2075 lines
66 KiB
Go
2075 lines
66 KiB
Go
package web
|
||
|
||
import (
|
||
"context"
|
||
"crypto/hmac"
|
||
"crypto/sha256"
|
||
"encoding/hex"
|
||
"encoding/json"
|
||
"fmt"
|
||
"net"
|
||
"net/http"
|
||
"path/filepath"
|
||
"regexp"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"ops-assistant/internal/channel"
|
||
"ops-assistant/internal/core/ecode"
|
||
"ops-assistant/internal/core/ops"
|
||
"ops-assistant/internal/core/runbook"
|
||
"ops-assistant/internal/service"
|
||
"ops-assistant/models"
|
||
"ops-assistant/version"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
"gorm.io/gorm"
|
||
)
|
||
|
||
const (
|
||
cookieUserNew = "ops_user"
|
||
cookieTokenNew = "ops_token"
|
||
cookieUserOld = "xiaji_user"
|
||
cookieTokenOld = "xiaji_token"
|
||
)
|
||
|
||
type WebServer struct {
|
||
db *gorm.DB
|
||
dbPath string
|
||
baseDir string
|
||
finance *service.FinanceService
|
||
port int
|
||
username string
|
||
password string
|
||
secretKey string
|
||
reloadFn func() (string, error)
|
||
}
|
||
|
||
type CurrentUser struct {
|
||
Username string `json:"username"`
|
||
Role string `json:"role"`
|
||
UserID int64 `json:"user_id"`
|
||
Permissions map[string]bool `json:"-"`
|
||
PermList []string `json:"permissions"`
|
||
Flags map[string]bool `json:"flags"`
|
||
Caps map[string]bool `json:"effective_capabilities"`
|
||
}
|
||
|
||
type flagPatchReq struct {
|
||
Enabled bool `json:"enabled"`
|
||
Reason string `json:"reason"`
|
||
}
|
||
|
||
type moduleToggleReq struct {
|
||
Enabled bool `json:"enabled"`
|
||
Reason string `json:"reason"`
|
||
}
|
||
|
||
type opsJobActionReq struct {
|
||
Reason string `json:"reason"`
|
||
}
|
||
|
||
type channelConfigPatchReq struct {
|
||
Name *string `json:"name"`
|
||
Enabled *bool `json:"enabled"`
|
||
Config json.RawMessage `json:"config"`
|
||
Secrets json.RawMessage `json:"secrets"`
|
||
}
|
||
|
||
type cpaSettingsReq struct {
|
||
ManagementToken string `json:"management_token"`
|
||
ManagementBase string `json:"management_base"`
|
||
}
|
||
|
||
type cfSettingsReq struct {
|
||
AccountID string `json:"account_id"`
|
||
APIEmail string `json:"api_email"`
|
||
APIToken string `json:"api_token"`
|
||
}
|
||
|
||
type aiSettingsReq struct {
|
||
Enabled *bool `json:"enabled"`
|
||
BaseURL string `json:"base_url"`
|
||
APIKey string `json:"api_key"`
|
||
Model string `json:"model"`
|
||
TimeoutSeconds int `json:"timeout_seconds"`
|
||
}
|
||
|
||
type opsTargetReq struct {
|
||
Name string `json:"name"`
|
||
Host string `json:"host"`
|
||
Port int `json:"port"`
|
||
User string `json:"user"`
|
||
Enabled bool `json:"enabled"`
|
||
}
|
||
|
||
var (
|
||
validHostRe = regexp.MustCompile(`^(?:[a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$`)
|
||
validUserRe = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
|
||
)
|
||
|
||
func validateTargetFields(host, user string, port int) error {
|
||
host = strings.TrimSpace(host)
|
||
user = strings.TrimSpace(user)
|
||
if host == "" || user == "" {
|
||
return fmt.Errorf("host/user 不能为空")
|
||
}
|
||
if ip := net.ParseIP(host); ip == nil {
|
||
if !validHostRe.MatchString(host) {
|
||
return fmt.Errorf("host 非法")
|
||
}
|
||
}
|
||
if !validUserRe.MatchString(user) {
|
||
return fmt.Errorf("user 非法")
|
||
}
|
||
if port <= 0 || port > 65535 {
|
||
return fmt.Errorf("port 无效")
|
||
}
|
||
return nil
|
||
}
|
||
|
||
var rolePermissions = map[string][]string{
|
||
"owner": {
|
||
"records.read.self", "records.read.all",
|
||
"records.delete.self", "records.delete.all",
|
||
"records.export.self", "records.export.all",
|
||
"settings.flags.read", "settings.flags.write",
|
||
"channels.read", "channels.write", "channels.test",
|
||
"audit.read", "ops.read", "ops.cancel", "ops.retry",
|
||
},
|
||
"admin": {
|
||
"records.read.self", "records.delete.self", "records.export.self",
|
||
"settings.flags.read", "channels.read", "audit.read", "ops.read", "ops.cancel", "ops.retry",
|
||
},
|
||
"viewer": {
|
||
"records.read.self",
|
||
},
|
||
}
|
||
|
||
func NewWebServer(db *gorm.DB, dbPath, baseDir string, finance *service.FinanceService, port int, username, password, sessionKey string, reloadFn func() (string, error)) *WebServer {
|
||
return &WebServer{
|
||
db: db,
|
||
dbPath: dbPath,
|
||
baseDir: baseDir,
|
||
finance: finance,
|
||
port: port,
|
||
username: username,
|
||
password: password,
|
||
secretKey: "ops-assistant-session-" + sessionKey,
|
||
reloadFn: reloadFn,
|
||
}
|
||
}
|
||
|
||
func (s *WebServer) generateToken(username string) string {
|
||
exp := time.Now().Add(7 * 24 * time.Hour).Unix()
|
||
payload := fmt.Sprintf("%s|%d", username, exp)
|
||
mac := hmac.New(sha256.New, []byte(s.secretKey))
|
||
mac.Write([]byte(payload))
|
||
sig := hex.EncodeToString(mac.Sum(nil))
|
||
return fmt.Sprintf("%s|%s", payload, sig)
|
||
}
|
||
|
||
func (s *WebServer) validateToken(username, token string) bool {
|
||
parts := strings.Split(token, "|")
|
||
if len(parts) == 1 {
|
||
// legacy token: HMAC(username)
|
||
expected := s.generateLegacyToken(username)
|
||
return hmac.Equal([]byte(expected), []byte(token))
|
||
}
|
||
if len(parts) != 3 {
|
||
return false
|
||
}
|
||
if parts[0] != username {
|
||
return false
|
||
}
|
||
exp, err := strconv.ParseInt(parts[1], 10, 64)
|
||
if err != nil {
|
||
return false
|
||
}
|
||
if time.Now().Unix() > exp {
|
||
return false
|
||
}
|
||
payload := fmt.Sprintf("%s|%s", parts[0], parts[1])
|
||
mac := hmac.New(sha256.New, []byte(s.secretKey))
|
||
mac.Write([]byte(payload))
|
||
expected := hex.EncodeToString(mac.Sum(nil))
|
||
return hmac.Equal([]byte(expected), []byte(parts[2]))
|
||
}
|
||
|
||
func (s *WebServer) generateLegacyToken(username string) string {
|
||
mac := hmac.New(sha256.New, []byte(s.secretKey))
|
||
mac.Write([]byte(username))
|
||
return hex.EncodeToString(mac.Sum(nil))
|
||
}
|
||
|
||
func (s *WebServer) buildCurrentUser(username string) *CurrentUser {
|
||
role := "viewer"
|
||
userID := int64(1)
|
||
if username == s.username {
|
||
role = "owner"
|
||
}
|
||
perms := map[string]bool{}
|
||
permList := make([]string, 0)
|
||
for _, p := range rolePermissions[role] {
|
||
perms[p] = true
|
||
permList = append(permList, p)
|
||
}
|
||
return &CurrentUser{Username: username, Role: role, UserID: userID, Permissions: perms, PermList: permList}
|
||
}
|
||
|
||
func (s *WebServer) getFlagMap() map[string]bool {
|
||
res := map[string]bool{}
|
||
var flags []models.FeatureFlag
|
||
s.db.Find(&flags)
|
||
for _, f := range flags {
|
||
res[f.Key] = f.Enabled
|
||
}
|
||
return res
|
||
}
|
||
|
||
func (s *WebServer) flagEnabled(key string) bool {
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", key).First(&ff).Error; err != nil {
|
||
return false
|
||
}
|
||
return ff.Enabled
|
||
}
|
||
|
||
func (s *WebServer) hasPermission(u *CurrentUser, perm string) bool {
|
||
if u == nil {
|
||
return false
|
||
}
|
||
return u.Permissions[perm]
|
||
}
|
||
|
||
func (s *WebServer) requirePerm(c *gin.Context, u *CurrentUser, perm, msg string) bool {
|
||
if s.hasPermission(u, perm) {
|
||
return true
|
||
}
|
||
deny(c, msg)
|
||
return false
|
||
}
|
||
|
||
func (s *WebServer) renderPage(c *gin.Context, tpl string, u *CurrentUser, extra gin.H) {
|
||
data := gin.H{"version": "v" + version.Version}
|
||
if u != nil {
|
||
data["username"] = u.Username
|
||
}
|
||
for k, v := range extra {
|
||
data[k] = v
|
||
}
|
||
c.HTML(http.StatusOK, tpl, data)
|
||
}
|
||
|
||
func deny(c *gin.Context, msg string) {
|
||
respondErr(c, http.StatusForbidden, ecode.ErrPermissionDenied, msg)
|
||
}
|
||
|
||
func currentUser(c *gin.Context) *CurrentUser {
|
||
if v, ok := c.Get("currentUser"); ok {
|
||
if u, ok2 := v.(*CurrentUser); ok2 {
|
||
return u
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func (s *WebServer) authRequired() gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
username, _ := c.Cookie(cookieUserNew)
|
||
token, _ := c.Cookie(cookieTokenNew)
|
||
|
||
legacy := false
|
||
if username == "" || token == "" {
|
||
username, _ = c.Cookie(cookieUserOld)
|
||
token, _ = c.Cookie(cookieTokenOld)
|
||
legacy = username != "" && token != ""
|
||
}
|
||
|
||
if username == "" || token == "" || !s.validateToken(username, token) {
|
||
path := c.Request.URL.Path
|
||
if strings.HasPrefix(path, "/api") || c.Request.Method == "POST" || c.Request.Method == "PATCH" {
|
||
respondErr(c, http.StatusUnauthorized, ecode.ErrPermissionDenied, "未登录")
|
||
} else {
|
||
c.Redirect(http.StatusFound, "/login")
|
||
}
|
||
c.Abort()
|
||
return
|
||
}
|
||
|
||
if legacy {
|
||
maxAge := 7 * 24 * 3600
|
||
c.SetCookie(cookieUserNew, username, maxAge, "/", "", false, true)
|
||
c.SetCookie(cookieTokenNew, token, maxAge, "/", "", false, true)
|
||
} else if strings.Contains(token, "|") {
|
||
// refresh exp for new token format
|
||
maxAge := 7 * 24 * 3600
|
||
fresh := s.generateToken(username)
|
||
c.SetCookie(cookieUserNew, username, maxAge, "/", "", false, true)
|
||
c.SetCookie(cookieTokenNew, fresh, maxAge, "/", "", false, true)
|
||
}
|
||
|
||
c.Set("currentUser", s.buildCurrentUser(username))
|
||
c.Next()
|
||
}
|
||
}
|
||
|
||
func (s *WebServer) writeAudit(actor int64, action, targetType, targetID, before, after, note string) {
|
||
_ = s.db.Create(&models.AuditLog{
|
||
ActorID: actor,
|
||
Action: action,
|
||
TargetType: targetType,
|
||
TargetID: targetID,
|
||
BeforeJSON: before,
|
||
AfterJSON: after,
|
||
Note: note,
|
||
}).Error
|
||
}
|
||
|
||
func (s *WebServer) writeAuditResult(actor int64, action, targetType, targetID, before, after, note, result string) {
|
||
finalNote := strings.TrimSpace(note)
|
||
if strings.TrimSpace(result) != "" {
|
||
if finalNote == "" {
|
||
finalNote = "result=" + result
|
||
} else {
|
||
finalNote = finalNote + " | result=" + result
|
||
}
|
||
}
|
||
s.writeAudit(actor, action, targetType, targetID, before, after, finalNote)
|
||
}
|
||
|
||
func (s *WebServer) registerAPIV1Routes(auth *gin.RouterGroup) {
|
||
auth.GET("/api/v1/me", s.handleMe)
|
||
auth.GET("/api/v1/records", s.handleRecordsV1)
|
||
auth.POST("/api/v1/records/:id/delete", s.handleDeleteV1)
|
||
auth.GET("/api/v1/export", s.handleExportV1)
|
||
auth.GET("/api/v1/admin/settings/flags", s.handleFlagsList)
|
||
auth.PATCH("/api/v1/admin/settings/flags/:key", s.handleFlagPatch)
|
||
// CPA settings
|
||
auth.GET("/api/v1/admin/cpa/settings", s.handleCPASettingsGet)
|
||
auth.PATCH("/api/v1/admin/cpa/settings", s.handleCPASettingsPatch)
|
||
// Cloudflare settings
|
||
auth.GET("/api/v1/admin/cf/settings", s.handleCFSettingsGet)
|
||
auth.PATCH("/api/v1/admin/cf/settings", s.handleCFSettingsPatch)
|
||
// AI settings
|
||
auth.GET("/api/v1/admin/ai/settings", s.handleAISettingsGet)
|
||
auth.PATCH("/api/v1/admin/ai/settings", s.handleAISettingsPatch)
|
||
// Ops targets
|
||
auth.GET("/api/v1/admin/ops/targets", s.handleOpsTargetsList)
|
||
auth.POST("/api/v1/admin/ops/targets", s.handleOpsTargetsCreate)
|
||
auth.PATCH("/api/v1/admin/ops/targets/:id", s.handleOpsTargetsPatch)
|
||
|
||
auth.GET("/api/v1/admin/channels", s.handleChannelsList)
|
||
auth.PATCH("/api/v1/admin/channels/:platform", s.handleChannelPatch)
|
||
auth.POST("/api/v1/admin/channels/:platform/publish", s.handleChannelPublish)
|
||
auth.POST("/api/v1/admin/channels/reload", s.handleChannelReload)
|
||
auth.POST("/api/v1/admin/channels/disable-all", s.handleChannelDisableAll)
|
||
auth.POST("/api/v1/admin/channels/:platform/enable", s.handleChannelEnable)
|
||
auth.POST("/api/v1/admin/channels/:platform/disable", s.handleChannelDisable)
|
||
auth.POST("/api/v1/admin/channels/:platform/test", s.handleChannelTest)
|
||
auth.POST("/api/v1/admin/channels/:platform/apply", s.handleChannelApply)
|
||
auth.GET("/api/v1/admin/audit", s.handleAuditList)
|
||
auth.GET("/api/v1/admin/legacy/usage", s.handleLegacyUsage)
|
||
auth.GET("/api/v1/admin/legacy/trend", s.handleLegacyTrend)
|
||
auth.GET("/api/v1/admin/legacy/readiness", s.handleLegacyReadiness)
|
||
auth.GET("/api/v1/modules", s.handleModulesList)
|
||
auth.POST("/api/v1/modules/:module/toggle", s.handleModuleToggle)
|
||
auth.GET("/api/v1/dashboard/overview", s.handleDashboardOverview)
|
||
auth.GET("/api/v1/dashboard/summary", s.handleDashboardSummary)
|
||
auth.GET("/api/v1/ops/jobs", s.handleOpsJobs)
|
||
auth.GET("/api/v1/ops/jobs/request/:requestID", s.handleOpsJobsByRequestID)
|
||
auth.GET("/api/v1/ops/jobs/:id", s.handleOpsJobDetail)
|
||
auth.POST("/api/v1/ops/jobs/:id/cancel", s.handleOpsJobCancel)
|
||
auth.POST("/api/v1/ops/jobs/:id/retry", s.handleOpsJobRetry)
|
||
}
|
||
|
||
func (s *WebServer) registerLegacyCompatRoutes(auth *gin.RouterGroup) {
|
||
// 兼容老前端调用，统一复用 v1 handler（兼容层）
|
||
//
|
||
// 废弃计划（仅文档约束，当前不删）：
|
||
// 1) 新功能与新页面只允许使用 /api/v1/*
|
||
// 2) 当确认无旧调用后，再移除以下旧路由映射
|
||
// 3) 每次版本发布前，优先检查是否仍存在对旧路由的引用
|
||
auth.GET("/api/records", s.handleLegacyRecords)
|
||
auth.POST("/delete/:id", s.handleLegacyDelete)
|
||
auth.GET("/export", s.handleLegacyExport)
|
||
}
|
||
|
||
func (s *WebServer) writeLegacyAccess(c *gin.Context, route string) {
|
||
u := currentUser(c)
|
||
uid := int64(0)
|
||
if u != nil {
|
||
uid = u.UserID
|
||
}
|
||
note := fmt.Sprintf("legacy route=%s method=%s path=%s ua=%s", route, c.Request.Method, c.Request.URL.Path, c.Request.UserAgent())
|
||
s.writeAuditResult(uid, "legacy.route.access", "route", route, "", "", note, "success")
|
||
}
|
||
|
||
func (s *WebServer) markLegacyDeprecated(c *gin.Context, replacement string) {
|
||
c.Header("X-API-Deprecated", "true")
|
||
c.Header("X-API-Replacement", replacement)
|
||
c.Header("Warning", fmt.Sprintf(`299 - "legacy API deprecated, use %s"`, replacement))
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyRecords(c *gin.Context) {
|
||
s.writeLegacyAccess(c, "/api/records")
|
||
s.markLegacyDeprecated(c, "/api/v1/records")
|
||
s.handleRecordsV1(c)
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyDelete(c *gin.Context) {
|
||
s.writeLegacyAccess(c, "/delete/:id")
|
||
s.markLegacyDeprecated(c, "/api/v1/records/:id/delete")
|
||
s.handleDeleteV1(c)
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyExport(c *gin.Context) {
|
||
s.writeLegacyAccess(c, "/export")
|
||
s.markLegacyDeprecated(c, "/api/v1/export")
|
||
s.handleExportV1(c)
|
||
}
|
||
|
||
func (s *WebServer) RegisterRoutes(r *gin.Engine) {
|
||
r.LoadHTMLGlob("templates/*")
|
||
|
||
r.GET("/login", s.handleLoginPage)
|
||
r.POST("/login", s.handleLogin)
|
||
r.GET("/logout", s.handleLogout)
|
||
r.GET("/health", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"status": "ok"}) })
|
||
|
||
auth := r.Group("/")
|
||
auth.Use(s.authRequired())
|
||
{
|
||
auth.GET("/", s.handleIndex)
|
||
auth.GET("/channels", s.handleChannelsPage)
|
||
auth.GET("/audit", s.handleAuditPage)
|
||
auth.GET("/ops", s.handleOpsPage)
|
||
auth.GET("/cpa", s.handleCPASettingsPage)
|
||
auth.GET("/cf", s.handleCFSettingsPage)
|
||
// AI 配置页临时隐藏（保留后端接口）
|
||
|
||
s.registerAPIV1Routes(auth)
|
||
s.registerLegacyCompatRoutes(auth)
|
||
}
|
||
}
|
||
|
||
func (s *WebServer) Start() {
|
||
gin.SetMode(gin.ReleaseMode)
|
||
r := gin.New()
|
||
r.Use(gin.Recovery())
|
||
r.Use(gin.Logger())
|
||
s.RegisterRoutes(r)
|
||
|
||
logAddr := fmt.Sprintf(":%d", s.port)
|
||
fmt.Printf("🌐 Web后台运行在 http://127.0.0.1%s\n", logAddr)
|
||
if err := r.Run(logAddr); err != nil {
|
||
fmt.Printf("❌ Web服务启动失败: %v\n", err)
|
||
}
|
||
}
|
||
|
||
func (s *WebServer) handleLoginPage(c *gin.Context) {
|
||
username, _ := c.Cookie(cookieUserNew)
|
||
token, _ := c.Cookie(cookieTokenNew)
|
||
if username == "" || token == "" {
|
||
username, _ = c.Cookie(cookieUserOld)
|
||
token, _ = c.Cookie(cookieTokenOld)
|
||
}
|
||
if username != "" && token != "" && s.validateToken(username, token) {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "login.html", nil, gin.H{"error": ""})
|
||
}
|
||
|
||
func (s *WebServer) handleLogin(c *gin.Context) {
|
||
username := c.PostForm("username")
|
||
password := c.PostForm("password")
|
||
|
||
if username == s.username && password == s.password {
|
||
token := s.generateToken(username)
|
||
maxAge := 7 * 24 * 3600
|
||
c.SetCookie(cookieUserNew, username, maxAge, "/", "", false, true)
|
||
c.SetCookie(cookieTokenNew, token, maxAge, "/", "", false, true)
|
||
c.SetCookie(cookieUserOld, "", -1, "/", "", false, true)
|
||
c.SetCookie(cookieTokenOld, "", -1, "/", "", false, true)
|
||
u := s.buildCurrentUser(username)
|
||
s.writeAuditResult(u.UserID, "auth.login.success", "user", username, "", "", "", "success")
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
|
||
s.writeAuditResult(0, "auth.login.failed", "user", username, "", "", "用户名或密码错误", "failed")
|
||
s.renderPage(c, "login.html", nil, gin.H{"error": "用户名或密码错误"})
|
||
}
|
||
|
||
func (s *WebServer) handleLogout(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u != nil {
|
||
s.writeAuditResult(u.UserID, "auth.logout", "user", u.Username, "", "", "", "success")
|
||
}
|
||
c.SetCookie(cookieUserNew, "", -1, "/", "", false, true)
|
||
c.SetCookie(cookieTokenNew, "", -1, "/", "", false, true)
|
||
c.SetCookie(cookieUserOld, "", -1, "/", "", false, true)
|
||
c.SetCookie(cookieTokenOld, "", -1, "/", "", false, true)
|
||
c.Redirect(http.StatusFound, "/login")
|
||
}
|
||
|
||
func (s *WebServer) handleIndex(c *gin.Context) {
|
||
u := currentUser(c)
|
||
s.renderPage(c, "index.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleChannelsPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "channels.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "channels.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleAuditPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "audit.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "audit.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleOpsPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "ops.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "ops.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleCPASettingsPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "settings.flags.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "cpa_settings.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleCFSettingsPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "settings.flags.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "cf_settings.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleAISettingsPage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil || !s.hasPermission(u, "settings.flags.read") {
|
||
c.Redirect(http.StatusFound, "/")
|
||
return
|
||
}
|
||
s.renderPage(c, "ai_settings.html", u, nil)
|
||
}
|
||
|
||
func (s *WebServer) handleCPASettingsGet(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
keys := []string{"cpa_management_token", "cpa_management_base"}
|
||
out := map[string]string{}
|
||
for _, k := range keys {
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", k).First(&sset).Error; err == nil {
|
||
out[k] = sset.Value
|
||
} else {
|
||
out[k] = ""
|
||
}
|
||
}
|
||
// do not expose secret token
|
||
if v := strings.TrimSpace(out["cpa_management_token"]); v != "" {
|
||
out["cpa_management_token"] = "***"
|
||
}
|
||
respondOK(c, "ok", gin.H{"settings": out})
|
||
}
|
||
|
||
func (s *WebServer) handleCPASettingsPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
var req cpaSettingsReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
// management_token
|
||
key := "cpa_management_token"
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&sset).Error; err != nil {
|
||
sset = models.AppSetting{Key: key, Value: req.ManagementToken, UpdatedBy: u.UserID}
|
||
if err := s.db.Create(&sset).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
} else {
|
||
old := sset.Value
|
||
sset.Value = req.ManagementToken
|
||
sset.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&sset).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
_ = s.db.Create(&models.FeatureFlagHistory{FlagKey: key, OldValue: old != "", NewValue: req.ManagementToken != "", ChangedBy: u.UserID, Reason: "cpa_settings_update", RequestID: c.GetHeader("X-Request-ID")}).Error
|
||
}
|
||
|
||
// management_base
|
||
key = "cpa_management_base"
|
||
var ssetBase models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&ssetBase).Error; err != nil {
|
||
ssetBase = models.AppSetting{Key: key, Value: req.ManagementBase, UpdatedBy: u.UserID}
|
||
if err := s.db.Create(&ssetBase).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
} else {
|
||
old := ssetBase.Value
|
||
ssetBase.Value = req.ManagementBase
|
||
ssetBase.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&ssetBase).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
_ = s.db.Create(&models.FeatureFlagHistory{FlagKey: key, OldValue: old != "", NewValue: req.ManagementBase != "", ChangedBy: u.UserID, Reason: "cpa_settings_update", RequestID: c.GetHeader("X-Request-ID")}).Error
|
||
}
|
||
|
||
s.writeAuditResult(u.UserID, "cpa.settings.update", "settings", "cpa_management", "", "", "", "success")
|
||
respondOK(c, "success", gin.H{"keys": []string{"cpa_management_token", "cpa_management_base"}})
|
||
}
|
||
|
||
func (s *WebServer) handleCFSettingsGet(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
keys := []string{"cf_account_id", "cf_api_email", "cf_api_token"}
|
||
out := map[string]string{}
|
||
for _, k := range keys {
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", k).First(&sset).Error; err == nil {
|
||
out[k] = sset.Value
|
||
} else {
|
||
out[k] = ""
|
||
}
|
||
}
|
||
respondOK(c, "ok", gin.H{"settings": out})
|
||
}
|
||
|
||
func (s *WebServer) handleCFSettingsPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
var req cfSettingsReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
// account id
|
||
if req.AccountID != "" {
|
||
key := "cf_account_id"
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&sset).Error; err != nil {
|
||
sset = models.AppSetting{Key: key, Value: req.AccountID, UpdatedBy: u.UserID}
|
||
_ = s.db.Create(&sset).Error
|
||
} else {
|
||
sset.Value = req.AccountID
|
||
sset.UpdatedBy = u.UserID
|
||
_ = s.db.Save(&sset).Error
|
||
}
|
||
}
|
||
// api email
|
||
if req.APIEmail != "" {
|
||
key := "cf_api_email"
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&sset).Error; err != nil {
|
||
sset = models.AppSetting{Key: key, Value: req.APIEmail, UpdatedBy: u.UserID}
|
||
_ = s.db.Create(&sset).Error
|
||
} else {
|
||
sset.Value = req.APIEmail
|
||
sset.UpdatedBy = u.UserID
|
||
_ = s.db.Save(&sset).Error
|
||
}
|
||
}
|
||
// api token
|
||
if req.APIToken != "" {
|
||
key := "cf_api_token"
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&sset).Error; err != nil {
|
||
sset = models.AppSetting{Key: key, Value: req.APIToken, UpdatedBy: u.UserID}
|
||
_ = s.db.Create(&sset).Error
|
||
} else {
|
||
sset.Value = req.APIToken
|
||
sset.UpdatedBy = u.UserID
|
||
_ = s.db.Save(&sset).Error
|
||
}
|
||
}
|
||
respondOK(c, "success", gin.H{"ok": true})
|
||
}
|
||
|
||
func (s *WebServer) handleAISettingsGet(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
keys := []string{"ai_enabled", "ai_base_url", "ai_api_key", "ai_model", "ai_timeout_seconds"}
|
||
out := map[string]string{}
|
||
for _, k := range keys {
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", k).First(&sset).Error; err == nil {
|
||
out[k] = sset.Value
|
||
} else {
|
||
out[k] = ""
|
||
}
|
||
}
|
||
respondOK(c, "ok", gin.H{"settings": out})
|
||
}
|
||
|
||
func (s *WebServer) handleAISettingsPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
var req aiSettingsReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
setKV := func(key, val string) {
|
||
var sset models.AppSetting
|
||
if err := s.db.Where("key = ?", key).First(&sset).Error; err != nil {
|
||
sset = models.AppSetting{Key: key, Value: val, UpdatedBy: u.UserID}
|
||
_ = s.db.Create(&sset).Error
|
||
return
|
||
}
|
||
sset.Value = val
|
||
sset.UpdatedBy = u.UserID
|
||
_ = s.db.Save(&sset).Error
|
||
}
|
||
if req.Enabled != nil {
|
||
if *req.Enabled {
|
||
setKV("ai_enabled", "true")
|
||
} else {
|
||
setKV("ai_enabled", "false")
|
||
}
|
||
}
|
||
if strings.TrimSpace(req.BaseURL) != "" {
|
||
setKV("ai_base_url", strings.TrimSpace(req.BaseURL))
|
||
}
|
||
if strings.TrimSpace(req.APIKey) != "" {
|
||
setKV("ai_api_key", strings.TrimSpace(req.APIKey))
|
||
}
|
||
if strings.TrimSpace(req.Model) != "" {
|
||
setKV("ai_model", strings.TrimSpace(req.Model))
|
||
}
|
||
if req.TimeoutSeconds > 0 {
|
||
setKV("ai_timeout_seconds", strconv.Itoa(req.TimeoutSeconds))
|
||
}
|
||
s.writeAuditResult(u.UserID, "ai.settings.update", "settings", "ai", "", "", "", "success")
|
||
respondOK(c, "success", gin.H{"ok": true})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsTargetsList(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
var items []models.OpsTarget
|
||
s.db.Order("name asc").Find(&items)
|
||
respondOK(c, "ok", gin.H{"targets": items})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsTargetsCreate(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
var req opsTargetReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
if strings.TrimSpace(req.Name) == "" || strings.TrimSpace(req.Host) == "" || strings.TrimSpace(req.User) == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "name/host/user 不能为空")
|
||
return
|
||
}
|
||
if req.Port == 0 {
|
||
req.Port = 22
|
||
}
|
||
if err := validateTargetFields(req.Host, req.User, req.Port); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, err.Error())
|
||
return
|
||
}
|
||
item := models.OpsTarget{Name: strings.TrimSpace(req.Name), Host: strings.TrimSpace(req.Host), Port: req.Port, User: strings.TrimSpace(req.User), Enabled: req.Enabled}
|
||
if err := s.db.Create(&item).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "创建失败")
|
||
return
|
||
}
|
||
s.writeAuditResult(u.UserID, "ops_target.create", "ops_target", item.Name, "", "", "", "success")
|
||
respondOK(c, "success", gin.H{"target": item})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsTargetsPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
id, _ := strconv.Atoi(strings.TrimSpace(c.Param("id")))
|
||
if id <= 0 {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "id 无效")
|
||
return
|
||
}
|
||
var req opsTargetReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
var item models.OpsTarget
|
||
if err := s.db.First(&item, id).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "目标不存在")
|
||
return
|
||
}
|
||
if strings.TrimSpace(req.Name) != "" {
|
||
item.Name = strings.TrimSpace(req.Name)
|
||
}
|
||
if strings.TrimSpace(req.Host) != "" {
|
||
item.Host = strings.TrimSpace(req.Host)
|
||
}
|
||
if strings.TrimSpace(req.User) != "" {
|
||
item.User = strings.TrimSpace(req.User)
|
||
}
|
||
if req.Port != 0 {
|
||
item.Port = req.Port
|
||
}
|
||
item.Enabled = req.Enabled
|
||
if err := validateTargetFields(item.Host, item.User, item.Port); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, err.Error())
|
||
return
|
||
}
|
||
if err := s.db.Save(&item).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "更新失败")
|
||
return
|
||
}
|
||
s.writeAuditResult(u.UserID, "ops_target.update", "ops_target", item.Name, "", "", "", "success")
|
||
respondOK(c, "success", gin.H{"target": item})
|
||
}
|
||
|
||
func (s *WebServer) handleMe(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if u == nil {
|
||
respondErr(c, http.StatusUnauthorized, ecode.ErrPermissionDenied, "未登录")
|
||
return
|
||
}
|
||
|
||
flags := s.getFlagMap()
|
||
caps := map[string]bool{
|
||
"can_read_self": s.hasPermission(u, "records.read.self"),
|
||
"can_read_all": s.hasPermission(u, "records.read.all") && flags["allow_cross_user_read"],
|
||
"can_delete_self": s.hasPermission(u, "records.delete.self"),
|
||
"can_delete_all": s.hasPermission(u, "records.delete.all") && flags["allow_cross_user_delete"],
|
||
"can_export_self": s.hasPermission(u, "records.export.self"),
|
||
"can_export_all": s.hasPermission(u, "records.export.all") && flags["allow_export_all_users"],
|
||
"can_view_flags": s.hasPermission(u, "settings.flags.read"),
|
||
"can_edit_flags": s.hasPermission(u, "settings.flags.write"),
|
||
"can_view_channels": s.hasPermission(u, "channels.read"),
|
||
"can_edit_channels": s.hasPermission(u, "channels.write"),
|
||
"can_test_channels": s.hasPermission(u, "channels.test"),
|
||
"can_view_audit": s.hasPermission(u, "audit.read"),
|
||
"can_view_ops": s.hasPermission(u, "ops.read"),
|
||
"can_cancel_ops": s.hasPermission(u, "ops.cancel"),
|
||
"can_retry_ops": s.hasPermission(u, "ops.retry"),
|
||
}
|
||
|
||
u.Flags = flags
|
||
u.Caps = caps
|
||
respondOK(c, "ok", u)
|
||
}
|
||
|
||
func (s *WebServer) handleRecordsV1(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.hasPermission(u, "records.read.self") {
|
||
s.writeAuditResult(u.UserID, "record.list.self", "transaction", "*", "", "", "无 records.read.self 权限", "denied")
|
||
deny(c, "无 records.read.self 权限")
|
||
return
|
||
}
|
||
|
||
scope := c.DefaultQuery("scope", "self")
|
||
q := s.db.Model(&models.Transaction{}).Where("is_deleted = ?", false)
|
||
action := "record.list.self"
|
||
note := ""
|
||
|
||
if scope == "all" {
|
||
action = "record.list.all"
|
||
if !s.hasPermission(u, "records.read.all") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", "无 records.read.all 权限", "denied")
|
||
deny(c, "无 records.read.all 权限")
|
||
return
|
||
}
|
||
if !s.flagEnabled("allow_cross_user_read") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", "策略开关 allow_cross_user_read 未开启", "denied")
|
||
deny(c, "策略开关 allow_cross_user_read 未开启")
|
||
return
|
||
}
|
||
} else {
|
||
q = q.Where("user_id = ?", u.UserID)
|
||
}
|
||
|
||
var items []models.Transaction
|
||
q.Order("id desc").Limit(100).Find(&items)
|
||
|
||
type txResponse struct {
|
||
ID uint `json:"id"`
|
||
UserID int64 `json:"user_id"`
|
||
Amount float64 `json:"amount"`
|
||
Category string `json:"category"`
|
||
Note string `json:"note"`
|
||
Date string `json:"date"`
|
||
}
|
||
|
||
resp := make([]txResponse, len(items))
|
||
for i, item := range items {
|
||
resp[i] = txResponse{ID: item.ID, UserID: item.UserID, Amount: item.AmountYuan(), Category: item.Category, Note: item.Note, Date: item.Date}
|
||
}
|
||
note = fmt.Sprintf("scope=%s,count=%d", scope, len(resp))
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", note, "success")
|
||
respondOK(c, "ok", gin.H{"records": resp})
|
||
}
|
||
|
||
func (s *WebServer) handleDeleteV1(c *gin.Context) {
|
||
u := currentUser(c)
|
||
idStr := c.Param("id")
|
||
id, err := strconv.ParseUint(idStr, 10, 64)
|
||
if err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "无效的ID")
|
||
return
|
||
}
|
||
|
||
var tx models.Transaction
|
||
if err := s.db.Where("id = ? AND is_deleted = ?", id, false).First(&tx).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "记录不存在或已删除")
|
||
return
|
||
}
|
||
|
||
action := "record.delete.self"
|
||
if tx.UserID == u.UserID {
|
||
if !s.hasPermission(u, "records.delete.self") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", fmt.Sprintf("%d", id), "", "", "无 records.delete.self 权限", "denied")
|
||
deny(c, "无 records.delete.self 权限")
|
||
return
|
||
}
|
||
} else {
|
||
action = "record.delete.all"
|
||
if !s.hasPermission(u, "records.delete.all") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", fmt.Sprintf("%d", id), "", "", "无 records.delete.all 权限", "denied")
|
||
deny(c, "无 records.delete.all 权限")
|
||
return
|
||
}
|
||
if !s.flagEnabled("allow_cross_user_delete") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", fmt.Sprintf("%d", id), "", "", "策略开关 allow_cross_user_delete 未开启", "denied")
|
||
deny(c, "策略开关 allow_cross_user_delete 未开启")
|
||
return
|
||
}
|
||
}
|
||
|
||
result := s.db.Model(&models.Transaction{}).Where("id = ? AND is_deleted = ?", id, false).Update("is_deleted", true)
|
||
if result.Error != nil {
|
||
s.writeAuditResult(u.UserID, action, "transaction", fmt.Sprintf("%d", id), "", "", result.Error.Error(), "failed")
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "删除失败")
|
||
return
|
||
}
|
||
s.writeAuditResult(u.UserID, action, "transaction", fmt.Sprintf("%d", id), "", `{"is_deleted":true}`, "", "success")
|
||
respondOK(c, "success", gin.H{"id": id})
|
||
}
|
||
|
||
func (s *WebServer) handleExportV1(c *gin.Context) {
|
||
u := currentUser(c)
|
||
scope := c.DefaultQuery("scope", "self")
|
||
action := "record.export.self"
|
||
|
||
q := s.db.Model(&models.Transaction{}).Where("is_deleted = ?", false)
|
||
if scope == "all" {
|
||
action = "record.export.all"
|
||
if !s.hasPermission(u, "records.export.all") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", "无 records.export.all 权限", "denied")
|
||
deny(c, "无 records.export.all 权限")
|
||
return
|
||
}
|
||
if !s.flagEnabled("allow_export_all_users") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", "策略开关 allow_export_all_users 未开启", "denied")
|
||
deny(c, "策略开关 allow_export_all_users 未开启")
|
||
return
|
||
}
|
||
} else {
|
||
if !s.hasPermission(u, "records.export.self") {
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", "无 records.export.self 权限", "denied")
|
||
deny(c, "无 records.export.self 权限")
|
||
return
|
||
}
|
||
q = q.Where("user_id = ?", u.UserID)
|
||
}
|
||
|
||
var items []models.Transaction
|
||
q.Order("date asc, id asc").Find(&items)
|
||
|
||
now := time.Now().Format("20060102")
|
||
filename := fmt.Sprintf("ops_assistant_%s.csv", now)
|
||
c.Header("Content-Type", "text/csv; charset=utf-8")
|
||
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%s", filename))
|
||
|
||
c.Writer.Write([]byte{0xEF, 0xBB, 0xBF})
|
||
c.Writer.WriteString("ID,用户ID,日期,分类,金额(元),备注\n")
|
||
for _, item := range items {
|
||
line := fmt.Sprintf("%d,%d,%s,%s,%.2f,\"%s\"\n", item.ID, item.UserID, item.Date, item.Category, item.AmountYuan(), item.Note)
|
||
c.Writer.WriteString(line)
|
||
}
|
||
s.writeAuditResult(u.UserID, action, "transaction", "*", "", "", fmt.Sprintf("scope=%s,count=%d", scope, len(items)), "success")
|
||
}
|
||
|
||
func (s *WebServer) handleFlagsList(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
var flags []models.FeatureFlag
|
||
s.db.Order("key asc").Find(&flags)
|
||
respondOK(c, "ok", gin.H{"flags": flags})
|
||
}
|
||
|
||
func (s *WebServer) handleFlagPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.hasPermission(u, "settings.flags.write") {
|
||
s.writeAuditResult(u.UserID, "settings.flag.update", "feature_flag", c.Param("key"), "", "", "无 settings.flags.write 权限", "denied")
|
||
deny(c, "无 settings.flags.write 权限")
|
||
return
|
||
}
|
||
|
||
key := c.Param("key")
|
||
var req flagPatchReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", key).First(&ff).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "开关不存在")
|
||
return
|
||
}
|
||
if ff.RequireReason && strings.TrimSpace(req.Reason) == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "该开关修改必须提供 reason")
|
||
return
|
||
}
|
||
|
||
before := fmt.Sprintf(`{"enabled":%v}`, ff.Enabled)
|
||
old := ff.Enabled
|
||
ff.Enabled = req.Enabled
|
||
ff.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&ff).Error; err != nil {
|
||
s.writeAuditResult(u.UserID, "settings.flag.update", "feature_flag", key, before, "", err.Error(), "failed")
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "更新失败")
|
||
return
|
||
}
|
||
|
||
after := fmt.Sprintf(`{"enabled":%v}`, ff.Enabled)
|
||
h := models.FeatureFlagHistory{FlagKey: key, OldValue: old, NewValue: req.Enabled, ChangedBy: u.UserID, Reason: req.Reason, RequestID: c.GetHeader("X-Request-ID")}
|
||
_ = s.db.Create(&h).Error
|
||
s.writeAuditResult(u.UserID, "settings.flag.update", "feature_flag", key, before, after, req.Reason, "success")
|
||
|
||
respondOK(c, "success", gin.H{"key": key, "old": old, "new": req.Enabled})
|
||
}
|
||
|
||
func sanitizeJSON(raw string) string {
|
||
if strings.TrimSpace(raw) == "" {
|
||
return "{}"
|
||
}
|
||
var m map[string]any
|
||
if err := json.Unmarshal([]byte(raw), &m); err != nil {
|
||
return "{}"
|
||
}
|
||
for k := range m {
|
||
lk := strings.ToLower(k)
|
||
if strings.Contains(lk, "token") || strings.Contains(lk, "secret") || strings.Contains(lk, "key") || strings.Contains(lk, "password") {
|
||
m[k] = "***"
|
||
}
|
||
}
|
||
b, _ := json.Marshal(m)
|
||
return string(b)
|
||
}
|
||
|
||
func isMaskedSecretsPayload(raw json.RawMessage) bool {
|
||
if len(raw) == 0 {
|
||
return false
|
||
}
|
||
var v any
|
||
if err := json.Unmarshal(raw, &v); err != nil {
|
||
return false
|
||
}
|
||
var walk func(any) bool
|
||
walk = func(x any) bool {
|
||
switch t := x.(type) {
|
||
case map[string]any:
|
||
if len(t) == 0 {
|
||
return false
|
||
}
|
||
allMasked := true
|
||
for _, vv := range t {
|
||
if !walk(vv) {
|
||
allMasked = false
|
||
break
|
||
}
|
||
}
|
||
return allMasked
|
||
case []any:
|
||
if len(t) == 0 {
|
||
return false
|
||
}
|
||
for _, vv := range t {
|
||
if !walk(vv) {
|
||
return false
|
||
}
|
||
}
|
||
return true
|
||
case string:
|
||
return strings.TrimSpace(t) == "***"
|
||
default:
|
||
return false
|
||
}
|
||
}
|
||
return walk(v)
|
||
}
|
||
|
||
func (s *WebServer) handleChannelsList(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.read", "无 channels.read 权限") {
|
||
return
|
||
}
|
||
|
||
var items []models.ChannelConfig
|
||
s.db.Order("platform asc").Find(&items)
|
||
|
||
type out struct {
|
||
ID uint `json:"id"`
|
||
Platform string `json:"platform"`
|
||
Name string `json:"name"`
|
||
Enabled bool `json:"enabled"`
|
||
Status string `json:"status"`
|
||
ConfigJSON string `json:"config_json"`
|
||
DraftConfigJSON string `json:"draft_config_json"`
|
||
Secrets string `json:"secrets"`
|
||
DraftSecrets string `json:"draft_secrets"`
|
||
HasDraft bool `json:"has_draft"`
|
||
PublishedAt *time.Time `json:"published_at"`
|
||
LastCheck *time.Time `json:"last_check_at"`
|
||
UpdatedAt time.Time `json:"updated_at"`
|
||
}
|
||
|
||
resp := make([]out, 0, len(items))
|
||
for _, it := range items {
|
||
sec := channel.MaybeDecryptPublic(it.SecretJSON)
|
||
draftSec := channel.MaybeDecryptPublic(it.DraftSecretJSON)
|
||
resp = append(resp, out{
|
||
ID: it.ID,
|
||
Platform: it.Platform,
|
||
Name: it.Name,
|
||
Enabled: it.Enabled,
|
||
Status: it.Status,
|
||
ConfigJSON: it.ConfigJSON,
|
||
DraftConfigJSON: it.DraftConfigJSON,
|
||
Secrets: sanitizeJSON(sec),
|
||
DraftSecrets: sanitizeJSON(draftSec),
|
||
HasDraft: strings.TrimSpace(it.DraftConfigJSON) != "" || strings.TrimSpace(it.DraftSecretJSON) != "",
|
||
PublishedAt: it.PublishedAt,
|
||
LastCheck: it.LastCheck,
|
||
UpdatedAt: it.UpdatedAt,
|
||
})
|
||
}
|
||
respondOK(c, "ok", gin.H{"channels": resp})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelPatch(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
platform := c.Param("platform")
|
||
var req channelConfigPatchReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
|
||
var row models.ChannelConfig
|
||
if err := s.db.Where("platform = ?", platform).First(&row).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "渠道不存在")
|
||
return
|
||
}
|
||
|
||
before := fmt.Sprintf(`{"draft_config":%s,"draft_secrets":%s}`,
|
||
sanitizeJSON(row.DraftConfigJSON), sanitizeJSON(channel.MaybeDecryptPublic(row.DraftSecretJSON)))
|
||
|
||
if req.Name != nil {
|
||
row.Name = strings.TrimSpace(*req.Name)
|
||
}
|
||
if req.Enabled != nil {
|
||
row.Enabled = *req.Enabled
|
||
}
|
||
if len(req.Config) > 0 {
|
||
row.DraftConfigJSON = string(req.Config)
|
||
}
|
||
if len(req.Secrets) > 0 {
|
||
if isMaskedSecretsPayload(req.Secrets) {
|
||
// 前端脱敏占位符（***）不应覆盖真实密钥
|
||
} else {
|
||
row.DraftSecretJSON = channel.EncryptSecretJSON(string(req.Secrets))
|
||
}
|
||
}
|
||
|
||
if err := s.db.Save(&row).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
|
||
after := fmt.Sprintf(`{"draft_config":%s,"draft_secrets":%s}`,
|
||
sanitizeJSON(row.DraftConfigJSON), sanitizeJSON(channel.MaybeDecryptPublic(row.DraftSecretJSON)))
|
||
s.writeAudit(u.UserID, "channel_draft_update", "channel", row.Platform, before, after, "")
|
||
|
||
respondOK(c, "success", gin.H{"mode": "draft"})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelPublish(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
platform := c.Param("platform")
|
||
var row models.ChannelConfig
|
||
if err := s.db.Where("platform = ?", platform).First(&row).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "渠道不存在")
|
||
return
|
||
}
|
||
|
||
before := fmt.Sprintf(`{"config":%s,"secrets":%s}`,
|
||
sanitizeJSON(row.ConfigJSON), sanitizeJSON(channel.MaybeDecryptPublic(row.SecretJSON)))
|
||
|
||
if strings.TrimSpace(row.DraftConfigJSON) != "" {
|
||
row.ConfigJSON = row.DraftConfigJSON
|
||
}
|
||
if strings.TrimSpace(row.DraftSecretJSON) != "" {
|
||
row.SecretJSON = row.DraftSecretJSON
|
||
}
|
||
now := time.Now()
|
||
row.PublishedAt = &now
|
||
row.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&row).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "发布失败")
|
||
return
|
||
}
|
||
|
||
after := fmt.Sprintf(`{"config":%s,"secrets":%s}`,
|
||
sanitizeJSON(row.ConfigJSON), sanitizeJSON(channel.MaybeDecryptPublic(row.SecretJSON)))
|
||
s.writeAudit(u.UserID, "channel_publish", "channel", row.Platform, before, after, "")
|
||
|
||
respondOK(c, "success", gin.H{"published_at": now})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelReload(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
if s.reloadFn == nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "reload 未配置")
|
||
return
|
||
}
|
||
|
||
detail, err := s.reloadFn()
|
||
if err != nil {
|
||
s.writeAudit(u.UserID, "channel_reload", "system", "runtime", "", "", "failed: "+err.Error())
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, err.Error())
|
||
return
|
||
}
|
||
s.writeAudit(u.UserID, "channel_reload", "system", "runtime", "", "", detail)
|
||
respondOK(c, "success", gin.H{"detail": detail})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelEnable(c *gin.Context) {
|
||
s.handleChannelToggle(c, true)
|
||
}
|
||
|
||
func (s *WebServer) handleChannelDisable(c *gin.Context) {
|
||
s.handleChannelToggle(c, false)
|
||
}
|
||
|
||
func (s *WebServer) handleChannelDisableAll(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
res := s.db.Model(&models.ChannelConfig{}).Where("enabled = ?", true).Updates(map[string]any{
|
||
"enabled": false,
|
||
"status": "disabled",
|
||
"updated_by": u.UserID,
|
||
})
|
||
if res.Error != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "批量关闭失败")
|
||
return
|
||
}
|
||
s.writeAudit(u.UserID, "channel_disable_all", "channel", "*", "", fmt.Sprintf(`{"affected":%d}`, res.RowsAffected), "")
|
||
respondOK(c, "success", gin.H{"affected": res.RowsAffected})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelToggle(c *gin.Context, enable bool) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
platform := c.Param("platform")
|
||
var row models.ChannelConfig
|
||
if err := s.db.Where("platform = ?", platform).First(&row).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "渠道不存在")
|
||
return
|
||
}
|
||
|
||
before := fmt.Sprintf(`{"enabled":%v}`, row.Enabled)
|
||
row.Enabled = enable
|
||
if !enable {
|
||
row.Status = "disabled"
|
||
}
|
||
row.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&row).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存失败")
|
||
return
|
||
}
|
||
after := fmt.Sprintf(`{"enabled":%v}`, row.Enabled)
|
||
action := "channel_disable"
|
||
if enable {
|
||
action = "channel_enable"
|
||
}
|
||
s.writeAudit(u.UserID, action, "channel", row.Platform, before, after, "")
|
||
respondOK(c, "success", gin.H{"enabled": row.Enabled, "platform": row.Platform})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelTest(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.test", "无 channels.test 权限") {
|
||
return
|
||
}
|
||
|
||
platform := c.Param("platform")
|
||
var row models.ChannelConfig
|
||
if err := s.db.Where("platform = ?", platform).First(&row).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "渠道不存在")
|
||
return
|
||
}
|
||
|
||
if strings.TrimSpace(row.DraftConfigJSON) != "" {
|
||
row.ConfigJSON = row.DraftConfigJSON
|
||
}
|
||
if strings.TrimSpace(row.DraftSecretJSON) != "" {
|
||
row.SecretJSON = row.DraftSecretJSON
|
||
}
|
||
|
||
now := time.Now()
|
||
status, detail := channel.TestChannelConnectivity(context.Background(), row)
|
||
row.LastCheck = &now
|
||
row.Status = status
|
||
if err := s.db.Save(&row).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "测试写入失败")
|
||
return
|
||
}
|
||
|
||
s.writeAudit(u.UserID, "channel_test", "channel", row.Platform, "", fmt.Sprintf(`{"status":%q,"detail":%q}`, row.Status, detail), "manual test")
|
||
respondOK(c, "ok", gin.H{"status": row.Status, "detail": detail, "platform": row.Platform, "checked_at": now})
|
||
}
|
||
|
||
func (s *WebServer) handleChannelApply(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "channels.write", "无 channels.write 权限") {
|
||
return
|
||
}
|
||
|
||
platform := c.Param("platform")
|
||
var req channelConfigPatchReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误(stage=patch,committed=false)")
|
||
return
|
||
}
|
||
|
||
var row models.ChannelConfig
|
||
if err := s.db.Where("platform = ?", platform).First(&row).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "渠道不存在(stage=patch,committed=false)")
|
||
return
|
||
}
|
||
|
||
beforeEnabled := row.Enabled
|
||
beforeConfig := row.ConfigJSON
|
||
beforeDraftConfig := row.DraftConfigJSON
|
||
beforeSecret := channel.MaybeDecryptPublic(row.SecretJSON)
|
||
beforeDraftSecret := channel.MaybeDecryptPublic(row.DraftSecretJSON)
|
||
|
||
if req.Name != nil {
|
||
row.Name = strings.TrimSpace(*req.Name)
|
||
}
|
||
if req.Enabled != nil {
|
||
row.Enabled = *req.Enabled
|
||
}
|
||
if len(req.Config) > 0 {
|
||
row.DraftConfigJSON = string(req.Config)
|
||
}
|
||
if len(req.Secrets) > 0 {
|
||
if isMaskedSecretsPayload(req.Secrets) {
|
||
// 前端脱敏占位符（***）不应覆盖真实密钥
|
||
} else {
|
||
row.DraftSecretJSON = channel.EncryptSecretJSON(string(req.Secrets))
|
||
}
|
||
}
|
||
if !row.Enabled {
|
||
row.Status = "disabled"
|
||
}
|
||
if strings.TrimSpace(row.DraftConfigJSON) != "" {
|
||
row.ConfigJSON = row.DraftConfigJSON
|
||
}
|
||
if strings.TrimSpace(row.DraftSecretJSON) != "" {
|
||
row.SecretJSON = row.DraftSecretJSON
|
||
}
|
||
publishAt := time.Now()
|
||
row.PublishedAt = &publishAt
|
||
row.UpdatedBy = u.UserID
|
||
|
||
if err := s.db.Save(&row).Error; err != nil {
|
||
s.writeAudit(u.UserID, "channel_apply", "channel", row.Platform, "", "", "failed stage=publish: "+err.Error())
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "保存并发布失败(stage=publish,committed=false)")
|
||
return
|
||
}
|
||
|
||
before := fmt.Sprintf(`{"enabled":%v,"config":%s,"draft_config":%s,"secrets":%s,"draft_secrets":%s}`,
|
||
beforeEnabled,
|
||
sanitizeJSON(beforeConfig),
|
||
sanitizeJSON(beforeDraftConfig),
|
||
sanitizeJSON(beforeSecret),
|
||
sanitizeJSON(beforeDraftSecret),
|
||
)
|
||
after := fmt.Sprintf(`{"enabled":%v,"config":%s,"draft_config":%s,"secrets":%s,"draft_secrets":%s}`,
|
||
row.Enabled,
|
||
sanitizeJSON(row.ConfigJSON),
|
||
sanitizeJSON(row.DraftConfigJSON),
|
||
sanitizeJSON(channel.MaybeDecryptPublic(row.SecretJSON)),
|
||
sanitizeJSON(channel.MaybeDecryptPublic(row.DraftSecretJSON)),
|
||
)
|
||
|
||
if s.reloadFn == nil {
|
||
s.writeAudit(u.UserID, "channel_apply", "channel", row.Platform, before, after, "failed stage=reload: reload 未配置")
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "reload 未配置(stage=reload,committed=true)")
|
||
return
|
||
}
|
||
detail, err := s.reloadFn()
|
||
if err != nil {
|
||
s.writeAudit(u.UserID, "channel_apply", "channel", row.Platform, before, after, "failed stage=reload: "+err.Error())
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "reload失败(stage=reload,committed=true): "+err.Error())
|
||
return
|
||
}
|
||
|
||
note := fmt.Sprintf("apply(patch+publish+reload) detail=%s", detail)
|
||
s.writeAudit(u.UserID, "channel_apply", "channel", row.Platform, before, after, note)
|
||
|
||
respondOK(c, "success", gin.H{
|
||
"platform": row.Platform,
|
||
"published_at": publishAt,
|
||
"detail": detail,
|
||
})
|
||
}
|
||
|
||
func (s *WebServer) handleAuditList(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "audit.read", "无 audit.read 权限") {
|
||
return
|
||
}
|
||
|
||
action := strings.TrimSpace(c.Query("action"))
|
||
targetType := strings.TrimSpace(c.Query("target_type"))
|
||
result := strings.TrimSpace(c.Query("result"))
|
||
actorID := strings.TrimSpace(c.Query("actor_id"))
|
||
from := strings.TrimSpace(c.Query("from"))
|
||
to := strings.TrimSpace(c.Query("to"))
|
||
limit, _ := strconv.Atoi(c.DefaultQuery("limit", "100"))
|
||
if limit <= 0 || limit > 500 {
|
||
limit = 100
|
||
}
|
||
offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
|
||
if offset < 0 {
|
||
offset = 0
|
||
}
|
||
|
||
q := s.db.Model(&models.AuditLog{})
|
||
if action != "" {
|
||
q = q.Where("action = ?", action)
|
||
}
|
||
if targetType != "" {
|
||
q = q.Where("target_type = ?", targetType)
|
||
}
|
||
if actorID != "" {
|
||
if aid, err := strconv.ParseInt(actorID, 10, 64); err == nil {
|
||
q = q.Where("actor_id = ?", aid)
|
||
}
|
||
}
|
||
if from != "" {
|
||
if t, err := time.Parse(time.RFC3339, from); err == nil {
|
||
q = q.Where("created_at >= ?", t)
|
||
}
|
||
}
|
||
if to != "" {
|
||
if t, err := time.Parse(time.RFC3339, to); err == nil {
|
||
q = q.Where("created_at <= ?", t)
|
||
}
|
||
}
|
||
if result != "" {
|
||
q = q.Where("note LIKE ?", "%result="+result+"%")
|
||
}
|
||
|
||
var logs []models.AuditLog
|
||
if err := q.Order("id desc").Limit(limit).Offset(offset).Find(&logs).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询失败")
|
||
return
|
||
}
|
||
respondOK(c, "ok", gin.H{"logs": logs})
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyUsage(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "audit.read", "无 audit.read 权限") {
|
||
return
|
||
}
|
||
|
||
type row struct {
|
||
Route string `json:"route"`
|
||
Count int64 `json:"count"`
|
||
}
|
||
routes := []string{"/api/records", "/delete/:id", "/export"}
|
||
usage := make([]row, 0, len(routes))
|
||
for _, rt := range routes {
|
||
var cnt int64
|
||
err := s.db.Model(&models.AuditLog{}).
|
||
Where("action = ? AND target_type = ? AND target_id = ?", "legacy.route.access", "route", rt).
|
||
Count(&cnt).Error
|
||
if err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询legacy usage失败")
|
||
return
|
||
}
|
||
usage = append(usage, row{Route: rt, Count: cnt})
|
||
}
|
||
|
||
var recent []models.AuditLog
|
||
if err := s.db.Where("action = ? AND target_type = ?", "legacy.route.access", "route").Order("id desc").Limit(50).Find(&recent).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询legacy recent失败")
|
||
return
|
||
}
|
||
respondOK(c, "ok", gin.H{"summary": usage, "recent": recent})
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyTrend(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "audit.read", "无 audit.read 权限") {
|
||
return
|
||
}
|
||
days, _ := strconv.Atoi(c.DefaultQuery("days", "7"))
|
||
if days <= 0 || days > 90 {
|
||
days = 7
|
||
}
|
||
start := time.Now().AddDate(0, 0, -days+1)
|
||
|
||
type point struct {
|
||
Day string `json:"day"`
|
||
Count int64 `json:"count"`
|
||
}
|
||
type routeTrend struct {
|
||
Route string `json:"route"`
|
||
Points []point `json:"points"`
|
||
}
|
||
routes := []string{"/api/records", "/delete/:id", "/export"}
|
||
trends := make([]routeTrend, 0, len(routes))
|
||
|
||
for _, rt := range routes {
|
||
pts := make([]point, 0, days)
|
||
for i := 0; i < days; i++ {
|
||
dayStart := time.Date(start.Year(), start.Month(), start.Day(), 0, 0, 0, 0, start.Location()).AddDate(0, 0, i)
|
||
dayEnd := dayStart.Add(24 * time.Hour)
|
||
var cnt int64
|
||
err := s.db.Model(&models.AuditLog{}).
|
||
Where("action = ? AND target_type = ? AND target_id = ?", "legacy.route.access", "route", rt).
|
||
Where("created_at >= ? AND created_at < ?", dayStart, dayEnd).
|
||
Count(&cnt).Error
|
||
if err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询legacy trend失败")
|
||
return
|
||
}
|
||
pts = append(pts, point{Day: dayStart.Format("2006-01-02"), Count: cnt})
|
||
}
|
||
trends = append(trends, routeTrend{Route: rt, Points: pts})
|
||
}
|
||
respondOK(c, "ok", gin.H{"days": days, "from": start.Format(time.RFC3339), "trends": trends})
|
||
}
|
||
|
||
func (s *WebServer) handleLegacyReadiness(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "audit.read", "无 audit.read 权限") {
|
||
return
|
||
}
|
||
days, _ := strconv.Atoi(c.DefaultQuery("days", "7"))
|
||
if days <= 0 || days > 90 {
|
||
days = 7
|
||
}
|
||
zeroDays, _ := strconv.Atoi(c.DefaultQuery("zero_days", "3"))
|
||
if zeroDays <= 0 || zeroDays > 30 {
|
||
zeroDays = 3
|
||
}
|
||
|
||
start := time.Now().AddDate(0, 0, -days+1)
|
||
routes := []string{"/api/records", "/delete/:id", "/export"}
|
||
routeTotals := map[string]int64{}
|
||
zeroStreak := map[string]int{}
|
||
windowTotal := int64(0)
|
||
ready := true
|
||
|
||
for _, rt := range routes {
|
||
var total int64
|
||
err := s.db.Model(&models.AuditLog{}).
|
||
Where("action = ? AND target_type = ? AND target_id = ?", "legacy.route.access", "route", rt).
|
||
Where("created_at >= ?", start).
|
||
Count(&total).Error
|
||
if err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询legacy readiness失败")
|
||
return
|
||
}
|
||
routeTotals[rt] = total
|
||
windowTotal += total
|
||
|
||
streak := 0
|
||
for i := days - 1; i >= 0; i-- {
|
||
dayStart := time.Date(start.Year(), start.Month(), start.Day(), 0, 0, 0, 0, start.Location()).AddDate(0, 0, i)
|
||
dayEnd := dayStart.Add(24 * time.Hour)
|
||
var cnt int64
|
||
err := s.db.Model(&models.AuditLog{}).
|
||
Where("action = ? AND target_type = ? AND target_id = ?", "legacy.route.access", "route", rt).
|
||
Where("created_at >= ? AND created_at < ?", dayStart, dayEnd).
|
||
Count(&cnt).Error
|
||
if err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询legacy readiness失败")
|
||
return
|
||
}
|
||
if cnt == 0 {
|
||
streak++
|
||
} else {
|
||
break
|
||
}
|
||
}
|
||
zeroStreak[rt] = streak
|
||
if streak < zeroDays {
|
||
ready = false
|
||
}
|
||
}
|
||
|
||
recommendation := "暂不建议下线 legacy 路由（未满足连续0调用阈值）"
|
||
if ready {
|
||
recommendation = "可考虑下线 legacy 路由（已满足连续0调用阈值）"
|
||
}
|
||
respondOK(c, "ok", gin.H{
|
||
"days": days,
|
||
"zero_days": zeroDays,
|
||
"window_total": windowTotal,
|
||
"route_totals": routeTotals,
|
||
"consecutive_zero_days": zeroStreak,
|
||
"ready": ready,
|
||
"recommendation": recommendation,
|
||
})
|
||
}
|
||
|
||
func (s *WebServer) handleModulesList(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.read", "无 settings.flags.read 权限") {
|
||
return
|
||
}
|
||
type moduleItem struct {
|
||
Module string `json:"module"`
|
||
DisplayName string `json:"display_name"`
|
||
FlagKey string `json:"flag_key"`
|
||
Enabled bool `json:"enabled"`
|
||
}
|
||
items := []moduleItem{
|
||
{Module: "cpa", DisplayName: "CPA 管理", FlagKey: "enable_module_cpa"},
|
||
{Module: "cf", DisplayName: "CF 管理", FlagKey: "enable_module_cf"},
|
||
{Module: "mail", DisplayName: "邮箱管理", FlagKey: "enable_module_mail"},
|
||
}
|
||
for i := range items {
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", items[i].FlagKey).First(&ff).Error; err == nil {
|
||
items[i].Enabled = ff.Enabled
|
||
}
|
||
}
|
||
respondOK(c, "ok", gin.H{"modules": items})
|
||
}
|
||
|
||
func (s *WebServer) handleModuleToggle(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "settings.flags.write", "无 settings.flags.write 权限") {
|
||
return
|
||
}
|
||
module := strings.TrimSpace(strings.ToLower(c.Param("module")))
|
||
flagKey := ""
|
||
switch module {
|
||
case "cpa":
|
||
flagKey = "enable_module_cpa"
|
||
case "cf":
|
||
flagKey = "enable_module_cf"
|
||
case "mail":
|
||
flagKey = "enable_module_mail"
|
||
default:
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "unknown module")
|
||
return
|
||
}
|
||
|
||
var req moduleToggleReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
if strings.TrimSpace(req.Reason) == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "修改模块开关必须提供 reason")
|
||
return
|
||
}
|
||
if module == "cpa" && !req.Enabled {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "禁止禁用关键模块 cpa")
|
||
return
|
||
}
|
||
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", flagKey).First(&ff).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "模块开关不存在")
|
||
return
|
||
}
|
||
old := ff.Enabled
|
||
if old == req.Enabled {
|
||
respondOK(c, "noop", gin.H{"module": module, "flag_key": flagKey, "old": old, "new": req.Enabled})
|
||
return
|
||
}
|
||
ff.Enabled = req.Enabled
|
||
ff.UpdatedBy = u.UserID
|
||
if err := s.db.Save(&ff).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "更新失败")
|
||
return
|
||
}
|
||
_ = s.db.Create(&models.FeatureFlagHistory{FlagKey: flagKey, OldValue: old, NewValue: req.Enabled, ChangedBy: u.UserID, Reason: req.Reason, RequestID: c.GetHeader("X-Request-ID")}).Error
|
||
s.writeAuditResult(u.UserID, "module.toggle", "module", module, fmt.Sprintf(`{"enabled":%v}`, old), fmt.Sprintf(`{"enabled":%v}`, req.Enabled), req.Reason, "success")
|
||
respondOK(c, "success", gin.H{"module": module, "flag_key": flagKey, "old": old, "new": req.Enabled})
|
||
}
|
||
|
||
func (s *WebServer) handleDashboardOverview(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.read", "无 ops.read 权限") {
|
||
return
|
||
}
|
||
|
||
var jobs []models.OpsJob
|
||
s.db.Order("id desc").Limit(30).Find(&jobs)
|
||
statusCount := map[string]int{"pending": 0, "running": 0, "success": 0, "failed": 0, "cancelled": 0}
|
||
for _, j := range jobs {
|
||
statusCount[j.Status]++
|
||
}
|
||
|
||
type moduleItem struct {
|
||
Module string `json:"module"`
|
||
Enabled bool `json:"enabled"`
|
||
}
|
||
mods := []moduleItem{{Module: "cpa"}, {Module: "cf"}, {Module: "mail"}}
|
||
for i := range mods {
|
||
flagKey := "enable_module_" + mods[i].Module
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", flagKey).First(&ff).Error; err == nil {
|
||
mods[i].Enabled = ff.Enabled
|
||
}
|
||
}
|
||
|
||
var channels []models.ChannelConfig
|
||
s.db.Order("platform asc").Find(&channels)
|
||
channelOut := make([]gin.H, 0, len(channels))
|
||
for _, ch := range channels {
|
||
channelOut = append(channelOut, gin.H{"platform": ch.Platform, "enabled": ch.Enabled, "status": ch.Status})
|
||
}
|
||
|
||
respondOK(c, "ok", gin.H{"jobs": gin.H{"recent": jobs, "status_count": statusCount}, "modules": mods, "channels": channelOut})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsJobs(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.read", "无 ops.read 权限") {
|
||
return
|
||
}
|
||
limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
|
||
if limit <= 0 || limit > 200 {
|
||
limit = 50
|
||
}
|
||
status := strings.TrimSpace(c.Query("status"))
|
||
target := strings.TrimSpace(c.Query("target"))
|
||
runbook := strings.TrimSpace(c.Query("runbook"))
|
||
requestID := strings.TrimSpace(c.Query("request_id"))
|
||
operator := strings.TrimSpace(c.Query("operator"))
|
||
riskLevel := strings.TrimSpace(c.Query("risk_level"))
|
||
qtext := strings.TrimSpace(c.Query("q"))
|
||
from := strings.TrimSpace(c.Query("from"))
|
||
to := strings.TrimSpace(c.Query("to"))
|
||
|
||
q := s.db.Model(&models.OpsJob{})
|
||
if status != "" {
|
||
q = q.Where("status = ?", status)
|
||
}
|
||
if target != "" {
|
||
q = q.Where("target = ?", target)
|
||
}
|
||
if runbook != "" {
|
||
q = q.Where("runbook = ?", runbook)
|
||
}
|
||
if requestID != "" {
|
||
q = q.Where("request_id = ?", requestID)
|
||
}
|
||
if operator != "" {
|
||
opid, err := strconv.ParseInt(operator, 10, 64)
|
||
if err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid operator")
|
||
return
|
||
}
|
||
q = q.Where("operator = ?", opid)
|
||
}
|
||
if riskLevel != "" {
|
||
q = q.Where("risk_level = ?", riskLevel)
|
||
}
|
||
if qtext != "" {
|
||
like := "%" + qtext + "%"
|
||
q = q.Where("command LIKE ? OR runbook LIKE ? OR target LIKE ? OR request_id LIKE ?", like, like, like, like)
|
||
}
|
||
if from != "" {
|
||
t, err := time.Parse(time.RFC3339, from)
|
||
if err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid from, must be RFC3339")
|
||
return
|
||
}
|
||
q = q.Where("created_at >= ?", t)
|
||
}
|
||
if to != "" {
|
||
t, err := time.Parse(time.RFC3339, to)
|
||
if err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid to, must be RFC3339")
|
||
return
|
||
}
|
||
q = q.Where("created_at <= ?", t)
|
||
}
|
||
|
||
var jobs []models.OpsJob
|
||
if err := q.Order("id desc").Limit(limit).Find(&jobs).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询ops jobs失败")
|
||
return
|
||
}
|
||
respondOK(c, "ok", gin.H{"jobs": jobs, "filters": gin.H{"limit": limit, "status": status, "target": target, "runbook": runbook, "request_id": requestID, "operator": operator, "risk_level": riskLevel, "q": qtext, "from": from, "to": to}})
|
||
}
|
||
|
||
func (s *WebServer) handleDashboardSummary(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.read", "无 ops.read 权限") {
|
||
return
|
||
}
|
||
|
||
var total, running, failed, success int64
|
||
s.db.Model(&models.OpsJob{}).Count(&total)
|
||
s.db.Model(&models.OpsJob{}).Where("status = ?", "running").Count(&running)
|
||
s.db.Model(&models.OpsJob{}).Where("status = ?", "failed").Count(&failed)
|
||
s.db.Model(&models.OpsJob{}).Where("status = ?", "success").Count(&success)
|
||
|
||
mods := map[string]bool{"cpa": false, "cf": false, "mail": false}
|
||
for k := range mods {
|
||
var ff models.FeatureFlag
|
||
if err := s.db.Where("key = ?", "enable_module_"+k).First(&ff).Error; err == nil {
|
||
mods[k] = ff.Enabled
|
||
}
|
||
}
|
||
|
||
respondOK(c, "ok", gin.H{
|
||
"jobs": gin.H{"total": total, "running": running, "failed": failed, "success": success},
|
||
"modules": mods,
|
||
})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsJobsByRequestID(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.read", "无 ops.read 权限") {
|
||
return
|
||
}
|
||
requestID := strings.TrimSpace(c.Param("requestID"))
|
||
if requestID == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "request id required")
|
||
return
|
||
}
|
||
limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
|
||
if limit <= 0 || limit > 200 {
|
||
limit = 50
|
||
}
|
||
var jobs []models.OpsJob
|
||
if err := s.db.Where("request_id = ?", requestID).Order("id desc").Limit(limit).Find(&jobs).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询ops jobs失败")
|
||
return
|
||
}
|
||
var total int64
|
||
if err := s.db.Model(&models.OpsJob{}).Where("request_id = ?", requestID).Count(&total).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "查询ops jobs总数失败")
|
||
return
|
||
}
|
||
respondOK(c, "ok", gin.H{"request_id": requestID, "total": total, "jobs": jobs})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsJobDetail(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.read", "无 ops.read 权限") {
|
||
return
|
||
}
|
||
id, err := strconv.Atoi(c.Param("id"))
|
||
if err != nil || id <= 0 {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid job id")
|
||
return
|
||
}
|
||
|
||
var job models.OpsJob
|
||
if err := s.db.First(&job, id).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "job not found")
|
||
return
|
||
}
|
||
|
||
var steps []models.OpsJobStep
|
||
if err := s.db.Where("job_id = ?", job.ID).Order("id asc").Find(&steps).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "query steps failed")
|
||
return
|
||
}
|
||
|
||
stepStats := map[string]int{"running": 0, "success": 0, "failed": 0, "skipped": 0}
|
||
var stepDurationMs int64
|
||
for _, st := range steps {
|
||
stepStats[st.Status]++
|
||
if !st.StartedAt.IsZero() && !st.EndedAt.IsZero() {
|
||
d := st.EndedAt.Sub(st.StartedAt).Milliseconds()
|
||
if d > 0 {
|
||
stepDurationMs += d
|
||
}
|
||
}
|
||
}
|
||
var jobDurationMs int64
|
||
if !job.StartedAt.IsZero() && !job.EndedAt.IsZero() {
|
||
d := job.EndedAt.Sub(job.StartedAt).Milliseconds()
|
||
if d > 0 {
|
||
jobDurationMs = d
|
||
}
|
||
}
|
||
respondOK(c, "ok", gin.H{"job": job, "steps": steps, "step_stats": stepStats, "step_total": len(steps), "duration": gin.H{"job_ms": jobDurationMs, "steps_ms_sum": stepDurationMs}})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsJobCancel(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.cancel", "无 ops.cancel 权限") {
|
||
return
|
||
}
|
||
id, err := strconv.Atoi(c.Param("id"))
|
||
if err != nil || id <= 0 {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid job id")
|
||
return
|
||
}
|
||
|
||
var req opsJobActionReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
reason := strings.TrimSpace(req.Reason)
|
||
if reason == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "cancel 必须提供 reason")
|
||
return
|
||
}
|
||
|
||
var job models.OpsJob
|
||
if err := s.db.First(&job, id).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "job not found")
|
||
return
|
||
}
|
||
if job.Status == "success" || job.Status == "failed" || job.Status == "cancelled" {
|
||
respondOK(c, "noop", gin.H{"id": job.ID, "job_status": job.Status, "reason": "job already finished"})
|
||
return
|
||
}
|
||
if job.Status != "pending" && job.Status != "running" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "job status not cancellable")
|
||
return
|
||
}
|
||
cancelled := runbook.CancelJob(job.ID)
|
||
job.Status = "cancelled"
|
||
job.CancelNote = reason
|
||
job.EndedAt = time.Now()
|
||
if err := s.db.Save(&job).Error; err != nil {
|
||
respondErr(c, http.StatusInternalServerError, ecode.ErrStepFailed, "cancel failed")
|
||
return
|
||
}
|
||
s.writeAuditResult(u.UserID, "ops.job.cancel", "ops_job", strconv.Itoa(int(job.ID)), "", "", reason, "success")
|
||
respondOK(c, "cancelled", gin.H{"id": job.ID, "reason": reason, "signal_sent": cancelled})
|
||
}
|
||
|
||
func (s *WebServer) handleOpsJobRetry(c *gin.Context) {
|
||
u := currentUser(c)
|
||
if !s.requirePerm(c, u, "ops.retry", "无 ops.retry 权限") {
|
||
return
|
||
}
|
||
id, err := strconv.Atoi(c.Param("id"))
|
||
if err != nil || id <= 0 {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "invalid job id")
|
||
return
|
||
}
|
||
|
||
var req opsJobActionReq
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "请求体格式错误")
|
||
return
|
||
}
|
||
reason := strings.TrimSpace(req.Reason)
|
||
if reason == "" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "retry 必须提供 reason")
|
||
return
|
||
}
|
||
|
||
var old models.OpsJob
|
||
if err := s.db.First(&old, id).Error; err != nil {
|
||
respondErr(c, http.StatusNotFound, ecode.ErrStepFailed, "job not found")
|
||
return
|
||
}
|
||
if strings.TrimSpace(old.Status) != "failed" {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, "only failed jobs can retry")
|
||
return
|
||
}
|
||
|
||
newID, err := ops.RetryJobWithDB(s.db, filepath.Clean(s.baseDir), uint(id))
|
||
if err != nil {
|
||
respondErr(c, http.StatusBadRequest, ecode.ErrStepFailed, err.Error())
|
||
return
|
||
}
|
||
s.writeAuditResult(u.UserID, "ops.job.retry", "ops_job", strconv.Itoa(id), "", "", reason, "success")
|
||
respondOK(c, "retried", gin.H{"old_job_id": id, "new_job_id": newID, "reason": reason})
|
||
}
|