refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Logan.LiandClaude committed
1 parent
fb8d10231a
commit
327e282356
93 files changed
+8433
-3089
No files matched your search
@@ -1,79 +0,0 @@
|
||||
package utils
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"io"
|
||||
|
||||
"lokideploy/config"
|
||||
|
||||
"golang.org/x/crypto/argon2"
|
||||
)
|
||||
|
||||
func HashPassword(password string) (string, error) {
|
||||
salt := make([]byte, 16)
|
||||
if _, err := rand.Read(salt); err != nil {
|
||||
return "", err
|
||||
}
|
||||
hash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
combined := append(salt, hash...)
|
||||
return base64.StdEncoding.EncodeToString(combined), nil
|
||||
}
|
||||
|
||||
func VerifyPassword(password, hashStr string) bool {
|
||||
combined, err := base64.StdEncoding.DecodeString(hashStr)
|
||||
if err != nil || len(combined) < 16 {
|
||||
return false
|
||||
}
|
||||
salt := combined[:16]
|
||||
hash := combined[16:]
|
||||
newHash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, 32)
|
||||
return subtle.ConstantTimeCompare(hash, newHash) == 1
|
||||
}
|
||||
|
||||
func Encrypt(plaintext string) (string, error) {
|
||||
key := []byte(config.GetConfig().JWTSecret)[:32]
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
|
||||
return base64.StdEncoding.EncodeToString(ciphertext), nil
|
||||
}
|
||||
|
||||
func Decrypt(ciphertext string) (string, error) {
|
||||
key := []byte(config.GetConfig().JWTSecret)[:32]
|
||||
data, err := base64.StdEncoding.DecodeString(ciphertext)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if len(data) < gcm.NonceSize() {
|
||||
return "", errors.New("ciphertext too short")
|
||||
}
|
||||
nonce, ciphertextBytes := data[:gcm.NonceSize()], data[gcm.NonceSize():]
|
||||
plaintext, err := gcm.Open(nil, nonce, ciphertextBytes, nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(plaintext), nil
|
||||
}
|
||||
+36
-4
@@ -3,9 +3,41 @@ package utils
|
||||
import "errors"
|
||||
|
||||
var (
|
||||
// 认证相关错误
|
||||
ErrInvalidCredentials = errors.New("用户名或密码错误")
|
||||
ErrNotFound = errors.New("资源不存在")
|
||||
ErrAlreadyExists = errors.New("资源已存在")
|
||||
ErrUnauthorized = errors.New("未登录或登录已过期")
|
||||
ErrForbidden = errors.New("没有操作权限")
|
||||
ErrUserNotFound = errors.New("用户不存在")
|
||||
ErrUserExists = errors.New("用户已存在")
|
||||
ErrTokenExpired = errors.New("Token已过期")
|
||||
ErrInvalidToken = errors.New("无效的Token")
|
||||
|
||||
// 资源相关错误
|
||||
ErrNotFound = errors.New("资源不存在")
|
||||
ErrAlreadyExists = errors.New("资源已存在")
|
||||
ErrUnauthorized = errors.New("未登录或登录已过期")
|
||||
ErrForbidden = errors.New("没有操作权限")
|
||||
ErrBadRequest = errors.New("请求参数无效")
|
||||
ErrValidationFailed = errors.New("参数校验失败")
|
||||
|
||||
// SSH相关错误
|
||||
ErrSSHConnectionFailed = errors.New("SSH连接失败")
|
||||
ErrSSHAuthFailed = errors.New("SSH认证失败")
|
||||
ErrSSHTimeout = errors.New("SSH连接超时")
|
||||
ErrSSHHostKeyMismatch = errors.New("SSH主机密钥不匹配，可能存在中间人攻击")
|
||||
ErrInvalidPort = errors.New("无效的端口号")
|
||||
|
||||
// 部署相关错误
|
||||
ErrDeploymentFailed = errors.New("部署失败")
|
||||
ErrDeploymentInProgress = errors.New("部署正在进行中")
|
||||
ErrClusterNotConnected = errors.New("集群未连接")
|
||||
ErrHostNotConnected = errors.New("主机未连接")
|
||||
|
||||
// 存储相关错误
|
||||
ErrStorageNotFound = errors.New("存储配置不存在")
|
||||
ErrInvalidStorageConfig = errors.New("无效的存储配置")
|
||||
|
||||
// 系统错误
|
||||
ErrInternalServer = errors.New("服务器内部错误")
|
||||
ErrDatabaseSaveFailed = errors.New("数据库保存失败")
|
||||
ErrEncryptionFailed = errors.New("加密操作失败")
|
||||
ErrDecryptionFailed = errors.New("解密操作失败")
|
||||
)
|
||||
@@ -1,62 +0,0 @@
|
||||
package utils
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"time"
|
||||
|
||||
"lokideploy/config"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type Claims struct {
|
||||
UserID uint `json:"userId"`
|
||||
Username string `json:"username"`
|
||||
Role string `json:"role"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
func GenerateToken(userID uint, username, role string) (string, error) {
|
||||
cfg := config.GetConfig()
|
||||
claims := Claims{
|
||||
UserID: userID,
|
||||
Username: username,
|
||||
Role: role,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
Subject: username,
|
||||
},
|
||||
}
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
return token.SignedString([]byte(cfg.JWTSecret))
|
||||
}
|
||||
|
||||
func ParseToken(tokenString string) (*Claims, error) {
|
||||
cfg := config.GetConfig()
|
||||
token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
|
||||
return []byte(cfg.JWTSecret), nil
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if claims, ok := token.Claims.(*Claims); ok && token.Valid {
|
||||
return claims, nil
|
||||
}
|
||||
return nil, errors.New("invalid token")
|
||||
}
|
||||
|
||||
func GetUserFromContext(c *gin.Context) (*Claims, bool) {
|
||||
user, exists := c.Get("user")
|
||||
if !exists {
|
||||
return nil, false
|
||||
}
|
||||
claims, ok := user.(*Claims)
|
||||
return claims, ok
|
||||
}
|
||||
|
||||
func IsAdmin(c *gin.Context) bool {
|
||||
claims, ok := GetUserFromContext(c)
|
||||
return ok && claims.Role == "admin"
|
||||
}
|
||||
@@ -20,18 +20,26 @@ type PageData struct {
|
||||
PageSize int `json:"pageSize"`
|
||||
}
|
||||
|
||||
// Success 返回200状态码的成功响应
|
||||
func Success(c *gin.Context, data interface{}) {
|
||||
c.JSON(http.StatusOK, Response{Code: 0, Message: "success", Data: data})
|
||||
}
|
||||
|
||||
// Error 返回指定HTTP状态码的错误响应，status code与业务code一致
|
||||
func Error(c *gin.Context, code int, message string) {
|
||||
c.JSON(http.StatusOK, Response{Code: code, Message: message})
|
||||
httpStatus := code
|
||||
if httpStatus < 100 || httpStatus >= 600 {
|
||||
httpStatus = http.StatusBadRequest
|
||||
}
|
||||
c.JSON(httpStatus, Response{Code: code, Message: message})
|
||||
}
|
||||
|
||||
// BadRequest 返回400状态码
|
||||
func BadRequest(c *gin.Context, message string) {
|
||||
Error(c, 400, message)
|
||||
c.JSON(http.StatusBadRequest, Response{Code: 400, Message: message})
|
||||
}
|
||||
|
||||
// Unauthorized 返回401状态码
|
||||
func Unauthorized(c *gin.Context, message string) {
|
||||
if message == "" {
|
||||
message = "未登录或登录已过期"
|
||||
@@ -39,6 +47,7 @@ func Unauthorized(c *gin.Context, message string) {
|
||||
c.JSON(http.StatusUnauthorized, Response{Code: 401, Message: message})
|
||||
}
|
||||
|
||||
// Forbidden 返回403状态码
|
||||
func Forbidden(c *gin.Context, message string) {
|
||||
if message == "" {
|
||||
message = "没有操作权限"
|
||||
@@ -46,11 +55,28 @@ func Forbidden(c *gin.Context, message string) {
|
||||
c.JSON(http.StatusForbidden, Response{Code: 403, Message: message})
|
||||
}
|
||||
|
||||
// NotFound 返回404状态码
|
||||
func NotFound(c *gin.Context, message string) {
|
||||
if message == "" {
|
||||
message = "资源不存在"
|
||||
}
|
||||
Error(c, 404, message)
|
||||
c.JSON(http.StatusNotFound, Response{Code: 404, Message: message})
|
||||
}
|
||||
|
||||
// InternalServerError 返回500状态码
|
||||
func InternalServerError(c *gin.Context, message string) {
|
||||
if message == "" {
|
||||
message = "服务器内部错误"
|
||||
}
|
||||
c.JSON(http.StatusInternalServerError, Response{Code: 500, Message: message})
|
||||
}
|
||||
|
||||
// ValidationError 返回422状态码（参数校验失败）
|
||||
func ValidationError(c *gin.Context, message string) {
|
||||
if message == "" {
|
||||
message = "参数校验失败"
|
||||
}
|
||||
c.JSON(http.StatusUnprocessableEntity, Response{Code: 422, Message: message})
|
||||
}
|
||||
|
||||
func Pagination(c *gin.Context) (page, pageSize int) {
|
||||
@@ -74,7 +100,7 @@ func IntParam(c *gin.Context, key string) (int, error) {
|
||||
|
||||
func BindAndValidate(c *gin.Context, obj interface{}) bool {
|
||||
if err := c.ShouldBindJSON(obj); err != nil {
|
||||
BadRequest(c, "请求参数无效: "+err.Error())
|
||||
ValidationError(c, "请求参数无效: "+err.Error())
|
||||
return false
|
||||
}
|
||||
return true
|
||||
|
||||
Reference in new issue
Block a user