From f09c0f6e4b4caff1209c1bd7b84840bf2e29ce09 Mon Sep 17 00:00:00 2001 From: gouki Date: Wed, 23 Sep 2026 10:15:52 +0000 Subject: [PATCH] =?UTF-8?q?fix(review):=20=E5=A4=84=E7=90=86=E5=85=A8?= =?UTF-8?q?=E9=87=8F=E5=AE=A1=E6=9F=A5=E5=89=A9=E4=BD=99=E9=A1=B9=EF=BC=88?= =?UTF-8?q?M4-M8/M11/M12=20+=2021=20=E6=9D=A1=20low=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 后端 - asset_service: delete_asset 先清 subdomains/site_certs 子表（SQLite 不强制 FK 且 assets.id 无 AUTOINCREMENT，删最大 id 后新建会复用 rowid 导致孤儿误挂）； metrics.db 清理改 best-effort，不再让已成功的删除返回 500 - provider_service: slug 唯一约束竞态补 IntegrityError 兜底（与 account_service 一致） - account_service/sync_service: raise HTTPException 补 from e，保留原始异常链 - sync_service: 删死代码 _load_config；新增 BalanceUnsupported，平台无余额接口时 计入 skipped 而不是静默当作失败；到期日写库前归一 - ai: 删掉 OpenAI 早已下线的 billing 余额接口实现，能力探测如实报「不支持」 - adapters/base: _overridden 改走 MRO，中间层基类实现的能力不再被误判为未实现 - core/timeutils: 删死代码 utcnow_iso（注释声称 Z 后缀，实际输出 +00:00） - main: lifespan 退出时 await 被 cancel 的清理任务，避免 pending task 被销毁 - ssl_service: 写 site_certs/subdomains 前校验 asset_id 存在，杜绝悬空引用； 到期阈值贯穿 _judge_status/_apply_probe/check_one/check_all_site_certs - routers/credentials、accounts: 明文密码 GET 补 Cache-Control: no-store - routers/stats: /stats/expiring 的 Query 描述与实际语义对齐（不设下界，含已过期） Agent - collector: 解析 sshd_config 的 Include（含 sshd_config.d/*.conf，按 sshd 语义 「首次出现的值生效」），未显式配置的关键字按编译默认值判定，消除假 pass； 防火墙检测改用 iptables -S 统计 -A 规则行并读 INPUT 策略（-L -n 恒有链头输出） - reporter: 4xx（除 429）不再重试直接退出，429 优先按 Retry-After 退避 安全与部署 - core/security: require_agent_key 改为对外 fail-closed——tailnet/本机放行， 外部来源未配 AGENT_KEY 时一律 401（此前全放行，而服务默认监听 0.0.0.0， 公网上任何人可伪造监控指标与安全检查结果） - main: 启动时把「未配 API_KEY/AGENT_KEY 则外部来源不可用」打进日志 - run.sh: HOST/PORT 可用环境变量覆盖，并说明默认 0.0.0.0 的权衡 - deploy/setup.sh: 新装时自动生成随机 API_KEY/AGENT_KEY 并提示同步到各 VPS； 注册 vps-cert-check.timer - deploy/vps-cert-check.{service,timer}: 新增每日 09:30 的站点证书到期探测 （此前 check_site_certs.py 没有任何 unit，证书提醒不会自动跑） - deploy/update.sh: sync_units 对 timer 用 enable --now（新增 timer 只 restart 不会建开机自启软链），主服务 unit 变更后额外 restart；pip 安装失败不再被吞 - scripts/check_site_certs.py: threshold 参数真正生效并打印 - scripts/make_migration_bundle.py: 缺 assets.db 直接 abort；umask 077 + chmod 600 （包内含 .env 的 MASTER_KEY 与 escrow，不能默认 644 落在 /tmp） - scripts/restore_migration_bundle.py: 校验之外补必备文件预检，缺文件在触碰 目标机状态之前就 abort 前端 - store: 拆分列表口径 assets 与统计口径 allAssets（无筛选时同源，不重复请求）； 删除已无消费者的 expiring/loadExpiring（每次 loadAll 白发一个请求） - dashboard/monitor/providers/subscriptions/modals: 统计与计数改用 allAssets， 资产页的筛选（含统计卡片点击跳转带的筛选）不再让其他视图的数字缩水 - modals: 账号同步后补 loadOverview；settings: 导入后改 loadAll - api: countdownText 支持 unit/empty 选项，monitor/domains 各自的实现改为委托， assets/domains/subscriptions 的到期列不再直出「(-3天)」 - servers: cpu/mem/disk 百分比统一判空，采样缺项不再渲染「null%」 - assets: 同步 AI 余额的结果提示区分 skipped（平台无余额接口）与 failed - modals: 修正凭据库头注释——2FA 动态码是选填 + 可事后补验，与实现一致 测试 - 新增 tests/test_agent_collector.py（8 条）、tests/test_security.py（11 条） - 全量 113 passed；改动 JS 均通过 node --check，deploy 脚本通过 bash -n - 浏览器实测：筛选态下总览/监控中心/平台页/付费资产的统计仍为全量口径， 到期文案与 null 百分比渲染正确，console 零报错 --- .env.example | 6 +- agent/collector.py | 84 +++++++++++++---- agent/reporter.py | 36 +++++-- app/adapters/ai.py | 11 +-- app/adapters/base.py | 9 +- app/core/security.py | 36 +++++-- app/core/timeutils.py | 5 - app/main.py | 22 ++++- app/routers/accounts.py | 8 +- app/routers/credentials.py | 6 +- app/routers/stats.py | 8 +- app/services/account_service.py | 8 +- app/services/asset_service.py | 29 +++++- app/services/provider_service.py | 24 ++++- app/services/ssl_service.py | 31 +++++-- app/services/sync_service.py | 41 ++++---- deploy/setup.sh | 16 +++- deploy/update.sh | 28 +++++- deploy/vps-cert-check.service | 13 +++ deploy/vps-cert-check.timer | 15 +++ run.sh | 10 +- scripts/check_site_certs.py | 6 +- scripts/make_migration_bundle.py | 20 +++- scripts/restore_migration_bundle.py | 14 +++ static/js/api.js | 11 ++- static/js/modals.js | 10 +- static/js/store.js | 25 ++++- static/js/views/assets.js | 9 +- static/js/views/dashboard.js | 5 +- static/js/views/domains.js | 9 +- static/js/views/monitor.js | 13 ++- static/js/views/providers.js | 4 +- static/js/views/servers.js | 12 ++- static/js/views/settings.js | 4 +- static/js/views/subscriptions.js | 6 +- tests/test_agent_collector.py | 139 ++++++++++++++++++++++++++++ tests/test_security.py | 121 ++++++++++++++++++++++++ 37 files changed, 712 insertions(+), 142 deletions(-) create mode 100644 deploy/vps-cert-check.service create mode 100644 deploy/vps-cert-check.timer create mode 100644 tests/test_agent_collector.py create mode 100644 tests/test_security.py diff --git a/.env.example b/.env.example index 5d433f0..fd9bdde 100644 --- a/.env.example +++ b/.env.example @@ -8,7 +8,11 @@ APP_NAME=VPS 资产管理系统 # 外部来源必须携带 X-API-Key: <此密钥>；留空则外部来源一律拒绝（仅内网可用） API_KEY= -# Agent 上报鉴权密钥（可选） +# Agent 上报鉴权密钥 +# 与 API_KEY 同一套可信来源判定：tailnet（100.64.0.0/10）/本机自动放行， +# 外部来源必须携带 X-Agent-Key；留空则外部上报一律 401（防止公网伪造监控数据）。 +# deploy/setup.sh 新建安装时会自动生成随机值；启用后需同步写入各 VPS 的 +# /etc/vps-agent.env（VPS_AGENT_KEY），否则那台机器的 Agent 上报会失败 AGENT_KEY= # 凭证加密主密钥（Fernet，必填以加密 API Key/SSH 凭证） diff --git a/agent/collector.py b/agent/collector.py index 86bea0a..4c2c122 100644 --- a/agent/collector.py +++ b/agent/collector.py @@ -4,6 +4,7 @@ 依赖 psutil + 少量系统命令（ufw/iptables/sshd_config）。 """ +import glob import platform import socket import subprocess @@ -74,25 +75,56 @@ def collect_server_info() -> dict: } -def _check_ssh_config() -> dict: - """检查 SSH 配置（root 登录 / 密码登录）""" - path = "/etc/ssh/sshd_config" - permit_root = "unknown" - password_auth = "unknown" +SSHD_CONFIG = "/etc/ssh/sshd_config" +_SSHD_KEYS = ("permitrootlogin", "passwordauthentication") +# sshd 编译默认值：关键字未显式配置时实际生效的就是这些 +_SSHD_DEFAULTS = {"permitrootlogin": "prohibit-password", "passwordauthentication": "yes"} + + +def _parse_sshd_config(path: str, values: dict, seen: set, depth: int = 0) -> bool: + """按 sshd 语义解析配置：Include 就地展开、同一关键字「首次出现的值生效」 + + 返回是否成功打开该文件。Debian/Ubuntu 云镜像通常把加固项放在 + /etc/ssh/sshd_config.d/*.conf，而主配置顶部就有 Include；只读主文件会漏掉 + 这些值，把已加固的机器误报成 warn，或反过来漏报。 + """ + real = path if path.startswith("/") else f"/etc/ssh/{path}" + if depth > 3 or real in seen: + return False + seen.add(real) try: - with open(path) as f: - for line in f: - low = line.strip().lower() - if low.startswith("permitrootlogin"): - parts = low.split() - permit_root = parts[1] if len(parts) > 1 else "unknown" - elif low.startswith("passwordauthentication"): - parts = low.split() - password_auth = parts[1] if len(parts) > 1 else "unknown" - except Exception: + with open(real) as f: + lines = f.readlines() + except OSError: + return False + for line in lines: + low = line.strip().lower() + if not low or low.startswith("#"): + continue + parts = low.split() + if parts[0] == "include" and len(parts) > 1: + # Include 的相对路径由 sshd 按 /etc/ssh 解析，不能交给 glob 按 CWD 展开 + pattern = parts[1] if parts[1].startswith("/") else f"/etc/ssh/{parts[1]}" + for inc in sorted(glob.glob(pattern)): + _parse_sshd_config(inc, values, seen, depth + 1) + elif parts[0] in _SSHD_KEYS and len(parts) > 1: + values.setdefault(parts[0], parts[1]) # 首次出现生效 + return True + + +def _check_ssh_config() -> dict: + """检查 SSH 配置（root 登录 / 密码登录），含 sshd_config.d 与默认值判定""" + values: dict = {} + if not _parse_sshd_config(SSHD_CONFIG, values, set()): return {"check_item": "ssh_config", "status": "unknown", "detail": "无法读取 sshd_config", "suggestion": None} + permit_root = values.get("permitrootlogin", _SSHD_DEFAULTS["permitrootlogin"]) + password_auth = values.get("passwordauthentication", _SSHD_DEFAULTS["passwordauthentication"]) + # 未显式配置的关键字按 sshd 默认值判定，不能因为「没写」就当作已通过 + # （PasswordAuthentication 默认就是 yes，这类机器实际是开着密码登录的） + implicit = [k for k in _SSHD_KEYS if k not in values] + status = "pass" suggestions = [] if permit_root == "yes": @@ -101,10 +133,13 @@ def _check_ssh_config() -> dict: if password_auth == "yes": status = "warn" suggestions.append("关闭密码登录 PasswordAuthentication no，改用密钥") + detail = f"PermitRootLogin={permit_root}, PasswordAuthentication={password_auth}" + if implicit: + detail += f"（{'/'.join(implicit)} 未显式配置，取 sshd 默认值）" return { "check_item": "ssh_config", "status": status, - "detail": f"PermitRootLogin={permit_root}, PasswordAuthentication={password_auth}", + "detail": detail, "suggestion": "；".join(suggestions) if suggestions else None, } @@ -120,10 +155,21 @@ def _check_firewall() -> dict: "detail": "ufw 未启用", "suggestion": "启用防火墙 ufw enable"} except Exception: try: - out = subprocess.run(["iptables", "-L", "-n"], capture_output=True, text=True, timeout=5) - if out.stdout.strip(): + # 用 -S 而不是 -L：-L 即使零规则也会输出链头（Chain INPUT ... + 表头）， + # 拿 stdout 非空当「有规则」会永远判 pass + out = subprocess.run(["iptables", "-S"], capture_output=True, text=True, timeout=5) + lines = [ln.strip() for ln in out.stdout.splitlines() if ln.strip()] + rules = [ln for ln in lines if ln.startswith("-A")] + policy = next( + (ln.split()[-1] for ln in lines if ln.startswith("-P INPUT")), "ACCEPT" + ) + if rules or policy.upper() == "DROP": return {"check_item": "firewall", "status": "pass", - "detail": "iptables 有规则", "suggestion": None} + "detail": f"iptables {len(rules)} 条规则，INPUT 策略 {policy}", + "suggestion": None} + return {"check_item": "firewall", "status": "warn", + "detail": f"iptables 无过滤规则（INPUT 策略 {policy}）", + "suggestion": "配置防火墙规则，或启用 ufw/nftables"} except Exception: pass return {"check_item": "firewall", "status": "unknown", diff --git a/agent/reporter.py b/agent/reporter.py index 35e9eed..e294c2c 100644 --- a/agent/reporter.py +++ b/agent/reporter.py @@ -4,7 +4,7 @@ VPS_MANAGER_URL 中心地址，如 http://100.89.0.11:8000 VPS_ASSET_ID 本机对应的资产 ID VPS_AGENT_KEY Agent Key（中心配置了 AGENT_KEY 时必填） - VPS_AGENT_RETRY 上报失败重试次数（默认 2，指数退避） + VPS_AGENT_RETRY 上报失败重试次数（默认 2，指数退避；4xx 不重试，429 按 Retry-After） """ import os @@ -16,6 +16,16 @@ import httpx from collector import collect_metrics, collect_security, collect_server_info +def _next_wait(attempt: int, resp=None) -> int: + """重试等待：429 优先按服务端 Retry-After，其余走指数退避""" + if resp is not None: + try: + return max(1, min(int(resp.headers.get("Retry-After")), 300)) + except (TypeError, ValueError): + pass + return 2 ** attempt + + def main() -> int: url = os.environ.get("VPS_MANAGER_URL", "").rstrip("/") asset_id = os.environ.get("VPS_ASSET_ID", "") @@ -39,17 +49,25 @@ def main() -> int: resp = httpx.post( f"{url}/api/agent/report", json=payload, headers=headers, timeout=30 ) - print(f"上报完成 HTTP {resp.status_code}: {resp.text}") resp.raise_for_status() + print(f"上报完成 HTTP {resp.status_code}: {resp.text}") return 0 - except Exception as e: # noqa: BLE001 - if attempt < max_retry: - wait = 2 ** attempt - print(f"上报失败（{attempt + 1}/{max_retry + 1}），{wait}s 后重试: {e}") - time.sleep(wait) - else: - print(f"上报失败（已重试 {max_retry} 次）: {e}") + except httpx.HTTPStatusError as e: + code = e.response.status_code + if 400 <= code < 500 and code != 429: + # 鉴权失败/参数错误这类 4xx 重试必然继续失败，白白拖完退避还丢点； + # 立即退出并把原因留给 systemd 日志（429 是频控，例外） + print(f"上报被拒绝 HTTP {code}（不重试）：{e.response.text[:200]}") return 1 + wait, err = _next_wait(attempt, e.response), f"HTTP {code}" + except Exception as e: # noqa: BLE001 网络/DNS/超时 + wait, err = _next_wait(attempt), str(e) + if attempt < max_retry: + print(f"上报失败（{attempt + 1}/{max_retry + 1}）{err}，{wait}s 后重试") + time.sleep(wait) + else: + print(f"上报失败（已重试 {max_retry} 次）：{err}") + return 1 return 1 diff --git a/app/adapters/ai.py b/app/adapters/ai.py index 7fc7016..d542cb0 100644 --- a/app/adapters/ai.py +++ b/app/adapters/ai.py @@ -89,13 +89,10 @@ class OpenAIAdapter(_AIBase): except Exception as e: # noqa: BLE001 return {"ok": False, "message": str(e)} - def get_account(self) -> AccountInfo: - # OpenAI 余额接口需组织级权限，尝试旧版 billing，失败返回空 - try: - data = self._get("https://api.openai.com/dashboard/billing/credit_grants") - return AccountInfo(balance=data.get("total_available"), currency="USD", raw=data) - except Exception: # noqa: BLE001 - return AccountInfo(balance=None, currency="USD", raw={}) + # 故意不实现 get_account：OpenAI 的 /dashboard/billing/credit_grants 早已下线 + # （且需组织级权限）。旧实现把异常静默吞掉并返回 balance=None， + # 导致前端提示「已更新」但数值永远不变；不实现则 capabilities() 中 + # get_account 为 False，刷新余额时会如实提示「暂不支持余额查询」。 @register("minimax-api") diff --git a/app/adapters/base.py b/app/adapters/base.py index 697ce86..301c768 100644 --- a/app/adapters/base.py +++ b/app/adapters/base.py @@ -87,8 +87,13 @@ class AccountInfo: def _overridden(instance: "BaseAdapter", method_name: str) -> bool: - """判断子类是否重写了某方法（用于能力探测）""" - return type(instance).__dict__.get(method_name) is not None + """判断子类是否重写了某方法（用于能力探测） + + 比较按 MRO 解析到的实现与 BaseAdapter 的默认实现：只查 type(instance).__dict__ + 的话，由中间层基类（如 ai._AIBase）实现的能力会被误判为「未实现」。 + """ + impl = getattr(type(instance), method_name, None) + return impl is not None and impl is not getattr(BaseAdapter, method_name, None) class BaseAdapter(ABC): diff --git a/app/core/security.py b/app/core/security.py index 8d294cc..8c8c919 100644 --- a/app/core/security.py +++ b/app/core/security.py @@ -1,8 +1,8 @@ """API Key 认证依赖 -用于保护写操作（POST/PUT/DELETE）。 +用于保护写操作（POST/PUT/DELETE）与 Agent 上报。 - 来自可信内网（Tailscale 100.64.0.0/10、本机回环）的请求直接放行； -- 其余来源：API_KEY 已配置则校验 X-API-Key，未配置则拒绝（防止外部裸奔）。 +- 其余来源：密钥已配置则校验对应请求头，未配置则拒绝（防止外部裸奔）。 """ import hmac @@ -92,14 +92,36 @@ async def require_api_key( await _require_key(x_api_key) -async def require_agent_key( - x_agent_key: Optional[str] = Header(default=None, alias="X-Agent-Key"), -) -> None: - """校验 Agent 上报 Key（可选启用）""" +async def _require_agent_key(x_agent_key: Optional[str]) -> None: + """按外部来源校验 Agent Key（可信内网已在调用方排除）""" if not settings.AGENT_KEY: - return + raise HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail=( + "Agent 上报来自外部网络，需先在 .env 配置 AGENT_KEY" + "并写入各 VPS 的 /etc/vps-agent.env（VPS_AGENT_KEY）" + ), + ) if not _key_matches(x_agent_key, settings.AGENT_KEY): raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Agent Key 无效或缺失", ) + + +async def require_agent_key( + request: Request, + x_agent_key: Optional[str] = Header(default=None, alias="X-Agent-Key"), +) -> None: + """校验 Agent 上报 Key：tailnet/本机放行，外部来源必须携带有效 Key + + 与 require_api_key 用同一套可信来源判定。此前未配 AGENT_KEY 时对任意来源全放行， + 而服务默认监听 0.0.0.0——公网上任何人都能伪造监控指标与安全检查结果上报。 + 改成「外部来源必须有 key」后，走 tailnet IP 上报的 Agent 不受影响。 + """ + if _is_funnel_request(request): + await _require_agent_key(x_agent_key) + return + if _is_trusted(_client_ip(request)): + return + await _require_agent_key(x_agent_key) diff --git a/app/core/timeutils.py b/app/core/timeutils.py index be2a7d0..cb448b5 100644 --- a/app/core/timeutils.py +++ b/app/core/timeutils.py @@ -12,8 +12,3 @@ from datetime import datetime, timezone def utcnow() -> datetime: """返回当前 UTC 时间（naive，与 datetime.utcnow() 行为一致）""" return datetime.now(timezone.utc).replace(tzinfo=None) - - -def utcnow_iso() -> str: - """返回当前 UTC 时间的 ISO 格式字符串（带 Z 后缀标识 UTC）""" - return datetime.now(timezone.utc).isoformat() diff --git a/app/main.py b/app/main.py index ec4121a..2db6eae 100644 --- a/app/main.py +++ b/app/main.py @@ -6,7 +6,7 @@ - 启用 CORS（便于外部程序/其他 AI 跨域调用写入接口） """ -from contextlib import asynccontextmanager +from contextlib import asynccontextmanager, suppress from pathlib import Path import asyncio import logging @@ -85,15 +85,35 @@ logging.basicConfig( jinja_env = Environment(loader=FileSystemLoader(TEMPLATE_DIR), autoescape=True) +def _warn_insecure_config() -> None: + """把「暴露面 vs 密钥」的配置缺口打到启动日志里，避免静默裸奔 + + 服务默认监听 0.0.0.0，而密钥留空时外部来源会被 fail-closed 拒绝： + 这意味着 funnel/公网访问直接不可用，原因必须在日志里说清。 + """ + log = logging.getLogger(__name__) + if not settings.API_KEY: + log.warning("未配置 API_KEY：外部来源的写操作一律 401，仅 tailnet/本机可用") + if not settings.AGENT_KEY: + log.warning( + "未配置 AGENT_KEY：外部来源的 Agent 上报一律 401（tailnet 内的 Agent 不受影响）" + ) + + @asynccontextmanager async def lifespan(_: FastAPI): """应用启动时自动建表、初始化预设平台，并启动监控数据定期清理任务""" init_db() + _warn_insecure_config() with Session(assets_engine) as session: seed_providers(session) cleanup_task = asyncio.create_task(cleanup_service.cleanup_loop()) yield cleanup_task.cancel() + # 等取消真正落地：只 cancel 不 await 的话，事件循环关闭时该 task 仍处于 pending， + # 会打出 "Task was destroyed but it is pending"，也可能跳过清理协程的收尾逻辑 + with suppress(asyncio.CancelledError): + await cleanup_task app = FastAPI(title=settings.APP_NAME, version=f"{APP_VERSION} ({GIT_COMMIT})", lifespan=lifespan) diff --git a/app/routers/accounts.py b/app/routers/accounts.py index 827bc18..4ae4949 100644 --- a/app/routers/accounts.py +++ b/app/routers/accounts.py @@ -7,7 +7,7 @@ from typing import List -from fastapi import APIRouter, Depends +from fastapi import APIRouter, Depends, Response from sqlmodel import Session from app.core.security import require_api_key @@ -60,7 +60,11 @@ def delete_account(account_id: int, session: Session = Depends(get_session)) -> summary="查看账号登录密码明文（解密返回）", dependencies=[Depends(require_api_key)], ) -def reveal_password(account_id: int, session: Session = Depends(get_session)) -> dict: +def reveal_password( + account_id: int, response: Response, session: Session = Depends(get_session) +) -> dict: + # 明文密码禁止缓存（与凭据库 /otp、/password 保持一致） + response.headers["Cache-Control"] = "no-store" return account_service.reveal_password(session, account_id) diff --git a/app/routers/credentials.py b/app/routers/credentials.py index 718b886..829e772 100644 --- a/app/routers/credentials.py +++ b/app/routers/credentials.py @@ -76,7 +76,11 @@ def delete_credential(credential_id: int, session: Session = Depends(get_session summary="查看凭据密码明文（解密返回）", dependencies=[Depends(require_api_key)], ) -def reveal_password(credential_id: int, session: Session = Depends(get_session)) -> dict: +def reveal_password( + credential_id: int, response: Response, session: Session = Depends(get_session) +) -> dict: + # 明文密码禁止缓存（与 /otp 保持一致），避免浏览器/代理缓存或历史残留 + response.headers["Cache-Control"] = "no-store" return credential_service.reveal_password(session, credential_id) diff --git a/app/routers/stats.py b/app/routers/stats.py index 3fd1691..8bd4d27 100644 --- a/app/routers/stats.py +++ b/app/routers/stats.py @@ -19,7 +19,13 @@ def overview(session: Session = Depends(get_session)) -> dict: @router.get("/expiring", response_model=List[AssetRead], summary="续费倒计时") def expiring( - days: int = Query(default=30, ge=1, le=365, description="统计未来 N 天内到期"), + days: int = Query( + default=30, + ge=1, + le=365, + description="到期日上界 = 今天 + N 天；不设下界，已过期未处理的也会返回（days_to_expiry 可为负）", + ), session: Session = Depends(get_session), ): + """对外 API：前端的到期卡片直接走 /stats/overview + 资产列表，不再调本接口""" return asset_service.get_expiring(session, days) diff --git a/app/services/account_service.py b/app/services/account_service.py index 7fb9114..249e3c5 100644 --- a/app/services/account_service.py +++ b/app/services/account_service.py @@ -113,13 +113,13 @@ def create_account(session: Session, data: AccountCreate) -> AccountRead: try: session.add(account) session.commit() - except IntegrityError: + except IntegrityError as e: # 并发创建同名账号时唯一约束兜底：检查与提交之间存在竞态窗口 session.rollback() raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail=f"该平台下账号已存在：{name}", - ) + ) from e session.refresh(account) return _to_read(account, _asset_counts(session), _cred_of(session, account)) @@ -150,13 +150,13 @@ def update_account(session: Session, account_id: int, data: AccountUpdate) -> Ac try: session.add(account) session.commit() - except IntegrityError: + except IntegrityError as e: # 重命名撞上已有账号时唯一约束兜底，与 _check_name_taken 存在竞态窗口 session.rollback() raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail=f"该平台下账号已存在：{account.name}", - ) + ) from e session.refresh(account) return _to_read(account, _asset_counts(session), _cred_of(session, account)) diff --git a/app/services/asset_service.py b/app/services/asset_service.py index 82d2036..d0c00f9 100644 --- a/app/services/asset_service.py +++ b/app/services/asset_service.py @@ -299,17 +299,42 @@ def update_asset(session: Session, asset_id: int, data: AssetUpdate) -> AssetRea def delete_asset(session: Session, asset_id: int) -> None: - """删除资产及其详情，并清理 metrics.db 中的关联监控数据（避免孤儿数据）""" + """删除资产及其详情/子表，并尽力清理 metrics.db 中的关联监控数据（避免孤儿数据）""" asset = session.get(Asset, asset_id) if not asset: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="资产不存在") detail = _get_detail(session, asset) if detail is not None: session.delete(detail) + _delete_child_rows(session, asset_id) session.delete(asset) session.commit() logger.info("删除资产 id=%s name=%s", asset_id, asset.name) - _cleanup_metrics_for_asset(asset_id) + # metrics.db 是独立库（可能正在被 Agent 写入而短暂锁定）， + # 清理失败不应让已经成功的删除返回 500，否则前端会误报「删除失败」 + try: + _cleanup_metrics_for_asset(asset_id) + except Exception as e: # noqa: BLE001 + logger.warning( + "清理资产监控数据失败 asset_id=%s：%s（资产已删除，监控数据可后续手动清理）", + asset_id, + e, + ) + + +def _delete_child_rows(session: Session, asset_id: int) -> None: + """删除 assets.db 中引用该资产的子表行（subdomains / site_certs） + + 必须显式清理：SQLite 默认不强制外键（PRAGMA foreign_keys=0），残留行会变成孤儿； + 而 assets.id 是 INTEGER PRIMARY KEY（无 AUTOINCREMENT），删掉最大 id 后 + 新建资产必然复用该 id，孤儿行会被误挂到不相干的新资产上。 + """ + from sqlmodel import delete + + from app.models.ssl import SiteCert, Subdomain + + for model in (Subdomain, SiteCert): + session.exec(delete(model).where(model.asset_id == asset_id)) def _cleanup_metrics_for_asset(asset_id: int) -> None: diff --git a/app/services/provider_service.py b/app/services/provider_service.py index 79ee4e5..07f1123 100644 --- a/app/services/provider_service.py +++ b/app/services/provider_service.py @@ -3,6 +3,7 @@ from typing import List, Optional from fastapi import HTTPException, status +from sqlalchemy.exc import IntegrityError from sqlmodel import Session, select from app.core import crypto @@ -47,8 +48,16 @@ def create_provider(session: Session, data: ProviderCreate) -> ProviderRead: provider_data = data.model_dump(exclude={"api_config"}) provider = Provider(**provider_data) provider.api_config_encrypted = crypto.encrypt(data.api_config) - session.add(provider) - session.commit() + try: + session.add(provider) + session.commit() + except IntegrityError as e: + # 上面的 exists 检查与 commit 之间存在竞态窗口，靠 slug 唯一约束兜底， + # 否则并发建同名平台会直接把 IntegrityError 抛成 500 + session.rollback() + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, detail=f"slug 已存在：{data.slug}" + ) from e session.refresh(provider) return _to_read(provider) @@ -64,8 +73,15 @@ def update_provider( setattr(provider, key, value) if data.api_config is not None: provider.api_config_encrypted = crypto.encrypt(data.api_config) - session.add(provider) - session.commit() + try: + session.add(provider) + session.commit() + except IntegrityError as e: + # 改 slug 撞上已有平台时同样靠唯一约束兜底 + session.rollback() + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, detail=f"slug 已存在：{provider.slug}" + ) from e session.refresh(provider) return _to_read(provider) diff --git a/app/services/ssl_service.py b/app/services/ssl_service.py index e2b7fcf..f1b4ab4 100644 --- a/app/services/ssl_service.py +++ b/app/services/ssl_service.py @@ -29,13 +29,13 @@ def days_until(d: Optional[date]) -> Optional[int]: return (d - date.today()).days -def _judge_status(days: Optional[int]) -> str: +def _judge_status(days: Optional[int], threshold: int = EXPIRING_THRESHOLD) -> str: """按剩余天数定级：expired / expiring / valid""" if days is None: return "unknown" if days < 0: return "expired" - if days <= EXPIRING_THRESHOLD: + if days <= threshold: return "expiring" return "valid" @@ -115,7 +115,20 @@ def list_subdomains(session: Session, asset_id: Optional[int] = None) -> list: ] +def _require_asset(session: Session, asset_id: Optional[int]) -> None: + """校验关联资产存在 + + SQLite 默认不强制外键，写一个不存在的 asset_id 不会报错， + 但列表页 join 不出资产名，删除资产时也清不到这些悬空行。 + """ + if asset_id is None: + return + if not session.get(Asset, asset_id): + raise ValueError(f"关联资产不存在（id={asset_id}）") + + def create_subdomain(session: Session, data: dict) -> Subdomain: + _require_asset(session, data["asset_id"]) sub = Subdomain( asset_id=data["asset_id"], host=data["host"].strip().lower(), @@ -157,7 +170,7 @@ def delete_subdomain(session: Session, sub_id: int) -> None: # ---------------- 站点证书监控 ---------------- -def _apply_probe(cert: SiteCert, info: dict) -> SiteCert: +def _apply_probe(cert: SiteCert, info: dict, threshold: int = EXPIRING_THRESHOLD) -> SiteCert: """把探测结果写入模型并定级""" cert.subject_cn = info["subject_cn"] cert.issuer = info["issuer"] @@ -165,16 +178,16 @@ def _apply_probe(cert: SiteCert, info: dict) -> SiteCert: cert.valid_to = info["valid_to"] cert.fingerprint = info["fingerprint"] cert.error = None - cert.status = _judge_status(days_until(info["valid_to"])) + cert.status = _judge_status(days_until(info["valid_to"]), threshold) cert.last_checked_at = utcnow() return cert -def check_one(session: Session, cert: SiteCert) -> SiteCert: +def check_one(session: Session, cert: SiteCert, threshold: int = EXPIRING_THRESHOLD) -> SiteCert: """重新探测单条证书记录（失败则标记 error，保留旧到期信息）""" try: info = probe_site_cert(cert.hostname, cert.port) - _apply_probe(cert, info) + _apply_probe(cert, info, threshold) except Exception as e: # noqa: BLE001 cert.status = "error" cert.error = str(e)[:200] @@ -187,6 +200,7 @@ def check_one(session: Session, cert: SiteCert) -> SiteCert: def create_site_cert(session: Session, hostname: str, port: int = 443, asset_id: Optional[int] = None) -> SiteCert: """创建探测目标并立即探测一次；hostname+port 已存在则复用并刷新""" + _require_asset(session, asset_id) hostname = hostname.strip().lower() existing = session.exec( select(SiteCert).where(SiteCert.hostname == hostname, SiteCert.port == port) @@ -223,12 +237,13 @@ def delete_site_cert(session: Session, cert_id: int) -> None: session.commit() -def check_all_site_certs(session: Session) -> dict: +def check_all_site_certs(session: Session, threshold: int = EXPIRING_THRESHOLD) -> dict: """全量刷新所有站点证书，返回统计与异常清单 探测为纯网络 IO（单次最长 8s），用线程池并发探测后统一写库： 串行时 N 个站点最坏耗时 N×8s，并发后接近单站点耗时； 写库集中在主线程一次 commit（原来逐条 commit 产生 N 次事务）。 + threshold：「即将到期」的天数阈值，默认 EXPIRING_THRESHOLD。 """ from concurrent.futures import ThreadPoolExecutor @@ -244,7 +259,7 @@ def check_all_site_certs(session: Session) -> dict: for future in futures: cert = futures[future] try: - _apply_probe(cert, future.result()) + _apply_probe(cert, future.result(), threshold) except Exception as e: # noqa: BLE001 cert.status = "error" cert.error = str(e)[:200] diff --git a/app/services/sync_service.py b/app/services/sync_service.py index fddf241..aa793dd 100644 --- a/app/services/sync_service.py +++ b/app/services/sync_service.py @@ -36,17 +36,6 @@ from app.models.provider import Provider _VALID_STATUS = {s.value for s in AssetStatus} -def _load_config(provider: Provider) -> dict: - """（已弃用）解密平台级 API 配置，仅为兼容历史数据保留""" - plain = crypto.decrypt(provider.api_config_encrypted) - if not plain: - return {} - try: - return json.loads(plain) - except (json.JSONDecodeError, TypeError): - return {} - - def _load_account_config(account: Account) -> dict: """解密账号的 API 配置 JSON""" plain = crypto.decrypt(account.api_config_encrypted) @@ -334,6 +323,20 @@ _AI_SDK_MAP = { } +class BalanceUnsupported(HTTPException): + """该平台没有可用的余额查询接口 + + 与「查询失败」区分开：sync_all_ai_balances 把它计入 skipped 而不是 failed， + 否则每次「同步 AI 余额」都会把这类平台报成错误。 + """ + + def __init__(self, sdk_type: str): + super().__init__( + status_code=status.HTTP_400_BAD_REQUEST, + detail=f"{sdk_type} 暂不支持余额查询", + ) + + def refresh_ai_balance(session: Session, asset_id: int) -> dict: """刷新 AI 账号余额：解密 api_key → 适配器 get_account → 更新余额""" asset = session.get(Asset, asset_id) @@ -367,19 +370,18 @@ def refresh_ai_balance(session: Session, asset_id: int) -> dict: ) adapter = registry.get_adapter(sdk_type, {"api_key": api_key}) + if not adapter.capabilities().get("get_account"): + raise BalanceUnsupported(sdk_type) try: acc = adapter.get_account() - except NotImplementedError: - raise HTTPException( - status_code=status.HTTP_400_BAD_REQUEST, - detail=f"{sdk_type} 暂不支持余额查询", - ) + except NotImplementedError as e: + raise BalanceUnsupported(sdk_type) from e except HTTPException: raise except Exception as e: # noqa: BLE001 raise HTTPException( status_code=status.HTTP_502_BAD_GATEWAY, detail=f"查询余额失败：{e}" - ) + ) from e if acc.balance is not None: ai.balance = acc.balance @@ -417,6 +419,7 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict: success = 0 failed = 0 + skipped = 0 errors = [] with ThreadPoolExecutor(max_workers=max_workers) as pool: futures = {pool.submit(_refresh_one, aid): name for aid, name in asset_ids} @@ -425,6 +428,9 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict: try: future.result() success += 1 + except BalanceUnsupported: + # 平台本身没余额接口，不算失败（否则每次都报一堆红） + skipped += 1 except HTTPException as e: failed += 1 errors.append(f"{name}: {e.detail}") @@ -435,6 +441,7 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict: "total": len(asset_ids), "success": success, "failed": failed, + "skipped": skipped, "errors": errors, "synced_at": utcnow().isoformat(), } diff --git a/deploy/setup.sh b/deploy/setup.sh index 82de740..b014297 100755 --- a/deploy/setup.sh +++ b/deploy/setup.sh @@ -40,10 +40,15 @@ python3 -m venv .venv echo "==> [4/6] 生成 .env（若不存在）" if [ ! -f .env ]; then MASTER_KEY="$(.venv/bin/python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")" + # API_KEY / AGENT_KEY 默认生成强随机值：留空时 Agent 上报接口对任意来源放行 + # （require_agent_key 未配 key 即全放），而服务默认监听 0.0.0.0， + # 公网上任何人都能伪造监控数据上报 + API_KEY="$(.venv/bin/python -c "import secrets; print(secrets.token_urlsafe(32))")" + AGENT_KEY="$(.venv/bin/python -c "import secrets; print(secrets.token_urlsafe(32))")" cat > .env < [6/6] 验证服务状态" sleep 3 diff --git a/deploy/update.sh b/deploy/update.sh index e023125..cce2d04 100755 --- a/deploy/update.sh +++ b/deploy/update.sh @@ -1,6 +1,7 @@ #!/usr/bin/env bash # vps-manager 自动更新脚本（由 systemd timer 定时触发） -# 1. 自动同步 deploy/ 下的 systemd 单元文件（有变更才拷贝 + daemon-reload） +# 1. 自动同步 deploy/ 下的 systemd 单元文件（有变更才拷贝 + daemon-reload； +# timer 变更 enable --now，主服务 unit 变更额外 restart） # 2. 从 Gitea 拉取最新代码，如有更新则装依赖并重启服务 # # 可配置项（环境变量）： @@ -30,10 +31,11 @@ print_version() { } # 同步 systemd 单元文件：deploy/ 下的 .service/.timer 与 /etc/systemd/system -# 不一致时拷贝并 reload；timer 变更额外 restart 使新调度周期立即生效。 +# 不一致时拷贝并 reload；timer 变更额外 enable --now（新调度周期立即生效且开机自启）， +# 主服务 unit 变更额外 restart（否则光 daemon-reload 日志说已更新、实际没生效）。 # 每次都执行（而非仅版本更新时），保证单元变更不依赖代码变更触发。 sync_units() { - local changed=0 f base + local changed=0 restart_main=0 f base for f in "$APP_DIR"/deploy/*.service "$APP_DIR"/deploy/*.timer; do [ -f "$f" ] || continue base=$(basename "$f") @@ -42,7 +44,16 @@ sync_units() { echo "[$(date '+%F %T')] 单元已更新: $base" changed=1 case "$base" in - *.timer) systemctl restart "$base" 2>/dev/null || true ;; + *.timer) + # enable --now：新增的 timer 只 restart 不会建开机自启软链，宿主重启后就丢了 + systemctl enable --now "$base" 2>/dev/null \ + || systemctl restart "$base" 2>/dev/null || true + ;; + "$SERVICE_NAME".service) + # 常驻服务的 unit 变更（如 ExecStart）光 daemon-reload 不生效，必须 restart； + # oneshot 服务下次触发自然读新配置，无需 restart + restart_main=1 + ;; esac fi done @@ -50,6 +61,10 @@ sync_units() { systemctl daemon-reload echo "[$(date '+%F %T')] systemd 单元同步完成" fi + if [ "$restart_main" -eq 1 ]; then + systemctl restart "$SERVICE_NAME" + echo "[$(date '+%F %T')] 已重启 $SERVICE_NAME 使 unit 变更生效" + fi } sync_units @@ -72,7 +87,10 @@ git reset --hard -q "origin/$BRANCH" # 依赖如有变更自动安装（无变化时 pip 会快速跳过） if [ -x ".venv/bin/pip" ]; then - .venv/bin/pip install -q -r requirements.txt 2>/dev/null || true + # 不再用 2>/dev/null || true 把报错全吞：装不上时只表现为服务重启后 ImportError，极难定位 + if ! .venv/bin/pip install -q -r requirements.txt; then + echo "[$(date '+%F %T')] 警告：依赖安装失败，服务可能因 ImportError 起不来；请手动执行 .venv/bin/pip install -r requirements.txt 看完整报错" + fi fi # 重启服务加载新代码 diff --git a/deploy/vps-cert-check.service b/deploy/vps-cert-check.service new file mode 100644 index 0000000..ed223e6 --- /dev/null +++ b/deploy/vps-cert-check.service @@ -0,0 +1,13 @@ +# 站点 SSL 证书检查服务（oneshot，由 timer 触发） +# 部署位置：/etc/systemd/system/vps-cert-check.service + +[Unit] +Description=Probe site SSL certificates and notify on expiry +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +WorkingDirectory=/opt/vps-manager +EnvironmentFile=-/opt/vps-manager/.env +ExecStart=/opt/vps-manager/.venv/bin/python /opt/vps-manager/scripts/check_site_certs.py diff --git a/deploy/vps-cert-check.timer b/deploy/vps-cert-check.timer new file mode 100644 index 0000000..9ec85fe --- /dev/null +++ b/deploy/vps-cert-check.timer @@ -0,0 +1,15 @@ +# 站点 SSL 证书每日检查定时器（09:30，错开 09:00 的续费检查，避免两条提醒同时发） +# 部署位置：/etc/systemd/system/vps-cert-check.timer +# 阈值默认取 ssl_service.EXPIRING_THRESHOLD（30 天）；如需自定义， +# 在 vps-cert-check.service 的 ExecStart 末尾追加天数参数即可。 + +[Unit] +Description=Daily site SSL certificate check + +[Timer] +OnCalendar=*-*-* 09:30:00 +Persistent=true +Unit=vps-cert-check.service + +[Install] +WantedBy=timers.target diff --git a/run.sh b/run.sh index 763d4fa..8c89c16 100644 --- a/run.sh +++ b/run.sh @@ -11,4 +11,12 @@ if [ ! -d ".venv" ]; then .venv/bin/pip install -r requirements.txt fi -exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 "$@" +# 监听地址/端口可用环境变量覆盖（HOST=127.0.0.1 ./run.sh）。 +# 默认 0.0.0.0 是为了让其他 VPS 上的 Agent 能直连 100.89.0.11:8000 上报； +# 若所有 Agent 都改走 tailscale serve 的 HTTPS 地址，HOST=127.0.0.1 更安全： +# GET 接口对 tailnet/本机零鉴权，绑公网 IP 时资产清单会被任意读取。 +# 注：生产由 systemd 拉起，绑定地址在 deploy/vps-manager.service 的 ExecStart 里。 +HOST="${HOST:-0.0.0.0}" +PORT="${PORT:-8000}" + +exec .venv/bin/uvicorn app.main:app --host "$HOST" --port "$PORT" "$@" diff --git a/scripts/check_site_certs.py b/scripts/check_site_certs.py index e5a8da8..38a1a06 100644 --- a/scripts/check_site_certs.py +++ b/scripts/check_site_certs.py @@ -22,7 +22,9 @@ def main() -> int: threshold = int(sys.argv[1]) if len(sys.argv) > 1 else ssl_service.EXPIRING_THRESHOLD init_db() with Session(assets_engine) as session: - result = ssl_service.check_all_site_certs(session) + # 阈值必须传进去：否则定级仍按模块常量 EXPIRING_THRESHOLD， + # CLI 参数取了却从未生效（文档声称支持） + result = ssl_service.check_all_site_certs(session, threshold) stats = result["stats"] # 即将到期 / 已过期 / 探测失败的证书 → 发提醒 @@ -40,7 +42,7 @@ def main() -> int: ) print( - f"[SSL检查] 共 {stats['total']} 个站点 | 正常 {stats['ok']} | " + f"[SSL检查] 阈值 {threshold} 天 | 共 {stats['total']} 个站点 | 正常 {stats['ok']} | " f"即将到期 {stats['expiring']} | 已过期 {stats['expired']} | 探测失败 {stats['error']}" ) for p in result["problems"]: diff --git a/scripts/make_migration_bundle.py b/scripts/make_migration_bundle.py index 2caf0f5..9e9090b 100644 --- a/scripts/make_migration_bundle.py +++ b/scripts/make_migration_bundle.py @@ -18,6 +18,7 @@ setup.sh 与一条 serve 命令重建，故不在包内）： import hashlib import json +import os import shutil import socket import sqlite3 @@ -81,8 +82,14 @@ def main() -> int: if src.exists(): snap_db(src, data_dst / db) copied.append(f"data/{db}") + elif db == "assets.db": + # 资产库是迁移的主体：缺了它仍打包，恢复端会把目标机 data/ 换成空库 + # 并报「恢复成功」，旧数据仅存于 data.pre-restore-* + print("[abort] 缺少 data/assets.db（迁移包没有主体数据）", file=sys.stderr) + shutil.rmtree(work, ignore_errors=True) + return 2 else: - print(f"[skip] {db} 不存在") + print("[warn] metrics.db 不存在，包内不含监控历史（不影响资产迁移）") escrow = data_src / "master_key.escrow" if escrow.exists(): shutil.copy2(escrow, data_dst / "master_key.escrow") @@ -119,8 +126,15 @@ def main() -> int: ) out.parent.mkdir(parents=True, exist_ok=True) - with tarfile.open(out, "w:gz") as tar: - tar.add(root, arcname="bundle") + # 包内含 .env（MASTER_KEY）与 escrow：先收紧 umask 再落盘， + # 避免默认 644 落在 /tmp 被同机其他用户读走 + old_umask = os.umask(0o077) + try: + with tarfile.open(out, "w:gz") as tar: + tar.add(root, arcname="bundle") + finally: + os.umask(old_umask) + out.chmod(0o600) shutil.rmtree(work, ignore_errors=True) print(f"[ok] 迁移包：{out}") diff --git a/scripts/restore_migration_bundle.py b/scripts/restore_migration_bundle.py index d94dcad..fe3d812 100644 --- a/scripts/restore_migration_bundle.py +++ b/scripts/restore_migration_bundle.py @@ -65,10 +65,12 @@ def main() -> int: print("[abort] 包内缺 manifest.sha256，拒绝恢复", file=sys.stderr) return 2 print("[1/4] 校验包内文件…") + listed: set[str] = set() for line in manifest_sha.read_text(encoding="utf-8").splitlines(): if not line.strip(): continue digest, name = line.split(" ", 1) + listed.add(name) target = root / name if not target.exists(): print(f"[abort] 包内缺文件：{name}", file=sys.stderr) @@ -80,6 +82,18 @@ def main() -> int: return 2 print(f" ok {name}") + # 必备文件预检：校验和只能证明「已列出的文件完好」，发现不了「压根没打进包」。 + # 缺 assets.db/.env 还往下走的话，目标机 data/ 与 .env 已被移走， + # 恢复出的却是空库，而且还会报「恢复成功」 + missing = [ + name for name in ("data/assets.db", ".env") + if name not in listed or not (root / name).exists() + ] + if missing: + print(f"[abort] 迁移包缺必备文件：{', '.join(missing)}（尚未触碰目标机状态）", + file=sys.stderr) + return 2 + ts = datetime.now().strftime("%Y%m%d_%H%M%S") print("[2/4] 备份目标机现有状态…") for src, tag in ((app_dir / "data", f"data.pre-restore-{ts}"), diff --git a/static/js/api.js b/static/js/api.js index a849a77..0c79dd0 100644 --- a/static/js/api.js +++ b/static/js/api.js @@ -124,12 +124,15 @@ window.VpsFmt = { if (d !== null && d !== undefined && d <= 30) return 'bg-amber-500/10 text-amber-600 dark:text-amber-400'; return 'bg-slate-500/10 text-slate-500'; }, - /* 倒计时文案：统一「距到期还有多久」的表述，负数归一为「已过期 N 天」，避免直出 "-3 天" */ - countdownText(d) { - if (d === null || d === undefined) return '未设到期日'; + /* 倒计时文案：统一「距到期还有多久」的表述，负数归一为「已过期 N 天」，避免直出 "-3 天" + opts.unit 传 '' 时只说「N 天」（表格窄列用），默认「N 天后」 + opts.empty 无到期日时的占位，默认「未设到期日」（表格里可传 '—' / '未知'） + 已有多处视图各自实现一份（且措辞不一），一律改为调这里 */ + countdownText(d, opts = {}) { + if (d === null || d === undefined) return opts.empty === undefined ? '未设到期日' : opts.empty; if (d < 0) return '已过期 ' + Math.abs(d) + ' 天'; if (d === 0) return '今天到期'; - return d + ' 天后'; + return d + (opts.unit === '' ? ' 天' : ' 天后'); }, checkBadge(s) { return { pass: 'bg-emerald-500/10 text-emerald-600 dark:text-emerald-400', warn: 'bg-amber-500/10 text-amber-600 dark:text-amber-400', fail: 'bg-red-500/10 text-red-600 dark:text-red-400', unknown: 'bg-slate-500/10 text-slate-500' }[s] || 'bg-slate-500/10 text-slate-500'; diff --git a/static/js/modals.js b/static/js/modals.js index 530e610..8f7e5b9 100644 --- a/static/js/modals.js +++ b/static/js/modals.js @@ -376,7 +376,8 @@ const AccountsViewModal = { return p ? p.name : slug; } function assetsOf(a) { - return store.assets.filter(x => x.account_id === a.id); + // 用 allAssets（全量口径）：账号名下有多少资产是事实，不该受资产页筛选影响 + return store.allAssets.filter(x => x.account_id === a.id); } function toggle(id) { expanded[id] = !expanded[id]; } // 账号所属平台配了 sdk_type 且账号有 API 配置时，提供测试/同步 @@ -402,7 +403,9 @@ const AccountsViewModal = { if (r.vps_error) lines.push('VPS 错误：' + r.vps_error); if (r.domains_error) lines.push('域名错误：' + r.domains_error); alert(lines.join('\n')); - await Promise.all([loadAccounts(), loadAssets()]); + // 同步会新建/更新资产（含到期日），总览的统计卡片也得跟着刷， + // 否则回到总览看到的还是同步前的数字 + await Promise.all([loadAccounts(), loadAssets(), loadOverview()]); } catch (e) { alert('同步失败：' + e.message); } } // 每次打开重置展开状态；关闭时连带收掉密码弹窗 @@ -472,7 +475,8 @@ const AccountsViewModal = { /* 凭据编辑模态框（密码库） * * 粒度 = 站点 × 登录方式：同一邮箱注册多个站点就录多条，密码相同也各存一份。 - * 2FA 录入必须同时填当前动态码（服务端校验），防 secret 手误成废条目。 + * 2FA 的动态码是选填：填了就当场校验（防 secret 手误成废条目），拿不到可以先存着， + * 条目会标「未验证」，之后在列表里随时补验。 */ const CredentialModal = { template: ` diff --git a/static/js/store.js b/static/js/store.js index c553a7c..a9f5a42 100644 --- a/static/js/store.js +++ b/static/js/store.js @@ -25,13 +25,13 @@ function _writeOauthList(k, list) { const store = reactive({ view: 'dashboard', - assets: [], + assets: [], // 列表口径：按当前筛选条件（类型/状态/平台/搜索）的结果 + allAssets: [], // 统计口径：不带筛选的全量资产（总览/监控卡片/平台计数用） providers: [], accounts: [], subdomains: [], siteCerts: [], overview: {}, - expiring: [], serverMetrics: {}, search: '', filterType: '', @@ -106,7 +106,25 @@ function buildAssetPayload(f) { // 后端 status 参数只认单个 AssetStatus 枚举值；「异常」是「已停止 + 已过期」的组合概念， // 后端不支持多值筛选，这里当作前端本地筛选的哨兵值，不发给 API，由视图层自己过滤。 const CLIENT_SIDE_STATUS_FILTERS = new Set(['abnormal']); + +// 列表口径 vs 统计口径必须分开：总览到期日历、监控中心统计卡片、平台页 +// 「关联 N 个资产」、账号弹窗的资产清单都是全量语义，如果跟着筛选走， +// 用户在资产页点了筛选（或从统计卡片跳转筛选）后，其他视图的数字会跟着变小， +// 看起来像数据丢了。 +async function loadAllAssets() { + const params = new URLSearchParams(); + params.set('sort', 'expiry_date'); params.set('order', 'asc'); + store.allAssets = await Api.get('/assets?' + params.toString()); +} +function _hasAssetFilter() { + return !!(store.filterType || store.filterStatus || store.filterProvider || store.search); +} async function loadAssets() { + await loadAllAssets(); + if (!_hasAssetFilter()) { + store.assets = [...store.allAssets]; // 无筛选时两个口径同源，不重复请求 + return; + } const params = new URLSearchParams(); if (store.filterType) params.set('asset_type', store.filterType); if (store.filterStatus && !CLIENT_SIDE_STATUS_FILTERS.has(store.filterStatus)) params.set('status', store.filterStatus); @@ -127,10 +145,9 @@ async function loadCredentials() { async function loadSubdomains() { store.subdomains = await Api.get('/subdomains'); } async function loadSiteCerts() { store.siteCerts = await Api.get('/site-certs'); } async function loadOverview() { store.overview = await Api.get('/stats/overview'); } -async function loadExpiring() { store.expiring = await Api.get('/stats/expiring?days=30'); } async function loadAll() { store.loading = true; store.error = ''; - try { await Promise.all([loadAssets(), loadProviders(), loadAccounts(), loadCredentials(), loadSubdomains(), loadSiteCerts(), loadOverview(), loadExpiring()]); } + try { await Promise.all([loadAssets(), loadProviders(), loadAccounts(), loadCredentials(), loadSubdomains(), loadSiteCerts(), loadOverview()]); } catch (e) { store.error = e.message; } finally { store.loading = false; } } diff --git a/static/js/views/assets.js b/static/js/views/assets.js index e85540c..d796d2b 100644 --- a/static/js/views/assets.js +++ b/static/js/views/assets.js @@ -54,7 +54,7 @@ const AssetsView = { {{ a.name }} {{ Fmt.TYPE_LABELS[a.asset_type] }} {{ a.provider_name || a.provider }} - {{ a.expiry_date || '—' }}({{ a.days_to_expiry }}天) + {{ a.expiry_date || '—' }}({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }}) {{ a.cost }} {{ a.currency }}/{{ Fmt.CYCLE_LABELS[a.renewal_cycle] || a.renewal_cycle }} {{ Fmt.STATUS_LABELS[a.status] }} @@ -80,7 +80,7 @@ const AssetsView = { {{ Fmt.TYPE_LABELS[a.asset_type] }}
- {{ a.expiry_date || '无到期' }} ({{ a.days_to_expiry }}天) + {{ a.expiry_date || '无到期' }} ({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }}) {{ a.cost }}{{ a.currency }} {{ Fmt.STATUS_LABELS[a.status] }}
@@ -149,7 +149,10 @@ const AssetsView = { if (!confirm('同步所有 AI 账号的余额？')) return; try { const r = await Api.post('/sync/ai-balances', {}); - alert('同步完成：成功 ' + r.success + '，失败 ' + r.failed + (r.errors && r.errors.length ? '\n' + r.errors.join('\n') : '')); + // skipped：平台本身没余额接口（如 OpenAI 已下线 billing），不属于失败 + alert('同步完成：成功 ' + r.success + '，失败 ' + r.failed + + (r.skipped ? '，跳过 ' + r.skipped + '（平台无余额接口）' : '') + + (r.errors && r.errors.length ? '\n' + r.errors.join('\n') : '')); await loadAssets(); } catch (e) { alert('同步失败：' + e.message); } } diff --git a/static/js/views/dashboard.js b/static/js/views/dashboard.js index 54a0ac8..fa30ae7 100644 --- a/static/js/views/dashboard.js +++ b/static/js/views/dashboard.js @@ -56,10 +56,11 @@ const DashboardView = { `, setup() { // 到期日历：只看未注销且有到期日的资产，最紧急（含已过期）排最前 - const expiryList = Vue.computed(() => store.assets + // 用 allAssets（全量口径）：总览是全局视图，不能跟着资产页的筛选变小 + const expiryList = Vue.computed(() => store.allAssets .filter(a => a.expiry_date && a.status !== 'cancelled') .sort((x, y) => (x.days_to_expiry ?? 10 ** 9) - (y.days_to_expiry ?? 10 ** 9))); - const noExpiryCount = Vue.computed(() => store.assets.filter(a => !a.expiry_date && a.status !== 'cancelled').length); + const noExpiryCount = Vue.computed(() => store.allAssets.filter(a => !a.expiry_date && a.status !== 'cancelled').length); // 副标题：类型 · 平台 · 费用/周期，缺失的字段不占位（避免出现 "VPS · · 3.5USD"） function meta(a) { const bits = [Fmt.TYPE_LABELS[a.asset_type] || a.asset_type, a.provider_name || a.provider]; diff --git a/static/js/views/domains.js b/static/js/views/domains.js index b998488..569306b 100644 --- a/static/js/views/domains.js +++ b/static/js/views/domains.js @@ -29,7 +29,7 @@ const DomainsView = { {{ a.domain_detail.domain_name }} {{ a.domain_detail.registrar || '—' }} {{ a.domain_detail.dns_provider || '—' }} - {{ a.expiry_date || '—' }}({{ a.days_to_expiry }}天) + {{ a.expiry_date || '—' }}({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }}) {{ sslByAsset[a.id].hostname }} · {{ certText(sslByAsset[a.id]) }} @@ -154,11 +154,8 @@ const DomainsView = { } catch (e) { alert('探测失败：' + e.message); } } function certText(c) { - const d = c.days_to_expiry; - if (d === null || d === undefined) return '未知'; - if (d < 0) return '已过期' + Math.abs(d) + '天'; - if (d === 0) return '今天到期'; - return d + '天'; + // 统一走 Fmt.countdownText：不再自己维护一份，也避免负数直出「-3天」 + return Fmt.countdownText(c.days_to_expiry, { unit: '', empty: '未知' }); } function certBadge(d) { if (d === null || d === undefined) return 'bg-slate-500/10 text-slate-500'; diff --git a/static/js/views/monitor.js b/static/js/views/monitor.js index e42911b..b668d31 100644 --- a/static/js/views/monitor.js +++ b/static/js/views/monitor.js @@ -189,9 +189,11 @@ const MonitorView = { ]; const hasExpiry = a => a.expiry_date && a.status !== 'cancelled'; // 当前 TAB 下、有到期日的资产（未叠加到期区间子筛选），作为统计卡片与列表的共同基础数据集 + // 用 allAssets（全量口径）：监控中心靠自己的 TAB 与子筛选限定范围， + // 不应该继承资产页的类型/状态/平台/搜索筛选，否则卡片数字会莫名变小 const tabScopedAssets = Vue.computed(() => { if (store.monitorTab === 'ssl') return []; - let list = store.assets.filter(hasExpiry); + let list = store.allAssets.filter(hasExpiry); const t = store.monitorTab; if (t === 'subscription') list = list.filter(a => a.cost > 0); else if (t) list = list.filter(a => a.asset_type === t); @@ -253,12 +255,9 @@ const MonitorView = { function clearExpiryFilter() { store.monitorExpiryFilter = ''; } function toggleSslStatusFilter(k) { store.monitorSslStatusFilter = store.monitorSslStatusFilter === k ? '' : k; } function clearSslStatusFilter() { store.monitorSslStatusFilter = ''; } - function countdownText(d) { - if (d === null || d === undefined) return '—'; - if (d < 0) return '已过期 ' + Math.abs(d) + ' 天'; - if (d === 0) return '今天到期'; - return d + ' 天'; - } + // 文案统一走 Fmt.countdownText（不再自己维护一份）； + // 此处保留窄列样式：无到期日显示 —，天数不带「后」 + const countdownText = d => Fmt.countdownText(d, { unit: '', empty: '—' }); function countdownBadge(d) { if (d === null || d === undefined) return 'bg-slate-500/10 text-slate-500'; if (d < 0 || d === 0 || d <= 7) return 'bg-red-500/10 text-red-600 dark:text-red-400'; diff --git a/static/js/views/providers.js b/static/js/views/providers.js index a04db74..3341844 100644 --- a/static/js/views/providers.js +++ b/static/js/views/providers.js @@ -47,9 +47,11 @@ const ProvidersView = { setup() { // 凭证已下沉到账号层：平台卡片不再提供测试/同步（见账号弹窗） // 平台关联资产数：优先按 provider_id 归并，其次按资产里填的平台名/slug + // 用 allAssets（全量口径）：「关联 N 个资产」是平台的事实数量， + // 不能因为资产页正在筛选就少算（否则点进去看到的清单与数字对不上） const assetCounts = Vue.computed(() => { const m = {}; - for (const a of store.assets) { + for (const a of store.allAssets) { if (a.provider_id) m['id:' + a.provider_id] = (m['id:' + a.provider_id] || 0) + 1; else if (a.provider) m['p:' + a.provider] = (m['p:' + a.provider] || 0) + 1; } diff --git a/static/js/views/servers.js b/static/js/views/servers.js index 49ed9fa..6cc9954 100644 --- a/static/js/views/servers.js +++ b/static/js/views/servers.js @@ -13,17 +13,17 @@ const ServersView = {
CPU
-
{{ latest ? latest.cpu_pct : '—' }}%
+
{{ pct(latest && latest.cpu_pct) }}
{{ m.info.cpu_cores }} 核
内存
-
{{ latest ? latest.mem_pct : '—' }}%
+
{{ pct(latest && latest.mem_pct) }}
{{ m.info.mem_total_gb }} GB
磁盘
-
{{ latest ? latest.disk_pct : '—' }}%
+
{{ pct(latest && latest.disk_pct) }}
{{ m.info.disk_total_gb }} GB
@@ -100,7 +100,11 @@ const ServersView = { function scoreClass(level) { return { good: 'text-emerald-600 dark:text-emerald-400', warning: 'text-amber-600 dark:text-amber-400', risk: 'text-red-600 dark:text-red-400', unknown: 'text-slate-400' }[level] || 'text-slate-400'; } + // 百分比统一判空：采样缺项时字段是 null，直出模板会渲染成「null%」 + function pct(v) { + return (v === null || v === undefined) ? '—' : v + '%'; + } function goBack() { window.location.hash = '#assets'; } - return { store, Fmt, m, latest, scoreClass, goBack }; + return { store, Fmt, m, latest, scoreClass, pct, goBack }; }, }; diff --git a/static/js/views/settings.js b/static/js/views/settings.js index a4fbc8f..71937f9 100644 --- a/static/js/views/settings.js +++ b/static/js/views/settings.js @@ -96,7 +96,9 @@ const SettingsView = { const data = JSON.parse(ev.target.result); const r = await Api.post('/assets/import', data); dataResult.value = '导入完成：新增 ' + r.created + '，更新 ' + r.updated + (r.errors && r.errors.length ? '，错误 ' + r.errors.length : ''); - await loadAssets(); + // 导入可能新增平台/账号/资产，全量重拉（含总览统计）， + // 只刷 loadAssets 会让总览卡片与平台页计数停在导入前 + await loadAll(); } catch (err) { dataResult.value = '导入失败：' + err.message; } }; reader.readAsText(file); diff --git a/static/js/views/subscriptions.js b/static/js/views/subscriptions.js index a6ce103..4643d01 100644 --- a/static/js/views/subscriptions.js +++ b/static/js/views/subscriptions.js @@ -38,7 +38,7 @@ const SubscriptionsView = { {{ a.name }} {{ a.provider_name || a.provider }} {{ a.cost }} {{ a.currency }}/{{ Fmt.CYCLE_LABELS[a.renewal_cycle] || a.renewal_cycle }} - {{ a.expiry_date || '—' }}({{ a.days_to_expiry }}天) + {{ a.expiry_date || '—' }}({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }}) 续费 取消 @@ -50,7 +50,9 @@ const SubscriptionsView = {
`, setup() { - const subs = Vue.computed(() => store.assets + // 用 allAssets（全量口径）：本页有自己的口径（付费/有到期日）， + // 不该被资产页的类型/状态/搜索筛选影响，否则月度支出统计会跟着缩水 + const subs = Vue.computed(() => store.allAssets .filter(a => (a.cost > 0 || a.expiry_date) && a.status !== 'cancelled') .sort((x, y) => (x.days_to_expiry ?? 9999) - (y.days_to_expiry ?? 9999))); const monthlyByCurrency = Vue.computed(() => { diff --git a/tests/test_agent_collector.py b/tests/test_agent_collector.py new file mode 100644 index 0000000..a92fc57 --- /dev/null +++ b/tests/test_agent_collector.py @@ -0,0 +1,139 @@ +"""VPS Agent 安全检查采集测试 + +覆盖两处「假 pass」回归： + +1. ssh_config：只读 /etc/ssh/sshd_config 会漏掉 Include 展开的 sshd_config.d/*.conf + （Debian/Ubuntu 云镜像把加固项放在那里），且关键字缺失时被当成 unknown 直接放过； + 实际 PasswordAuthentication 的 sshd 默认值就是 yes，这类机器是开着密码登录的。 +2. firewall：`iptables -L -n` 即使零规则也会输出链头，拿 stdout 非空判「有规则」 + 会永远 pass；改用 `iptables -S` 统计 -A 规则行并结合 INPUT 策略判断。 + +运行：.venv/bin/pytest tests/test_agent_collector.py -v +""" + +import subprocess +import sys +from pathlib import Path + +import pytest + +AGENT_DIR = Path(__file__).resolve().parent.parent / "agent" +if str(AGENT_DIR) not in sys.path: + sys.path.insert(0, str(AGENT_DIR)) + +import collector # noqa: E402 （agent 目录不是包，按路径导入） + + +@pytest.fixture() +def sshd_tree(tmp_path, monkeypatch): + """把 collector.SSHD_CONFIG 指向 tmp 下的假配置树""" + main = tmp_path / "sshd_config" + dropin_dir = tmp_path / "sshd_config.d" + dropin_dir.mkdir() + monkeypatch.setattr(collector, "SSHD_CONFIG", str(main)) + return main, dropin_dir + + +def test_ssh_config_reads_included_dropins(sshd_tree): + """加固项写在 sshd_config.d/*.conf 时必须被读到，不能误报 warn""" + main, dropin_dir = sshd_tree + main.write_text( + f"Include {dropin_dir}/*.conf\n\n# 主文件里是未加固的旧值\nPermitRootLogin yes\n" + ) + (dropin_dir / "50-cloud.conf").write_text( + "PermitRootLogin prohibit-password\nPasswordAuthentication no\n" + ) + + result = collector._check_ssh_config() + + assert result["status"] == "pass" + assert "PermitRootLogin=prohibit-password" in result["detail"] + assert "PasswordAuthentication=no" in result["detail"] + + +def test_ssh_config_first_value_wins(sshd_tree): + """sshd 语义是「首次出现的值生效」：Include 在顶部时 drop-in 优先于主文件""" + main, dropin_dir = sshd_tree + main.write_text(f"Include {dropin_dir}/*.conf\nPasswordAuthentication yes\n") + (dropin_dir / "60-hardening.conf").write_text("PasswordAuthentication no\n") + + result = collector._check_ssh_config() + + assert result["status"] == "pass" + assert "PasswordAuthentication=no" in result["detail"] + + +def test_ssh_config_missing_keys_use_sshd_defaults(sshd_tree): + """关键字没写 ≠ 安全：PasswordAuthentication 默认 yes，必须告警而不是 pass""" + main, _ = sshd_tree + main.write_text("# 空配置，两个关键字都没写\nPort 22\n") + + result = collector._check_ssh_config() + + assert result["status"] == "warn" + assert "PasswordAuthentication=yes" in result["detail"] + assert "未显式配置" in result["detail"] + assert "关闭密码登录" in result["suggestion"] + + +def test_ssh_config_unreadable_is_unknown(monkeypatch): + """读不到主配置时如实报 unknown，不能默认放行""" + monkeypatch.setattr(collector, "SSHD_CONFIG", "/nonexistent/sshd_config") + + result = collector._check_ssh_config() + + assert result["status"] == "unknown" + assert "无法读取" in result["detail"] + + +def _fake_run(monkeypatch, iptables_output: str): + """ufw 不存在（走 iptables 分支），iptables -S 返回指定输出""" + + def run(cmd, **kwargs): + if cmd[0] == "ufw": + raise FileNotFoundError("ufw not installed") + return subprocess.CompletedProcess(cmd, 0, stdout=iptables_output, stderr="") + + monkeypatch.setattr(collector.subprocess, "run", run) + + +def test_firewall_no_rules_is_warn(monkeypatch): + """零规则时 -S 仍有 -P 行，不能据此判 pass""" + _fake_run(monkeypatch, "-P INPUT ACCEPT\n-P FORWARD ACCEPT\n-P OUTPUT ACCEPT\n") + + result = collector._check_firewall() + + assert result["status"] == "warn" + assert "无过滤规则" in result["detail"] + assert result["suggestion"] + + +def test_firewall_with_rules_is_pass(monkeypatch): + _fake_run( + monkeypatch, + "-P INPUT ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n", + ) + + result = collector._check_firewall() + + assert result["status"] == "pass" + assert "2 条规则" in result["detail"] + + +def test_firewall_drop_policy_without_rules_is_pass(monkeypatch): + """没有 -A 规则但 INPUT 策略是 DROP，本身就是有效防护""" + _fake_run(monkeypatch, "-P INPUT DROP\n-P FORWARD DROP\n-P OUTPUT ACCEPT\n") + + result = collector._check_firewall() + + assert result["status"] == "pass" + assert "INPUT 策略 DROP" in result["detail"] + + +def test_firewall_unknown_when_no_tool(monkeypatch): + def run(cmd, **kwargs): + raise FileNotFoundError(cmd[0]) + + monkeypatch.setattr(collector.subprocess, "run", run) + + assert collector._check_firewall()["status"] == "unknown" diff --git a/tests/test_security.py b/tests/test_security.py new file mode 100644 index 0000000..165395e --- /dev/null +++ b/tests/test_security.py @@ -0,0 +1,121 @@ +"""API Key / Agent Key 鉴权边界测试 + +锁死两条不可回退的行为： + +1. 可信来源判定：tailnet（100.64.0.0/10）与本机回环放行；仅当请求确实来自回环时 + 才信任 X-Forwarded-For（tailscale serve 转发场景），防止外部直连伪造 XFF 绕过。 +2. 未配置密钥时对外部来源必须**拒绝**（fail-closed）。Agent 上报此前是「未配 key + 就全放行」，而服务默认监听 0.0.0.0，公网上任何人都能伪造监控数据上报。 + +运行：.venv/bin/pytest tests/test_security.py -v +""" + +import asyncio + +import pytest +from fastapi import HTTPException +from starlette.requests import Request + +from app.core.config import settings +from app.core.security import require_agent_key, require_api_key + +TAILNET_IP = "100.89.0.5" +PUBLIC_IP = "203.0.113.7" + + +def _request(client_ip: str = PUBLIC_IP, headers: dict = None) -> Request: + """构造最小 Request：只需 client 与 headers 两个属性""" + scope = { + "type": "http", + "method": "POST", + "path": "/api/agent/report", + "client": (client_ip, 40000) if client_ip else None, + "headers": [ + (k.lower().encode(), v.encode()) for k, v in (headers or {}).items() + ], + } + return Request(scope) + + +def _run(coro): + return asyncio.run(coro) + + +def _assert_401(coro): + with pytest.raises(HTTPException) as exc: + _run(coro) + assert exc.value.status_code == 401 + return exc.value + + +# ----------------------------- 可信来源放行 ----------------------------- # +def test_tailnet_source_allowed_without_key(monkeypatch): + """走 tailnet IP 上报的 Agent 不受密钥缺失影响""" + monkeypatch.setattr(settings, "AGENT_KEY", "") + _run(require_agent_key(_request(TAILNET_IP), None)) # 不抛异常即通过 + + +def test_loopback_source_allowed_without_key(monkeypatch): + monkeypatch.setattr(settings, "API_KEY", "") + _run(require_api_key(_request("127.0.0.1"), None)) + + +def test_loopback_xff_tailnet_allowed(monkeypatch): + """tailscale serve 转发：peer 是回环、真实来源在 XFF 里且属于 tailnet""" + monkeypatch.setattr(settings, "API_KEY", "") + req = _request("127.0.0.1", {"X-Forwarded-For": TAILNET_IP}) + _run(require_api_key(req, None)) + + +def test_xff_from_public_source_is_ignored(monkeypatch): + """外部直连时伪造 XFF 不能绕过鉴权（只有回环来源的 XFF 才可信）""" + monkeypatch.setattr(settings, "API_KEY", "secret") + req = _request(PUBLIC_IP, {"X-Forwarded-For": TAILNET_IP}) + exc = _assert_401(require_api_key(req, None)) + assert "API Key" in exc.detail + + +def test_loopback_xff_public_still_requires_key(monkeypatch): + """回环转发但真实来源是公网 IP（funnel 之外的代理场景）→ 仍需 key""" + monkeypatch.setattr(settings, "API_KEY", "") + req = _request("127.0.0.1", {"X-Forwarded-For": PUBLIC_IP}) + _assert_401(require_api_key(req, None)) + + +def test_funnel_request_forces_key_even_from_tailnet_ip(monkeypatch): + """funnel 公网流量强制校验，即使来源 IP 恰在 tailnet 网段（双保险）""" + monkeypatch.setattr(settings, "AGENT_KEY", "") + req = _request(TAILNET_IP, {"Tailscale-Funnel-Request": "?1"}) + _assert_401(require_agent_key(req, None)) + + +# ----------------------------- 外部来源 fail-closed ----------------------------- # +def test_agent_key_unset_rejects_external(monkeypatch): + """未配 AGENT_KEY 时，外部来源必须 401（此前是全放行）""" + monkeypatch.setattr(settings, "AGENT_KEY", "") + exc = _assert_401(require_agent_key(_request(PUBLIC_IP), None)) + assert "AGENT_KEY" in exc.detail + + +def test_api_key_unset_rejects_external(monkeypatch): + monkeypatch.setattr(settings, "API_KEY", "") + _assert_401(require_api_key(_request(PUBLIC_IP), None)) + + +def test_agent_key_valid_and_invalid(monkeypatch): + monkeypatch.setattr(settings, "AGENT_KEY", "sekret") + _run(require_agent_key(_request(PUBLIC_IP), "sekret")) # 正确 key 放行 + _assert_401(require_agent_key(_request(PUBLIC_IP), "wrong")) + _assert_401(require_agent_key(_request(PUBLIC_IP), None)) + + +def test_api_key_valid_and_invalid(monkeypatch): + monkeypatch.setattr(settings, "API_KEY", "sekret") + _run(require_api_key(_request(PUBLIC_IP), "sekret")) + _assert_401(require_api_key(_request(PUBLIC_IP), "wrong")) + + +def test_unknown_client_is_not_trusted(monkeypatch): + """拿不到 client（如某些代理场景）时按不可信处理，不能默认放行""" + monkeypatch.setattr(settings, "AGENT_KEY", "") + _assert_401(require_agent_key(_request(None), None))