feat: 重建 Sense 认证权限与审计 (#64)

Sense/server/app/admin/apis/captcha.go

@@ -21,13 +21,12 @@ func (e System) GenerateCaptchaHandler(c *gin.Context) {
 		e.Error(500, err, "服务初始化失败！")
 		return
 	}
-	id, b64s, answer, err := captcha.DriverDigitFunc()
+	id, b64s, _, err := captcha.DriverDigitFunc()
 	if err != nil {
 		e.Logger.Errorf("DriverDigitFunc error, %s", err.Error())
 		e.Error(500, err, "验证码获取失败")
 		return
 	}
-	e.Logger.Infof("DriverDigitFunc answer: %s", answer)
 	e.Custom(gin.H{
 		"code": 200,
 		"data": b64s,

Sense/server/app/admin/apis/identity_bootstrap.go

@@ -0,0 +1,94 @@
+package apis
+
+import (
+	"crypto/subtle"
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
+	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
+	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
+)
+
+const bootstrapTokenHeader = "X-Sense-Bootstrap-Token"
+
+type bootstrapRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+	NickName string `json:"nickName"`
+}
+
+// Bootstrap creates the first Sense administrator. The one-time authorization
+// token is supplied out of band and never accepted in the JSON request body.
+func (e System) Bootstrap(c *gin.Context) {
+	if err := e.MakeContext(c).MakeOrm().Errors; err != nil {
+		e.Error(http.StatusInternalServerError, err, "安全初始化失败")
+		return
+	}
+	db := e.Orm
+	var req bootstrapRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		e.Custom(gin.H{"code": http.StatusBadRequest, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+	req.Username = strings.TrimSpace(req.Username)
+	if req.NickName == "" {
+		req.NickName = req.Username
+	}
+	if err := validateBootstrapInput(req); err != nil || !validBootstrapToken(c.GetHeader(bootstrapTokenHeader)) {
+		handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
+		e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec("LOCK TABLE sys_user IN EXCLUSIVE MODE").Error; err != nil {
+			return err
+		}
+		var count int64
+		if err := tx.Model(&models.SysUser{}).Count(&count).Error; err != nil {
+			return err
+		}
+		if count != 0 {
+			return errors.New("identity already initialized")
+		}
+		var role models.SysRole
+		if err := tx.Where("role_key = ? AND status = ?", "admin", "2").First(&role).Error; err != nil {
+			return err
+		}
+		return tx.Create(&models.SysUser{
+			Username: req.Username,
+			Password: req.Password,
+			NickName: req.NickName,
+			RoleId:   role.RoleId,
+			Status:   "2",
+		}).Error
+	})
+	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
+		e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+	handler.WriteIdentityAudit(c, "2", "首个管理员创建成功", req.Username)
+	e.Custom(gin.H{"code": http.StatusOK, "msg": "管理员创建成功"})
+}
+
+func validateBootstrapInput(req bootstrapRequest) error {
+	if len(req.Username) < 3 || len(req.Username) > 64 || strings.ContainsAny(req.Username, " \t\r\n") {
+		return errors.New("invalid username")
+	}
+	return service.ValidatePassword(req.Password)
+}
+
+func validBootstrapToken(candidate string) bool {
+	expected := os.Getenv("SENSE_BOOTSTRAP_TOKEN")
+	if len(expected) < 32 || len(candidate) != len(expected) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(candidate), []byte(expected)) == 1
+}

Sense/server/app/admin/apis/identity_bootstrap_test.go

@@ -0,0 +1,33 @@
+package apis
+
+import "testing"
+
+func TestValidateBootstrapInput(t *testing.T) {
+	if err := validateBootstrapInput(bootstrapRequest{Username: "admin", Password: "abcdef"}); err != nil {
+		t.Fatalf("expected valid bootstrap input: %v", err)
+	}
+	for _, req := range []bootstrapRequest{
+		{Username: "ab", Password: "abcdef"},
+		{Username: "bad name", Password: "abcdef"},
+		{Username: "admin", Password: "abcde"},
+	} {
+		if err := validateBootstrapInput(req); err == nil {
+			t.Fatalf("expected invalid bootstrap input: %+v", req)
+		}
+	}
+}
+
+func TestValidBootstrapToken(t *testing.T) {
+	const token = "0123456789abcdef0123456789abcdef"
+	t.Setenv("SENSE_BOOTSTRAP_TOKEN", token)
+	if !validBootstrapToken(token) {
+		t.Fatal("expected configured token to be accepted")
+	}
+	if validBootstrapToken("wrong") {
+		t.Fatal("expected wrong token to be rejected")
+	}
+	t.Setenv("SENSE_BOOTSTRAP_TOKEN", "short")
+	if validBootstrapToken("short") {
+		t.Fatal("expected short configured token to be rejected")
+	}
+}

Sense/server/app/admin/apis/sys_user.go

@@ -1,9 +1,8 @@
 package apis
 
 import (
-	"github.com/gin-gonic/gin/binding"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
-	"golang.org/x/crypto/bcrypt"
+	"github.com/gin-gonic/gin/binding"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -15,6 +14,7 @@ import (
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service/dto"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/actions"
+	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
 )
 
 type SysUser struct {
@@ -113,6 +113,10 @@ func (e SysUser) Insert(c *gin.Context) {
 		e.Error(500, err, err.Error())
 		return
 	}
+	if err = service.ValidatePassword(req.Password); err != nil {
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
+	}
 	// 设置创建人
 	req.SetCreateBy(user.GetUserId(c))
 	err = s.Insert(&req)
@@ -306,6 +310,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
 		e.Error(500, err, err.Error())
 		return
 	}
+	if err = service.ValidatePassword(req.Password); err != nil {
+		handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
+	}
 
 	req.SetUpdateBy(user.GetUserId(c))
 
@@ -314,9 +323,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
 
 	err = s.ResetPwd(&req, p)
 	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
 		e.Logger.Error(err)
 		return
 	}
+	handler.WriteIdentityAudit(c, "2", "管理员重置密码成功", user.GetUserName(c))
 	e.OK(req.GetId(), "更新成功")
 }
 
@@ -346,18 +357,21 @@ func (e SysUser) UpdatePwd(c *gin.Context) {
 
 	// 数据权限检查
 	p := actions.GetPermissionFromContext(c)
-	var hash []byte
-	if hash, err = bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost); err != nil {
-		req.NewPassword = string(hash)
+	if err = service.ValidatePassword(req.NewPassword); err != nil {
+		handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
 	}
 
 	err = s.UpdatePwd(user.GetUserId(c), req.OldPassword, req.NewPassword, p)
 	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
 		e.Logger.Error(err)
 		e.Error(http.StatusForbidden, err, "密码修改失败")
 		return
 	}
 
+	handler.WriteIdentityAudit(c, "2", "修改密码成功", user.GetUserName(c))
 	e.OK(nil, "密码修改成功")
 }
 

Sense/server/app/admin/router/init_router.go

@@ -3,10 +3,10 @@ package router
 import (
 	"os"
 
+	common "git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
 	"github.com/gin-gonic/gin"
 	log "github.com/go-admin-team/go-admin-core/logger"
 	"github.com/go-admin-team/go-admin-core/sdk"
-	common "git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
 )
 
 // InitRouter 路由初始化，不要怀疑，这里用到了

Sense/server/app/admin/router/sys_api.go

@@ -9,7 +9,6 @@ import (
 )
 
 func init() {
-	routerCheckRole = append(routerCheckRole, registerSysApiRouter)
 }
 
 // registerSysApiRouter

Sense/server/app/admin/router/sys_config.go

@@ -9,7 +9,6 @@ import (
 )
 
 func init() {
-	routerCheckRole = append(routerCheckRole, registerSysConfigRouter)
 }
 
 // 需认证的路由代码

Sense/server/app/admin/router/sys_dept.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -24,9 +24,9 @@ func registerSysDeptRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 		r.DELETE("", api.Delete)
 	}
 
-	r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc())
+	r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	{
 		r1.GET("/deptTree", api.Get2Tree)
 	}
 
-}
+}

Sense/server/app/admin/router/sys_dict.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {

Sense/server/app/admin/router/sys_login_log.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -21,4 +21,4 @@ func registerSysLoginLogRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMi
 		r.GET("/:id", api.Get)
 		r.DELETE("", api.Delete)
 	}
-}
+}

Sense/server/app/admin/router/sys_menu.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -30,4 +30,4 @@ func registerSysMenuRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 		//r1.GET("/menuids", api.GetMenuIDS)
 	}
 
-}
+}

Sense/server/app/admin/router/sys_opera_log.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -20,4 +20,4 @@ func registerSysOperaLogRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMi
 		r.GET("/:id", api.Get)
 		r.DELETE("", api.Delete)
 	}
-}
+}

Sense/server/app/admin/router/sys_post.go

@@ -1,10 +1,10 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -22,4 +22,4 @@ func registerSyPostRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddlew
 		r.PUT("/:id", api.Update)
 		r.DELETE("", api.Delete)
 	}
-}
+}

Sense/server/app/admin/router/sys_role.go

@@ -23,7 +23,7 @@ func registerSysRoleRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 		r.PUT("/:id", api.Update)
 		r.DELETE("", api.Delete)
 	}
-	r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc())
+	r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	{
 		r1.PUT("/role-status", api.Update2Status)
 		r1.PUT("/roledatascope", api.Update2DataScope)

Sense/server/app/admin/router/sys_router.go

@@ -68,6 +68,8 @@ func sysCheckRoleRouterInit(r *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 
 	v1 := r.Group("/api/v1")
 	{
+		v1.GET("/captcha", apis.System{}.GenerateCaptchaHandler)
+		v1.POST("/bootstrap", apis.System{}.Bootstrap)
 		v1.POST("/login", authMiddleware.LoginHandler)
 		// Refresh time can be longer than token timeout
 		v1.GET("/refresh_token", authMiddleware.RefreshHandler)
@@ -81,8 +83,7 @@ func registerBaseRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddlewar
 	v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	{
 		v1auth.GET("/roleMenuTreeselect/:roleId", api.GetMenuTreeSelect)
-		//v1.GET("/menuTreeselect", api.GetMenuTreeSelect)
 		v1auth.GET("/roleDeptTreeselect/:roleId", api2.GetDeptTreeRoleSelect)
-		v1auth.POST("/logout", handler.LogOut)
 	}
+	v1.Group("").Use(authMiddleware.MiddlewareFunc()).POST("/logout", handler.LogOut)
 }

Sense/server/app/admin/router/sys_user.go

@@ -1,11 +1,11 @@
 package router
 
 import (
-	"github.com/gin-gonic/gin"
-	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/apis"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/actions"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
 )
 
 func init() {
@@ -24,16 +24,19 @@ func registerSysUserRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 		r.DELETE("", api.Delete)
 	}
 
-	user := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()).Use(actions.PermissionAction())
+	user := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(actions.PermissionAction())
 	{
 		user.GET("/profile", api.GetProfile)
 		user.POST("/avatar", api.InsetAvatar)
 		user.PUT("/pwd/set", api.UpdatePwd)
-		user.PUT("/pwd/reset", api.ResetPwd)
-		user.PUT("/status", api.UpdateStatus)
+	}
+	userAdmin := v1.Group("/user").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()).Use(actions.PermissionAction())
+	{
+		userAdmin.PUT("/pwd/reset", api.ResetPwd)
+		userAdmin.PUT("/status", api.UpdateStatus)
 	}
 	v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc())
 	{
 		v1auth.GET("/getinfo", api.GetInfo)
 	}
-}
+}

Sense/server/app/admin/service/password_policy.go

@@ -0,0 +1,23 @@
+package service
+
+import (
+	"errors"
+	"unicode/utf8"
+)
+
+const (
+	MinPasswordLength = 6
+	MaxPasswordBytes  = 72
+)
+
+// ValidatePassword enforces the frozen Sense policy. Lowercase-only passwords
+// are valid; complexity rules are intentionally not added here.
+func ValidatePassword(password string) error {
+	if utf8.RuneCountInString(password) < MinPasswordLength {
+		return errors.New("密码至少需要 6 个字符")
+	}
+	if len(password) > MaxPasswordBytes {
+		return errors.New("密码不能超过 72 个字节")
+	}
+	return nil
+}

Sense/server/app/admin/service/password_policy_test.go

@@ -0,0 +1,26 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidatePassword(t *testing.T) {
+	tests := []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{name: "lowercase accepted", value: "chengma", wantErr: false},
+		{name: "six characters accepted", value: "abcdef", wantErr: false},
+		{name: "too short", value: "abcde", wantErr: true},
+		{name: "bcrypt byte limit", value: strings.Repeat("a", MaxPasswordBytes+1), wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ValidatePassword(tt.value); (got != nil) != tt.wantErr {
+				t.Fatalf("ValidatePassword() error = %v, wantErr %v", got, tt.wantErr)
+			}
+		})
+	}
+}

Sense/server/app/admin/service/sys_role.go

@@ -103,12 +103,13 @@ func (e *SysRole) Insert(c *dto.SysRoleInsertReq, cb *casbin.SyncedEnforcer) err
 		return err
 	}
 
-	mp := make(map[string]interface{}, 0)
+	mp := make(map[string]struct{})
 	polices := make([][]string, 0)
 	for _, menu := range dataMenu {
 		for _, api := range menu.SysApi {
-			if mp[data.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
-				mp[data.RoleKey+"-"+api.Path+"-"+api.Action] = ""
+			key := data.RoleKey + "-" + api.Path + "-" + api.Action
+			if _, exists := mp[key]; !exists {
+				mp[key] = struct{}{}
 				polices = append(polices, []string{data.RoleKey, api.Path, api.Action})
 			}
 		}
@@ -169,12 +170,13 @@ func (e *SysRole) Update(c *dto.SysRoleUpdateReq, cb *casbin.SyncedEnforcer) err
 		e.Log.Errorf("delete policy error:%s", err)
 		return err
 	}
-	mp := make(map[string]interface{}, 0)
+	mp := make(map[string]struct{})
 	polices := make([][]string, 0)
 	for _, menu := range mlist {
 		for _, api := range menu.SysApi {
-			if mp[model.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
-				mp[model.RoleKey+"-"+api.Path+"-"+api.Action] = ""
+			key := model.RoleKey + "-" + api.Path + "-" + api.Action
+			if _, exists := mp[key]; !exists {
+				mp[key] = struct{}{}
 				//_, err = cb.AddNamedPolicy("p", model.RoleKey, api.Path, api.Action)
 				polices = append(polices, []string{model.RoleKey, api.Path, api.Action})
 			}

Sense/server/app/admin/service/sys_user.go

@@ -161,6 +161,9 @@ func (e *SysUser) UpdateStatus(c *dto.UpdateSysUserStatusReq, p *actions.DataPer
 // ResetPwd 重置用户密码
 func (e *SysUser) ResetPwd(c *dto.ResetSysUserPwdReq, p *actions.DataPermission) error {
 	var err error
+	if err = ValidatePassword(c.Password); err != nil {
+		return err
+	}
 	var model models.SysUser
 	db := e.Orm.Scopes(
 		actions.Permission(model.TableName(), p),
@@ -204,8 +207,8 @@ func (e *SysUser) Remove(c *dto.SysUserById, p *actions.DataPermission) error {
 func (e *SysUser) UpdatePwd(id int, oldPassword, newPassword string, p *actions.DataPermission) error {
 	var err error
 
-	if newPassword == "" {
-		return nil
+	if err = ValidatePassword(newPassword); err != nil {
+		return err
 	}
 	c := &models.SysUser{}