mrlee
fc16fb2dc2
CI / verify (push) Canceled after 0s
- frps 安装/升级一直 404：frp 官方校验文件名始终是 frp_sha256_checksums.txt（不带版本号），代码却拼 frp_<版本>_sha256sums.txt；现按候选名依次尝试并在失败时列出尝试项。同一条 bug 也存在于本机下载 frpc 的路径，一并修复（SHA-256 校验逻辑未改） - nginx 探测（agent）：nginxPath() 不再回落到配置里的裸名字 nginx（否则「未安装」被误报为配置校验失败，且一键安装入口永不出现）；vhost 目录探测不再要求被加载文件带 .conf 后缀（Debian 的 sites-enabled/default 不带，导致只剩主配置目录可试，报「均无法放置完整 server 配置」），失败信息补上具体原因 - 证书 CA：LiteSSL（亚数 TrustAsia，90 天，支持单域名/通配符/多域名）替换 Buypass。LiteSSL 目录 meta.externalAccountRequired=true，强制 EAB——在 FreeSSL 创建后填 Kid/HMAC 即可，HMAC 只回掩码；Buypass 保留常量与展示元数据但不再可选 - 前端申请证书弹窗的颁发机构卡片改为前端可控清单（原先后端 /api/certs/options 的结果不参与渲染，后端改了弹窗不变） - 测试：internal/frp 校验文件候选名与 sha256sum 解析；internal/acme LiteSSL 目录/别名/通配符/Buypass 停用提示。gofmt / go build / go vet / go test / vue-tsc / vite build 全绿 - AgentVersion 0.12.4 → 0.12.7，双架构二进制已重编：VPS 上需点「升级 Agent」
271 lines
9.2 KiB
Go
271 lines
9.2 KiB
Go
package api
|
||
|
||
import (
|
||
"encoding/json"
|
||
"fmt"
|
||
"net/http"
|
||
"strconv"
|
||
"strings"
|
||
|
||
"github.com/fonu/fonu/internal/notify"
|
||
"github.com/fonu/fonu/internal/service"
|
||
"github.com/fonu/fonu/internal/settings"
|
||
"github.com/fonu/fonu/internal/validate"
|
||
)
|
||
|
||
type SettingsHandler struct {
|
||
store *settings.Store
|
||
proxy *service.ProxyService
|
||
notify *notify.Service
|
||
}
|
||
|
||
func NewSettingsHandler(store *settings.Store, proxySvc *service.ProxyService, notifySvc *notify.Service) *SettingsHandler {
|
||
return &SettingsHandler{store: store, proxy: proxySvc, notify: notifySvc}
|
||
}
|
||
|
||
func (h *SettingsHandler) Get(w http.ResponseWriter, r *http.Request) {
|
||
values, err := h.store.List(r.Context())
|
||
if err != nil {
|
||
writeError(r, w, http.StatusInternalServerError, "读取设置失败", err)
|
||
return
|
||
}
|
||
notify.SanitizeSettings(values)
|
||
// 状态页访问码只回掩码：既不下发明文也不下发哈希
|
||
if values[settings.KeyStatusPageCodeHash] != "" {
|
||
values[settings.KeyStatusPageCode] = MaskedStatusPageCode
|
||
}
|
||
delete(values, settings.KeyStatusPageCodeHash)
|
||
writeJSON(w, http.StatusOK, values)
|
||
}
|
||
|
||
func (h *SettingsHandler) Put(w http.ResponseWriter, r *http.Request) {
|
||
var req map[string]string
|
||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||
writeError(r, w, http.StatusBadRequest, "请求格式无效")
|
||
return
|
||
}
|
||
allowed := map[string]bool{
|
||
settings.KeyTheme: true,
|
||
settings.KeyTimezone: true,
|
||
settings.KeyLogRetentionDays: true,
|
||
settings.KeyDDNSCheckInterval: true,
|
||
settings.KeyCertRenewThreshold: true,
|
||
settings.KeyRootDomain: true,
|
||
settings.KeyACMEEmail: true,
|
||
settings.KeyACMECA: true,
|
||
settings.KeyZeroSSLAPIKey: true,
|
||
settings.KeyACMEDNSResolvers: true,
|
||
settings.KeyLiteSSLEABKid: true,
|
||
settings.KeyLiteSSLEABHMAC: true,
|
||
settings.KeyNotifyWebhookURL: true,
|
||
settings.KeyNotifyType: true,
|
||
settings.KeyNotifyEmailJSON: true,
|
||
settings.KeyNotifySMTPPassword: true,
|
||
settings.KeyNotifyWebhookJSON: true,
|
||
settings.KeyNotifyWebhookSecret: true,
|
||
settings.KeyNotifyTelegramJSON: true,
|
||
settings.KeyNotifyTelegramToken: true,
|
||
settings.KeyNotifyOnDDNSIPChange: true,
|
||
settings.KeyNotifyOnDDNSFailure: true,
|
||
settings.KeyNotifyOnCertExpiry: true,
|
||
settings.KeyNotifyOnCertRenewSuccess: true,
|
||
settings.KeyNotifyOnIPFrequentAccess: true,
|
||
settings.KeyNotifyOnCertRenewFailure: true,
|
||
settings.KeyNotifyOnLoginFailure: true,
|
||
settings.KeyNotifyOnNginxReloadFailure: true,
|
||
settings.KeyNotifyIPFrequentThreshold: true,
|
||
settings.KeyNotifyIPFrequentWindowSec: true,
|
||
settings.KeyNotifyLoginFailureThreshold: true,
|
||
settings.KeyNotifyLoginFailureWindowSec: true,
|
||
settings.KeyNotifyOnResourceThreshold: true,
|
||
settings.KeyNotifyOnTunnelDown: true,
|
||
settings.KeyNotifyCPUThreshold: true,
|
||
settings.KeyNotifyMemoryThreshold: true,
|
||
settings.KeyNotifyDiskThreshold: true,
|
||
settings.KeyNotifyTunnelFailThreshold: true,
|
||
settings.KeyNotifyOnFrpsDown: true,
|
||
settings.KeyNotifyOnAgentUnreachable: true,
|
||
settings.KeyNotifyOnRouteDrift: true,
|
||
settings.KeyNotifyFrpsFailThreshold: true,
|
||
settings.KeyNotifyAgentFailThreshold: true,
|
||
settings.KeyNotifyDriftCooldownHours: true,
|
||
settings.KeyBackupAutoEnabled: true,
|
||
settings.KeyRouteHealthEnabled: true,
|
||
settings.KeyStatusPageEnabled: true,
|
||
settings.KeyMetricsHistoryEnabled: true,
|
||
settings.KeyStatusPageCode: true,
|
||
settings.KeyBackupKeepCount: true,
|
||
settings.KeyNotifyOnBackupFailure: true,
|
||
settings.KeyTrustedProxy: true,
|
||
settings.KeyGlobalIPBlacklist: true,
|
||
settings.KeyGlobalIPWhitelist: true,
|
||
settings.KeyChinaCIDRUpdateHours: true,
|
||
settings.KeyChinaCIDRSourceV4: true,
|
||
settings.KeyChinaCIDRSourceV6: true,
|
||
}
|
||
filtered := map[string]string{}
|
||
for key, value := range req {
|
||
if !allowed[key] {
|
||
continue
|
||
}
|
||
if err := h.validateSetting(key, value); err != nil {
|
||
writeError(r, w, http.StatusBadRequest, err.Error())
|
||
return
|
||
}
|
||
filtered[key] = value
|
||
}
|
||
// 状态页访问码走「掩码往返」：客户端提交明文，这里落 SHA-256；
|
||
// 空串 = 清除访问码，掩码值 = 保持不变。哈希字段不接受客户端直接写入。
|
||
if code, ok := filtered[settings.KeyStatusPageCode]; ok {
|
||
delete(filtered, settings.KeyStatusPageCode)
|
||
trimmed := strings.TrimSpace(code)
|
||
switch {
|
||
case trimmed == MaskedStatusPageCode:
|
||
case trimmed == "":
|
||
filtered[settings.KeyStatusPageCodeHash] = ""
|
||
default:
|
||
filtered[settings.KeyStatusPageCodeHash] = hashStatusPageCode(trimmed)
|
||
}
|
||
}
|
||
if h.notify != nil && h.notify.Store() != nil {
|
||
if in, ok := notify.ParseSaveInputFromMap(filtered); ok {
|
||
if err := h.notify.Store().Save(r.Context(), in); err != nil {
|
||
writeError(r, w, http.StatusBadRequest, err.Error())
|
||
return
|
||
}
|
||
for key := range filtered {
|
||
if isNotifySettingKey(key) {
|
||
delete(filtered, key)
|
||
}
|
||
}
|
||
}
|
||
}
|
||
if err := h.store.SetMany(r.Context(), filtered); err != nil {
|
||
writeError(r, w, http.StatusInternalServerError, "保存设置失败", err)
|
||
return
|
||
}
|
||
if h.proxy != nil && (filtered[settings.KeyTrustedProxy] != "" || filtered[settings.KeyGlobalIPBlacklist] != "" || filtered[settings.KeyGlobalIPWhitelist] != "") {
|
||
if err := h.proxy.ReloadAll(r.Context()); err != nil {
|
||
writeError(r, w, http.StatusInternalServerError, "设置已保存，但 Nginx 重载失败："+err.Error(), err)
|
||
return
|
||
}
|
||
}
|
||
values, err := h.store.List(r.Context())
|
||
if err != nil {
|
||
writeError(r, w, http.StatusInternalServerError, "读取设置失败", err)
|
||
return
|
||
}
|
||
notify.SanitizeSettings(values)
|
||
// 状态页访问码只回掩码：既不下发明文也不下发哈希
|
||
if values[settings.KeyStatusPageCodeHash] != "" {
|
||
values[settings.KeyStatusPageCode] = MaskedStatusPageCode
|
||
}
|
||
delete(values, settings.KeyStatusPageCodeHash)
|
||
writeJSON(w, http.StatusOK, values)
|
||
}
|
||
|
||
func isNotifySettingKey(key string) bool {
|
||
switch key {
|
||
case settings.KeyNotifyType,
|
||
settings.KeyNotifyEmailJSON,
|
||
settings.KeyNotifySMTPPassword,
|
||
settings.KeyNotifyWebhookJSON,
|
||
settings.KeyNotifyWebhookSecret,
|
||
settings.KeyNotifyTelegramJSON,
|
||
settings.KeyNotifyTelegramToken,
|
||
settings.KeyNotifyOnDDNSIPChange,
|
||
settings.KeyNotifyOnDDNSFailure,
|
||
settings.KeyNotifyOnCertExpiry,
|
||
settings.KeyNotifyOnCertRenewSuccess,
|
||
settings.KeyNotifyOnIPFrequentAccess,
|
||
settings.KeyNotifyOnCertRenewFailure,
|
||
settings.KeyNotifyOnLoginFailure,
|
||
settings.KeyNotifyOnNginxReloadFailure,
|
||
settings.KeyNotifyIPFrequentThreshold,
|
||
settings.KeyNotifyIPFrequentWindowSec,
|
||
settings.KeyNotifyLoginFailureThreshold,
|
||
settings.KeyNotifyLoginFailureWindowSec,
|
||
settings.KeyNotifyOnResourceThreshold,
|
||
settings.KeyNotifyOnTunnelDown,
|
||
settings.KeyNotifyCPUThreshold,
|
||
settings.KeyNotifyMemoryThreshold,
|
||
settings.KeyNotifyDiskThreshold,
|
||
settings.KeyNotifyTunnelFailThreshold,
|
||
settings.KeyNotifyOnFrpsDown,
|
||
settings.KeyNotifyOnAgentUnreachable,
|
||
settings.KeyNotifyOnRouteDrift,
|
||
settings.KeyNotifyFrpsFailThreshold,
|
||
settings.KeyNotifyAgentFailThreshold,
|
||
settings.KeyNotifyDriftCooldownHours,
|
||
settings.KeyNotifyOnBackupFailure,
|
||
settings.KeyNotifyWebhookURL:
|
||
return true
|
||
default:
|
||
return false
|
||
}
|
||
}
|
||
|
||
func (h *SettingsHandler) validateSetting(key, value string) error {
|
||
switch key {
|
||
case settings.KeyNotifyEmailJSON, settings.KeyNotifyWebhookJSON, settings.KeyNotifyTelegramJSON:
|
||
if value != "" {
|
||
var raw map[string]any
|
||
if err := json.Unmarshal([]byte(value), &raw); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
case settings.KeyNotifyType:
|
||
switch value {
|
||
case "", "email", "webhook", "telegram":
|
||
default:
|
||
return fmt.Errorf("无效的通知类型")
|
||
}
|
||
case settings.KeyNotifyIPFrequentThreshold:
|
||
if value != "" {
|
||
n, err := strconv.Atoi(value)
|
||
if err != nil || n < 10 || n > 10000 {
|
||
return fmt.Errorf("频繁访问阈值需在 10–10000 之间")
|
||
}
|
||
}
|
||
case settings.KeyNotifyIPFrequentWindowSec, settings.KeyNotifyLoginFailureWindowSec:
|
||
if value != "" {
|
||
n, err := strconv.Atoi(value)
|
||
if err != nil || n < 10 || n > 3600 {
|
||
return fmt.Errorf("统计窗口需在 10–3600 秒之间")
|
||
}
|
||
}
|
||
case settings.KeyBackupKeepCount:
|
||
if value != "" {
|
||
n, err := strconv.Atoi(value)
|
||
if err != nil || n < 1 || n > 60 {
|
||
return fmt.Errorf("备份保留份数需在 1–60 之间")
|
||
}
|
||
}
|
||
case settings.KeyNotifyLoginFailureThreshold:
|
||
if value != "" {
|
||
n, err := strconv.Atoi(value)
|
||
if err != nil || n < 3 || n > 100 {
|
||
return fmt.Errorf("登录失败阈值需在 3–100 之间")
|
||
}
|
||
}
|
||
case settings.KeyGlobalIPBlacklist, settings.KeyGlobalIPWhitelist:
|
||
var list []string
|
||
if value != "" && value != "[]" {
|
||
if err := json.Unmarshal([]byte(value), &list); err != nil {
|
||
return err
|
||
}
|
||
if err := validate.IPOrCIDRList(list); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
case settings.KeyTrustedProxy:
|
||
if value != "" && value != "{}" {
|
||
var raw map[string]any
|
||
if err := json.Unmarshal([]byte(value), &raw); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
}
|
||
return nil
|
||
}
|