refactor: 弹框架构重构 + 审核规则seed API + LDAP默认配置 + 全量初始数据
弹框架构: - Layout header/sidebar z-[200] 隔离弹框层，弹框不再遮挡面包屑 - dialog.tsx 简化: 去掉 border/backdrop-blur，统一暗色主题变量 - ModalOverlay z-[100] 对齐 Radix Dialog overlay 层级 - EditInstanceDialog 同步 z-index 修复 - 修复 InstanceGroupPage/InstancePage/LdapConfigPage 缺失 import - 修复 InstanceGroupPage 缺失 X icon import - RedisDetailPage ModalOverlay 迁移为 FormDialog 审核规则: - POST /audit-rules/seed/:dbType 初始化默认规则 (mysql 11/pg 7/redis 4/mongo 4) - POST /audit-rules/:id/toggle 开关规则 - PUT /audit-rules/:id 编辑规则 - seed.go 启动时自动创建 26 条默认审核规则 LDAP 默认配置: - seed.go 自动写入 9 条 LDAP 配置 (8.217.205.92:389, dc=opsx,dc=vip) - 全新 DB 启动即就位，无需手动配置
This commit is contained in:
logan committed
1 parent
47431f127c
commit
889cce140b
24 files changed
+494
-252
No files matched your search
@@ -15,6 +15,8 @@ func seedAll(db *gorm.DB) {
|
||||
seedDefaultUsers(db)
|
||||
seedDefaultWorkflow(db)
|
||||
seedDefaultSettings(db)
|
||||
seedLDAPConfig(db)
|
||||
seedAuditRules(db)
|
||||
log.Println("[seed] Default data initialized")
|
||||
}
|
||||
|
||||
@@ -114,3 +116,104 @@ func seedDefaultWorkflow(db *gorm.DB) {
|
||||
}
|
||||
|
||||
func intPtr(v int) *int { return &v }
|
||||
|
||||
// seedLDAPConfig inserts default LDAP settings if not present.
|
||||
func seedLDAPConfig(db *gorm.DB) {
|
||||
ldapDefaults := []model.SystemSetting{
|
||||
{Key: "ldap_host", Value: "8.217.205.92", ValueType: "string", Group: "ldap", Label: "LDAP 服务器地址", Desc: strPtr("LDAP 服务器 IP 或域名"), DefaultValue: strPtr("8.217.205.92"), SortOrder: 1},
|
||||
{Key: "ldap_port", Value: "389", ValueType: "number", Group: "ldap", Label: "LDAP 端口", Desc: strPtr("默认 389，LDAPS 用 636"), DefaultValue: strPtr("389"), SortOrder: 2},
|
||||
{Key: "ldap_use_ssl", Value: "false", ValueType: "boolean", Group: "ldap", Label: "启用 LDAPS (SSL/TLS)", Desc: strPtr("使用 SSL/TLS 加密连接"), DefaultValue: strPtr("false"), SortOrder: 3},
|
||||
{Key: "ldap_bind_dn", Value: "cn=admin,dc=opsx,dc=vip", ValueType: "string", Group: "ldap", Label: "管理员 DN", Desc: strPtr("LDAP 管理员绑定 DN"), DefaultValue: strPtr("cn=admin,dc=opsx,dc=vip"), SortOrder: 4},
|
||||
{Key: "ldap_base_dn", Value: "dc=opsx,dc=vip", ValueType: "string", Group: "ldap", Label: "Base DN", Desc: strPtr("用户搜索的基础 DN"), DefaultValue: strPtr("dc=opsx,dc=vip"), SortOrder: 5},
|
||||
{Key: "ldap_user_filter", Value: "(objectClass=inetOrgPerson)", ValueType: "string", Group: "ldap", Label: "用户过滤器", Desc: strPtr("LDAP 用户搜索过滤器"), DefaultValue: strPtr("(objectClass=inetOrgPerson)"), SortOrder: 6},
|
||||
{Key: "ldap_uid_attr", Value: "uid", ValueType: "string", Group: "ldap", Label: "UID 属性", Desc: strPtr("用户唯一标识属性"), DefaultValue: strPtr("uid"), SortOrder: 7},
|
||||
{Key: "ldap_mail_attr", Value: "mail", ValueType: "string", Group: "ldap", Label: "邮箱属性", Desc: strPtr("用户邮箱属性名"), DefaultValue: strPtr("mail"), SortOrder: 8},
|
||||
{Key: "ldap_cn_attr", Value: "cn", ValueType: "string", Group: "ldap", Label: "显示名属性", Desc: strPtr("用户显示名属性名"), DefaultValue: strPtr("cn"), SortOrder: 9},
|
||||
}
|
||||
for _, s := range ldapDefaults {
|
||||
var existing model.SystemSetting
|
||||
if db.Where("`key` = ?", s.Key).First(&existing).Error != nil {
|
||||
db.Create(&s)
|
||||
}
|
||||
}
|
||||
log.Println("[seed] LDAP default config seeded")
|
||||
}
|
||||
|
||||
// seedAuditRules creates default audit rules for all DB types.
|
||||
func seedAuditRules(db *gorm.DB) {
|
||||
var count int64
|
||||
db.Model(&model.AuditRule{}).Count(&count)
|
||||
if count > 0 {
|
||||
return // Already has rules
|
||||
}
|
||||
|
||||
enabled := true
|
||||
|
||||
type seedRule struct {
|
||||
Name, Desc, RuleType, Severity, Pattern, Message, Value string
|
||||
}
|
||||
|
||||
allRules := map[string][]seedRule{
|
||||
"mysql": {
|
||||
{"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作，可能导致数据永久丢失", "reject"},
|
||||
{"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"},
|
||||
{"禁止 TRUNCATE TABLE", "清空表数据需走审批", "DDL", "error", `(?i)^\s*TRUNCATE\s+TABLE?`, "禁止执行 TRUNCATE 操作，请使用 DELETE 逐批删除", "reject"},
|
||||
{"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"},
|
||||
{"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"},
|
||||
{"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"},
|
||||
{"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段，避免使用 SELECT *", "warn"},
|
||||
{"INSERT 需指定列", "INSERT 需指定列名", "DML", "warning", `(?i)^\s*INSERT\s+INTO\s+\S+\s+VALUES`, "INSERT 语句应明确指定列名", "review"},
|
||||
{"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL PRIVILEGES", "reject"},
|
||||
{"大表变更警告", "影响行数超过阈值需注意", "performance", "warning", "", "操作影响行数可能较大，建议在低峰期执行", "warn"},
|
||||
{"禁止不带 LIMIT 的 DELETE", "批量删除建议带 LIMIT", "DML", "warning", `(?i)^\s*DELETE\s+FROM\s+\S+\s+WHERE`, "建议 DELETE 语句添加 LIMIT 子句分批删除", "warn"},
|
||||
},
|
||||
"postgresql": {
|
||||
{"禁止 DROP TABLE", "生产环境不允许删除表", "DDL", "error", `(?i)^\s*DROP\s+TABLE`, "禁止执行 DROP TABLE 操作", "reject"},
|
||||
{"禁止 DROP DATABASE", "不允许删除数据库", "DDL", "error", `(?i)^\s*DROP\s+DATABASE`, "禁止执行 DROP DATABASE 操作", "reject"},
|
||||
{"禁止 DELETE 无 WHERE", "删除操作必须带条件", "DML", "error", `(?i)^\s*DELETE\s+FROM?\s+\S+\s*$`, "DELETE 语句必须包含 WHERE 条件", "reject"},
|
||||
{"禁止 UPDATE 无 WHERE", "更新操作必须带条件", "DML", "error", `(?i)^\s*UPDATE\s+\S+\s+SET\s+.*\s*$`, "UPDATE 语句必须包含 WHERE 条件", "reject"},
|
||||
{"ALTER TABLE 需审核", "表结构变更需审批", "DDL", "warning", `(?i)^\s*ALTER\s+TABLE`, "ALTER TABLE 操作需要审批后执行", "review"},
|
||||
{"SELECT * 建议", "避免使用 SELECT *", "DQL", "info", `(?i)^\s*SELECT\s+\*\s+FROM`, "建议明确指定查询字段", "warn"},
|
||||
{"禁止 GRANT ALL", "不允许授予全部权限", "DCL", "error", `(?i)^\s*GRANT\s+ALL`, "禁止使用 GRANT ALL", "reject"},
|
||||
},
|
||||
"redis": {
|
||||
{"禁止 FLUSHALL", "不允许清空所有数据", "DDL", "error", `(?i)^FLUSHALL`, "禁止执行 FLUSHALL 操作", "reject"},
|
||||
{"禁止 FLUSHDB", "清空数据库需审批", "DDL", "error", `(?i)^FLUSHDB`, "禁止执行 FLUSHDB 操作", "reject"},
|
||||
{"禁止 CONFIG", "配置修改需走审批", "security", "error", `(?i)^CONFIG\s`, "CONFIG 命令需要审批后执行", "reject"},
|
||||
{"KEYS 命令警告", "生产环境禁止 KEYS", "performance", "error", `(?i)^KEYS\s`, "生产环境禁止使用 KEYS 命令，请使用 SCAN", "reject"},
|
||||
},
|
||||
"mongodb": {
|
||||
{"禁止 dropDatabase", "不允许删除数据库", "DDL", "error", `dropDatabase`, "禁止执行 dropDatabase 操作", "reject"},
|
||||
{"禁止 drop 集合", "不允许删除集合", "DDL", "error", `(?i)\.drop\(\)`, "禁止执行集合 drop 操作", "reject"},
|
||||
{"remove 需带条件", "删除操作必须带条件", "DML", "error", `(?i)remove\(\s*\)`, "remove 操作必须带查询条件", "reject"},
|
||||
{"updateMany 需审核", "批量更新需审批", "DML", "warning", `(?i)updateMany`, "updateMany 操作需要审批后执行", "review"},
|
||||
},
|
||||
}
|
||||
|
||||
total := 0
|
||||
for dbType, rules := range allRules {
|
||||
for _, r := range rules {
|
||||
desc := r.Desc
|
||||
pattern := r.Pattern
|
||||
severity := r.Severity
|
||||
value := r.Value
|
||||
rule := model.AuditRule{
|
||||
Name: r.Name,
|
||||
Desc: &desc,
|
||||
RuleType: r.RuleType,
|
||||
Severity: &severity,
|
||||
DBType: &dbType,
|
||||
Pattern: &pattern,
|
||||
IsEnabled: &enabled,
|
||||
Message: r.Message,
|
||||
Value: &value,
|
||||
}
|
||||
if err := db.Create(&rule).Error; err != nil {
|
||||
log.Printf("[seed] Failed to create audit rule %s/%s: %v", dbType, r.Name, err)
|
||||
} else {
|
||||
total++
|
||||
}
|
||||
}
|
||||
}
|
||||
log.Printf("[seed] Created %d default audit rules across 4 DB types", total)
|
||||
}
|
||||
Reference in new issue
Block a user