feat: opsx-loki 全面升级 — 前端重构/用户与LDAP/部署向导/日志查询
基于 WEB-UI-Development-Guide 标准的整体升级,并更名 LokiDeploy → opsx-loki。 前端(Gin+React+shadcn/ui): - 按 02/07 章重构:页面域化拆分(无超 400 行文件)、PageContainer/ListQuery、 反馈分级(成功静默/失败 toast/危险确认)、401 单飞刷新+队列重放 - 暗色模式(next-themes)+ 语义 Token(--primary 品牌色/success/warning/info) - 部署向导(状态推导四步:环境→存储→Loki→采集,内嵌表单闭环) - 日志查询页:LogQL 标签构建器/拖拽直方图/日志上下文/Live Tail/查询历史 - 按用户+标签策略的查询授权(服务端强制合并策略) 后端(Go+Gin+JSON DB): - 简单用户管理(仅 admin,无 RBAC)+ TokenVersion 会话吊销 + 登录 IP 限流 - LDAP 接入:配置(AES 加密存储/hasPassword 脱敏)/测试连接/批量导入/登录 - 存储配置测试连接(SigV4 零依赖)+ 桶不存在自动创建 - Loki 三模式部署修复:SSH 密钥认证、3.x 配置模板、ruler 对象存储嵌套块、 凭证解密、孤儿 deploying 状态恢复、Grafana 部署(可选默认关)+面板导入 - DaemonSet 采集纯 YAML(去 helm 依赖)+ DNS 自愈回退 ClusterIP + 集群名标签 - 日志查询代理:cluster-svc 经 kube-apiserver proxy/url 直连 + cursor 翻页 - 统一 log 命名空间;部署就绪探活;Grafana 访问地址自动记录 修复:run.sh 增量编译检测、Sanitized 脱敏补全、LokiDeployment Update 白名单、 健康检查 CreatedAt 零值等 10+ 存量 bug。 数据兼容:DB 沿用旧 lokideploy.json(新名优先);localStorage 一次性迁移; HKDF 加密前缀保留(已加密凭证不受影响)。
This commit is contained in:
logan committed
1 parent
327e282356
commit
f9c6c1d826
204 files changed
+14107
-9103
No files matched your search
+186
-11
@@ -1,11 +1,12 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"lokideploy/models"
|
||||
"lokideploy/pkg/crypto"
|
||||
"lokideploy/pkg/jwt"
|
||||
"lokideploy/repository"
|
||||
"lokideploy/utils"
|
||||
"fmt"
|
||||
"opsxloki/models"
|
||||
"opsxloki/pkg/crypto"
|
||||
"opsxloki/pkg/jwt"
|
||||
"opsxloki/repository"
|
||||
"opsxloki/utils"
|
||||
)
|
||||
|
||||
type AuthService struct{}
|
||||
@@ -17,23 +18,89 @@ func NewAuthService() *AuthService {
|
||||
func (s *AuthService) Login(username, password string) (*models.User, *jwt.TokenPair, error) {
|
||||
db := repository.GetDB()
|
||||
db.RLock()
|
||||
defer db.RUnlock()
|
||||
var local *models.User
|
||||
for i := range db.Users {
|
||||
if db.Users[i].Username == username {
|
||||
if !crypto.VerifyPassword(password, db.Users[i].Password) {
|
||||
return nil, nil, utils.ErrInvalidCredentials
|
||||
}
|
||||
tokenPair, err := jwt.GenerateTokenPair(db.Users[i].ID, db.Users[i].Username, db.Users[i].Role)
|
||||
u := db.Users[i]
|
||||
local = &u
|
||||
break
|
||||
}
|
||||
}
|
||||
db.RUnlock()
|
||||
|
||||
// 本地用户密码校验(普通本地用户唯一路径;LDAP 用户不使用本地密码)
|
||||
if local != nil && local.AuthSource != "ldap" {
|
||||
if !crypto.VerifyPassword(password, local.Password) {
|
||||
return nil, nil, utils.ErrInvalidCredentials
|
||||
}
|
||||
return s.issueTokenPair(local)
|
||||
}
|
||||
|
||||
// LDAP 用户(本地已导入或首次登录自动创建);enabled=false 或验证失败返回统一错误
|
||||
if ldapCfg := GetLDAPConfig(); ldapCfg.Enabled && ldapCfg.Host != "" {
|
||||
if entry, err := verifyLDAPPassword(ldapCfg, username, password); err == nil {
|
||||
user, err := s.syncLDAPUser(entry)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return &db.Users[i], tokenPair, nil
|
||||
return s.issueTokenPair(user)
|
||||
}
|
||||
}
|
||||
return nil, nil, utils.ErrInvalidCredentials
|
||||
}
|
||||
|
||||
func (s *AuthService) issueTokenPair(u *models.User) (*models.User, *jwt.TokenPair, error) {
|
||||
pair, err := jwt.GenerateTokenPair(u.ID, u.Username, u.Role, u.TokenVersion)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return u, pair, nil
|
||||
}
|
||||
|
||||
// syncLDAPUser LDAP 验证通过后同步本地记录:不存在则创建(user 角色,密码占位不可本地登录),
|
||||
// 存在则同步昵称/邮箱
|
||||
func (s *AuthService) syncLDAPUser(entry *ldapUserEntry) (*models.User, error) {
|
||||
db := repository.GetDB()
|
||||
// 已存在 → 同步昵称并标记 LDAP 来源
|
||||
db.Lock()
|
||||
for i := range db.Users {
|
||||
if db.Users[i].Username == entry.Username {
|
||||
db.Users[i].Nickname = entry.DisplayName
|
||||
db.Users[i].AuthSource = "ldap"
|
||||
db.RequestSave()
|
||||
u := db.Users[i]
|
||||
db.Unlock()
|
||||
return &u, nil
|
||||
}
|
||||
}
|
||||
db.Unlock()
|
||||
|
||||
// 不存在 → 创建(CreateUser 自管锁与 ID 分配)
|
||||
hash, _ := crypto.HashPassword("ldap-user-" + entry.Username + "-no-local-login")
|
||||
user := &models.User{
|
||||
Username: entry.Username,
|
||||
Password: hash,
|
||||
Nickname: entry.DisplayName,
|
||||
Role: "user",
|
||||
AuthSource: "ldap",
|
||||
}
|
||||
if err := db.CreateUser(user); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return user, nil
|
||||
}
|
||||
|
||||
func (s *AuthService) Register(username, password, nickname, role string) (*models.User, error) {
|
||||
db := repository.GetDB()
|
||||
db.RLock()
|
||||
for i := range db.Users {
|
||||
if db.Users[i].Username == username {
|
||||
db.RUnlock()
|
||||
return nil, utils.ErrUsernameExists
|
||||
}
|
||||
}
|
||||
db.RUnlock()
|
||||
|
||||
hash, err := crypto.HashPassword(password)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -70,6 +137,9 @@ func (s *AuthService) ChangePassword(userID uint, oldPassword, newPassword strin
|
||||
defer db.Unlock()
|
||||
for i := range db.Users {
|
||||
if db.Users[i].ID == userID {
|
||||
if db.Users[i].AuthSource == "ldap" {
|
||||
return fmt.Errorf("LDAP 用户请在 LDAP 目录中修改密码")
|
||||
}
|
||||
if !crypto.VerifyPassword(oldPassword, db.Users[i].Password) {
|
||||
return utils.ErrInvalidCredentials
|
||||
}
|
||||
@@ -78,6 +148,111 @@ func (s *AuthService) ChangePassword(userID uint, oldPassword, newPassword strin
|
||||
return err
|
||||
}
|
||||
db.Users[i].Password = hash
|
||||
db.Users[i].TokenVersion++
|
||||
db.RequestSave()
|
||||
return nil
|
||||
}
|
||||
}
|
||||
return utils.ErrNotFound
|
||||
}
|
||||
|
||||
// ListUsers 分页返回用户列表（按 ID 升序），pageSize 上限 100
|
||||
func (s *AuthService) ListUsers(page, pageSize int) ([]models.User, int64) {
|
||||
db := repository.GetDB()
|
||||
db.RLock()
|
||||
defer db.RUnlock()
|
||||
|
||||
total := int64(len(db.Users))
|
||||
if page < 1 {
|
||||
page = 1
|
||||
}
|
||||
if pageSize < 1 || pageSize > 100 {
|
||||
pageSize = 20
|
||||
}
|
||||
start := (page - 1) * pageSize
|
||||
if start >= int(total) {
|
||||
return []models.User{}, total
|
||||
}
|
||||
end := start + pageSize
|
||||
if end > int(total) {
|
||||
end = int(total)
|
||||
}
|
||||
users := make([]models.User, end-start)
|
||||
copy(users, db.Users[start:end])
|
||||
return users, total
|
||||
}
|
||||
|
||||
// DeleteUser 删除用户；不能删除自己，不能删除最后一个管理员
|
||||
func (s *AuthService) DeleteUser(id, requesterID uint) error {
|
||||
db := repository.GetDB()
|
||||
db.Lock()
|
||||
defer db.Unlock()
|
||||
|
||||
idx := -1
|
||||
adminCount := 0
|
||||
for i := range db.Users {
|
||||
if db.Users[i].ID == id {
|
||||
idx = i
|
||||
}
|
||||
if db.Users[i].Role == "admin" {
|
||||
adminCount++
|
||||
}
|
||||
}
|
||||
if idx == -1 {
|
||||
return utils.ErrNotFound
|
||||
}
|
||||
if id == requesterID {
|
||||
return utils.ErrCannotDeleteSelf
|
||||
}
|
||||
if db.Users[idx].Role == "admin" && adminCount <= 1 {
|
||||
return utils.ErrLastAdmin
|
||||
}
|
||||
|
||||
db.Users = append(db.Users[:idx], db.Users[idx+1:]...)
|
||||
for i := range db.LogSources {
|
||||
kept := db.LogSources[i].Access[:0]
|
||||
for _, rule := range db.LogSources[i].Access {
|
||||
if rule.UserID != id {
|
||||
kept = append(kept, rule)
|
||||
}
|
||||
}
|
||||
db.LogSources[i].Access = kept
|
||||
}
|
||||
groups := db.LogPolicyGroups[:0]
|
||||
for _, group := range db.LogPolicyGroups {
|
||||
members := group.UserIDs[:0]
|
||||
for _, member := range group.UserIDs {
|
||||
if member != id {
|
||||
members = append(members, member)
|
||||
}
|
||||
}
|
||||
group.UserIDs = members
|
||||
if len(members) > 0 {
|
||||
groups = append(groups, group)
|
||||
}
|
||||
}
|
||||
db.LogPolicyGroups = groups
|
||||
db.RequestSave()
|
||||
return nil
|
||||
}
|
||||
|
||||
// ResetPassword 管理员重置用户密码，并递增 TokenVersion 吊销其全部旧会话
|
||||
func (s *AuthService) ResetPassword(userID uint, newPassword string) error {
|
||||
db := repository.GetDB()
|
||||
db.Lock()
|
||||
defer db.Unlock()
|
||||
|
||||
for i := range db.Users {
|
||||
if db.Users[i].ID == userID {
|
||||
if db.Users[i].AuthSource == "ldap" {
|
||||
return fmt.Errorf("LDAP 用户密码由目录服务管理，不能在此重置")
|
||||
}
|
||||
hash, err := crypto.HashPassword(newPassword)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
db.Users[i].Password = hash
|
||||
db.Users[i].TokenVersion++
|
||||
db.RequestSave()
|
||||
return nil
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user