@wenbin_wb/dsh-bridge 2.8.7 → 2.10.0

package/lib/auth/manager.js

@@ -1,12 +1,23 @@
 // lib/auth/manager.js
 // 远程访问安全认证管理器：密码加盐哈希、Session 管理、免密安全 Token、防暴力破解与全协议鉴权拦截
 
-import { randomBytes, pbkdf2Sync, timingSafeEqual } from 'node:crypto'
+import { randomBytes, pbkdf2 as pbkdf2Callback, timingSafeEqual } from 'node:crypto'
+import { promisify } from 'node:util'
+
+const pbkdf2Async = promisify(pbkdf2Callback)
 
 const DEFAULT_SESSION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000 // 30 天
 const MAX_FAILED_ATTEMPTS = 5
 const LOCKOUT_PERIOD_MS = 60 * 1000 // 连续失败封禁 60 秒
 
+// T4.1：PBKDF2-HMAC-SHA256 迭代次数升级到 OWASP 建议值。
+// 新哈希带算法前缀（pbkdf2-sha256$<iterations>$<hex>）；裸 hex 视为旧的 10000 次
+// 格式，登录成功后透明重哈希升级（无需用户重设密码）。
+const PBKDF2_ITERATIONS = 600000
+const LEGACY_PBKDF2_ITERATIONS = 10000
+const PBKDF2_KEYLEN = 32
+const PBKDF2_PREFIX = 'pbkdf2-sha256$'
+
 export class AuthManager {
   /**
    * @param {object} opts
@@ -17,6 +28,7 @@ export class AuthManager {
    * @param {string} [opts.config.passwordSalt]
    * @param {string} [opts.config.secretToken]
    * @param {boolean} [opts.config.allowLoopback=true]
+   * @param {boolean} [opts.config.adminProtection=true] 管理保护独立开关：关闭后管理操作免 adminToken
    * @param {(patch: object) => Promise<void>|void} [opts.onPersist]
    * @param {object} [opts.logger]
    */
@@ -28,6 +40,8 @@ export class AuthManager {
     this.mode = config.mode || 'token_and_password'
     this.scope = config.scope || 'all' // 'all' | 'public_only' | 'lan_only'
     this.adminPolicy = config.adminPolicy || 'password_unlock' // 'password_unlock' | 'local_only' | 'open'
+    // 管理保护独立于访问认证：默认开启（现有用户保持受保护），关闭后管理操作免 adminToken
+    this.adminProtection = config.adminProtection !== false
     this.passwordHash = config.passwordHash || ''
     this.passwordSalt = config.passwordSalt || ''
     this.adminPasswordHash = config.adminPasswordHash || ''
@@ -53,8 +67,47 @@ export class AuthManager {
     return 'dsh_' + randomBytes(18).toString('hex')
   }
 
-  _hashPassword(password, salt) {
-    return pbkdf2Sync(String(password), salt, 10000, 32, 'sha256').toString('hex')
+  // 异步派生：600k 次迭代约数百毫秒，同步实现会卡住整个事件循环
+  async _hashPassword(password, salt, iterations = PBKDF2_ITERATIONS) {
+    const derived = await pbkdf2Async(String(password), salt, iterations, PBKDF2_KEYLEN, 'sha256')
+    return `${PBKDF2_PREFIX}${iterations}$${derived.toString('hex')}`
+  }
+
+  // 校验密码与存储哈希；兼容裸 hex 旧格式（10000 次）。返回 legacy 标记供透明升级。
+  async _verifyHash(inputPassword, storedHash, storedSalt) {
+    if (!storedHash || !storedSalt) return { ok: false, legacy: false }
+    let iterations = LEGACY_PBKDF2_ITERATIONS
+    let expected = storedHash
+    if (storedHash.startsWith(PBKDF2_PREFIX)) {
+      const rest = storedHash.slice(PBKDF2_PREFIX.length)
+      const sep = rest.indexOf('$')
+      if (sep === -1) return { ok: false, legacy: false }
+      iterations = Number(rest.slice(0, sep))
+      expected = rest.slice(sep + 1)
+      if (!Number.isFinite(iterations) || iterations < 1) return { ok: false, legacy: false }
+    }
+    try {
+      const derived = await pbkdf2Async(String(inputPassword), storedSalt, iterations, PBKDF2_KEYLEN, 'sha256')
+      const expectedBuf = Buffer.from(expected, 'hex')
+      const ok = derived.length === expectedBuf.length && timingSafeEqual(derived, expectedBuf)
+      return { ok, legacy: ok && !storedHash.startsWith(PBKDF2_PREFIX) }
+    } catch {
+      return { ok: false, legacy: false }
+    }
+  }
+
+  // 旧格式哈希在登录成功后透明升级到当前格式（新盐 + 新迭代数）并持久化
+  async _upgradeHash(kind, password) {
+    const salt = randomBytes(16).toString('hex')
+    const hash = await this._hashPassword(password, salt)
+    if (kind === 'admin') {
+      this.adminPasswordHash = hash
+      this.adminPasswordSalt = salt
+    } else {
+      this.passwordHash = hash
+      this.passwordSalt = salt
+    }
+    await this._persist()
   }
 
   get hasPassword() {
@@ -78,6 +131,7 @@ export class AuthManager {
       mode: this.mode,
       scope: this.scope,
       adminPolicy: this.adminPolicy,
+      adminProtection: this.adminProtection,
       hasPassword: this.hasPassword,
       hasAdminPassword: this.hasAdminPassword,
       secretToken: token,
@@ -107,6 +161,7 @@ export class AuthManager {
       mode: this.mode,
       scope: this.scope,
       adminPolicy: this.adminPolicy,
+      adminProtection: this.adminProtection,
       hasPassword: this.hasPassword,
       hasAdminPassword: this.hasAdminPassword,
       allowLoopback: this.allowLoopback,
@@ -120,6 +175,13 @@ export class AuthManager {
     await this._persist()
   }
 
+  /** 管理保护独立开关：关闭后管理操作免 adminToken（与访问认证解耦） */
+  async setAdminProtection(protection) {
+    this.adminProtection = protection !== false
+    if (!this.adminProtection) this.adminSessions.clear()
+    await this._persist()
+  }
+
   async setMode(mode) {
     if (['token_and_password', 'password_only', 'token_only'].includes(mode)) {
       this.mode = mode
@@ -154,8 +216,7 @@ export class AuthManager {
       this.passwordSalt = ''
     } else {
       const salt = randomBytes(16).toString('hex')
-      const hash = this._hashPassword(password, salt)
-      this.passwordHash = hash
+      this.passwordHash = await this._hashPassword(password, salt)
       this.passwordSalt = salt
     }
     // 更改访问密码时使所有普通访客 Session 失效
@@ -170,8 +231,7 @@ export class AuthManager {
       this.adminPasswordSalt = ''
     } else {
       const salt = randomBytes(16).toString('hex')
-      const hash = this._hashPassword(password, salt)
-      this.adminPasswordHash = hash
+      this.adminPasswordHash = await this._hashPassword(password, salt)
       this.adminPasswordSalt = salt
     }
     // 更改管理密码时使所有远程管理员解锁 Session 失效
@@ -212,7 +272,7 @@ export class AuthManager {
     if (adminToken) this.adminSessions.delete(adminToken)
   }
 
-  verifyAdminPassword(inputPassword, clientIp = '') {
+  async verifyAdminPassword(inputPassword, clientIp = '') {
     if (this.isIpBlocked(clientIp)) {
       return { success: false, error: '尝试次数过多，请稍后再试' }
     }
@@ -224,11 +284,12 @@ export class AuthManager {
       return { success: true }
     }
 
-    const inputHash = this._hashPassword(inputPassword, targetSalt)
-    const bufA = Buffer.from(inputHash, 'hex')
-    const bufB = Buffer.from(targetHash, 'hex')
-
-    if (bufA.length === bufB.length && timingSafeEqual(bufA, bufB)) {
+    const check = await this._verifyHash(inputPassword, targetHash, targetSalt)
+    if (check.ok) {
+      // 旧格式透明升级：管理位为空时实际校验的是访客密码，升级落在对应字段
+      if (check.legacy) {
+        await this._upgradeHash(this.adminPasswordHash ? 'admin' : 'password', inputPassword)
+      }
       this.recordSuccess(clientIp)
       return { success: true }
     }
@@ -237,20 +298,32 @@ export class AuthManager {
     return { success: false, error: '管理员密码错误' }
   }
 
-  unlockAdmin(password, clientIp = '') {
+  async unlockAdmin(password, clientIp = '') {
     if (this.adminPolicy === 'local_only') {
       return { ok: false, error: '当前已配置为仅限电脑本机管理设置' }
     }
+    // RPC 层拿不到真实 clientIp（代理以回环转发），因此用独立的全局失败计数防爆破：
+    // 攻击者 5 次失败即锁 60s，暴力破解不可行；代价是攻击者可短时干扰解锁（可接受的权衡）
+    if (this._adminUnlockLockUntil && Date.now() < this._adminUnlockLockUntil) {
+      return { ok: false, error: '尝试次数过多，请 60 秒后再试' }
+    }
     const hasAnyPassword = this.hasAdminPassword || this.hasPassword
     if (!hasAnyPassword) {
       const adminToken = this.createAdminSession()
       return { ok: true, adminToken }
     }
-    const verify = this.verifyAdminPassword(password, clientIp)
+    const verify = await this.verifyAdminPassword(password, clientIp)
     if (verify.success) {
+      this._adminUnlockFailures = 0
       const adminToken = this.createAdminSession()
       return { ok: true, adminToken }
     }
+    this._adminUnlockFailures = (this._adminUnlockFailures || 0) + 1
+    if (this._adminUnlockFailures >= MAX_FAILED_ATTEMPTS) {
+      this._adminUnlockLockUntil = Date.now() + LOCKOUT_PERIOD_MS
+      this._adminUnlockFailures = 0
+      this.logger.warn?.('[dsh-bridge auth] admin unlock locked out for 60s due to repeated failed attempts')
+    }
     return { ok: false, error: verify.error || '管理员密码错误' }
   }
 
@@ -262,6 +335,7 @@ export class AuthManager {
           mode: this.mode,
           scope: this.scope,
           adminPolicy: this.adminPolicy,
+          adminProtection: this.adminProtection,
           passwordHash: this.passwordHash,
           passwordSalt: this.passwordSalt,
           adminPasswordHash: this.adminPasswordHash,
@@ -280,7 +354,7 @@ export class AuthManager {
   /**
    * 校验客户端密码
    */
-  verifyPassword(inputPassword, clientIp = '') {
+  async verifyPassword(inputPassword, clientIp = '') {
     if (this.isIpBlocked(clientIp)) {
       return { success: false, error: '尝试次数过多，请稍后再试' }
     }
@@ -298,11 +372,12 @@ export class AuthManager {
       return { success: true }
     }
 
-    const inputHash = this._hashPassword(inputPassword, this.passwordSalt)
-    const bufA = Buffer.from(inputHash, 'hex')
-    const bufB = Buffer.from(this.passwordHash, 'hex')
-
-    if (bufA.length === bufB.length && timingSafeEqual(bufA, bufB)) {
+    const check = await this._verifyHash(inputPassword, this.passwordHash, this.passwordSalt)
+    if (check.ok) {
+      // 旧格式（裸 hex，10000 次）透明升级到当前格式
+      if (check.legacy) {
+        await this._upgradeHash('password', inputPassword)
+      }
       this.recordSuccess(clientIp)
       return { success: true }
     }
@@ -467,4 +542,4 @@ export class AuthManager {
     this.sessions.clear()
     this.rateLimits.clear()
   }
-}
+}

package/lib/bridge-rpc.js

@@ -33,7 +33,7 @@ async function renderQr(loginState) {
   if (!loginState?.qrPayload) return null;
   const cacheKey = `${loginState.qrKind}:${loginState.qrPayload.slice(0, 80)}`;
   if (renderQr.cache && renderQr.cache.key === cacheKey) return renderQr.cache.url;
-  let url = null;
+  let url;
   const payload = loginState.qrPayload;
   if (loginState.qrKind === 'img') {
     url = /^data:/i.test(payload) ? payload : `data:image/png;base64,${payload}`;
@@ -48,21 +48,29 @@ async function renderQr(loginState) {
   return url;
 }
 
-/** 归一化 wechat 状态返回：把 loginState 里的 qrPayload 渲染成 qr dataURL。 */
-async function wechatStatusValue(wechatService, logger) {
-  const status = wechatService.getStatus();
-  const qr = await renderQr(status.login).catch((err) => {
-    logger.warn('dsh-bridge: render wechat qr failed: %s', err?.message ?? err);
-    return null;
-  });
-  return { ...status, login: { ...status.login, qr, qrPayload: undefined, qrKind: undefined } };
-}
-
-function checkAdminAuth(authManager, payload) {
+function checkAdminAuth(authManager, payload, { requireConfigured = false } = {}) {
   if (!authManager) return null;
+  // local_only 最严格：即使关闭管理保护，也绝不远程放行（本机经 loopback-token 天然持有 adminToken）
+  // 注意：RPC 层无法区分本机/远程（代理以回环转发），local_only 的防线是 unlockAdmin 拒绝
+  // 远程解锁——因此这里管理保护关闭时也不放行 local_only，保持"仅本机可管理"的语义。
+  if (authManager.adminPolicy === 'local_only') {
+    // local_only 下必须持有有效 adminToken（只有本机 loopback-token / 本机解锁能拿到）
+    if (payload?.adminToken && authManager.validateAdminSession(payload.adminToken)) {
+      return null;
+    }
+    return fail('bad-request', '操作已被拦截：当前策略为仅限电脑本机管理');
+  }
+  // 管理保护独立开关：用户明确关闭后，管理操作免 adminToken（与访问认证 enabled 解耦）
+  if (authManager.adminProtection === false) return null;
   if (authManager.adminPolicy === 'open') return null;
   // 若系统尚未设置任何管理密码或访客密码，允许免密管理
   const hasAnyPassword = authManager.hasAdminPassword || authManager.hasPassword;
+  // T2.9：高危操作（备份导出/导入、隧道配置与启动、目录浏览、添加工作区、升级、重启）
+  // 在系统从未设置任何密码时不再静默放行，强制先完成一次密码设置，
+  // 杜绝"未设密码 = 局域网/隧道内任何人都可导出全部凭证"的裸奔状态被直接利用
+  if (requireConfigured && !hasAnyPassword) {
+    return fail('bad-request', '该操作涉及敏感配置：请先在「安全认证」中设置访问密码或管理密码后再执行');
+  }
   if (!hasAnyPassword) {
     return null;
   }
@@ -73,7 +81,7 @@ function checkAdminAuth(authManager, payload) {
   return fail('bad-request', '操作已被拦截：需要管理员权限，请先在控制台输入管理密码解锁');
 }
 
-export function installBridgeRpc(ctx, { service, authManager, wechat, platformManager, logger, saveCustomTunnelConfig, exportBackup, importBackup }) {
+export function installBridgeRpc(ctx, { service, authManager, platformManager, logger, saveCustomTunnelConfig, exportBackup, importBackup }) {
   if (!ctx?.connection?.rpc?.handle) {
     logger.warn('dsh-bridge: Connection RPC unavailable — UI will not work');
     return () => {};
@@ -101,14 +109,21 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
 
         if (endpoint === BRIDGE_ENDPOINTS.authUpdateConfig) {
           if (!authManager) return fail('bad-request', 'AuthManager 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          const { enabled, mode, scope, adminPolicy, password, adminPassword } = payload;
+          const { enabled, mode, scope, adminPolicy, adminProtection, password, adminPassword } = payload;
+          // 仅切换 enabled（访问认证开关）不需要管理权限：用户应能自由决定是否开放访问，
+          // 否则"关闭访问认证"这个动作本身会被管理保护锁死（死锁：关闭要先解锁，解锁要过认证）。
+          // 其余字段（模式/范围/策略/密码/管理保护）均涉及安全配置，仍需管理权限。
+          const sensitive = mode !== undefined || scope !== undefined || adminPolicy !== undefined
+            || adminProtection !== undefined || password !== undefined || adminPassword !== undefined;
+          if (sensitive) {
+            const adminErr = checkAdminAuth(authManager, payload);
+            if (adminErr) return adminErr;
+          }
           if (enabled != null) await authManager.setEnabled(enabled);
           if (mode != null) await authManager.setMode(mode);
           if (scope != null) await authManager.setScope(scope);
           if (adminPolicy != null) await authManager.setAdminPolicy(adminPolicy);
+          if (adminProtection != null) await authManager.setAdminProtection(adminProtection);
           if (password !== undefined) await authManager.setPassword(password);
           if (adminPassword !== undefined) await authManager.setAdminPassword(adminPassword);
           return ok(authManager.getStatus({ masked: false }));
@@ -126,7 +141,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         if (endpoint === BRIDGE_ENDPOINTS.authAdminUnlock) {
           if (!authManager) return fail('bad-request', 'AuthManager 未初始化');
           const { password } = payload;
-          const res = authManager.unlockAdmin(password);
+          const res = await authManager.unlockAdmin(password);
           if (res.ok) return ok({ adminToken: res.adminToken });
           return fail('bad-request', res.error || '管理员密码错误');
         }
@@ -138,27 +153,28 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.saveCustomTunnelConfig) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
-          const { serverUrl = '', accessToken = '' } = payload;
-          await saveCustomTunnelConfig(serverUrl.trim(), accessToken.trim());
+          // 未提供的字段保持 undefined 透传：服务端视为"保留现值"
+          const { serverUrl, accessToken } = payload;
+          await saveCustomTunnelConfig(serverUrl, accessToken);
           const status = await service.getStatus();
           return ok(status);
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.saveCloudflaredConfig) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
-          const { token = '', hostname = '' } = payload;
+          const { token, hostname } = payload;
           await service.saveCloudflaredConfig({ token, hostname });
           const status = await service.getStatus();
           return ok(status);
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.setTunnelAutoStart) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           const { tunnel, autoStart } = payload;
@@ -177,7 +193,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.startCustomTunnel) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           try {
@@ -200,7 +216,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.startCloudflared) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           try {
@@ -237,7 +253,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.upgradePlugin) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           const result = await service.upgradePlugin(payload);
@@ -245,7 +261,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.restartDsh) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           const result = await service.restartDsh();
@@ -253,7 +269,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.exportBackup) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           if (!exportBackup) return fail('bad-request', '备份导出服务不可用');
@@ -262,7 +278,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.importBackup) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           if (!importBackup) return fail('bad-request', '备份导入服务不可用');
@@ -284,7 +300,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         // ---- 远程工作区管理与目录浏览 ----
 
         if (endpoint === BRIDGE_ENDPOINTS.listRemoteDirectories) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           const clientKey = payload?.clientIp || payload?.adminToken || 'default';
@@ -298,7 +314,7 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
         }
 
         if (endpoint === BRIDGE_ENDPOINTS.addRemoteWorkspace) {
-          const adminErr = checkAdminAuth(authManager, payload);
+          const adminErr = checkAdminAuth(authManager, payload, { requireConfigured: true });
           if (adminErr) return adminErr;
 
           const clientKey = payload?.clientIp || payload?.adminToken || 'default';
@@ -427,78 +443,6 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
           return ok({ ...status, login: { ...status.login, qr, qrPayload: undefined, qrKind: undefined } });
         }
 
-        // ---- 微信 Bot（v1.x 向后兼容别名，deprecated）----
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatGetStatus) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatLogin) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          const { qrType } = payload;
-          const result = await wechat.login({ qrType });
-          if (!result.ok) return fail('bad-request', result.error ?? '登录启动失败');
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatSetAllowFrom) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          await wechat.setAllowFrom(payload.allowFrom);
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatSetConfig) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          await wechat.setConfig(payload);
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatStop) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          await wechat.stop();
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatStart) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          await wechat.gateway.start().catch((err) => {
-            logger.error('wechat start enabled: %s', err?.message ?? err);
-          });
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
-        if (endpoint === BRIDGE_ENDPOINTS.wechatUnbind) {
-          if (!wechat) return fail('bad-request', '微信 Bot 未初始化');
-          const adminErr = checkAdminAuth(authManager, payload);
-          if (adminErr) return adminErr;
-
-          await wechat.unbind();
-          const value = await wechatStatusValue(wechat, logger);
-          return ok(value);
-        }
-
         return fail('bad-request', `Unknown endpoint: ${endpoint}`);
       } catch (err) {
         logger.error('RPC endpoint %s failed: %s', endpoint, err.message);