refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Logan.LiandClaude committed
1 parent
fb8d10231a
commit
327e282356
93 files changed
+8433
-3089
No files matched your search
@@ -0,0 +1,173 @@
|
||||
// Package crypto 提供可复用的安全原语：AES-256-GCM 字段加解密、argon2id 口令哈希。
|
||||
// 密钥经 HKDF 从 config.EncryptionKey 派生（与 JWT 密钥分离）。
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"io"
|
||||
"strings"
|
||||
|
||||
"lokideploy/config"
|
||||
|
||||
"golang.org/x/crypto/argon2"
|
||||
"golang.org/x/crypto/hkdf"
|
||||
)
|
||||
|
||||
const (
|
||||
keySaltPrefix = "lokideploy-v2-enc:" // HKDF info prefix for key derivation
|
||||
)
|
||||
|
||||
// deriveEncryptionKey 使用HKDF从ENCRYPTION_KEY派生AES-256密钥
|
||||
// 这样即使ENCRYPTION_KEY被复用，不同上下文的密钥也不同
|
||||
func deriveEncryptionKey() ([]byte, error) {
|
||||
cfg := config.GetConfig()
|
||||
encKey := cfg.EncryptionKey
|
||||
|
||||
// 支持hex或base64编码的密钥
|
||||
var masterKey []byte
|
||||
var err error
|
||||
if len(encKey) == 64 { // 可能是hex编码的32字节
|
||||
masterKey, err = hex.DecodeString(encKey)
|
||||
if err != nil {
|
||||
masterKey = []byte(encKey) // fallback: 直接使用原始字节
|
||||
}
|
||||
} else if len(encKey) > 32 { // 可能是base64编码
|
||||
masterKey, err = base64.StdEncoding.DecodeString(encKey)
|
||||
if err != nil {
|
||||
masterKey = []byte(encKey) // fallback: 直接使用原始字节
|
||||
}
|
||||
} else {
|
||||
masterKey = []byte(encKey)
|
||||
}
|
||||
|
||||
// 使用HKDF-SHA256派生固定长度的AES密钥
|
||||
hkdfReader := hkdf.New(sha256.New, masterKey, nil, []byte(keySaltPrefix+"aes-gcm-256"))
|
||||
aesKey := make([]byte, 32)
|
||||
if _, err := io.ReadFull(hkdfReader, aesKey); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return aesKey, nil
|
||||
}
|
||||
|
||||
func HashPassword(password string) (string, error) {
|
||||
salt := make([]byte, 16)
|
||||
if _, err := rand.Read(salt); err != nil {
|
||||
return "", err
|
||||
}
|
||||
hash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
combined := append(salt, hash...)
|
||||
return base64.StdEncoding.EncodeToString(combined), nil
|
||||
}
|
||||
|
||||
func VerifyPassword(password, hashStr string) bool {
|
||||
combined, err := base64.StdEncoding.DecodeString(hashStr)
|
||||
if err != nil || len(combined) < 16 {
|
||||
return false
|
||||
}
|
||||
salt := combined[:16]
|
||||
hash := combined[16:]
|
||||
newHash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
return subtle.ConstantTimeCompare(hash, newHash) == 1
|
||||
}
|
||||
|
||||
func Encrypt(plaintext string) (string, error) {
|
||||
if plaintext == "" {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
key, err := deriveEncryptionKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
|
||||
return base64.StdEncoding.EncodeToString(ciphertext), nil
|
||||
}
|
||||
|
||||
func Decrypt(ciphertext string) (string, error) {
|
||||
if ciphertext == "" {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
key, err := deriveEncryptionKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
data, err := base64.StdEncoding.DecodeString(ciphertext)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if len(data) < gcm.NonceSize() {
|
||||
return "", errors.New("ciphertext too short")
|
||||
}
|
||||
nonce, ciphertextBytes := data[:gcm.NonceSize()], data[gcm.NonceSize():]
|
||||
plaintext, err := gcm.Open(nil, nonce, ciphertextBytes, nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(plaintext), nil
|
||||
}
|
||||
|
||||
// EncryptField 加密敏感字段，返回 ENC: 前缀标记格式。
|
||||
// 加密失败时返回错误（绝不返回明文或哨兵串），调用方必须处理该错误，
|
||||
// 否则可能把垃圾值当凭证落库。
|
||||
func EncryptField(plaintext string) (string, error) {
|
||||
if plaintext == "" {
|
||||
return "", nil
|
||||
}
|
||||
enc, err := Encrypt(plaintext)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return "ENC:" + enc, nil
|
||||
}
|
||||
|
||||
// DecryptField 解密 ENC: 前缀标记的字段
|
||||
func DecryptField(encrypted string) string {
|
||||
if encrypted == "" {
|
||||
return ""
|
||||
}
|
||||
if strings.HasPrefix(encrypted, "ENC:") {
|
||||
plain, err := Decrypt(encrypted[4:])
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return plain
|
||||
}
|
||||
// 未加密的数据直接返回（向后兼容）
|
||||
return encrypted
|
||||
}
|
||||
|
||||
// IsEncryptedField 检查字段是否已加密
|
||||
func IsEncryptedField(value string) bool {
|
||||
return strings.HasPrefix(value, "ENC:")
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestEncryptDecryptRoundTrip 覆盖 AES-GCM 加解密往返（含空串与 Unicode）。
|
||||
func TestEncryptDecryptRoundTrip(t *testing.T) {
|
||||
cases := []string{"", "hello", "a-much-longer-secret-with-unicode-密码-🔑"}
|
||||
for _, plain := range cases {
|
||||
enc, err := Encrypt(plain)
|
||||
if err != nil {
|
||||
t.Fatalf("Encrypt(%q) error: %v", plain, err)
|
||||
}
|
||||
dec, err := Decrypt(enc)
|
||||
if err != nil {
|
||||
t.Fatalf("Decrypt(%q) error: %v", plain, err)
|
||||
}
|
||||
if dec != plain {
|
||||
t.Fatalf("round-trip mismatch: got %q want %q", dec, plain)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestDecryptTamperedFails 验证 GCM 认证：篡改密文必须解密失败。
|
||||
func TestDecryptTamperedFails(t *testing.T) {
|
||||
enc, err := Encrypt("secret-value")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(enc) < 4 {
|
||||
t.Fatal("ciphertext too short")
|
||||
}
|
||||
// 翻转末尾两个 base64 字符，破坏 GCM 认证标签
|
||||
tampered := enc[:len(enc)-2] + "AA"
|
||||
if _, err := Decrypt(tampered); err == nil {
|
||||
t.Fatal("expected Decrypt to fail on tampered ciphertext, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestEncryptFieldContract 是 M2 的回归保护：
|
||||
// EncryptField 绝不能返回 "ENC_ERR:" 哨兵（否则 DecryptField 会把它当明文凭证用），
|
||||
// 只能返回 ""（空输入）或 "ENC:" 前缀；且与 DecryptField 可往返。
|
||||
func TestEncryptFieldContract(t *testing.T) {
|
||||
enc, err := EncryptField("super-secret")
|
||||
if err != nil {
|
||||
t.Fatalf("EncryptField error: %v", err)
|
||||
}
|
||||
if !strings.HasPrefix(enc, "ENC:") {
|
||||
t.Fatalf("EncryptField must return ENC:-prefixed value, got %q", enc)
|
||||
}
|
||||
if enc == "ENC_ERR:" {
|
||||
t.Fatal("EncryptField returned legacy sentinel ENC_ERR: (M2 regression)")
|
||||
}
|
||||
if got := DecryptField(enc); got != "super-secret" {
|
||||
t.Fatalf("DecryptField round-trip: got %q want super-secret", got)
|
||||
}
|
||||
if !IsEncryptedField(enc) {
|
||||
t.Fatal("IsEncryptedField should be true for ENC: value")
|
||||
}
|
||||
if IsEncryptedField("plain-value") {
|
||||
t.Fatal("IsEncryptedField should be false for plain value")
|
||||
}
|
||||
// 空输入约定
|
||||
if enc, err := EncryptField(""); enc != "" || err != nil {
|
||||
t.Fatalf("EncryptField(\"\") = (%q,%v), want (\"\",nil)", enc, err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestEncryptFieldRandomNonce 同一明文两次加密应产生不同密文（随机 nonce）。
|
||||
func TestEncryptFieldRandomNonce(t *testing.T) {
|
||||
a, _ := EncryptField("same-secret")
|
||||
b, _ := EncryptField("same-secret")
|
||||
if a == b {
|
||||
t.Fatal("expected different ciphertexts due to random nonce")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestMain 预置安全环境变量。deriveEncryptionKey 经 config.GetConfig() 读取
|
||||
// ENCRYPTION_KEY，缺失或 <32 字符时 log.Fatal，故须先设置。
|
||||
func TestMain(m *testing.M) {
|
||||
os.Setenv("JWT_SECRET", "crypto-pkg-test-secret-32chars!!")
|
||||
os.Setenv("ENCRYPTION_KEY", "crypto-pkg-test-encryption-32ch!!")
|
||||
os.Setenv("DATA_DIR", os.TempDir()+"/lokideploy-crypto-pkg-test")
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
Reference in new issue
Block a user