feat: 实现管理鉴权、API 令牌与操作日志

2026-09-30 06:58:54 +08:00
parent 308b0b9edd
commit 0e068c6ade
13 changed files with 1655 additions and 1 deletions
@@ -0,0 +1,165 @@
+package admin
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"strings"
+
+	"git.asio.asia/nixevol/NixMsg/internal/httpx"
+)
+
+func (h *Handler) handleTokenList(w http.ResponseWriter, r *http.Request) {
+	items, err := h.listAPITokens(r.Context())
+	if err != nil {
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, it := range items {
+		row := map[string]any{
+			"id":              it.ID,
+			"name":            it.Name,
+			"enabled":         it.Enabled,
+			"created_at_ms":   it.CreatedAt.UnixMilli(),
+			"last_used_at_ms": nil,
+		}
+		if it.LastUsedAt != nil {
+			row["last_used_at_ms"] = it.LastUsedAt.UnixMilli()
+		}
+		out = append(out, row)
+	}
+	httpx.WriteOK(w, map[string]any{
+		"items":       out,
+		"next_cursor": "",
+		"total":       len(out),
+	})
+}
+
+func (h *Handler) handleTokenCreate(w http.ResponseWriter, r *http.Request) {
+	p, _ := principalFrom(r.Context())
+	ip := httpx.ClientIP(r, h.trusted)
+
+	var req struct {
+		Name string `json:"name"`
+	}
+	if err := httpx.DecodeJSON(r, &req); err != nil || strings.TrimSpace(req.Name) == "" {
+		h.audit(actorString(p), "token_create", "", "bad_request", ip)
+		httpx.WriteError(w, http.StatusBadRequest, "bad_request", "名称不能为空")
+		return
+	}
+	name := strings.TrimSpace(req.Name)
+
+	plain, hash, err := h.tokens.Issue(r.Context())
+	if err != nil {
+		h.audit(actorString(p), "token_create", "", "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	id, err := newTokenID()
+	if err != nil {
+		h.audit(actorString(p), "token_create", "", "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	created, err := h.insertAPIToken(r.Context(), id, name, hash)
+	if err != nil {
+		h.audit(actorString(p), "token_create", id, "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	h.audit(actorString(p), "token_create", id, "ok", ip)
+	httpx.WriteOK(w, map[string]any{
+		"id":            id,
+		"name":          name,
+		"token":         plain,
+		"created_at_ms": created.UnixMilli(),
+	})
+}
+
+func (h *Handler) handleTokenPatch(w http.ResponseWriter, r *http.Request) {
+	p, _ := principalFrom(r.Context())
+	ip := httpx.ClientIP(r, h.trusted)
+	id := r.PathValue("id")
+
+	var req struct {
+		Name    *string `json:"name"`
+		Enabled *bool   `json:"enabled"`
+	}
+	if err := httpx.DecodeJSON(r, &req); err != nil {
+		h.audit(actorString(p), "token_update", id, "bad_request", ip)
+		httpx.WriteError(w, http.StatusBadRequest, "bad_request", "请求体无效")
+		return
+	}
+	if req.Name == nil && req.Enabled == nil {
+		h.audit(actorString(p), "token_update", id, "bad_request", ip)
+		httpx.WriteError(w, http.StatusBadRequest, "bad_request", "无更新字段")
+		return
+	}
+	if req.Name != nil {
+		n := strings.TrimSpace(*req.Name)
+		if n == "" {
+			h.audit(actorString(p), "token_update", id, "bad_request", ip)
+			httpx.WriteError(w, http.StatusBadRequest, "bad_request", "名称不能为空")
+			return
+		}
+		req.Name = &n
+	}
+
+	if err := h.updateAPIToken(r.Context(), id, req.Name, req.Enabled); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			h.audit(actorString(p), "token_update", id, "not_found", ip)
+			httpx.WriteError(w, http.StatusNotFound, "not_found", "令牌不存在")
+			return
+		}
+		h.audit(actorString(p), "token_update", id, "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	row, err := h.getAPITokenByID(r.Context(), id)
+	if err != nil {
+		h.audit(actorString(p), "token_update", id, "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	h.audit(actorString(p), "token_update", id, "ok", ip)
+	resp := map[string]any{
+		"id":              row.ID,
+		"name":            row.Name,
+		"enabled":         row.Enabled,
+		"created_at_ms":   row.CreatedAt.UnixMilli(),
+		"last_used_at_ms": nil,
+	}
+	if row.LastUsedAt != nil {
+		resp["last_used_at_ms"] = row.LastUsedAt.UnixMilli()
+	}
+	httpx.WriteOK(w, resp)
+}
+
+func (h *Handler) handleTokenDelete(w http.ResponseWriter, r *http.Request) {
+	p, _ := principalFrom(r.Context())
+	ip := httpx.ClientIP(r, h.trusted)
+	id := r.PathValue("id")
+	if err := h.deleteAPIToken(r.Context(), id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			h.audit(actorString(p), "token_delete", id, "not_found", ip)
+			httpx.WriteError(w, http.StatusNotFound, "not_found", "令牌不存在")
+			return
+		}
+		h.audit(actorString(p), "token_delete", id, "error", ip)
+		httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
+		return
+	}
+	h.audit(actorString(p), "token_delete", id, "ok", ip)
+	httpx.WriteOK(w, map[string]any{})
+}
+
+func newTokenID() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}