ila/yovision
1
0
Fork 0
Code Issues 14 Pull Requests 14 Actions Packages Projects Releases Wiki Activity

feat: 重建 Sense 认证权限与审计 (#64)

Browse Source
This commit is contained in:
QiuSW
2026-08-14 12:03:10 +08:00
parent c515f00319
commit 0411aa37c5
32 changed files with 509 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sense/server/app/admin/apis/captcha.go
+1 -2
View File
@@ -21,13 +21,12 @@ func (e System) GenerateCaptchaHandler(c *gin.Context) {
e.Error(500, err, "服务初始化失败！")
return
}
id, b64s, answer, err := captcha.DriverDigitFunc()
id, b64s, _, err := captcha.DriverDigitFunc()
if err != nil {
e.Logger.Errorf("DriverDigitFunc error, %s", err.Error())
e.Error(500, err, "验证码获取失败")
return
}
e.Logger.Infof("DriverDigitFunc answer: %s", answer)
e.Custom(gin.H{
"code": 200,
"data": b64s,
Sense/server/app/admin/apis/identity_bootstrap.go
+94
View File
@@ -0,0 +1,94 @@
package apis
import (
"crypto/subtle"
"errors"
"net/http"
"os"
"strings"
"github.com/gin-gonic/gin"
"gorm.io/gorm"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
)
const bootstrapTokenHeader = "X-Sense-Bootstrap-Token"
type bootstrapRequest struct {
Username string `json:"username" binding:"required"`
Password string `json:"password" binding:"required"`
NickName string `json:"nickName"`
}
// Bootstrap creates the first Sense administrator. The one-time authorization
// token is supplied out of band and never accepted in the JSON request body.
func (e System) Bootstrap(c *gin.Context) {
if err := e.MakeContext(c).MakeOrm().Errors; err != nil {
e.Error(http.StatusInternalServerError, err, "安全初始化失败")
return
}
db := e.Orm
var req bootstrapRequest
if err := c.ShouldBindJSON(&req); err != nil {
e.Custom(gin.H{"code": http.StatusBadRequest, "msg": "安全初始化不可用或输入不符合要求"})
return
}
req.Username = strings.TrimSpace(req.Username)
if req.NickName == "" {
req.NickName = req.Username
}
if err := validateBootstrapInput(req); err != nil || !validBootstrapToken(c.GetHeader(bootstrapTokenHeader)) {
handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
return
}
err := db.Transaction(func(tx *gorm.DB) error {
if err := tx.Exec("LOCK TABLE sys_user IN EXCLUSIVE MODE").Error; err != nil {
return err
}
var count int64
if err := tx.Model(&models.SysUser{}).Count(&count).Error; err != nil {
return err
}
if count != 0 {
return errors.New("identity already initialized")
}
var role models.SysRole
if err := tx.Where("role_key = ? AND status = ?", "admin", "2").First(&role).Error; err != nil {
return err
}
return tx.Create(&models.SysUser{
Username: req.Username,
Password: req.Password,
NickName: req.NickName,
RoleId: role.RoleId,
Status: "2",
}).Error
})
if err != nil {
handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
return
}
handler.WriteIdentityAudit(c, "2", "首个管理员创建成功", req.Username)
e.Custom(gin.H{"code": http.StatusOK, "msg": "管理员创建成功"})
}
func validateBootstrapInput(req bootstrapRequest) error {
if len(req.Username) < 3 || len(req.Username) > 64 || strings.ContainsAny(req.Username, " \t\r\n") {
return errors.New("invalid username")
}
return service.ValidatePassword(req.Password)
}
func validBootstrapToken(candidate string) bool {
expected := os.Getenv("SENSE_BOOTSTRAP_TOKEN")
if len(expected) < 32 || len(candidate) != len(expected) {
return false
}
return subtle.ConstantTimeCompare([]byte(candidate), []byte(expected)) == 1
}
Sense/server/app/admin/apis/identity_bootstrap_test.go
+33
View File
@@ -0,0 +1,33 @@
package apis
import "testing"
func TestValidateBootstrapInput(t *testing.T) {
if err := validateBootstrapInput(bootstrapRequest{Username: "admin", Password: "abcdef"}); err != nil {
t.Fatalf("expected valid bootstrap input: %v", err)
}
for _, req := range []bootstrapRequest{
{Username: "ab", Password: "abcdef"},
{Username: "bad name", Password: "abcdef"},
{Username: "admin", Password: "abcde"},
} {
if err := validateBootstrapInput(req); err == nil {
t.Fatalf("expected invalid bootstrap input: %+v", req)
}
}
}
func TestValidBootstrapToken(t *testing.T) {
const token = "0123456789abcdef0123456789abcdef"
t.Setenv("SENSE_BOOTSTRAP_TOKEN", token)
if !validBootstrapToken(token) {
t.Fatal("expected configured token to be accepted")
}
if validBootstrapToken("wrong") {
t.Fatal("expected wrong token to be rejected")
}
t.Setenv("SENSE_BOOTSTRAP_TOKEN", "short")
if validBootstrapToken("short") {
t.Fatal("expected short configured token to be rejected")
}
}
Sense/server/app/admin/apis/sys_user.go
+19 -5
View File
@@ -1,9 +1,8 @@
package apis
import (
"github.com/gin-gonic/gin/binding"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
"golang.org/x/crypto/bcrypt"
"github.com/gin-gonic/gin/binding"
"net/http"
"github.com/gin-gonic/gin"
@@ -15,6 +14,7 @@ import (
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service/dto"
"git.ilapage.cn/ila/yovision/Sense/server/common/actions"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
)
type SysUser struct {
@@ -113,6 +113,10 @@ func (e SysUser) Insert(c *gin.Context) {
e.Error(500, err, err.Error())
return
}
if err = service.ValidatePassword(req.Password); err != nil {
e.Error(http.StatusBadRequest, err, err.Error())
return
}
// 设置创建人
req.SetCreateBy(user.GetUserId(c))
err = s.Insert(&req)
@@ -306,6 +310,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
e.Error(500, err, err.Error())
return
}
if err = service.ValidatePassword(req.Password); err != nil {
handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
e.Error(http.StatusBadRequest, err, err.Error())
return
}
req.SetUpdateBy(user.GetUserId(c))
@@ -314,9 +323,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
err = s.ResetPwd(&req, p)
if err != nil {
handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
e.Logger.Error(err)
return
}
handler.WriteIdentityAudit(c, "2", "管理员重置密码成功", user.GetUserName(c))
e.OK(req.GetId(), "更新成功")
}
@@ -346,18 +357,21 @@ func (e SysUser) UpdatePwd(c *gin.Context) {
// 数据权限检查
p := actions.GetPermissionFromContext(c)
var hash []byte
if hash, err = bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost); err != nil {
req.NewPassword = string(hash)
if err = service.ValidatePassword(req.NewPassword); err != nil {
handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
e.Error(http.StatusBadRequest, err, err.Error())
return
}
err = s.UpdatePwd(user.GetUserId(c), req.OldPassword, req.NewPassword, p)
if err != nil {
handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
e.Logger.Error(err)
e.Error(http.StatusForbidden, err, "密码修改失败")
return
}
handler.WriteIdentityAudit(c, "2", "修改密码成功", user.GetUserName(c))
e.OK(nil, "密码修改成功")
}
Sense/server/app/admin/router/init_router.go
+1 -1
View File
@@ -3,10 +3,10 @@ package router
import (
"os"
common "git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
log "github.com/go-admin-team/go-admin-core/logger"
"github.com/go-admin-team/go-admin-core/sdk"
common "git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
)
// InitRouter 路由初始化，不要怀疑，这里用到了
Sense/server/app/admin/router/sys_api.go
-1
View File
@@ -9,7 +9,6 @@ import (
)
func init() {
routerCheckRole = append(routerCheckRole, registerSysApiRouter)
}
// registerSysApiRouter
Sense/server/app/admin/router/sys_config.go
-1
View File
@@ -9,7 +9,6 @@ import (
)
func init() {
routerCheckRole = append(routerCheckRole, registerSysConfigRouter)
}
// 需认证的路由代码
Sense/server/app/admin/router/sys_dept.go
+4 -4
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -24,9 +24,9 @@ func registerSysDeptRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
r.DELETE("", api.Delete)
}
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc())
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
{
r1.GET("/deptTree", api.Get2Tree)
}
}
}
Sense/server/app/admin/router/sys_dict.go
+2 -2
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
Sense/server/app/admin/router/sys_login_log.go
+3 -3
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -21,4 +21,4 @@ func registerSysLoginLogRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMi
r.GET("/:id", api.Get)
r.DELETE("", api.Delete)
}
}
}
Sense/server/app/admin/router/sys_menu.go
+3 -3
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -30,4 +30,4 @@ func registerSysMenuRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
//r1.GET("/menuids", api.GetMenuIDS)
}
}
}
Sense/server/app/admin/router/sys_opera_log.go
+3 -3
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -20,4 +20,4 @@ func registerSysOperaLogRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMi
r.GET("/:id", api.Get)
r.DELETE("", api.Delete)
}
}
}
Sense/server/app/admin/router/sys_post.go
+3 -3
View File
@@ -1,10 +1,10 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -22,4 +22,4 @@ func registerSyPostRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddlew
r.PUT("/:id", api.Update)
r.DELETE("", api.Delete)
}
}
}
Sense/server/app/admin/router/sys_role.go
+1 -1
View File
@@ -23,7 +23,7 @@ func registerSysRoleRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
r.PUT("/:id", api.Update)
r.DELETE("", api.Delete)
}
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc())
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
{
r1.PUT("/role-status", api.Update2Status)
r1.PUT("/roledatascope", api.Update2DataScope)
Sense/server/app/admin/router/sys_router.go
+3 -2
View File
@@ -68,6 +68,8 @@ func sysCheckRoleRouterInit(r *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
v1 := r.Group("/api/v1")
{
v1.GET("/captcha", apis.System{}.GenerateCaptchaHandler)
v1.POST("/bootstrap", apis.System{}.Bootstrap)
v1.POST("/login", authMiddleware.LoginHandler)
// Refresh time can be longer than token timeout
v1.GET("/refresh_token", authMiddleware.RefreshHandler)
@@ -81,8 +83,7 @@ func registerBaseRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddlewar
v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
{
v1auth.GET("/roleMenuTreeselect/:roleId", api.GetMenuTreeSelect)
//v1.GET("/menuTreeselect", api.GetMenuTreeSelect)
v1auth.GET("/roleDeptTreeselect/:roleId", api2.GetDeptTreeRoleSelect)
v1auth.POST("/logout", handler.LogOut)
}
v1.Group("").Use(authMiddleware.MiddlewareFunc()).POST("/logout", handler.LogOut)
}
Sense/server/app/admin/router/sys_user.go
+9 -6
View File
@@ -1,11 +1,11 @@
package router
import (
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
"git.ilapage.cn/ila/yovision/Sense/server/common/actions"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
"github.com/gin-gonic/gin"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)
func init() {
@@ -24,16 +24,19 @@ func registerSysUserRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
r.DELETE("", api.Delete)
}
user := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()).Use(actions.PermissionAction())
user := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(actions.PermissionAction())
{
user.GET("/profile", api.GetProfile)
user.POST("/avatar", api.InsetAvatar)
user.PUT("/pwd/set", api.UpdatePwd)
user.PUT("/pwd/reset", api.ResetPwd)
user.PUT("/status", api.UpdateStatus)
}
userAdmin := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()).Use(actions.PermissionAction())
{
userAdmin.PUT("/pwd/reset", api.ResetPwd)
userAdmin.PUT("/status", api.UpdateStatus)
}
v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc())
{
v1auth.GET("/getinfo", api.GetInfo)
}
}
}
Sense/server/app/admin/service/password_policy.go
+23
View File
@@ -0,0 +1,23 @@
package service
import (
"errors"
"unicode/utf8"
)
const (
MinPasswordLength = 6
MaxPasswordBytes = 72
)
// ValidatePassword enforces the frozen Sense policy. Lowercase-only passwords
// are valid; complexity rules are intentionally not added here.
func ValidatePassword(password string) error {
if utf8.RuneCountInString(password) < MinPasswordLength {
return errors.New("密码至少需要 6 个字符")
}
if len(password) > MaxPasswordBytes {
return errors.New("密码不能超过 72 个字节")
}
return nil
}
Sense/server/app/admin/service/password_policy_test.go
+26
View File
@@ -0,0 +1,26 @@
package service
import (
"strings"
"testing"
)
func TestValidatePassword(t *testing.T) {
tests := []struct {
name string
value string
wantErr bool
}{
{name: "lowercase accepted", value: "chengma", wantErr: false},
{name: "six characters accepted", value: "abcdef", wantErr: false},
{name: "too short", value: "abcde", wantErr: true},
{name: "bcrypt byte limit", value: strings.Repeat("a", MaxPasswordBytes+1), wantErr: true},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := ValidatePassword(tt.value); (got != nil) != tt.wantErr {
t.Fatalf("ValidatePassword() error = %v, wantErr %v", got, tt.wantErr)
}
})
}
}
Sense/server/app/admin/service/sys_role.go
+8 -6
View File
@@ -103,12 +103,13 @@ func (e *SysRole) Insert(c *dto.SysRoleInsertReq, cb *casbin.SyncedEnforcer) err
return err
}
mp := make(map[string]interface{}, 0)
mp := make(map[string]struct{})
polices := make([][]string, 0)
for _, menu := range dataMenu {
for _, api := range menu.SysApi {
if mp[data.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
mp[data.RoleKey+"-"+api.Path+"-"+api.Action] = ""
key := data.RoleKey + "-" + api.Path + "-" + api.Action
if _, exists := mp[key]; !exists {
mp[key] = struct{}{}
polices = append(polices, []string{data.RoleKey, api.Path, api.Action})
}
}
@@ -169,12 +170,13 @@ func (e *SysRole) Update(c *dto.SysRoleUpdateReq, cb *casbin.SyncedEnforcer) err
e.Log.Errorf("delete policy error:%s", err)
return err
}
mp := make(map[string]interface{}, 0)
mp := make(map[string]struct{})
polices := make([][]string, 0)
for _, menu := range mlist {
for _, api := range menu.SysApi {
if mp[model.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
mp[model.RoleKey+"-"+api.Path+"-"+api.Action] = ""
key := model.RoleKey + "-" + api.Path + "-" + api.Action
if _, exists := mp[key]; !exists {
mp[key] = struct{}{}
//_, err = cb.AddNamedPolicy("p", model.RoleKey, api.Path, api.Action)
polices = append(polices, []string{model.RoleKey, api.Path, api.Action})
}
Sense/server/app/admin/service/sys_user.go
+5 -2
View File
@@ -161,6 +161,9 @@ func (e *SysUser) UpdateStatus(c *dto.UpdateSysUserStatusReq, p *actions.DataPer
// ResetPwd 重置用户密码
func (e *SysUser) ResetPwd(c *dto.ResetSysUserPwdReq, p *actions.DataPermission) error {
var err error
if err = ValidatePassword(c.Password); err != nil {
return err
}
var model models.SysUser
db := e.Orm.Scopes(
actions.Permission(model.TableName(), p),
@@ -204,8 +207,8 @@ func (e *SysUser) Remove(c *dto.SysUserById, p *actions.DataPermission) error {
func (e *SysUser) UpdatePwd(id int, oldPassword, newPassword string, p *actions.DataPermission) error {
var err error
if newPassword == "" {
return nil
if err = ValidatePassword(newPassword); err != nil {
return err
}
c := &models.SysUser{}
Sense/server/cmd/migrate/migration/version/2026081412000_identity.go
+124
View File
@@ -0,0 +1,124 @@
package version
import (
"runtime"
"gorm.io/gorm"
"gorm.io/gorm/clause"
"git.ilapage.cn/ila/yovision/Sense/server/cmd/migrate/migration"
"git.ilapage.cn/ila/yovision/Sense/server/cmd/migrate/migration/models"
common "git.ilapage.cn/ila/yovision/Sense/server/common/models"
)
type identityRoleDefinition struct {
name string
key string
sort int
menuIDs []int
policies [][2]string
}
type identityCasbinRule struct {
ID uint `gorm:"primaryKey;autoIncrement"`
Ptype string `gorm:"size:512;uniqueIndex:unique_index"`
V0 string `gorm:"size:512;uniqueIndex:unique_index"`
V1 string `gorm:"size:512;uniqueIndex:unique_index"`
V2 string `gorm:"size:512;uniqueIndex:unique_index"`
V3 string `gorm:"size:512;uniqueIndex:unique_index"`
V4 string `gorm:"size:512;uniqueIndex:unique_index"`
V5 string `gorm:"size:512;uniqueIndex:unique_index"`
}
func (identityCasbinRule) TableName() string { return "casbin_rule" }
func init() {
_, fileName, _, _ := runtime.Caller(0)
migration.Migrate.SetVersion(migration.GetFilename(fileName), migrateSenseIdentityBaseline)
}
func migrateSenseIdentityBaseline(db *gorm.DB, version string) error {
return db.Transaction(func(tx *gorm.DB) error {
if err := tx.AutoMigrate(&identityCasbinRule{}); err != nil {
return err
}
resetPasswordMenu, err := ensureIdentityButton(tx, "SenseResetPassword", "重置用户密码", "admin:sysUser:resetPassword", 154)
if err != nil {
return err
}
changeStatusMenu, err := ensureIdentityButton(tx, "SenseChangeUserStatus", "启停用户", "admin:sysUser:edit", 155)
if err != nil {
return err
}
definitions := []identityRoleDefinition{
{name: "系统管理员", key: "admin", sort: 1},
{
name: "实施运维", key: "implementation_operator", sort: 10,
menuIDs: []int{2, 211, 212, 216, 248, 250},
policies: [][2]string{{"/api/v1/sys-login-log", "GET"}, {"/api/v1/sys-login-log/:id", "GET"}, {"/api/v1/sys-opera-log", "GET"}, {"/api/v1/sys-opera-log/:id", "GET"}, {"/api/v1/dict-data/option-select", "GET"}},
},
{
name: "站点管理员", key: "site_admin", sort: 20,
menuIDs: []int{2, 3, 43, 44, 45, resetPasswordMenu.MenuId, changeStatusMenu.MenuId},
policies: [][2]string{{"/api/v1/sys-user", "GET"}, {"/api/v1/sys-user/:id", "GET"}, {"/api/v1/sys-user", "POST"}, {"/api/v1/sys-user", "PUT"}, {"/api/v1/user/pwd/reset", "PUT"}, {"/api/v1/user/status", "PUT"}, {"/api/v1/deptTree", "GET"}, {"/api/v1/post", "GET"}, {"/api/v1/role", "GET"}, {"/api/v1/dict-data/option-select", "GET"}},
},
{name: "只读用户", key: "viewer", sort: 30},
}
for _, definition := range definitions {
role, err := ensureIdentityRole(tx, definition)
if err != nil {
return err
}
if err = attachIdentityMenus(tx, &role, definition.menuIDs); err != nil {
return err
}
for _, policy := range definition.policies {
rule := identityCasbinRule{Ptype: "p", V0: definition.key, V1: policy[0], V2: policy[1]}
if err = tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&rule).Error; err != nil {
return err
}
}
}
return tx.Create(&common.Migration{Version: version}).Error
})
}
func ensureIdentityRole(tx *gorm.DB, definition identityRoleDefinition) (models.SysRole, error) {
var role models.SysRole
err := tx.Where("role_key = ?", definition.key).First(&role).Error
if err != nil && err != gorm.ErrRecordNotFound {
return role, err
}
if err == gorm.ErrRecordNotFound {
role = models.SysRole{RoleName: definition.name, RoleKey: definition.key, RoleSort: definition.sort, Status: "2", Admin: definition.key == "admin", DataScope: "1", Remark: "Sense 内置最小权限角色"}
return role, tx.Create(&role).Error
}
err = tx.Model(&role).Updates(map[string]interface{}{"role_name": definition.name, "status": "2", "role_sort": definition.sort, "admin": definition.key == "admin"}).Error
return role, err
}
func ensureIdentityButton(tx *gorm.DB, name, title, permission string, apiID int) (models.SysMenu, error) {
menu := models.SysMenu{MenuName: name, Title: title, MenuType: "F", Action: "PUT", Permission: permission, ParentId: 3, Paths: "/0/2/3", Sort: 25, Visible: "1", IsFrame: "1"}
if err := tx.Where("menu_name = ?", name).FirstOrCreate(&menu).Error; err != nil {
return menu, err
}
var api models.SysApi
if err := tx.First(&api, apiID).Error; err != nil {
return menu, err
}
return menu, tx.Model(&menu).Association("SysApi").Append(&api)
}
func attachIdentityMenus(tx *gorm.DB, role *models.SysRole, menuIDs []int) error {
if len(menuIDs) == 0 {
return nil
}
var menus []models.SysMenu
if err := tx.Where("menu_id IN ?", menuIDs).Find(&menus).Error; err != nil {
return err
}
return tx.Model(role).Association("SysMenu").Append(&menus)
}
Sense/server/common/middleware/auth.go
+4 -4
View File
@@ -3,9 +3,9 @@ package middleware
import (
"time"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
"github.com/go-admin-team/go-admin-core/sdk/config"
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
)
// AuthInit jwt验证new
@@ -19,7 +19,7 @@ func AuthInit() (*jwt.GinJWTMiddleware, error) {
}
}
return jwt.New(&jwt.GinJWTMiddleware{
Realm: "test zone",
Realm: "Sense",
Key: []byte(config.JwtConfig.Secret),
Timeout: timeout,
MaxRefresh: time.Hour,
@@ -28,9 +28,9 @@ func AuthInit() (*jwt.GinJWTMiddleware, error) {
Authenticator: handler.Authenticator,
Authorizator: handler.Authorizator,
Unauthorized: handler.Unauthorized,
TokenLookup: "header: Authorization, query: token, cookie: jwt",
TokenLookup: "header: Authorization, cookie: sense_session",
TokenHeadName: "Bearer",
TimeFunc: time.Now,
})
}
}
Sense/server/common/middleware/handler/auth.go
+37 -28
View File
@@ -6,7 +6,6 @@ import (
"net/http"
"github.com/gin-gonic/gin"
"github.com/go-admin-team/go-admin-core/sdk"
"github.com/go-admin-team/go-admin-core/sdk/api"
"github.com/go-admin-team/go-admin-core/sdk/config"
"github.com/go-admin-team/go-admin-core/sdk/pkg"
@@ -15,7 +14,6 @@ import (
"github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth/user"
"github.com/go-admin-team/go-admin-core/sdk/pkg/response"
"github.com/mssola/user_agent"
"git.ilapage.cn/ila/yovision/Sense/server/common/global"
)
func PayloadFunc(data interface{}) jwt.MapClaims {
@@ -28,7 +26,7 @@ func PayloadFunc(data interface{}) jwt.MapClaims {
jwt.RoleKey: r.RoleKey,
jwt.NiceKey: u.Username,
jwt.DataScopeKey: r.DataScope,
jwt.RoleNameKey: r.RoleName,
jwt.RoleNameKey: r.RoleKey,
}
}
return jwt.MapClaims{}
@@ -108,36 +106,44 @@ func Authenticator(c *gin.Context) (interface{}, error) {
// LoginLogToDB Write log to database
func LoginLogToDB(c *gin.Context, status string, msg string, username string) {
if !config.LoggerConfig.EnabledDB {
WriteIdentityAudit(c, status, msg, username)
}
// WriteIdentityAudit persists identity/security events synchronously. It never
// records request bodies, credentials, tokens, captcha answers, or cookies.
func WriteIdentityAudit(c *gin.Context, status string, msg string, username string) {
log := api.GetRequestLogger(c)
db, err := pkg.GetOrm(c)
if err != nil {
log.Errorf("identity audit database unavailable: %s", err.Error())
return
}
log := api.GetRequestLogger(c)
l := make(map[string]interface{})
ua := user_agent.New(c.Request.UserAgent())
l["ipaddr"] = common.GetClientIP(c)
l["loginLocation"] = "" // pkg.GetLocation(common.GetClientIP(c),gaConfig.ExtConfig.AMap.Key)
l["loginTime"] = pkg.GetCurrentTime()
l["status"] = status
l["remark"] = c.Request.UserAgent()
browserName, browserVersion := ua.Browser()
l["browser"] = browserName + " " + browserVersion
l["os"] = ua.OS()
l["platform"] = ua.Platform()
l["username"] = username
l["msg"] = msg
q := sdk.Runtime.GetMemoryQueue(c.Request.Host)
message, err := sdk.Runtime.GetStreamMessage("", global.LoginLog, l)
if err != nil {
log.Errorf("GetStreamMessage error, %s", err.Error())
//日志报错错误，不中断请求
} else {
err = q.Append(message)
if err != nil {
log.Errorf("Append message error, %s", err.Error())
}
l := models.SysLoginLog{
Username: truncateAuditText(username, 128),
Status: status,
Ipaddr: truncateAuditText(common.GetClientIP(c), 255),
LoginLocation: "",
Browser: truncateAuditText(browserName+" "+browserVersion, 255),
Os: truncateAuditText(ua.OS(), 255),
Platform: truncateAuditText(ua.Platform(), 255),
LoginTime: pkg.GetCurrentTime(),
Remark: truncateAuditText(c.Request.Method+" "+c.FullPath(), 255),
Msg: truncateAuditText(msg, 255),
}
if err = db.Create(&l).Error; err != nil {
log.Errorf("identity audit write failed: %s", err.Error())
}
}
func truncateAuditText(value string, limit int) string {
runes := []rune(value)
if len(runes) <= limit {
return value
}
return string(runes[:limit])
}
// LogOut
@@ -164,7 +170,7 @@ func Authorizator(data interface{}, c *gin.Context) bool {
if v, ok := data.(map[string]interface{}); ok {
u, _ := v["user"].(models.SysUser)
r, _ := v["role"].(models.SysRole)
c.Set("role", r.RoleName)
c.Set("role", r.RoleKey)
c.Set("roleIds", r.RoleId)
c.Set("userId", u.UserId)
c.Set("userName", u.Username)
@@ -175,6 +181,9 @@ func Authorizator(data interface{}, c *gin.Context) bool {
}
func Unauthorized(c *gin.Context, code int, message string) {
if c.FullPath() != "/api/v1/login" {
WriteIdentityAudit(c, "1", "未认证访问被拒绝", "")
}
c.JSON(http.StatusOK, gin.H{
"code": code,
"msg": message,
Sense/server/common/middleware/handler/auth_test.go
+12
View File
@@ -0,0 +1,12 @@
package handler
import "testing"
func TestTruncateAuditText(t *testing.T) {
if got := truncateAuditText("中文审计记录", 3); got != "中文审" {
t.Fatalf("unexpected truncation: %q", got)
}
if got := truncateAuditText("short", 10); got != "short" {
t.Fatalf("unexpected unchanged value: %q", got)
}
}
Sense/server/common/middleware/logger.go
+44 -1
View File
@@ -95,11 +95,54 @@ func LoggerToFile() gin.HandlerFunc {
log.Fields(map[string]interface{}{})
}()
if c.Request.Method != "OPTIONS" && config.LoggerConfig.EnabledDB && statusCode != 404 {
SetDBOperLog(c, clientIP, statusCode, reqUri, reqMethod, latencyTime, body, result, statusBus)
SetDBOperLog(c, clientIP, statusCode, reqUri, reqMethod, latencyTime, sanitizeAuditJSON(body), sanitizeAuditJSON(result), statusBus)
}
}
}
func sanitizeAuditJSON(value string) string {
if strings.TrimSpace(value) == "" {
return ""
}
var decoded interface{}
if err := json.Unmarshal([]byte(value), &decoded); err != nil {
return "[内容已隐藏]"
}
redactAuditValue(decoded)
encoded, err := json.Marshal(decoded)
if err != nil {
return "[内容已隐藏]"
}
return string(encoded)
}
func redactAuditValue(value interface{}) {
switch current := value.(type) {
case map[string]interface{}:
for key, item := range current {
if isSensitiveAuditKey(key) {
current[key] = "[已隐藏]"
continue
}
redactAuditValue(item)
}
case []interface{}:
for _, item := range current {
redactAuditValue(item)
}
}
}
func isSensitiveAuditKey(key string) bool {
normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
switch normalized {
case "password", "oldpassword", "newpassword", "token", "refreshtoken", "secret", "code", "uuid":
return true
default:
return false
}
}
// SetDBOperLog 写入操作日志表 fixme 该方法后续即将弃用
func SetDBOperLog(c *gin.Context, clientIP string, statusCode int, reqUri string, reqMethod string, latencyTime time.Duration, body string, result string, status int) {
Sense/server/common/middleware/logger_test.go
+25
View File
@@ -0,0 +1,25 @@
package middleware
import (
"strings"
"testing"
)
func TestSanitizeAuditJSON(t *testing.T) {
input := `{"username":"operator","password":"secret-value","nested":{"newPassword":"another-secret"},"token":"jwt-value"}`
got := sanitizeAuditJSON(input)
for _, secret := range []string{"secret-value", "another-secret", "jwt-value"} {
if strings.Contains(got, secret) {
t.Fatalf("sensitive value leaked: %s", got)
}
}
if !strings.Contains(got, "operator") {
t.Fatalf("non-sensitive context was unexpectedly removed: %s", got)
}
}
func TestSanitizeAuditJSONRejectsUnstructuredBodies(t *testing.T) {
if got := sanitizeAuditJSON("password=secret-value"); strings.Contains(got, "secret-value") {
t.Fatalf("unstructured body leaked: %s", got)
}
}
Sense/server/common/middleware/permission.go
+9
View File
@@ -4,6 +4,7 @@ import (
"github.com/casbin/casbin/v2/util"
"net/http"
"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
"github.com/gin-gonic/gin"
"github.com/go-admin-team/go-admin-core/sdk"
"github.com/go-admin-team/go-admin-core/sdk/api"
@@ -49,6 +50,7 @@ func AuthCheckRole() gin.HandlerFunc {
c.Next()
} else {
log.Warnf("isTrue: %v role: %s method: %s path: %s message: %s", res, v["rolekey"], c.Request.Method, c.Request.URL.Path, "当前request无权限，请管理员确认！")
handler.WriteIdentityAudit(c, "1", "拒绝访问 "+c.Request.Method+" "+c.FullPath(), userNameFromClaims(v))
c.JSON(http.StatusOK, gin.H{
"code": 403,
"msg": "对不起，您没有该接口访问权限，请联系管理员",
@@ -59,3 +61,10 @@ func AuthCheckRole() gin.HandlerFunc {
}
}
func userNameFromClaims(claims jwtauth.MapClaims) string {
if value, ok := claims["nice"].(string); ok {
return value
}
return ""
}
Sense/server/common/middleware/settings.go
+1 -35
View File
@@ -6,38 +6,4 @@ type UrlInfo struct {
}
// CasbinExclude casbin 排除的路由列表
var CasbinExclude = []UrlInfo{
{Url: "/api/v1/dict/type-option-select", Method: "GET"},
{Url: "/api/v1/dict-data/option-select", Method: "GET"},
{Url: "/api/v1/deptTree", Method: "GET"},
{Url: "/api/v1/db/tables/page", Method: "GET"},
{Url: "/api/v1/db/columns/page", Method: "GET"},
{Url: "/api/v1/gen/toproject/:tableId", Method: "GET"},
{Url: "/api/v1/gen/todb/:tableId", Method: "GET"},
{Url: "/api/v1/gen/tabletree", Method: "GET"},
{Url: "/api/v1/gen/preview/:tableId", Method: "GET"},
{Url: "/api/v1/gen/apitofile/:tableId", Method: "GET"},
{Url: "/api/v1/getCaptcha", Method: "GET"},
{Url: "/api/v1/getinfo", Method: "GET"},
{Url: "/api/v1/menuTreeselect", Method: "GET"},
{Url: "/api/v1/menurole", Method: "GET"},
{Url: "/api/v1/menuids", Method: "GET"},
{Url: "/api/v1/roleMenuTreeselect/:roleId", Method: "GET"},
{Url: "/api/v1/roleDeptTreeselect/:roleId", Method: "GET"},
{Url: "/api/v1/refresh_token", Method: "GET"},
{Url: "/api/v1/configKey/:configKey", Method: "GET"},
{Url: "/api/v1/app-config", Method: "GET"},
{Url: "/api/v1/user/profile", Method: "GET"},
{Url: "/info", Method: "GET"},
{Url: "/api/v1/login", Method: "POST"},
{Url: "/api/v1/logout", Method: "POST"},
{Url: "/api/v1/user/avatar", Method: "POST"},
{Url: "/api/v1/user/pwd", Method: "PUT"},
{Url: "/api/v1/metrics", Method: "GET"},
{Url: "/api/v1/health", Method: "GET"},
{Url: "/", Method: "GET"},
{Url: "/api/v1/server-monitor", Method: "GET"},
{Url: "/api/v1/public/uploadFile", Method: "POST"},
{Url: "/api/v1/user/pwd/set", Method: "PUT"},
{Url: "/api/v1/sys-user", Method: "PUT"},
}
var CasbinExclude = []UrlInfo{}
Sense/server/config/identity.env.example
+3
View File
@@ -0,0 +1,3 @@
# 首次创建管理员时临时设置为至少 32 个字符的随机值。
# 初始化成功后应从运行环境移除；不要把真实值写入本文件或仓库。
SENSE_BOOTSTRAP_TOKEN=
Sense/server/config/settings.yml
+1 -1
View File
@@ -19,7 +19,7 @@ settings:
stdout: '' #控制台日志，启用后，不输出到文件
# 日志等级, trace, debug, info, warn, error, fatal
level: info
# 数据库日志开关
# 通用操作数据库日志开关；登录、退出、密码和拒绝访问等身份审计始终写入数据库。
enableddb: false
jwt:
# 必填。生产环境至少 32 个字符；不得提交真实值。
Sense/ui/src/utils/auth.js
+1 -1
View File
@@ -1,6 +1,6 @@
import Cookies from 'js-cookie'
const TokenKey = 'Admin-Token'
const TokenKey = 'Sense-Admin-Token'
export function getToken() {
return Cookies.get(TokenKey)
Sense/ui/src/views/admin/sys-user/index.vue
+7 -8
View File
@@ -353,8 +353,6 @@ export default {
open: false,
// 部门名称
deptName: undefined,
// 默认密码
initPassword: undefined,
// 日期范围
dateRange: [],
// 状态数据字典
@@ -400,7 +398,10 @@ export default {
username: [{ required: true, message: '用户名称不能为空', trigger: 'blur' }],
nickName: [{ required: true, message: '用户昵称不能为空', trigger: 'blur' }],
deptId: [{ required: true, message: '归属部门不能为空', trigger: 'blur' }],
password: [{ required: true, message: '用户密码不能为空', trigger: 'blur' }],
password: [
{ required: true, message: '用户密码不能为空', trigger: 'blur' },
{ min: 6, max: 72, message: '密码长度为 6 至 72 个字符', trigger: 'blur' }
],
email: [
{ required: true, message: '邮箱地址不能为空', trigger: 'blur' },
{ type: 'email', message: "'请输入正确的邮箱地址", trigger: ['blur', 'change'] }
@@ -427,9 +428,6 @@ export default {
this.getDicts('sys_user_sex').then(response => {
this.sexOptions = response.data
})
this.getConfigKey('sys_user_initPassword').then(response => {
this.initPassword = response.data.configValue
})
},
methods: {
/** 查询用户列表 */
@@ -556,7 +554,6 @@ export default {
})
this.open = true
this.title = '添加用户'
this.form.password = this.initPassword
},
/** 修改按钮操作 */
handleUpdate(row) {
@@ -580,7 +577,9 @@ export default {
handleResetPwd(row) {
this.$prompt('请输入"' + row.username + '"的新密码', '提示', {
confirmButtonText: '确定',
cancelButtonText: '取消'
cancelButtonText: '取消',
inputPattern: /^.{6,72}$/,
inputErrorMessage: '密码长度为 6 至 72 个字符'
}).then(({ value }) => {
resetUserPwd(row.userId, value).then(response => {
if (response.code === 200) {