From 8e339f083ad2f43ab19f4571cf641345cf6291ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=80=AA=E7=A8=8B=E4=BC=9F?= Date: Wed, 17 Jun 2026 21:45:36 +0800 Subject: [PATCH] docs(security): correct generated-file TTL comment (7 days, not 10 min) The permitAll comment claimed a 10-minute TTL, but GeneratedFileCache.TTL is 7 days. The stale figure could mislead future security reasoning about how long an unauthenticated capability URL stays live. Align the comment with the actual value; the unguessable UUID remains the access guard. Refs matevip/mateclaw#344 --- .../src/main/java/vip/mate/config/SecurityConfig.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mateclaw-server/src/main/java/vip/mate/config/SecurityConfig.java b/mateclaw-server/src/main/java/vip/mate/config/SecurityConfig.java index f81c4995..5217b667 100644 --- a/mateclaw-server/src/main/java/vip/mate/config/SecurityConfig.java +++ b/mateclaw-server/src/main/java/vip/mate/config/SecurityConfig.java @@ -62,7 +62,9 @@ public class SecurityConfig { "/api/v1/channels/webhook/**", "/api/v1/channels/webchat/**", "/api/v1/talk/ws", - // RFC-045: tool-generated files served via unguessable UUID + 10-min TTL + // RFC-045: tool-generated files served via unguessable UUID; entries + // expire after GeneratedFileCache.TTL (7 days) — delayed access (e.g. an + // IM-delivered link opened later) is intentional, the UUID is the guard. "/api/v1/files/generated/**" ).permitAll() // 所有其他 API 接口需要认证