": "内置 API 的认证密钥，随意填写即可。",
     "config.comments.kook_token": "KOOK 机器人令牌。",
     "config.comments.locale_url": "本地化项目网址。",
     "config.comments.lost_petal_limit": "单日失去花瓣上限。",
diff --git a/core/locales/zh_tw.json b/core/locales/zh_tw.json
index 6308cb31fd..7efb40308f 100644
--- a/core/locales/zh_tw.json
+++ b/core/locales/zh_tw.json
@@ -35,7 +35,6 @@
     "config.comments.help_url": "線上說明文件網址。",
     "config.comments.ignored_sender": "無視的使用者列表，匹配到此列表中的使用者將會被忽略。",
     "config.comments.issue_url": "問題報告網址。",
-    "config.comments.jwt_secret": "內建 API 的認證金鑰，隨意填寫即可。",
     "config.comments.kook_token": "KOOK 機器人令牌。",
     "config.comments.locale_url": "在地化專案網址。",
     "config.comments.lost_petal_limit": "單日失去花瓣上限。",
diff --git a/modules/core/utils.py b/modules/core/utils.py
index fa182012ba..0302ffdd68 100644
--- a/modules/core/utils.py
+++ b/modules/core/utils.py
@@ -2,7 +2,6 @@
 import subprocess
 from datetime import datetime, timedelta, UTC
 
-import jwt
 import psutil
 from cpuinfo import get_cpu_info
 
@@ -14,8 +13,6 @@
 from core.utils.i18n import get_available_locales, Locale, load_locale_file
 from core.utils.info import Info
 
-jwt_secret = Config("jwt_secret", cfg_type=str, secret=True, table_name="bot_api")
-
 ver = module("version", base=True, doc=True)
 
 
@@ -345,23 +342,3 @@ async def _(msg: Bot.MessageSession):
         await msg.call_api("set_group_leave", group_id=msg.session.target)
     else:
         await msg.finish()
-
-
-token = module("token", base=True, hidden=True)
-
-
-@token.command("<code> {{core.help.token}}")
-async def _(msg: Bot.MessageSession, code: str):
-    await msg.finish(
-        jwt.encode(
-            {
-                "exp": datetime.now(UTC)
-                + timedelta(seconds=60 * 60 * 24 * 7),  # 7 days
-                "iat": datetime.now(UTC),
-                "senderId": msg.target.sender_id,
-                "code": code,
-            },
-            bytes(jwt_secret, "utf-8"),
-            algorithm="HS256",
-        )
-    )
diff --git a/poetry.lock b/poetry.lock
index ea5dc18bd1..16940bb5a1 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
 
 [[package]]
 name = "aiocqhttp"
@@ -3177,26 +3177,6 @@ files = [
 [package.dependencies]
 typing-extensions = ">=4.6.0,<4.7.0 || >4.7.0"
 
-[[package]]
-name = "pyjwt"
-version = "2.9.0"
-description = "JSON Web Token implementation in Python"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "PyJWT-2.9.0-py3-none-any.whl", hash = "sha256:3b02fb0f44517787776cf48f2ae25d8e14f300e6d7545a4315cee571a415e850"},
-    {file = "pyjwt-2.9.0.tar.gz", hash = "sha256:7e1e5b56cc735432a7369cbfa0efe50fa113ebecdc04ae6922deba8b84582d0c"},
-]
-
-[package.dependencies]
-cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"crypto\""}
-
-[package.extras]
-crypto = ["cryptography (>=3.4.0)"]
-dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"]
-docs = ["sphinx", "sphinx-rtd-theme", "zope.interface"]
-tests = ["coverage[toml] (==5.0.4)", "pytest (>=6.0.0,<7.0.0)"]
-
 [[package]]
 name = "pymysql"
 version = "1.1.1"
@@ -4537,4 +4517,4 @@ propcache = ">=0.2.0"
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12.0"
-content-hash = "9c98494aec57da701cba72db281f4a589564bb45d66a324c3f468aba2dfeebed"
+content-hash = "3e820dfe728d57685e285ace6b865015663b272fda51c886a0597330811e5394"
diff --git a/pyproject.toml b/pyproject.toml
index 0ae82b4362..c4e3009a6e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -53,7 +53,6 @@ khl-py = "^0.3.16"
 matrix-nio = "^0.25.0"
 attrs = "^24.2.0"
 uvicorn = {extras = ["standard"], version = "^0.32.0"}
-pyjwt = {extras = ["crypto"], version = "^2.8.0"}
 python-whois = "^0.9.0"
 pandas = "^2.2.0"
 future = "^1.0.0"
diff --git a/requirements.txt b/requirements.txt
index f8398a97f7..fd6397ce7a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -105,7 +105,6 @@ pycryptodome==3.21.0 ; python_full_version >= "3.12.0" and python_full_version <
 pycryptodomex==3.21.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pydantic-core==2.23.4 ; python_full_version >= "3.12.0" and python_version < "4.0"
 pydantic==2.9.2 ; python_full_version >= "3.12.0" and python_version < "4.0"
-pyjwt[crypto]==2.9.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pymysql==1.1.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pyparsing==3.2.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 python-dateutil==2.9.0.post0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"

From 9adc37a69b19844e563c7017325ac92357b31e0f Mon Sep 17 00:00:00 2001
From: yzhh <31803608+OasisAkari@users.noreply.github.com>
Date: Fri, 27 Dec 2024 15:22:26 +0800
Subject: [PATCH 08/18] u

---
 core/database/link.py   | 18 ++++++++++++++++++
 core/database/orm.py    | 17 +++--------------
 core/database/tables.py |  5 +++--
 3 files changed, 24 insertions(+), 16 deletions(-)
 create mode 100644 core/database/link.py

diff --git a/core/database/link.py b/core/database/link.py
new file mode 100644
index 0000000000..d3302c7c51
--- /dev/null
+++ b/core/database/link.py
@@ -0,0 +1,18 @@
+import os
+
+from core.config import Config
+from core.constants import db_path_default, database_path
+
+db_link = Config("db_path", default=db_path_default, secret=True)
+db_path = database_path
+
+db_type = db_link.split("://")[0].split("+")[0]
+if db_type == "sqlite":
+    db_path = os.path.dirname(db_link.replace("sqlite:///", ""))
+os.makedirs(db_path, exist_ok=True)
+
+def get_db_link(orm_type="sqlalchemy"):
+    if orm_type == "sqlalchemy":
+        return db_link
+    if orm_type == "tortoise":
+        return db_type + "://" + db_link.split("://")[1]
diff --git a/core/database/orm.py b/core/database/orm.py
index 1aec509257..c95653ea57 100644
--- a/core/database/orm.py
+++ b/core/database/orm.py
@@ -1,26 +1,15 @@
-import os
-
 from sqlalchemy import create_engine
 from sqlalchemy.ext.asyncio import create_async_engine, async_sessionmaker
 from sqlalchemy.orm import sessionmaker
 
-from core.config import Config
-from core.constants.default import db_path_default
-from core.constants.path import database_path
+from core.database.link import db_link
 from core.database.orm_base import Base
 
-DB_LINK = Config("db_path", default=db_path_default, secret=True)
-
-db_path = database_path
-if DB_LINK.startswith("sqlite:///"):
-    db_path = os.path.dirname(DB_LINK.replace("sqlite:///", ""))
-os.makedirs(db_path, exist_ok=True)
-
 
 class DBSession:
     def __init__(self):
         self.engine = create_engine(
-            DB_LINK, isolation_level="READ UNCOMMITTED", pool_pre_ping=True
+            db_link, isolation_level="READ UNCOMMITTED", pool_pre_ping=True
         )
         self.Session = sessionmaker()
         self.Session.configure(bind=self.engine)
@@ -35,7 +24,7 @@ def create(self):
 
 class AsyncDBSession:
     def __init__(self):
-        self.engine = create_async_engine(DB_LINK, isolation_level="READ UNCOMMITTED")
+        self.engine = create_async_engine(db_link, isolation_level="READ UNCOMMITTED")
         self.Session = async_sessionmaker()
         self.Session.configure(bind=self.engine)
 
diff --git a/core/database/tables.py b/core/database/tables.py
index 5e9c2939a3..69300949a1 100644
--- a/core/database/tables.py
+++ b/core/database/tables.py
@@ -2,10 +2,11 @@
 from sqlalchemy.dialects.mysql import LONGTEXT
 
 from core.config import Config
-from core.database.orm import Session, DB_LINK
+from core.database.orm import Session
+from core.database.link import db_type
 from core.database.orm_base import Base
 
-is_mysql = DB_LINK.startswith("mysql")
+is_mysql = db_type == "mysql"
 default_locale = Config("default_locale", cfg_type=str)
 
 

From 344d53dcbd8e033b3d29e26dce9b6510da615ea1 Mon Sep 17 00:00:00 2001
From: yzhh <31803608+OasisAkari@users.noreply.github.com>
Date: Fri, 27 Dec 2024 15:22:41 +0800
Subject: [PATCH 09/18] Update link.py

---
 core/database/link.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/database/link.py b/core/database/link.py
index d3302c7c51..01af3d4d87 100644
--- a/core/database/link.py
+++ b/core/database/link.py
@@ -11,6 +11,7 @@
     db_path = os.path.dirname(db_link.replace("sqlite:///", ""))
 os.makedirs(db_path, exist_ok=True)
 
+
 def get_db_link(orm_type="sqlalchemy"):
     if orm_type == "sqlalchemy":
         return db_link

From 0379b4c193eb4db6dc078e54d92d232559520e35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Fri, 27 Dec 2024 16:55:50 +0800
Subject: [PATCH 10/18] Update change-password API

---
 bots/api/bot.py | 105 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 74 insertions(+), 31 deletions(-)

diff --git a/bots/api/bot.py b/bots/api/bot.py
index 349d1d2a66..94ed539b85 100644
--- a/bots/api/bot.py
+++ b/bots/api/bot.py
@@ -10,7 +10,6 @@
 from cpuinfo import get_cpu_info
 from fastapi import FastAPI, Request, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse
 
 from bots.api.info import client_name
 from core.queue import JobQueue
@@ -36,17 +35,17 @@
 started_time = datetime.now()
 
 origins = [
-    "http://localhost:8080",  # Vue 前端的地址
-    "http://127.0.0.1:8080",  # 如果是从本地开发环境发出的请求
-]
+    "http://localhost:8080",
+    "http://127.0.0.1:8080",
+]  # temp
+
 
-# 将 CORSMiddleware 中间件添加到 FastAPI 应用
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,  # 允许的源
+    allow_origins=origins,
     allow_credentials=True,
-    allow_methods=["*"],    # 允许所有 HTTP 方法（GET、POST 等）
-    allow_headers=["*"],    # 允许所有 HTTP 头
+    allow_methods=["GET", "POST"],
+    allow_headers=["*"],
 )
 
 
@@ -61,19 +60,63 @@ async def startup_event():
 
 @app.post("/auth")
 async def auth(request: Request):
-    password_path = os.path.join(PrivateAssets.path, ".password")
-    if not os.path.exists(password_path):
+    try:
+        password_path = os.path.join(PrivateAssets.path, ".password")
+        if not os.path.exists(password_path):
+            return {"message": "success"}
+
+        with open(password_path, "r") as file:
+            stored_password = file.read().strip()
+
+        body = await request.json()
+        password = body["password"]
+        password = hashlib.sha256(password.encode()).hexdigest()
+        if stored_password != password:
+            raise HTTPException(status_code=401, detail="invalid password")
         return {"message": "success"}
+    except HTTPException as e:
+        raise e
+    except Exception:
+        return HTTPException(status_code=400, detail="bad request")
+
+
+@app.post("/auth/change")
+async def changepassword(request: Request):
+    try:
+        password_path = os.path.join(PrivateAssets.path, ".password")
+
+        body = await request.json()
+        new_password = body.get("new_password", "")
+        password = body.get("password", "")
+
+        if not os.path.exists(password_path):
+            if new_password == "":
+                raise HTTPException(status_code=400, detail="new password required")
+            new_password = hashlib.sha256(new_password.encode()).hexdigest()
+            with open(password_path, "w") as file:
+                file.write(new_password)
+            return {"message": "success"}
+
+        with open(password_path, "r") as file:
+            stored_password = file.read().strip()
+
+        password = hashlib.sha256(password.encode()).hexdigest()
+        if stored_password != password:
+            raise HTTPException(status_code=401, detail="invalid password")
+
+        if new_password == "":
+            os.remove(password_path)
+            return {"message": "success"}
 
-    with open(password_path, "r") as file:
-        stored_password = file.read().strip()
+        new_password = hashlib.sha256(new_password.encode()).hexdigest()
+        with open(password_path, "w") as file:
+            file.write(new_password)
 
-    body = await request.json()
-    password = body["password"]
-    password = hashlib.sha256(password.encode()).hexdigest()
-    if stored_password != password:
-        raise HTTPException(status_code=401, detail="Invalid password")
-    return {"message": "success"}
+        return {"message": "success"}
+    except HTTPException as e:
+        raise e
+    except Exception:
+        return HTTPException(status_code=400, detail="bad request")
 
 
 @app.get("/serverinfo")
@@ -103,7 +146,7 @@ async def get_server_info():
 async def get_target(target_id: str):
     target = BotDBUtil.TargetInfo(target_id)
     if not target.query:
-        return JSONResponse(status_code=404, content={"detail": "Not Found"})
+        return HTTPException(status_code=404, detail="not found")
     enabled_modules = target.enabled_modules
     is_muted = target.is_muted
     custom_admins = target.custom_admins
@@ -134,7 +177,7 @@ async def get_target(target_id: str):
 async def get_sender(sender_id: str):
     sender = BotDBUtil.SenderInfo(sender_id)
     if not sender.query:
-        return JSONResponse(status_code=404, content={"detail": "Not Found"})
+        return HTTPException(status_code=404, detail="not found")
 
     return {
         "senderId": sender_id,
@@ -156,7 +199,7 @@ async def get_module_list():
 async def get_target_modules(target_id: str):
     target_data = BotDBUtil.TargetInfo(target_id)
     if not target_data.query:
-        return JSONResponse(status_code=404, content={"detail": "Not Found"})
+        return HTTPException(status_code=404, detail="not found")
     target_from = "|".join(target_id.split("|")[:-2])
     modules = ModulesManager.return_modules_list(target_from=target_from)
     enabled_modules = target_data.enabled_modules
@@ -171,7 +214,7 @@ async def enable_modules(target_id: str, request: Request):
     try:
         target_data = BotDBUtil.TargetInfo(target_id)
         if not target_data.query:
-            return JSONResponse(status_code=404, content={"detail": "Not Found"})
+            return HTTPException(status_code=404, detail="not found")
         target_from = "|".join(target_id.split("|")[:-2])
 
         body = await request.json()
@@ -184,18 +227,18 @@ async def enable_modules(target_id: str, request: Request):
         ]
         target_data.enable(modules)
         return {"message": "success"}
+    except HTTPException as e:
+        raise e
     except Exception:
-        return JSONResponse(
-            status_code=400, content={"detail": "Bad Request", "message": "error"}
-        )
+        return HTTPException(status_code=400, detail="bad request")
 
 
 @app.post("/modules/{target_id}/disable")
-async def enable_modules(target_id: str, request: Request):
+async def disable_modules(target_id: str, request: Request):
     try:
         target_data = BotDBUtil.TargetInfo(target_id)
         if not target_data.query:
-            return JSONResponse(status_code=404, content={"detail": "Not Found"})
+            return HTTPException(status_code=404, detail="not found")
         target_from = "|".join(target_id.split("|")[:-2])
 
         body = await request.json()
@@ -208,11 +251,11 @@ async def enable_modules(target_id: str, request: Request):
         ]
         target_data.disable(modules)
         return {"message": "success"}
+    except HTTPException as e:
+        raise e
     except Exception as e:
         Logger.error(str(e))
-        return JSONResponse(
-            status_code=400, content={"detail": "Bad Request", "message": "error"}
-        )
+        return HTTPException(status_code=400, detail="bad request")
 
 
 @app.get("/locale/{locale}/{string}")
@@ -224,7 +267,7 @@ async def get_locale(locale: str, string: str):
             "translation": Locale(locale).t(string, False),
         }
     except TypeError:
-        return JSONResponse(status_code=404, content={"detail": "Not Found"})
+        return HTTPException(status_code=404, detail="not found")
 
 
 if (__name__ == "__main__" or Info.subprocess) and Config(

From e3e454daca187835c49852535edf228c107cd933 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Fri, 27 Dec 2024 23:11:40 +0800
Subject: [PATCH 11/18] Revert "remove jwt"

This reverts commit d0e3dccfc3078a46bcaa262861e71cb2071b0e29.
---
 assets/config_store/en_us/bot_api.toml  |   4 +
 assets/config_store/en_us/config.toml   |   4 +-
 assets/config_store/zh_cn/bot_api.toml  |   4 +
 assets/config_store/zh_cn/config.toml   |   2 +-
 assets/config_store/zh_tw/bot_api.toml  |   4 +
 assets/config_store/zh_tw/config.toml   |   6 +-
 assets/config_store_packed/en_us.zip    | Bin 14530 -> 14843 bytes
 assets/config_store_packed/zh_cn.zip    | Bin 13254 -> 13534 bytes
 assets/config_store_packed/zh_tw.zip    | Bin 13227 -> 13507 bytes
 bots/api/bot.py                         | 113 +++++++++++++-----------
 core/config/update.py                   |   1 +
 core/locales/en_us.json                 |   1 +
 core/locales/zh_cn.json                 |   1 +
 core/locales/zh_tw.json                 |   1 +
 modules/core/utils.py                   |   2 +-
 modules/ncmusic/locales/en_us.json      |   2 +-
 modules/ncmusic/locales/zh_cn.json      |   2 +-
 modules/ncmusic/locales/zh_tw.json      |   2 +-
 modules/osu/locales/zh_tw.json          |   2 +-
 modules/wolframalpha/locales/en_us.json |   4 +-
 modules/wordle/locales/zh_tw.json       |   4 +-
 poetry.lock                             |  24 ++++-
 pyproject.toml                          |   1 +
 requirements.txt                        |   1 +
 24 files changed, 115 insertions(+), 70 deletions(-)

diff --git a/assets/config_store/en_us/bot_api.toml b/assets/config_store/en_us/bot_api.toml
index d1f2b3c011..9415798b65 100644
--- a/assets/config_store/en_us/bot_api.toml
+++ b/assets/config_store/en_us/bot_api.toml
@@ -2,6 +2,10 @@
 # NOTE: TOML is not like Python. Do not use Python syntax here.
 # EXAMPLE: Boolean values in TOML must be lowercase.
 
+[bot_api_secret]
+# The secret config section of the platform. The bot will try to intercept if the value here accidentally appears in the message sent, but be careful to prevent leakage.
+jwt_secret = "<Replace me with str value>" # The authentication key for the built-in API, for signing and verifying validity.
+
 [bot_api]
 # The basic config section of the platform. The value ​​filled in here can be displayed in the message. Please do not fill in sensitive information in this section.
 enable = true # Whether to enable this platform.
diff --git a/assets/config_store/en_us/config.toml b/assets/config_store/en_us/config.toml
index 179070552e..d9644260ef 100644
--- a/assets/config_store/en_us/config.toml
+++ b/assets/config_store/en_us/config.toml
@@ -57,7 +57,7 @@ dice_output_len = 200 # The maximum length output of dice module.
 dice_roll_limit = 10 # The maximum number of dice rolled per command of dice module.
 dice_detail_count = 5 # The total number of dice rolled n times of dice module, it will no longer show details when this value is exceeded.
 dice_count_limit = 10 # The maximum number of items in dice expressions of dice module.
-ncmusic_enable_card = false # Whether enables card messages of ncmusic module. (Only valid on QQ)
+ncmusic_enable_card = false # Whether enables card messages of ncmusic module. (Only valid on QQ client)
 wiki_whitelist_url = "<Replace me with str value>" # Wiki whitelist application URL.
 wordle_disable_image = false # Whether to disable images of wordle module.
 slower_schedule = false # Whether to enable a slower scheduled task scheduler. (To reduce request pressure)
@@ -73,7 +73,7 @@ ff3_tweak = "1E915EC4922E78" # The key tweak used to encrypt sensitive informati
 web_render = "<Replace me with str value>" # WebRender service URL.
 openai_api_key = "<Replace me with str value>" # OpenAI API Key. (For ask modules etc.)
 exchange_rate_api_key = "<Replace me with str value>" # API Key for ExchangeRate-API. (For exchange_rate module and exchange rate calculation)
-wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha 的 AppID。（用于 wolframalpha 模块）
+wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha AppID. (For wolframalpha module)
 diving_fish_developer_token = "<Replace me with str value>" # Developer token for Diving Fish prober. (For maimai module)
 curseforge_api_key = "<Replace me with str value>" # CurseForge API key. (For mod_dl module)
 ncmusic_api = "<Replace me with str value>" # API address of NetEase Cloud Music API. (For ncmusic module)
diff --git a/assets/config_store/zh_cn/bot_api.toml b/assets/config_store/zh_cn/bot_api.toml
index 778eed465a..4116782585 100644
--- a/assets/config_store/zh_cn/bot_api.toml
+++ b/assets/config_store/zh_cn/bot_api.toml
@@ -2,6 +2,10 @@
 # 注意：TOML 不是 Python。请不要在此处使用 Python 语法。
 # 例如：TOML 中的布尔值必须是小写。
 
+[bot_api_secret]
+# 平台端的密钥配置部分，此处的值若意外出现在发送的消息中，机器人会尝试拦截。但请务必提防泄露。
+jwt_secret = "<Replace me with str value>" # 内置 API 的身份认证密钥，用于签名和验证有效性。
+
 [bot_api]
 # 平台端的配置部分，此处填写的值可在消息中以明文形式展示。请不要在此部分填写敏感信息。
 enable = true # 是否启用此平台。
diff --git a/assets/config_store/zh_cn/config.toml b/assets/config_store/zh_cn/config.toml
index 77136e9b2a..d1292b7c86 100644
--- a/assets/config_store/zh_cn/config.toml
+++ b/assets/config_store/zh_cn/config.toml
@@ -57,7 +57,7 @@ dice_output_len = 200 # dice 模块输出最大长度。
 dice_roll_limit = 10 # dice 模块一次命令投掷次数上限。
 dice_detail_count = 5 # dice 模块 n 次投掷的骰子的总量超过该值时将不再显示详细信息。
 dice_count_limit = 10 # dice 模块骰子表达式项数上限。
-ncmusic_enable_card = false # ncmusic 模块是否启用卡片消息。（仅在 QQ 平台有效）
+ncmusic_enable_card = false # ncmusic 模块是否启用卡片消息。（仅在 QQ 客户端有效）
 wiki_whitelist_url = "<Replace me with str value>" # Wiki 白名单申请网址。
 wordle_disable_image = false # wordle 模块是否禁用图片。
 slower_schedule = false # 是否启用更慢的计划任务调度器。（减少请求压力用）
diff --git a/assets/config_store/zh_tw/bot_api.toml b/assets/config_store/zh_tw/bot_api.toml
index 8ee0f86e36..b129692ff1 100644
--- a/assets/config_store/zh_tw/bot_api.toml
+++ b/assets/config_store/zh_tw/bot_api.toml
@@ -2,6 +2,10 @@
 # 注意：TOML 不是 Python。請不要在此處使用 Python 語法。
 # 例如：TOML 中的布林值必須是小寫。
 
+[bot_api_secret]
+# 平台端的金鑰設定部分，此處的值若意外出現在傳送的訊息中，機器人會嘗試攔截。但請務必提防洩漏。
+jwt_secret = "<Replace me with str value>" # 內建 API 的身份認證金鑰，用於簽署和驗證有效性。
+
 [bot_api]
 # 平台端的設定部分，此處填寫的值可在訊息中以明文顯示。請不要在此部分填寫敏感資訊。
 enable = true # 是否啟用此平台。
diff --git a/assets/config_store/zh_tw/config.toml b/assets/config_store/zh_tw/config.toml
index 86eaab2bc4..685898be1b 100644
--- a/assets/config_store/zh_tw/config.toml
+++ b/assets/config_store/zh_tw/config.toml
@@ -57,9 +57,9 @@ dice_output_len = 200 # dice 模組輸出最大長度。
 dice_roll_limit = 10 # dice 模組一次指令投擲次數上限。
 dice_detail_count = 5 # dice 模組 n 次投擲的骰子的總量超過該值時將不再顯示詳細資訊。
 dice_count_limit = 10 # dice 模組骰子表示式項數上限。
-ncmusic_enable_card = false # ncmusic 模組是否啟用卡片訊息。（僅在 QQ 平台有效）
+ncmusic_enable_card = false # ncmusic 模組是否啟用卡片訊息。（僅在 QQ 用戶端有效）
 wiki_whitelist_url = "<Replace me with str value>" # Wiki 白名單申請網址。
-wordle_disable_image = false # wordle 模块是否禁用图片。
+wordle_disable_image = false # wordle 模組是否停用圖片。
 slower_schedule = false # 是否啟用更慢的排程任務調度器。（減少請求壓力用）
 
 [secret]
@@ -77,4 +77,4 @@ wolfram_alpha_appid = "<Replace me with str value>" # WolframAlpha 的 AppID。
 diving_fish_developer_token = "<Replace me with str value>" # Diving Fish 查分器的開發者令牌。（用於 maimai 模組）
 curseforge_api_key = "<Replace me with str value>" # CurseForge 的 API Key。（用於 mod_dl 模組）
 ncmusic_api = "<Replace me with str value>" # 網易雲音樂 API 的 API 位址。（用於 ncmusic 模組）
-osu_api_key = "<Replace me with str value>" # osu! 的 API Key。（用于 osu 模块）
+osu_api_key = "<Replace me with str value>" # osu! 的 API Key。（用於 osu 模組）
diff --git a/assets/config_store_packed/en_us.zip b/assets/config_store_packed/en_us.zip
index db6f6d0c6992c64b87aaa55d19437ade223debe5..7fce09d16a66b99e74fe6507ba52c1341ad82a39 100644
GIT binary patch
delta 450
zcmX?9_`8@Vz?+#xgaHI1cW&gd<Y0>2x!Ij#I}=~z&e@UgZ#ijwVq#$U#59?Qd&A`a
zY+ISL%1b71Fx2x-EG@}M%`3@FPAtjH&r`@wtyD<MFH!&sDkPO==9K7W<|#M^c<O*f
zi!;;nGV{_E67y0N%2JCm(<(u{vc#Osl+2RK&Fi^!8A0~m<JrmtqNnmN1Jkxb@hl+z
zJh3+{ydd}Nf9$(jTAG1Ddh>MYxx(xU$vK%oH*7Z1zsjoMSWw{UqNkwY26RPveok6Z
zVs2tiK}MoNZhlH>PO9c+Q_}??TP9yOvjb7$<~HblOf=U4$@H7cFbVKYUTZD~;++NZ
zjtfkFZ7vPsaahRI=L<71B;}XH=O&gEWmf2w<mcuDcr!AIFu=lbc4U%gqwgUW1_lu3
s1BWhz*w%PK9HP0f5NHHey>L$gJ<5%ucb^OcLvsG)#TJrmOco#+0J3L~j{pDw

delta 337
zcmexee5jBoz?+#xgaHKp6l~<N<Y4+!u-TnsI}_iZg4vPR*>`DfVPs&~!Z?|Sd&A~m
zJPM2;c^ST~Od$HQz%nphEga7R;@=T}!@>*FCwlVJ1qEpa28GR6W#$TRt~9vHs`GqS
zi-Kc8fv3ykhNky>I-XBi@nlz@LV12pT2W$dVopIuqQbKk3!l!N{(evA<~*|nAe$x&
zSlEH601F#*_sp`;0m+=OkYT#SGx?c?oGr-Wlh+MAYnd1rK$sWoD+sZzv6G*HAt}Ek
zK07}@TdyQPHz&ZGkx7IB=Jm;rmNHC+LX+byWkJT)0eO?eCeN{yQ9$tz&`;bb#x_V#
NzF{fLcG3(a3IOi%cF6z$

diff --git a/assets/config_store_packed/zh_cn.zip b/assets/config_store_packed/zh_cn.zip
index 5d0fd22d198b8caad88ddc58e95f7b1207dffc43..e4a7b7ec18fe334b6c1263742dfbb3bf1953a88c 100644
GIT binary patch
delta 415
zcmX?>elL?Jz?+#xgaHI1cW&f)%f=MBbMtSuN+#*ZowFmEMB9_6F)=WJFb_~kQhrH%
zVnOC)1%c(vAbPL(4CbuzlF4&)v>czdwLagwPQfw2Q{nlnmKVELKiR$a#kwUg);B&~
z-}Z9S()W9Mo=;ivWLMwwwfmk<=zTh==jEy%pzO0bozJFrJZo4!S&Qo{$aY2UawZTx
zi#G#Ivk17dfcV}bc`UpjS3PRpocKe6f#JvIV-g*L9P1W6>)8H$_4>`hT5aq=g_Ca^
z+JPu(BO5+cPfSiV(op~jExc4E=?(M~2n&Ec4<WWSYVl0oXe0;He$hyVX))jA_eRnn
z9*?mM6R+T8En`^_&(l~YF+>y+9)*R#P|+*N&&>(&W@Hj!fCVO!JArQHMzQ6HBm+Zo
ZeqLH;I#eSo8%Ul52p=;tFg!H^@c_Cxlv4lz

delta 316
zcmcbYc`ThLz?+#xgaHJ87i{Et%f|G(VDoRbN+!PF1+yc0<tN{2WMp7yWSrc@xqY%9
z_cM^R8BaMAh+fZ^0j4DdU0Fc<1kpSeUXZrma^a?5B^VgKZoVzqA;`LO^V9wfo3pjs
z*nz4he>SoMQO3qL=vLGk>wsid8_O_>a!)>KEC=GfG?t0!<7Hq-$}fq}&d<-*E6LBz
z3GilQ5@CQjdv;`@<ZT`)76t|o<_CKQLTqdN0px<T<|dXDWmaI(JUP)shRI%Ja=nR+
Y0*c##?&n4^YQ4nd-6pbZXAME30K({GDF6Tf

diff --git a/assets/config_store_packed/zh_tw.zip b/assets/config_store_packed/zh_tw.zip
index bc99acdad485813e0c557a4045bda597e4be98c5..b74e698fc7abb7e3ae7a9142433621fdd795db74 100644
GIT binary patch
delta 444
zcmZ3TemIjSz?+#xgaHI1cW&f)#>N!6bMqIrVkW-GowFm?8hfiwW@2EN%rv=_bNl3f
zd^4D{%1b6s(9v>y+PeJd?p+Fw0iFuaXSKZ8wff2Ky)RbvzF6D&vVG#qi5uSU>3Ke7
z#j|O9o^ROueD9{GlX_mRoDP(IHmCF1)Q)Ej%O}fneF9k~$X&<;qFZ>A!1N1#Cl(N2
zM<kO)3gn24QuPark_-$W%nfvBa(-S~X8L47_C=cmB|ivof~@J-_I&mF$?jSmLeICh
zJe#rp>4arZ8|MIJp3a%J`JvW6HbtOI6!MEp6`rkF2vqWZPbV)|fHxzP2m{RXlMfi$
z0qvb+WP|Q?FC!hG#N-Mi873*7$<vJFY(dUC_MiWbB`|D2m=_#?5Mo<nFCPO#QhrH%
zc7A@gUP*p#4w^+Dfd+jPn9Of13o=&EScb_|bh3}Ji~=^_!c5-QxIl7php{Z%DI<^&
E05D9Z*8l(j

delta 349
zcmX?{xjLOEz?+#xgaHJ87i{Et#>Vu!VDlHYVkW-d1+yd51Z@A-F)}dJF-|V!+&<Zn
z`!Psbji-<aM9<_)0@Hs5oLE47N6}0cu(qgQ{VV=SFfja+*t|n>o*>)PotvNbZ<rjf
z-68aJ?(}Cf)<2!F?D?|B=TlZZoxN}KPwjndicfa+DdZQIDm+`U5UAw+o=#q_0B=Sn
z5eAssCf_i!16nd!!q^7gX-UR9AejlqGEA)8lh+x`fq3VDyb9jQZ;YiuJWdlCraSzT
z)lFn$K>qr)dBc8t76t|o<^y{kLTqbP0NR(7UlLzf2qg7N@^f=goiRHS;W-8dZWO)U
P5|bC0$g*uR1c?Fwe))Xz

diff --git a/bots/api/bot.py b/bots/api/bot.py
index 94ed539b85..3bdb2fb631 100644
--- a/bots/api/bot.py
+++ b/bots/api/bot.py
@@ -1,15 +1,19 @@
-from datetime import datetime
 import os
 import platform
 import sys
 import time
+import uuid
+from datetime import datetime, timedelta, UTC
 
 import hashlib
+import jwt
+import orjson as json
 import psutil
 import uvicorn
 from cpuinfo import get_cpu_info
-from fastapi import FastAPI, Request, HTTPException
+from fastapi import FastAPI, Request, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 
 from bots.api.info import client_name
 from core.queue import JobQueue
@@ -34,6 +38,10 @@
 app = FastAPI()
 started_time = datetime.now()
 
+JWT_SECRET = Config("jwt_secret", cfg_type=str, secret=True, table_name="bot_api")
+PASSWORD_PATH = os.path.join(PrivateAssets.path, ".password")
+
+
 origins = [
     "http://localhost:8080",
     "http://127.0.0.1:8080",
@@ -61,85 +69,83 @@ async def startup_event():
 @app.post("/auth")
 async def auth(request: Request):
     try:
-        password_path = os.path.join(PrivateAssets.path, ".password")
-        if not os.path.exists(password_path):
+        if not os.path.exists(PASSWORD_PATH):
             return {"message": "success"}
 
-        with open(password_path, "r") as file:
-            stored_password = file.read().strip()
-
         body = await request.json()
         password = body["password"]
+        remember = body.get("remember", False)
+
+        with open(PASSWORD_PATH, "r") as file:
+            stored_password = file.read().strip()
+
         password = hashlib.sha256(password.encode()).hexdigest()
         if stored_password != password:
             raise HTTPException(status_code=401, detail="invalid password")
-        return {"message": "success"}
+
+        payload = {
+            "device_id": str(uuid.uuid4()),
+            "exp": datetime.now(UTC) + (timedelta(days=365) if remember else timedelta(hours=24)),  # 过期时间
+            "iat": datetime.now(UTC),  # 签发时间
+            "iss": "auth-api"  # 签发者
+        }
+        jwt_token = jwt.encode(payload, JWT_SECRET, algorithm='HS256')
+
+        return {"message": "success", "deviceToken": jwt_token}
+
     except HTTPException as e:
         raise e
-    except Exception:
-        return HTTPException(status_code=400, detail="bad request")
+    except Exception as e:
+        Logger.error(str(e))
+        raise HTTPException(status_code=400, detail="bad request")
 
 
-@app.post("/auth/change")
-async def changepassword(request: Request):
+@app.post("/verify-token")
+async def verify_token(credentials: HTTPAuthorizationCredentials = Depends(HTTPBearer())):
     try:
-        password_path = os.path.join(PrivateAssets.path, ".password")
+        token = credentials.credentials
+        payload = jwt.decode(token, JWT_SECRET, algorithm='HS256')
+        return payload
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(status_code=401, detail="token expired")
+    except jwt.InvalidTokenError:
+        raise HTTPException(status_code=401, detail="invalid token")
 
+
+@app.post("/change-password")
+async def change_password(request: Request):
+    try:
         body = await request.json()
         new_password = body.get("new_password", "")
         password = body.get("password", "")
 
-        if not os.path.exists(password_path):
+        # 读取旧密码
+        if not os.path.exists(PASSWORD_PATH):
             if new_password == "":
                 raise HTTPException(status_code=400, detail="new password required")
-            new_password = hashlib.sha256(new_password.encode()).hexdigest()
-            with open(password_path, "w") as file:
-                file.write(new_password)
+            new_password_hashed = hashlib.sha256(new_password.encode()).hexdigest()
+            with open(PASSWORD_PATH, "w") as file:
+                file.write(new_password_hashed)
             return {"message": "success"}
 
-        with open(password_path, "r") as file:
+        with open(PASSWORD_PATH, "r") as file:
             stored_password = file.read().strip()
 
-        password = hashlib.sha256(password.encode()).hexdigest()
-        if stored_password != password:
+        hashed_password = hashlib.sha256(password.encode()).hexdigest()
+        if stored_password != hashed_password:
             raise HTTPException(status_code=401, detail="invalid password")
 
-        if new_password == "":
-            os.remove(password_path)
-            return {"message": "success"}
-
-        new_password = hashlib.sha256(new_password.encode()).hexdigest()
-        with open(password_path, "w") as file:
-            file.write(new_password)
+        # 设置新密码
+        new_password_hashed = hashlib.sha256(new_password.encode()).hexdigest()
+        with open(PASSWORD_PATH, "w") as file:
+            file.write(new_password_hashed)
 
         return {"message": "success"}
     except HTTPException as e:
         raise e
-    except Exception:
-        return HTTPException(status_code=400, detail="bad request")
-
-
-@app.get("/serverinfo")
-async def get_server_info():
-    timediff = str(datetime.now() - started_time).split(".")[0]
-    python_version = str(platform.python_version())
-    cpu_brand = get_cpu_info()["brand_raw"]
-    cpu_usage = psutil.cpu_percent()
-    ram = int(psutil.virtual_memory().total / (1024 * 1024))
-    swap = int(psutil.swap_memory().total / (1024 * 1024))
-    disk = int(psutil.disk_usage("/").used / (1024 * 1024 * 1024))
-    disk_total = int(psutil.disk_usage("/").total / (1024 * 1024 * 1024))
-    return {
-        "message": "Success",
-        "timeDiff": timediff,
-        "pythonVersion": python_version,
-        "cpuBrand": cpu_brand,
-        "cpuUsage": cpu_usage,
-        "ram": ram,
-        "swap": swap,
-        "disk": disk,
-        "diskTotal": disk_total,
-    }
+    except Exception as e:
+        Logger.error(str(e))
+        raise HTTPException(status_code=400, detail="bad request")
 
 
 @app.get("/target/{target_id}")
@@ -229,7 +235,8 @@ async def enable_modules(target_id: str, request: Request):
         return {"message": "success"}
     except HTTPException as e:
         raise e
-    except Exception:
+    except Exception as e:
+        Logger.error(str(e))
         return HTTPException(status_code=400, detail="bad request")
 
 
diff --git a/core/config/update.py b/core/config/update.py
index efd763adf2..1339b526e1 100644
--- a/core/config/update.py
+++ b/core/config/update.py
@@ -194,6 +194,7 @@ def bot_add_enabled_flag(cls):
         Reorganize.table = 'api'
         Reorganize.bot_add_enabled_flag()
         Reorganize.reorganize_bot_key('api_port')
+        Reorganize.reorganize_bot_key('jwt_secret', True)
 
         # discord
 
diff --git a/core/locales/en_us.json b/core/locales/en_us.json
index 325a609192..76ea746417 100644
--- a/core/locales/en_us.json
+++ b/core/locales/en_us.json
@@ -35,6 +35,7 @@
     "config.comments.help_url": "Help document URL.",
     "config.comments.ignored_sender": "Ignore user list. Users matching this list will be ignored.",
     "config.comments.issue_url": "Issue feedback URL.",
+    "config.comments.jwt_secret": "The authentication key for the built-in API, for signing and verifying validity.",
     "config.comments.kook_token": "KOOK bot token.",
     "config.comments.locale_url": "Localized project URL.",
     "config.comments.lost_petal_limit": "The maximum number of petals users can lose per day.",
diff --git a/core/locales/zh_cn.json b/core/locales/zh_cn.json
index 8e637319fd..79dfd0b19d 100644
--- a/core/locales/zh_cn.json
+++ b/core/locales/zh_cn.json
@@ -35,6 +35,7 @@
     "config.comments.help_url": "帮助文档网址。",
     "config.comments.ignored_sender": "无视的用户列表，匹配到此列表中的用户将会被忽略。",
     "config.comments.issue_url": "问题反馈网址。",
+    "config.comments.jwt_secret": "内置 API 的身份认证密钥，用于签名和验证有效性。",
     "config.comments.kook_token": "KOOK 机器人令牌。",
     "config.comments.locale_url": "本地化项目网址。",
     "config.comments.lost_petal_limit": "单日失去花瓣上限。",
diff --git a/core/locales/zh_tw.json b/core/locales/zh_tw.json
index 7efb40308f..0f9224b7aa 100644
--- a/core/locales/zh_tw.json
+++ b/core/locales/zh_tw.json
@@ -35,6 +35,7 @@
     "config.comments.help_url": "線上說明文件網址。",
     "config.comments.ignored_sender": "無視的使用者列表，匹配到此列表中的使用者將會被忽略。",
     "config.comments.issue_url": "問題報告網址。",
+    "config.comments.jwt_secret": "內建 API 的身份認證金鑰，用於簽署和驗證有效性。",
     "config.comments.kook_token": "KOOK 機器人令牌。",
     "config.comments.locale_url": "在地化專案網址。",
     "config.comments.lost_petal_limit": "單日失去花瓣上限。",
diff --git a/modules/core/utils.py b/modules/core/utils.py
index 0302ffdd68..d75942edd2 100644
--- a/modules/core/utils.py
+++ b/modules/core/utils.py
@@ -1,6 +1,6 @@
 import platform
 import subprocess
-from datetime import datetime, timedelta, UTC
+from datetime import datetime
 
 import psutil
 from cpuinfo import get_cpu_info
diff --git a/modules/ncmusic/locales/en_us.json b/modules/ncmusic/locales/en_us.json
index 79ffe96efc..27b0e68c9f 100644
--- a/modules/ncmusic/locales/en_us.json
+++ b/modules/ncmusic/locales/en_us.json
@@ -16,5 +16,5 @@
     "ncmusic.message.search.table.header.id": "序号",
     "ncmusic.message.search.table.header.name": "歌名",
     "config.comments.ncmusic_api": "API address of NetEase Cloud Music API. (For ncmusic module)",
-    "config.comments.ncmusic_enable_card": "Whether enables card messages of ncmusic module. (Only valid on QQ)"
+    "config.comments.ncmusic_enable_card": "Whether enables card messages of ncmusic module. (Only valid on QQ client)"
 }
diff --git a/modules/ncmusic/locales/zh_cn.json b/modules/ncmusic/locales/zh_cn.json
index 3aa1ce531c..63e1b0cf92 100644
--- a/modules/ncmusic/locales/zh_cn.json
+++ b/modules/ncmusic/locales/zh_cn.json
@@ -16,5 +16,5 @@
     "ncmusic.message.search.table.header.id": "编号",
     "ncmusic.message.search.table.header.name": "歌名",
     "config.comments.ncmusic_api": "网易云音乐 API 的 API 地址。（用于 ncmusic 模块）",
-    "config.comments.ncmusic_enable_card": "ncmusic 模块是否启用卡片消息。（仅在 QQ 平台有效）"
+    "config.comments.ncmusic_enable_card": "ncmusic 模块是否启用卡片消息。（仅在 QQ 客户端有效）"
 }
diff --git a/modules/ncmusic/locales/zh_tw.json b/modules/ncmusic/locales/zh_tw.json
index 81b687321c..5aa4fecd82 100644
--- a/modules/ncmusic/locales/zh_tw.json
+++ b/modules/ncmusic/locales/zh_tw.json
@@ -16,5 +16,5 @@
     "ncmusic.message.search.table.header.id": "編號",
     "ncmusic.message.search.table.header.name": "歌名",
     "config.comments.ncmusic_api": "網易雲音樂 API 的 API 位址。（用於 ncmusic 模組）",
-    "config.comments.ncmusic_enable_card": "ncmusic 模組是否啟用卡片訊息。（僅在 QQ 平台有效）"
+    "config.comments.ncmusic_enable_card": "ncmusic 模組是否啟用卡片訊息。（僅在 QQ 用戶端有效）"
 }
diff --git a/modules/osu/locales/zh_tw.json b/modules/osu/locales/zh_tw.json
index dec4d3c8eb..cb190fed6d 100644
--- a/modules/osu/locales/zh_tw.json
+++ b/modules/osu/locales/zh_tw.json
@@ -9,5 +9,5 @@
     "osu.message.unbind.success": "解绑成功。",
     "osu.message.not_found": "获取内容失败。",
     "osu.message.user_unbound": "未绑定用户，请使用“${prefix}osu bind”绑定一个用户。",
-    "config.comments.osu_api_key": "osu! 的 API Key。（用于 osu 模块）"
+    "config.comments.osu_api_key": "osu! 的 API Key。（用於 osu 模組）"
 }
diff --git a/modules/wolframalpha/locales/en_us.json b/modules/wolframalpha/locales/en_us.json
index 5862df696f..aa4d85f7af 100644
--- a/modules/wolframalpha/locales/en_us.json
+++ b/modules/wolframalpha/locales/en_us.json
@@ -3,5 +3,5 @@
     "wolframalpha.help.ask": "Answer the question via WolframAlpha.",
     "wolframalpha.help.desc": "Use WolframAlpha.",
     "wolframalpha.message.incomprehensible": "WolframAlpha can't understand your question.",
-    "config.comments.wolfram_alpha_appid": "WolframAlpha 的 AppID。（用于 wolframalpha 模块）"
-}
+    "config.comments.wolfram_alpha_appid": "WolframAlpha AppID. (For wolframalpha module)"
+}
diff --git a/modules/wordle/locales/zh_tw.json b/modules/wordle/locales/zh_tw.json
index 621bbb729f..2345daddb7 100644
--- a/modules/wordle/locales/zh_tw.json
+++ b/modules/wordle/locales/zh_tw.json
@@ -12,5 +12,5 @@
     "wordle.message.stop": "已停止，答案为：${answer}。\n查詢辭典：https://dictionary.cambridge.org/dictionary/english/${answer}",
     "wordle.message.theme.disable": "已禁用深色主題。",
     "wordle.message.theme.enable": "已啟用深色主題。",
-    "config.comments.wordle_disable_image": "wordle 模块是否禁用图片。"
-}
+    "config.comments.wordle_disable_image": "wordle 模組是否停用圖片。"
+}
diff --git a/poetry.lock b/poetry.lock
index 16940bb5a1..ea5dc18bd1 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
 [[package]]
 name = "aiocqhttp"
@@ -3177,6 +3177,26 @@ files = [
 [package.dependencies]
 typing-extensions = ">=4.6.0,<4.7.0 || >4.7.0"
 
+[[package]]
+name = "pyjwt"
+version = "2.9.0"
+description = "JSON Web Token implementation in Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "PyJWT-2.9.0-py3-none-any.whl", hash = "sha256:3b02fb0f44517787776cf48f2ae25d8e14f300e6d7545a4315cee571a415e850"},
+    {file = "pyjwt-2.9.0.tar.gz", hash = "sha256:7e1e5b56cc735432a7369cbfa0efe50fa113ebecdc04ae6922deba8b84582d0c"},
+]
+
+[package.dependencies]
+cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"crypto\""}
+
+[package.extras]
+crypto = ["cryptography (>=3.4.0)"]
+dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"]
+docs = ["sphinx", "sphinx-rtd-theme", "zope.interface"]
+tests = ["coverage[toml] (==5.0.4)", "pytest (>=6.0.0,<7.0.0)"]
+
 [[package]]
 name = "pymysql"
 version = "1.1.1"
@@ -4517,4 +4537,4 @@ propcache = ">=0.2.0"
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12.0"
-content-hash = "3e820dfe728d57685e285ace6b865015663b272fda51c886a0597330811e5394"
+content-hash = "9c98494aec57da701cba72db281f4a589564bb45d66a324c3f468aba2dfeebed"
diff --git a/pyproject.toml b/pyproject.toml
index c4e3009a6e..0ae82b4362 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -53,6 +53,7 @@ khl-py = "^0.3.16"
 matrix-nio = "^0.25.0"
 attrs = "^24.2.0"
 uvicorn = {extras = ["standard"], version = "^0.32.0"}
+pyjwt = {extras = ["crypto"], version = "^2.8.0"}
 python-whois = "^0.9.0"
 pandas = "^2.2.0"
 future = "^1.0.0"
diff --git a/requirements.txt b/requirements.txt
index fd6397ce7a..f8398a97f7 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -105,6 +105,7 @@ pycryptodome==3.21.0 ; python_full_version >= "3.12.0" and python_full_version <
 pycryptodomex==3.21.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pydantic-core==2.23.4 ; python_full_version >= "3.12.0" and python_version < "4.0"
 pydantic==2.9.2 ; python_full_version >= "3.12.0" and python_version < "4.0"
+pyjwt[crypto]==2.9.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pymysql==1.1.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pyparsing==3.2.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 python-dateutil==2.9.0.post0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"

From ff393ee439b5e49a83295d3b45328710c8739a82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Sat, 28 Dec 2024 11:09:51 +0800
Subject: [PATCH 12/18] update api

---
 assets/config_store/en_us/bot_api.toml |   2 ++
 assets/config_store/zh_cn/bot_api.toml |   2 ++
 assets/config_store/zh_tw/bot_api.toml |   2 ++
 assets/config_store_packed/en_us.zip   | Bin 14843 -> 15012 bytes
 assets/config_store_packed/zh_cn.zip   | Bin 13534 -> 13690 bytes
 assets/config_store_packed/zh_tw.zip   | Bin 13507 -> 13666 bytes
 assets/favicon.ico                     | Bin 0 -> 16958 bytes
 bot.py                                 |   4 +--
 bots/api/bot.py                        |  40 +++++++++++++++++++------
 core/locales/en_us.json                |   6 ++--
 core/locales/zh_cn.json                |   6 ++--
 core/locales/zh_tw.json                |   6 ++--
 12 files changed, 51 insertions(+), 17 deletions(-)
 create mode 100644 assets/favicon.ico

diff --git a/assets/config_store/en_us/bot_api.toml b/assets/config_store/en_us/bot_api.toml
index 9415798b65..2524ea76f6 100644
--- a/assets/config_store/en_us/bot_api.toml
+++ b/assets/config_store/en_us/bot_api.toml
@@ -4,6 +4,8 @@
 
 [bot_api_secret]
 # The secret config section of the platform. The bot will try to intercept if the value here accidentally appears in the message sent, but be careful to prevent leakage.
+api_access_token = "<Replace me with str value>" # Access Token used to request the API service.
+api_allow_origins = ["*"] # The API service allows CORS sources list.
 jwt_secret = "<Replace me with str value>" # The authentication key for the built-in API, for signing and verifying validity.
 
 [bot_api]
diff --git a/assets/config_store/zh_cn/bot_api.toml b/assets/config_store/zh_cn/bot_api.toml
index 4116782585..d7e48ff102 100644
--- a/assets/config_store/zh_cn/bot_api.toml
+++ b/assets/config_store/zh_cn/bot_api.toml
@@ -4,6 +4,8 @@
 
 [bot_api_secret]
 # 平台端的密钥配置部分，此处的值若意外出现在发送的消息中，机器人会尝试拦截。但请务必提防泄露。
+api_access_token = "<Replace me with str value>" # 请求 API 服务的 Access Token。
+api_allow_origins = ["*"] # API 服务允许 CORS 的源列表。
 jwt_secret = "<Replace me with str value>" # 内置 API 的身份认证密钥，用于签名和验证有效性。
 
 [bot_api]
diff --git a/assets/config_store/zh_tw/bot_api.toml b/assets/config_store/zh_tw/bot_api.toml
index b129692ff1..d0c3eb84ad 100644
--- a/assets/config_store/zh_tw/bot_api.toml
+++ b/assets/config_store/zh_tw/bot_api.toml
@@ -4,6 +4,8 @@
 
 [bot_api_secret]
 # 平台端的金鑰設定部分，此處的值若意外出現在傳送的訊息中，機器人會嘗試攔截。但請務必提防洩漏。
+api_access_token = "<Replace me with str value>" # 請求 API 服務的 Access Token。
+api_allow_origins = ["*"] # API 服務允许 CORS 的來源列表。
 jwt_secret = "<Replace me with str value>" # 內建 API 的身份認證金鑰，用於簽署和驗證有效性。
 
 [bot_api]
diff --git a/assets/config_store_packed/en_us.zip b/assets/config_store_packed/en_us.zip
index 7fce09d16a66b99e74fe6507ba52c1341ad82a39..02bdd7841c636c9813eb657f74aaa02c3a3d01a0 100644
GIT binary patch
delta 394
zcmexeyrh&jz?+#xgaHKfBj;@7wcua|(wjXvwlVPm8Ijyyj>XPqW?-1jyqSkPm618I
zAan9IcH6Yl;?xv{l6-}t)WXu#;u3|Dj8p~308fSD)S|M?<WxOgE}+Wz#GIV`^7#Cs
z%=FB>Vg*};XeBMBSOsN;5LDF)V0Fa`&i+Bc3dQ-QMaikf3OSj@C7bhj)-Zw{B+Ivj
z3Cy@6uoS|m5sqU4i`*4|4Pl&?ah3*&Ocu1T1=E2R)@YuXJj+4{EOpXCnsMjkrxx<j
zAYY!mZs1wV#J~W;yx_oq5Zf9H1Q{5T@=M~g^YgRyO7e4a0=yZSL>S;97Ad@Z(_0f3
t1_lu3N6{)FGCAH-7HnI+r8HBe#N;`aGGOj*AU9oh@(oK_w$&COJpjc}bp!wa

delta 314
zcmZ2d`n#Anz?+#xgaHI1ch26(Yr(+`q&ItTY-8dBG9usKa?<+5#K7>0X)_OZDkF1N
zdCBB?#(JB*c`F#fDv$APVFEL11(!k?sv>bLV39V7*APaDtg|#oWb!TxTQL30!Wzx=
z$<CHK@*oRW?M+(I3A7M|1;Flt5Zf9BCihv&gSBt4lx8|EF!`({#MIY7Zocqj4lCIh
zkO@hijlPFi7#Kj955<HF;tUK)`6cm%g+NlTBtJJNz?+dtgaPjV$o-FfS4&GXFn};O
Rir#%PlN+sM*_bRqq5y1aU#tKC

diff --git a/assets/config_store_packed/zh_cn.zip b/assets/config_store_packed/zh_cn.zip
index e4a7b7ec18fe334b6c1263742dfbb3bf1953a88c..cfbbe2c9e97bbee05b748416d5b6cc290d69b236 100644
GIT binary patch
delta 397
zcmcbY`74Vzz?+#xgaHKfBIj)6eZ$5Kq&NRzt6<^-G9sJKq$C(IGcXu2Z*JoBXXHvO
z$c#@+PEIW@p1gopGv&ql?awwgDL4jrDm<Ih`?PD}^I0tlj$nC(ko@e_yvGeqybw(}
zIr-)B`9+!OnR&$uwhGZoT1v4B%1BzDwl=<4w?o0%KPXrMXw0)+6P|WVf3a}I<}+Lw
zj9^!p^OP}x85{W0Aq*)&7Z$KcqG&FJaZyr15+pMDi;*puHZitF^U35|V;!*68e?h3
zW0Ox9%Y%8ZjHPYt`573J@=M~g^YgRyO7e4a0=yZSL>S-!6j>;Fn@5U;fdPbpYT;m8
z<I2g7CUWwiFf%@Xz1amQ55jzK6$}j98b3^~Gm!;bHqS(wDM4!TZWCFyMq`i~0K5Ny
AhX4Qo

delta 326
zcmeyBbuW`Qz?+#xgaHI1ch26(`-Y7fNN@hbR>33<WJEHFwkJ<xVqgGa9-yM6{F3;@
zg3QSm1(#1Y<C?uWmphpetm86I855Y{!=DaeY!h^00gL<<&4n;>r4%GVB9kW=+k)u}
z#@2kOwoH~Z(WwUsExc4E=?%0LgayFvgAm&qwSevbIU^;rI61#4MXw}3Hz&ZGkx7IB
z?vKc&PZnF)19gHhFN*HPd=TB)`T5ycwH8WFK4K!l$UFJ2i5%FG|4gJALncd^%7S@T
TrqWDDBqxWP%CbE*0+|c|O;und

diff --git a/assets/config_store_packed/zh_tw.zip b/assets/config_store_packed/zh_tw.zip
index b74e698fc7abb7e3ae7a9142433621fdd795db74..4d03492158a2da261060a7333b714116a9c6e799 100644
GIT binary patch
delta 396
zcmX?{`6!Dwz?+#xgaHKfBIj)6eaglRq&I(MD`MgUG9ufGt9BSMGcXu2Z!YEZXJk$+
z$ef(dW|013b@#K4O$v?yo(j+A^givL`FvK3f@5-WYH_hbNPc!|-s6TQUM`^O_{5x?
z{POtxqRjNnykZ4gg=i%$rC0@JB&|<d8(*y3q2TNv6s!O==E=UcXS*gm?U?>z;fl@s
zxl$RyE>h<yU}Dw>I&BtTB82fzz>x(k;v|~E0#>tDQd1Jdn0(X77EDVTTci16a+0wQ
zSZboNG~>?6YmMbWMod0$EX}0DKlzQZG?>d}BF!{GaI(6IYz$B~^3&!G`|Vj67(kd0
z999rwTjLc`28N{klK8?xAgNc9pPLil&B!Fe01wf~j8gRrjFJotAk2-T*IsJ!0ux!b
IOk<EJ0K(FLzyJUM

delta 312
zcmaEqbvTnZz?+#xgaHI1ch26(`;?6tNN@hiR>Z^yWJInt_Ew$D#K16_X>%#3KjY?P
z?gU1#ieo$lOkjp3e<Fl2SJ06KEb>q^1H$l;(v$>=Os+7t1=Bl>t<g-K%xIzmmNGDr
zW|W%jV<Hdc<(Wt`_3};bHjxH%SDHxIe-vO~NXjpX&rK{T%B;{U$<NIR@MdHZVSu|n
z^3&!G`|Vj67(kd0>?a7Zt<h8zqPegTXarWh8KvqM7$q4PK$sgv?*gDma{gpzQ%SZ{
HMj#mg){R<D

diff --git a/assets/favicon.ico b/assets/favicon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..6ef8eee3d916f279245bd9506e987431873369b2
GIT binary patch
literal 16958
zcmeI2KWG#|6voFSsFevKVj)CCB!!3s3z1+#Dhsg?NfAU+1Q7{hDIzF{gcO1%iU?YW
zh^R=4AR-blSXc!SD+}S|ijX465yXhet-rUoZ*T78ybHIxw|AKhU*7KQ%zNMWW_D)(
zoH3jD8yGPB-(z|PjoE38=>Zg(>p;r=ZJ=P>f0qH50ha-n0ha-n0ha-nf#@^fJv7F<
zW7_g}Oh<mQHb{MMGI}madGw}y%}3EOh3?PT9Qd;i{Gx7_wy&`lu-lX3UT+-u9t3m1
ziwfwM{9Oi{>*W_`dw7lj>AT3Zm-+gDe|fA)-3HH5uvW(R3w*Cqb^;t@zpq9NQhx+I
z1wVnEPx0B6rUbz62$1Vrc`mU(%pBHMFHijJM(?!c+v9k~yIa5Sdbvq^cy)j;7QY4f
z$zyk98}q5GAGfR+lIP*b0@UG1cqlJ8${6UY!(GLuk^_9tXe{hk##cwh1__*yH5wlF
zT>mJ}b(>gwz;B?}8E<(Sx51;UjL(6%*%0rg>X&OG?s)(6507KY1^YdU`R;%5<Q#EE
zteA7v>c@E=9^tjm{<}D1sc+)QTBGCto0d1i!sDF9<y8_K81o0Lm<vh7tQ5o653fY@
z6Vuke$TinR>}{0SeXmhTXQlEK=$Gq2pR1P0!*kGEiEq^9DbcTUfm+GOSpG%SYX9|@
zQvH$#c@8=CFXL!SQlMX+GY)~n;5=i05v$`M%iORvTE(T_h!xKN#7=(xyKPG5fB5tO
z`+4zXDdT95(xzY3!RayZ#{hjY9<Ab1Zz<J(MfGDJlroO?D5d)4J(>3ZM$|v9`mwx;
zjc-d^|1;mqyBK-jtZTr<_|*GzO={+US?kb!Pqj1mt%1EQt-tUt<PDnNf(6wc*e7vn
z7vIDQ`=9;f*Z<-;*YU1au7TL!5i`C9fySJOJKsUh?dLy@tyb=PpMgZa7X{zBP807E
zi1l7mb4wgs|1!rn!3}T$?9+O!YSCEKUv~f7s+w(GY10p%U7#;PoF!J_dT((5!(%^?
zZ?ii8Bx@V5|4hTQ7jpjHzBZEHXYJd8{&^tZWRix={bNaME|153r+k~-j7=2sTbgn%
zX*;HWdciEX55nJW$bL{J=fd~3b~!l>%hRT-Rz7GDeL5!&X*<e>tnyhcr+!#2ZMD2v
zEgEHR@b#nToa&&=er}krR<7rp%{u+X{+B-2{@XzPAO3EK@qfGq{l}@N^To8*Z&ph`
z%f0agnnv^1@0BX`KWm!2Q;^@0O@Lj^s=FHRO8Tp{YnAip57#;Nn|_^JZ@-{9y#L|a
zX!`q{_3C%^T?SkRTn1bQTn1bQTn5sR0Wb1x#kBiAGd$GD_THF&u{XSxZj9II<vTHX
z4t(41dE*?fVn2$#=6N3io2_Cq{e}9O?!e+u+Gla-TO9fphrY#OiPdtg7qrW4Db&jZ
x{xbNNEmJU_@RH58tMq0&Wwymlaa&#f<R7f$KGtN{az6@<bAb=F%fWFZ<}al9!TA6H

literal 0
HcmV?d00001

diff --git a/bot.py b/bot.py
index 932470e948..5eb267f14b 100644
--- a/bot.py
+++ b/bot.py
@@ -26,7 +26,7 @@
     "aiogram": ["telegram_token"],
     "kook": ["kook_token"],
     "matrix": ["matrix_homeserver", "matrix_user", "matrix_device_id", "matrix_token"],
-    "api": [],
+    "api": ["jwt_secret", "api_allow_origins"],
     "qqbot": ["qq_bot_appid", "qq_bot_secret"],
 }
 
@@ -98,7 +98,7 @@ def multiprocess_run_until_complete(func):
     p.close()
 
 
-def go(bot_name: str = None, subprocess: bool = False, binary_mode: bool = False):
+def go(bot_name: str, subprocess: bool = False, binary_mode: bool = False):
     from core.logger import Logger  # noqa
     from core.utils.info import Info  # noqa
 
diff --git a/bots/api/bot.py b/bots/api/bot.py
index 3bdb2fb631..ad19578535 100644
--- a/bots/api/bot.py
+++ b/bots/api/bot.py
@@ -13,7 +13,9 @@
 from cpuinfo import get_cpu_info
 from fastapi import FastAPI, Request, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import FileResponse
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from fastapi.staticfiles import StaticFiles
 
 from bots.api.info import client_name
 from core.queue import JobQueue
@@ -33,29 +35,38 @@
 from core.utils.i18n import Locale  # noqa: E402
 from modules.wiki.utils.dbutils import WikiTargetInfo  # noqa: E402
 
-
-PrivateAssets.set(os.path.join(assets_path, "private", "api"))
-app = FastAPI()
 started_time = datetime.now()
-
+PrivateAssets.set(os.path.join(assets_path, "private", "api"))
+ACCESS_TOKEN = Config("api_access_token", cfg_type=str, secret=True, table_name="bot_api")
+ALLOW_ORIGINS = Config("api_allow_origins", default=['*'], cfg_type=(str, list), secret=True, table_name="bot_api")
 JWT_SECRET = Config("jwt_secret", cfg_type=str, secret=True, table_name="bot_api")
 PASSWORD_PATH = os.path.join(PrivateAssets.path, ".password")
 
 
-origins = [
-    "http://localhost:8080",
-    "http://127.0.0.1:8080",
-]  # temp
+def verify_access_token(request: Request):
+    if request.url.path == "/favicon.ico":
+        return
+    if not ACCESS_TOKEN:
+        return
+
+    auth_header = request.headers.get("Authorization")
+    if not auth_header or auth_header != f"Bearer {ACCESS_TOKEN}":
+        raise HTTPException(status_code=403, detail="forbidden")
+
+
+app = FastAPI(dependencies=[Depends(verify_access_token)])
 
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origins=ALLOW_ORIGINS,
     allow_credentials=True,
     allow_methods=["GET", "POST"],
     allow_headers=["*"],
 )
 
+app.mount("/assets", StaticFiles(directory="assets"), name="assets")
+
 
 @app.on_event("startup")
 async def startup_event():
@@ -66,6 +77,17 @@ async def startup_event():
     await JobQueue.web_render_status()
 
 
+@app.get("/favicon.ico", response_class=FileResponse)
+async def favicon():
+    favicon_path = os.path.join(assets_path, "favicon.ico")
+    return FileResponse(favicon_path)
+
+
+@app.get("/")
+async def main():
+    return {"message": "Hello AkariBot!"}
+
+
 @app.post("/auth")
 async def auth(request: Request):
     try:
diff --git a/core/locales/en_us.json b/core/locales/en_us.json
index 76ea746417..58fe15dd58 100644
--- a/core/locales/en_us.json
+++ b/core/locales/en_us.json
@@ -4,6 +4,8 @@
     "check.redacted.all": "<ALL REDACTED:${reason}>",
     "config.comments.allow_reload_base": "Whether to allow reloading of the base modules.",
     "config.comments.allow_request_private_ip": "Whether to allow bot to request local private IP addresses. (Prevent possible leakage)",
+    "config.comments.api_access_token": "Access Token used to request the API service.",
+    "config.comments.api_allow_origins": "The API service allows CORS sources list.",
     "config.comments.api_port": "The port number of the API service.",
     "config.comments.base_superuser": "The bot's base superuser list. The values ​​filled in here will be loaded into the database when the bot starts.",
     "config.comments.bug_report_url": "Report error URL.",
@@ -47,6 +49,7 @@
     "config.comments.matrix_user": "Matrix bot fully restricted user ID.",
     "config.comments.no_confirm": "Whether to execute the command without the sender confirming the message.",
     "config.comments.proxy": "Proxy service address.",
+    "config.comments.qq_access_token": "Access Token for connecting to the WebSocket server when using the Onebot protocol.",
     "config.comments.qq_account": "Bot QQ number. (Required when using the Onebot Protocol side to deploy the QQ bot)",
     "config.comments.qq_allow_approve_friend": "Whether to automatically approve friend requests when using the Onebot protocol.",
     "config.comments.qq_allow_approve_group_invite": "Whether to automatically accept group invitations when using the Onebot protocol.",
@@ -56,7 +59,6 @@
     "config.comments.qq_disable_temp_session": "Whether to enable temp sessions when using the Onebot Protocol.",
     "config.comments.qq_enable_listening_self_message": "Whether to enable self-message monitoring when using the Onebot protocol.",
     "config.comments.qq_host": "The address of Aiocqhttp WebSocket main server. (The Onebot protocol end should use the reverse Websocket method to connect)",
-    "config.comments.qq_access_token": "Access Token for connecting to the WebSocket server when using the Onebot protocol.",
     "config.comments.qq_limited_emoji": "When using QQ related protocol terminals, the response emoji ID attached to the message when the message processing fails. It needs to be supported by the protocol terminal. For details of emoji ID, see: https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
     "config.comments.qq_private_bot": "Whether it is a private robot when using the QQ official bot.",
     "config.comments.qq_typing_emoji": "When using QQ related protocol terminals, the response emoji ID attached to the message when processing the message. It needs to be supported by the protocol terminal. For details of emoji ID, see: https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
@@ -182,4 +184,4 @@
     "tos.message.warning.count": "You have received ${current_warns} warnings.",
     "tos.message.warning.last": "This is the last warning.",
     "tos.message.warning.prompt": "Your account will be blocked if you receive more than ${warn_counts} warnings."
-}
+}
\ No newline at end of file
diff --git a/core/locales/zh_cn.json b/core/locales/zh_cn.json
index 79dfd0b19d..125fe79315 100644
--- a/core/locales/zh_cn.json
+++ b/core/locales/zh_cn.json
@@ -4,6 +4,8 @@
     "check.redacted.all": "<全部吃掉了:${reason}>",
     "config.comments.allow_reload_base": "是否允许重载基础模块。",
     "config.comments.allow_request_private_ip": "是否允许机器人请求本地私有 IP 地址。（防止可能的信息泄露）",
+    "config.comments.api_access_token": "请求 API 服务的 Access Token。",
+    "config.comments.api_allow_origins": "API 服务允许 CORS 的源列表。",
     "config.comments.api_port": "API 服务的端口号。",
     "config.comments.base_superuser": "机器人的基础超级用户列表，此处填写的值将会在机器人启动时被加载进入数据库。",
     "config.comments.bug_report_url": "汇报错误网址。",
@@ -47,6 +49,7 @@
     "config.comments.matrix_user": "Matrix 机器人的完全限定用户 ID。",
     "config.comments.no_confirm": "是否无需发送者确认消息后再执行命令。",
     "config.comments.proxy": "代理服务地址。",
+    "config.comments.qq_access_token": "使用 Onebot 协议时，连接 WebSocket 服务器的 Access Token。",
     "config.comments.qq_account": "机器人 QQ 号。（使用 Onebot 协议端部署 QQ 机器人时需要）",
     "config.comments.qq_allow_approve_friend": "使用 Onebot 协议时，是否自动同意好友请求。",
     "config.comments.qq_allow_approve_group_invite": "使用 Onebot 协议时，是否自动同意群邀请。",
@@ -56,7 +59,6 @@
     "config.comments.qq_disable_temp_session": "使用 Onebot 协议时，是否启用临时会话。",
     "config.comments.qq_enable_listening_self_message": "使用 Onebot 协议时，是否启用自身消息监听。",
     "config.comments.qq_host": "Aiocqhttp WebSocket 主服务器的地址。（Onebot 协议端请使用反向 Websocket 方式进行连接）",
-    "config.comments.qq_access_token": "使用 Onebot 协议时，连接 WebSocket 服务器的 Access Token。",
     "config.comments.qq_limited_emoji": "使用 QQ 相关协议端时，消息处理失败时向消息挂上的回应表情 ID，需协议端支持。ID 详见：https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
     "config.comments.qq_private_bot": "使用 QQ 机器人（官方）时，是否为私域机器人。",
     "config.comments.qq_typing_emoji": "使用 QQ 相关协议端时，正在处理消息时向消息挂上的回应表情 ID，需协议端支持。ID 详见：https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
@@ -182,4 +184,4 @@
     "tos.message.warning.count": "这是第 ${current_warns} 次警告。",
     "tos.message.warning.last": "这是最后一次警告。",
     "tos.message.warning.prompt": "如超过 ${warn_counts} 次警告，我们将会封禁你的账户。"
-}
+}
\ No newline at end of file
diff --git a/core/locales/zh_tw.json b/core/locales/zh_tw.json
index 0f9224b7aa..e8bb61a283 100644
--- a/core/locales/zh_tw.json
+++ b/core/locales/zh_tw.json
@@ -4,6 +4,8 @@
     "check.redacted.all": "<全部已編輯:${reason}>",
     "config.comments.allow_reload_base": "是否允許重載基礎模組。",
     "config.comments.allow_request_private_ip": "是否允許機器人請求本地私有 IP 位址。（防止可能的資訊外洩）",
+    "config.comments.api_access_token": "請求 API 服務的 Access Token。",
+    "config.comments.api_allow_origins": "API 服務允许 CORS 的來源列表。",
     "config.comments.api_port": "API 服務的連接埠號。",
     "config.comments.base_superuser": "機器人的基礎超級使用者列表，此處填寫的值將會在機器人啟動時載入資料庫。",
     "config.comments.bug_report_url": "回報錯誤網址。",
@@ -47,6 +49,7 @@
     "config.comments.matrix_user": "Matrix 機器人的完全限定使用者 ID。",
     "config.comments.no_confirm": "是否無需傳送者確認訊息後再執行指令。",
     "config.comments.proxy": "代理服務位址。",
+    "config.comments.qq_access_token": "使用 Onebot 協定時，連結 WebSocket 伺服器的 Access Token。",
     "config.comments.qq_account": "機器人 QQ 號。（使用 Onebot 協定端部署 QQ 機器人時需要）",
     "config.comments.qq_allow_approve_friend": "使用 Onebot 協定時，是否自動同意好友請求。",
     "config.comments.qq_allow_approve_group_invite": "使用 Onebot 協定時，是否自動同意群組邀請。",
@@ -56,7 +59,6 @@
     "config.comments.qq_disable_temp_session": "使用 Onebot 協定時，是否啟用臨時會話。",
     "config.comments.qq_enable_listening_self_message": "使用 Onebot 協定時，是否啟用自身訊息監聽。",
     "config.comments.qq_host": "Aiocqhttp WebSocket 主伺服器的位址。（Onebot 協定端請使用反向 Websocket 方式連線）",
-    "config.comments.qq_access_token": "使用 Onebot 協定時，連結 WebSocket 伺服器的 Access Token。",
     "config.comments.qq_limited_emoji": "使用 QQ 相關協定端時，訊息處理失敗時向訊息掛上的回應表情 ID，需協定端支援。 ID 詳見：https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
     "config.comments.qq_private_bot": "使用 QQ 機器人（官方）時，是否為私域機器人。",
     "config.comments.qq_typing_emoji": "使用 QQ 相關協定端時，正在處理訊息時向訊息掛上的回應表情 ID，需協定端支援。 ID 詳見：https://bot.q.qq.com/wiki/develop/api/openapi/emoji/model.html#Emoji",
@@ -182,4 +184,4 @@
     "tos.message.warning.count": "這是第 ${current_warns} 次警告。",
     "tos.message.warning.last": "這是最後一次警告。",
     "tos.message.warning.prompt": "如超過 ${warn_counts} 次警告，我們將會封鎖你的帳戶。"
-}
+}
\ No newline at end of file

From 19a55def27b53dc5a08976e135a90794dff02397 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Sat, 28 Dec 2024 12:43:09 +0800
Subject: [PATCH 13/18] fix regex

---
 core/builtins/message/__init__.py |  4 +++-
 core/parser/message.py            | 20 ++++++----------
 example/new_module/__init__.py    |  4 ++--
 modules/bilibili/__init__.py      | 32 +++++++++++--------------
 modules/bugtracker/__init__.py    |  3 ++-
 modules/exchange_rate/__init__.py | 20 ++++++++--------
 modules/maimai/regex.py           | 36 +++++++---------------------
 modules/wiki/inline.py            | 39 +++++++++++--------------------
 8 files changed, 59 insertions(+), 99 deletions(-)

diff --git a/core/builtins/message/__init__.py b/core/builtins/message/__init__.py
index acf9ae7b74..dc24dcbd62 100644
--- a/core/builtins/message/__init__.py
+++ b/core/builtins/message/__init__.py
@@ -2,7 +2,8 @@
 
 import asyncio
 from datetime import datetime, UTC as datetimeUTC
-from typing import Any, Coroutine, Dict, List, Optional, Union
+from re import Match
+from typing import Any, Coroutine, Dict, List, Optional, Tuple, Union
 
 from core.builtins.message.chain import *
 from core.builtins.message.elements import MessageElement
@@ -195,6 +196,7 @@ def __init__(self, target: MsgInfo, session: Session):
         self.session = session
         self.sent: List[MessageChain] = []
         self.trigger_msg: Optional[str] = None
+        self.matched_msg: Optional[Union[Match[str], Tuple[Any]]] = None
         self.parsed_msg: Optional[dict] = None
         self.prefixes: List[str] = []
         self.data = exports.get("BotDBUtil").TargetInfo(self.target.target_id)
diff --git a/core/parser/message.py b/core/parser/message.py
index 411f70ccdf..d73d3b8a03 100644
--- a/core/parser/message.py
+++ b/core/parser/message.py
@@ -489,11 +489,8 @@ async def execute_submodule(msg: Bot.MessageSession, command_first_word):
                         errmsg = msg.locale.t('error.prompt.report', detail=str(e))
 
                     if Config('bug_report_url', bug_report_url_default, cfg_type=str):
-                        errmsg += '\n' + msg.locale.t('error.prompt.address',
-                                                      url=Url(Config('bug_report_url',
-                                                                     bug_report_url_default,
-                                                                     cfg_type=str),
-                                                              use_mm=False))
+                        bug_report_url = Url(Config('bug_report_url', bug_report_url_default, cfg_type=str), use_mm=False)
+                        errmsg += '\n' + msg.locale.t('error.prompt.address', url=bug_report_url)
                     await msg.send_message(errmsg)
 
                     if not timeout and report_targets:
@@ -539,16 +536,16 @@ async def execute_submodule(msg: Bot.MessageSession, command_first_word):
                     for rfunc in regex_module.regex_list.set:  # 遍历正则模块的表达式
                         time_start = datetime.now()
                         try:
-                            msg.matched_msg = False
                             matched = False
                             matched_hash = 0
+                            trigger_msg = msg.as_display(msg.trigger_msg)
                             if rfunc.mode.upper() in ['M', 'MATCH']:
-                                msg.matched_msg = re.match(rfunc.pattern, msg.trigger_msg, flags=rfunc.flags)
+                                msg.matched_msg = re.match(rfunc.pattern, trigger_msg, flags=rfunc.flags)
                                 if msg.matched_msg:
                                     matched = True
                                     matched_hash = hash(msg.matched_msg.groups())
                             elif rfunc.mode.upper() in ['A', 'FINDALL']:
-                                msg.matched_msg = re.findall(rfunc.pattern, msg.trigger_msg, flags=rfunc.flags)
+                                msg.matched_msg = re.findall(rfunc.pattern, trigger_msg, flags=rfunc.flags)
                                 msg.matched_msg = tuple(set(msg.matched_msg))
                                 if msg.matched_msg:
                                     matched = True
@@ -633,11 +630,8 @@ async def execute_submodule(msg: Bot.MessageSession, command_first_word):
                                 errmsg = msg.locale.t('error.prompt.report', detail=str(e))
 
                             if Config('bug_report_url', bug_report_url_default, cfg_type=str):
-                                errmsg += '\n' + msg.locale.t('error.prompt.address',
-                                                              url=str(Url(Config('bug_report_url',
-                                                                                 bug_report_url_default,
-                                                                                 cfg_type=str),
-                                                                          use_mm=False)))
+                                bug_report_url = Url(Config('bug_report_url', bug_report_url_default, cfg_type=str), use_mm=False)
+                                errmsg += '\n' + msg.locale.t('error.prompt.address', url=bug_report_url)
                             await msg.send_message(errmsg)
 
                             if not timeout and report_targets:
diff --git a/example/new_module/__init__.py b/example/new_module/__init__.py
index db31e89762..98bc516bb6 100644
--- a/example/new_module/__init__.py
+++ b/example/new_module/__init__.py
@@ -49,14 +49,14 @@ async def _(msg: Bot.MessageSession):
     await msg.send_message([Plain("A picture:"), Image("https://http.cat/100.jpg")])
 
 
-@test.regex(re.compile(r"\{\{(.*)}}"), mode="M")  # re.match
+@test.regex(r"\{\{(.*)}}", mode="M")  # re.match
 async def _(msg: Bot.MessageSession):
     #  >>> {{Hello World!}}
     #  <<< Hello World!
     await msg.finish(msg.matched_msg.group(1))
 
 
-@test.regex(re.compile(r"\[\[(.*)]]"), mode="A")  # re.findall
+@test.regex(r"\[\[(.*)]]", mode="A")  # re.findall
 async def _(msg: Bot.MessageSession):
     #  >>> [[Hello]] [[World]]
     #  <<< Hello
diff --git a/modules/bilibili/__init__.py b/modules/bilibili/__init__.py
index c1a5ecf07f..b7945b3d77 100644
--- a/modules/bilibili/__init__.py
+++ b/modules/bilibili/__init__.py
@@ -36,34 +36,30 @@ async def _(msg: Bot.MessageSession, bid: str, get_detail=False):
         await msg.finish(msg.locale.t("message.cooldown", time=int(30 - res)))
 
 
-@bili.regex(
-    re.compile(r"av(\d+)", flags=re.I), mode="M", desc="{bilibili.help.regex.av}"
-)
+@bili.regex(r"av(\d+)", flags=re.I, mode="A", desc="{bilibili.help.regex.av}")
 async def _(msg: Bot.MessageSession):
-    query = f"?aid={msg.matched_msg.group(1)}"
-    await get_video_info(msg, query)
+    matched = msg.matched_msg[:5]
+    for video in matched:
+        if video:
+            query = f"?aid={video}"
+            await get_video_info(msg, query)
 
 
-@bili.regex(
-    re.compile(r"\bBV[a-zA-Z0-9]{10}\b"), mode="A", desc="{bilibili.help.regex.bv}"
-)
+@bili.regex(r"\bBV[a-zA-Z0-9]{10}\b", mode="A", desc="{bilibili.help.regex.bv}")
 async def _(msg: Bot.MessageSession):
-    matched = list(set(msg.matched_msg))[:5]
+    matched = msg.matched_msg[:5]
     for video in matched:
-        if video != "":
+        if video:
             query = f"?bvid={video}"
             await get_video_info(msg, query)
 
 
-@bili.regex(
-    re.compile(
-        r"\b(?:http[s]?://)?(?:bili(?:22|33|2233)\.cn|b23\.tv)/([A-Za-z0-9]{7})(?:/.*?|)\b"
-    ),
-    mode="A",
-    desc="{bilibili.help.regex.url}",
-)
+@bili.regex(r"\b(?:http[s]?://)?(?:bili(?:22|33|2233)\.cn|b23\.tv)/([A-Za-z0-9]{7})(?:/.*?|)\b",
+            mode="A",
+            desc="{bilibili.help.regex.url}",
+            )
 async def _(msg: Bot.MessageSession):
-    matched = list(set(msg.matched_msg))[:5]
+    matched = msg.matched_msg[:5]
     for video in matched:
         if video != "":
             query = await parse_shorturl(f"https://b23.tv/{video}")
diff --git a/modules/bugtracker/__init__.py b/modules/bugtracker/__init__.py
index aa8dd663f7..b4a4cd289c 100644
--- a/modules/bugtracker/__init__.py
+++ b/modules/bugtracker/__init__.py
@@ -39,7 +39,8 @@ async def _(msg: Bot.MessageSession, mojiraid: str):
     desc="{bugtracker.help.regex.desc}",
 )
 async def _(msg: Bot.MessageSession):
-    titles = list(set(msg.matched_msg))[:5]
+
+    titles = msg.matched_msg[:5]
     for title in titles:
         if title != "":
             await query_bugtracker(msg, title)
diff --git a/modules/exchange_rate/__init__.py b/modules/exchange_rate/__init__.py
index 30abfe05aa..0b9c08d3a5 100644
--- a/modules/exchange_rate/__init__.py
+++ b/modules/exchange_rate/__init__.py
@@ -1,10 +1,12 @@
 import datetime
+import re
 
 from core.builtins import Bot
 from core.component import module
 from core.config import Config
 from core.constants.exceptions import ConfigValueError
 from core.utils.http import get_url
+from core.utils.text import isfloat
 
 api_key = Config("exchange_rate_api_key", cfg_type=str, secret=True)
 
@@ -61,8 +63,6 @@ async def exchange(base_currency, target_currency, amount: float, msg):
             await msg.finish(
                 f"{msg.locale.t('exchange_rate.message.invalid.unit')}{' '.join(unsupported_currencies)}"
             )
-    else:
-        raise Exception(data["error-type"])
 
     url = f"https://v6.exchangerate-api.com/v6/{api_key}/pair/{base_currency}/{target_currency}/{amount}"
     data = await get_url(url, 200, fmt="json")
@@ -81,18 +81,18 @@ async def exchange(base_currency, target_currency, amount: float, msg):
                 time=time,
             )
         )
-    else:
-        raise Exception(data["error-type"])
 
 
 @excr.regex(
-    r"(\d+(\.\d+)?)?\s?([a-zA-Z]{3})\s?[兑换兌換]\s?([a-zA-Z]{3})",
+    r"(\d+(?:\.\d+)?)?\s?([a-zA-Z]{3})\s?[兑换兌換]\s?([a-zA-Z]{3})",
+    mode="M",
+    flags=re.I,
     desc="{exchange_rate.help.regex.desc}",
 )
 async def _(msg: Bot.MessageSession):
-    groups = msg.matched_msg.groups()
-    amount = groups[0] if groups[0] else "1"
-    base = groups[2].upper()
-    target = groups[3].upper()
+    matched_msg = msg.matched_msg
+    amount = matched_msg.group(1) if matched_msg.group(1) and isfloat(matched_msg.group(1)) else 1
+    base = matched_msg.group(2).upper()
+    target = matched_msg.group(3).upper()
     if base != target:
-        await msg.finish(await exchange(base, target, amount, msg))
+        await msg.finish(await exchange(base, target, float(amount), msg))
diff --git a/modules/maimai/regex.py b/modules/maimai/regex.py
index ad25953588..40190bf227 100644
--- a/modules/maimai/regex.py
+++ b/modules/maimai/regex.py
@@ -24,9 +24,7 @@
 )
 
 
-@mai_regex.regex(
-    re.compile(r"(.+)\s?是什[么麼]歌"), desc="{maimai.help.maimai_regex.song}"
-)
+@mai_regex.regex(r"(.+)\s?是什[么麼]歌", desc="{maimai.help.maimai_regex.song}")
 async def _(msg: Bot.MessageSession):
     name = msg.matched_msg.groups()[0]
     if name[:2].lower() == "id":
@@ -75,10 +73,7 @@ async def _(msg: Bot.MessageSession):
     await msg.finish(await get_info(music, Plain(res)))
 
 
-@mai_regex.regex(
-    re.compile(r"(?:id)?(\d+)\s?有什(?:么别|麼別)[名称稱]", flags=re.I),
-    desc="{maimai.help.maimai_regex.alias}",
-)
+@mai_regex.regex(r"(?:id)?(\d+)\s?有什(?:么别|麼別)[名称稱]", flags=re.I, desc="{maimai.help.maimai_regex.alias}")
 async def _(msg: Bot.MessageSession):
     sid = msg.matched_msg.groups()[0]
     music = (await total_list.get()).by_id(sid)
@@ -96,19 +91,14 @@ async def _(msg: Bot.MessageSession):
         await msg.finish([Plain(result.strip())])
 
 
-@mai_regex.regex(
-    re.compile(r"(.+)\s?有什[么麼]分\s?(.+)?"), desc="{maimai.help.maimai_regex.info}"
-)
+@mai_regex.regex(r"(.+)\s?有什[么麼]分\s?(.+)?", desc="{maimai.help.maimai_regex.info}")
 async def _(msg: Bot.MessageSession):
     songname = msg.matched_msg.groups()[0]
     username = msg.matched_msg.groups()[1]
     await query_song_info(msg, songname, username)
 
 
-@mai_regex.regex(
-    re.compile(r"(\d+\+?)\s?([a-zA-Z]+\+?)\s?[进進]度\s?(.+)?"),
-    desc="{maimai.help.maimai_regex.process}",
-)
+@mai_regex.regex(r"(\d+\+?)\s?([a-zA-Z]+\+?)\s?[进進]度\s?(.+)?", desc="{maimai.help.maimai_regex.process}")
 async def _(msg: Bot.MessageSession):
     level = msg.matched_msg.groups()[0]
     goal = msg.matched_msg.groups()[1]
@@ -116,22 +106,15 @@ async def _(msg: Bot.MessageSession):
     await query_process(msg, level, goal, username)
 
 
-@mai_regex.regex(
-    re.compile(r"(.?)([極极将將舞神者]舞?)[进進]度\s?(.+)?"),
-    desc="{maimai.help.maimai_regex.plate}",
-)
+@mai_regex.regex(r"(.?)([極极将將舞神者]舞?)[进進]度\s?(.+)?", desc="{maimai.help.maimai_regex.plate}")
 async def _(msg: Bot.MessageSession):
     plate = msg.matched_msg.groups()[0] + msg.matched_msg.groups()[1]
     username = msg.matched_msg.groups()[2]
     await query_plate(msg, plate, username)
 
 
-@mai_regex.regex(
-    re.compile(
-        r"(?:随个|隨個)\s?((?:dx|DX|sd|SD|标准|標準)\s?)?([绿綠黄黃红紅紫白]?)\s?([0-9]+\+?)"
-    ),
-    desc="{maimai.help.maimai_regex.random}",
-)
+@mai_regex.regex(r"(?:随个|隨個)\s?((?:dx|DX|sd|SD|标准|標準)\s?)?([绿綠黄黃红紅紫白]?)\s?([0-9]+\+?)",
+                 desc="{maimai.help.maimai_regex.random}")
 async def _(msg: Bot.MessageSession):
     res = msg.matched_msg
     if res:
@@ -162,10 +145,7 @@ async def _(msg: Bot.MessageSession):
             await msg.finish(msg.locale.t("maimai.message.random.failed"))
 
 
-@mai_regex.regex(
-    re.compile(r"(.+)\s?段位(?:[认認]定)?列?表"),
-    desc="{maimai.help.maimai_regex.grade}",
-)
+@mai_regex.regex(r"(.+)\s?段位(?:[认認]定)?列?表", desc="{maimai.help.maimai_regex.grade}")
 async def _(msg: Bot.MessageSession):
     grade = msg.matched_msg.groups()[0]
     await get_grade_info(msg, grade)
diff --git a/modules/wiki/inline.py b/modules/wiki/inline.py
index 76cec2c06b..3b84a09207 100644
--- a/modules/wiki/inline.py
+++ b/modules/wiki/inline.py
@@ -31,11 +31,7 @@
 )
 
 
-@wiki_inline.regex(
-    re.compile(r"\[\[(.*?)\]\]", flags=re.I),
-    mode="A",
-    desc="{wiki.help.wiki_inline.page}",
-)
+@wiki_inline.regex(r"\[\[(.*?)\]\]", flags=re.I, mode="A", desc="{wiki.help.wiki_inline.page}")
 async def _(msg: Bot.MessageSession):
     query_list = []
     for x in msg.matched_msg:
@@ -45,11 +41,7 @@ async def _(msg: Bot.MessageSession):
         await query_pages(msg, query_list[:5], inline_mode=True)
 
 
-@wiki_inline.regex(
-    re.compile(r"\{\{(.*?)\}\}", flags=re.I),
-    mode="A",
-    desc="{wiki.help.wiki_inline.template}",
-)
+@wiki_inline.regex(r"\{\{(.*?)\}\}", flags=re.I, mode="A", desc="{wiki.help.wiki_inline.template}")
 async def _(msg: Bot.MessageSession):
     query_list = []
     for x in msg.matched_msg:
@@ -59,12 +51,11 @@ async def _(msg: Bot.MessageSession):
         await query_pages(msg, query_list[:5], template=True, inline_mode=True)
 
 
-@wiki_inline.regex(
-    re.compile(r"≺(.*?)≻|⧼(.*?)⧽", flags=re.I),
-    mode="A",
-    show_typing=False,
-    desc="{wiki.help.wiki_inline.mediawiki}",
-)
+@wiki_inline.regex(r"≺(.*?)≻|⧼(.*?)⧽",
+                   flags=re.I,
+                   mode="A",
+                   show_typing=False,
+                   desc="{wiki.help.wiki_inline.mediawiki}")
 async def _(msg: Bot.MessageSession):
     query_list = []
     for x in msg.matched_msg:
@@ -75,16 +66,12 @@ async def _(msg: Bot.MessageSession):
         await query_pages(msg, query_list[:5], mediawiki=True, inline_mode=True)
 
 
-@wiki_inline.regex(
-    re.compile(
-        r"(https?://[-a-zA-Z0-9@:%._+~#=]{2,256}\.[a-z]{2,4}\b[-a-zA-Z0-9@:%_+.~#?&/=]*)",
-        flags=re.I,
-    ),
-    mode="A",
-    show_typing=False,
-    logging=False,
-    desc="{wiki.help.wiki_inline.url}",
-)
+@wiki_inline.regex(r"(https?://[-a-zA-Z0-9@:%._+~#=]{2,256}\.[a-z]{2,4}\b[-a-zA-Z0-9@:%_+.~#?&/=]*)",
+                   flags=re.I,
+                   mode="A",
+                   show_typing=False,
+                   logging=False,
+                   desc="{wiki.help.wiki_inline.url}")
 async def _(msg: Bot.MessageSession):
     match_msg = msg.matched_msg
 

From 17bd49a9b24dd80c6387c23438c1126baf8d7915 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 28 Dec 2024 13:16:28 +0800
Subject: [PATCH 14/18] Update dependency quart to v0.20.0 [SECURITY] (#1511)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index f8398a97f7..516ce73e1c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -116,7 +116,7 @@ pytz==2024.2 ; python_version >= "3.12" and python_version < "4.0"
 pywin32==306 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0" and sys_platform == "win32"
 pyyaml==6.0.2 ; python_version >= "3.12" and python_version < "4.0"
 qq-botpy==1.2.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
-quart==0.19.8 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
+quart==0.20.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 referencing==0.35.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 regex==2024.9.11 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 requests-toolbelt==1.0.0 ; python_full_version >= "3.12.0" and python_version < "4.0"

From 2de667bd1cc4e2b5e799fcb06bb3f07c9111cfda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <dorowolf314@gmail.com>
Date: Sat, 28 Dec 2024 13:39:53 +0800
Subject: [PATCH 15/18] use argon2 instead hs256

---
 bots/api/bot.py  | 20 ++++++-------
 poetry.lock      | 76 +++++++++++++++++++++++++++++++++++++++++-------
 pyproject.toml   |  1 +
 requirements.txt |  6 ++--
 4 files changed, 81 insertions(+), 22 deletions(-)

diff --git a/bots/api/bot.py b/bots/api/bot.py
index ad19578535..8be6ea3cc9 100644
--- a/bots/api/bot.py
+++ b/bots/api/bot.py
@@ -5,12 +5,9 @@
 import uuid
 from datetime import datetime, timedelta, UTC
 
-import hashlib
 import jwt
-import orjson as json
-import psutil
 import uvicorn
-from cpuinfo import get_cpu_info
+from argon2 import PasswordHasher
 from fastapi import FastAPI, Request, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse
@@ -55,6 +52,7 @@ def verify_access_token(request: Request):
 
 
 app = FastAPI(dependencies=[Depends(verify_access_token)])
+ph = PasswordHasher()
 
 
 app.add_middleware(
@@ -101,8 +99,9 @@ async def auth(request: Request):
         with open(PASSWORD_PATH, "r") as file:
             stored_password = file.read().strip()
 
-        password = hashlib.sha256(password.encode()).hexdigest()
-        if stored_password != password:
+        try:
+            ph.verify(stored_password, password)  # 验证输入的密码是否与存储的哈希匹配
+        except Exception:
             raise HTTPException(status_code=401, detail="invalid password")
 
         payload = {
@@ -145,7 +144,7 @@ async def change_password(request: Request):
         if not os.path.exists(PASSWORD_PATH):
             if new_password == "":
                 raise HTTPException(status_code=400, detail="new password required")
-            new_password_hashed = hashlib.sha256(new_password.encode()).hexdigest()
+            new_password_hashed = ph.hash(new_password)
             with open(PASSWORD_PATH, "w") as file:
                 file.write(new_password_hashed)
             return {"message": "success"}
@@ -153,12 +152,13 @@ async def change_password(request: Request):
         with open(PASSWORD_PATH, "r") as file:
             stored_password = file.read().strip()
 
-        hashed_password = hashlib.sha256(password.encode()).hexdigest()
-        if stored_password != hashed_password:
+        try:
+            ph.verify(stored_password, password)
+        except Exception:
             raise HTTPException(status_code=401, detail="invalid password")
 
         # 设置新密码
-        new_password_hashed = hashlib.sha256(new_password.encode()).hexdigest()
+        new_password_hashed = ph.hash(new_password)
         with open(PASSWORD_PATH, "w") as file:
             file.write(new_password_hashed)
 
diff --git a/poetry.lock b/poetry.lock
index ea5dc18bd1..1919048ad1 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -293,6 +293,63 @@ tornado = ["tornado (>=4.3)"]
 twisted = ["twisted"]
 zookeeper = ["kazoo"]
 
+[[package]]
+name = "argon2-cffi"
+version = "23.1.0"
+description = "Argon2 for Python"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "argon2_cffi-23.1.0-py3-none-any.whl", hash = "sha256:c670642b78ba29641818ab2e68bd4e6a78ba53b7eff7b4c3815ae16abf91c7ea"},
+    {file = "argon2_cffi-23.1.0.tar.gz", hash = "sha256:879c3e79a2729ce768ebb7d36d4609e3a78a4ca2ec3a9f12286ca057e3d0db08"},
+]
+
+[package.dependencies]
+argon2-cffi-bindings = "*"
+
+[package.extras]
+dev = ["argon2-cffi[tests,typing]", "tox (>4)"]
+docs = ["furo", "myst-parser", "sphinx", "sphinx-copybutton", "sphinx-notfound-page"]
+tests = ["hypothesis", "pytest"]
+typing = ["mypy"]
+
+[[package]]
+name = "argon2-cffi-bindings"
+version = "21.2.0"
+description = "Low-level CFFI bindings for Argon2"
+optional = false
+python-versions = ">=3.6"
+files = [
+    {file = "argon2-cffi-bindings-21.2.0.tar.gz", hash = "sha256:bb89ceffa6c791807d1305ceb77dbfacc5aa499891d2c55661c6459651fc39e3"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-macosx_10_9_x86_64.whl", hash = "sha256:ccb949252cb2ab3a08c02024acb77cfb179492d5701c7cbdbfd776124d4d2367"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9524464572e12979364b7d600abf96181d3541da11e23ddf565a32e70bd4dc0d"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b746dba803a79238e925d9046a63aa26bf86ab2a2fe74ce6b009a1c3f5c8f2ae"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:58ed19212051f49a523abb1dbe954337dc82d947fb6e5a0da60f7c8471a8476c"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:bd46088725ef7f58b5a1ef7ca06647ebaf0eb4baff7d1d0d177c6cc8744abd86"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-musllinux_1_1_i686.whl", hash = "sha256:8cd69c07dd875537a824deec19f978e0f2078fdda07fd5c42ac29668dda5f40f"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:f1152ac548bd5b8bcecfb0b0371f082037e47128653df2e8ba6e914d384f3c3e"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-win32.whl", hash = "sha256:603ca0aba86b1349b147cab91ae970c63118a0f30444d4bc80355937c950c082"},
+    {file = "argon2_cffi_bindings-21.2.0-cp36-abi3-win_amd64.whl", hash = "sha256:b2ef1c30440dbbcba7a5dc3e319408b59676e2e039e2ae11a8775ecf482b192f"},
+    {file = "argon2_cffi_bindings-21.2.0-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:e415e3f62c8d124ee16018e491a009937f8cf7ebf5eb430ffc5de21b900dad93"},
+    {file = "argon2_cffi_bindings-21.2.0-pp37-pypy37_pp73-macosx_10_9_x86_64.whl", hash = "sha256:3e385d1c39c520c08b53d63300c3ecc28622f076f4c2b0e6d7e796e9f6502194"},
+    {file = "argon2_cffi_bindings-21.2.0-pp37-pypy37_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2c3e3cc67fdb7d82c4718f19b4e7a87123caf8a93fde7e23cf66ac0337d3cb3f"},
+    {file = "argon2_cffi_bindings-21.2.0-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6a22ad9800121b71099d0fb0a65323810a15f2e292f2ba450810a7316e128ee5"},
+    {file = "argon2_cffi_bindings-21.2.0-pp37-pypy37_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f9f8b450ed0547e3d473fdc8612083fd08dd2120d6ac8f73828df9b7d45bb351"},
+    {file = "argon2_cffi_bindings-21.2.0-pp37-pypy37_pp73-win_amd64.whl", hash = "sha256:93f9bf70084f97245ba10ee36575f0c3f1e7d7724d67d8e5b08e61787c320ed7"},
+    {file = "argon2_cffi_bindings-21.2.0-pp38-pypy38_pp73-macosx_10_9_x86_64.whl", hash = "sha256:3b9ef65804859d335dc6b31582cad2c5166f0c3e7975f324d9ffaa34ee7e6583"},
+    {file = "argon2_cffi_bindings-21.2.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d4966ef5848d820776f5f562a7d45fdd70c2f330c961d0d745b784034bd9f48d"},
+    {file = "argon2_cffi_bindings-21.2.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:20ef543a89dee4db46a1a6e206cd015360e5a75822f76df533845c3cbaf72670"},
+    {file = "argon2_cffi_bindings-21.2.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ed2937d286e2ad0cc79a7087d3c272832865f779430e0cc2b4f3718d3159b0cb"},
+    {file = "argon2_cffi_bindings-21.2.0-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:5e00316dabdaea0b2dd82d141cc66889ced0cdcbfa599e8b471cf22c620c329a"},
+]
+
+[package.dependencies]
+cffi = ">=1.0.1"
+
+[package.extras]
+dev = ["cogapp", "pre-commit", "pytest", "wheel"]
+tests = ["pytest"]
+
 [[package]]
 name = "asyncio-dgram"
 version = "2.2.0"
@@ -3399,28 +3456,27 @@ PyYAML = "*"
 
 [[package]]
 name = "quart"
-version = "0.19.8"
-description = "A Python ASGI web microframework with the same API as Flask"
+version = "0.20.0"
+description = "A Python ASGI web framework with the same API as Flask"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 files = [
-    {file = "quart-0.19.8-py3-none-any.whl", hash = "sha256:34eeb559014f4e72e093d034cfe203b1a6262e9d3504f826f293090e230609f2"},
-    {file = "quart-0.19.8.tar.gz", hash = "sha256:ef567d0be7677c99890d5c6ff30e679699fe7e5fca1a90fa3b6974edd8421794"},
+    {file = "quart-0.20.0-py3-none-any.whl", hash = "sha256:003c08f551746710acb757de49d9b768986fd431517d0eb127380b656b98b8f1"},
+    {file = "quart-0.20.0.tar.gz", hash = "sha256:08793c206ff832483586f5ae47018c7e40bdd75d886fee3fabbdaa70c2cf505d"},
 ]
 
 [package.dependencies]
 aiofiles = "*"
 blinker = ">=1.6"
-click = ">=8.0.0"
-flask = ">=3.0.0"
+click = ">=8.0"
+flask = ">=3.0"
 hypercorn = ">=0.11.2"
 itsdangerous = "*"
 jinja2 = "*"
 markupsafe = "*"
-werkzeug = ">=3.0.0"
+werkzeug = ">=3.0"
 
 [package.extras]
-docs = ["pydata_sphinx_theme"]
 dotenv = ["python-dotenv"]
 
 [[package]]
@@ -4537,4 +4593,4 @@ propcache = ">=0.2.0"
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12.0"
-content-hash = "9c98494aec57da701cba72db281f4a589564bb45d66a324c3f468aba2dfeebed"
+content-hash = "a4693a4a3853282a78998786d6d55f5b426f364d86b7baa789f1b98957cd78d4"
diff --git a/pyproject.toml b/pyproject.toml
index 0ae82b4362..a3bd40f050 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -70,6 +70,7 @@ qq-botpy = "^1.2.1"
 botpy = {git = "https://github.com/Teahouse-Studios/botpy.git"}
 tomlkit = "^0.13.2"
 cattrs = "^24.1.2"
+argon2-cffi = "^23.1.0"
 
 
 [tool.poetry.group.dev.dependencies]
diff --git a/requirements.txt b/requirements.txt
index 516ce73e1c..6458fe518b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,6 +10,8 @@ annotated-types==0.7.0 ; python_full_version >= "3.12.0" and python_version < "4
 anyio==4.6.2.post1 ; python_full_version >= "3.12.0" and python_version < "4.0"
 appdirs==1.4.4 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 apscheduler==3.10.4 ; python_version >= "3.12" and python_version < "4.0"
+argon2-cffi-bindings==21.2.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
+argon2-cffi==23.1.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 asyncio-dgram==2.2.0 ; python_full_version >= "3.12.0" and python_version < "4"
 attrs==24.2.0 ; python_version >= "3.12" and python_version < "4.0"
 backoff==2.2.1 ; python_full_version >= "3.12.0" and python_version < "4.0"
@@ -19,7 +21,7 @@ botpy @ git+https://github.com/Teahouse-Studios/botpy.git@56c66983f36918fa433a71
 caio==0.9.17 ; python_full_version >= "3.12.0" and python_version < "4"
 cattrs==24.1.2 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 certifi==2024.8.30 ; python_full_version >= "3.12.0" and python_version < "4.0"
-cffi==1.17.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0" and platform_python_implementation != "PyPy"
+cffi==1.17.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 cfgv==3.4.0 ; python_version >= "3.12" and python_version < "4.0"
 charset-normalizer==3.4.0 ; python_full_version >= "3.12.0" and python_version < "4.0"
 click==8.1.7 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
@@ -100,7 +102,7 @@ propcache==0.2.0 ; python_version >= "3.12" and python_version < "4.0"
 psutil==6.1.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 py-cord==2.6.1 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 py-cpuinfo==9.0.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
-pycparser==2.22 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0" and platform_python_implementation != "PyPy"
+pycparser==2.22 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pycryptodome==3.21.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pycryptodomex==3.21.0 ; python_full_version >= "3.12.0" and python_full_version < "4.0.0"
 pydantic-core==2.23.4 ; python_full_version >= "3.12.0" and python_version < "4.0"

From f3f1edcf602ed139df0dc6f1a21c4c559e95d32c Mon Sep 17 00:00:00 2001
From: yzhh <31803608+OasisAkari@users.noreply.github.com>
Date: Sat, 28 Dec 2024 16:09:03 +0800
Subject: [PATCH 16/18] fix

---
 core/utils/http.py            | 2 +-
 modules/wiki/utils/wikilib.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/utils/http.py b/core/utils/http.py
index 1b22d16723..e2c0e2d4a6 100644
--- a/core/utils/http.py
+++ b/core/utils/http.py
@@ -47,7 +47,7 @@ def private_ip_check(url: str):
 
 async def get_url(
     url: str,
-    status_code: int = 200,
+    status_code: Union[int, None] = 200,
     headers: Optional[Dict[str, Any]] = None,
     params: Optional[Dict[str, Any]] = None,
     fmt: Optional[str] = None,
diff --git a/modules/wiki/utils/wikilib.py b/modules/wiki/utils/wikilib.py
index 856e8a5ab9..b35ec0d843 100644
--- a/modules/wiki/utils/wikilib.py
+++ b/modules/wiki/utils/wikilib.py
@@ -226,7 +226,7 @@ async def check_wiki_available(self):
             wiki_api_link = api_match.group(1)
         except Exception:
             try:
-                get_page = await get_url(self.url, fmt="text", headers=self.headers)
+                get_page = await get_url(self.url, status_code=None, fmt="text", headers=self.headers)
                 if (
                     get_page.find("<title>Attention Required! | Cloudflare</title>")
                     != -1

From d1249c5de957610d92ffa7d3206da19d71b47528 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <Dorowolf314@gmail.com>
Date: Sat, 28 Dec 2024 16:12:40 +0800
Subject: [PATCH 17/18] Use Optional

---
 core/utils/http.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/utils/http.py b/core/utils/http.py
index e2c0e2d4a6..17ab9f21c1 100644
--- a/core/utils/http.py
+++ b/core/utils/http.py
@@ -47,7 +47,7 @@ def private_ip_check(url: str):
 
 async def get_url(
     url: str,
-    status_code: Union[int, None] = 200,
+    status_code: Optional[int] = 200,
     headers: Optional[Dict[str, Any]] = None,
     params: Optional[Dict[str, Any]] = None,
     fmt: Optional[str] = None,
@@ -124,7 +124,7 @@ async def get_():
 async def post_url(
     url: str,
     data: Any = None,
-    status_code: int = 200,
+    status_code: Optional[int] = 200,
     headers: Optional[Dict[str, Any]] = None,
     fmt: Optional[str] = None,
     timeout: Optional[float] = 20,
@@ -200,7 +200,7 @@ async def download(
     url: str,
     filename: Optional[str] = None,
     path: Optional[str] = None,
-    status_code: int = 200,
+    status_code: Optional[int] = 200,
     method: str = "GET",
     post_data: Any = None,
     headers: Optional[Dict[str, Any]] = None,

From 5b3717e5b0c52a198835c9e7140c4d9dfc3f6a06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9A=E7=BE=85=E7=8B=BC?= <Dorowolf314@gmail.com>
Date: Sun, 29 Dec 2024 09:37:13 +0800
Subject: [PATCH 18/18] fix webrender (#1512)

* Update bugtracker.py

* Update help.py

* Update screenshot_image.py

* Update help.py

* Update image.py

* Update image_table.py
---
 core/utils/image.py                    | 23 ++++++++++------
 core/utils/image_table.py              | 31 +++++++++++++--------
 modules/bugtracker/bugtracker.py       |  8 ++----
 modules/core/help.py                   | 38 ++++++++++++++------------
 modules/wiki/utils/screenshot_image.py | 14 ++++------
 5 files changed, 63 insertions(+), 51 deletions(-)

diff --git a/core/utils/image.py b/core/utils/image.py
index fbafa46dfc..ee66fe726a 100644
--- a/core/utils/image.py
+++ b/core/utils/image.py
@@ -90,6 +90,7 @@ async def msgchain2image(message_chain: Union[List, MessageChain],
     d = {'content': html_content, 'element': '.botbox'}
     html_ = json.dumps(d)
 
+    Logger.info("[WebRender] Converting message chain...")
     try:
         pic = await download(webrender('element_screenshot', use_local=use_local),
                              status_code=200,
@@ -100,17 +101,21 @@ async def msgchain2image(message_chain: Union[List, MessageChain],
                              timeout=30,
                              request_private_ip=True
                              )
-    except aiohttp.ClientConnectorError:
+    except Exception:
         if use_local:
-            pic = await download(webrender('element_screenshot', use_local=False),
-                                 status_code=200,
-                                 method='POST',
-                                 headers={'Content-Type': 'application/json'},
-                                 post_data=html_,
-                                 request_private_ip=True
-                                 )
+            try:
+                pic = await download(webrender('element_screenshot', use_local=False),
+                                     status_code=200,
+                                     method='POST',
+                                     headers={'Content-Type': 'application/json'},
+                                     post_data=html_,
+                                     request_private_ip=True
+                                     )
+            except Exception:
+                Logger.error('[WebRender] Generation Failed.')
+                return False
         else:
-            Logger.info('[WebRender] Generation Failed.')
+            Logger.error('[WebRender] Generation Failed.')
             return False
 
     with open(pic) as read:
diff --git a/core/utils/image_table.py b/core/utils/image_table.py
index 4c60f945a1..d84036e0c6 100644
--- a/core/utils/image_table.py
+++ b/core/utils/image_table.py
@@ -1,5 +1,6 @@
 import base64
 import re
+import traceback
 from html import escape
 from io import BytesIO
 from typing import Any, List, Union
@@ -100,19 +101,27 @@ async def image_table_render(
                     "Content-Type": "application/json",
                 },
             )
-        except aiohttp.ClientConnectorError:
+        except Exception:
             if use_local:
-                pic = await download(
-                    webrender(use_local=False),
-                    method="POST",
-                    post_data=json.dumps(html),
-                    request_private_ip=True,
-                    headers={
-                        "Content-Type": "application/json",
-                    },
-                )
+                try:
+                    pic = await download(
+                        webrender(use_local=False),
+                        method="POST",
+                        post_data=json.dumps(html),
+                        request_private_ip=True,
+                        headers={
+                            "Content-Type": "application/json",
+                        },
+                    )
+                except Exception:
+                    Logger.error("Generation failed.")
+                    return False
+            else:
+                Logger.error("Generation failed.")
+                return False
     except Exception:
-        Logger.exception("Error at image_table_render.")
+        Logger.error(traceback.format_exc())
+        return False
     with open(pic) as read:
         load_img = json.loads(read.read())
     img_lst = []
diff --git a/modules/bugtracker/bugtracker.py b/modules/bugtracker/bugtracker.py
index a31c917e24..cc6b81164a 100644
--- a/modules/bugtracker/bugtracker.py
+++ b/modules/bugtracker/bugtracker.py
@@ -43,14 +43,12 @@ async def make_screenshot(page_link, use_local=True):
                 bimg = PILImage.open(bio)
                 img_lst.append(bimg)
             return img_lst
-        Logger.info("[WebRender] Generation Failed.")
+        Logger.error("[WebRender] Generation Failed.")
         return False
-    except aiohttp.ClientConnectorError:
+    except Exception:
         if use_local:
             return await make_screenshot(page_link, use_local=False)
-        return False
-    except ValueError:
-        Logger.info("[WebRender] Generation Failed.")
+        Logger.error("[WebRender] Generation Failed.")
         return False
 
 
diff --git a/modules/core/help.py b/modules/core/help.py
index 43fb08baa4..af3cb99e89 100644
--- a/modules/core/help.py
+++ b/modules/core/help.py
@@ -137,7 +137,7 @@ async def _(msg: Bot.MessageSession, module: str):
 
                         d = {'content': html_content, 'element': '.botbox'}
                         html_ = json.dumps(d)
-
+                        Logger.info("[WebRender] Generating help document...")
                         try:
                             pic = await download(webrender('element_screenshot', use_local=use_local),
                                                  status_code=200,
@@ -148,7 +148,7 @@ async def _(msg: Bot.MessageSession, module: str):
                                                  timeout=30,
                                                  request_private_ip=True
                                                  )
-                        except aiohttp.ClientConnectorError:
+                        except Exception as e:
                             if use_local:
                                 try:
                                     pic = await download(webrender('element_screenshot', use_local=False),
@@ -158,12 +158,12 @@ async def _(msg: Bot.MessageSession, module: str):
                                                          post_data=html_,
                                                          request_private_ip=True
                                                          )
-                                except aiohttp.ClientConnectorError:
-                                    Logger.info('[WebRender] Generation Failed.')
-                                    raise
+                                except Exception as e:
+                                    Logger.error('[WebRender] Generation Failed.')
+                                    raise e
                             else:
-                                Logger.info('[WebRender] Generation Failed.')
-                                raise
+                                Logger.error('[WebRender] Generation Failed.')
+                                raise e
                         with open(pic) as read:
                             load_img = json.loads(read.read())
                         img_lst = []
@@ -363,7 +363,7 @@ async def help_generator(msg: Bot.MessageSession,
 
     d = {'content': html_content, 'element': '.botbox'}
     html_ = json.dumps(d)
-
+    Logger.info("[WebRender] Generating module list...")
     try:
         pic = await download(webrender('element_screenshot', use_local=use_local),
                              status_code=200,
@@ -374,17 +374,21 @@ async def help_generator(msg: Bot.MessageSession,
                              timeout=30,
                              request_private_ip=True
                              )
-    except aiohttp.ClientConnectorError:
+    except Exception:
         if use_local:
-            pic = await download(webrender('element_screenshot', use_local=False),
-                                 status_code=200,
-                                 method='POST',
-                                 headers={'Content-Type': 'application/json'},
-                                 post_data=html_,
-                                 request_private_ip=True
-                                 )
+            try:
+                pic = await download(webrender('element_screenshot', use_local=False),
+                                     status_code=200,
+                                     method='POST',
+                                     headers={'Content-Type': 'application/json'},
+                                     post_data=html_,
+                                     request_private_ip=True
+                                     )
+            except Exception:
+                Logger.error('[WebRender] Generation Failed.')
+                return False
         else:
-            Logger.info('[WebRender] Generation Failed.')
+            Logger.error('[WebRender] Generation Failed.')
             return False
     with open(pic) as read:
         load_img = json.loads(read.read())
diff --git a/modules/wiki/utils/screenshot_image.py b/modules/wiki/utils/screenshot_image.py
index 2f321275b7..aa8a98701a 100644
--- a/modules/wiki/utils/screenshot_image.py
+++ b/modules/wiki/utils/screenshot_image.py
@@ -52,7 +52,7 @@ async def generate_screenshot_v2(
                 timeout=30,
                 request_private_ip=True,
             )
-        except aiohttp.ClientConnectorError:
+        except Exception:
             if use_local:
                 return await generate_screenshot_v2(
                     page_link,
@@ -61,9 +61,7 @@ async def generate_screenshot_v2(
                     content_mode,
                     use_local=False,
                 )
-            return False
-        except ValueError:
-            Logger.info("[WebRender] Generation Failed.")
+            Logger.error("[WebRender] Generation Failed.")
             return False
     else:
         Logger.info("[WebRender] Generating section screenshot...")
@@ -79,7 +77,7 @@ async def generate_screenshot_v2(
                 timeout=30,
                 request_private_ip=True,
             )
-        except aiohttp.ClientConnectorError:
+        except Exception:
             if use_local:
                 return await generate_screenshot_v2(
                     page_link,
@@ -88,9 +86,7 @@ async def generate_screenshot_v2(
                     content_mode,
                     use_local=False,
                 )
-            return False
-        except ValueError:
-            Logger.info("[WebRender] Generation Failed.")
+            Logger.error("[WebRender] Generation Failed.")
             return False
     with open(img) as read:
         load_img = json.loads(read.read())
@@ -119,7 +115,7 @@ async def generate_screenshot_v1(
                 page_link, timeout=aiohttp.ClientTimeout(total=20)
             ) as req:
                 html = await req.read()
-        except BaseException:
+        except Exception:
             Logger.error(traceback.format_exc())
             return False
         soup = BeautifulSoup(html, "html.parser")