feat(audit): F1+F2 告警静默规则标记完成 + 审计日志CSV导出实现

F1 告警静默规则 [done]: - 后端 alert_silence.go: CRUD + Toggle (onetime/daily/weekly 三模式) - 告警引擎 isSilenced 集成 (alert_engine.go) - 前端 SilenceRuleTab + SilenceDialog - 路由 /alerts/silences 已注册 F2 审计日志导出 [done]: - 重写 ExportAuditLogs: 真正的 CSV 导出 (encoding/csv + UTF-8 BOM) - 支持 module/action/username/startTime/endTime 筛选 - 导出限制 10000 条防溢出，自动记录审计日志 - JSON 格式向后兼容 (format=json) - 前端 exportLogs 传递查询参数同时包含累积的前期工作: - 目录重构 internal/ -> controller/model/router (v0.55-v0.57) - 后端分层架构 dto/repository/service/utils - 审计模块全功能 (终端审计/操作审计/登录日志) - asciicast v2 录制格式 - SFTP 文件浏览器 - StatStrip 紧凑统计条 - 在线会话自动刷新 - LiveMonitor WebSocket 诊断修复验证: go build ✅ | npm run build ✅ | Docker 部署 ✅ | 10 回归端点 ✅ | CSV 导出 ✅ | 静默 CRUD ✅
2026-06-25 20:16:30 +08:00
1 parent e57718998a
commit 77c234b060
@@ -0,0 +1,183 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"strconv"
+	"syscall"
+
+	"ezops/model"
+	"ezops/pkg/toolinstaller"
+
+	"github.com/creack/pty"
+	"github.com/gin-gonic/gin"
+	"github.com/gorilla/websocket"
+	"gorm.io/gorm"
+)
+
+// KubectlShellHandler kubectl WebSocket 终端处理（PTY 模式）
+type KubectlShellHandler struct {
+	db             *gorm.DB
+	toolInstaller  *toolinstaller.ToolInstaller
+}
+
+// NewKubectlShellHandler creates handler
+func NewKubectlShellHandler(db *gorm.DB, ti *toolinstaller.ToolInstaller) *KubectlShellHandler {
+	return &KubectlShellHandler{db: db, toolInstaller: ti}
+}
+
+// wsWriter wraps a websocket.Conn as an io.Writer (each write = one WSMessage)
+type wsWriter struct {
+	conn *websocket.Conn
+}
+
+func (w wsWriter) Write(p []byte) (int, error) {
+	err := w.conn.WriteJSON(WSMessage{Status: 0, Data: string(p)})
+	if err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+// Terminal starts a PTY-backed bash session with the cluster's kubeconfig injected
+func (h *KubectlShellHandler) Terminal(c *gin.Context) {
+	clusterID := c.Query("id")
+	if clusterID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "missing cluster id"})
+		return
+	}
+	id, err := strconv.Atoi(clusterID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid cluster id"})
+		return
+	}
+
+	var cluster model.KubernetesCluster
+	if err := h.db.First(&cluster, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "cluster not found"})
+		return
+	}
+	if cluster.KubeConfig == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no kubeconfig configured"})
+		return
+	}
+
+	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
+	if err != nil {
+		log.Printf("[KubectlShell] WebSocket upgrade failed: %v", err)
+		return
+	}
+	defer conn.Close()
+
+	// Write kubeconfig to a temp file (isolated per session)
+	tmpFile, err := os.CreateTemp("", "kubeconfig-*.yaml")
+	if err != nil {
+		conn.WriteJSON(WSMessage{Status: 0, Data: "\r\n\x1b[31mFailed to create temp kubeconfig\x1b[0m\r\n"})
+		return
+	}
+	defer os.Remove(tmpFile.Name())
+	if _, err := tmpFile.WriteString(cluster.KubeConfig); err != nil {
+		conn.WriteJSON(WSMessage{Status: 0, Data: "\r\n\x1b[31mFailed to write kubeconfig\x1b[0m\r\n"})
+		return
+	}
+	tmpFile.Close()
+
+	// Lazy-load kubectl on first K8s terminal connection (uses ToolInstaller)
+	if err := h.toolInstaller.EnsureAvailable("kubectl"); err != nil {
+		log.Printf("[KubectlShell] kubectl not available: %v", err)
+		conn.WriteJSON(WSMessage{Status: 0, Data: fmt.Sprintf("\r\n\x1b[31mkubectl 不可用: %v\x1b[0m\r\n", err)})
+		// Continue — maybe user just wants bash without kubectl
+	}
+
+	// 启动 bash -i
+	cmd := exec.CommandContext(c.Request.Context(), "bash", "--norc", "-i")
+	cmd.Env = append(os.Environ(),
+		"KUBECONFIG="+tmpFile.Name(),
+		"HOME=/root",
+		"TERM=xterm-256color",
+		fmt.Sprintf("PS1=\x1b[32m[%s]\x1b[0m $ ", cluster.Code),
+		"COLUMNS=120",
+		"LINES=30",
+	)
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+	}
+
+	ptmx, err := pty.StartWithSize(cmd, &pty.Winsize{Cols: 120, Rows: 30})
+	if err != nil {
+		conn.WriteJSON(WSMessage{Status: 0, Data: "\r\n\x1b[31mFailed to start shell (bash not available?)\x1b[0m\r\n"})
+		return
+	}
+	defer func() {
+		ptmx.Close()
+		if cmd.Process != nil {
+			syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		}
+		cmd.Wait()
+	}()
+
+	// Welcome message
+	welcome := fmt.Sprintf("\r\n\x1b[32m=== kubectl shell — %s (%s) ===\x1b[0m\r\n", cluster.Name, cluster.Code)
+	welcome += "\x1b[36mKUBECONFIG 已预配 | 输入 'exit' 退出\x1b[0m\r\n\r\n"
+	conn.WriteJSON(WSMessage{Status: 0, Data: welcome})
+
+	// Use a cancellable context for the two goroutines
+	ctx, cancel := context.WithCancel(c.Request.Context())
+	defer cancel()
+
+	// PTY → WebSocket
+	go func() {
+		defer cancel()
+		n, err := io.Copy(wsWriter{conn: conn}, ptmx)
+		if err != nil && err != io.EOF {
+			log.Printf("[KubectlShell] PTY copy ended: %v (bytes=%d)", err, n)
+		}
+	}()
+
+	// WebSocket → PTY
+	go func() {
+		defer ptmx.Close()
+		for {
+			msgType, data, err := conn.ReadMessage()
+			if err != nil {
+				if !websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseNormalClosure) {
+				} else {
+					log.Printf("[KubectlShell] WS read error: %v", err)
+				}
+				return
+			}
+			if msgType == websocket.TextMessage || msgType == websocket.BinaryMessage {
+				var msg WSMessage
+				if err := json.Unmarshal(data, &msg); err != nil {
+					if msgType == websocket.BinaryMessage {
+						ptmx.Write(data)
+					}
+					continue
+				}
+				switch msg.Status {
+				case 0:
+					if _, err := ptmx.Write([]byte(msg.Data)); err != nil {
+						log.Printf("[KubectlShell] PTY write error: %v", err)
+						return
+					}
+				case 1:
+					if msg.Cols > 0 && msg.Rows > 0 {
+						pty.Setsize(ptmx, &pty.Winsize{
+							Cols: uint16(msg.Cols),
+							Rows: uint16(msg.Rows),
+						})
+					}
+				}
+			}
+		}
+	}()
+
+	<-ctx.Done()
+	log.Printf("[KubectlShell] session ended for cluster %s", cluster.Name)
+}