6e99e32285
实现「一个二进制三个监听」中的管理端:
- 独立监听 ADMIN_LISTEN(默认 127.0.0.1:9443,FromEnv 拒绝 0.0.0.0/:: 等公网绑定)
- 中间件链:mw_ipallow(CIDR 白名单,仅信任 RemoteAddr,默认内网段)→
mw_session(HttpOnly+Secure+SameSite=Strict cookie,Redis 30min 滑动 TTL)
- 登录双因素:argon2id 密码 + RFC6238 TOTP;失败限流与临时锁定;
TOTP 密钥 AES-GCM 加密入库;migration 000008 增补 admins 表;
首个管理员由 cmd/adminctl create 创建(终端输出 otpauth URI/Secret)
- 功能三块(html/template + embed 静态资源,原生 JS 二次确认):
1. 码批次:表单生成→明文仅在本次 CSV 下载出现(不落盘/不入日志);
批次列表 + 整批作废(复用 #3 codes,新增 Store.ListBatches/VoidBatch)
2. 节点操作:列表 + 近期 node_events;replace 经 #14 ProvisionService、
draining/up 经 #5 Lifecycle(二者未就绪→注入 stub,UI 置灰);二次确认 + CSRF
3. audit_log 查看:actor/action/target/时间范围过滤分页;同页查 node_events
- 所有写操作写 audit_log(actor=用户名,meta 不含明文);管理端仅记安全事件
(登录失败/锁定/白名单拦截),不记常规访问日志
- internal/totp 复用包(与 doc/05 用户中心 2FA 同算法,纯标准库)
测试:totp RFC6238 向量、argon2/AES 往返、白名单放行/拦截、会话滑动过期、
登录成功/密码错/TOTP 错/未知用户/锁定、批次 CSV 含明文且 audit 不泄露、
作废/节点操作的二次确认与 CSRF 缺失被拒、mock 断言 service 调用参数、审计过滤。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
104 lines
2.8 KiB
Go
104 lines
2.8 KiB
Go
package codes
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
// BatchInfo summarises a code_batches row with aggregate code counts, for the
|
|
// admin batch-list view. It carries no plaintext — only hashes live in `codes`.
|
|
type BatchInfo struct {
|
|
ID int64
|
|
Channel BatchChannel
|
|
CreatedBy string
|
|
Note string
|
|
CreatedAt time.Time
|
|
Total int
|
|
Redeemed int
|
|
Void int
|
|
Unused int
|
|
}
|
|
|
|
// ListBatches returns code batches newest-first with aggregate counts, plus the
|
|
// total number of batches (for pagination).
|
|
func (s *Store) ListBatches(ctx context.Context, limit, offset int) ([]BatchInfo, int, error) {
|
|
if limit <= 0 || limit > 500 {
|
|
limit = 50
|
|
}
|
|
if offset < 0 {
|
|
offset = 0
|
|
}
|
|
|
|
var total int
|
|
if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM code_batches`).Scan(&total); err != nil {
|
|
return nil, 0, fmt.Errorf("store.ListBatches count: %w", err)
|
|
}
|
|
|
|
rows, err := s.db.QueryContext(ctx,
|
|
`SELECT b.id, b.channel, b.created_by, COALESCE(b.note, ''), b.created_at,
|
|
COUNT(c.id),
|
|
SUM(c.status = 'redeemed'),
|
|
SUM(c.status = 'void'),
|
|
SUM(c.status = 'unused')
|
|
FROM code_batches b
|
|
LEFT JOIN codes c ON c.batch_id = b.id
|
|
GROUP BY b.id, b.channel, b.created_by, b.note, b.created_at
|
|
ORDER BY b.id DESC
|
|
LIMIT ? OFFSET ?`, limit, offset)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("store.ListBatches: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var out []BatchInfo
|
|
for rows.Next() {
|
|
var bi BatchInfo
|
|
// SUM over a possibly-empty group yields NULL; scan into nullable ints.
|
|
var redeemed, void, unused, totalCnt nullInt
|
|
if err := rows.Scan(&bi.ID, &bi.Channel, &bi.CreatedBy, &bi.Note, &bi.CreatedAt,
|
|
&totalCnt, &redeemed, &void, &unused); err != nil {
|
|
return nil, 0, fmt.Errorf("store.ListBatches scan: %w", err)
|
|
}
|
|
bi.Total = totalCnt.val
|
|
bi.Redeemed = redeemed.val
|
|
bi.Void = void.val
|
|
bi.Unused = unused.val
|
|
out = append(out, bi)
|
|
}
|
|
return out, total, rows.Err()
|
|
}
|
|
|
|
// VoidBatch marks every still-unused code in a batch as void and returns the
|
|
// number of codes voided. Already-redeemed codes are left untouched.
|
|
func (s *Store) VoidBatch(ctx context.Context, batchID int64) (int64, error) {
|
|
res, err := s.db.ExecContext(ctx,
|
|
`UPDATE codes SET status = 'void' WHERE batch_id = ? AND status = 'unused'`, batchID)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("store.VoidBatch: %w", err)
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return 0, fmt.Errorf("store.VoidBatch rows: %w", err)
|
|
}
|
|
return n, nil
|
|
}
|
|
|
|
// nullInt scans a possibly-NULL integer aggregate, defaulting to 0.
|
|
type nullInt struct{ val int }
|
|
|
|
func (n *nullInt) Scan(src any) error {
|
|
switch v := src.(type) {
|
|
case nil:
|
|
n.val = 0
|
|
case int64:
|
|
n.val = int(v)
|
|
case []byte:
|
|
_, err := fmt.Sscanf(string(v), "%d", &n.val)
|
|
return err
|
|
default:
|
|
return fmt.Errorf("nullInt: unsupported type %T", src)
|
|
}
|
|
return nil
|
|
}
|