32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
|
---
|
||
|
|
name: nexus-btpanel-review
|
||
|
|
description: Use when reviewing or changing Nexus BT/宝塔 panel integration, one-click login, API bootstrap, session keepalive fixes, or BT credential handling.
|
||
|
|
---
|
||
|
|
|
||
|
|
# Nexus BT Panel Review
|
||
|
|
|
||
|
|
Use for 宝塔/BT panel integration changes.
|
||
|
|
|
||
|
|
## Call chain to map
|
||
|
|
|
||
|
|
API one-click login -> btpanel_service -> BT API credential lookup/bootstrap -> SSH bootstrap if needed -> login URL/tmp_token -> panel session behavior.
|
||
|
|
|
||
|
|
## Required checks
|
||
|
|
|
||
|
|
- Do not log or return BT API keys, session cookies, temporary login tokens, SSH private keys, or passwords.
|
||
|
|
- One-click login should fail closed for real authentication errors, but best-effort environment repair must not block login unless required for correctness.
|
||
|
|
- Session keepalive/cleanup repair must be idempotent and throttled; do not restart or rewrite BT panel aggressively without explicit approval.
|
||
|
|
- Respect existing BT panel services and ports. Do not occupy panel, nginx, redis, or mysql ports.
|
||
|
|
- Old servers with existing BT API credentials must still receive the session-cleanup TTL check before login.
|
||
|
|
- Record bootstrap state without storing secrets.
|
||
|
|
|
||
|
|
## Regression tests
|
||
|
|
|
||
|
|
Cover:
|
||
|
|
|
||
|
|
- Existing credentials still trigger throttled TTL check.
|
||
|
|
- Missing SSH auth does not block login URL generation.
|
||
|
|
- Failed repair is throttled and retried later.
|
||
|
|
- Temporary login token TTL remains bounded.
|
||
|
|
- No secret values appear in returned bootstrap/status payloads.
|