chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

backend/middleware/agent_auth.go

@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"ezops/model"
+	"ezops/pkg/agentauth"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+const agentCredentialContextKey = "agentCredential"
+
+// AgentAuth 在兼容阶段识别新 Token，强制阶段拒绝旧的匿名和用户 JWT 调用。 // Logan.Li
+func AgentAuth(db *gorm.DB, enforce bool) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authHeader := c.GetHeader("Authorization")
+		if authHeader == "" {
+			if enforce {
+				c.AbortWithStatusJSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "未提供 Agent 凭证"})
+			}
+			return
+		}
+		parts := strings.SplitN(authHeader, " ", 2)
+		if len(parts) == 2 && parts[0] == "Bearer" && strings.HasPrefix(parts[1], "agt_") {
+			credential, err := agentauth.Authenticate(db, parts[1])
+			if err == nil {
+				c.Set(agentCredentialContextKey, credential)
+				return
+			}
+			c.AbortWithStatusJSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "无效 Agent 凭证"})
+			return
+		}
+		if enforce {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "无效 Agent 凭证"})
+		}
+	}
+}
+
+// RequireAgentHostname 校验请求中主机名与凭证绑定主机一致。 // Logan.Li
+func RequireAgentHostname(c *gin.Context, hostname string) bool {
+	credential, exists := c.Get(agentCredentialContextKey)
+	if !exists {
+		return true
+	}
+	agentCredential, ok := credential.(*model.AgentCredential)
+	if !ok || agentCredential.Hostname != hostname {
+		c.AbortWithStatusJSON(http.StatusForbidden, model.Response{Code: 403, Message: "Agent 凭证与主机不匹配"})
+		return false
+	}
+	return true
+}

backend/middleware/auth.go

@@ -1,7 +1,6 @@
 package middleware
 
 import (
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -123,9 +122,7 @@ func tryAPIKeyAuth(c *gin.Context, db *gorm.DB, tokenString string) bool {
 		return false
 	}
 	now := time.Now()
-	if err := db.Model(&model.User{}).Where("id = ?", user.ID).Update("api_access_key_last_used_at", now).Error; err != nil {
-		log.Printf("[Auth] 更新 API 密钥最后使用时间失败 (user_id=%d): %v", user.ID, err)
-	}
+	_ = db.Model(&model.User{}).Where("id = ?", user.ID).Update("api_access_key_last_used_at", now).Error
 	c.Set("userID", user.ID)
 	c.Set("username", user.Username)
 	c.Set("isAdmin", user.IsAdmin)
@@ -174,4 +171,4 @@ func GetIsAdmin(c *gin.Context) bool {
 		return false
 	}
 	return isAdmin.(bool)
-}
+}

backend/middleware/automation_access.go

@@ -46,7 +46,7 @@ func collectPermissionCodes(db *gorm.DB, userID uint) []string {
 		SELECT DISTINCT p.code AS code
 		FROM iam_user_roles ur
 		JOIN iam_roles r ON r.id = ur.role_id AND r.status = 1
-		JOIN role_permissions rp ON rp.role_id = r.id
+		JOIN iam_role_permissions rp ON rp.role_id = r.id
 		JOIN iam_permissions p ON p.id = rp.permission_id AND p.status = 1
 		WHERE ur.user_id = ?
 	`, userID).Scan(&rows)
@@ -57,4 +57,4 @@ func collectPermissionCodes(db *gorm.DB, userID uint) []string {
 		}
 	}
 	return codes
-}
+}

backend/middleware/pipeline_access.go

@@ -3,6 +3,7 @@ package middleware
 import (
 	"net/http"
 	"regexp"
+	"strconv"
 
 	"ezops/model"
 
@@ -28,67 +29,75 @@ func PipelineAccess(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 
-		// 注入 context，后续 handlers 统一从这里读
-		c.Set("pipelineID", pipeline.ID)
-		c.Set("pipelineCode", code)
-
-		// 2) 管理员直接放行（跳过权限检查）
-		if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
+		if authorizePipelineAccess(c, db, &pipeline) {
 			c.Next()
-			return
 		}
-
-		username, _ := c.Get("username")
-		usernameStr, _ := username.(string)
-		if usernameStr == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未认证"})
-			return
-		}
-
-		pipelineID := pipeline.ID
-
-		// 3) 检查是否直接是流水线成员
-		var directCount int64
-		db.Model(&model.DeployPipelineMember{}).
-			Where("pipeline_id = ? AND username = ?", pipelineID, usernameStr).
-			Count(&directCount)
-		if directCount > 0 {
-			c.Next()
-			return
-		}
-
-		// 4) 检查是否属于授权给该流水线的用户组
-		var groupCount int64
-		db.Table("deploy_pipeline_members").
-			Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").
-			Where("deploy_pipeline_members.pipeline_id = ? AND deploy_user_group_members.username = ?", pipelineID, usernameStr).
-			Count(&groupCount)
-		if groupCount > 0 {
-			c.Next()
-			return
-		}
-
-		// 5) Jenkins-style Item Role — regex pattern matching on pipeline code
-		var itemRoles []model.ItemRole
-		db.Table("iam_item_roles").
-			Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").
-			Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?",
-				func() uint { uid, _ := c.Get("userID"); return uid.(uint) }()).
-			Find(&itemRoles)
-		for _, ir := range itemRoles {
-			if pipelineMatchesItemRole(pipeline, ir.Pattern) {
-				c.Next()
-				return
-			}
-		}
-
-		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
-			"code":    403,
-			"message": "无权访问此流水线，请联系流水线 Owner 添加你为成员",
-		})
 	}
 }
 
+// PipelineRunAccess 通过运行记录反查流水线并校验访问权限，防止按 runId 越权读取日志或工作区。 // Logan.Li
+func PipelineRunAccess(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		runID, err := strconv.ParseUint(c.Param("runId"), 10, 32)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"code": 400, "message": "无效的运行记录 ID"})
+			return
+		}
+
+		var run model.PipelineRun
+		if err := db.Select("id", "pipeline_id").Take(&run, uint(runID)).Error; err != nil {
+			c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"code": 404, "message": "流水线运行记录不存在"})
+			return
+		}
+		var pipeline model.Pipeline
+		if err := db.Take(&pipeline, run.PipelineID).Error; err != nil {
+			c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"code": 404, "message": "关联流水线不存在"})
+			return
+		}
+		if authorizePipelineAccess(c, db, &pipeline) {
+			c.Next()
+		}
+	}
+}
+
+// authorizePipelineAccess 集中复用流水线成员、用户组与 Item Role 授权规则。 // Logan.Li
+func authorizePipelineAccess(c *gin.Context, db *gorm.DB, pipeline *model.Pipeline) bool {
+	c.Set("pipelineID", pipeline.ID)
+	c.Set("pipelineCode", pipeline.Code)
+	if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
+		return true
+	}
+	username, _ := c.Get("username")
+	usernameStr, _ := username.(string)
+	userID, _ := c.Get("userID")
+	userIDUint, ok := userID.(uint)
+	if usernameStr == "" || !ok {
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "未认证"})
+		return false
+	}
+
+	var directCount int64
+	db.Model(&model.DeployPipelineMember{}).Where("pipeline_id = ? AND username = ?", pipeline.ID, usernameStr).Count(&directCount)
+	if directCount > 0 {
+		return true
+	}
+	var groupCount int64
+	db.Table("deploy_pipeline_members").Joins("JOIN deploy_user_group_members ON deploy_user_group_members.group_id = deploy_pipeline_members.group_id").Where("deploy_pipeline_members.pipeline_id = ? AND deploy_user_group_members.username = ?", pipeline.ID, usernameStr).Count(&groupCount)
+	if groupCount > 0 {
+		return true
+	}
+
+	var itemRoles []model.ItemRole
+	db.Table("iam_item_roles").Joins("JOIN iam_user_item_roles ON iam_user_item_roles.item_role_id = iam_item_roles.id").Where("iam_item_roles.status = 1 AND iam_user_item_roles.user_id = ?", userIDUint).Find(&itemRoles)
+	for _, ir := range itemRoles {
+		if pipelineMatchesItemRole(*pipeline, ir.Pattern) {
+			return true
+		}
+	}
+	c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权访问此流水线，请联系流水线 Owner 添加你为成员"})
+	return false
+}
+
 // GetAccessiblePipelineIDs 获取当前用户有权访问的流水线 ID 列表
 // 包括：直接成员 + 用户组 + Item Role (regex)
 func GetAccessiblePipelineIDs(db *gorm.DB, username string, userID uint) ([]uint, bool) {