fix: P1安全加固 — 全局JWT保护 + 审计日志补全 + 敏感字段过滤
Settings API: - 所有端点添加JWT认证(get_current_admin) - 不可改项(secret_key/api_key/encryption_key/database_url)禁止PUT修改 - 敏感字段GET响应自动脱敏(前8位+...) - Schedules/Presets/Retry CRUD添加JWT+审计日志 Servers API: - POST/PUT/DELETE添加JWT认证 - 服务器增删改写审计日志 Assets API: - Platform/Node写操作添加JWT认证 - Platform创建添加审计日志
This commit is contained in:
Your Name
+132
-17
@@ -1,48 +1,86 @@
|
||||
"""Nexus — Settings & Schedules API Routes
|
||||
Presentation layer — system settings + push schedules + password presets + audit logs.
|
||||
|
||||
Security: All write operations require JWT authentication.
|
||||
Immutable settings (secret_key, api_key, encryption_key, database_url) cannot be modified via API.
|
||||
Sensitive values are masked in GET responses.
|
||||
"""
|
||||
|
||||
from typing import Optional
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
|
||||
from server.api.dependencies import get_db
|
||||
from server.api.auth_jwt import get_current_admin
|
||||
from server.api.schemas import ScheduleCreate, ScheduleUpdate, PresetCreate, SettingUpdatePayload
|
||||
from server.infrastructure.database.setting_repo import SettingRepositoryImpl
|
||||
from server.infrastructure.database.push_schedule_repo import PushScheduleRepositoryImpl, PushRetryJobRepositoryImpl
|
||||
from server.infrastructure.database.password_preset_repo import PasswordPresetRepositoryImpl
|
||||
from server.infrastructure.database.audit_log_repo import AuditLogRepositoryImpl
|
||||
from server.domain.models import Setting, PushSchedule, PushRetryJob, PasswordPreset, AuditLog
|
||||
from server.domain.models import Setting, PushSchedule, PushRetryJob, PasswordPreset, AuditLog, Admin
|
||||
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
# Settings that cannot be modified via API (encryption consistency)
|
||||
IMMUTABLE_KEYS = {"secret_key", "api_key", "encryption_key", "database_url"}
|
||||
|
||||
# Settings whose values are masked in GET responses
|
||||
SENSITIVE_KEYS = {"secret_key", "api_key", "encryption_key", "redis_url"}
|
||||
|
||||
router = APIRouter(prefix="/api/settings", tags=["settings"])
|
||||
|
||||
|
||||
# ── System Settings ──
|
||||
|
||||
@router.get("/", response_model=list)
|
||||
async def list_settings(db: AsyncSession = Depends(get_db)):
|
||||
"""List all system settings"""
|
||||
async def list_settings(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||||
"""List all system settings (sensitive values masked)"""
|
||||
repo = SettingRepositoryImpl(db)
|
||||
settings = await repo.get_all()
|
||||
return [{"key": s.key, "value": s.value, "updated_at": str(s.updated_at)} for s in settings]
|
||||
result = []
|
||||
for s in settings:
|
||||
val = s.value
|
||||
if s.key in SENSITIVE_KEYS and val:
|
||||
val = val[:8] + "..." if len(val) > 8 else "***"
|
||||
result.append({"key": s.key, "value": val, "updated_at": str(s.updated_at)})
|
||||
return result
|
||||
|
||||
|
||||
@router.get("/{key}", response_model=dict)
|
||||
async def get_setting(key: str, db: AsyncSession = Depends(get_db)):
|
||||
"""Get a single setting by key"""
|
||||
async def get_setting(key: str, admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||||
"""Get a single setting by key (sensitive values masked)"""
|
||||
repo = SettingRepositoryImpl(db)
|
||||
value = await repo.get(key)
|
||||
if value is None:
|
||||
raise HTTPException(status_code=404, detail="Setting not found")
|
||||
if key in SENSITIVE_KEYS and value:
|
||||
value = value[:8] + "..." if len(value) > 8 else "***"
|
||||
return {"key": key, "value": value}
|
||||
|
||||
|
||||
@router.put("/{key}", response_model=dict)
|
||||
async def set_setting(key: str, payload: SettingUpdatePayload, db: AsyncSession = Depends(get_db)):
|
||||
"""Set a system setting value"""
|
||||
async def set_setting(
|
||||
key: str,
|
||||
payload: SettingUpdatePayload,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Set a system setting value (immutable keys are rejected)"""
|
||||
if key in IMMUTABLE_KEYS:
|
||||
raise HTTPException(status_code=403, detail=f"Setting '{key}' is immutable and cannot be modified via API")
|
||||
|
||||
repo = SettingRepositoryImpl(db)
|
||||
setting = await repo.set(key, str(payload.value))
|
||||
|
||||
# Audit log
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="update_setting",
|
||||
target_type="setting",
|
||||
detail=f"key={key}",
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
return {"key": setting.key, "value": setting.value}
|
||||
|
||||
|
||||
@@ -52,7 +90,7 @@ schedule_router = APIRouter(prefix="/api/schedules", tags=["schedules"])
|
||||
|
||||
|
||||
@schedule_router.get("/", response_model=list)
|
||||
async def list_schedules(db: AsyncSession = Depends(get_db)):
|
||||
async def list_schedules(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||||
"""List all push schedules"""
|
||||
repo = PushScheduleRepositoryImpl(db)
|
||||
schedules = await repo.get_all()
|
||||
@@ -60,16 +98,36 @@ async def list_schedules(db: AsyncSession = Depends(get_db)):
|
||||
|
||||
|
||||
@schedule_router.post("/", response_model=dict, status_code=201)
|
||||
async def create_schedule(payload: ScheduleCreate, db: AsyncSession = Depends(get_db)):
|
||||
async def create_schedule(
|
||||
payload: ScheduleCreate,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Create a new push schedule"""
|
||||
repo = PushScheduleRepositoryImpl(db)
|
||||
schedule = PushSchedule(**payload.model_dump())
|
||||
created = await repo.create(schedule)
|
||||
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="create_schedule",
|
||||
target_type="schedule",
|
||||
target_id=created.id,
|
||||
detail=f"name={created.name}",
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
return _schedule_to_dict(created)
|
||||
|
||||
|
||||
@schedule_router.put("/{id}", response_model=dict)
|
||||
async def update_schedule(id: int, payload: ScheduleUpdate, db: AsyncSession = Depends(get_db)):
|
||||
async def update_schedule(
|
||||
id: int,
|
||||
payload: ScheduleUpdate,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Update a push schedule"""
|
||||
repo = PushScheduleRepositoryImpl(db)
|
||||
schedule = await repo.get_by_id(id)
|
||||
@@ -79,17 +137,41 @@ async def update_schedule(id: int, payload: ScheduleUpdate, db: AsyncSession = D
|
||||
if hasattr(schedule, key) and key != "id":
|
||||
setattr(schedule, key, value)
|
||||
updated = await repo.update(schedule)
|
||||
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="update_schedule",
|
||||
target_type="schedule",
|
||||
target_id=id,
|
||||
detail=f"name={updated.name}",
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
return _schedule_to_dict(updated)
|
||||
|
||||
|
||||
@schedule_router.delete("/{id}", status_code=204)
|
||||
async def delete_schedule(id: int, db: AsyncSession = Depends(get_db)):
|
||||
async def delete_schedule(
|
||||
id: int,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Delete a push schedule"""
|
||||
repo = PushScheduleRepositoryImpl(db)
|
||||
result = await repo.delete(id)
|
||||
if not result:
|
||||
raise HTTPException(status_code=404, detail="Schedule not found")
|
||||
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="delete_schedule",
|
||||
target_type="schedule",
|
||||
target_id=id,
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
|
||||
# ── Password Presets ──
|
||||
|
||||
@@ -97,7 +179,7 @@ preset_router = APIRouter(prefix="/api/presets", tags=["presets"])
|
||||
|
||||
|
||||
@preset_router.get("/", response_model=list)
|
||||
async def list_presets(db: AsyncSession = Depends(get_db)):
|
||||
async def list_presets(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||||
"""List all password presets"""
|
||||
repo = PasswordPresetRepositoryImpl(db)
|
||||
presets = await repo.get_all()
|
||||
@@ -105,24 +187,52 @@ async def list_presets(db: AsyncSession = Depends(get_db)):
|
||||
|
||||
|
||||
@preset_router.post("/", response_model=dict, status_code=201)
|
||||
async def create_preset(payload: PresetCreate, db: AsyncSession = Depends(get_db)):
|
||||
async def create_preset(
|
||||
payload: PresetCreate,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Create a password preset (password will be encrypted)"""
|
||||
from server.infrastructure.database.crypto import encrypt_value
|
||||
repo = PasswordPresetRepositoryImpl(db)
|
||||
encrypted = encrypt_value(payload.encrypted_pw)
|
||||
preset = PasswordPreset(name=payload.name, encrypted_pw=encrypted)
|
||||
created = await repo.create(preset)
|
||||
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="create_preset",
|
||||
target_type="preset",
|
||||
target_id=created.id,
|
||||
detail=f"name={created.name}",
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
return {"id": created.id, "name": created.name}
|
||||
|
||||
|
||||
@preset_router.delete("/{id}", status_code=204)
|
||||
async def delete_preset(id: int, db: AsyncSession = Depends(get_db)):
|
||||
async def delete_preset(
|
||||
id: int,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Delete a password preset"""
|
||||
repo = PasswordPresetRepositoryImpl(db)
|
||||
result = await repo.delete(id)
|
||||
if not result:
|
||||
raise HTTPException(status_code=404, detail="Preset not found")
|
||||
|
||||
audit_repo = AuditLogRepositoryImpl(db)
|
||||
await audit_repo.create(AuditLog(
|
||||
admin_username=admin.username,
|
||||
action="delete_preset",
|
||||
target_type="preset",
|
||||
target_id=id,
|
||||
ip_address="",
|
||||
))
|
||||
|
||||
|
||||
# ── Audit Logs ──
|
||||
|
||||
@@ -133,6 +243,7 @@ audit_router = APIRouter(prefix="/api/audit", tags=["audit"])
|
||||
async def list_audit_logs(
|
||||
action: Optional[str] = None,
|
||||
limit: int = 200,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List recent audit logs, optionally filtered by action"""
|
||||
@@ -150,7 +261,11 @@ retry_router = APIRouter(prefix="/api/retries", tags=["retries"])
|
||||
|
||||
|
||||
@retry_router.get("/", response_model=list)
|
||||
async def list_retry_jobs(limit: int = 100, db: AsyncSession = Depends(get_db)):
|
||||
async def list_retry_jobs(
|
||||
limit: int = 100,
|
||||
admin: Admin = Depends(get_current_admin),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List pending retry jobs"""
|
||||
repo = PushRetryJobRepositoryImpl(db)
|
||||
jobs = await repo.get_pending(limit)
|
||||
@@ -199,4 +314,4 @@ def _retry_to_dict(job: PushRetryJob) -> dict:
|
||||
"next_retry_at": str(job.next_retry_at) if job.next_retry_at else None,
|
||||
"last_error": job.last_error,
|
||||
"created_at": str(job.created_at) if job.created_at else None,
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user