Logan.Li
d867c276d4
chore(frontend): engineering baseline per guide ch.8
...
- toolchain: vitest+jsdom (15 tests green: permission pure functions
exhaustive, storage migration), prettier (printWidth 120 to fit the
dense existing style + 700-line page budget), commitlint conventional
- npm scripts: typecheck / format / test / lint:fix; build fingerprint
__APP_VERSION__ (version+git hash+build time) shown in Settings > about
- git hooks via core.hooksPath=frontend/.husky: pre-commit lint-staged
(prettier + eslint --fix best-effort), commit-msg commitlint
- permission pure functions extracted to lib/permissions.ts (single
source consumed by useAuth/useLogin); AuditLogsPage filters on URL
- backend: resp package unit tests; health version constant aligned
with frontend package.json
2026-10-26 17:58:59 +08:00
Logan.Li
16f1f7d65f
feat(backend): unified response helpers, refresh token, security hardening
...
- new resp package (OK/Page/Fail/BadRequest/.../InternalErr): unified error
envelope {detail, code?}, sanitized 500s (full error logged server-side,
generic message to client - stops DB error leakage), pagination envelope
{items,total,page,page_size}; migrate 200+ inline c.JSON error sites
- refresh token: 7d rotation tokens (SHA-256 hashed at rest), public
POST /auth/refresh with single-use rotation, POST /auth/logout revokes
all user refresh tokens (endpoint previously missing - frontend 404)
- security: gh-ost command line password masked in task status payload;
Instance.MarshalJSON guarantees encrypted passwords never leave the API
(removes reliance on per-handler manual masking); production (DEBUG=false)
with default JWT secret now auto-generates and persists a random secret
- safe.Go recover wrapper for background goroutines (instance probe,
gh-ost async)
- delete dead service layer (zero callers)
- fix pre-existing go vet unkeyed bson.E literals
2026-10-26 17:21:00 +08:00
logan
bc2092a980
feat: 平台配置全面生效 — 配置策略接入实际逻辑
...
- query组: ExecuteQuery读取query_limit_max/query_timeout/query_dangerous_pattern
- 查询超时通过context.WithTimeout生效，db.QueryContext/QueryRowContext
- 危险模式检测拦截无WHERE的DELETE/UPDATE/DROP/TRUNCATE
- LIMIT上限从settings读取，不再硬编码1000
- security组: Login读取login_max_attempts/login_lockout_minutes
- 新增User字段: failed_login_attempts + locked_until
- 登录失败达到阈值自动锁定，成功时清除计数
- JWT Token过期时间读取session_timeout_hours设置
- executor组: ExecuteTicket读取executor_timeout/executor_dry_run
- 执行超时通过context.WithTimeout控制
- 开启dry_run时先EXPLAIN预检查SQL语法
- db.ExecContext替代db.Exec
- cleanup组: SettingsCleanupPreview/Run从占位改为真实实现
- 预览统计4类数据(工单/查询历史/慢日志/审计日志)待清理数量
- 执行清理按retention_days配置删除过期数据
- ghost组: 13项gh-ost配置加入seedDefaultSettings
- enabled/path/mode/osc_priority/env/cloud/trigger/chunk/load/lag等
- 已被ghost.go中getGhostConfig等函数读取
- 前端: PlatformConfigPage新增Ghost/OSC分组显示
2026-06-01 01:00:23 +08:00
logan
889cce140b
refactor: 弹框架构重构 + 审核规则seed API + LDAP默认配置 + 全量初始数据
...
弹框架构:
- Layout header/sidebar z-[200] 隔离弹框层，弹框不再遮挡面包屑
- dialog.tsx 简化: 去掉 border/backdrop-blur，统一暗色主题变量
- ModalOverlay z-[100] 对齐 Radix Dialog overlay 层级
- EditInstanceDialog 同步 z-index 修复
- 修复 InstanceGroupPage/InstancePage/LdapConfigPage 缺失 import
- 修复 InstanceGroupPage 缺失 X icon import
- RedisDetailPage ModalOverlay 迁移为 FormDialog
审核规则:
- POST /audit-rules/seed/:dbType 初始化默认规则 (mysql 11/pg 7/redis 4/mongo 4)
- POST /audit-rules/:id/toggle 开关规则
- PUT /audit-rules/:id 编辑规则
- seed.go 启动时自动创建 26 条默认审核规则
LDAP 默认配置:
- seed.go 自动写入 9 条 LDAP 配置 (8.217.205.92:389, dc=opsx,dc=vip)
- 全新 DB 启动即就位，无需手动配置
2026-05-29 22:48:45 +08:00
logan
ad12f30355
feat: 添加 seed.go 初始化文件 — 默认用户+审批流程+系统设置
...
- seedDefaultUsers: 4个默认用户(admin/dba/auditor/developer, 密码admin123)
- seedDefaultWorkflow: 默认审批流程(提交→DBA审核→执行)
- seedDefaultSettings: 数据脱敏默认配置
- 所有操作幂等，已有数据不覆盖
- main.go调用seedAll()统一初始化
2026-05-29 21:31:25 +08:00
logan
557d88d3ed
feat: 数据脱敏体系重构 — 全局设置+masked_columns+前端去硬编码
...
后端:
- applyDataMasking 新增 masked_columns 返回字段，告诉前端哪些列被脱敏
- seedDefaultSettings 添加 data_masking 分组(启用开关+敏感字段列表)
- 脱敏逻辑: 全局敏感字段 + 实例级 mask_fields 合并，开关关闭则跳过
前端:
- QueriesPage 去掉硬编码 sensitiveKeywords 和 maskData()
- 改用后端返回的 masked_columns 显示'敏'标签
- 脱敏值由后端统一处理(替换为*)
- PlatformConfigPage 数据脱敏分组独立显示
- EditInstanceDialog 脱敏字段简化为逗号分隔输入
验证:
- 设置页开关可正常开关/保存
- 查询 ghost_test: email列被脱敏为*，列头显示'敏'标签
- 非敏感列(name, id, status)正常显示
2026-05-28 23:26:10 +08:00
logan
ca308e277d
feat: v0.3.1 — Go/Gin 后端重写 + gh-ost 集成
...
架构变更:
- Python/FastAPI → Go/Gin 重写（Python 后端保留在 backend-python/）
- GORM + SQLite（兼容现有数据库表结构）
- JWT 认证 + RBAC 权限中间件
Go 后端结构:
- cmd/server/main.go — 入口，端口 9000
- config/config.go — 环境变量配置
- internal/model/ — GORM 模型（30张表，完全兼容 SQLite）
- internal/handler/ — auth/instance/ticket/dashboard/ghost handler
- internal/middleware/ — JWT 认证 + CORS
- internal/ghost/ — gh-ost 集成模块（同步/异步执行，任务管理）
- router/router.go — API 路由注册（/api/v1/...）
gh-ost 集成:
- RunGhOst() 同步执行
- RunGhOstAsync() 异步执行 + 进度追踪
- TaskManager 管理多个并发任务
- API: POST /ghost/dry-run, /ghost/execute, GET /ghost/status/:taskId
核心 API 已对齐:
- POST /auth/login (JWT)
- GET /dashboard/stats, /dashboard/my-tickets
- GET /tickets/statistics, CRUD + approve/execute
- GET/POST/PUT/DELETE /instances
- GET /users, /audit-rules, /announcements, /settings
已验证:
- 登录 admin/admin123 ✅
- Dashboard 99工单/110查询/4实例 ✅
- 工单统计按角色过滤 ✅
2026-05-25 21:40:54 +08:00
Logan.Li