refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Logan.LiandClaude committed
1 parent
fb8d10231a
commit
327e282356
93 files changed
+8433
-3089
No files matched your search
@@ -0,0 +1,173 @@
|
||||
// Package crypto 提供可复用的安全原语：AES-256-GCM 字段加解密、argon2id 口令哈希。
|
||||
// 密钥经 HKDF 从 config.EncryptionKey 派生（与 JWT 密钥分离）。
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"io"
|
||||
"strings"
|
||||
|
||||
"lokideploy/config"
|
||||
|
||||
"golang.org/x/crypto/argon2"
|
||||
"golang.org/x/crypto/hkdf"
|
||||
)
|
||||
|
||||
const (
|
||||
keySaltPrefix = "lokideploy-v2-enc:" // HKDF info prefix for key derivation
|
||||
)
|
||||
|
||||
// deriveEncryptionKey 使用HKDF从ENCRYPTION_KEY派生AES-256密钥
|
||||
// 这样即使ENCRYPTION_KEY被复用，不同上下文的密钥也不同
|
||||
func deriveEncryptionKey() ([]byte, error) {
|
||||
cfg := config.GetConfig()
|
||||
encKey := cfg.EncryptionKey
|
||||
|
||||
// 支持hex或base64编码的密钥
|
||||
var masterKey []byte
|
||||
var err error
|
||||
if len(encKey) == 64 { // 可能是hex编码的32字节
|
||||
masterKey, err = hex.DecodeString(encKey)
|
||||
if err != nil {
|
||||
masterKey = []byte(encKey) // fallback: 直接使用原始字节
|
||||
}
|
||||
} else if len(encKey) > 32 { // 可能是base64编码
|
||||
masterKey, err = base64.StdEncoding.DecodeString(encKey)
|
||||
if err != nil {
|
||||
masterKey = []byte(encKey) // fallback: 直接使用原始字节
|
||||
}
|
||||
} else {
|
||||
masterKey = []byte(encKey)
|
||||
}
|
||||
|
||||
// 使用HKDF-SHA256派生固定长度的AES密钥
|
||||
hkdfReader := hkdf.New(sha256.New, masterKey, nil, []byte(keySaltPrefix+"aes-gcm-256"))
|
||||
aesKey := make([]byte, 32)
|
||||
if _, err := io.ReadFull(hkdfReader, aesKey); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return aesKey, nil
|
||||
}
|
||||
|
||||
func HashPassword(password string) (string, error) {
|
||||
salt := make([]byte, 16)
|
||||
if _, err := rand.Read(salt); err != nil {
|
||||
return "", err
|
||||
}
|
||||
hash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
combined := append(salt, hash...)
|
||||
return base64.StdEncoding.EncodeToString(combined), nil
|
||||
}
|
||||
|
||||
func VerifyPassword(password, hashStr string) bool {
|
||||
combined, err := base64.StdEncoding.DecodeString(hashStr)
|
||||
if err != nil || len(combined) < 16 {
|
||||
return false
|
||||
}
|
||||
salt := combined[:16]
|
||||
hash := combined[16:]
|
||||
newHash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
return subtle.ConstantTimeCompare(hash, newHash) == 1
|
||||
}
|
||||
|
||||
func Encrypt(plaintext string) (string, error) {
|
||||
if plaintext == "" {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
key, err := deriveEncryptionKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
|
||||
return base64.StdEncoding.EncodeToString(ciphertext), nil
|
||||
}
|
||||
|
||||
func Decrypt(ciphertext string) (string, error) {
|
||||
if ciphertext == "" {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
key, err := deriveEncryptionKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
data, err := base64.StdEncoding.DecodeString(ciphertext)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if len(data) < gcm.NonceSize() {
|
||||
return "", errors.New("ciphertext too short")
|
||||
}
|
||||
nonce, ciphertextBytes := data[:gcm.NonceSize()], data[gcm.NonceSize():]
|
||||
plaintext, err := gcm.Open(nil, nonce, ciphertextBytes, nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(plaintext), nil
|
||||
}
|
||||
|
||||
// EncryptField 加密敏感字段，返回 ENC: 前缀标记格式。
|
||||
// 加密失败时返回错误（绝不返回明文或哨兵串），调用方必须处理该错误，
|
||||
// 否则可能把垃圾值当凭证落库。
|
||||
func EncryptField(plaintext string) (string, error) {
|
||||
if plaintext == "" {
|
||||
return "", nil
|
||||
}
|
||||
enc, err := Encrypt(plaintext)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return "ENC:" + enc, nil
|
||||
}
|
||||
|
||||
// DecryptField 解密 ENC: 前缀标记的字段
|
||||
func DecryptField(encrypted string) string {
|
||||
if encrypted == "" {
|
||||
return ""
|
||||
}
|
||||
if strings.HasPrefix(encrypted, "ENC:") {
|
||||
plain, err := Decrypt(encrypted[4:])
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return plain
|
||||
}
|
||||
// 未加密的数据直接返回（向后兼容）
|
||||
return encrypted
|
||||
}
|
||||
|
||||
// IsEncryptedField 检查字段是否已加密
|
||||
func IsEncryptedField(value string) bool {
|
||||
return strings.HasPrefix(value, "ENC:")
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestEncryptDecryptRoundTrip 覆盖 AES-GCM 加解密往返（含空串与 Unicode）。
|
||||
func TestEncryptDecryptRoundTrip(t *testing.T) {
|
||||
cases := []string{"", "hello", "a-much-longer-secret-with-unicode-密码-🔑"}
|
||||
for _, plain := range cases {
|
||||
enc, err := Encrypt(plain)
|
||||
if err != nil {
|
||||
t.Fatalf("Encrypt(%q) error: %v", plain, err)
|
||||
}
|
||||
dec, err := Decrypt(enc)
|
||||
if err != nil {
|
||||
t.Fatalf("Decrypt(%q) error: %v", plain, err)
|
||||
}
|
||||
if dec != plain {
|
||||
t.Fatalf("round-trip mismatch: got %q want %q", dec, plain)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestDecryptTamperedFails 验证 GCM 认证：篡改密文必须解密失败。
|
||||
func TestDecryptTamperedFails(t *testing.T) {
|
||||
enc, err := Encrypt("secret-value")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(enc) < 4 {
|
||||
t.Fatal("ciphertext too short")
|
||||
}
|
||||
// 翻转末尾两个 base64 字符，破坏 GCM 认证标签
|
||||
tampered := enc[:len(enc)-2] + "AA"
|
||||
if _, err := Decrypt(tampered); err == nil {
|
||||
t.Fatal("expected Decrypt to fail on tampered ciphertext, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestEncryptFieldContract 是 M2 的回归保护：
|
||||
// EncryptField 绝不能返回 "ENC_ERR:" 哨兵（否则 DecryptField 会把它当明文凭证用），
|
||||
// 只能返回 ""（空输入）或 "ENC:" 前缀；且与 DecryptField 可往返。
|
||||
func TestEncryptFieldContract(t *testing.T) {
|
||||
enc, err := EncryptField("super-secret")
|
||||
if err != nil {
|
||||
t.Fatalf("EncryptField error: %v", err)
|
||||
}
|
||||
if !strings.HasPrefix(enc, "ENC:") {
|
||||
t.Fatalf("EncryptField must return ENC:-prefixed value, got %q", enc)
|
||||
}
|
||||
if enc == "ENC_ERR:" {
|
||||
t.Fatal("EncryptField returned legacy sentinel ENC_ERR: (M2 regression)")
|
||||
}
|
||||
if got := DecryptField(enc); got != "super-secret" {
|
||||
t.Fatalf("DecryptField round-trip: got %q want super-secret", got)
|
||||
}
|
||||
if !IsEncryptedField(enc) {
|
||||
t.Fatal("IsEncryptedField should be true for ENC: value")
|
||||
}
|
||||
if IsEncryptedField("plain-value") {
|
||||
t.Fatal("IsEncryptedField should be false for plain value")
|
||||
}
|
||||
// 空输入约定
|
||||
if enc, err := EncryptField(""); enc != "" || err != nil {
|
||||
t.Fatalf("EncryptField(\"\") = (%q,%v), want (\"\",nil)", enc, err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestEncryptFieldRandomNonce 同一明文两次加密应产生不同密文（随机 nonce）。
|
||||
func TestEncryptFieldRandomNonce(t *testing.T) {
|
||||
a, _ := EncryptField("same-secret")
|
||||
b, _ := EncryptField("same-secret")
|
||||
if a == b {
|
||||
t.Fatal("expected different ciphertexts due to random nonce")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestMain 预置安全环境变量。deriveEncryptionKey 经 config.GetConfig() 读取
|
||||
// ENCRYPTION_KEY，缺失或 <32 字符时 log.Fatal，故须先设置。
|
||||
func TestMain(m *testing.M) {
|
||||
os.Setenv("JWT_SECRET", "crypto-pkg-test-secret-32chars!!")
|
||||
os.Setenv("ENCRYPTION_KEY", "crypto-pkg-test-encryption-32ch!!")
|
||||
os.Setenv("DATA_DIR", os.TempDir()+"/lokideploy-crypto-pkg-test")
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
// Package jwt 提供可复用的 JWT 签发/解析（HS256）、access/refresh 双 token、
|
||||
// 算法混淆防护与 gin 上下文用户提取。
|
||||
// 外部依赖 github.com/golang-jwt/jwt/v5 包名同为 jwt，故在此包内别名为 jwtv5 以避免冲突。
|
||||
package jwt
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"lokideploy/config"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
jwtv5 "github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
const (
|
||||
// AccessToken有效期2小时（较短的过期时间增强安全性）
|
||||
accessTokenExpiry = 2 * time.Hour
|
||||
// RefreshToken有效期7天
|
||||
refreshTokenExpiry = 7 * 24 * time.Hour
|
||||
)
|
||||
|
||||
type Claims struct {
|
||||
UserID uint `json:"userId"`
|
||||
Username string `json:"username"`
|
||||
Role string `json:"role"`
|
||||
TokenType string `json:"tokenType"` // access | refresh
|
||||
jwtv5.RegisteredClaims
|
||||
}
|
||||
|
||||
// TokenPair 包含access token和refresh token
|
||||
type TokenPair struct {
|
||||
AccessToken string `json:"accessToken"`
|
||||
RefreshToken string `json:"refreshToken"`
|
||||
ExpiresAt time.Time `json:"expiresAt"`
|
||||
}
|
||||
|
||||
func GenerateTokenPair(userID uint, username, role string) (*TokenPair, error) {
|
||||
cfg := config.GetConfig()
|
||||
now := time.Now()
|
||||
|
||||
// Access Token
|
||||
accessClaims := Claims{
|
||||
UserID: userID,
|
||||
Username: username,
|
||||
Role: role,
|
||||
TokenType: "access",
|
||||
RegisteredClaims: jwtv5.RegisteredClaims{
|
||||
ExpiresAt: jwtv5.NewNumericDate(now.Add(accessTokenExpiry)),
|
||||
IssuedAt: jwtv5.NewNumericDate(now),
|
||||
Subject: username,
|
||||
ID: generateTokenID(),
|
||||
},
|
||||
}
|
||||
accessToken := jwtv5.NewWithClaims(jwtv5.SigningMethodHS256, accessClaims)
|
||||
accessTokenString, err := accessToken.SignedString([]byte(cfg.JWTSecret))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Refresh Token
|
||||
refreshClaims := Claims{
|
||||
UserID: userID,
|
||||
Username: username,
|
||||
Role: role,
|
||||
TokenType: "refresh",
|
||||
RegisteredClaims: jwtv5.RegisteredClaims{
|
||||
ExpiresAt: jwtv5.NewNumericDate(now.Add(refreshTokenExpiry)),
|
||||
IssuedAt: jwtv5.NewNumericDate(now),
|
||||
Subject: username,
|
||||
ID: generateTokenID(),
|
||||
},
|
||||
}
|
||||
refreshToken := jwtv5.NewWithClaims(jwtv5.SigningMethodHS256, refreshClaims)
|
||||
refreshTokenString, err := refreshToken.SignedString([]byte(cfg.JWTSecret))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &TokenPair{
|
||||
AccessToken: accessTokenString,
|
||||
RefreshToken: refreshTokenString,
|
||||
ExpiresAt: now.Add(accessTokenExpiry),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// RefreshAccessToken 使用refresh token换取新的access token
|
||||
func RefreshAccessToken(refreshTokenString string) (*TokenPair, error) {
|
||||
claims, err := ParseToken(refreshTokenString)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// 验证token类型必须是refresh
|
||||
if claims.TokenType != "refresh" {
|
||||
return nil, errors.New("invalid token type")
|
||||
}
|
||||
|
||||
return GenerateTokenPair(claims.UserID, claims.Username, claims.Role)
|
||||
}
|
||||
|
||||
func ParseToken(tokenString string) (*Claims, error) {
|
||||
cfg := config.GetConfig()
|
||||
token, err := jwtv5.ParseWithClaims(tokenString, &Claims{}, func(token *jwtv5.Token) (interface{}, error) {
|
||||
// 强制校验签名算法，防止算法混淆攻击
|
||||
if _, ok := token.Method.(*jwtv5.SigningMethodHMAC); !ok {
|
||||
return nil, errors.New("unexpected signing method")
|
||||
}
|
||||
return []byte(cfg.JWTSecret), nil
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if claims, ok := token.Claims.(*Claims); ok && token.Valid {
|
||||
return claims, nil
|
||||
}
|
||||
return nil, errors.New("invalid token")
|
||||
}
|
||||
|
||||
func GetUserFromContext(c *gin.Context) (*Claims, bool) {
|
||||
user, exists := c.Get("user")
|
||||
if !exists {
|
||||
return nil, false
|
||||
}
|
||||
claims, ok := user.(*Claims)
|
||||
return claims, ok
|
||||
}
|
||||
|
||||
func IsAdmin(c *gin.Context) bool {
|
||||
claims, ok := GetUserFromContext(c)
|
||||
return ok && claims.Role == "admin"
|
||||
}
|
||||
|
||||
// generateTokenID 生成简单的token ID（基于纳秒时间戳）
|
||||
func generateTokenID() string {
|
||||
return strconv.FormatInt(time.Now().UnixNano(), 36)
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
package jwt
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
jwtv5 "github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
// TestTokenPairRoundTrip 覆盖签发 + 解析，并校验 access token 类型。
|
||||
func TestTokenPairRoundTrip(t *testing.T) {
|
||||
pair, err := GenerateTokenPair(42, "alice", "admin")
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateTokenPair: %v", err)
|
||||
}
|
||||
if pair.AccessToken == "" || pair.RefreshToken == "" {
|
||||
t.Fatal("tokens must not be empty")
|
||||
}
|
||||
claims, err := ParseToken(pair.AccessToken)
|
||||
if err != nil {
|
||||
t.Fatalf("ParseToken(access): %v", err)
|
||||
}
|
||||
if claims.UserID != 42 || claims.Username != "alice" || claims.Role != "admin" {
|
||||
t.Fatalf("unexpected claims: %+v", claims)
|
||||
}
|
||||
if claims.TokenType != "access" {
|
||||
t.Fatalf("access token should have tokenType=access, got %q", claims.TokenType)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRefreshRequiresRefreshToken 覆盖 token 类型强制：
|
||||
// 用 access token 刷新必须被拒；用 refresh token 刷新应成功。
|
||||
func TestRefreshRequiresRefreshToken(t *testing.T) {
|
||||
pair, _ := GenerateTokenPair(1, "bob", "user")
|
||||
|
||||
if _, err := RefreshAccessToken(pair.AccessToken); err == nil {
|
||||
t.Fatal("RefreshAccessToken must reject access tokens")
|
||||
}
|
||||
newPair, err := RefreshAccessToken(pair.RefreshToken)
|
||||
if err != nil {
|
||||
t.Fatalf("RefreshAccessToken(refresh): %v", err)
|
||||
}
|
||||
if newPair.AccessToken == "" {
|
||||
t.Fatal("new access token must not be empty")
|
||||
}
|
||||
}
|
||||
|
||||
// TestParseTokenRejectsBogus 解析任意非 JWT 字符串必须失败。
|
||||
func TestParseTokenRejectsBogus(t *testing.T) {
|
||||
if _, err := ParseToken("not-a-jwt"); err == nil {
|
||||
t.Fatal("ParseToken must reject bogus token")
|
||||
}
|
||||
}
|
||||
|
||||
// TestParseTokenRejectsNoneAlgo 覆盖算法混淆攻击防护：
|
||||
// ParseToken 的 keyfunc 仅接受 HMAC，alg=none 构造的 token 必须被拒。
|
||||
func TestParseTokenRejectsNoneAlgo(t *testing.T) {
|
||||
tok := jwtv5.NewWithClaims(jwtv5.SigningMethodNone, Claims{UserID: 1, TokenType: "access"})
|
||||
unsigned, err := tok.SigningString()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
bogus := unsigned + "." // alg=none 的无签名形式
|
||||
if _, err := ParseToken(bogus); err == nil {
|
||||
t.Fatal("ParseToken must reject alg=none (algorithm confusion)")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package jwt
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestMain 预置安全环境变量。config.GetConfig() 在 JWT_SECRET/ENCRYPTION_KEY
|
||||
// 缺失时会 log.Fatal，故必须在任何测试逻辑之前设置。
|
||||
func TestMain(m *testing.M) {
|
||||
os.Setenv("JWT_SECRET", "jwt-pkg-test-secret-32chars-min!!")
|
||||
os.Setenv("ENCRYPTION_KEY", "jwt-pkg-test-encryption-32chars!!")
|
||||
os.Setenv("DATA_DIR", os.TempDir()+"/lokideploy-jwt-pkg-test")
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
Reference in new issue
Block a user