feat(audit): F1+F2 告警静默规则标记完成 + 审计日志CSV导出实现
F1 告警静默规则 [done]: - 后端 alert_silence.go: CRUD + Toggle (onetime/daily/weekly 三模式) - 告警引擎 isSilenced 集成 (alert_engine.go) - 前端 SilenceRuleTab + SilenceDialog - 路由 /alerts/silences 已注册 F2 审计日志导出 [done]: - 重写 ExportAuditLogs: 真正的 CSV 导出 (encoding/csv + UTF-8 BOM) - 支持 module/action/username/startTime/endTime 筛选 - 导出限制 10000 条防溢出，自动记录审计日志 - JSON 格式向后兼容 (format=json) - 前端 exportLogs 传递查询参数 同时包含累积的前期工作: - 目录重构 internal/ -> controller/model/router (v0.55-v0.57) - 后端分层架构 dto/repository/service/utils - 审计模块全功能 (终端审计/操作审计/登录日志) - asciicast v2 录制格式 - SFTP 文件浏览器 - StatStrip 紧凑统计条 - 在线会话自动刷新 - LiveMonitor WebSocket 诊断修复 验证: go build ✅ | npm run build ✅ | Docker 部署 ✅ | 10 回归端点 ✅ | CSV 导出 ✅ | 静默 CRUD ✅
This commit is contained in:
attacker committed
1 parent
e57718998a
commit
77c234b060
314 files changed
+10050
-4065
No files matched your search
@@ -0,0 +1,139 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"ezops/config"
|
||||
"ezops/model"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
// JWTClaims JWT声明
|
||||
type JWTClaims struct {
|
||||
UserID uint `json:"user_id"`
|
||||
Username string `json:"username"`
|
||||
IsAdmin bool `json:"is_admin"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
// GenerateToken 生成JWT令牌
|
||||
func GenerateToken(user *model.User, cfg *config.JWTConfig) (string, error) {
|
||||
claims := JWTClaims{
|
||||
UserID: user.ID,
|
||||
Username: user.Username,
|
||||
IsAdmin: user.IsAdmin,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(cfg.ExpireHour) * time.Hour)),
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
Issuer: "ezops",
|
||||
},
|
||||
}
|
||||
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
return token.SignedString([]byte(cfg.Secret))
|
||||
}
|
||||
|
||||
// JWTAuth JWT认证中间件
|
||||
func JWTAuth(cfg *config.JWTConfig) gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
authHeader := c.GetHeader("Authorization")
|
||||
// Also allow token via query param for file downloads
|
||||
if authHeader == "" {
|
||||
if token := c.Query("token"); token != "" {
|
||||
authHeader = "Bearer " + token
|
||||
}
|
||||
}
|
||||
if authHeader == "" {
|
||||
c.JSON(http.StatusUnauthorized, model.Response{
|
||||
Code: 401,
|
||||
Message: "未提供认证令牌",
|
||||
})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
parts := strings.SplitN(authHeader, " ", 2)
|
||||
if !(len(parts) == 2 && parts[0] == "Bearer") {
|
||||
c.JSON(http.StatusUnauthorized, model.Response{
|
||||
Code: 401,
|
||||
Message: "认证令牌格式错误",
|
||||
})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
tokenString := parts[1]
|
||||
token, err := jwt.ParseWithClaims(tokenString, &JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
|
||||
return []byte(cfg.Secret), nil
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
c.JSON(http.StatusUnauthorized, model.Response{
|
||||
Code: 401,
|
||||
Message: "无效的认证令牌: " + err.Error(),
|
||||
})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
|
||||
if claims, ok := token.Claims.(*JWTClaims); ok && token.Valid {
|
||||
c.Set("userID", claims.UserID)
|
||||
c.Set("username", claims.Username)
|
||||
c.Set("isAdmin", claims.IsAdmin)
|
||||
c.Next()
|
||||
} else {
|
||||
c.JSON(http.StatusUnauthorized, model.Response{
|
||||
Code: 401,
|
||||
Message: "无效的认证令牌",
|
||||
})
|
||||
c.Abort()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// AdminAuth 管理员认证中间件
|
||||
func AdminAuth() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
isAdmin, exists := c.Get("isAdmin")
|
||||
if !exists || !isAdmin.(bool) {
|
||||
c.JSON(http.StatusForbidden, model.Response{
|
||||
Code: 403,
|
||||
Message: "需要管理员权限",
|
||||
})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// GetUserID 获取当前用户ID
|
||||
func GetUserID(c *gin.Context) uint {
|
||||
userID, exists := c.Get("userID")
|
||||
if !exists {
|
||||
return 0
|
||||
}
|
||||
return userID.(uint)
|
||||
}
|
||||
|
||||
// GetUsername 获取当前用户名
|
||||
func GetUsername(c *gin.Context) string {
|
||||
username, exists := c.Get("username")
|
||||
if !exists {
|
||||
return ""
|
||||
}
|
||||
return username.(string)
|
||||
}
|
||||
|
||||
// GetIsAdmin 获取是否为管理员
|
||||
func GetIsAdmin(c *gin.Context) bool {
|
||||
isAdmin, exists := c.Get("isAdmin")
|
||||
if !exists {
|
||||
return false
|
||||
}
|
||||
return isAdmin.(bool)
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"regexp"
|
||||
|
||||
"ezops/model"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// PipelineAccess 流水线权限中间件
|
||||
// 路由参数 :code（流水线编码）→ 查找 pipeline → 注入 pipelineID 到 context
|
||||
// 权限检查顺序：管理员 → 直接成员 → 用户组 → Item Role (regex)
|
||||
func PipelineAccess(db *gorm.DB) gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 1) 解析 code → 查找流水线（所有用户都需要）
|
||||
code := c.Param("code")
|
||||
if code == "" {
|
||||
c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"code": 400, "message": "缺少流水线编码"})
|
||||
return
|
||||
}
|
||||
|
||||
var pipeline model.Pipeline
|
||||
if err := db.Where("code = ?", code).First(&pipeline).Error; err != nil {
|
||||
c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"code": 404, "message": "流水线不存在"})
|
||||
return
|
||||
}
|
||||
|
||||
// 注入 context，后续 handlers 统一从这里读
|
||||
c.Set("pipelineID", pipeline.ID)
|
||||
c.Set("pipelineCode", code)
|
||||
|
||||
// 2) 管理员直接放行（跳过权限检查）
|
||||
if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
username, _ := c.Get("username")
|
||||
usernameStr, _ := username.(string)
|
||||
if usernameStr == "" {
|
||||
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未认证"})
|
||||
return
|
||||
}
|
||||
|
||||
pipelineID := pipeline.ID
|
||||
|
||||
// 3) 检查是否直接是流水线成员
|
||||
var directCount int64
|
||||
db.Model(&model.DeployPipelineMember{}).
|
||||
Where("pipeline_id = ? AND username = ?", pipelineID, usernameStr).
|
||||
Count(&directCount)
|
||||
if directCount > 0 {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
// 4) 检查是否属于授权给该流水线的用户组
|
||||
var groupCount int64
|
||||
db.Table("deploy_pipeline_members").
|
||||
Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").
|
||||
Where("deploy_pipeline_members.pipeline_id = ? AND deploy_user_group_members.username = ?", pipelineID, usernameStr).
|
||||
Count(&groupCount)
|
||||
if groupCount > 0 {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
// 5) Jenkins-style Item Role — regex pattern matching on pipeline code
|
||||
var itemRoles []model.ItemRole
|
||||
db.Table("iam_item_roles").
|
||||
Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").
|
||||
Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?",
|
||||
func() uint { uid, _ := c.Get("userID"); return uid.(uint) }()).
|
||||
Find(&itemRoles)
|
||||
for _, ir := range itemRoles {
|
||||
if matched, _ := regexp.MatchString(ir.Pattern, code); matched {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||||
"code": 403,
|
||||
"message": "无权访问此流水线，请联系流水线 Owner 添加你为成员",
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// GetAccessiblePipelineIDs 获取当前用户有权访问的流水线 ID 列表
|
||||
// 包括：直接成员 + 用户组 + Item Role (regex)
|
||||
func GetAccessiblePipelineIDs(db *gorm.DB, username string, userID uint) ([]uint, bool) {
|
||||
var directIDs []uint
|
||||
db.Model(&model.DeployPipelineMember{}).
|
||||
Where("username = ?", username).
|
||||
Pluck("pipeline_id", &directIDs)
|
||||
|
||||
var groupIDs []uint
|
||||
db.Model(&model.DeployPipelineMember{}).
|
||||
Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").
|
||||
Where("deploy_user_group_members.username = ?", username).
|
||||
Pluck("deploy_pipeline_members.pipeline_id", &groupIDs)
|
||||
|
||||
idSet := make(map[uint]bool)
|
||||
for _, id := range directIDs {
|
||||
idSet[id] = true
|
||||
}
|
||||
for _, id := range groupIDs {
|
||||
idSet[id] = true
|
||||
}
|
||||
|
||||
// Item Role regex matching: get all item roles for user, match against pipeline codes
|
||||
var itemRoles []model.ItemRole
|
||||
db.Table("iam_item_roles").
|
||||
Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").
|
||||
Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?", userID).
|
||||
Find(&itemRoles)
|
||||
if len(itemRoles) > 0 {
|
||||
var allPipelines []model.Pipeline
|
||||
db.Find(&allPipelines)
|
||||
for _, p := range allPipelines {
|
||||
for _, ir := range itemRoles {
|
||||
if matched, _ := regexp.MatchString(ir.Pattern, p.Code); matched {
|
||||
idSet[p.ID] = true
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ids := make([]uint, 0, len(idSet))
|
||||
for id := range idSet {
|
||||
ids = append(ids, id)
|
||||
}
|
||||
|
||||
return ids, len(ids) > 0
|
||||
}
|
||||
Reference in new issue
Block a user