merge: 管理端最小后台 + TOTP 双因素 [tsk_SCMtcGF4F434]

以 main 现有 cmd/server 设计为准(保留 probe + /v1 路由),叠加分支新增:internal/admin/ 自包含后台(session/2FA/IP 白名单/审计/模板)、internal/totp/ + cmd/adminctl/(TOTP + 管理员创建 CLI)、cmd/server/main.go 的 startAdminIfConfigured()(opt-in:ADMIN_SECRET_KEY+DB_DSN 才起)。统一 getenvDefault 命名;go.mod 取 HEAD + go mod tidy(x/term 提为直接依赖);admins 迁移与 main 既有 000008_provision 撞号,重排为 000009_admins。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 18:47:38 +08:00
parent 03b00b9a0f 6e99e32285
commit 20a1f8e2af
36 changed files with 3687 additions and 3 deletions
@@ -0,0 +1,166 @@
+// Command adminctl manages admin-backend accounts from the CLI.
+//
+// The first administrator must be created here (the web UI has no self-signup):
+//
+//	adminctl create -username alice
+//
+// Requires DB_DSN and ADMIN_SECRET_KEY in the environment (same as the server).
+// On success it prints the otpauth:// provisioning URI and Base32 secret to the
+// terminal so the operator can add it to an authenticator app / render a QR.
+package main
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"golang.org/x/term"
+
+	"github.com/wangjia/pangolin/server/internal/admin"
+	"github.com/wangjia/pangolin/server/internal/db"
+	"github.com/wangjia/pangolin/server/internal/totp"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	switch os.Args[1] {
+	case "create":
+		if err := runCreate(os.Args[2:]); err != nil {
+			fmt.Fprintln(os.Stderr, "error:", err)
+			os.Exit(1)
+		}
+	case "-h", "--help", "help":
+		usage()
+	default:
+		usage()
+		os.Exit(2)
+	}
+}
+
+func usage() {
+	fmt.Fprintln(os.Stdout, "adminctl — Pangolin admin account tool")
+	fmt.Fprintln(os.Stdout, "")
+	fmt.Fprintln(os.Stdout, "Usage:")
+	fmt.Fprintln(os.Stdout, "  adminctl create -username <name>")
+	fmt.Fprintln(os.Stdout, "")
+	fmt.Fprintln(os.Stdout, "Env: DB_DSN, ADMIN_SECRET_KEY (32-byte hex/base64)")
+}
+
+func runCreate(args []string) error {
+	var username string
+	fs := flag.NewFlagSet("create", flag.ContinueOnError)
+	fs.StringVar(&username, "username", "", "admin username")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return errors.New("-username is required")
+	}
+
+	dsn := os.Getenv("DB_DSN")
+	if dsn == "" {
+		return errors.New("DB_DSN is required")
+	}
+	keyStr := os.Getenv("ADMIN_SECRET_KEY")
+	if keyStr == "" {
+		return errors.New("ADMIN_SECRET_KEY is required")
+	}
+	key, err := parseSecretKey(keyStr)
+	if err != nil {
+		return err
+	}
+
+	password, err := readPassword()
+	if err != nil {
+		return err
+	}
+	if len(password) < 8 {
+		return errors.New("password must be at least 8 characters")
+	}
+
+	pwHash, err := admin.HashPassword(password)
+	if err != nil {
+		return err
+	}
+	secret, err := totp.GenerateSecret()
+	if err != nil {
+		return err
+	}
+	enc, err := admin.EncryptSecret(key, secret)
+	if err != nil {
+		return err
+	}
+
+	database, err := db.Open(dsn)
+	if err != nil {
+		return err
+	}
+	defer database.Close()
+
+	store := admin.NewDBStore(database)
+	id, err := store.CreateAdmin(context.Background(), username, pwHash, enc)
+	if err != nil {
+		return err
+	}
+
+	uri := totp.ProvisioningURI(secret, username, "Pangolin")
+	fmt.Println()
+	fmt.Printf("✓ 已创建管理员 #%d: %s\n", id, username)
+	fmt.Println()
+	fmt.Println("请在身份验证器中添加以下 TOTP（二维码可由下方 otpauth URI 生成）：")
+	fmt.Println("  Secret (Base32):", secret)
+	fmt.Println("  otpauth URI    :", uri)
+	fmt.Println()
+	fmt.Println("登录需输入：用户名 + 密码 + 6 位动态验证码。")
+	return nil
+}
+
+// readPassword reads a password from ADMIN_PASSWORD or, if unset, prompts on the
+// terminal with echo disabled (falling back to a plain stdin line).
+func readPassword() (string, error) {
+	if v := os.Getenv("ADMIN_PASSWORD"); v != "" {
+		return v, nil
+	}
+	fd := int(os.Stdin.Fd())
+	if term.IsTerminal(fd) {
+		fmt.Print("Password: ")
+		b, err := term.ReadPassword(fd)
+		fmt.Println()
+		if err != nil {
+			return "", err
+		}
+		return string(b), nil
+	}
+	r := bufio.NewReader(os.Stdin)
+	line, err := r.ReadString('\n')
+	if err != nil && line == "" {
+		return "", err
+	}
+	return strings.TrimRight(line, "\r\n"), nil
+}
+
+// parseSecretKey accepts a 32-byte key as hex or base64 (mirrors the admin
+// package's own loader so the CLI and server agree on the key format).
+func parseSecretKey(s string) ([]byte, error) {
+	s = strings.TrimSpace(s)
+	if b, err := hex.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	if b, err := base64.StdEncoding.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	if b, err := base64.RawStdEncoding.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	return nil, errors.New("ADMIN_SECRET_KEY must decode to exactly 32 bytes (hex or base64)")
+}
@@ -9,11 +9,13 @@ import (

 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
-	"github.com/wangjia/pangolin/server/internal/redisutil"
-	"github.com/wangjia/pangolin/server/internal/scheduler/probe"

 	"github.com/wangjia/pangolin/server/api/gen"
+	"github.com/wangjia/pangolin/server/internal/admin"
+	"github.com/wangjia/pangolin/server/internal/db"
 	"github.com/wangjia/pangolin/server/internal/httpapi"
+	"github.com/wangjia/pangolin/server/internal/redisutil"
+	"github.com/wangjia/pangolin/server/internal/scheduler/probe"
 )

 func main() {
@@ -28,6 +30,10 @@ func main() {
 		}
 	}

+	// Admin backend (separate internal listener). Started only when explicitly
+	// configured so the public API can run on its own. See internal/admin.
+	startAdminIfConfigured()
+
 	r := chi.NewRouter()
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
@@ -77,6 +83,44 @@ func main() {
 	}
 }

+// startAdminIfConfigured launches the admin listener in a background goroutine
+// when ADMIN_SECRET_KEY and DB_DSN are present. The admin port binds an
+// internal address only (enforced by admin.FromEnv) and is fronted by an IP
+// allowlist + two-factor login.
+func startAdminIfConfigured() {
+	if os.Getenv("ADMIN_SECRET_KEY") == "" || os.Getenv("DB_DSN") == "" {
+		log.Printf("admin backend disabled (set DB_DSN and ADMIN_SECRET_KEY to enable)")
+		return
+	}
+	cfg, err := admin.FromEnv()
+	if err != nil {
+		log.Fatalf("admin config: %v", err)
+	}
+	database, err := db.Open(os.Getenv("DB_DSN"))
+	if err != nil {
+		log.Fatalf("admin db: %v", err)
+	}
+	rdb, err := redisutil.New(
+		getenvDefault("REDIS_ADDR", "127.0.0.1:6379"),
+		os.Getenv("REDIS_PASSWORD"), 0)
+	if err != nil {
+		log.Fatalf("admin redis: %v", err)
+	}
+
+	svc := admin.BuildServices(database, rdb, 5, cfg.LoginLockDuration)
+	handler, err := admin.NewHandler(cfg, database, rdb, svc, log.Default())
+	if err != nil {
+		log.Fatalf("admin handler: %v", err)
+	}
+
+	go func() {
+		log.Printf("admin backend listening on %s (internal only)", cfg.Listen)
+		if err := http.ListenAndServe(cfg.Listen, handler); err != nil {
+			log.Fatalf("admin server error: %v", err)
+		}
+	}()
+}
+
 func getenvDefault(key, def string) string {
 	if v := os.Getenv(key); v != "" {
 		return v