Files
pangolin/server/internal/codes/admin_support.go
T
wangjia 6e99e32285 feat(admin): 管理端最小后台(独立监听 + 白名单 + 2FA)tsk_SCMtcGF4F434
实现「一个二进制三个监听」中的管理端:

- 独立监听 ADMIN_LISTEN(默认 127.0.0.1:9443,FromEnv 拒绝 0.0.0.0/:: 等公网绑定)
- 中间件链:mw_ipallow(CIDR 白名单,仅信任 RemoteAddr,默认内网段)→
  mw_session(HttpOnly+Secure+SameSite=Strict cookie,Redis 30min 滑动 TTL)
- 登录双因素:argon2id 密码 + RFC6238 TOTP;失败限流与临时锁定;
  TOTP 密钥 AES-GCM 加密入库;migration 000008 增补 admins 表;
  首个管理员由 cmd/adminctl create 创建(终端输出 otpauth URI/Secret)
- 功能三块(html/template + embed 静态资源,原生 JS 二次确认):
  1. 码批次:表单生成→明文仅在本次 CSV 下载出现(不落盘/不入日志);
     批次列表 + 整批作废(复用 #3 codes,新增 Store.ListBatches/VoidBatch)
  2. 节点操作:列表 + 近期 node_events;replace 经 #14 ProvisionService、
     draining/up 经 #5 Lifecycle(二者未就绪→注入 stub,UI 置灰);二次确认 + CSRF
  3. audit_log 查看:actor/action/target/时间范围过滤分页;同页查 node_events
- 所有写操作写 audit_log(actor=用户名,meta 不含明文);管理端仅记安全事件
  (登录失败/锁定/白名单拦截),不记常规访问日志
- internal/totp 复用包(与 doc/05 用户中心 2FA 同算法,纯标准库)

测试:totp RFC6238 向量、argon2/AES 往返、白名单放行/拦截、会话滑动过期、
登录成功/密码错/TOTP 错/未知用户/锁定、批次 CSV 含明文且 audit 不泄露、
作废/节点操作的二次确认与 CSRF 缺失被拒、mock 断言 service 调用参数、审计过滤。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 14:49:32 +08:00

104 lines
2.8 KiB
Go

package codes
import (
"context"
"fmt"
"time"
)
// BatchInfo summarises a code_batches row with aggregate code counts, for the
// admin batch-list view. It carries no plaintext — only hashes live in `codes`.
type BatchInfo struct {
ID int64
Channel BatchChannel
CreatedBy string
Note string
CreatedAt time.Time
Total int
Redeemed int
Void int
Unused int
}
// ListBatches returns code batches newest-first with aggregate counts, plus the
// total number of batches (for pagination).
func (s *Store) ListBatches(ctx context.Context, limit, offset int) ([]BatchInfo, int, error) {
if limit <= 0 || limit > 500 {
limit = 50
}
if offset < 0 {
offset = 0
}
var total int
if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM code_batches`).Scan(&total); err != nil {
return nil, 0, fmt.Errorf("store.ListBatches count: %w", err)
}
rows, err := s.db.QueryContext(ctx,
`SELECT b.id, b.channel, b.created_by, COALESCE(b.note, ''), b.created_at,
COUNT(c.id),
SUM(c.status = 'redeemed'),
SUM(c.status = 'void'),
SUM(c.status = 'unused')
FROM code_batches b
LEFT JOIN codes c ON c.batch_id = b.id
GROUP BY b.id, b.channel, b.created_by, b.note, b.created_at
ORDER BY b.id DESC
LIMIT ? OFFSET ?`, limit, offset)
if err != nil {
return nil, 0, fmt.Errorf("store.ListBatches: %w", err)
}
defer rows.Close()
var out []BatchInfo
for rows.Next() {
var bi BatchInfo
// SUM over a possibly-empty group yields NULL; scan into nullable ints.
var redeemed, void, unused, totalCnt nullInt
if err := rows.Scan(&bi.ID, &bi.Channel, &bi.CreatedBy, &bi.Note, &bi.CreatedAt,
&totalCnt, &redeemed, &void, &unused); err != nil {
return nil, 0, fmt.Errorf("store.ListBatches scan: %w", err)
}
bi.Total = totalCnt.val
bi.Redeemed = redeemed.val
bi.Void = void.val
bi.Unused = unused.val
out = append(out, bi)
}
return out, total, rows.Err()
}
// VoidBatch marks every still-unused code in a batch as void and returns the
// number of codes voided. Already-redeemed codes are left untouched.
func (s *Store) VoidBatch(ctx context.Context, batchID int64) (int64, error) {
res, err := s.db.ExecContext(ctx,
`UPDATE codes SET status = 'void' WHERE batch_id = ? AND status = 'unused'`, batchID)
if err != nil {
return 0, fmt.Errorf("store.VoidBatch: %w", err)
}
n, err := res.RowsAffected()
if err != nil {
return 0, fmt.Errorf("store.VoidBatch rows: %w", err)
}
return n, nil
}
// nullInt scans a possibly-NULL integer aggregate, defaulting to 0.
type nullInt struct{ val int }
func (n *nullInt) Scan(src any) error {
switch v := src.(type) {
case nil:
n.val = 0
case int64:
n.val = int(v)
case []byte:
_, err := fmt.Sscanf(string(v), "%d", &n.val)
return err
default:
return fmt.Errorf("nullInt: unsupported type %T", src)
}
return nil
}