feat(admin): 管理端最小后台（独立监听 + 白名单 + 2FA）tsk_SCMtcGF4F434

实现「一个二进制三个监听」中的管理端： - 独立监听 ADMIN_LISTEN（默认 127.0.0.1:9443，FromEnv 拒绝 0.0.0.0/:: 等公网绑定） - 中间件链：mw_ipallow（CIDR 白名单，仅信任 RemoteAddr，默认内网段）→ mw_session（HttpOnly+Secure+SameSite=Strict cookie，Redis 30min 滑动 TTL） - 登录双因素：argon2id 密码 + RFC6238 TOTP；失败限流与临时锁定； TOTP 密钥 AES-GCM 加密入库；migration 000008 增补 admins 表；首个管理员由 cmd/adminctl create 创建（终端输出 otpauth URI/Secret） - 功能三块（html/template + embed 静态资源，原生 JS 二次确认）： 1. 码批次：表单生成→明文仅在本次 CSV 下载出现（不落盘/不入日志）；批次列表 + 整批作废（复用 #3 codes，新增 Store.ListBatches/VoidBatch） 2. 节点操作：列表 + 近期 node_events；replace 经 #14 ProvisionService、 draining/up 经 #5 Lifecycle（二者未就绪→注入 stub，UI 置灰）；二次确认 + CSRF 3. audit_log 查看：actor/action/target/时间范围过滤分页；同页查 node_events - 所有写操作写 audit_log（actor=用户名，meta 不含明文）；管理端仅记安全事件（登录失败/锁定/白名单拦截），不记常规访问日志 - internal/totp 复用包（与 doc/05 用户中心 2FA 同算法，纯标准库）测试：totp RFC6238 向量、argon2/AES 往返、白名单放行/拦截、会话滑动过期、登录成功/密码错/TOTP 错/未知用户/锁定、批次 CSV 含明文且 audit 不泄露、作废/节点操作的二次确认与 CSRF 缺失被拒、mock 断言 service 调用参数、审计过滤。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 14:49:32 +08:00
parent 787151245e
commit 6e99e32285
36 changed files with 3695 additions and 2 deletions
@@ -0,0 +1,166 @@
+// Command adminctl manages admin-backend accounts from the CLI.
+//
+// The first administrator must be created here (the web UI has no self-signup):
+//
+//	adminctl create -username alice
+//
+// Requires DB_DSN and ADMIN_SECRET_KEY in the environment (same as the server).
+// On success it prints the otpauth:// provisioning URI and Base32 secret to the
+// terminal so the operator can add it to an authenticator app / render a QR.
+package main
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"golang.org/x/term"
+
+	"github.com/wangjia/pangolin/server/internal/admin"
+	"github.com/wangjia/pangolin/server/internal/db"
+	"github.com/wangjia/pangolin/server/internal/totp"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	switch os.Args[1] {
+	case "create":
+		if err := runCreate(os.Args[2:]); err != nil {
+			fmt.Fprintln(os.Stderr, "error:", err)
+			os.Exit(1)
+		}
+	case "-h", "--help", "help":
+		usage()
+	default:
+		usage()
+		os.Exit(2)
+	}
+}
+
+func usage() {
+	fmt.Fprintln(os.Stdout, "adminctl — Pangolin admin account tool")
+	fmt.Fprintln(os.Stdout, "")
+	fmt.Fprintln(os.Stdout, "Usage:")
+	fmt.Fprintln(os.Stdout, "  adminctl create -username <name>")
+	fmt.Fprintln(os.Stdout, "")
+	fmt.Fprintln(os.Stdout, "Env: DB_DSN, ADMIN_SECRET_KEY (32-byte hex/base64)")
+}
+
+func runCreate(args []string) error {
+	var username string
+	fs := flag.NewFlagSet("create", flag.ContinueOnError)
+	fs.StringVar(&username, "username", "", "admin username")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return errors.New("-username is required")
+	}
+
+	dsn := os.Getenv("DB_DSN")
+	if dsn == "" {
+		return errors.New("DB_DSN is required")
+	}
+	keyStr := os.Getenv("ADMIN_SECRET_KEY")
+	if keyStr == "" {
+		return errors.New("ADMIN_SECRET_KEY is required")
+	}
+	key, err := parseSecretKey(keyStr)
+	if err != nil {
+		return err
+	}
+
+	password, err := readPassword()
+	if err != nil {
+		return err
+	}
+	if len(password) < 8 {
+		return errors.New("password must be at least 8 characters")
+	}
+
+	pwHash, err := admin.HashPassword(password)
+	if err != nil {
+		return err
+	}
+	secret, err := totp.GenerateSecret()
+	if err != nil {
+		return err
+	}
+	enc, err := admin.EncryptSecret(key, secret)
+	if err != nil {
+		return err
+	}
+
+	database, err := db.Open(dsn)
+	if err != nil {
+		return err
+	}
+	defer database.Close()
+
+	store := admin.NewDBStore(database)
+	id, err := store.CreateAdmin(context.Background(), username, pwHash, enc)
+	if err != nil {
+		return err
+	}
+
+	uri := totp.ProvisioningURI(secret, username, "Pangolin")
+	fmt.Println()
+	fmt.Printf("✓ 已创建管理员 #%d: %s\n", id, username)
+	fmt.Println()
+	fmt.Println("请在身份验证器中添加以下 TOTP（二维码可由下方 otpauth URI 生成）：")
+	fmt.Println("  Secret (Base32):", secret)
+	fmt.Println("  otpauth URI    :", uri)
+	fmt.Println()
+	fmt.Println("登录需输入：用户名 + 密码 + 6 位动态验证码。")
+	return nil
+}
+
+// readPassword reads a password from ADMIN_PASSWORD or, if unset, prompts on the
+// terminal with echo disabled (falling back to a plain stdin line).
+func readPassword() (string, error) {
+	if v := os.Getenv("ADMIN_PASSWORD"); v != "" {
+		return v, nil
+	}
+	fd := int(os.Stdin.Fd())
+	if term.IsTerminal(fd) {
+		fmt.Print("Password: ")
+		b, err := term.ReadPassword(fd)
+		fmt.Println()
+		if err != nil {
+			return "", err
+		}
+		return string(b), nil
+	}
+	r := bufio.NewReader(os.Stdin)
+	line, err := r.ReadString('\n')
+	if err != nil && line == "" {
+		return "", err
+	}
+	return strings.TrimRight(line, "\r\n"), nil
+}
+
+// parseSecretKey accepts a 32-byte key as hex or base64 (mirrors the admin
+// package's own loader so the CLI and server agree on the key format).
+func parseSecretKey(s string) ([]byte, error) {
+	s = strings.TrimSpace(s)
+	if b, err := hex.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	if b, err := base64.StdEncoding.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	if b, err := base64.RawStdEncoding.DecodeString(s); err == nil && len(b) == 32 {
+		return b, nil
+	}
+	return nil, errors.New("ADMIN_SECRET_KEY must decode to exactly 32 bytes (hex or base64)")
+}