mrlee/-Fonu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cloudflare): 应用配置支持程序安装与默认 Token 并发布 v1.6.3
CI / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
mrlee
2026-09-28 16:59:30 +08:00
parent 0d7af99a78
commit 5e995dee28
17 changed files with 363 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/cloudflare_handler.go
+24
View File
@@ -165,6 +165,30 @@ func (h *CloudflareHandler) BinaryInfo(w http.ResponseWriter, r *http.Request) {
})
}
func (h *CloudflareHandler) AppSettings(w http.ResponseWriter, r *http.Request) {
settings, err := h.svc.AppSettings(r.Context())
if err != nil {
writeError(r, w, http.StatusBadGateway, err.Error())
return
}
writeJSON(w, http.StatusOK, settings)
}
func (h *CloudflareHandler) SaveAppSettings(w http.ResponseWriter, r *http.Request) {
var input cloudflared.AppSettingsInput
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&input); err != nil {
writeError(r, w, http.StatusBadRequest, "请求格式无效")
return
}
input.Network = normalizeCloudflareNetwork(input.Network)
settings, err := h.svc.SaveAppSettings(r.Context(), input)
if err != nil {
writeError(r, w, http.StatusBadGateway, err.Error())
return
}
writeJSON(w, http.StatusOK, settings)
}
func (h *CloudflareHandler) DownloadBinary(w http.ResponseWriter, r *http.Request) {
var request struct {
Mirror string `json:"mirror"`
internal/api/router.go
+2
View File
@@ -206,6 +206,8 @@ func newRouterWithSpecs(deps Deps) (http.Handler, []routeSpec) {
protect("GET /api/cloudflare/tunnels/{id}/config", cf.Config)
protect("GET /api/cloudflare/binary", cf.BinaryInfo)
protect("POST /api/cloudflare/binary/download", cf.DownloadBinary)
protect("GET /api/cloudflare/settings", cf.AppSettings)
protect("PUT /api/cloudflare/settings", cf.SaveAppSettings)
protect("GET /api/cloudflare/ingress-candidates", cf.IngressCandidates)
}
internal/cloudflared/model.go
+15
View File
@@ -70,6 +70,21 @@ type CreateInput struct {
AutoStart bool `json:"auto_start"`
}
// AppSettings 是模块级配置；默认 token 只回显掩码，不返回明文。
type AppSettings struct {
DefaultTokenConfigured bool `json:"default_token_configured"`
DefaultTokenMasked string `json:"default_token_masked"`
Mirror string `json:"mirror"`
Network NetworkSettings `json:"network"`
}
// AppSettingsInput 是保存应用配置的入参；Token 留空表示保留原值。
type AppSettingsInput struct {
Token string `json:"token"`
Mirror string `json:"mirror"`
Network NetworkSettings `json:"network"`
}
// RuntimeStatus 是隧道运行状态与指标快照。
type RuntimeStatus struct {
Running bool `json:"running"`
internal/cloudflared/service.go
+87 -5
View File
@@ -72,7 +72,12 @@ func (s *Service) Create(ctx context.Context, in CreateInput) (Tunnel, error) {
if err := validateInput(in); err != nil {
return Tunnel{}, err
}
accountTag, tunnelID, tunnelSecret, err := DecodeToken(in.Token)
in.Network = s.applyDefaultNetwork(ctx, in.Network)
token, err := s.resolveToken(ctx, in.Token)
if err != nil {
return Tunnel{}, err
}
accountTag, tunnelID, tunnelSecret, err := DecodeToken(token)
if err != nil {
return Tunnel{}, err
}
@@ -95,7 +100,7 @@ func (s *Service) Create(ctx context.Context, in CreateInput) (Tunnel, error) {
if err := fsutil.WriteFileAtomic(configPath, []byte(configContent), 0o640); err != nil {
return Tunnel{}, err
}
encrypted, err := s.secretBox.Encrypt(in.Token)
encrypted, err := s.secretBox.Encrypt(token)
if err != nil {
return Tunnel{}, err
}
@@ -109,6 +114,7 @@ func (s *Service) Update(ctx context.Context, id int64, in CreateInput) (Tunnel,
return Tunnel{}, err
}
_ = s.manager.Stop(id)
in.Network = s.applyDefaultNetwork(ctx, in.Network)
accountTag, tunnelID := current.AccountTag, current.TunnelID
encrypted := current.CredentialsEnc
if token := strings.TrimSpace(in.Token); token != "" {
@@ -191,6 +197,85 @@ func (s *Service) RuntimeStatus(ctx context.Context, id int64) (RuntimeStatus, e
return s.manager.Status(id), nil
}
// AppSettings 返回模块级配置；默认 token 只回显掩码。
func (s *Service) AppSettings(ctx context.Context) (AppSettings, error) {
row, err := s.store.GetSettingsRaw(ctx)
if err != nil {
return AppSettings{}, err
}
out := AppSettings{Mirror: row.Mirror, Network: row.Network}
if row.TokenEnc != "" {
out.DefaultTokenConfigured = true
if plain, err := s.secretBox.Decrypt(row.TokenEnc); err == nil {
out.DefaultTokenMasked = MaskSecret(plain)
}
}
return out, nil
}
// SaveAppSettings 保存默认 token、下载镜像与默认网络设置；Token 留空表示保留原值。
func (s *Service) SaveAppSettings(ctx context.Context, in AppSettingsInput) (AppSettings, error) {
row, err := s.store.GetSettingsRaw(ctx)
if err != nil {
return AppSettings{}, err
}
tokenEnc := row.TokenEnc
if token := strings.TrimSpace(in.Token); token != "" {
if _, _, _, err := DecodeToken(token); err != nil {
return AppSettings{}, err
}
tokenEnc, err = s.secretBox.Encrypt(token)
if err != nil {
return AppSettings{}, err
}
}
mirror := strings.TrimSpace(in.Mirror)
if mirror == "" {
mirror = row.Mirror
}
if mirror == "" {
mirror = "official"
}
network := in.Network
if strings.TrimSpace(network.TransportProtocol) == "" {
network = row.Network
}
if err := s.store.SaveSettings(ctx, tokenEnc, mirror, network); err != nil {
return AppSettings{}, err
}
return s.AppSettings(ctx)
}
func (s *Service) applyDefaultNetwork(ctx context.Context, network NetworkSettings) NetworkSettings {
if strings.TrimSpace(network.TransportProtocol) != "" {
return network
}
row, err := s.store.GetSettingsRaw(ctx)
if err != nil {
return DefaultNetworkSettings()
}
return row.Network
}
func (s *Service) resolveToken(ctx context.Context, input string) (string, error) {
token := strings.TrimSpace(input)
if token != "" {
return token, nil
}
row, err := s.store.GetSettingsRaw(ctx)
if err != nil {
return "", err
}
if row.TokenEnc == "" {
return "", fmt.Errorf("请填写 token，或先在「应用配置」中保存默认 token")
}
plain, err := s.secretBox.Decrypt(row.TokenEnc)
if err != nil {
return "", fmt.Errorf("默认 token 解密失败: %w", err)
}
return plain, nil
}
// attachConfig 从 config.yml 回填域名与回源 service，供编辑弹窗使用。
func (s *Service) attachConfig(item *Tunnel) {
data, err := os.ReadFile(item.ConfigPath)
@@ -298,8 +383,5 @@ func validateInput(in CreateInput) error {
default:
return fmt.Errorf("暂不支持该模式，当前仅支持 token-local / token-remote")
}
if strings.TrimSpace(in.Token) == "" {
return fmt.Errorf("token 不能为空")
}
return nil
}
internal/cloudflared/settings_test.go
+52
View File
@@ -0,0 +1,52 @@
package cloudflared
import (
"context"
"encoding/base64"
"io"
"log/slog"
"path/filepath"
"testing"
"github.com/fonu/fonu/internal/config"
"github.com/fonu/fonu/internal/db"
"github.com/fonu/fonu/internal/secret"
)
func TestAppSettingsDefaultToken(t *testing.T) {
dir := t.TempDir()
conn, err := db.Open(filepath.Join(dir, "test.db"))
if err != nil {
t.Fatal(err)
}
defer conn.Close()
if err := db.Migrate(context.Background(), conn, filepath.Join("..", "..", "migrations")); err != nil {
t.Fatal(err)
}
box, err := secret.NewBox("cloudflared-settings-test")
if err != nil {
t.Fatal(err)
}
svc := NewService(config.Config{DataDir: dir}, NewStore(conn), box, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
token := base64.StdEncoding.EncodeToString([]byte(`{"a":"acc-1","t":"tun-1","s":"sec-1"}`))
settings, err := svc.SaveAppSettings(context.Background(), AppSettingsInput{
Token: token, Mirror: "gh-proxy-org", Network: DefaultNetworkSettings(),
})
if err != nil {
t.Fatal(err)
}
if !settings.DefaultTokenConfigured || settings.DefaultTokenMasked == "" {
t.Fatalf("默认 token 应标记为已配置并返回掩码：%#v", settings)
}
tunnel, err := svc.Create(context.Background(), CreateInput{
Name: "demo", Mode: ModeTokenLocal, Hostnames: []string{"a.example.com"}, Network: DefaultNetworkSettings(),
})
if err != nil {
t.Fatalf("应能使用默认 token 创建隧道: %v", err)
}
if tunnel.TunnelID != "tun-1" || tunnel.AccountTag != "acc-1" {
t.Fatalf("默认 token 解析结果不符：%#v", tunnel)
}
}
internal/cloudflared/store.go
+34
View File
@@ -95,6 +95,40 @@ func (s *Store) SetRuntime(ctx context.Context, id int64, status, lastError stri
return err
}
// settingsRow 是应用配置的原始行；TokenEnc 只在 Service 内部解密，不直接回给前端。
type settingsRow struct {
TokenEnc string
Mirror string
Network NetworkSettings
}
func (s *Store) GetSettingsRaw(ctx context.Context) (settingsRow, error) {
var tokenEnc, mirror, networkJSON string
err := s.db.QueryRowContext(ctx, `
SELECT COALESCE(default_token_enc, ''), COALESCE(mirror, 'official'), COALESCE(network_json, '{}')
FROM cf_settings WHERE id = 1
`).Scan(&tokenEnc, &mirror, &networkJSON)
if errors.Is(err, sql.ErrNoRows) {
return settingsRow{Mirror: "official", Network: DefaultNetworkSettings()}, nil
}
if err != nil {
return settingsRow{}, err
}
row := settingsRow{TokenEnc: tokenEnc, Mirror: mirror, Network: DefaultNetworkSettings()}
_ = json.Unmarshal([]byte(networkJSON), &row.Network)
return row, nil
}
func (s *Store) SaveSettings(ctx context.Context, tokenEnc, mirror string, network NetworkSettings) error {
networkJSON, _ := json.Marshal(network)
_, err := s.db.ExecContext(ctx, `
UPDATE cf_settings
SET default_token_enc = ?, mirror = ?, network_json = ?, updated_at = datetime('now')
WHERE id = 1
`, tokenEnc, mirror, string(networkJSON))
return err
}
func scanTunnel(row interface{ Scan(dest ...any) error }) (Tunnel, error) {
var item Tunnel
var networkJSON, created, updated string