wangjia
6e99e32285
实现「一个二进制三个监听」中的管理端：
- 独立监听 ADMIN_LISTEN（默认 127.0.0.1:9443，FromEnv 拒绝 0.0.0.0/:: 等公网绑定）
- 中间件链：mw_ipallow（CIDR 白名单，仅信任 RemoteAddr，默认内网段）→
mw_session（HttpOnly+Secure+SameSite=Strict cookie，Redis 30min 滑动 TTL）
- 登录双因素：argon2id 密码 + RFC6238 TOTP；失败限流与临时锁定；
TOTP 密钥 AES-GCM 加密入库；migration 000008 增补 admins 表；
首个管理员由 cmd/adminctl create 创建（终端输出 otpauth URI/Secret）
- 功能三块（html/template + embed 静态资源，原生 JS 二次确认）：
1. 码批次：表单生成→明文仅在本次 CSV 下载出现（不落盘/不入日志）；
批次列表 + 整批作废（复用 #3 codes，新增 Store.ListBatches/VoidBatch）
2. 节点操作：列表 + 近期 node_events；replace 经 #14 ProvisionService、
draining/up 经 #5 Lifecycle（二者未就绪→注入 stub，UI 置灰）；二次确认 + CSRF
3. audit_log 查看：actor/action/target/时间范围过滤分页；同页查 node_events
- 所有写操作写 audit_log（actor=用户名，meta 不含明文）；管理端仅记安全事件
（登录失败/锁定/白名单拦截），不记常规访问日志
- internal/totp 复用包（与 doc/05 用户中心 2FA 同算法，纯标准库）
测试：totp RFC6238 向量、argon2/AES 往返、白名单放行/拦截、会话滑动过期、
登录成功/密码错/TOTP 错/未知用户/锁定、批次 CSV 含明文且 audit 不泄露、
作废/节点操作的二次确认与 CSRF 缺失被拒、mock 断言 service 调用参数、审计过滤。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
2.4 KiB
Go
77 lines
2.4 KiB
Go
package admin
|
|
|
|
import (
|
|
"database/sql"
|
|
"log"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/go-chi/chi/v5/middleware"
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/wangjia/pangolin/server/internal/codes"
|
|
)
|
|
|
|
// NewRouter wires the full admin HTTP handler chain:
|
|
//
|
|
// IP allowlist → [ /login, /static ] (no session)
|
|
// IP allowlist → session → [ everything else ] (authenticated)
|
|
func NewRouter(h *Handlers, sessions *SessionStore, cfg *Config, sec *SecurityLog) http.Handler {
|
|
ipAllow := func(next http.Handler) http.Handler { return NewIPAllow(cfg.AllowCIDRs, sec, next) }
|
|
requireSession := func(next http.Handler) http.Handler { return NewSessionMiddleware(sessions, next) }
|
|
|
|
r := chi.NewRouter()
|
|
r.Use(middleware.Recoverer)
|
|
r.Use(ipAllow)
|
|
|
|
// Static assets (CSS/JS) — embedded; behind the allowlist but pre-auth.
|
|
r.Handle("/static/*", http.FileServer(http.FS(assetsFS)))
|
|
|
|
// Pre-auth login routes.
|
|
r.Get("/login", h.LoginPage)
|
|
r.Post("/login", h.LoginSubmit)
|
|
|
|
// Authenticated routes.
|
|
r.Group(func(pr chi.Router) {
|
|
pr.Use(requireSession)
|
|
pr.Get("/", h.Dashboard)
|
|
pr.Post("/logout", h.Logout)
|
|
pr.Get("/codes", h.CodesPage)
|
|
pr.Post("/codes", h.CreateBatch)
|
|
pr.Post("/codes/void", h.VoidBatch)
|
|
pr.Get("/nodes", h.NodesPage)
|
|
pr.Post("/nodes/op", h.NodeOp)
|
|
pr.Get("/audit", h.AuditPage)
|
|
})
|
|
return r
|
|
}
|
|
|
|
// BuildServices assembles the downstream services. The codes service (#3) is
|
|
// real; lifecycle (#5) and provisioning (#14) are stubs until those modules
|
|
// land — the UI greys out their controls (Ready()==false).
|
|
func BuildServices(db *sql.DB, rdb *redis.Client, failMax int, lockDur time.Duration) Services {
|
|
codeStore := codes.NewStore(db)
|
|
codeSvc := codes.NewService(codeStore, rdb, failMax, lockDur)
|
|
return Services{
|
|
Codes: NewCodesAdapter(codeSvc, codeStore),
|
|
Lifecycle: NewStubLifecycle(),
|
|
Provision: NewStubProvision(),
|
|
}
|
|
}
|
|
|
|
// NewHandler builds the complete admin http.Handler from its dependencies.
|
|
func NewHandler(cfg *Config, db *sql.DB, rdb *redis.Client, svc Services, logger *log.Logger) (http.Handler, error) {
|
|
if logger == nil {
|
|
logger = log.Default()
|
|
}
|
|
store := NewDBStore(db)
|
|
sessions := NewSessionStore(rdb, cfg.SessionTTL)
|
|
sec := NewSecurityLog(store, logger)
|
|
auth := NewAuthenticator(store, sessions, rdb, cfg, sec)
|
|
handlers, err := NewHandlers(cfg, store, sessions, auth, svc, sec, logger)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return NewRouter(handlers, sessions, cfg, sec), nil
|
|
}
|