diff --git a/backend/cmd/server/seed.go b/backend/cmd/server/seed.go index ccda25e..08c07a9 100644 --- a/backend/cmd/server/seed.go +++ b/backend/cmd/server/seed.go @@ -15,6 +15,8 @@ func seedAll(db *gorm.DB) { seedDefaultUsers(db) seedDefaultWorkflow(db) seedDefaultSettings(db) + seedLDAPConfig(db) + seedAuditRules(db) log.Println("[seed] Default data initialized") } @@ -114,3 +116,104 @@ func seedDefaultWorkflow(db *gorm.DB) { } func intPtr(v int) *int { return &v } + +// seedLDAPConfig inserts default LDAP settings if not present. +func seedLDAPConfig(db *gorm.DB) { + ldapDefaults := []model.SystemSetting{ + {Key: "ldap_host", Value: "8.217.205.92", ValueType: "string", Group: "ldap", Label: "LDAP 服务器地址", Desc: strPtr("LDAP 服务器 IP 或域名"), DefaultValue: strPtr("8.217.205.92"), SortOrder: 1}, + {Key: "ldap_port", Value: "389", ValueType: "number", Group: "ldap", Label: "LDAP 端口", Desc: strPtr("默认 389，LDAPS 用 636"), DefaultValue: strPtr("389"), SortOrder: 2}, + {Key: "ldap_use_ssl", Value: "false", ValueType: "boolean", Group: "ldap", Label: "启用 LDAPS (SSL/TLS)", Desc: strPtr("使用 SSL/TLS 加密连接"), DefaultValue: strPtr("false"), SortOrder: 3}, + {Key: "ldap_bind_dn", Value: "cn=admin,dc=opsx,dc=vip", ValueType: "string", Group: "ldap", Label: "管理员 DN", Desc: strPtr("LDAP 管理员绑定 DN"), DefaultValue: strPtr("cn=admin,dc=opsx,dc=vip"), SortOrder: 4}, + {Key: "ldap_base_dn", Value: "dc=opsx,dc=vip", ValueType: "string", Group: "ldap", Label: "Base DN", Desc: strPtr("用户搜索的基础 DN"), DefaultValue: strPtr("dc=opsx,dc=vip"), SortOrder: 5}, + {Key: "ldap_user_filter", Value: "(objectClass=inetOrgPerson)", ValueType: "string", Group: "ldap", Label: "用户过滤器", Desc: strPtr("LDAP 用户搜索过滤器"), DefaultValue: strPtr("(objectClass=inetOrgPerson)"), SortOrder: 6}, + {Key: "ldap_uid_attr", Value: "uid", ValueType: "string", Group: "ldap", Label: "UID 属性", Desc: strPtr("用户唯一标识属性"), DefaultValue: strPtr("uid"), SortOrder: 7}, + {Key: "ldap_mail_attr", Value: "mail", ValueType: "string", Group: "ldap", Label: "邮箱属性", Desc: strPtr("用户邮箱属性名"), DefaultValue: strPtr("mail"), SortOrder: 8}, + {Key: "ldap_cn_attr", Value: "cn", ValueType: "string", Group: "ldap", Label: "显示名属性", Desc: strPtr("用户显示名属性名"), DefaultValue: strPtr("cn"), SortOrder: 9}, + } + for _, s := range ldapDefaults { + var existing model.SystemSetting + if db.Where("`key` = ?", s.Key).First(&existing).Error != nil { + db.Create(&s) + } + } + log.Println("[seed] LDAP default config seeded") +} + +// seedAuditRules creates default audit rules for all DB types. +func seedAuditRules(db *gorm.DB) { + var count int64 + db.Model(&model.AuditRule{}).Count(&count) + if count > 0 { + return // Already has rules + } + + enabled := true + + type seedRule struct { + Name, Desc, RuleType, Severity, Pattern, Message, Value string + } + + allRules := map[string][]seedRule{ + "mysql": { + {"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作，可能导致数据永久丢失", "reject"}, + {"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"}, + {"禁止 TRUNCATE TABLE", "清空表数据需走审批", "DDL", "error", `(?i)^\s*TRUNCATE\s+TABLE?`, "禁止执行 TRUNCATE 操作，请使用 DELETE 逐批删除", "reject"}, + {"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"}, + {"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"}, + {"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"}, + {"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段，避免使用 SELECT *", "warn"}, + {"INSERT 需指定列", "INSERT 需指定列名", "DML", "warning", `(?i)^\s*INSERT\s+INTO\s+\S+\s+VALUES`, "INSERT 语句应明确指定列名", "review"}, + {"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL PRIVILEGES", "reject"}, + {"大表变更警告", "影响行数超过阈值需注意", "performance", "warning", "", "操作影响行数可能较大，建议在低峰期执行", "warn"}, + {"禁止不带 LIMIT 的 DELETE", "批量删除建议带 LIMIT", "DML", "warning", `(?i)^\s*DELETE\s+FROM\s+\S+\s+WHERE`, "建议 DELETE 语句添加 LIMIT 子句分批删除", "warn"}, + }, + "postgresql": { + {"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作", "reject"}, + {"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"}, + {"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"}, + {"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"}, + {"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"}, + {"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段", "warn"}, + {"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL", "reject"}, + }, + "redis": { + {"禁止 FLUSHALL", "不允许清空所有数据", "DDL", "error", `(?i)^FLUSHALL`, "禁止执行 FLUSHALL 操作", "reject"}, + {"禁止 FLUSHDB", "清空数据库需审批", "DDL", "error", `(?i)^FLUSHDB`, "禁止执行 FLUSHDB 操作", "reject"}, + {"禁止 CONFIG", "配置修改需走审批", "security", "error", `(?i)^CONFIG\s`, "CONFIG 命令需要审批后执行", "reject"}, + {"KEYS 命令警告", "生产环境禁止 KEYS", "performance", "error", `(?i)^KEYS\s`, "生产环境禁止使用 KEYS 命令，请使用 SCAN", "reject"}, + }, + "mongodb": { + {"禁止 dropDatabase", "不允许删除数据库", "DDL", "error", `dropDatabase`, "禁止执行 dropDatabase 操作", "reject"}, + {"禁止 drop 集合", "不允许删除集合", "DDL", "error", `(?i)\.drop\(\)`, "禁止执行集合 drop 操作", "reject"}, + {"remove 需带条件", "删除操作必须带条件", "DML", "error", `(?i)remove\(\s*\)`, "remove 操作必须带查询条件", "reject"}, + {"updateMany 需审核", "批量更新需审批", "DML", "warning", `(?i)updateMany`, "updateMany 操作需要审批后执行", "review"}, + }, + } + + total := 0 + for dbType, rules := range allRules { + for _, r := range rules { + desc := r.Desc + pattern := r.Pattern + severity := r.Severity + value := r.Value + rule := model.AuditRule{ + Name: r.Name, + Desc: &desc, + RuleType: r.RuleType, + Severity: &severity, + DBType: &dbType, + Pattern: &pattern, + IsEnabled: &enabled, + Message: r.Message, + Value: &value, + } + if err := db.Create(&rule).Error; err != nil { + log.Printf("[seed] Failed to create audit rule %s/%s: %v", dbType, r.Name, err) + } else { + total++ + } + } + } + log.Printf("[seed] Created %d default audit rules across 4 DB types", total) +} diff --git a/backend/internal/handler/ghost.go b/backend/internal/handler/ghost.go index 3c28413..9ea894f 100644 --- a/backend/internal/handler/ghost.go +++ b/backend/internal/handler/ghost.go @@ -528,3 +528,152 @@ func TestNotification(c *gin.Context) { _ = time.Now() c.JSON(http.StatusOK, gin.H{"message": "Notification sent (placeholder)"}) } + +// ==================== Audit Rules ==================== + +// defaultAuditRules defines seed rules per db_type +var defaultAuditRules = map[string][]struct { + Name string + Desc string + RuleType string + Severity string + Pattern string + Message string + Value string +}{ + "mysql": { + {"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作，可能导致数据永久丢失", "reject"}, + {"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"}, + {"禁止 TRUNCATE TABLE", "清空表数据需走审批", "DDL", "error", `(?i)^\s*TRUNCATE\s+TABLE?`, "禁止执行 TRUNCATE 操作，请使用 DELETE 逐批删除", "reject"}, + {"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"}, + {"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"}, + {"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"}, + {"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段，避免使用 SELECT *", "warn"}, + {"INSERT 需指定列", "INSERT 需指定列名", "DML", "warning", `(?i)^\s*INSERT\s+INTO\s+\S+\s+VALUES`, "INSERT 语句应明确指定列名", "review"}, + {"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL PRIVILEGES", "reject"}, + {"大表变更警告", "影响行数超过阈值需注意", "performance", "warning", "", "操作影响行数可能较大，建议在低峰期执行", "warn"}, + {"禁止不带 LIMIT 的 DELETE", "批量删除建议带 LIMIT", "DML", "warning", `(?i)^\s*DELETE\s+FROM\s+\S+\s+WHERE`, "建议 DELETE 语句添加 LIMIT 子句分批删除", "warn"}, + }, + "postgresql": { + {"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作", "reject"}, + {"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"}, + {"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"}, + {"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"}, + {"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"}, + {"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段", "warn"}, + {"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL", "reject"}, + }, + "redis": { + {"禁止 FLUSHALL", "不允许清空所有数据", "DDL", "error", `(?i)^FLUSHALL`, "禁止执行 FLUSHALL 操作", "reject"}, + {"禁止 FLUSHDB", "清空数据库需审批", "DDL", "error", `(?i)^FLUSHDB`, "禁止执行 FLUSHDB 操作", "reject"}, + {"禁止 CONFIG", "配置修改需走审批", "security", "error", `(?i)^CONFIG\s`, "CONFIG 命令需要审批后执行", "reject"}, + {"KEYS 命令警告", "生产环境禁止 KEYS", "performance", "error", `(?i)^KEYS\s`, "生产环境禁止使用 KEYS 命令，请使用 SCAN", "reject"}, + }, + "mongodb": { + {"禁止 dropDatabase", "不允许删除数据库", "DDL", "error", `dropDatabase`, "禁止执行 dropDatabase 操作", "reject"}, + {"禁止 drop 集合", "不允许删除集合", "DDL", "error", `(?i)\.drop\(\)`, "禁止执行集合 drop 操作", "reject"}, + {"remove 需带条件", "删除操作必须带条件", "DML", "error", `(?i)remove\(\s*\)`, "remove 操作必须带查询条件", "reject"}, + {"updateMany 需审核", "批量更新需审批", "DML", "warning", `(?i)updateMany`, "updateMany 操作需要审批后执行", "review"}, + }, +} + +// POST /api/v1/audit-rules/seed/:dbType +func SeedAuditRules(c *gin.Context) { + dbType := c.Param("dbType") + rules, ok := defaultAuditRules[dbType] + if !ok { + c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("不支持的数据库类型: %s", dbType)}) + return + } + + enabled := true + count := 0 + for _, r := range rules { + // Idempotent: skip if rule with same name+db_type exists + var existing int64 + model.DB.Model(&model.AuditRule{}).Where("name = ? AND db_type = ?", r.Name, dbType).Count(&existing) + if existing > 0 { + continue + } + desc := r.Desc + pattern := r.Pattern + severity := r.Severity + value := r.Value + rule := model.AuditRule{ + Name: r.Name, + Desc: &desc, + RuleType: r.RuleType, + Severity: &severity, + DBType: &dbType, + Pattern: &pattern, + IsEnabled: &enabled, + Message: r.Message, + Value: &value, + } + if err := model.DB.Create(&rule).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"detail": fmt.Sprintf("创建规则失败: %s", err.Error())}) + return + } + count++ + } + + c.JSON(http.StatusOK, gin.H{"message": fmt.Sprintf("成功初始化 %d 条规则", count), "count": count}) +} + +// POST /api/v1/audit-rules/:id/toggle +func ToggleAuditRule(c *gin.Context) { + id, err := strconv.Atoi(c.Param("id")) + if err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": "无效的规则 ID"}) + return + } + var rule model.AuditRule + if err := model.DB.First(&rule, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "规则不存在"}) + return + } + newEnabled := !*rule.IsEnabled + model.DB.Model(&rule).Update("is_enabled", newEnabled) + c.JSON(http.StatusOK, gin.H{"id": id, "is_enabled": newEnabled}) +} + +// PUT /api/v1/audit-rules/:id +func UpdateAuditRule(c *gin.Context) { + id, err := strconv.Atoi(c.Param("id")) + if err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": "无效的规则 ID"}) + return + } + var rule model.AuditRule + if err := model.DB.First(&rule, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "规则不存在"}) + return + } + var body struct { + Value *string `json:"value"` + Pattern *string `json:"pattern"` + Message *string `json:"message"` + Severity *string `json:"severity"` + } + if err := c.ShouldBindJSON(&body); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + updates := map[string]interface{}{} + if body.Value != nil { + updates["value"] = *body.Value + } + if body.Pattern != nil { + updates["pattern"] = *body.Pattern + } + if body.Message != nil { + updates["message"] = *body.Message + } + if body.Severity != nil { + updates["severity"] = *body.Severity + } + if len(updates) > 0 { + model.DB.Model(&rule).Updates(updates) + } + c.JSON(http.StatusOK, rule) +} diff --git a/backend/router/router.go b/backend/router/router.go index a49adcd..ceadf5b 100644 --- a/backend/router/router.go +++ b/backend/router/router.go @@ -181,6 +181,9 @@ func Setup(r *gin.Engine) { // Read-only resources auth.GET("/audit-rules", handler.ListAuditRules) + auth.POST("/audit-rules/seed/:dbType", handler.SeedAuditRules) + auth.POST("/audit-rules/:id/toggle", handler.ToggleAuditRule) + auth.PUT("/audit-rules/:id", handler.UpdateAuditRule) auth.GET("/announcements", handler.ListAnnouncements) auth.GET("/query-histories", handler.ListQueryHistories) // Notifications CRUD (replaces old channels/templates endpoints) diff --git a/frontend/src/components/EditInstanceDialog.tsx b/frontend/src/components/EditInstanceDialog.tsx index 2985662..31b9442 100644 --- a/frontend/src/components/EditInstanceDialog.tsx +++ b/frontend/src/components/EditInstanceDialog.tsx @@ -137,7 +137,7 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m const labelCls = 'block text-xs font-medium text-[var(--dg-text-secondary)] mb-1'; return ( -
+
e.stopPropagation()} diff --git a/frontend/src/components/Layout.tsx b/frontend/src/components/Layout.tsx index 3fca66b..b58dede 100644 --- a/frontend/src/components/Layout.tsx +++ b/frontend/src/components/Layout.tsx @@ -52,8 +52,8 @@ export default function Layout() { return (
- {/* 侧边栏 */} -