Compare commits
8 Commits
5520434d53
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
 Nexus Release Bot
|
d3c3e5a74f | ||
|
Nexus Release Bot
|
92834559bc | ||
|
Nexus Release Bot
|
3938170a16 | ||
 admin
|
1c5b45732f | ||
|
Codex Release Bot
|
00c9eddd19 | ||
|
Codex Release Bot
|
6aaf292ad9 | ||
|
r
|
a16ba169fd | ||
|
r
|
9b583ccc91 |
+15
-1
@@ -2,8 +2,22 @@
|
||||
"mcpServers": {
|
||||
"mysql-mcp": {
|
||||
"command": "bash",
|
||||
"args": ["scripts/linux_mcp_mysql.sh"],
|
||||
"args": [
|
||||
"scripts/linux_mcp_mysql.sh"
|
||||
],
|
||||
"env": {}
|
||||
},
|
||||
"gitea-mcp": {
|
||||
"command": "bash",
|
||||
"args": [
|
||||
"scripts/mcp_gitea.sh"
|
||||
],
|
||||
"env": {
|
||||
"GITEA_HOST": "https://axs.kuma1xn.vip",
|
||||
"GITEA_ACCESS_TOKEN_FILE": "/mnt/c/Users/uzuma/.codex/secrets/gitea-axs.token",
|
||||
"HTTPS_PROXY": "socks5://127.0.0.1:10808",
|
||||
"HTTP_PROXY": "socks5://127.0.0.1:10808"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -27,3 +27,16 @@ standards/
|
||||
web/uploads
|
||||
backups/
|
||||
deploy/gate_log.jsonl
|
||||
|
||||
# Release/build local artifacts
|
||||
frontend-v2/node_modules
|
||||
.venv
|
||||
.venv-*
|
||||
venv
|
||||
.pytest_cache
|
||||
.ruff_cache
|
||||
.playwright-mcp
|
||||
2025.2
|
||||
=2025.2
|
||||
*.bak-
|
||||
tmp/
|
||||
|
||||
@@ -16,6 +16,7 @@ deploy/nexus-1panel.secrets.sh
|
||||
*.pem
|
||||
.env.*
|
||||
.venv/
|
||||
.venv-*/
|
||||
venv/
|
||||
ENV/
|
||||
|
||||
|
||||
@@ -19,13 +19,12 @@ cd frontend && npm run dev # :3000/app/
|
||||
|
||||
路径见 [linux-dev-paths.md](docs/project/linux-dev-paths.md)。
|
||||
|
||||
## Git（仅本机快照）
|
||||
## Git（本机 + Gitea）
|
||||
|
||||
- 本地 `git commit` 用于回滚；**不 `git push`**（除非你明确要求）。
|
||||
- 已移除 `origin` 跟踪，避免误推；原远程：`http://66.154.115.8:3000/admin/Nexus.git`（需恢复时说一声）。
|
||||
- `.env`、`SECRETS.md`、`*.pem` 已在 `.gitignore`，**勿提交**。
|
||||
- 改完代码：**`git commit` 后 `bash scripts/git-push.sh` 推到 Gitea**（凭据 `deploy/nexus-1panel.secrets.sh`）；大仓库可用 `scripts/git-push-axs-full.sh`。
|
||||
- 本地 commit 仍用于回滚；**不要漏推 Gitea**（用户约定 2026-07-09）。
|
||||
- `.env`、`SECRETS.md`、`*.pem`、`deploy/nexus-1panel.secrets.sh` 已在 `.gitignore`，**勿提交**。
|
||||
- 改代码仍写 `docs/changelog/YYYY-MM-DD-*.md`（≥10 行）。
|
||||
- 用户说「提交快照 / commit」时执行。
|
||||
|
||||
## 强制约束
|
||||
|
||||
@@ -40,14 +39,15 @@ cd frontend && npm run dev # :3000/app/
|
||||
|
||||
## 部署
|
||||
|
||||
默认 **本机 rsync → SSH 生产机**（不 push Gitea）：
|
||||
默认 **本机 rsync → SSH 生产机**；**代码先 push Gitea 再部署**（见上节 Git）：
|
||||
|
||||
```bash
|
||||
bash deploy/pre_deploy_check.sh
|
||||
bash scripts/git-push.sh # 或 git-push-axs-full.sh
|
||||
bash deploy/deploy-production.sh # rsync + Docker upgrade --skip-git + 前端
|
||||
```
|
||||
|
||||
可选：`NEXUS_DEPLOY_VIA_GIT=1` 恢复远程 `git pull`。仅 `git push` 当你明确要求时。
|
||||
可选：`NEXUS_DEPLOY_VIA_GIT=1` 恢复远程 `git pull`。
|
||||
|
||||
详情见功能指南 §17–18。
|
||||
|
||||
|
||||
@@ -12,6 +12,16 @@ RUN npm ci --ignore-scripts
|
||||
COPY frontend/ ./
|
||||
RUN npx vite build
|
||||
|
||||
# ── Stage 1b: React/Vite App V2 ──
|
||||
FROM node:20-bookworm-slim AS frontend_v2
|
||||
WORKDIR /build/frontend-v2
|
||||
|
||||
COPY frontend-v2/package.json frontend-v2/package-lock.json ./
|
||||
RUN npm ci --ignore-scripts
|
||||
|
||||
COPY frontend-v2/ ./
|
||||
RUN npm run build:safe
|
||||
|
||||
# ── Stage 2: Python API + built static assets ──
|
||||
FROM python:3.12-slim-bookworm
|
||||
|
||||
@@ -30,6 +40,7 @@ RUN pip install --no-cache-dir -r requirements.txt
|
||||
|
||||
COPY server/ ./server/
|
||||
COPY web/agent/ ./web/agent/
|
||||
COPY --from=frontend_v2 /build/web/app-v2 ./web/app-v2/
|
||||
COPY --from=frontend /build/web/app ./web/app/
|
||||
# Login wallpaper cache (Vite does not emit this dir; sync also writes here at runtime)
|
||||
COPY web/app/wallpapers/ ./web/app/wallpapers/
|
||||
@@ -45,6 +56,7 @@ COPY web/app/vendor/tailwindcss-browser.js \
|
||||
COPY docker/entrypoint.sh ./docker/entrypoint.sh
|
||||
RUN chmod +x ./docker/entrypoint.sh \
|
||||
&& test -f /app/web/app/install.html \
|
||||
&& test -f /app/web/app-v2/index.html \
|
||||
&& test -f /app/web/app/vendor/alpinejs.min.js \
|
||||
&& test -f /app/web/app/vendor/tailwindcss-browser.js \
|
||||
&& test -f /app/web/app/vendor/theme.css \
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
|
||||
| 脚本 | 用途 | 一条命令 |
|
||||
|------|------|----------|
|
||||
| `quick-install.sh` | 仅装 Nexus（1Panel 已就绪） | `curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
|
||||
| `quick-install.sh` | 仅装 Nexus（1Panel 已就绪） | `curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" \| bash` |
|
||||
| `install-1panel-docker.sh` | 重装服务器全链 | `curl -fsSL ".../install-1panel-docker.sh" \| bash` |
|
||||
| `install-nexus-fresh.sh` | 全新空库安装 | `bash deploy/install-nexus-fresh.sh --skip-clone` |
|
||||
| **`update.sh`** | **一键更新** | `curl -fsSL ".../update.sh" \| bash` |
|
||||
@@ -27,7 +27,7 @@
|
||||
## 重装服务器（1Panel + Docker + Nexus）
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
```
|
||||
|
||||
4 核 16G：
|
||||
@@ -45,7 +45,7 @@ curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --skip-1panel
|
||||
## 仅 Nexus Docker
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
```
|
||||
|
||||
安装完成后：`https://api.synaglobal.vip/app/install.html`
|
||||
@@ -72,7 +72,7 @@ nx # → [4] 一键更新
|
||||
远程：
|
||||
|
||||
```bash
|
||||
curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
curl -fsSL ".../update.sh" | bash -s -- --no-cache
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,272 @@
|
||||
#!/usr/bin/env bash
|
||||
# Apply a Nexus release tarball on the production host.
|
||||
#
|
||||
# Usage:
|
||||
# sudo bash deploy/apply-release-bundle.sh \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1 \
|
||||
# --deploy-path /opt/nexus
|
||||
#
|
||||
# Validate only (no backup, no rsync, no rebuild):
|
||||
# bash deploy/apply-release-bundle.sh --validate-only \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 6474d58fdccde668b4c91d5e7454fa08e01e20660e3bcbb363eeadbb7c2346a1
|
||||
#
|
||||
# This script intentionally preserves runtime secrets and data:
|
||||
# - .env
|
||||
# - docker/.env.prod
|
||||
# - web/data
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TARBALL=""
|
||||
EXPECTED_SHA256=""
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
|
||||
BACKUP_DIR="${NEXUS_BACKUP_DIR:-/opt/nexus-backups}"
|
||||
SKIP_REBUILD=0
|
||||
DRY_RUN=0
|
||||
VALIDATE_ONLY=0
|
||||
APPLY_TMP=""
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
usage() {
|
||||
sed -n '1,26p' "$0"
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--tarball)
|
||||
TARBALL="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--sha256)
|
||||
EXPECTED_SHA256="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--deploy-path)
|
||||
DEPLOY_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--backup-dir)
|
||||
BACKUP_DIR="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--skip-rebuild)
|
||||
SKIP_REBUILD=1
|
||||
shift
|
||||
;;
|
||||
--dry-run)
|
||||
DRY_RUN=1
|
||||
shift
|
||||
;;
|
||||
--validate-only)
|
||||
VALIDATE_ONLY=1
|
||||
shift
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Unknown argument: $1"
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
require_cmd() {
|
||||
command -v "$1" >/dev/null 2>&1 || {
|
||||
error "Missing required command: $1"
|
||||
exit 127
|
||||
}
|
||||
}
|
||||
|
||||
require_runtime_cmds() {
|
||||
require_cmd tar
|
||||
require_cmd sha256sum
|
||||
if [[ "$VALIDATE_ONLY" == 1 ]]; then
|
||||
return 0
|
||||
fi
|
||||
require_cmd rsync
|
||||
require_cmd curl
|
||||
}
|
||||
|
||||
run() {
|
||||
echo "+ $*"
|
||||
if [[ "$DRY_RUN" == 1 ]]; then
|
||||
return 0
|
||||
fi
|
||||
"$@"
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
if [[ -n "${APPLY_TMP:-}" && -d "$APPLY_TMP" ]]; then
|
||||
rm -rf "$APPLY_TMP"
|
||||
fi
|
||||
}
|
||||
|
||||
detect_runtime() {
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
|
||||
echo docker
|
||||
return
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo supervisor
|
||||
return
|
||||
fi
|
||||
echo unknown
|
||||
}
|
||||
|
||||
verify_sha256() {
|
||||
if [[ -z "$EXPECTED_SHA256" ]]; then
|
||||
warn "No --sha256 provided; skipping checksum verification"
|
||||
return 0
|
||||
fi
|
||||
local actual
|
||||
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
||||
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
|
||||
error "SHA256 mismatch"
|
||||
error "expected: $EXPECTED_SHA256"
|
||||
error "actual: $actual"
|
||||
exit 1
|
||||
fi
|
||||
info "SHA256 OK: $actual"
|
||||
}
|
||||
|
||||
validate_extracted_tree() {
|
||||
local src="$1"
|
||||
for required in server deploy Dockerfile.prod frontend-v2 web/app-v2; do
|
||||
if [[ ! -e "${src}/${required}" ]]; then
|
||||
error "Release bundle missing required path: ${required}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
for forbidden in .env docker/.env.prod web/data .venv-py312-codex frontend-v2/node_modules 2025.2 =2025.2; do
|
||||
if [[ -e "${src}/${forbidden}" ]]; then
|
||||
error "Release bundle contains forbidden path: ${forbidden}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
info "Extracted release tree validation OK"
|
||||
}
|
||||
|
||||
backup_current() {
|
||||
if [[ ! -d "$DEPLOY_PATH" ]]; then
|
||||
warn "Deploy path does not exist yet: $DEPLOY_PATH"
|
||||
return 0
|
||||
fi
|
||||
local stamp backup
|
||||
stamp="$(date +%Y%m%d-%H%M%S)"
|
||||
backup="${BACKUP_DIR}/nexus-before-${stamp}.tar.gz"
|
||||
run mkdir -p "$BACKUP_DIR"
|
||||
info "Backup current deploy path -> $backup"
|
||||
run tar czf "$backup" \
|
||||
--exclude='./web/data' \
|
||||
--exclude='./.venv*' \
|
||||
--exclude='./venv' \
|
||||
--exclude='./frontend/node_modules' \
|
||||
--exclude='./frontend-v2/node_modules' \
|
||||
-C "$(dirname "$DEPLOY_PATH")" "$(basename "$DEPLOY_PATH")"
|
||||
}
|
||||
|
||||
sync_release() {
|
||||
local src="$1"
|
||||
run mkdir -p "$DEPLOY_PATH"
|
||||
info "Sync release tree -> $DEPLOY_PATH"
|
||||
run rsync -a --delete \
|
||||
--exclude='.env' \
|
||||
--exclude='docker/.env.prod' \
|
||||
--exclude='web/data' \
|
||||
"${src}/" "${DEPLOY_PATH}/"
|
||||
}
|
||||
|
||||
rebuild_or_restart() {
|
||||
if [[ "$SKIP_REBUILD" == 1 ]]; then
|
||||
warn "--skip-rebuild set; not rebuilding/restarting Nexus"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local runtime
|
||||
runtime="$(detect_runtime)"
|
||||
info "Runtime: $runtime"
|
||||
case "$runtime" in
|
||||
docker)
|
||||
if [[ -x "${DEPLOY_PATH}/deploy/nexus-1panel.sh" || -f "${DEPLOY_PATH}/deploy/nexus-1panel.sh" ]]; then
|
||||
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/nexus-1panel.sh" upgrade --skip-git
|
||||
else
|
||||
error "Docker runtime detected but deploy/nexus-1panel.sh missing"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" ]]; then
|
||||
run env NEXUS_ROOT="$DEPLOY_PATH" bash "${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh"
|
||||
fi
|
||||
;;
|
||||
supervisor)
|
||||
run supervisorctl restart nexus
|
||||
;;
|
||||
*)
|
||||
error "Unknown runtime. Rebuild/restart manually."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
verify_local_endpoints() {
|
||||
local port health app app_v2
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
port="${port:-8600}"
|
||||
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
|
||||
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
|
||||
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
|
||||
echo " /health -> ${health}"
|
||||
echo " /app/ -> ${app}"
|
||||
echo " /app-v2/ -> ${app_v2}"
|
||||
if [[ "$health" != "ok" || "$app" != "200" || "$app_v2" != "200" ]]; then
|
||||
error "Local endpoint verification failed"
|
||||
exit 1
|
||||
fi
|
||||
info "Local endpoint verification OK"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [[ -z "$TARBALL" ]]; then
|
||||
error "--tarball is required"
|
||||
usage
|
||||
exit 2
|
||||
fi
|
||||
[[ -f "$TARBALL" ]] || {
|
||||
error "Tarball not found: $TARBALL"
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_runtime_cmds
|
||||
|
||||
info "Tarball: $TARBALL"
|
||||
info "Deploy path: $DEPLOY_PATH"
|
||||
info "Backup dir: $BACKUP_DIR"
|
||||
verify_sha256
|
||||
|
||||
local extracted
|
||||
APPLY_TMP="$(mktemp -d /tmp/nexus-release-apply.XXXXXX)"
|
||||
trap cleanup EXIT
|
||||
run tar xzf "$TARBALL" -C "$APPLY_TMP"
|
||||
extracted="${APPLY_TMP}/nexus-release"
|
||||
validate_extracted_tree "$extracted"
|
||||
if [[ "$VALIDATE_ONLY" == 1 ]]; then
|
||||
info "Validate-only mode: tarball checksum and content validation passed"
|
||||
return 0
|
||||
fi
|
||||
backup_current
|
||||
sync_release "$extracted"
|
||||
rebuild_or_restart
|
||||
if [[ "$DRY_RUN" != 1 && "$SKIP_REBUILD" != 1 ]]; then
|
||||
verify_local_endpoints
|
||||
fi
|
||||
info "Release applied successfully"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
+27
-10
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env bash
|
||||
# deploy-frontend.sh — Build Vuetify frontend and deploy to server
|
||||
# deploy-frontend.sh — Build frontend v1 + app-v2 and deploy to server
|
||||
#
|
||||
# Docker 生产：前端在镜像内构建，远程执行 nexus-1panel.sh upgrade
|
||||
# Supervisor：tar 上传到 web/app + supervisorctl restart
|
||||
# Supervisor：tar 上传到 web/app + web/app-v2 + supervisorctl restart
|
||||
#
|
||||
# Usage: bash deploy/deploy-frontend.sh
|
||||
|
||||
@@ -61,16 +61,29 @@ DEPLOY_PATH="${REMOTE_RUNTIME#* }"
|
||||
|
||||
echo "Remote runtime: ${RUNTIME} @ ${DEPLOY_PATH}"
|
||||
|
||||
echo "▶ Building frontend (local verify)..."
|
||||
echo "▶ Building frontend v1 (local verify)..."
|
||||
cd frontend && npx vite build && cd ..
|
||||
if [[ -d frontend-v2 ]]; then
|
||||
echo "▶ Building frontend v2 (/app-v2, local verify)..."
|
||||
(cd frontend-v2 && npm run build:safe)
|
||||
test -f web/app-v2/index.html
|
||||
fi
|
||||
echo "✓ Build complete"
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Docker 生产：重建镜像以包含新前端（非 tar 热更新）..."
|
||||
ssh_cmd "cd ${DEPLOY_PATH} && sudo env NEXUS_ROOT=${DEPLOY_PATH} bash ${DEPLOY_PATH}/deploy/nexus-1panel.sh upgrade"
|
||||
else
|
||||
echo "▶ Packaging..."
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
echo "▶ Packaging web/app and web/app-v2..."
|
||||
pkg_dir="$(mktemp -d)"
|
||||
trap 'rm -rf "${pkg_dir}"' EXIT
|
||||
mkdir -p "${pkg_dir}/app"
|
||||
cp -a web/app/index.html web/app/assets "${pkg_dir}/app/"
|
||||
if [[ -f web/app-v2/index.html && -d web/app-v2/assets ]]; then
|
||||
mkdir -p "${pkg_dir}/app-v2"
|
||||
cp -a web/app-v2/index.html web/app-v2/assets "${pkg_dir}/app-v2/"
|
||||
fi
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C "${pkg_dir}" .
|
||||
echo "✓ Package ready ($(du -h /tmp/nexus-frontend.tar.gz | cut -f1))"
|
||||
|
||||
echo "▶ Uploading to server..."
|
||||
@@ -78,13 +91,15 @@ else
|
||||
echo "✓ Upload complete"
|
||||
|
||||
echo "▶ Deploying on server..."
|
||||
ssh_cmd "cd ${DEPLOY_PATH}/web/app && tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz"
|
||||
ssh_cmd "set -e; mkdir -p ${DEPLOY_PATH}/web; tar xzf /tmp/nexus-frontend.tar.gz -C ${DEPLOY_PATH}/web; rm /tmp/nexus-frontend.tar.gz"
|
||||
echo "▶ Pruning orphaned assets..."
|
||||
if ! ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py --dry-run"; then
|
||||
if [[ -f deploy/prune_frontend_assets.py ]]; then
|
||||
if ! ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app --dry-run"; then
|
||||
echo "✗ Prune dry-run failed"
|
||||
exit 1
|
||||
fi
|
||||
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"
|
||||
ssh_cmd "python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app"
|
||||
fi
|
||||
echo "✓ Extracted and pruned"
|
||||
|
||||
echo "▶ Restarting backend..."
|
||||
@@ -93,15 +108,17 @@ else
|
||||
fi
|
||||
|
||||
sleep 3
|
||||
HEALTH=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
|
||||
HEALTH=$(ssh_cmd "curl -s http://127.0.0.1:8600/health" 2>/dev/null || echo "000")
|
||||
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app/" 2>/dev/null || echo "000")
|
||||
SPA_V2=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8600/app-v2/" 2>/dev/null || echo "000")
|
||||
|
||||
echo ""
|
||||
echo "═══ Verification ═══"
|
||||
echo " /health → $HEALTH"
|
||||
echo " /app/ → $SPA"
|
||||
echo " /app-v2/ → $SPA_V2"
|
||||
|
||||
if [[ "$HEALTH" == "200" || "$HEALTH" == "ok" ]] && [[ "$SPA" == "200" ]]; then
|
||||
if [[ "$HEALTH" == "200" || "$HEALTH" == "ok" ]] && [[ "$SPA" == "200" ]] && [[ "$SPA_V2" == "200" ]]; then
|
||||
echo "✓ Deploy successful!"
|
||||
else
|
||||
echo "✗ Verification failed — check server logs"
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
#
|
||||
# Optional env:
|
||||
# NEXUS_GITEA_TOKEN — if git pull needs auth
|
||||
# NEXUS_GIT_REMOTE — override authenticated remote, default: https://axs.kuma1xn.vip/admin/Nexus.git
|
||||
# SKIP_FRONTEND=1 — Supervisor 模式跳过热更新前端 tar
|
||||
# NEXUS_DEPLOY_PATH — 覆盖自动检测路径
|
||||
|
||||
@@ -31,7 +32,9 @@ echo "Path: ${DEPLOY_PATH}"
|
||||
echo "Runtime: ${RUNTIME}"
|
||||
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
git remote set-url origin "http://admin:${NEXUS_GITEA_TOKEN}@66.154.115.8:3000/admin/Nexus.git"
|
||||
GIT_REMOTE="${NEXUS_GIT_REMOTE:-https://axs.kuma1xn.vip/admin/Nexus.git}"
|
||||
GIT_REMOTE_AUTH="${GIT_REMOTE/https:\/\//https://admin:${NEXUS_GITEA_TOKEN}@}"
|
||||
git remote set-url origin "${GIT_REMOTE_AUTH}"
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
@@ -49,11 +52,20 @@ supervisorctl restart nexus
|
||||
|
||||
if [[ -f /tmp/nexus-frontend.tar.gz && "${SKIP_FRONTEND:-0}" != "1" ]]; then
|
||||
echo "▶ extract /tmp/nexus-frontend.tar.gz..."
|
||||
tar xzf /tmp/nexus-frontend.tar.gz -C web/app
|
||||
mkdir -p web/app web/app-v2
|
||||
if tar tzf /tmp/nexus-frontend.tar.gz | grep -Eq '^(\./)?app/'; then
|
||||
tar xzf /tmp/nexus-frontend.tar.gz -C web
|
||||
else
|
||||
# Backward compatibility for legacy archives containing index.html + assets/ at root.
|
||||
tar xzf /tmp/nexus-frontend.tar.gz -C web/app --exclude=app-v2
|
||||
if tar tzf /tmp/nexus-frontend.tar.gz | grep -Eq '^(\./)?app-v2/'; then
|
||||
tar xzf /tmp/nexus-frontend.tar.gz -C web/app-v2 --strip-components=1 app-v2
|
||||
fi
|
||||
fi
|
||||
rm -f /tmp/nexus-frontend.tar.gz
|
||||
if [[ -f deploy/prune_frontend_assets.py ]]; then
|
||||
python3 deploy/prune_frontend_assets.py --dry-run
|
||||
python3 deploy/prune_frontend_assets.py
|
||||
python3 deploy/prune_frontend_assets.py web/app --dry-run
|
||||
python3 deploy/prune_frontend_assets.py web/app
|
||||
fi
|
||||
supervisorctl restart nexus
|
||||
fi
|
||||
@@ -61,10 +73,12 @@ fi
|
||||
sleep 3
|
||||
HEALTH=$(curl -s "http://127.0.0.1:${PORT}/health" || true)
|
||||
SPA=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/app/" || echo "000")
|
||||
SPA_V2=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/app-v2/" || echo "000")
|
||||
echo " /health → ${HEALTH}"
|
||||
echo " /app/ → ${SPA}"
|
||||
echo " /app-v2/ → ${SPA_V2}"
|
||||
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" ]]; then
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" && "${SPA_V2}" == "200" ]]; then
|
||||
echo "✓ Server deploy OK"
|
||||
suggest_ops_cron "$DEPLOY_PATH"
|
||||
else
|
||||
|
||||
@@ -147,11 +147,23 @@ else
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" || "$RUNTIME" == "supervisor" ]]; then
|
||||
echo "▶ Frontend: local vite build + upload to host web/app..."
|
||||
echo "▶ Frontend: local vite build + upload to host web/app and web/app-v2..."
|
||||
cd frontend && npx vite build && cd ..
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C web/app index.html assets/
|
||||
if [[ -d frontend-v2 ]]; then
|
||||
(cd frontend-v2 && npm run build:safe)
|
||||
test -f web/app-v2/index.html
|
||||
fi
|
||||
pkg_dir="$(mktemp -d)"
|
||||
trap 'rm -rf "${pkg_dir}"' EXIT
|
||||
mkdir -p "${pkg_dir}/app"
|
||||
cp -a web/app/index.html web/app/assets "${pkg_dir}/app/"
|
||||
if [[ -f web/app-v2/index.html && -d web/app-v2/assets ]]; then
|
||||
mkdir -p "${pkg_dir}/app-v2"
|
||||
cp -a web/app-v2/index.html web/app-v2/assets "${pkg_dir}/app-v2/"
|
||||
fi
|
||||
tar czf /tmp/nexus-frontend.tar.gz -C "${pkg_dir}" .
|
||||
scp_cmd /tmp/nexus-frontend.tar.gz "${NEXUS_SSH_HOST}:/tmp/nexus-frontend.tar.gz"
|
||||
ssh_cmd "cd ${DEPLOY_PATH}/web/app && sudo tar xzf /tmp/nexus-frontend.tar.gz && rm /tmp/nexus-frontend.tar.gz && sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app"
|
||||
ssh_cmd "set -e; sudo mkdir -p ${DEPLOY_PATH}/web; sudo tar xzf /tmp/nexus-frontend.tar.gz -C ${DEPLOY_PATH}/web; rm /tmp/nexus-frontend.tar.gz; sudo chown -R ${DEPLOY_CHOWN} ${DEPLOY_PATH}/web/app ${DEPLOY_PATH}/web/app-v2"
|
||||
if ssh_cmd "test -f ${DEPLOY_PATH}/deploy/prune_frontend_assets.py"; then
|
||||
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app --dry-run"
|
||||
ssh_cmd "sudo python3 ${DEPLOY_PATH}/deploy/prune_frontend_assets.py ${DEPLOY_PATH}/web/app"
|
||||
@@ -159,9 +171,9 @@ if [[ "$RUNTIME" == "docker" || "$RUNTIME" == "supervisor" ]]; then
|
||||
fi
|
||||
|
||||
if [[ "$RUNTIME" == "docker" ]]; then
|
||||
echo "▶ Sync host web/app into container..."
|
||||
echo "▶ Sync host web/app and web/app-v2 into container..."
|
||||
ssh_cmd "sudo env NEXUS_ROOT=${DEPLOY_PATH} NEXUS_PUBLISH_PORT=\$(grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod 2>/dev/null | cut -d= -f2 | tr -d '\"' || echo 8600) bash ${DEPLOY_PATH}/deploy/sync_webapp_to_container.sh" || {
|
||||
echo "WARN: web/app sync failed — run sync_webapp_to_container.sh on server manually" >&2
|
||||
echo "WARN: web/app + web/app-v2 sync failed — run sync_webapp_to_container.sh on server manually" >&2
|
||||
}
|
||||
fi
|
||||
|
||||
@@ -170,9 +182,11 @@ PORT="$(ssh_cmd "grep -E '^NEXUS_PUBLISH_PORT=' ${DEPLOY_PATH}/docker/.env.prod
|
||||
PORT="${PORT:-8600}"
|
||||
HEALTH=$(ssh_cmd "curl -s http://127.0.0.1:${PORT}/health" 2>/dev/null || true)
|
||||
SPA=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app/" 2>/dev/null || echo "000")
|
||||
SPA_V2=$(ssh_cmd "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:${PORT}/app-v2/" 2>/dev/null || echo "000")
|
||||
echo " /health → ${HEALTH}"
|
||||
echo " /app/ → ${SPA}"
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" ]]; then
|
||||
echo " /app-v2/ → ${SPA_V2}"
|
||||
if [[ "${HEALTH}" == "ok" && "${SPA}" == "200" && "${SPA_V2}" == "200" ]]; then
|
||||
echo "✓ Deploy successful"
|
||||
if ssh_cmd "command -v crontab >/dev/null && crontab -l 2>/dev/null | grep -q nexus-health-monitor" 2>/dev/null; then
|
||||
echo "✓ Ops cron (health_monitor) already installed"
|
||||
|
||||
@@ -1,16 +1,17 @@
|
||||
#!/usr/bin/env bash
|
||||
# 下载并执行 install-nexus-fresh.sh（公共仓库无需令牌）
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/download-install-fresh.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/download-install-fresh.sh" | bash
|
||||
#
|
||||
# 推荐直接使用:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-axs.kuma1xn.vip}"
|
||||
NEXUS_GITEA_SCHEME="${NEXUS_GITEA_SCHEME:-https}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
OUT="${OUT:-/tmp/install-nexus-fresh.sh}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
@@ -26,7 +27,7 @@ done
|
||||
|
||||
download() {
|
||||
local url base
|
||||
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
for base in "${NEXUS_RAW_BASE}" "${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/install-nexus-fresh.sh"
|
||||
if curl -fsSL "$url" -o "$OUT" 2>/dev/null && head -1 "$OUT" | grep -q '^#!/'; then
|
||||
ok "已下载 install-nexus-fresh.sh"
|
||||
@@ -35,7 +36,7 @@ download() {
|
||||
fi
|
||||
done
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
url="http://${NEXUS_GITEA_HOST}/api/v1/repos/admin/Nexus/raw/deploy/install-nexus-fresh.sh?ref=${NEXUS_GIT_BRANCH}"
|
||||
url="${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/api/v1/repos/admin/Nexus/raw/deploy/install-nexus-fresh.sh?ref=${NEXUS_GIT_BRANCH}"
|
||||
if curl -fsSL -H "Authorization: token ${NEXUS_GITEA_TOKEN}" "$url" -o "$OUT" 2>/dev/null \
|
||||
&& head -1 "$OUT" | grep -q '^#!/'; then
|
||||
ok "已下载（API + 令牌）"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# 适用：全新 VPS / 重装系统后，root 一条命令装完整栈。
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/install-1panel-docker.sh" | bash
|
||||
#
|
||||
# 4 核 16G + 自定义域名:
|
||||
# curl -fsSL ".../install-1panel-docker.sh" | bash -s -- --profile 4c16g --domain api.example.com
|
||||
@@ -23,9 +23,10 @@
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-axs.kuma1xn.vip}"
|
||||
NEXUS_GITEA_SCHEME="${NEXUS_GITEA_SCHEME:-https}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
|
||||
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
|
||||
@@ -233,7 +234,7 @@ download_fresh_installer() {
|
||||
local name="install-nexus-fresh.sh" dest
|
||||
dest="$(mktemp /tmp/install-nexus-fresh.XXXXXX.sh)"
|
||||
local url base
|
||||
for base in "${NEXUS_RAW_BASE}" "http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
for base in "${NEXUS_RAW_BASE}" "${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/${name}"
|
||||
if curl -fsSL "$url" -o "$dest" 2>/dev/null && head -1 "$dest" | grep -q '^#!/'; then
|
||||
chmod +x "$dest"
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
#
|
||||
# 用法（公共仓库，root 下一条命令，参考 1Panel）:
|
||||
#
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
#
|
||||
# 已 clone 到 /opt/nexus:
|
||||
# cd /opt/nexus && bash deploy/install-nexus-fresh.sh --skip-clone
|
||||
@@ -32,12 +32,13 @@ fi
|
||||
|
||||
# ── 默认配置（与 SECRETS.md / nexus-1panel 一致）──
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-axs.kuma1xn.vip}"
|
||||
NEXUS_GITEA_SCHEME="${NEXUS_GITEA_SCHEME:-https}"
|
||||
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
|
||||
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
|
||||
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://66.154.115.8:3000/admin/Nexus/raw/branch/main}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
@@ -195,9 +196,9 @@ phase_packages() {
|
||||
|
||||
git_clone_url() {
|
||||
if [[ -z "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
echo "http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
echo "${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
else
|
||||
echo "http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
echo "${NEXUS_GITEA_SCHEME}://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
# 复制: cp deploy/nexus-1panel.secrets.sh.example deploy/nexus-1panel.secrets.sh
|
||||
# 用于 git push（scripts/git-push.sh）；clone/pull 仍可匿名
|
||||
|
||||
# NEXUS_GITEA_HOST='66.154.115.8:3000'
|
||||
# NEXUS_GITEA_HOST='axs.kuma1xn.vip' # HTTPS Gitea（2026-07-08 起，分支 release/20260708-axs）
|
||||
# NEXUS_GITEA_HOST='axs.kuma1xn.vip' # HTTPS Gitea
|
||||
# NEXUS_GITEA_SCHEME='https'
|
||||
# NEXUS_GITEA_REPO='admin/Nexus.git'
|
||||
# admin 账号密码或 Access Token：
|
||||
# NEXUS_GITEA_TOKEN='你的密码或令牌'
|
||||
|
||||
+19
-9
@@ -2,7 +2,7 @@
|
||||
# Nexus 6.0 — 1Panel + Docker 一键安装 / 升级（参数已全部内置，无需 export）
|
||||
#
|
||||
# 新机 1Panel 终端一条命令:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/nexus-1panel.sh" | bash -s install
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/nexus-1panel.sh" | bash -s install
|
||||
#
|
||||
# 已 clone 到 /opt/nexus:
|
||||
# cd /opt/nexus && bash deploy/nexus-1panel.sh install --skip-clone
|
||||
@@ -24,6 +24,7 @@ set -euo pipefail
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-axs.kuma1xn.vip}"
|
||||
NEXUS_GITEA_SCHEME="${NEXUS_GITEA_SCHEME:-https}"
|
||||
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
|
||||
NEXUS_DOMAIN="${NEXUS_DOMAIN:-api.synaglobal.vip}"
|
||||
NEXUS_PROFILE="${NEXUS_PROFILE:-2c8g}"
|
||||
@@ -182,9 +183,13 @@ apply_pool_to_env_prod() {
|
||||
local root="$1" prof="$2"
|
||||
local env_file="$root/$ENV_PROD"
|
||||
[[ -f "$env_file" ]] || return 0
|
||||
if [[ ! -f "$prof" ]]; then
|
||||
warn "未找到资源档位文件: $prof，保留 $ENV_PROD 中现有数据库连接池配置"
|
||||
return 0
|
||||
fi
|
||||
local pool overflow
|
||||
pool="$(grep -E '^NEXUS_DB_POOL_SIZE=' "$prof" | cut -d= -f2-)"
|
||||
overflow="$(grep -E '^NEXUS_DB_MAX_OVERFLOW=' "$prof" | cut -d= -f2-)"
|
||||
pool="$(grep -E '^NEXUS_DB_POOL_SIZE=' "$prof" | cut -d= -f2- || true)"
|
||||
overflow="$(grep -E '^NEXUS_DB_MAX_OVERFLOW=' "$prof" | cut -d= -f2- || true)"
|
||||
[[ -n "$pool" ]] && sed -i "s|^NEXUS_DB_POOL_SIZE=.*|NEXUS_DB_POOL_SIZE=${pool}|" "$env_file"
|
||||
[[ -n "$overflow" ]] && sed -i "s|^NEXUS_DB_MAX_OVERFLOW=.*|NEXUS_DB_MAX_OVERFLOW=${overflow}|" "$env_file"
|
||||
}
|
||||
@@ -557,7 +562,11 @@ parse_gitea_endpoint() {
|
||||
GITEA_HOST="${hp%%:*}"
|
||||
GITEA_PORT="${hp##*:}"
|
||||
if [[ "$GITEA_HOST" == "$GITEA_PORT" || -z "$GITEA_PORT" ]]; then
|
||||
GITEA_PORT=3000
|
||||
case "${NEXUS_GITEA_SCHEME:-https}" in
|
||||
http) GITEA_PORT=80 ;;
|
||||
https) GITEA_PORT=443 ;;
|
||||
*) GITEA_PORT=443 ;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -726,10 +735,7 @@ require_token() {
|
||||
}
|
||||
|
||||
git_remote_url() {
|
||||
local scheme=http
|
||||
if [[ "$NEXUS_GITEA_HOST" != *:* ]]; then
|
||||
scheme="${NEXUS_GITEA_SCHEME:-https}"
|
||||
fi
|
||||
local scheme="${NEXUS_GITEA_SCHEME:-https}"
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
echo "${scheme}://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
else
|
||||
@@ -1023,10 +1029,14 @@ verify_health() {
|
||||
}
|
||||
|
||||
ensure_repo() {
|
||||
if [[ ! -d "$NEXUS_ROOT/.git" ]]; then
|
||||
if [[ ! -d "$NEXUS_ROOT" ]]; then
|
||||
error "未找到 $NEXUS_ROOT，请先: bash $0 install"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$SKIP_GIT" != true && ! -d "$NEXUS_ROOT/.git" ]]; then
|
||||
error "未找到 $NEXUS_ROOT/.git，请先: bash $0 install；如为发布包/rsync 部署请使用 --skip-git"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
|
||||
error "缺少 $NEXUS_ROOT/$ENV_PROD"
|
||||
exit 1
|
||||
|
||||
@@ -0,0 +1,197 @@
|
||||
#!/usr/bin/env bash
|
||||
# Nexus production host preflight before applying a release tarball.
|
||||
#
|
||||
# Usage:
|
||||
# bash deploy/preflight-release-host.sh \
|
||||
# --tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
# --sha256 a4eb8f35f0b98d40c1ad83117bfc652e7686ffc7d55f6bf90fcfd433a2ad6701 \
|
||||
# --deploy-path /opt/nexus
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TARBALL=""
|
||||
EXPECTED_SHA256=""
|
||||
DEPLOY_PATH="${NEXUS_DEPLOY_PATH:-/opt/nexus}"
|
||||
MIN_FREE_MB="${NEXUS_RELEASE_MIN_FREE_MB:-1024}"
|
||||
|
||||
info() { echo -e "\033[0;32m[INFO]\033[0m $*"; }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||
error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||
|
||||
usage() {
|
||||
sed -n '1,12p' "$0"
|
||||
}
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--tarball)
|
||||
TARBALL="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--sha256)
|
||||
EXPECTED_SHA256="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--deploy-path)
|
||||
DEPLOY_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--min-free-mb)
|
||||
MIN_FREE_MB="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Unknown argument: $1"
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
check_cmd() {
|
||||
local cmd="$1"
|
||||
if command -v "$cmd" >/dev/null 2>&1; then
|
||||
info "command OK: $cmd"
|
||||
return 0
|
||||
fi
|
||||
error "missing command: $cmd"
|
||||
return 1
|
||||
}
|
||||
|
||||
docker_cmd() {
|
||||
if docker "$@" 2>/dev/null; then return 0; fi
|
||||
sudo docker "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
detect_runtime() {
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]] && command -v docker >/dev/null 2>&1; then
|
||||
echo docker
|
||||
return
|
||||
fi
|
||||
if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
|
||||
echo supervisor
|
||||
return
|
||||
fi
|
||||
echo unknown
|
||||
}
|
||||
|
||||
verify_tarball() {
|
||||
if [[ -z "$TARBALL" ]]; then
|
||||
warn "--tarball not provided; skipping tarball checksum/content checks"
|
||||
return 0
|
||||
fi
|
||||
[[ -f "$TARBALL" ]] || {
|
||||
error "tarball not found: $TARBALL"
|
||||
return 1
|
||||
}
|
||||
info "tarball exists: $TARBALL"
|
||||
if [[ -n "$EXPECTED_SHA256" ]]; then
|
||||
local actual
|
||||
actual="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
||||
if [[ "$actual" != "$EXPECTED_SHA256" ]]; then
|
||||
error "SHA256 mismatch: expected=$EXPECTED_SHA256 actual=$actual"
|
||||
return 1
|
||||
fi
|
||||
info "SHA256 OK: $actual"
|
||||
else
|
||||
warn "--sha256 not provided; checksum not verified"
|
||||
fi
|
||||
tar tzf "$TARBALL" nexus-release/server nexus-release/deploy nexus-release/web/app-v2 >/dev/null
|
||||
info "tarball required paths OK"
|
||||
}
|
||||
|
||||
check_deploy_path() {
|
||||
if [[ -d "$DEPLOY_PATH" ]]; then
|
||||
info "deploy path exists: $DEPLOY_PATH"
|
||||
else
|
||||
warn "deploy path does not exist yet: $DEPLOY_PATH"
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/.env" ]]; then
|
||||
info "runtime .env preserved path exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/.env not found"
|
||||
fi
|
||||
if [[ -f "${DEPLOY_PATH}/docker/.env.prod" ]]; then
|
||||
info "docker/.env.prod exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/docker/.env.prod not found"
|
||||
fi
|
||||
if [[ -d "${DEPLOY_PATH}/web/data" ]]; then
|
||||
info "web/data exists"
|
||||
else
|
||||
warn "${DEPLOY_PATH}/web/data not found"
|
||||
fi
|
||||
}
|
||||
|
||||
check_disk_space() {
|
||||
local target free_mb
|
||||
target="$DEPLOY_PATH"
|
||||
[[ -e "$target" ]] || target="$(dirname "$DEPLOY_PATH")"
|
||||
free_mb="$(df -Pm "$target" | awk 'NR==2 {print $4}')"
|
||||
if [[ -z "$free_mb" ]]; then
|
||||
warn "unable to determine free disk space for $target"
|
||||
return 0
|
||||
fi
|
||||
if (( free_mb < MIN_FREE_MB )); then
|
||||
error "low disk space on $target: ${free_mb}MB < ${MIN_FREE_MB}MB"
|
||||
return 1
|
||||
fi
|
||||
info "disk free OK: ${free_mb}MB >= ${MIN_FREE_MB}MB"
|
||||
}
|
||||
|
||||
check_runtime() {
|
||||
local runtime
|
||||
runtime="$(detect_runtime)"
|
||||
info "runtime detected: $runtime"
|
||||
case "$runtime" in
|
||||
docker)
|
||||
docker_cmd ps --format '{{.Names}}' | grep -E 'nexus-prod-nexus|nexus-nexus-1' >/dev/null \
|
||||
&& info "Nexus docker container found" \
|
||||
|| warn "Nexus docker container not found by known name pattern"
|
||||
;;
|
||||
supervisor)
|
||||
supervisorctl status nexus || true
|
||||
;;
|
||||
*)
|
||||
warn "runtime unknown; apply script may require manual restart"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
check_local_endpoint() {
|
||||
local port health app app_v2
|
||||
port="$(grep -E '^NEXUS_PUBLISH_PORT=' "${DEPLOY_PATH}/docker/.env.prod" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '\r" ' || true)"
|
||||
port="${port:-8600}"
|
||||
health="$(curl -s "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
|
||||
app="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/" 2>/dev/null || echo 000)"
|
||||
app_v2="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app-v2/" 2>/dev/null || echo 000)"
|
||||
echo " current /health -> ${health:-<empty>}"
|
||||
echo " current /app/ -> ${app}"
|
||||
echo " current /app-v2/ -> ${app_v2}"
|
||||
}
|
||||
|
||||
main() {
|
||||
local failures=0
|
||||
for cmd in tar sha256sum df awk grep sed curl; do
|
||||
check_cmd "$cmd" || failures=$((failures + 1))
|
||||
done
|
||||
check_cmd rsync || failures=$((failures + 1))
|
||||
|
||||
verify_tarball || failures=$((failures + 1))
|
||||
check_deploy_path
|
||||
check_disk_space || failures=$((failures + 1))
|
||||
check_runtime
|
||||
check_local_endpoint
|
||||
|
||||
if (( failures > 0 )); then
|
||||
error "preflight failed: ${failures} blocking issue(s)"
|
||||
return 1
|
||||
fi
|
||||
info "preflight OK"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -3,10 +3,10 @@
|
||||
# Nexus 6.0 — 公共仓库一键安装入口（参考 1Panel quick_start.sh）
|
||||
#
|
||||
# root 登录后一条命令:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" | bash
|
||||
#
|
||||
# 或保存后执行:
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/quick-install.sh" -o /tmp/quick-install.sh
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/quick-install.sh" -o /tmp/quick-install.sh
|
||||
# bash /tmp/quick-install.sh
|
||||
#
|
||||
# 可选参数会传给 install-nexus-fresh.sh，例如:
|
||||
@@ -15,11 +15,12 @@
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-66.154.115.8:3000}"
|
||||
NEXUS_GITEA_HOST="${NEXUS_GITEA_HOST:-axs.kuma1xn.vip}"
|
||||
NEXUS_GITEA_SCHEME="${NEXUS_GITEA_SCHEME:-https}"
|
||||
NEXUS_GITEA_REPO="${NEXUS_GITEA_REPO:-admin/Nexus.git}"
|
||||
NEXUS_GIT_BRANCH="${NEXUS_GIT_BRANCH:-main}"
|
||||
NEXUS_ROOT="${NEXUS_ROOT:-/opt/nexus}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
NEXUS_RAW_BASE="${NEXUS_RAW_BASE:-${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/branch/${NEXUS_GIT_BRANCH}}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
@@ -57,7 +58,7 @@ download_script() {
|
||||
local url base
|
||||
for base in \
|
||||
"${NEXUS_RAW_BASE}" \
|
||||
"http://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
"${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/admin/Nexus/raw/${NEXUS_GIT_BRANCH}"; do
|
||||
url="${base}/deploy/${name}"
|
||||
if curl -fsSL "$url" -o "$dest" 2>/dev/null && validate_script_file "$dest"; then
|
||||
info "已下载 ${name}"
|
||||
@@ -68,9 +69,9 @@ download_script() {
|
||||
}
|
||||
|
||||
run_via_git() {
|
||||
local url="http://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
local url="${NEXUS_GITEA_SCHEME}://${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
if [[ -n "${NEXUS_GITEA_TOKEN:-}" ]]; then
|
||||
url="http://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
url="${NEXUS_GITEA_SCHEME}://admin:${NEXUS_GITEA_TOKEN}@${NEXUS_GITEA_HOST}/${NEXUS_GITEA_REPO}"
|
||||
fi
|
||||
step "改用 git clone..."
|
||||
mkdir -p "$(dirname "$NEXUS_ROOT")"
|
||||
|
||||
Regular → Executable
+24
-7
@@ -1,5 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
# Sync Git-tracked web/app into the running Nexus Docker container.
|
||||
# Sync Git-tracked web/app and web/app-v2 into the running Nexus Docker container.
|
||||
#
|
||||
# Root cause: Dockerfile.prod runs vite build inside the image; Docker layer cache
|
||||
# can produce asset hashes that differ from committed web/app on the host.
|
||||
@@ -36,11 +36,12 @@ resolve_container() {
|
||||
}
|
||||
|
||||
verify_entry_bundle() {
|
||||
local html bundle_path code
|
||||
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}/app/" 2>/dev/null || true)"
|
||||
bundle_path="$(printf '%s' "$html" | sed -n 's/.*src="\(\/app\/assets\/index-[^"]*\.js\)".*/\1/p' | head -1)"
|
||||
local prefix html bundle_path code
|
||||
prefix="$1"
|
||||
html="$(curl -sf "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${prefix}/" 2>/dev/null || true)"
|
||||
bundle_path="$(printf '%s' "$html" | grep -oE "${prefix}"'/assets/index-[^"]+\.js' | head -1 || true)"
|
||||
if [[ -z "$bundle_path" ]]; then
|
||||
error "/app/ index.html 未解析到主 bundle"
|
||||
error "${prefix}/ index.html 未解析到主 bundle"
|
||||
exit 1
|
||||
fi
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${NEXUS_PUBLISH_PORT}${bundle_path}" 2>/dev/null || echo 000)"
|
||||
@@ -53,6 +54,7 @@ verify_entry_bundle() {
|
||||
|
||||
main() {
|
||||
local app="${NEXUS_ROOT}/web/app"
|
||||
local app_v2="${NEXUS_ROOT}/web/app-v2"
|
||||
if [[ ! -f "${app}/index.html" ]]; then
|
||||
error "缺少 ${app}/index.html，请先 git pull"
|
||||
exit 1
|
||||
@@ -61,6 +63,14 @@ main() {
|
||||
error "缺少 ${app}/assets"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "${app_v2}/index.html" ]]; then
|
||||
error "缺少 ${app_v2}/index.html，请先构建 frontend-v2"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d "${app_v2}/assets" ]]; then
|
||||
error "缺少 ${app_v2}/assets"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
resolve_container
|
||||
|
||||
@@ -74,14 +84,21 @@ main() {
|
||||
docker_cmd cp "${app}/favicon.ico" "${CONTAINER}:/app/web/app/favicon.ico" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
info "同步 web/app-v2 → 容器 /app/web/app-v2 ..."
|
||||
docker_cmd exec "$CONTAINER" rm -rf /app/web/app-v2/assets
|
||||
docker_cmd exec "$CONTAINER" mkdir -p /app/web/app-v2
|
||||
docker_cmd cp "${app_v2}/index.html" "${CONTAINER}:/app/web/app-v2/index.html"
|
||||
docker_cmd cp "${app_v2}/assets" "${CONTAINER}:/app/web/app-v2/assets"
|
||||
|
||||
if [[ -x "${NEXUS_ROOT}/deploy/prune_frontend_assets.py" ]]; then
|
||||
info "容器内 prune 未引用 assets（可选）..."
|
||||
docker_cmd exec "$CONTAINER" python3 /app/deploy/prune_frontend_assets.py --dry-run 2>/dev/null || \
|
||||
warn "容器内 prune 跳过（脚本或路径不可用）"
|
||||
fi
|
||||
|
||||
verify_entry_bundle
|
||||
info "web/app 同步完成"
|
||||
verify_entry_bundle "/app"
|
||||
verify_entry_bundle "/app-v2"
|
||||
info "web/app 与 web/app-v2 同步完成"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
+1
-1
@@ -7,7 +7,7 @@
|
||||
#
|
||||
# 远程一条命令（推荐在仓库目录执行，管道模式会回退 /opt/nexus）:
|
||||
# cd /opt/nexus && bash deploy/update.sh
|
||||
# curl -fsSL "http://66.154.115.8:3000/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
# curl -fsSL "https://axs.kuma1xn.vip/admin/Nexus/raw/branch/main/deploy/update.sh" | bash
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# 宝塔未安装时一键登录友好提示
|
||||
|
||||
**日期**：2026-07-09
|
||||
|
||||
## 摘要
|
||||
|
||||
未安装宝塔的子机点击「宝塔一键登录」时，不再抛出 Python `ModuleNotFoundError: public` 堆栈，改为明确中文：`该机未检测到宝塔面板…`。
|
||||
|
||||
## 动机
|
||||
|
||||
运维误对无宝塔机器点登录，SSH 回退脚本 `import public` 失败，前端只显示晦涩 Traceback。
|
||||
|
||||
## 涉及文件
|
||||
|
||||
| 路径 | 说明 |
|
||||
|------|------|
|
||||
| `server/infrastructure/btpanel/ssh_login.py` | `BtPanelNotInstalledError`、`humanize_ssh_login_error`、SSH 前检测 `common.py` |
|
||||
| `server/application/services/btpanel_service.py` | bootstrap `bt_not_installed` 不再回退 SSH |
|
||||
| `server/api/btpanel.py` | 400 + 友好 `detail` |
|
||||
| `tests/test_btpanel_ssh_login.py` | 未安装 / public 模块报错映射 |
|
||||
|
||||
## 验证
|
||||
|
||||
```bash
|
||||
.venv/bin/pytest tests/test_btpanel_ssh_login.py tests/test_btpanel_temp_login_ttl.py -q
|
||||
```
|
||||
|
||||
对未装宝塔机器 `POST /api/btpanel/servers/{id}/login-url` → HTTP 400，detail 含「未检测到宝塔面板」。
|
||||
@@ -0,0 +1,53 @@
|
||||
# Codex 审批代理修复说明（2026-07-08）
|
||||
|
||||
## 问题
|
||||
|
||||
当前线程的高权限命令审批使用 `auto_review`，它会请求 `codex-auto-review` 模型。
|
||||
你的 CC Switch / custom provider 当前只支持 `gpt-5.5`，不支持 `codex-auto-review`，所以 SSH、scp、联网验证都会被拒绝。
|
||||
|
||||
## 修复方式
|
||||
|
||||
把当前线程的审批人从：
|
||||
|
||||
```json
|
||||
"approvalsReviewer": "auto_review"
|
||||
```
|
||||
|
||||
改成：
|
||||
|
||||
```json
|
||||
"approvalsReviewer": "user"
|
||||
```
|
||||
|
||||
这样以后高权限命令会弹给你手动确认，而不是走坏掉的自动审核模型。
|
||||
|
||||
## 我已生成脚本
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\fix-codex-approval-reviewer.ps1
|
||||
```
|
||||
|
||||
## 运行方法
|
||||
|
||||
在 PowerShell 里执行：
|
||||
|
||||
```powershell
|
||||
Set-ExecutionPolicy -Scope Process Bypass
|
||||
& "C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\fix-codex-approval-reviewer.ps1"
|
||||
```
|
||||
|
||||
脚本会自动备份：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\.codex\.codex-global-state.json.bak-switch-approval-时间戳
|
||||
```
|
||||
|
||||
## 运行后
|
||||
|
||||
建议重启 Codex，或者关闭再打开当前线程。然后我就可以再次尝试：
|
||||
|
||||
```cmd
|
||||
python scripts\publish_release_bundle.py --remote nexus --tarball ... --sha256 ...
|
||||
```
|
||||
|
||||
届时应该会弹出手动审批，而不是再报 `codex-auto-review` 不支持。
|
||||
@@ -0,0 +1,380 @@
|
||||
# Nexus API / Service / 数据库调用链索引报告
|
||||
|
||||
生成时间：2026-07-07
|
||||
|
||||
## 1. 总览
|
||||
|
||||
| 项目 | 数量 |
|
||||
| --- | --- |
|
||||
| API 路由 | 214 |
|
||||
| Service 方法 | 324 |
|
||||
| 调用边 | 16780 |
|
||||
| 数据库调用点 | 437 |
|
||||
| Redis 调用点 | 729 |
|
||||
| SSH/远程命令调用点 | 346 |
|
||||
| 宝塔相关流 | 183 |
|
||||
|
||||
## 2. API 方法分布
|
||||
|
||||
| HTTP 方法 | 数量 |
|
||||
| --- | --- |
|
||||
| POST | 104 |
|
||||
| GET | 77 |
|
||||
| PUT | 18 |
|
||||
| DELETE | 13 |
|
||||
| PATCH | 2 |
|
||||
|
||||
## 3. API 风险标签分布
|
||||
|
||||
| 风险标签 | 路由数 |
|
||||
| --- | --- |
|
||||
| file | 37 |
|
||||
| ssh | 35 |
|
||||
| script | 34 |
|
||||
| btpanel | 28 |
|
||||
| install | 18 |
|
||||
| login | 11 |
|
||||
| terminal | 7 |
|
||||
|
||||
## 4. 高优先级 API 路由（按风险标签/服务调用筛选）
|
||||
|
||||
| 方法 | 路径 | 风险标签 | 入口 | 函数 | Service 调用候选 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| POST | /script-callback | script | server/api/agent.py:245 | script_job_callback | |
|
||||
| GET | /nodes | script | server/api/assets.py:126 | list_nodes | |
|
||||
| GET | /ssh-sessions | script,ssh | server/api/assets.py:230 | list_ssh_sessions | |
|
||||
| GET | /command-logs | script,ssh | server/api/assets.py:282 | list_command_logs | |
|
||||
| GET | /login-access | login | server/api/auth.py:116 | login_access | |
|
||||
| POST | /login | login | server/api/auth.py:128 | login | service.login |
|
||||
| POST | /refresh | | server/api/auth.py:173 | refresh_token | service.refresh_token |
|
||||
| POST | /logout | | server/api/auth.py:214 | logout | service.logout_by_token |
|
||||
| POST | /totp/setup | | server/api/auth.py:235 | setup_totp | service.setup_totp |
|
||||
| POST | /totp/enable | | server/api/auth.py:258 | enable_totp | service.enable_totp |
|
||||
| POST | /totp/disable | | server/api/auth.py:280 | disable_totp | service.disable_totp |
|
||||
| PUT | /password | login | server/api/auth.py:303 | change_password | AuthService, auth_service._delete_all_refresh_tokens, AuthService._verify_totp |
|
||||
| POST | /webssh-token | ssh | server/api/auth.py:363 | issue_webssh_token | service.create_webssh_token |
|
||||
| GET | /me | login | server/api/auth.py:385 | get_me | |
|
||||
| GET | /servers | btpanel | server/api/btpanel.py:60 | list_bt_servers | |
|
||||
| GET | /servers/{server_id}/config | btpanel,install,script,ssh | server/api/btpanel.py:68 | get_bt_config | |
|
||||
| PUT | /servers/{server_id}/config | btpanel | server/api/btpanel.py:81 | update_bt_config | |
|
||||
| GET | /settings | btpanel | server/api/btpanel.py:103 | get_bt_global_settings | |
|
||||
| PUT | /settings | btpanel | server/api/btpanel.py:111 | update_bt_global_settings | |
|
||||
| POST | /servers/{server_id}/bootstrap | btpanel | server/api/btpanel.py:129 | bootstrap_bt_server | |
|
||||
| POST | /servers/batch-bootstrap | btpanel | server/api/btpanel.py:148 | batch_bootstrap_bt_servers | |
|
||||
| POST | /servers/{server_id}/login-url | btpanel,login | server/api/btpanel.py:166 | create_bt_login_url | |
|
||||
| GET | /servers/{server_id}/system/total | btpanel | server/api/btpanel.py:183 | bt_system_total | |
|
||||
| GET | /servers/{server_id}/system/disk | btpanel | server/api/btpanel.py:191 | bt_system_disk | |
|
||||
| GET | /servers/{server_id}/system/network | btpanel | server/api/btpanel.py:199 | bt_system_network | |
|
||||
| GET | /servers/{server_id}/sites | btpanel | server/api/btpanel.py:207 | bt_list_sites | |
|
||||
| POST | /servers/{server_id}/sites/start | btpanel | server/api/btpanel.py:215 | bt_site_start | |
|
||||
| POST | /servers/{server_id}/sites/stop | btpanel | server/api/btpanel.py:228 | bt_site_stop | |
|
||||
| GET | /servers/{server_id}/sites/php-versions | btpanel | server/api/btpanel.py:241 | bt_php_versions | |
|
||||
| POST | /servers/{server_id}/sites | btpanel | server/api/btpanel.py:249 | bt_create_site | |
|
||||
| GET | /servers/{server_id}/sites/{site_id}/domains | btpanel | server/api/btpanel.py:280 | bt_list_domains | |
|
||||
| POST | /servers/{server_id}/domains | btpanel | server/api/btpanel.py:293 | bt_add_domain | |
|
||||
| POST | /servers/{server_id}/domains/delete | btpanel | server/api/btpanel.py:306 | bt_delete_domain | |
|
||||
| GET | /servers/{server_id}/ssl/sites | btpanel | server/api/btpanel.py:319 | bt_ssl_sites | |
|
||||
| POST | /servers/{server_id}/ssl/set | btpanel | server/api/btpanel.py:327 | bt_set_ssl | |
|
||||
| POST | /servers/{server_id}/ssl/apply | btpanel | server/api/btpanel.py:345 | bt_apply_ssl | |
|
||||
| GET | /servers/{server_id}/databases | btpanel | server/api/btpanel.py:358 | bt_list_databases | |
|
||||
| POST | /servers/{server_id}/databases | btpanel | server/api/btpanel.py:366 | bt_create_database | |
|
||||
| POST | /servers/{server_id}/databases/password | btpanel | server/api/btpanel.py:384 | bt_db_password | |
|
||||
| POST | /servers/{server_id}/databases/backup | btpanel | server/api/btpanel.py:397 | bt_db_backup | |
|
||||
| GET | /servers/{server_id}/crontab | btpanel | server/api/btpanel.py:410 | bt_crontab | |
|
||||
| POST | /servers/{server_id}/services | btpanel | server/api/btpanel.py:418 | bt_service_admin | _svc.service_admin |
|
||||
| GET | '' | script | server/api/execution_records.py:20 | list_records | |
|
||||
| GET | /{record_id} | script | server/api/execution_records.py:41 | get_record_detail | |
|
||||
| GET | /browse | file,ssh | server/api/files.py:40 | browse_directory_get | |
|
||||
| GET | /status | install | server/api/install.py:972 | install_status | |
|
||||
| GET | /env-check | install | server/api/install.py:1006 | env_check | |
|
||||
| POST | /test-credentials | install | server/api/install.py:1097 | test_credentials | |
|
||||
| GET | /connection-check | file,install | server/api/install.py:1113 | connection_check | |
|
||||
| POST | /init-db | install | server/api/install.py:1153 | init_db | |
|
||||
| POST | /create-admin | install | server/api/install.py:1327 | create_admin | |
|
||||
| POST | /lock | install | server/api/install.py:1426 | lock_install | |
|
||||
| GET | /state | file,install | server/api/install.py:1469 | get_install_state | |
|
||||
| GET | / | script | server/api/scripts.py:31 | list_scripts | service.list_scripts |
|
||||
| GET | /exec-config | script | server/api/scripts.py:42 | script_exec_config | |
|
||||
| GET | /credentials | script | server/api/scripts.py:56 | list_credentials | service.list_credentials |
|
||||
| POST | /credentials | script | server/api/scripts.py:66 | create_credential | service.create_credential |
|
||||
| PUT | /credentials/{id} | script | server/api/scripts.py:90 | update_credential | |
|
||||
| DELETE | /credentials/{id} | script | server/api/scripts.py:131 | delete_credential | service.delete_credential |
|
||||
| GET | /executions | script | server/api/scripts.py:152 | list_executions | service.list_executions |
|
||||
| POST | /executions/{id}/stop | script | server/api/scripts.py:167 | stop_execution | service.stop_execution, service.get_execution_detail |
|
||||
| POST | /executions/{id}/mark-stuck | script | server/api/scripts.py:181 | mark_execution_stuck | service.mark_execution_stuck, service.get_execution_detail |
|
||||
| POST | /executions/{id}/retry | script | server/api/scripts.py:198 | retry_execution | service._parse_execution_meta, service.get_execution, service.get_execution_detail, service.retry_execution |
|
||||
| GET | /executions/{id} | script | server/api/scripts.py:238 | get_execution | service.get_execution_detail |
|
||||
| GET | /{id} | script | server/api/scripts.py:258 | get_script | service.get_script |
|
||||
| POST | / | script | server/api/scripts.py:271 | create_script | service.create_script |
|
||||
| PUT | /{id} | script | server/api/scripts.py:295 | update_script | service.get_script, service.update_script |
|
||||
| DELETE | /{id} | script | server/api/scripts.py:325 | delete_script | service.get_script, service.delete_script |
|
||||
| POST | /exec | script | server/api/scripts.py:364 | execute_command | service.get_execution_detail, service.execute_command |
|
||||
| GET | / | script | server/api/search.py:32 | global_search | |
|
||||
| GET | / | script | server/api/servers.py:94 | list_servers | |
|
||||
| GET | /terminal-search-history | terminal | server/api/servers.py:436 | get_terminal_search_history | |
|
||||
| PUT | /terminal-search-history | terminal | server/api/servers.py:454 | update_terminal_search_history | |
|
||||
| GET | /logs | script | server/api/servers.py:491 | get_all_sync_logs | |
|
||||
| GET | /meta/api_base_url | install | server/api/servers.py:561 | get_api_base_url | |
|
||||
| GET | /import/template | file | server/api/servers.py:570 | download_import_template | |
|
||||
| POST | /import | file | server/api/servers.py:589 | import_servers | service.create_server |
|
||||
| POST | /batch/install-agent | install | server/api/servers.py:832 | batch_install_agent | |
|
||||
| POST | /batch/detect-path | ssh | server/api/servers.py:850 | batch_detect_path | |
|
||||
| POST | /batch/uninstall-agent | install | server/api/servers.py:859 | batch_uninstall_agent | |
|
||||
| GET | /pending | script,ssh | server/api/servers.py:977 | list_pending_servers | |
|
||||
| POST | /add-by-ip | login,ssh | server/api/servers.py:1099 | add_server_by_ip | |
|
||||
| GET | /{id} | | server/api/servers.py:1334 | get_server | service.get_server |
|
||||
| GET | /{id}/metrics | | server/api/servers.py:1362 | get_server_metrics | service.get_server |
|
||||
| GET | /{id}/files-capability | file,ssh | server/api/servers.py:1407 | get_files_capability | service.get_server |
|
||||
| POST | /{id}/setup-files-sudo | file,install,ssh | server/api/servers.py:1422 | setup_files_sudo | service.get_server |
|
||||
| POST | / | file,ssh | server/api/servers.py:1463 | create_server | service.create_server |
|
||||
| PUT | /{id} | file,ssh | server/api/servers.py:1537 | update_server | service.get_server, service.update_server |
|
||||
| DELETE | /{id} | | server/api/servers.py:1629 | delete_server | service.get_server, service.delete_server |
|
||||
| POST | /{id}/agent-key | | server/api/servers.py:1659 | generate_agent_api_key | service.get_server, service.update_server |
|
||||
| POST | /{id}/install-agent | install,ssh | server/api/servers.py:1711 | install_agent_remote | service.get_server, service.update_server |
|
||||
| POST | /{id}/uninstall-agent | file,install,ssh | server/api/servers.py:1818 | uninstall_agent_remote | service.get_server |
|
||||
| POST | /{id}/agent-install-cmd | install | server/api/servers.py:1897 | get_agent_install_cmd | service.get_server |
|
||||
| POST | /{id}/upgrade-agent | ssh | server/api/servers.py:1965 | upgrade_agent | service.get_server |
|
||||
| POST | /{id}/agent-diagnose | ssh | server/api/servers.py:2067 | agent_diagnose | service.get_server |
|
||||
| POST | /check | ssh | server/api/servers.py:2105 | check_servers | |
|
||||
| GET | /ip-allowlist | login,script | server/api/settings.py:168 | get_ip_allowlist | |
|
||||
| GET | /bing-wallpaper | file | server/api/settings.py:307 | bing_wallpaper | |
|
||||
| PUT | /{id} | script | server/api/settings.py:476 | update_schedule | |
|
||||
| GET | / | ssh | server/api/settings.py:684 | list_ssh_key_presets | |
|
||||
| POST | / | ssh | server/api/settings.py:702 | create_ssh_key_preset | |
|
||||
| PUT | /{id} | ssh | server/api/settings.py:742 | update_ssh_key_preset | |
|
||||
| POST | /{id}/reveal | ssh | server/api/settings.py:795 | reveal_ssh_key_preset | |
|
||||
| DELETE | /{id} | ssh | server/api/settings.py:828 | delete_ssh_key_preset | |
|
||||
| GET | / | script | server/api/settings.py:856 | list_alert_history | |
|
||||
| GET | /ops-patrol/status | install | server/api/settings.py:1035 | ops_patrol_status | |
|
||||
| POST | /ops-patrol/sync-telegram | file | server/api/settings.py:1056 | ops_patrol_sync_telegram | |
|
||||
| POST | /ip-allowlist/parse-subscription | script | server/api/settings.py:1398 | parse_subscription | |
|
||||
| POST | /ip-allowlist | login,script | server/api/settings.py:1503 | set_ip_allowlist | |
|
||||
| POST | /ip-allowlist/toggle | login | server/api/settings.py:1569 | toggle_ip_allowlist | |
|
||||
| POST | /ip-allowlist/manual | login | server/api/settings.py:1596 | add_manual_ips | |
|
||||
| DELETE | /ip-allowlist/ip | login | server/api/settings.py:1632 | remove_allowlist_ip | |
|
||||
| POST | /files | file | server/api/sync_v2.py:80 | sync_files | |
|
||||
| POST | /preview | file | server/api/sync_v2.py:128 | preview_sync | |
|
||||
| POST | /file-ops | file,ssh | server/api/sync_v2.py:161 | file_operation | |
|
||||
| POST | /file-clipboard | file,ssh | server/api/sync_v2.py:228 | apply_file_clipboard | |
|
||||
| POST | /browse | file,ssh | server/api/sync_v2.py:291 | browse_directory | |
|
||||
| POST | /browse-local | file | server/api/sync_v2.py:322 | browse_local_directory | |
|
||||
| POST | /local-file-ops | file | server/api/sync_v2.py:361 | local_file_operation | |
|
||||
| POST | /local-file-preview | file | server/api/sync_v2.py:432 | local_file_preview | |
|
||||
|
||||
## 5. 典型调用链样例
|
||||
|
||||
| API | 入口 | 标签 | 调用链候选 |
|
||||
| --- | --- | --- | --- |
|
||||
| POST /script-callback | server/api/agent.py:245 | script | 未匹配到 service_calls |
|
||||
| GET /nodes | server/api/assets.py:126 | script | 未匹配到 service_calls |
|
||||
| GET /ssh-sessions | server/api/assets.py:230 | script,ssh | 未匹配到 service_calls |
|
||||
| GET /command-logs | server/api/assets.py:282 | script,ssh | 未匹配到 service_calls |
|
||||
| GET /login-access | server/api/auth.py:116 | login | 未匹配到 service_calls |
|
||||
| POST /login | server/api/auth.py:128 | login | AuthService.login(DB×7;Redis×15;SSH×2) |
|
||||
| PUT /password | server/api/auth.py:303 | login | AuthService.__init__(DB×7;Redis×15;SSH×2) -> AuthService.refresh_token(DB×7;Redis×15;SSH×2) -> AuthService._verify_totp(DB×7;Redis×15;SSH×2) |
|
||||
| POST /webssh-token | server/api/auth.py:363 | ssh | AuthService.create_webssh_token(DB×7;Redis×15;SSH×2) |
|
||||
| GET /me | server/api/auth.py:385 | login | 未匹配到 service_calls |
|
||||
| GET /servers | server/api/btpanel.py:60 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/config | server/api/btpanel.py:68 | script,ssh,btpanel,install | 未匹配到 service_calls |
|
||||
| PUT /servers/{server_id}/config | server/api/btpanel.py:81 | btpanel | 未匹配到 service_calls |
|
||||
| GET /settings | server/api/btpanel.py:103 | btpanel | 未匹配到 service_calls |
|
||||
| PUT /settings | server/api/btpanel.py:111 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/bootstrap | server/api/btpanel.py:129 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/batch-bootstrap | server/api/btpanel.py:148 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/login-url | server/api/btpanel.py:166 | login,btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/system/total | server/api/btpanel.py:183 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/system/disk | server/api/btpanel.py:191 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/system/network | server/api/btpanel.py:199 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/sites | server/api/btpanel.py:207 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/sites/start | server/api/btpanel.py:215 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/sites/stop | server/api/btpanel.py:228 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/sites/php-versions | server/api/btpanel.py:241 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/sites | server/api/btpanel.py:249 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/sites/{site_id}/domains | server/api/btpanel.py:280 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/domains | server/api/btpanel.py:293 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/domains/delete | server/api/btpanel.py:306 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/ssl/sites | server/api/btpanel.py:319 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/ssl/set | server/api/btpanel.py:327 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/ssl/apply | server/api/btpanel.py:345 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/databases | server/api/btpanel.py:358 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/databases | server/api/btpanel.py:366 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/databases/password | server/api/btpanel.py:384 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/databases/backup | server/api/btpanel.py:397 | btpanel | 未匹配到 service_calls |
|
||||
| GET /servers/{server_id}/crontab | server/api/btpanel.py:410 | btpanel | 未匹配到 service_calls |
|
||||
| POST /servers/{server_id}/services | server/api/btpanel.py:418 | btpanel | BtPanelService.service_admin(DB×7;Redis×16;SSH×7) |
|
||||
| GET '' | server/api/execution_records.py:20 | script | 未匹配到 service_calls |
|
||||
| GET /{record_id} | server/api/execution_records.py:41 | script | 未匹配到 service_calls |
|
||||
| GET /browse | server/api/files.py:40 | file,ssh | 未匹配到 service_calls |
|
||||
| GET /connection-check | server/api/install.py:1113 | file,install | 未匹配到 service_calls |
|
||||
| GET /state | server/api/install.py:1469 | file,install | 未匹配到 service_calls |
|
||||
| GET / | server/api/scripts.py:31 | script | ScriptService.list_scripts(DB×9;Redis×13;SSH×9) |
|
||||
| GET /exec-config | server/api/scripts.py:42 | script | 未匹配到 service_calls |
|
||||
| GET /credentials | server/api/scripts.py:56 | script | ScriptService.list_credentials(DB×9;Redis×13;SSH×9) |
|
||||
| POST /credentials | server/api/scripts.py:66 | script | ScriptService.create_credential(DB×9;Redis×13;SSH×9) |
|
||||
| PUT /credentials/{id} | server/api/scripts.py:90 | script | 未匹配到 service_calls |
|
||||
| DELETE /credentials/{id} | server/api/scripts.py:131 | script | ScriptService.delete_credential(DB×9;Redis×13;SSH×9) |
|
||||
| GET /executions | server/api/scripts.py:152 | script | ScriptService.list_executions(DB×9;Redis×13;SSH×9) |
|
||||
| POST /executions/{id}/stop | server/api/scripts.py:167 | script | ScriptService.stop_execution(DB×9;Redis×13;SSH×9) -> ScriptService.get_execution(DB×9;Redis×13;SSH×9) |
|
||||
| POST /executions/{id}/mark-stuck | server/api/scripts.py:181 | script | ScriptService.mark_execution_stuck(DB×9;Redis×13;SSH×9) -> ScriptService.get_execution(DB×9;Redis×13;SSH×9) |
|
||||
| POST /executions/{id}/retry | server/api/scripts.py:198 | script | ScriptService._parse_execution_meta(DB×9;Redis×13;SSH×9) -> get_execution_record_detail(Redis×6) -> ScriptService.get_execution(DB×9;Redis×13;SSH×9) -> ScriptService.retry_executio... |
|
||||
| GET /executions/{id} | server/api/scripts.py:238 | script | ScriptService.get_execution(DB×9;Redis×13;SSH×9) |
|
||||
| GET /{id} | server/api/scripts.py:258 | script | ScriptService.get_script(DB×9;Redis×13;SSH×9) |
|
||||
| POST / | server/api/scripts.py:271 | script | ScriptService.create_script(DB×9;Redis×13;SSH×9) |
|
||||
| PUT /{id} | server/api/scripts.py:295 | script | ScriptService.get_script(DB×9;Redis×13;SSH×9) -> ScriptService.update_script(DB×9;Redis×13;SSH×9) |
|
||||
| DELETE /{id} | server/api/scripts.py:325 | script | ScriptService.get_script(DB×9;Redis×13;SSH×9) -> ScriptService.delete_script(DB×9;Redis×13;SSH×9) |
|
||||
| POST /exec | server/api/scripts.py:364 | script | ScriptService.get_execution(DB×9;Redis×13;SSH×9) -> ScriptService.execute_command(DB×9;Redis×13;SSH×9) |
|
||||
| GET / | server/api/search.py:32 | script | 未匹配到 service_calls |
|
||||
| GET / | server/api/servers.py:94 | script | 未匹配到 service_calls |
|
||||
| GET /terminal-search-history | server/api/servers.py:436 | terminal | 未匹配到 service_calls |
|
||||
| PUT /terminal-search-history | server/api/servers.py:454 | terminal | 未匹配到 service_calls |
|
||||
| GET /logs | server/api/servers.py:491 | script | 未匹配到 service_calls |
|
||||
| GET /import/template | server/api/servers.py:570 | file | 未匹配到 service_calls |
|
||||
| POST /import | server/api/servers.py:589 | file | ServerService.create_server(DB×2;Redis×3;SSH×2) |
|
||||
| POST /batch/detect-path | server/api/servers.py:850 | ssh | 未匹配到 service_calls |
|
||||
| GET /pending | server/api/servers.py:977 | script,ssh | 未匹配到 service_calls |
|
||||
| POST /add-by-ip | server/api/servers.py:1099 | login,ssh | 未匹配到 service_calls |
|
||||
| GET /{id}/files-capability | server/api/servers.py:1407 | file,ssh | BtPanelService.get_server(DB×7;Redis×16;SSH×7) |
|
||||
| POST /{id}/setup-files-sudo | server/api/servers.py:1422 | file,ssh,install | BtPanelService.get_server(DB×7;Redis×16;SSH×7) |
|
||||
| POST / | server/api/servers.py:1463 | file,ssh | ServerService.create_server(DB×2;Redis×3;SSH×2) |
|
||||
| PUT /{id} | server/api/servers.py:1537 | file,ssh | BtPanelService.get_server(DB×7;Redis×16;SSH×7) -> ServerService.update_server(DB×2;Redis×3;SSH×2) |
|
||||
| POST /{id}/install-agent | server/api/servers.py:1711 | ssh,install | BtPanelService.get_server(DB×7;Redis×16;SSH×7) -> ServerService.update_server(DB×2;Redis×3;SSH×2) |
|
||||
| POST /{id}/uninstall-agent | server/api/servers.py:1818 | file,ssh,install | BtPanelService.get_server(DB×7;Redis×16;SSH×7) |
|
||||
| POST /{id}/upgrade-agent | server/api/servers.py:1965 | ssh | BtPanelService.get_server(DB×7;Redis×16;SSH×7) |
|
||||
| POST /{id}/agent-diagnose | server/api/servers.py:2067 | ssh | BtPanelService.get_server(DB×7;Redis×16;SSH×7) |
|
||||
| POST /check | server/api/servers.py:2105 | ssh | 未匹配到 service_calls |
|
||||
| GET /ip-allowlist | server/api/settings.py:168 | login,script | 未匹配到 service_calls |
|
||||
| GET /bing-wallpaper | server/api/settings.py:307 | file | 未匹配到 service_calls |
|
||||
| PUT /{id} | server/api/settings.py:476 | script | 未匹配到 service_calls |
|
||||
|
||||
## 6. 宝塔相关流
|
||||
|
||||
| 类型 | 位置 | 函数 | 标签/Key | 摘要 |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| api | server/api/btpanel.py:60 | list_bt_servers | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_server_statuses', '_svc'], 'fi |
|
||||
| api | server/api/btpanel.py:68 | get_bt_config | btpanel,install,script,ssh | {'auth_required_inferred': True, 'calls': ['router.get', 'Query', 'Depends', 'Depends', '_svc.get_config', '_http_error' |
|
||||
| api | server/api/btpanel.py:81 | update_bt_config | btpanel | {'auth_required_inferred': True, 'calls': ['router.put', 'Depends', 'Depends', '_svc.update_config', '_http_error', '_sv |
|
||||
| api | server/api/btpanel.py:103 | get_bt_global_settings | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.get_global_settings', '_svc'], 'fil |
|
||||
| api | server/api/btpanel.py:111 | update_bt_global_settings | btpanel | {'auth_required_inferred': True, 'calls': ['router.put', 'Depends', 'Depends', '_svc.update_global_settings', '_http_err |
|
||||
| api | server/api/btpanel.py:129 | bootstrap_bt_server | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.bootstrap_server', '_http_error', |
|
||||
| api | server/api/btpanel.py:148 | batch_bootstrap_bt_servers | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.batch_bootstrap', '_http_error', ' |
|
||||
| api | server/api/btpanel.py:166 | create_bt_login_url | btpanel,login | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.create_login_url', '_http_error', |
|
||||
| api | server/api/btpanel.py:183 | bt_system_total | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.system_total', '_http_error', '_svc |
|
||||
| api | server/api/btpanel.py:191 | bt_system_disk | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.system_disk', '_http_error', '_svc' |
|
||||
| api | server/api/btpanel.py:199 | bt_system_network | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.system_network', '_http_error', '_s |
|
||||
| api | server/api/btpanel.py:207 | bt_list_sites | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_sites', '_http_error', '_svc'] |
|
||||
| api | server/api/btpanel.py:215 | bt_site_start | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.site_start', '_http_error', '_svc' |
|
||||
| api | server/api/btpanel.py:228 | bt_site_stop | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.site_stop', '_http_error', '_svc'] |
|
||||
| api | server/api/btpanel.py:241 | bt_php_versions | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.php_versions', '_http_error', '_svc |
|
||||
| api | server/api/btpanel.py:249 | bt_create_site | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', 'json.dumps', '_svc.create_site', '_http |
|
||||
| api | server/api/btpanel.py:280 | bt_list_domains | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_domains', '_http_error', '_svc |
|
||||
| api | server/api/btpanel.py:293 | bt_add_domain | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.add_domain', '_http_error', 'body. |
|
||||
| api | server/api/btpanel.py:306 | bt_delete_domain | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.delete_domain', '_http_error', 'bo |
|
||||
| api | server/api/btpanel.py:319 | bt_ssl_sites | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_ssl_sites', '_http_error', '_s |
|
||||
| api | server/api/btpanel.py:327 | bt_set_ssl | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.set_ssl', '_http_error', 'body.mod |
|
||||
| api | server/api/btpanel.py:345 | bt_apply_ssl | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.apply_letsencrypt', '_http_error', |
|
||||
| api | server/api/btpanel.py:358 | bt_list_databases | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_databases', '_http_error', '_s |
|
||||
| api | server/api/btpanel.py:366 | bt_create_database | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.create_database', '_http_error', ' |
|
||||
| api | server/api/btpanel.py:384 | bt_db_password | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.reset_database_password', '_http_e |
|
||||
| api | server/api/btpanel.py:397 | bt_db_backup | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.backup_database', '_http_error', ' |
|
||||
| api | server/api/btpanel.py:410 | bt_crontab | btpanel | {'auth_required_inferred': True, 'calls': ['router.get', 'Depends', 'Depends', '_svc.list_crontab', '_http_error', '_svc |
|
||||
| api | server/api/btpanel.py:418 | bt_service_admin | btpanel | {'auth_required_inferred': True, 'calls': ['router.post', 'Depends', 'Depends', '_svc.service_admin', '_http_error', '_s |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:24 | | btpanel | {'calls': ["getattr(settings, 'BT_PANEL_AUTO_BOOTSTRAP_ENABLED', None) or 'true'.strip.lower", "getattr(settings, 'BT_PA |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:29 | | btpanel | {'calls': ['getattr', 'max', 'int', 'min'], 'class': None, 'end_line': 35, 'file': 'server/application/services/btpanel_ |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:38 | | btpanel,session | {'calls': ['int', 'AsyncSessionLocal', 'ServerRepositoryImpl', 'mark_bootstrap_pending', 'repo.get_by_id', 'bt_panel_con |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:54 | | btpanel | {'calls': ['is_auto_bootstrap_enabled', 'int', 'mark_servers_bootstrap_pending', 'asyncio.create_task', '_BG_TASKS.add', |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:68 | | btpanel,session | {'calls': ['AsyncSessionLocal', 'BtPanelService', 'logger.warning', 'svc.bootstrap_server'], 'class': None, 'end_line': |
|
||||
| service | server/application/services/btpanel_bootstrap_schedule.py:84 | | btpanel,session | {'calls': ['datetime.now', 'bootstrap_batch_size', 'is_auto_bootstrap_enabled', 'AsyncSessionLocal', 'ServerRepositoryIm |
|
||||
| service | server/application/services/btpanel_service.py:54 | | btpanel | {'calls': ['isinstance'], 'class': None, 'end_line': 55, 'file': 'server/application/services/btpanel_service.py', 'id': |
|
||||
| service | server/application/services/btpanel_service.py:59 | | btpanel | {'calls': ['ServerRepositoryImpl', 'AuditLogRepositoryImpl'], 'class': 'BtPanelService', 'end_line': 62, 'file': 'server |
|
||||
| service | server/application/services/btpanel_service.py:64 | | btpanel | {'calls': ['self.servers.get_by_id', 'ValueError'], 'class': 'BtPanelService', 'end_line': 68, 'file': 'server/applicati |
|
||||
| service | server/application/services/btpanel_service.py:70 | | btpanel | {'calls': ['read_bt_panel_credentials', 'BtPanelClient', 'ValueError'], 'class': 'BtPanelService', 'end_line': 74, 'file |
|
||||
| service | server/application/services/btpanel_service.py:76 | | btpanel,redis | {'calls': ['get_redis', 'redis.pipeline', 'zip', 'self.servers.get_all', 'pipe.hgetall', 'pipe.execute', 'agent_is_insta |
|
||||
| service | server/application/services/btpanel_service.py:112 | | btpanel | {'calls': ['self.get_server', 'self._resolve_bt_installed', 'public_bt_panel_status'], 'class': 'BtPanelService', 'end_l |
|
||||
| service | server/application/services/btpanel_service.py:117 | | btpanel | {'calls': ['get_bt_panel_block', 'block.get', 'block.get', 'merge_bootstrap_fields', 'bt_panel_configured', 'detect_bt_p |
|
||||
| service | server/application/services/btpanel_service.py:141 | | btpanel | {'calls': ["getattr(settings, 'BT_PANEL_SOURCE_IP', None) or ''.strip", 'self._auto_bootstrap_enabled', 'get_bt_panel_so |
|
||||
| service | server/application/services/btpanel_service.py:150 | | btpanel | {'calls': ['bt_panel_source_ip.strip', 'self.audit.create', 'self.get_global_settings', 'ValueError', 'self._persist_set |
|
||||
| service | server/application/services/btpanel_service.py:183 | | btpanel | {'calls': ['SettingRepositoryImpl', 'settings.apply_db_override', 'repo.set', 'publish_setting_change'], 'class': 'BtPan |
|
||||
| service | server/application/services/btpanel_service.py:194 | | btpanel | {'calls': ['is_auto_bootstrap_enabled'], 'class': 'BtPanelService', 'end_line': 197, 'file': 'server/application/service |
|
||||
| service | server/application/services/btpanel_service.py:199 | | btpanel | {'calls': ['merge_bt_panel_extra', 'self.get_server', 'self.servers.update', 'self.audit.create', 'self.get_config', 'is |
|
||||
| service | server/application/services/btpanel_service.py:249 | | btpanel | {'calls': ['bootstrap_lock', 'self._bootstrap_server_locked'], 'class': 'BtPanelService', 'end_line': 265, 'file': 'serv |
|
||||
| service | server/application/services/btpanel_service.py:267 | | btpanel | {'calls': ['get_bt_panel_source_ip', 'str.strip', 'str.strip', 'apply_bootstrap_success', 'self.get_server', 'bt_panel_c |
|
||||
| service | server/application/services/btpanel_service.py:368 | | btpanel | {'calls': ['ValueError', 'start_batch_job', 'self.list_server_statuses', 'int', 'int', 'ids.append', 's.get'], 'class': |
|
||||
| service | server/application/services/btpanel_service.py:398 | | btpanel | {'calls': ['self.audit.create', 'AuditLog', 'json.dumps'], 'class': 'BtPanelService', 'end_line': 421, 'file': 'server/a |
|
||||
| service | server/application/services/btpanel_service.py:424 | | btpanel | {'calls': ['getattr', 'getattr', 'bool', "getattr(server, 'auth_method', None) or ''.strip", 'bool', 'getattr', 'getattr |
|
||||
| service | server/application/services/btpanel_service.py:437 | | btpanel,session | {'calls': ['get_bt_panel_block', '_parse_iso', '_utcnow() - checked_at.total_seconds', 'block.get', 'block.get', '_utcno |
|
||||
| service | server/application/services/btpanel_service.py:447 | | btpanel,session | {'calls': ['merge_bootstrap_fields', 'self.servers.update', 'self.get_server', 'isinstance', '_iso', '_utcnow'], 'class' |
|
||||
| service | server/application/services/btpanel_service.py:457 | | btpanel,session | {'calls': ['get_bt_panel_source_ip', 'str.strip', 'str.strip', 'apply_bootstrap_success', 'self._session_cleanup_ttl_che |
|
||||
| service | server/application/services/btpanel_service.py:502 | | btpanel | {'calls': ['login_url_lock', 'self._create_login_url_fresh', 'self._audit_login_url_failure'], 'class': 'BtPanelService' |
|
||||
| service | server/application/services/btpanel_service.py:529 | | btpanel,session | {'calls': ['bt_panel_configured', 'read_bt_panel_credentials', 'self.get_server', 'bt_panel_configured', 'read_bt_panel_ |
|
||||
| service | server/application/services/btpanel_service.py:585 | | btpanel | {'calls': ['self.audit.create', 'logger.warning', 'AuditLog', 'json.dumps'], 'class': 'BtPanelService', 'end_line': 607, |
|
||||
| service | server/application/services/btpanel_service.py:609 | | btpanel | {'calls': ['self._repair_ip_whitelist', 'read_bt_panel_credentials', 'logger.warning', 'logger.warning', 'self.get_serve |
|
||||
| service | server/application/services/btpanel_service.py:642 | | btpanel | {'calls': ['BtPanelClient', 'isinstance', 'BtPanelApiError', 'int', 'client.post', 'data.get', 'time.time', 'data.get', |
|
||||
| service | server/application/services/btpanel_service.py:674 | | btpanel | {'calls': ['self._client', 'self.get_server', 'client.post', 'str', 'self.get_server', 'self._client.post', 'self._repai |
|
||||
| service | server/application/services/btpanel_service.py:692 | | btpanel | {'calls': ['get_bt_panel_source_ip', 'str.strip', 'str.strip', 'logger.info', 'logger.warning', 'apply_bootstrap_success |
|
||||
| service | server/application/services/btpanel_service.py:722 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 723, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:725 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 726, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:728 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 729, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:732 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 738, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:740 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 741, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:743 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 744, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:747 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 748, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:750 | | btpanel | {'calls': ['self.proxy', 'self.audit.create', 'AuditLog', 'json.dumps', 'payload.get'], 'class': 'BtPanelService', 'end_ |
|
||||
| service | server/application/services/btpanel_service.py:763 | | btpanel | {'calls': ['self.proxy', 'str'], 'class': 'BtPanelService', 'end_line': 768, 'file': 'server/application/services/btpane |
|
||||
| service | server/application/services/btpanel_service.py:770 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 771, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:773 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 774, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:777 | | btpanel | {'calls': ['self.list_sites'], 'class': 'BtPanelService', 'end_line': 778, 'file': 'server/application/services/btpanel_ |
|
||||
| service | server/application/services/btpanel_service.py:780 | | btpanel | {'calls': ['self.proxy', 'self.audit.create', 'AuditLog', 'json.dumps', 'payload.get'], 'class': 'BtPanelService', 'end_ |
|
||||
| service | server/application/services/btpanel_service.py:792 | | btpanel,crypto | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 793, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:796 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 801, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:803 | | btpanel | {'calls': ['self.proxy', 'self.audit.create', 'AuditLog', 'json.dumps', 'payload.get'], 'class': 'BtPanelService', 'end_ |
|
||||
| service | server/application/services/btpanel_service.py:815 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 816, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:818 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 819, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:822 | | btpanel | {'calls': ['self.proxy'], 'class': 'BtPanelService', 'end_line': 823, 'file': 'server/application/services/btpanel_servi |
|
||||
| service | server/application/services/btpanel_service.py:826 | | btpanel | {'calls': ['self.proxy', 'self.audit.create', 'AuditLog', 'json.dumps'], 'class': 'BtPanelService', 'end_line': 836, 'fi |
|
||||
| service | server/application/services/server_batch_service.py:774 | | btpanel,session | {'calls': ['str', 'server_map.get', '_run_with_semaphore', 'live.get', 'result_item_dict', 'result.get', 'result.get', ' |
|
||||
| service | server/application/services/server_batch_service.py:779 | | btpanel,session | {'calls': ['server_map.get', 'result_item_dict', 'result.get', 'result.get', 'result_item_dict', 'AsyncSessionLocal', 'B |
|
||||
| service | server/application/services/server_file_transfer_service.py:397 | | btpanel,token | {'calls': ['read_bt_panel_credentials', 'signed_download_url', 'ServerTransferError', 'ServerTransferError', 'normalize_ |
|
||||
| service | server/application/services/server_file_transfer_service.py:497 | | btpanel | {'calls': ['_assert_distinct_servers', 'int', '_get_server', 'bt_panel_configured', 'read_bt_panel_credentials', 'create |
|
||||
| redis | tests/test_btpanel_client.py:39 | test_merge_bt_panel_extra_encrypts_key | enc:secret,enc:{s} | {'file': 'tests/test_btpanel_client.py', 'function': 'test_merge_bt_panel_extra_encrypts_key', 'id': 'tests/test_btpanel |
|
||||
| redis | tests/test_btpanel_get_config.py:64 | test_bootstrap_lock_serializes_same_server | | {'file': 'tests/test_btpanel_get_config.py', 'function': 'test_bootstrap_lock_serializes_same_server', 'id': 'tests/test |
|
||||
| redis | tests/test_btpanel_get_config.py:67 | test_bootstrap_lock_serializes_same_server.worker | | {'file': 'tests/test_btpanel_get_config.py', 'function': 'test_bootstrap_lock_serializes_same_server.worker', 'id': 'tes |
|
||||
| redis | tests/test_btpanel_login_url.py:19 | _FakeRedis.get | | {'file': 'tests/test_btpanel_login_url.py', 'function': '_FakeRedis.get', 'id': 'tests/test_btpanel_login_url.py::_FakeR |
|
||||
| redis | tests/test_btpanel_login_url.py:27 | _noop_login_url_lock | | {'file': 'tests/test_btpanel_login_url.py', 'function': '_noop_login_url_lock', 'id': 'tests/test_btpanel_login_url.py:: |
|
||||
| redis | tests/test_btpanel_login_url.py:32 | test_create_login_url_bootstraps_when_unconfigured | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_bootstraps_when_unconfigured', 'id': 'tes |
|
||||
| redis | tests/test_btpanel_login_url.py:78 | test_create_login_url_does_not_reuse_single_use_tokens | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_does_not_reuse_single_use_tokens', 'id': |
|
||||
| redis | tests/test_btpanel_login_url.py:119 | test_create_login_url_skips_bootstrap_when_configured | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_skips_bootstrap_when_configured', 'id': ' |
|
||||
| redis | tests/test_btpanel_login_url.py:161 | test_create_login_url_ensures_session_cleanup_ttl_once_for_configured_server | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_ensures_session_cleanup_ttl_once_for_conf |
|
||||
| redis | tests/test_btpanel_login_url.py:224 | test_create_login_url_repairs_stale_port_then_uses_api | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_repairs_stale_port_then_uses_api', 'id': |
|
||||
| redis | tests/test_btpanel_login_url.py:288 | test_create_login_url_falls_back_to_ssh_when_api_unreachable | | {'file': 'tests/test_btpanel_login_url.py', 'function': 'test_create_login_url_falls_back_to_ssh_when_api_unreachable', |
|
||||
| redis | tests/test_btpanel_server_list.py:23 | test_list_server_statuses_includes_live_online_from_redis | | {'file': 'tests/test_btpanel_server_list.py', 'function': 'test_list_server_statuses_includes_live_online_from_redis', ' |
|
||||
| redis | tests/test_btpanel_ssh_bootstrap.py:34 | test_mark_bootstrap_pending_sets_now | | {'file': 'tests/test_btpanel_ssh_bootstrap.py', 'function': 'test_mark_bootstrap_pending_sets_now', 'id': 'tests/test_bt |
|
||||
| redis | tests/test_btpanel_ssh_bootstrap.py:42 | test_apply_failure_bt_not_installed_goes_installing | | {'file': 'tests/test_btpanel_ssh_bootstrap.py', 'function': 'test_apply_failure_bt_not_installed_goes_installing', 'id': |
|
||||
| redis | tests/test_btpanel_ssh_bootstrap.py:50 | test_apply_failure_ssh_auth_is_permanent | | {'file': 'tests/test_btpanel_ssh_bootstrap.py', 'function': 'test_apply_failure_ssh_auth_is_permanent', 'id': 'tests/tes |
|
||||
| redis | tests/test_btpanel_ssh_bootstrap.py:57 | test_apply_success_sets_ready | enc:token123,enc:{s} | {'file': 'tests/test_btpanel_ssh_bootstrap.py', 'function': 'test_apply_success_sets_ready', 'id': 'tests/test_btpanel_s |
|
||||
| redis | server/api/btpanel.py:46 | _http_error | | {'file': 'server/api/btpanel.py', 'function': '_http_error', 'id': 'server/api/btpanel.py::_http_error::redis', 'key_pat |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_lock.py:13 | bootstrap_lock | | {'file': 'server/infrastructure/btpanel/bootstrap_lock.py', 'function': 'bootstrap_lock', 'id': 'server/infrastructure/b |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:43 | get_bootstrap_block | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'get_bootstrap_block', 'id': 'server/infrastruc |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:78 | public_bootstrap_fields | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'public_bootstrap_fields', 'id': 'server/infras |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:96 | merge_bootstrap_fields | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'merge_bootstrap_fields', 'id': 'server/infrast |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:126 | bt_panel_configured_from_attrs | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'bt_panel_configured_from_attrs', 'id': 'server |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:135 | is_eligible_for_background_bootstrap | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'is_eligible_for_background_bootstrap', 'id': ' |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:155 | apply_bootstrap_success | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'apply_bootstrap_success', 'id': 'server/infras |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:196 | apply_bootstrap_failure | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'apply_bootstrap_failure', 'id': 'server/infras |
|
||||
| redis | server/infrastructure/btpanel/bootstrap_state.py:223 | get_bootstrap_block_from_attrs | | {'file': 'server/infrastructure/btpanel/bootstrap_state.py', 'function': 'get_bootstrap_block_from_attrs', 'id': 'server |
|
||||
| redis | server/infrastructure/btpanel/client.py:29 | raise_if_panel_error | | {'file': 'server/infrastructure/btpanel/client.py', 'function': 'raise_if_panel_error', 'id': 'server/infrastructure/btp |
|
||||
| redis | server/infrastructure/btpanel/client.py:50 | BtPanelClient._load_cookies | | {'file': 'server/infrastructure/btpanel/client.py', 'function': 'BtPanelClient._load_cookies', 'id': 'server/infrastruct |
|
||||
| redis | server/infrastructure/btpanel/client.py:60 | BtPanelClient._save_cookies | | {'file': 'server/infrastructure/btpanel/client.py', 'function': 'BtPanelClient._save_cookies', 'id': 'server/infrastruct |
|
||||
| redis | server/infrastructure/btpanel/client.py:64 | BtPanelClient.post | | {'file': 'server/infrastructure/btpanel/client.py', 'function': 'BtPanelClient.post', 'id': 'server/infrastructure/btpan |
|
||||
| redis | server/infrastructure/btpanel/credentials.py:26 | get_bt_panel_block | | {'file': 'server/infrastructure/btpanel/credentials.py', 'function': 'get_bt_panel_block', 'id': 'server/infrastructure/ |
|
||||
| redis | server/infrastructure/btpanel/credentials.py:31 | bt_panel_configured | | {'file': 'server/infrastructure/btpanel/credentials.py', 'function': 'bt_panel_configured', 'id': 'server/infrastructure |
|
||||
| redis | server/infrastructure/btpanel/credentials.py:36 | get_bt_panel_base_url | | {'file': 'server/infrastructure/btpanel/credentials.py', 'function': 'get_bt_panel_base_url', 'id': 'server/infrastructu |
|
||||
| redis | server/infrastructure/btpanel/credentials.py:41 | read_bt_panel_credentials | | {'file': 'server/infrastructure/btpanel/credentials.py', 'function': 'read_bt_panel_credentials', 'id': 'server/infrastr |
|
||||
| redis | server/infrastructure/btpanel/credentials.py:54 | merge_bt_panel_extra | | {'file': 'server/infrastructure/btpanel/credentials.py', 'function': 'merge_bt_panel_extra', 'id': 'server/infrastructur |
|
||||
|
||||
## 7. 安全审查优先级建议
|
||||
|
||||
1. **宝塔一键登录/session**：优先审查 `server/application/services/btpanel_service.py`、`server/infrastructure/btpanel/*`，关注 token TTL、Redis lock、并发打开 10 个面板、失败回退和审计日志。
|
||||
2. **文件管理/归档/解压**：优先审查带 `file` 标签的 API 与 `server/infrastructure/ssh/remote_archive.py`、文件传输路径，关注路径穿越、tar/zip 选项注入、软链、绝对路径。
|
||||
3. **SSH/远程 shell**：用户确认管理员远程执行 shell 是业务能力，不作为漏洞本身；审查重点应放在鉴权、审计、超时、输出截断、日志脱敏、命令模板边界。
|
||||
4. **数据库访问**：对 `db_queries.jsonl` 中写操作链路检查权限过滤、事务 commit/rollback、分页上限和多租户隔离。
|
||||
5. **Redis 锁/缓存**：对 login/session/任务类 Redis key 检查 TTL、锁释放、失败重试与缓存穿透。
|
||||
@@ -0,0 +1,349 @@
|
||||
# Nexus API 限速与并发限制盘点
|
||||
|
||||
日期：2026-07-07
|
||||
范围：本地代码上下文快照 `work/nexus_code_context/snapshots/nexus-source-20260707-112042`。
|
||||
说明：本报告只盘点代码内的 API rate limit、429、throttle、并发/批量限制；不包含外部平台（例如 Codex 模型 API）的 429。
|
||||
|
||||
## 结论
|
||||
|
||||
1. 当前 Nexus 后端没有发现全局 HTTP API 限速中间件。
|
||||
- 未发现 slowapi / fastapi-limiter / starlette limiter 等依赖或全局 middleware。
|
||||
- `server/main.py` 主要是安装模式、DB session、安全头、AppAuth、JWT、CORS 等中间件，没有全局 rate limit。
|
||||
|
||||
2. 当前会返回 HTTP 429 的后端代码只有两类：
|
||||
- 管理员登录失败锁定：`/api/auth/login`。
|
||||
- 子机脚本回调限速：`/api/agent/script-callback`。
|
||||
|
||||
3. 大量“速度限制”其实不是 API rate limit，而是远程 SSH / 同步 / 批量任务的并发保护。
|
||||
- 这些限制用于避免同时打爆子机、SSH、MySQL、Redis 或 Nexus 自身 worker。
|
||||
- 用户正常浏览后台 API 不会被这些限制直接 429。
|
||||
|
||||
## 1. 全局 API 限速
|
||||
|
||||
### 当前状态
|
||||
|
||||
没有发现全局限速。
|
||||
|
||||
检索点：
|
||||
|
||||
- `rate_limit` / `ratelimit` / `throttle` / `slowapi` / `limiter`
|
||||
- `status_code=429`
|
||||
- FastAPI middleware
|
||||
- Docker / Uvicorn worker 配置
|
||||
|
||||
### 影响
|
||||
|
||||
- 好处：后台操作不会因为普通访问频率触发全局 429。
|
||||
- 风险：如果公网暴露，普通 API 缺少统一抗刷保护；目前主要依赖登录锁定、鉴权、业务级并发控制。
|
||||
|
||||
## 2. 登录接口限速 / 锁定
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/api/auth.py:127-156`
|
||||
- `server/application/services/auth_service.py:37-39`
|
||||
- `server/application/services/auth_service.py:99-107`
|
||||
- `server/infrastructure/database/admin_repo.py:41-53`
|
||||
|
||||
### 规则
|
||||
|
||||
```text
|
||||
MAX_LOGIN_FAILURES = 5
|
||||
LOCKOUT_MINUTES = 15
|
||||
```
|
||||
|
||||
逻辑：
|
||||
|
||||
```text
|
||||
/api/auth/login
|
||||
-> AuthService.login()
|
||||
-> count_recent_failures(username, ip_address, 15)
|
||||
-> 最近 15 分钟同 username 失败次数 >= 5
|
||||
-> 返回 reason=account_locked
|
||||
-> API 层转成 HTTP 429
|
||||
```
|
||||
|
||||
仓库实现实际按 username 统计最近失败次数：
|
||||
|
||||
```text
|
||||
LoginAttempt.username == username
|
||||
LoginAttempt.success == False
|
||||
LoginAttempt.attempted_at >= cutoff
|
||||
```
|
||||
|
||||
备注：白名单 IP 会跳过失败计数锁定。
|
||||
|
||||
### 影响
|
||||
|
||||
这是登录防爆破，不是普通 API 限速。
|
||||
如果登录时出现 429，含义是账号登录失败过多锁定 15 分钟。
|
||||
|
||||
## 3. 脚本回调接口限速
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/api/agent.py:244-264`
|
||||
- `server/infrastructure/redis/script_callback_rate.py:14-16`
|
||||
- `server/infrastructure/redis/script_callback_rate.py:31-44`
|
||||
|
||||
### 规则
|
||||
|
||||
```text
|
||||
每 job_id：10 次 / 60 秒
|
||||
每 IP：60 次 / 60 秒
|
||||
```
|
||||
|
||||
Redis key：
|
||||
|
||||
```text
|
||||
script_cb:job:{job_id}
|
||||
script_cb:ip:{ip}
|
||||
```
|
||||
|
||||
触发后返回：
|
||||
|
||||
```text
|
||||
HTTP 429 Too many script callback requests
|
||||
```
|
||||
|
||||
### 影响
|
||||
|
||||
这是专门保护子机长任务脚本回调的，避免未登录回调接口被刷或同一 job 重复回调过多。
|
||||
不会影响后台普通 API，也不会影响宝塔一键登录。
|
||||
|
||||
## 4. 脚本远程执行并发限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/config.py:66-69`
|
||||
- `server/api/scripts.py:41-50`
|
||||
- `server/application/services/script_service.py:254-260`
|
||||
- `server/application/services/script_service.py:759-761`
|
||||
|
||||
### 当前值
|
||||
|
||||
```text
|
||||
SCRIPT_EXEC_BATCH_SIZE = 50
|
||||
SCRIPT_EXEC_CONCURRENCY = 10
|
||||
```
|
||||
|
||||
含义：
|
||||
|
||||
- 一批最多 50 台服务器。
|
||||
- 每批同时最多 10 个 SSH 执行。
|
||||
- `/api/scripts/exec-config` 会返回这些值给前端显示。
|
||||
|
||||
### 影响
|
||||
|
||||
这是远程命令执行的并发保护，不是 HTTP API 限速。
|
||||
如果一次选很多服务器，会按批次和并发执行，所以看起来“执行速度被限制”。
|
||||
|
||||
用户已说明 `script_service` 是管理员远程执行命令功能，任意 shell 本身不是问题；这里仅记录并发限制。
|
||||
|
||||
## 5. 同步/推送并发限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/api/schemas.py:224-225`
|
||||
- `server/application/services/sync_engine_v2.py:39`
|
||||
- `server/application/services/sync_engine_v2.py:113-127`
|
||||
|
||||
### 当前值
|
||||
|
||||
API schema：
|
||||
|
||||
```text
|
||||
batch_size: 默认 50，范围 1-200
|
||||
concurrency: 默认 10，范围 1-50
|
||||
```
|
||||
|
||||
服务层硬上限：
|
||||
|
||||
```text
|
||||
MAX_CONCURRENT = 10
|
||||
concurrency = min(concurrency, MAX_CONCURRENT)
|
||||
```
|
||||
|
||||
### 影响
|
||||
|
||||
虽然 API 入参允许 concurrency 到 50，但服务层最终会压到最多 10。
|
||||
所以同步/推送如果前端或 API 传 50，实际仍最多 10 并发。
|
||||
这是一个“配置表现不一致”的点。
|
||||
|
||||
## 6. 同步校验 verify 并发限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/api/sync_v2.py:1352-1354`
|
||||
|
||||
### 当前值
|
||||
|
||||
```text
|
||||
sem = asyncio.Semaphore(5)
|
||||
```
|
||||
|
||||
### 影响
|
||||
|
||||
同步校验会最多 5 台并发 SSH 校验。
|
||||
这也不是 API 429，而是校验任务执行速度保护。
|
||||
|
||||
## 7. 批量服务器操作并发限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/application/services/server_batch_service.py:35`
|
||||
- `server/application/services/server_batch_service.py:427-446`
|
||||
|
||||
### 当前值
|
||||
|
||||
```text
|
||||
CONCURRENCY = 5
|
||||
```
|
||||
|
||||
适用操作包括：
|
||||
|
||||
- health-check
|
||||
- detect-path
|
||||
- detect-domain
|
||||
- onboard
|
||||
- install-agent
|
||||
- upgrade-agent
|
||||
- uninstall-agent
|
||||
- bt-panel-bootstrap
|
||||
|
||||
### 影响
|
||||
|
||||
批量服务器操作最多 5 台并发。
|
||||
宝塔批量 bootstrap 也走这里。
|
||||
这不是 HTTP 限速，而是远程任务并发限制。
|
||||
|
||||
## 8. SSH 健康检查并发限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/application/server_connectivity.py:124-142`
|
||||
|
||||
### 当前值
|
||||
|
||||
```text
|
||||
concurrency = 10
|
||||
sem = asyncio.Semaphore(max(1, concurrency))
|
||||
```
|
||||
|
||||
### 影响
|
||||
|
||||
用于批量 SSH health check，默认 10 并发。
|
||||
|
||||
## 9. WebSocket 连接数限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `server/api/websocket.py:42-53`
|
||||
|
||||
### 当前值
|
||||
|
||||
```text
|
||||
MAX_CONNECTIONS = 500
|
||||
```
|
||||
|
||||
超过后关闭连接：
|
||||
|
||||
```text
|
||||
code=4003, reason="Too many connections"
|
||||
```
|
||||
|
||||
### 影响
|
||||
|
||||
这不是 HTTP API 限速，是单 worker 内存里的 WebSocket 连接数上限。
|
||||
|
||||
## 10. 前端侧并发/节流
|
||||
|
||||
### 位置
|
||||
|
||||
- `frontend/src/api/index.ts`：只处理后端 429 文案，没有主动限速。
|
||||
- `frontend/src/utils/filePreload.ts:12`：文件预加载并发 4。
|
||||
- `frontend/src/composables/push/types.ts:98`：推送预览并发 4。
|
||||
- `frontend/src/composables/push/usePushPreview.ts:75-76`：按 4 个一批预览。
|
||||
|
||||
### 影响
|
||||
|
||||
前端没有全局 API throttle/debounce。
|
||||
只有局部预加载/预览并发保护。
|
||||
|
||||
## 11. 部署侧限制
|
||||
|
||||
### 位置
|
||||
|
||||
- `Dockerfile:43`
|
||||
|
||||
当前容器命令：
|
||||
|
||||
```text
|
||||
uvicorn server.main:app --host 0.0.0.0 --port 8600
|
||||
```
|
||||
|
||||
没有发现：
|
||||
|
||||
- gunicorn worker 数配置
|
||||
- uvicorn --workers 配置
|
||||
- nginx limit_req 配置
|
||||
- compose 侧 API rate limit
|
||||
|
||||
### 影响
|
||||
|
||||
当前 Docker 部署默认单 Uvicorn worker。
|
||||
这不是“限速”，但会影响并发吞吐；远程 SSH 操作如果阻塞资源，也可能让 API 响应变慢。
|
||||
|
||||
## 12. 如果要调整，先给 6 个方向
|
||||
|
||||
后续如果要改，我建议先选方向，不直接动代码：
|
||||
|
||||
### 方案 A：不加全局限速，只调远程任务并发
|
||||
|
||||
- 调整脚本执行、同步、批量任务并发。
|
||||
- 适合内网/自用后台。
|
||||
- 风险低，不影响普通 API。
|
||||
|
||||
### 方案 B：加登录/敏感接口更严格限速
|
||||
|
||||
- 保持普通 API 不限速。
|
||||
- 对登录、令牌刷新、敏感设置、脚本回调加 Redis 限速。
|
||||
- 安全收益高，误伤较少。
|
||||
|
||||
### 方案 C：加全局 Redis 限速，但白名单内网/IP
|
||||
|
||||
- 对所有 API 做每 IP / 每用户限速。
|
||||
- 内网或管理员 IP 放宽。
|
||||
- 更安全，但可能误伤批量操作和前端轮询。
|
||||
|
||||
### 方案 D：按接口分层限速
|
||||
|
||||
- 读接口宽松。
|
||||
- 写接口中等。
|
||||
- 登录/敏感/远程执行严格。
|
||||
- 最合理，但实现和测试工作量最大。
|
||||
|
||||
### 方案 E：只优化吞吐，不做 rate limit
|
||||
|
||||
- 增加 uvicorn/gunicorn workers。
|
||||
- 调 DB pool、Redis、SSH 线程池/并发。
|
||||
- 目标是更快，不是防刷。
|
||||
|
||||
### 方案 F：把后台远程任务全部队列化
|
||||
|
||||
- API 只创建任务，worker 队列执行。
|
||||
- 支持取消、重试、并发池、优先级。
|
||||
- 长期最稳，但架构改动最大。
|
||||
|
||||
## 当前建议
|
||||
|
||||
如果你的目标是“后台 API 不要被限速”，当前代码已经没有全局 API 限速。
|
||||
真正影响速度的主要是：
|
||||
|
||||
1. 同步服务硬上限 `MAX_CONCURRENT = 10`。
|
||||
2. 批量服务器操作 `CONCURRENCY = 5`。
|
||||
3. 脚本执行 `SCRIPT_EXEC_CONCURRENCY = 10`、`SCRIPT_EXEC_BATCH_SIZE = 50`。
|
||||
4. Docker 默认单 Uvicorn worker。
|
||||
|
||||
如果你的目标是“提高批量操作速度”，优先讨论方案 A 或 E。
|
||||
如果你的目标是“增强公网安全”，优先讨论方案 B 或 D。
|
||||
@@ -0,0 +1,120 @@
|
||||
# Nexus → Gitea 白名单同步说明（2026-07-09）
|
||||
|
||||
## 目标
|
||||
|
||||
在 Nexus 里统一管理登录 IP 白名单，并把同一份“合并后的有效 IP/CIDR”同步到 Gitea 前置 Nginx，做到：
|
||||
|
||||
- Nexus 登录白名单继续作为主数据源；
|
||||
- Gitea 不改源码、不改数据库；
|
||||
- 新增 `/app-v2` 管理面板，可保存配置、预览 Nginx include、手动同步；
|
||||
- 可开启自动同步：Nexus 白名单变化后自动写入 Gitea 机器并 reload Nginx。
|
||||
|
||||
## 调用链
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[管理员在 Nexus 修改白名单] --> B[server/api/settings.py]
|
||||
B --> C[ip_allowlist_refresh.do_refresh]
|
||||
C --> D[settings.login_allowed_ips]
|
||||
D --> E[gitea_allowlist_service.render_nginx_allowlist]
|
||||
E --> F[SSH remote_write_bytes 写入 include 文件]
|
||||
F --> G[nginx -t && systemctl reload nginx]
|
||||
H[/app-v2 GiteaAllowlistPanel] --> I[GET/POST /api/settings/gitea-allowlist]
|
||||
I --> E
|
||||
```
|
||||
|
||||
## 新增后端接口
|
||||
|
||||
- `GET /api/settings/gitea-allowlist`
|
||||
返回 Gitea 同步配置、Nexus 当前有效白名单、Nginx 可用 IP/CIDR、被跳过的域名项、include 预览、最近同步状态。
|
||||
|
||||
- `POST /api/settings/gitea-allowlist`
|
||||
保存配置：
|
||||
- `enabled`
|
||||
- `auto_sync`
|
||||
- `server_id`
|
||||
- `remote_path`
|
||||
- `reload_command`
|
||||
|
||||
- `POST /api/settings/gitea-allowlist/sync`
|
||||
立即同步到 Gitea 服务器。
|
||||
|
||||
## 新增配置项
|
||||
|
||||
配置仍写入现有 `settings` 表，不新建表：
|
||||
|
||||
```text
|
||||
gitea_allowlist_enabled
|
||||
gitea_allowlist_auto_sync
|
||||
gitea_allowlist_server_id
|
||||
gitea_allowlist_remote_path
|
||||
gitea_allowlist_reload_command
|
||||
gitea_allowlist_last_sync_at
|
||||
gitea_allowlist_last_sync_ok
|
||||
gitea_allowlist_last_sync_error
|
||||
```
|
||||
|
||||
默认 include 路径：
|
||||
|
||||
```text
|
||||
/etc/nginx/gitea-allowlist.conf
|
||||
```
|
||||
|
||||
默认 reload 命令：
|
||||
|
||||
```bash
|
||||
nginx -t && systemctl reload nginx
|
||||
```
|
||||
|
||||
## Nginx 接入方式
|
||||
|
||||
在 Gitea 的 Nginx `server` 或 `location /` 中 include Nexus 生成的文件：
|
||||
|
||||
```nginx
|
||||
location / {
|
||||
include /etc/nginx/gitea-allowlist.conf;
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
```
|
||||
|
||||
## 安全边界
|
||||
|
||||
- 只把 IP/CIDR 写成 Nginx `allow` 指令。
|
||||
- Nexus 白名单里如果有域名，会在 Gitea 同步中跳过并写入注释，因为 Nginx `allow` 不支持域名动态解析。
|
||||
- `enabled=false` 时生成的 include 不包含 `allow/deny`，不会阻断访问。
|
||||
- `enabled=true` 但当前没有任何可用于 Nginx 的 IP/CIDR 时，后端会拒绝同步，避免误写 `deny all` 把 Gitea 锁死。
|
||||
- 远端路径要求绝对路径，拒绝 `/`、`/etc`、`/etc/nginx` 和控制字符。
|
||||
|
||||
## 自动同步触发点
|
||||
|
||||
开启 `gitea_allowlist_auto_sync=true` 后：
|
||||
|
||||
1. `POST /api/settings/ip-allowlist` 保存 Nexus 白名单后同步；
|
||||
2. `POST /api/settings/ip-allowlist/manual` 增加手动 IP 后同步；
|
||||
3. `DELETE /api/settings/ip-allowlist/ip` 删除手动 IP 后同步；
|
||||
4. 后台订阅刷新 `server/background/ip_allowlist_refresh.py` 成功更新 `login_allowed_ips` 后同步。
|
||||
|
||||
自动同步是 best-effort：失败只记录 `gitea_allowlist_last_sync_error`，不会影响 Nexus 原本白名单保存。
|
||||
|
||||
## 前端页面
|
||||
|
||||
新增 `/app-v2` 设置页中的 `Gitea 白名单同步` 面板：
|
||||
|
||||
- 开关：启用 Gitea 白名单、自动同步；
|
||||
- 输入：Gitea 服务器 ID、include 远端路径、reload 命令；
|
||||
- 展示：Nexus 合并白名单数量、Nginx 可用 IP/CIDR 数量、跳过项数量；
|
||||
- 展示：Nginx include 示例和即将写入文件预览；
|
||||
- 操作：保存配置、立即同步。
|
||||
|
||||
## 回滚
|
||||
|
||||
如果需要回滚：
|
||||
|
||||
1. 在 Nexus 关闭 `Gitea 白名单启用`；
|
||||
2. 点击“立即同步”，生成不拦截的 include；
|
||||
3. 或从 Gitea Nginx 配置中移除 `include /etc/nginx/gitea-allowlist.conf;`；
|
||||
4. 执行 `nginx -t && systemctl reload nginx`。
|
||||
@@ -0,0 +1,175 @@
|
||||
# Nexus SSH/文件管理安全巡检阶段 1（2026-07-07）
|
||||
|
||||
## 1. 巡检口径调整
|
||||
|
||||
用户已明确：`script_service` 是“管理员远程执行命令”功能，天然允许管理员执行任意 shell；这是产品设计内能力，不作为本轮漏洞修复项。
|
||||
|
||||
后续对它只保留三类审查：
|
||||
|
||||
- 鉴权：必须只能由已登录管理员调用。
|
||||
- 审计：执行人、目标服务器、执行时间、结果摘要要可追踪。
|
||||
- 敏感信息：不要把密码、Token、密钥等完整写入日志或返回给不该看到的人。
|
||||
|
||||
本轮实际修复的是“非脚本服务、非预期的命令参数边界”。
|
||||
|
||||
---
|
||||
|
||||
## 2. 当前测试机状态
|
||||
|
||||
- 测试机：`192.168.124.219`
|
||||
- 项目目录：`/opt/nexus-dev-current`
|
||||
- Git 分支：`audit/security-review`
|
||||
- 当前最新提交：`bcec78f fix: harden file manager shell operations`
|
||||
- Nexus 容器：`0.0.0.0:18600 -> 8600`，健康检查返回 `ok`
|
||||
- MySQL：`0.0.0.0:13306 -> 3306`
|
||||
- Redis：`0.0.0.0:16379 -> 6379`
|
||||
|
||||
最近提交：
|
||||
|
||||
```text
|
||||
bcec78f fix: harden file manager shell operations
|
||||
112e617 fix: stop archive option injection via filenames
|
||||
99edd30 chore: default compose ports for nexus test deploy
|
||||
a538358 fix: keep bt panel sessions alive after one-click login
|
||||
9d42fcd chore: baseline Nexus LAN test deployment snapshot
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. 已完成修复 A：远程压缩命令参数终止符
|
||||
|
||||
提交：`112e617 fix: stop archive option injection via filenames`
|
||||
|
||||
修改文件：
|
||||
|
||||
- `server/infrastructure/ssh/remote_archive.py`
|
||||
- `tests/test_remote_archive_commands.py`
|
||||
|
||||
修复点：
|
||||
|
||||
- `tar` 压缩命令增加 `--`，避免成员名以 `-` 开头时被当作 tar 参数。
|
||||
- `zip` 压缩命令增加 `--`，避免目标名或成员名以 `-` 开头时被当作 zip 参数。
|
||||
|
||||
运行容器已热更新确认包含：
|
||||
|
||||
```text
|
||||
tar -czf ... -C ... -- ...
|
||||
zip -qr -- ...
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. 已完成修复 B：文件管理命令参数终止符
|
||||
|
||||
提交：`bcec78f fix: harden file manager shell operations`
|
||||
|
||||
修改文件：
|
||||
|
||||
- `server/api/sync_v2.py`
|
||||
|
||||
加固命令：
|
||||
|
||||
```text
|
||||
rm -rf -- <path>
|
||||
mv -- <src> <dest>
|
||||
mkdir -p -- <path>
|
||||
cp -r -- <sources> <dest>
|
||||
mv -t <dest> -- <sources>
|
||||
```
|
||||
|
||||
说明：
|
||||
|
||||
- 这些路径本身已经经过 `normalize_remote_abs_path()` 和 `shlex.quote()`。
|
||||
- 本次增加 `--` 是第二道防线，防止未来路径来源变化或边界输入导致工具把路径误判为命令选项。
|
||||
- 这不是限制管理员能力；管理员确实要执行任意命令时仍应通过设计内的 `script_service`。
|
||||
|
||||
---
|
||||
|
||||
## 5. 已完成修复 C：递归 chmod/chown 系统目录子树保护
|
||||
|
||||
提交：`bcec78f fix: harden file manager shell operations`
|
||||
|
||||
修改文件：
|
||||
|
||||
- `server/utils/files_chmod_policy.py`
|
||||
- `tests/test_file_permissions.py`
|
||||
|
||||
修复前：
|
||||
|
||||
- 只禁止对精确系统路径递归改权限，例如 `/etc`、`/usr`、`/`。
|
||||
- 但 `/etc/nginx`、`/usr/local` 这类系统目录子树仍可能被文件管理 UI 执行递归 chmod/chown。
|
||||
|
||||
修复后：
|
||||
|
||||
- 继续禁止精确系统路径。
|
||||
- 新增禁止关键系统目录子树：
|
||||
- `/bin/`
|
||||
- `/boot/`
|
||||
- `/dev/`
|
||||
- `/etc/`
|
||||
- `/lib/`
|
||||
- `/lib64/`
|
||||
- `/proc/`
|
||||
- `/run/`
|
||||
- `/sbin/`
|
||||
- `/sys/`
|
||||
- `/usr/`
|
||||
- `/var/cache/`
|
||||
- `/var/lib/`
|
||||
- `/var/log/`
|
||||
- `/var/run/`
|
||||
- `/var/spool/`
|
||||
- 保留常见 Web 目录可操作：
|
||||
- `/www/wwwroot/site`
|
||||
- `/var/www/html`
|
||||
|
||||
设计原因：
|
||||
|
||||
- 文件管理 UI 的 chmod/chown 是“安全操作封装”，应防止误点造成系统不可用。
|
||||
- 真正需要改系统目录权限的管理员，仍可使用设计内的 `script_service` 明确执行命令。
|
||||
|
||||
---
|
||||
|
||||
## 6. 验证结果
|
||||
|
||||
已运行测试：
|
||||
|
||||
```text
|
||||
pytest tests/test_file_permissions.py tests/test_schema_path_validators.py tests/test_remote_archive_commands.py -q
|
||||
22 passed in 0.54s
|
||||
```
|
||||
|
||||
完整后端测试：
|
||||
|
||||
```text
|
||||
pytest -q
|
||||
733 passed, 1 skipped in 11.77s
|
||||
```
|
||||
|
||||
格式检查：
|
||||
|
||||
```text
|
||||
git diff --check
|
||||
无输出，表示无 whitespace 错误。
|
||||
```
|
||||
|
||||
运行容器热更新：
|
||||
|
||||
- 已把以下文件复制进 `nexus-nexus-1` 容器：
|
||||
- `server/infrastructure/ssh/remote_archive.py`
|
||||
- `server/api/sync_v2.py`
|
||||
- `server/utils/files_chmod_policy.py`
|
||||
- 已重启 Nexus 容器。
|
||||
- 健康检查返回 `ok`。
|
||||
|
||||
---
|
||||
|
||||
## 7. 下一步继续巡检建议
|
||||
|
||||
下一阶段建议按以下顺序继续：
|
||||
|
||||
1. `server/api/sync_v2.py` 解压链路：检查 tar/zip 解压是否需要增加归档成员路径校验，防 zip-slip/tar traversal。
|
||||
2. `server/application/services/server_file_transfer_service.py`：检查跨服务器打包/投递的路径校验、临时目录清理、权限回退。
|
||||
3. `server/infrastructure/ssh/remote_shell.py`、`asyncssh_pool.py`：复核 timeout、sudo fallback、stderr/stdout 截断和敏感信息处理。
|
||||
4. `server/infrastructure/btpanel/ssh_bootstrap.py`、`ssh_login.py`：复核宝塔 token、白名单、session patch 输出中是否有敏感信息泄漏。
|
||||
5. `server/api/servers.py`：复核 agent 安装/升级命令拼接、参数来源、失败回滚边界。
|
||||
@@ -0,0 +1,177 @@
|
||||
# Nexus SSH/文件管理安全巡检阶段 2：安全解压（2026-07-07）
|
||||
|
||||
## 1. 本阶段目标
|
||||
|
||||
继续 SSH/文件管理安全巡检，重点检查：
|
||||
|
||||
- `/api/sync/decompress` 解压链路。
|
||||
- tar/zip 归档成员是否可能写出目标目录。
|
||||
- 归档中的软链接、硬链接、设备文件是否可能造成覆盖或越权写入。
|
||||
|
||||
`script_service` 仍按用户确认的口径处理：它是设计内管理员远程 shell，不作为漏洞；本阶段只加固文件管理 UI 的“封装式安全操作”。
|
||||
|
||||
---
|
||||
|
||||
## 2. 修复提交
|
||||
|
||||
提交：
|
||||
|
||||
```text
|
||||
845d7e2 fix: validate remote archives before extraction
|
||||
```
|
||||
|
||||
修改文件：
|
||||
|
||||
```text
|
||||
server/api/sync_v2.py
|
||||
server/infrastructure/ssh/remote_archive.py
|
||||
tests/test_remote_archive_commands.py
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. 修复前风险
|
||||
|
||||
原解压逻辑直接执行：
|
||||
|
||||
```bash
|
||||
tar xzf <archive> -C <dest>
|
||||
unzip -o <archive> -d <dest>
|
||||
```
|
||||
|
||||
虽然 `<archive>` 和 `<dest>` 已经做过绝对路径规范化和 shell quote，但归档文件内部成员名不受 Nexus 控制，仍需要额外检查：
|
||||
|
||||
- 成员名为 `../evil` 可能尝试路径穿越。
|
||||
- 成员名为 `/etc/passwd` 属于绝对路径。
|
||||
- zip 中 Windows 分隔符 `dir\evil` 在某些工具/平台语义下容易产生歧义。
|
||||
- 归档内软链接/硬链接/设备文件可能造成解压后写出目标目录或制造特殊文件。
|
||||
|
||||
---
|
||||
|
||||
## 4. 修复后设计
|
||||
|
||||
解压流程从 API 中下沉到：
|
||||
|
||||
```text
|
||||
server/infrastructure/ssh/remote_archive.py::run_remote_decompress()
|
||||
```
|
||||
|
||||
新流程：
|
||||
|
||||
1. 判断格式：
|
||||
- `.tar.gz` / `.tgz` -> `tar.gz`
|
||||
- `.zip` -> `zip`
|
||||
2. 先列出成员名：
|
||||
- tar：`tar -tzf <archive>`
|
||||
- zip：`unzip -Z1 <archive>`
|
||||
3. 校验成员名：
|
||||
- 禁止空文件名。
|
||||
- 禁止绝对路径。
|
||||
- 禁止 `..` 路径穿越。
|
||||
- 禁止 Windows 反斜杠分隔符。
|
||||
4. 再列出成员类型：
|
||||
- tar：`tar -tvzf <archive>`
|
||||
- zip：`zipinfo -l <archive>`
|
||||
5. 校验成员类型：
|
||||
- 允许普通文件和目录。
|
||||
- 禁止符号链接。
|
||||
- 禁止硬链接。
|
||||
- 禁止块设备、字符设备、FIFO、socket。
|
||||
6. 通过校验后才解压。
|
||||
|
||||
安全 tar 解压命令增加：
|
||||
|
||||
```bash
|
||||
tar --no-same-owner --no-same-permissions -xzf <archive> -C <dest>
|
||||
```
|
||||
|
||||
避免归档强行恢复 owner/permission，降低解压后权限异常风险。
|
||||
|
||||
---
|
||||
|
||||
## 5. 新增测试覆盖
|
||||
|
||||
新增/扩展测试文件：
|
||||
|
||||
```text
|
||||
tests/test_remote_archive_commands.py
|
||||
```
|
||||
|
||||
覆盖：
|
||||
|
||||
- tar/zip 成员列表命令。
|
||||
- tar 解压命令使用 `--no-same-owner --no-same-permissions`。
|
||||
- 拒绝 `../evil.txt`。
|
||||
- 拒绝 `/etc/passwd`。
|
||||
- 拒绝 `dir\evil.txt`。
|
||||
- 允许普通相对文件和目录。
|
||||
- 拒绝符号链接。
|
||||
- 拒绝字符设备。
|
||||
- 允许 zipinfo header/footer + 普通文件/目录。
|
||||
|
||||
---
|
||||
|
||||
## 6. 验证结果
|
||||
|
||||
相关测试：
|
||||
|
||||
```text
|
||||
pytest tests/test_remote_archive_commands.py tests/test_schema_path_validators.py tests/test_file_permissions.py -q
|
||||
31 passed in 0.55s
|
||||
```
|
||||
|
||||
完整后端测试：
|
||||
|
||||
```text
|
||||
pytest -q
|
||||
742 passed, 1 skipped in 11.83s
|
||||
```
|
||||
|
||||
格式检查：
|
||||
|
||||
```text
|
||||
git diff --check
|
||||
无输出
|
||||
```
|
||||
|
||||
运行容器热更新：
|
||||
|
||||
- 已复制以下文件到 `nexus-nexus-1`：
|
||||
- `server/api/sync_v2.py`
|
||||
- `server/infrastructure/ssh/remote_archive.py`
|
||||
- 已重启 Nexus 容器。
|
||||
- `http://127.0.0.1:18600/health` 返回 `ok`。
|
||||
- 容器内已确认存在：
|
||||
- `validate_archive_member_names`
|
||||
- `run_remote_decompress`
|
||||
- API 调用 `run_remote_decompress(...)`
|
||||
|
||||
---
|
||||
|
||||
## 7. 当前最新提交链
|
||||
|
||||
```text
|
||||
845d7e2 fix: validate remote archives before extraction
|
||||
bcec78f fix: harden file manager shell operations
|
||||
112e617 fix: stop archive option injection via filenames
|
||||
99edd30 chore: default compose ports for nexus test deploy
|
||||
a538358 fix: keep bt panel sessions alive after one-click login
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 下一阶段建议
|
||||
|
||||
继续巡检：
|
||||
|
||||
1. `server/application/services/server_file_transfer_service.py`
|
||||
- 跨服务器打包/拉取/投递路径校验。
|
||||
- 临时文件清理。
|
||||
- sudo fallback 边界。
|
||||
2. `server/infrastructure/ssh/remote_shell.py` / `asyncssh_pool.py`
|
||||
- timeout 默认值。
|
||||
- stdout/stderr 截断。
|
||||
- 敏感信息是否可能返回前端。
|
||||
3. `server/api/servers.py`
|
||||
- agent 安装/升级/回滚命令拼接。
|
||||
- 参数来源和 quote。
|
||||
@@ -0,0 +1,87 @@
|
||||
# Nexus SSH 命令执行安全巡检阶段 3：跨服务器文件传输与项目专用 Skill
|
||||
|
||||
日期：2026-07-07
|
||||
分支：`audit/security-review`
|
||||
范围：跨服务器文件传输、BT 面板直链下载投递、远程归档压缩/解压、项目专用审查 Skill。
|
||||
|
||||
## 1. 本阶段结论
|
||||
|
||||
本阶段补齐了跨服务器文件传输链路中遗留的高风险边界：
|
||||
|
||||
- 传输包在目标服务器解压时，复用了统一的安全解压流程，先列成员、校验路径和类型，再解压。
|
||||
- 远程 `mkdir`、`mv`、`rm`、归档 staging move 增加 `--` 参数终止符，避免以 `-` 开头的路径被当成命令选项。
|
||||
- `pull_transfer_package` 与 BT 直链投递目标路径改为统一 `normalize_remote_abs_path` 校验，拒绝 `..` 与反斜杠。
|
||||
- 新增 `.skills/` 下 Nexus 专用安全巡检规范，后续每轮审查可按固定规则执行。
|
||||
|
||||
完整测试结果：`748 passed, 1 skipped`。
|
||||
|
||||
## 2. 调用链
|
||||
|
||||
### 2.1 Nexus 代理下载投递
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A["API: transfer package/deliver"] --> B["server_file_transfer_service.create_transfer_package"]
|
||||
B --> C["run_remote_compress(source)"]
|
||||
C --> D["Redis transfer_package_store: token/meta/ttl"]
|
||||
D --> E["pull_transfer_package(dest)"]
|
||||
E --> F["curl Nexus signed transfer URL to /tmp staging"]
|
||||
F --> G["mv -- staging -> dest archive path"]
|
||||
G --> H["run_remote_decompress(dest): list members"]
|
||||
H --> I["validate names/types"]
|
||||
I --> J["safe tar/unzip extract"]
|
||||
J --> K["apply_transfer_permissions"]
|
||||
```
|
||||
|
||||
### 2.2 BT 面板直链下载投递
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A["deliver_transfer_package"] --> B["source has BT API credentials"]
|
||||
B --> C["_deliver_via_btpanel_download"]
|
||||
C --> D["run_remote_compress(source)"]
|
||||
D --> E["signed_download_url(BT)"]
|
||||
E --> F["dest curl BT download URL to /tmp staging"]
|
||||
F --> G["mv -- staging -> dest archive path"]
|
||||
G --> H["run_remote_decompress(dest)"]
|
||||
H --> I["validate archive member names/types"]
|
||||
I --> J["extract + permissions"]
|
||||
```
|
||||
|
||||
## 3. 修复点
|
||||
|
||||
| 文件 | 修复 |
|
||||
|---|---|
|
||||
| `server/application/services/server_file_transfer_service.py` | `_extract_archive_on_server()` 改为调用 `run_remote_decompress()`，解压前校验归档成员；目标路径使用 `normalize_remote_abs_path()`；`mkdir/mv/rm` 增加 `--`。 |
|
||||
| `server/infrastructure/ssh/remote_archive.py` | tar/zip staging 压缩后的 `mv` 改为 `mv -f -- ...`。 |
|
||||
| `tests/test_server_file_transfer.py` | 新增安全解压委托、解压校验错误、目标路径穿越拒绝、下载 staging move/rm 参数终止符测试；更新旧的 tar overwrite 行为测试。 |
|
||||
| `tests/test_remote_archive_commands.py` | 新增 tar/zip staging move 参数终止符测试。 |
|
||||
| `.skills/nexus-security-review/SKILL.md` | 固化 Nexus 安全巡检总规则。 |
|
||||
| `.skills/nexus-ssh-safety/SKILL.md` | 固化 SSH 命令、路径、归档安全规则。 |
|
||||
| `.skills/nexus-btpanel-review/SKILL.md` | 固化宝塔一键登录/凭据/会话修复审查规则。 |
|
||||
|
||||
## 4. 边界说明
|
||||
|
||||
- `script_service` 是管理员显式远程 shell 能力，本阶段没有把它作为命令注入漏洞处理；后续只审查鉴权、审计、超时、输出截断和脱敏。
|
||||
- 文件传输仍允许管理员选择任意绝对目标路径，但不允许路径字符串中包含 `..`、反斜杠或非绝对路径。
|
||||
- 归档解压会拒绝绝对路径、父目录穿越、Windows 反斜杠、符号链接、硬链接和设备/FIFO/socket 等特殊条目。
|
||||
- 未在报告中记录任何密码、token、cookie、SSH key 或 BT API key。
|
||||
|
||||
## 5. 验证记录
|
||||
|
||||
```bash
|
||||
.venv/bin/python -m pytest tests/test_server_file_transfer.py tests/test_remote_archive_commands.py -q
|
||||
# 40 passed
|
||||
|
||||
.venv/bin/python -m pytest -q
|
||||
# 748 passed, 1 skipped
|
||||
|
||||
git diff --check
|
||||
# pass
|
||||
```
|
||||
|
||||
## 6. 下一步建议
|
||||
|
||||
1. 继续审查 `server/api/servers.py` 的 agent 安装/升级/回滚命令拼接与超时边界。
|
||||
2. 审查 `remote_shell.py` / `asyncssh_pool.py` 的 stdout/stderr 截断、敏感输出脱敏和 sudo fallback 一致性。
|
||||
3. 审查 API 鉴权覆盖：确认所有管理接口均有管理员依赖，公开下载类接口只暴露必要的 token 校验。
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,236 @@
|
||||
# Nexus 手动发布命令清单（2026-07-08）
|
||||
|
||||
> 适用场景：Codex 远程 SSH 审批不可用时，由人工在本机和线上服务器执行。
|
||||
> 发布包已通过本地 Gate 和发布包扫描。
|
||||
|
||||
## 本地发布包
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
## 方案 A：使用现有 deploy/deploy-production.sh（推荐）
|
||||
|
||||
前提：
|
||||
|
||||
- 本机能通过 SSH 访问线上 Host：`nexus`
|
||||
- 或设置 `NEXUS_SSH=user@host`
|
||||
- 线上已有 `/opt/nexus` 或 `/www/wwwroot/api.synaglobal.vip`
|
||||
|
||||
在源码快照目录执行：
|
||||
|
||||
```bash
|
||||
cd /c/Users/uzuma/Documents/Codex/2026-07-06/yuu/work/nexus_code_context/snapshots/nexus-source-20260707-112042
|
||||
bash deploy/deploy-production.sh
|
||||
```
|
||||
|
||||
如果不用 SSH config：
|
||||
|
||||
```bash
|
||||
export NEXUS_SSH='root@你的线上服务器IP'
|
||||
export NEXUS_DEPLOY_PATH='/opt/nexus'
|
||||
bash deploy/deploy-production.sh
|
||||
```
|
||||
|
||||
发布脚本会：
|
||||
|
||||
1. 本地同步源码到线上。
|
||||
2. 排除 `.venv-*`、`node_modules`、缓存、误生成文件。
|
||||
3. Docker 模式下执行 `nexus-1panel.sh upgrade --skip-git`。
|
||||
4. 构建并上传旧 `/app/`。
|
||||
5. 构建并上传新 `/app-v2/`。
|
||||
6. Docker 模式下同步 `web/app` 与 `web/app-v2` 到容器。
|
||||
7. 检查 `/health`、`/app/`、`/app-v2/`。
|
||||
|
||||
## 方案 B：发布 tar.gz 包到线上
|
||||
|
||||
### 1. 上传
|
||||
|
||||
Windows CMD / PowerShell：
|
||||
|
||||
```cmd
|
||||
scp C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz nexus:/tmp/nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
### 2. 线上校验
|
||||
|
||||
```bash
|
||||
cd /tmp
|
||||
sha256sum nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
必须等于：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
### 3. 线上备份
|
||||
|
||||
假设部署目录为 `/opt/nexus`：
|
||||
|
||||
```bash
|
||||
sudo mkdir -p /opt/nexus-backups
|
||||
sudo tar czf /opt/nexus-backups/nexus-before-20260708.tar.gz -C /opt nexus
|
||||
```
|
||||
|
||||
### 3B. 使用服务器侧脚本自动应用发布包（推荐）
|
||||
|
||||
如果线上已存在当前项目的 `deploy/apply-release-bundle.sh`，或者你先把发布包解开到临时目录后使用新脚本，可以执行：
|
||||
|
||||
```bash
|
||||
sudo bash /opt/nexus/deploy/apply-release-bundle.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
如果脚本尚未在旧线上目录中，可以先临时解出脚本：
|
||||
|
||||
```bash
|
||||
cd /tmp
|
||||
tar xzf nexus-release-20260708.tar.gz nexus-release/deploy/apply-release-bundle.sh
|
||||
sudo bash /tmp/nexus-release/deploy/apply-release-bundle.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
这个脚本会自动：
|
||||
|
||||
1. 校验 SHA256。
|
||||
2. 检查发布包内必须路径和禁止路径。
|
||||
3. 备份当前 `/opt/nexus`。
|
||||
4. rsync 覆盖代码，但保留 `.env`、`docker/.env.prod`、`web/data`。
|
||||
5. Docker 模式下执行 `nexus-1panel.sh upgrade --skip-git`。
|
||||
6. 同步 `/app/` 和 `/app-v2/` 静态资源到容器。
|
||||
7. 验证本机 `/health`、`/app/`、`/app-v2/`。
|
||||
|
||||
### 4. 解包覆盖
|
||||
|
||||
```bash
|
||||
sudo mkdir -p /opt/nexus
|
||||
sudo tar xzf /tmp/nexus-release-20260708.tar.gz -C /tmp
|
||||
sudo rsync -a --delete \
|
||||
--exclude='.env' \
|
||||
--exclude='docker/.env.prod' \
|
||||
--exclude='web/data' \
|
||||
/tmp/nexus-release/ /opt/nexus/
|
||||
```
|
||||
|
||||
### 5. 重建/重启
|
||||
|
||||
Docker/1Panel 模式：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus
|
||||
sudo env NEXUS_ROOT=/opt/nexus bash deploy/nexus-1panel.sh upgrade --skip-git
|
||||
```
|
||||
|
||||
如果是 Supervisor 模式：
|
||||
|
||||
```bash
|
||||
sudo supervisorctl restart nexus
|
||||
```
|
||||
|
||||
### 6. Docker 容器内静态资源同步
|
||||
|
||||
Docker 模式建议执行：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus
|
||||
sudo env NEXUS_ROOT=/opt/nexus bash deploy/sync_webapp_to_container.sh
|
||||
```
|
||||
|
||||
|
||||
## 方案 C：Python 发布辅助脚本（推荐替代手工 scp/ssh）
|
||||
|
||||
默认只上传并执行服务器侧 preflight，不会正式 apply：
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
preflight 输出确认无误后，再加 `--apply` 正式发布：
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b ^
|
||||
--apply
|
||||
```
|
||||
|
||||
详见：`Nexus-release-python-publisher-20260708.md`。
|
||||
|
||||
## 发布后验证
|
||||
|
||||
本机执行：
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\verify_online_release.py --base-url https://api.synaglobal.vip
|
||||
```
|
||||
|
||||
线上执行：
|
||||
|
||||
```bash
|
||||
curl -s https://api.synaglobal.vip/health
|
||||
curl -I https://api.synaglobal.vip/app/
|
||||
curl -I https://api.synaglobal.vip/app-v2/
|
||||
```
|
||||
|
||||
期望：
|
||||
|
||||
```text
|
||||
/health => ok
|
||||
/app/ => HTTP 200
|
||||
/app-v2/ => HTTP 200
|
||||
```
|
||||
|
||||
## 宝塔专项验证
|
||||
|
||||
发布后在 Nexus 后台验证：
|
||||
|
||||
1. 打开 `/app/` 旧后台，确认宝塔列表正常。
|
||||
2. 打开 `/app-v2/` 新后台，确认页面可访问。
|
||||
3. 对同一台宝塔连续点击一键登录，冲突时应该返回 HTTP 409。
|
||||
4. 对新增宝塔执行一键登录，应触发 hardcoded_3600 检测/修复兜底。
|
||||
5. 多台宝塔同时打开后，2 小时刷新不应因为 `task.py` hardcoded `3600` 陆续掉线。
|
||||
|
||||
## 回滚
|
||||
|
||||
如果异常：
|
||||
|
||||
```bash
|
||||
cd /opt
|
||||
sudo mv nexus nexus-bad-20260708
|
||||
sudo tar xzf /opt/nexus-backups/nexus-before-20260708.tar.gz -C /opt
|
||||
cd /opt/nexus
|
||||
sudo env NEXUS_ROOT=/opt/nexus bash deploy/nexus-1panel.sh upgrade --skip-git
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Server preflight command
|
||||
|
||||
Before applying the release on the production host, run:
|
||||
|
||||
```bash
|
||||
bash /tmp/nexus-release/deploy/preflight-release-host.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
This checks required commands, checksum, release tar paths, deploy path, runtime hints, disk space, and current local endpoints before applying changes.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Nexus release artifact metadata
|
||||
|
||||
- File: `nexus-release-20260708.tar.gz`
|
||||
- Size: `27.02 MB`
|
||||
- Entries: `2409`
|
||||
- SHA256: `46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b`
|
||||
- Created UTC: `2026-07-08T09:59:20.278597+00:00`
|
||||
|
||||
## Verify after upload
|
||||
|
||||
Linux:
|
||||
|
||||
```bash
|
||||
sha256sum nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
PowerShell:
|
||||
|
||||
```powershell
|
||||
Get-FileHash .\nexus-release-20260708.tar.gz -Algorithm SHA256
|
||||
```
|
||||
@@ -0,0 +1,777 @@
|
||||
# Nexus release diff manifest (2026-07-08)
|
||||
|
||||
Baseline:
|
||||
|
||||
- Old snapshot: `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236`
|
||||
- New snapshot: `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042`
|
||||
|
||||
Excluded names/patterns: `.git`, `node_modules`, `.venv-*`, `venv`, `__pycache__`, `.ruff_cache`, `.playwright-mcp`, `.cursor`, `.pytest_cache`, `tmp`, `*.pyc`, `*.pyo`, `*.bak-`, `2025.2`, `=2025.2`.
|
||||
|
||||
## Summary
|
||||
|
||||
- Added files: 381
|
||||
- Modified files: 26
|
||||
- Deleted files: 347
|
||||
|
||||
## Added files
|
||||
|
||||
- `.skills/nexus-btpanel-review/SKILL.md`
|
||||
- `.skills/nexus-security-review/SKILL.md`
|
||||
- `.skills/nexus-ssh-safety/SKILL.md`
|
||||
- `deploy/apply-release-bundle.sh`
|
||||
- `deploy/preflight-release-host.sh`
|
||||
- `docs/security/Nexus-SSH鍛戒护鎵ц瀹夊叏宸℃闃舵3-鏂囦欢浼犺緭涓庝笓鐢⊿kill-20260707.md`
|
||||
- `frontend-v2/index.html`
|
||||
- `frontend-v2/package-lock.json`
|
||||
- `frontend-v2/package.json`
|
||||
- `frontend-v2/postcss.config.js`
|
||||
- `frontend-v2/scripts/scan-app-v2-sensitive.mjs`
|
||||
- `frontend-v2/src/App.tsx`
|
||||
- `frontend-v2/src/components/ui/Badge.tsx`
|
||||
- `frontend-v2/src/components/ui/Panel.tsx`
|
||||
- `frontend-v2/src/features/dashboard/DashboardPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/api/dashboardApi.ts`
|
||||
- `frontend-v2/src/features/dashboard/components/AppShell.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/AssetInventoryPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/AuditLogPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/AuditTimeline.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/BtDomainSslPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/BtPanelPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/BtResourceOverviewPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/CommandPalette.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/ExecutionRecordsPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/GlobalSearchPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/HealthScore.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/OperationLogsPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/ReadOnlyFileBrowser.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/ScriptLibraryPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/SecurityInspectionPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/ServerDrawer.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/ServerTable.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/SettingsOverviewPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/StatCard.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/TaskCenter.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/TaskCenterPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/TerminalFilesPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/TrendPanel.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/TtlMatrix.tsx`
|
||||
- `frontend-v2/src/features/dashboard/components/WatchMonitoringPage.tsx`
|
||||
- `frontend-v2/src/features/dashboard/data/dashboardData.ts`
|
||||
- `frontend-v2/src/features/dashboard/hooks/useDashboardData.ts`
|
||||
- `frontend-v2/src/lib/api.ts`
|
||||
- `frontend-v2/src/lib/redaction.ts`
|
||||
- `frontend-v2/src/lib/utils.ts`
|
||||
- `frontend-v2/src/main.tsx`
|
||||
- `frontend-v2/src/stores/appStore.ts`
|
||||
- `frontend-v2/src/styles.css`
|
||||
- `frontend-v2/src/vite-env.d.ts`
|
||||
- `frontend-v2/tailwind.config.ts`
|
||||
- `frontend-v2/tsconfig.json`
|
||||
- `frontend-v2/tsconfig.node.json`
|
||||
- `frontend-v2/vite.config.ts`
|
||||
- `scripts/check_backend_test_env.py`
|
||||
- `scripts/check_deploy_excludes.py`
|
||||
- `scripts/check_text_integrity.py`
|
||||
- `scripts/generate_release_bundle.py`
|
||||
- `scripts/generate_release_diff.py`
|
||||
- `scripts/prepare_release_artifact.py`
|
||||
- `scripts/publish_release_bundle.py`
|
||||
- `scripts/run_btpanel_tests.py`
|
||||
- `scripts/run_btpanel_tests_docker.cmd`
|
||||
- `scripts/run_btpanel_tests_docker.sh`
|
||||
- `scripts/run_local_release_gate.py`
|
||||
- `scripts/scan_release_bundle.py`
|
||||
- `scripts/scan_release_manifest.py`
|
||||
- `scripts/verify_online_release.py`
|
||||
- `scripts/write_release_metadata.py`
|
||||
- `tests/test_btpanel_bootstrap_lock.py`
|
||||
- `tests/test_publish_release_bundle.py`
|
||||
- `tests/test_remote_archive_commands.py`
|
||||
- `web/app-v2/assets/DashboardPage--9cH96CJ.js`
|
||||
- `web/app-v2/assets/index-8f2_PJZM.js`
|
||||
- `web/app-v2/assets/index-saKc1OPG.css`
|
||||
- `web/app-v2/assets/query-B5fiFlYp.js`
|
||||
- `web/app-v2/assets/react-DGbf-iXy.js`
|
||||
- `web/app-v2/assets/rolldown-runtime-Bh1tDfsg.js`
|
||||
- `web/app-v2/assets/table-C-Cg70AL.js`
|
||||
- `web/app-v2/assets/ui-sq2aW9r5.js`
|
||||
- `web/app-v2/index.html`
|
||||
- `web/app/assets/AlertsPage-BZa6JbW1.js`
|
||||
- `web/app/assets/AlertsPage-DkbuUWgZ.js`
|
||||
- `web/app/assets/AuditPage-CrzMBMPz.js`
|
||||
- `web/app/assets/AuditPage-DE5F-bot.js`
|
||||
- `web/app/assets/BtPanelCrontabPage-CsxFXzwR.js`
|
||||
- `web/app/assets/BtPanelCrontabPage-DFAuKeNI.js`
|
||||
- `web/app/assets/BtPanelDatabasesPage-Cua9aENZ.js`
|
||||
- `web/app/assets/BtPanelDatabasesPage-Cxt_i4Lp.js`
|
||||
- `web/app/assets/BtPanelDomainsPage-9oKLFhi4.js`
|
||||
- `web/app/assets/BtPanelDomainsPage-CSupPzQH.js`
|
||||
- `web/app/assets/BtPanelLoginPage-DiKTnvyN.js`
|
||||
- `web/app/assets/BtPanelLoginPage-Dp3X10Er.js`
|
||||
- `web/app/assets/BtPanelMonitorPage-2tHIkE0-.js`
|
||||
- `web/app/assets/BtPanelMonitorPage-Pm3fw_df.js`
|
||||
- `web/app/assets/BtPanelMonitorPage-Td-5siPa.css`
|
||||
- `web/app/assets/BtPanelServicesPage-B652HAqe.js`
|
||||
- `web/app/assets/BtPanelServicesPage-DR8K2l-F.js`
|
||||
- `web/app/assets/BtPanelSettingsPage-BBi6ttQm.js`
|
||||
- `web/app/assets/BtPanelSettingsPage-DCQKy6JG.js`
|
||||
- `web/app/assets/BtPanelSiteCreatePage-DLG_BM-C.js`
|
||||
- `web/app/assets/BtPanelSiteCreatePage-DTCrnEa5.js`
|
||||
- `web/app/assets/BtPanelSitesPage--EP6G5x3.js`
|
||||
- `web/app/assets/BtPanelSitesPage-DWm4LMaV.js`
|
||||
- `web/app/assets/BtPanelSslPage-BuiQZ1OJ.js`
|
||||
- `web/app/assets/BtPanelSslPage-JWzPztxi.js`
|
||||
- `web/app/assets/CommandsPage-BNtXfIOs.js`
|
||||
- `web/app/assets/CommandsPage-CuHLCAHz.js`
|
||||
- `web/app/assets/CredentialsPage-BPUBEwg9.js`
|
||||
- `web/app/assets/CredentialsPage-Dc92himy.js`
|
||||
- `web/app/assets/DashboardPage-DOc8f-2E.js`
|
||||
- `web/app/assets/DashboardPage-DmG38yGr.css`
|
||||
- `web/app/assets/DashboardPage-yElaw2BV.js`
|
||||
- `web/app/assets/FilesPage-Be2kmggp.js`
|
||||
- `web/app/assets/FilesPage-By07WOZR.css`
|
||||
- `web/app/assets/FilesPage-DHwnC_As.js`
|
||||
- `web/app/assets/FleetTrendEChart-DbHCuhg7.css`
|
||||
- `web/app/assets/FleetTrendEChart-Dz57W1gD.js`
|
||||
- `web/app/assets/FleetTrendEChart-lgdTP3R-.js`
|
||||
- `web/app/assets/LoginPage-3NZZLudg.js`
|
||||
- `web/app/assets/LoginPage-BKIQ3yge.js`
|
||||
- `web/app/assets/LoginPage-BTEVFKpe.css`
|
||||
- `web/app/assets/PushPage-BcIAXgGU.js`
|
||||
- `web/app/assets/PushPage-DnVPUcAX.css`
|
||||
- `web/app/assets/PushPage-_afVGSg2.js`
|
||||
- `web/app/assets/RetriesPage-BdJWTxtp.js`
|
||||
- `web/app/assets/RetriesPage-C70vf571.js`
|
||||
- `web/app/assets/SchedulesPage-B47mlwc8.js`
|
||||
- `web/app/assets/SchedulesPage-B9PFTR71.css`
|
||||
- `web/app/assets/SchedulesPage-DM0j6jps.js`
|
||||
- `web/app/assets/ScriptRunsPage-CW2C9c7C.css`
|
||||
- `web/app/assets/ScriptRunsPage-DIeeXpt5.js`
|
||||
- `web/app/assets/ScriptRunsPage-DeZ4sRVP.js`
|
||||
- `web/app/assets/ScriptsPage-BWoaZhKf.js`
|
||||
- `web/app/assets/ScriptsPage-BrIbZLc5.css`
|
||||
- `web/app/assets/ScriptsPage-D8An6uCU.js`
|
||||
- `web/app/assets/ServerCategoryPicker-BJm8eTKs.js`
|
||||
- `web/app/assets/ServerCategoryPicker-BlyQtEug.js`
|
||||
- `web/app/assets/ServerCategoryPicker-CHn3BA4z.css`
|
||||
- `web/app/assets/ServerQuickAddDialogs-CoSabmGi.js`
|
||||
- `web/app/assets/ServerQuickAddDialogs-zcLgLArY.js`
|
||||
- `web/app/assets/ServerTransferPage-BdwpJEc4.css`
|
||||
- `web/app/assets/ServerTransferPage-CWGjaCXR.js`
|
||||
- `web/app/assets/ServerTransferPage-UYjJ6gzQ.js`
|
||||
- `web/app/assets/ServersPage-CEOh0Y1q.css`
|
||||
- `web/app/assets/ServersPage-D7wE_7hM.css`
|
||||
- `web/app/assets/ServersPage-nR5-sjDp.js`
|
||||
- `web/app/assets/ServersPage-nhvNw2_Z.js`
|
||||
- `web/app/assets/SettingsPage-Am37wCvf.js`
|
||||
- `web/app/assets/SettingsPage-FAHRRqSI.js`
|
||||
- `web/app/assets/StatCardsRow-CWt_wcFU.js`
|
||||
- `web/app/assets/StatCardsRow-CdfBB9tI.js`
|
||||
- `web/app/assets/StatCardsRow-snFLCRnD.css`
|
||||
- `web/app/assets/TerminalPage-CNkogNbG.js`
|
||||
- `web/app/assets/TerminalPage-DX9qLtN2.js`
|
||||
- `web/app/assets/TerminalPage-DvGyoWff.css`
|
||||
- `web/app/assets/VAutocomplete-B1NSIBuv.js`
|
||||
- `web/app/assets/VAutocomplete-CZMI3cz9.js`
|
||||
- `web/app/assets/VAutocomplete-D48FgPMA.css`
|
||||
- `web/app/assets/VCard-BCYbpv-w.css`
|
||||
- `web/app/assets/VCard-BwwttBcf.js`
|
||||
- `web/app/assets/VCard-pmpQR9O7.js`
|
||||
- `web/app/assets/VCheckbox-BO-mWtTk.js`
|
||||
- `web/app/assets/VCheckbox-ChRKi1kj.css`
|
||||
- `web/app/assets/VCheckbox-RnLQ4WBr.js`
|
||||
- `web/app/assets/VDataTable-ClfE0-sD.js`
|
||||
- `web/app/assets/VDataTable-D61zAwkI.css`
|
||||
- `web/app/assets/VDataTable-pRRodit6.js`
|
||||
- `web/app/assets/VDataTableServer-BIMNqMvk.js`
|
||||
- `web/app/assets/VDataTableServer-BysXbZ8p.js`
|
||||
- `web/app/assets/VDialog-BFQGuuXw.js`
|
||||
- `web/app/assets/VDialog-DP-kc9Gx.css`
|
||||
- `web/app/assets/VDialog-nKJcjfNL.js`
|
||||
- `web/app/assets/VExpansionPanels-ByOIBgKv.js`
|
||||
- `web/app/assets/VExpansionPanels-CUfe7Zz5.css`
|
||||
- `web/app/assets/VExpansionPanels-DUlWPWNJ.js`
|
||||
- `web/app/assets/VForm-CAvEgM-c.js`
|
||||
- `web/app/assets/VForm-uEqKaHHF.js`
|
||||
- `web/app/assets/VRow-DIr3-SqU.css`
|
||||
- `web/app/assets/VRow-qjxp2VJ5.js`
|
||||
- `web/app/assets/VRow-rmSa_q-C.js`
|
||||
- `web/app/assets/VSelect-3h-EI23Y.js`
|
||||
- `web/app/assets/VSelect-BmvHN1-i.css`
|
||||
- `web/app/assets/VSelect-BvR-yyLS.js`
|
||||
- `web/app/assets/VSkeletonLoader-BW_kZu-c.js`
|
||||
- `web/app/assets/VSkeletonLoader-CkAIsbz1.css`
|
||||
- `web/app/assets/VSkeletonLoader-gL4kF19X.js`
|
||||
- `web/app/assets/VSwitch-CIruBPax.js`
|
||||
- `web/app/assets/VSwitch-DPhHiAlh.css`
|
||||
- `web/app/assets/VSwitch-VDVIZTO7.js`
|
||||
- `web/app/assets/VTable-BTftprIQ.js`
|
||||
- `web/app/assets/VTable-Dq_7MYoa.css`
|
||||
- `web/app/assets/VTable-w1sxrmvd.js`
|
||||
- `web/app/assets/VTabs-BX9iYxVa.js`
|
||||
- `web/app/assets/VTabs-Bq6bCiCC.js`
|
||||
- `web/app/assets/VTabs-DjRHpLZ2.css`
|
||||
- `web/app/assets/VTextField-B-BnrJAQ.js`
|
||||
- `web/app/assets/VTextField-Bl91kSVs.css`
|
||||
- `web/app/assets/VTextField-GUQr1tUN.js`
|
||||
- `web/app/assets/VTextarea-BMTWx02W.js`
|
||||
- `web/app/assets/VTextarea-DDl63AeD.css`
|
||||
- `web/app/assets/VTextarea-PzNEhaMZ.js`
|
||||
- `web/app/assets/VTooltip-BbRT1OE8.js`
|
||||
- `web/app/assets/VTooltip-aiKJ1MVA.css`
|
||||
- `web/app/assets/VTooltip-tVMR683k.js`
|
||||
- `web/app/assets/WatchMetricsPage-BjqkPE11.css`
|
||||
- `web/app/assets/WatchMetricsPage-CL8abV00.js`
|
||||
- `web/app/assets/WatchMetricsPage-DByjAcyM.css`
|
||||
- `web/app/assets/WatchMetricsPage-DY4qY84I.js`
|
||||
- `web/app/assets/_plugin-vue_export-helper-BDNMzG2s.js`
|
||||
- `web/app/assets/abap-08VXUWAP.js`
|
||||
- `web/app/assets/apex-BWPQTe0t.js`
|
||||
- `web/app/assets/apiError-BUh3zCmq.js`
|
||||
- `web/app/assets/apiError-CpgZRt4T.js`
|
||||
- `web/app/assets/auditNormalize-xrm2MK_4.js`
|
||||
- `web/app/assets/azcli-Bc_sGQ0U.js`
|
||||
- `web/app/assets/bat-i0X4ZdIN.js`
|
||||
- `web/app/assets/bicep-B5-_aFwp.js`
|
||||
- `web/app/assets/btpanel-BsL25ffd.js`
|
||||
- `web/app/assets/btpanel-C_41A_fE.js`
|
||||
- `web/app/assets/cameligo-DMUM7wLl.js`
|
||||
- `web/app/assets/chunk-DK3Fl9T5.js`
|
||||
- `web/app/assets/clojure-Cm7r79vr.js`
|
||||
- `web/app/assets/codicon-ngg6Pgfi.ttf`
|
||||
- `web/app/assets/coffee-Ba7i2nA0.js`
|
||||
- `web/app/assets/cpp-C7h46wYY.js`
|
||||
- `web/app/assets/csharp-BKxtCVv1.js`
|
||||
- `web/app/assets/csp-bTuwJoIa.js`
|
||||
- `web/app/assets/css-DIMkf-bt.js`
|
||||
- `web/app/assets/css.worker-CvXBzhp8.js`
|
||||
- `web/app/assets/cssMode-CnBxfcpP.js`
|
||||
- `web/app/assets/cssMode-DoYviH0F.js`
|
||||
- `web/app/assets/cypher-CVaqCwHa.js`
|
||||
- `web/app/assets/dart-onAF5SnQ.js`
|
||||
- `web/app/assets/dataTable-esDY4cOk.js`
|
||||
- `web/app/assets/dist-DCycUQQT.js`
|
||||
- `web/app/assets/dist-DMqKEX4A.js`
|
||||
- `web/app/assets/dockerfile-DZFCIeNp.js`
|
||||
- `web/app/assets/ecl-D05T4iGw.js`
|
||||
- `web/app/assets/editor.worker-Cn2oRESe.js`
|
||||
- `web/app/assets/elixir-6RTg0lbw.js`
|
||||
- `web/app/assets/execDetailGrouping-B4lJ15VJ.js`
|
||||
- `web/app/assets/execDetailGrouping-CuMwXaZZ.js`
|
||||
- `web/app/assets/flow9-C5_-GSwl.js`
|
||||
- `web/app/assets/freemarker2-BUYL0LB-.js`
|
||||
- `web/app/assets/freemarker2-D0e9LerR.js`
|
||||
- `web/app/assets/fsharp-C8Ef5oNN.js`
|
||||
- `web/app/assets/go-C-y9NEjX.js`
|
||||
- `web/app/assets/graphql-fmXr3nnJ.js`
|
||||
- `web/app/assets/handlebars-C8vPzJIb.js`
|
||||
- `web/app/assets/handlebars-ncsxj4cu.js`
|
||||
- `web/app/assets/hcl-CpzslTdj.js`
|
||||
- `web/app/assets/html-8-zTuU_5.js`
|
||||
- `web/app/assets/html-DUT2IBNz.js`
|
||||
- `web/app/assets/html.worker-BO6WuOEO.js`
|
||||
- `web/app/assets/htmlMode-Bm_X9rOD.js`
|
||||
- `web/app/assets/htmlMode-C8LJuzCB.js`
|
||||
- `web/app/assets/index-BNJe_ogF.css`
|
||||
- `web/app/assets/index-CDcgx9V8.js`
|
||||
- `web/app/assets/index-a0fi5f-0.js`
|
||||
- `web/app/assets/ini-sBoK_t0W.js`
|
||||
- `web/app/assets/initMonaco-Cjv05FdX.js`
|
||||
- `web/app/assets/initMonaco-DTDMLv7Z.js`
|
||||
- `web/app/assets/initMonaco-DX2BVZF3.css`
|
||||
- `web/app/assets/install-BY4V-NK4.js`
|
||||
- `web/app/assets/install-bdNoH-9Q.js`
|
||||
- `web/app/assets/java-BEtHBSE6.js`
|
||||
- `web/app/assets/javascript-B4NqljlL.js`
|
||||
- `web/app/assets/javascript-wfMVVC84.js`
|
||||
- `web/app/assets/json.worker-BkJRGcCJ.js`
|
||||
- `web/app/assets/jsonMode-B06-mTjs.js`
|
||||
- `web/app/assets/jsonMode-B7uld_NH.js`
|
||||
- `web/app/assets/julia-Bri6UV-V.js`
|
||||
- `web/app/assets/kotlin-BOotOW0E.js`
|
||||
- `web/app/assets/labels-C-A2d08W.js`
|
||||
- `web/app/assets/less-B9JPFI3C.js`
|
||||
- `web/app/assets/lexon-CfSJPG6W.js`
|
||||
- `web/app/assets/liquid-B1dfVIHc.js`
|
||||
- `web/app/assets/liquid-BxkVsnPx.js`
|
||||
- `web/app/assets/lspLanguageFeatures-3WI5pdzZ.js`
|
||||
- `web/app/assets/lspLanguageFeatures-CaMGOy4a.js`
|
||||
- `web/app/assets/lua-CsQS60Ue.js`
|
||||
- `web/app/assets/m3-D-oSqn_W.js`
|
||||
- `web/app/assets/markdown-Cimd5fb3.js`
|
||||
- `web/app/assets/materialdesignicons-webfont-B7mPwVP_.ttf`
|
||||
- `web/app/assets/materialdesignicons-webfont-CSr8KVlo.eot`
|
||||
- `web/app/assets/materialdesignicons-webfont-Dp5v-WZN.woff2`
|
||||
- `web/app/assets/materialdesignicons-webfont-PXm3-2wK.woff`
|
||||
- `web/app/assets/mdx-B6lamGpH.js`
|
||||
- `web/app/assets/mdx-lREt6kXe.js`
|
||||
- `web/app/assets/mips-CIPQ_RoX.js`
|
||||
- `web/app/assets/msdax-DauUninz.js`
|
||||
- `web/app/assets/mysql-SOo6toE5.js`
|
||||
- `web/app/assets/objective-c-FvmIjYaQ.js`
|
||||
- `web/app/assets/paginatedFetch-CijkqaDG.js`
|
||||
- `web/app/assets/paginatedFetch-VYTwXwno.js`
|
||||
- `web/app/assets/pascal-DrH0SRf2.js`
|
||||
- `web/app/assets/pascaligo-D-ptJ9y-.js`
|
||||
- `web/app/assets/perl-oz_6vUea.js`
|
||||
- `web/app/assets/pgsql-DTj74zXo.js`
|
||||
- `web/app/assets/php-nr791fC2.js`
|
||||
- `web/app/assets/pla-CopQ2nXW.js`
|
||||
- `web/app/assets/postiats-43DmfD33.js`
|
||||
- `web/app/assets/powerquery-D3hlyOfw.js`
|
||||
- `web/app/assets/powershell-DmHpPYUd.js`
|
||||
- `web/app/assets/protobuf-C531GsRP.js`
|
||||
- `web/app/assets/pug-Z5eAx3Zn.js`
|
||||
- `web/app/assets/python-Dt0lyPW-.js`
|
||||
- `web/app/assets/python-DwgZPXhL.js`
|
||||
- `web/app/assets/qsharp-DkqhCAOL.js`
|
||||
- `web/app/assets/r-BwWrilGY.js`
|
||||
- `web/app/assets/razor-B1t_g3Ke.js`
|
||||
- `web/app/assets/razor-Dv9uiya3.js`
|
||||
- `web/app/assets/redis-ClamHrr6.js`
|
||||
- `web/app/assets/redshift-DT7zqm-g.js`
|
||||
- `web/app/assets/remotePath-D3rG2Z3e.js`
|
||||
- `web/app/assets/restructuredtext-BYgofb2h.js`
|
||||
- `web/app/assets/roboto-latin-300-normal-BARJ-h6h.woff`
|
||||
- `web/app/assets/roboto-latin-300-normal-CCzlftfr.woff2`
|
||||
- `web/app/assets/roboto-latin-400-normal-BqEyEoaF.woff2`
|
||||
- `web/app/assets/roboto-latin-400-normal-DyYNIH4P.woff`
|
||||
- `web/app/assets/roboto-latin-500-normal-7RbcRiD8.woff2`
|
||||
- `web/app/assets/roboto-latin-500-normal-DQZyH_nt.woff`
|
||||
- `web/app/assets/roboto-latin-700-normal-BZpUvMxY.woff2`
|
||||
- `web/app/assets/roboto-latin-700-normal-DLgJJpmK.woff`
|
||||
- `web/app/assets/ruby-DezsRK8O.js`
|
||||
- `web/app/assets/rust-DdL9SqIa.js`
|
||||
- `web/app/assets/sb-CcwsVR0C.js`
|
||||
- `web/app/assets/scala-DHpiXF5c.js`
|
||||
- `web/app/assets/scheme-BeGwcela.js`
|
||||
- `web/app/assets/scss-gp-XZpBa.js`
|
||||
- `web/app/assets/serverSiteUrl-DDZRgSNA.js`
|
||||
- `web/app/assets/shell-CC2rA5mh.js`
|
||||
- `web/app/assets/solidity-BEEn4gHE.js`
|
||||
- `web/app/assets/sophia-CRfGWb83.js`
|
||||
- `web/app/assets/sparql-D_Lu-MrJ.js`
|
||||
- `web/app/assets/sql-NEE52Syq.js`
|
||||
- `web/app/assets/st-DbInun42.js`
|
||||
- `web/app/assets/status-BrGQYcd-.js`
|
||||
- `web/app/assets/status-XDgjPQrL.js`
|
||||
- `web/app/assets/swift-Bxkupp3x.js`
|
||||
- `web/app/assets/systemverilog-Bz4Y3fRF.js`
|
||||
- `web/app/assets/tcl-DISqw1ZD.js`
|
||||
- `web/app/assets/ts.worker-B6r0Skfj.js`
|
||||
- `web/app/assets/tsMode-9bXRGx5g.js`
|
||||
- `web/app/assets/tsMode-ChdzhlZm.js`
|
||||
- `web/app/assets/twig-De2hgUGE.js`
|
||||
- `web/app/assets/typescript-D3T7er6k.js`
|
||||
- `web/app/assets/typescript-DRN2FRNg.js`
|
||||
- `web/app/assets/typespec-B8J7ngcE.js`
|
||||
- `web/app/assets/useBtPanelLogin-DCNB-U_J.js`
|
||||
- `web/app/assets/useBtPanelLogin-DDcleXPj.js`
|
||||
- `web/app/assets/useBtPanelPageLoad-CD81wbTP.js`
|
||||
- `web/app/assets/useBtPanelPageLoad-CV_unS2-.js`
|
||||
- `web/app/assets/usePageActivateRefresh-BntaOABK.js`
|
||||
- `web/app/assets/usePageActivateRefresh-CqHSpagO.js`
|
||||
- `web/app/assets/usePageAutoRefresh-DW8DyVQQ.js`
|
||||
- `web/app/assets/usePageAutoRefresh-DvG6Fd0_.js`
|
||||
- `web/app/assets/usePushStaging-BCIq1TPK.js`
|
||||
- `web/app/assets/usePushStaging-CfCU7s8k.css`
|
||||
- `web/app/assets/usePushStaging-DcgeHeSX.js`
|
||||
- `web/app/assets/useServerCategories-BcvoZF0H.js`
|
||||
- `web/app/assets/useServerCategories-V7luFEnW.js`
|
||||
- `web/app/assets/useServerList-6fsbQxWS.js`
|
||||
- `web/app/assets/useServerList-w3j3GRMG.js`
|
||||
- `web/app/assets/useServerSearchHistory-BnDuA-7p.js`
|
||||
- `web/app/assets/useServerSearchHistory-C3ha-zP2.css`
|
||||
- `web/app/assets/useServerSearchHistory-CTnIHvTd.js`
|
||||
- `web/app/assets/useSnackbar-u_XK4ZNm.js`
|
||||
- `web/app/assets/useTerminalQuickCommands-CGHoPHjs.js`
|
||||
- `web/app/assets/useTerminalQuickCommands-DKqOac6p.js`
|
||||
- `web/app/assets/useTerminalQuickCommands-DyOcH0CY.css`
|
||||
- `web/app/assets/useWatchPins-DTUw7j9v.js`
|
||||
- `web/app/assets/useWatchPins-DxD91kwD.js`
|
||||
- `web/app/assets/validation-BMzYTJL4.js`
|
||||
- `web/app/assets/vb-DV3o63ZY.js`
|
||||
- `web/app/assets/wgsl-DpFanUEy.js`
|
||||
- `web/app/assets/xml-BFdUA9kH.js`
|
||||
- `web/app/assets/xml-Btmx4yuJ.js`
|
||||
- `web/app/assets/yaml-DKn-1xmA.js`
|
||||
- `web/app/assets/yaml-tUm_O8N4.js`
|
||||
|
||||
## Modified files
|
||||
|
||||
- `.dockerignore`
|
||||
- `Dockerfile`
|
||||
- `Dockerfile.prod`
|
||||
- `deploy/deploy-production.sh`
|
||||
- `deploy/rsync-local-to-server.sh`
|
||||
- `deploy/sync_webapp_to_container.sh`
|
||||
- `docker-compose.yml`
|
||||
- `docs/research/jumpserver-easynode-architecture-analysis.md`
|
||||
- `requirements-dev.txt`
|
||||
- `server/api/assets.py`
|
||||
- `server/api/scripts.py`
|
||||
- `server/api/sync_v2.py`
|
||||
- `server/application/services/btpanel_service.py`
|
||||
- `server/application/services/server_file_transfer_service.py`
|
||||
- `server/infrastructure/btpanel/bootstrap_lock.py`
|
||||
- `server/infrastructure/btpanel/login_url_lock.py`
|
||||
- `server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
- `server/infrastructure/ssh/remote_archive.py`
|
||||
- `server/main.py`
|
||||
- `server/utils/files_chmod_policy.py`
|
||||
- `tests/test_btpanel_get_config.py`
|
||||
- `tests/test_btpanel_login_url.py`
|
||||
- `tests/test_btpanel_login_url_route.py`
|
||||
- `tests/test_btpanel_ssh_bootstrap.py`
|
||||
- `tests/test_file_permissions.py`
|
||||
- `tests/test_server_file_transfer.py`
|
||||
|
||||
## Deleted files
|
||||
|
||||
- `docker/.env.example`
|
||||
- `docker/.env.prod.example`
|
||||
- `docker/profiles/1c4g.env`
|
||||
- `docker/profiles/2c8g.env`
|
||||
- `docker/profiles/4c16g.env`
|
||||
- `docs/Nexus-功能说明书.html`
|
||||
- `frontend/.env.development`
|
||||
- `scripts/npm-proxy.env`
|
||||
- `web/app/dist/assets/AlertsPage-ji5eXKTc.js`
|
||||
- `web/app/dist/assets/AuditPage-C3fmqt6f.js`
|
||||
- `web/app/dist/assets/CommandsPage-C6QrgHcR.js`
|
||||
- `web/app/dist/assets/CredentialsPage-oLbFLgd2.js`
|
||||
- `web/app/dist/assets/DashboardPage-CKfPpNOT.js`
|
||||
- `web/app/dist/assets/FilesPage-BvG082ru.css`
|
||||
- `web/app/dist/assets/FilesPage-DNKIBjNs.js`
|
||||
- `web/app/dist/assets/LoginPage-D8ZqP1P_.js`
|
||||
- `web/app/dist/assets/MonacoEditor-Sfe2OjtA.js`
|
||||
- `web/app/dist/assets/PushPage-BDdmIVXZ.js`
|
||||
- `web/app/dist/assets/PushPage-ewjA8E7l.css`
|
||||
- `web/app/dist/assets/RetriesPage-BJbJspGS.js`
|
||||
- `web/app/dist/assets/SchedulesPage-D6oD8ext.js`
|
||||
- `web/app/dist/assets/ScriptsPage-CbZT-hk0.js`
|
||||
- `web/app/dist/assets/ServersPage-B4elP3Z1.js`
|
||||
- `web/app/dist/assets/ServersPage-DjRHpLZ2.css`
|
||||
- `web/app/dist/assets/SettingsPage-BuPIwZWo.js`
|
||||
- `web/app/dist/assets/TerminalPage-BGKczTgd.js`
|
||||
- `web/app/dist/assets/TerminalPage-Ol9WjDlo.css`
|
||||
- `web/app/dist/assets/VAlert-B33BooF0.css`
|
||||
- `web/app/dist/assets/VAlert-DGGVwUFF.js`
|
||||
- `web/app/dist/assets/VDataTable-0Xurhrxv.js`
|
||||
- `web/app/dist/assets/VDataTable-DlpDfCoY.css`
|
||||
- `web/app/dist/assets/VDataTableServer-FvIQviSN.js`
|
||||
- `web/app/dist/assets/VDialog-BLibPcoM.js`
|
||||
- `web/app/dist/assets/VDialog-DP-kc9Gx.css`
|
||||
- `web/app/dist/assets/VFileInput-C6sFcwsM.js`
|
||||
- `web/app/dist/assets/VFileInput-HYy7i9zh.css`
|
||||
- `web/app/dist/assets/VRow-DIr3-SqU.css`
|
||||
- `web/app/dist/assets/VRow-r8nkWmtD.js`
|
||||
- `web/app/dist/assets/VSelect-ALpjlDrA.css`
|
||||
- `web/app/dist/assets/VSelect-Bz5bHvpa.js`
|
||||
- `web/app/dist/assets/VSelectionControl-BTVr3HQm.css`
|
||||
- `web/app/dist/assets/VSelectionControl-C1Y9bNOF.js`
|
||||
- `web/app/dist/assets/VSpacer-DWZdSXUK.js`
|
||||
- `web/app/dist/assets/VSpacer-DfbUir7X.css`
|
||||
- `web/app/dist/assets/VSwitch-DPhHiAlh.css`
|
||||
- `web/app/dist/assets/VSwitch-DY1GlILd.js`
|
||||
- `web/app/dist/assets/VTextarea-3TieuoAv.js`
|
||||
- `web/app/dist/assets/VTextarea-DDl63AeD.css`
|
||||
- `web/app/dist/assets/abap-08VXUWAP.js`
|
||||
- `web/app/dist/assets/apex-BWPQTe0t.js`
|
||||
- `web/app/dist/assets/azcli-Bc_sGQ0U.js`
|
||||
- `web/app/dist/assets/bat-i0X4ZdIN.js`
|
||||
- `web/app/dist/assets/bicep-B5-_aFwp.js`
|
||||
- `web/app/dist/assets/cameligo-DMUM7wLl.js`
|
||||
- `web/app/dist/assets/clojure-Cm7r79vr.js`
|
||||
- `web/app/dist/assets/codicon-ngg6Pgfi.ttf`
|
||||
- `web/app/dist/assets/coffee-Ba7i2nA0.js`
|
||||
- `web/app/dist/assets/cpp-C7h46wYY.js`
|
||||
- `web/app/dist/assets/csharp-BKxtCVv1.js`
|
||||
- `web/app/dist/assets/csp-bTuwJoIa.js`
|
||||
- `web/app/dist/assets/css-DIMkf-bt.js`
|
||||
- `web/app/dist/assets/css.worker-CvXBzhp8.js`
|
||||
- `web/app/dist/assets/cssMode-DMvENJ_w.js`
|
||||
- `web/app/dist/assets/cypher-CVaqCwHa.js`
|
||||
- `web/app/dist/assets/dart-onAF5SnQ.js`
|
||||
- `web/app/dist/assets/dockerfile-DZFCIeNp.js`
|
||||
- `web/app/dist/assets/ecl-D05T4iGw.js`
|
||||
- `web/app/dist/assets/editor-DX2BVZF3.css`
|
||||
- `web/app/dist/assets/editor.api2-MWf-eAi-.js`
|
||||
- `web/app/dist/assets/elixir-6RTg0lbw.js`
|
||||
- `web/app/dist/assets/flow9-C5_-GSwl.js`
|
||||
- `web/app/dist/assets/freemarker2-DQGAilFk.js`
|
||||
- `web/app/dist/assets/fsharp-C8Ef5oNN.js`
|
||||
- `web/app/dist/assets/go-C-y9NEjX.js`
|
||||
- `web/app/dist/assets/graphql-fmXr3nnJ.js`
|
||||
- `web/app/dist/assets/handlebars-DCagTjhi.js`
|
||||
- `web/app/dist/assets/hcl-CpzslTdj.js`
|
||||
- `web/app/dist/assets/html-nrfydv4h.js`
|
||||
- `web/app/dist/assets/html.worker-BO6WuOEO.js`
|
||||
- `web/app/dist/assets/htmlMode-Bp4WNwyQ.js`
|
||||
- `web/app/dist/assets/index-DOFNruam.js`
|
||||
- `web/app/dist/assets/index-YClpuO23.css`
|
||||
- `web/app/dist/assets/ini-sBoK_t0W.js`
|
||||
- `web/app/dist/assets/java-BEtHBSE6.js`
|
||||
- `web/app/dist/assets/javascript-B0RcszDa.js`
|
||||
- `web/app/dist/assets/json.worker-BkJRGcCJ.js`
|
||||
- `web/app/dist/assets/jsonMode-D0vdA3eU.js`
|
||||
- `web/app/dist/assets/julia-Bri6UV-V.js`
|
||||
- `web/app/dist/assets/kotlin-BOotOW0E.js`
|
||||
- `web/app/dist/assets/less-B9JPFI3C.js`
|
||||
- `web/app/dist/assets/lexon-CfSJPG6W.js`
|
||||
- `web/app/dist/assets/liquid-DAtIwle-.js`
|
||||
- `web/app/dist/assets/lspLanguageFeatures-DRDm87pn.js`
|
||||
- `web/app/dist/assets/lua-CsQS60Ue.js`
|
||||
- `web/app/dist/assets/m3-D-oSqn_W.js`
|
||||
- `web/app/dist/assets/markdown-Cimd5fb3.js`
|
||||
- `web/app/dist/assets/materialdesignicons-webfont-B7mPwVP_.ttf`
|
||||
- `web/app/dist/assets/materialdesignicons-webfont-CSr8KVlo.eot`
|
||||
- `web/app/dist/assets/materialdesignicons-webfont-Dp5v-WZN.woff2`
|
||||
- `web/app/dist/assets/materialdesignicons-webfont-PXm3-2wK.woff`
|
||||
- `web/app/dist/assets/mdx-BvtNR28y.js`
|
||||
- `web/app/dist/assets/mips-CIPQ_RoX.js`
|
||||
- `web/app/dist/assets/monaco.contribution-fyH2rvpO.js`
|
||||
- `web/app/dist/assets/msdax-DauUninz.js`
|
||||
- `web/app/dist/assets/mysql-SOo6toE5.js`
|
||||
- `web/app/dist/assets/objective-c-FvmIjYaQ.js`
|
||||
- `web/app/dist/assets/pascal-DrH0SRf2.js`
|
||||
- `web/app/dist/assets/pascaligo-D-ptJ9y-.js`
|
||||
- `web/app/dist/assets/perl-oz_6vUea.js`
|
||||
- `web/app/dist/assets/pgsql-DTj74zXo.js`
|
||||
- `web/app/dist/assets/php-nr791fC2.js`
|
||||
- `web/app/dist/assets/pla-CopQ2nXW.js`
|
||||
- `web/app/dist/assets/postiats-43DmfD33.js`
|
||||
- `web/app/dist/assets/powerquery-D3hlyOfw.js`
|
||||
- `web/app/dist/assets/powershell-DmHpPYUd.js`
|
||||
- `web/app/dist/assets/protobuf-C531GsRP.js`
|
||||
- `web/app/dist/assets/pug-Z5eAx3Zn.js`
|
||||
- `web/app/dist/assets/python-Y2lQRCrb.js`
|
||||
- `web/app/dist/assets/qsharp-DkqhCAOL.js`
|
||||
- `web/app/dist/assets/r-BwWrilGY.js`
|
||||
- `web/app/dist/assets/razor-DHI-mrmN.js`
|
||||
- `web/app/dist/assets/redis-ClamHrr6.js`
|
||||
- `web/app/dist/assets/redshift-DT7zqm-g.js`
|
||||
- `web/app/dist/assets/restructuredtext-BYgofb2h.js`
|
||||
- `web/app/dist/assets/roboto-cyrillic-100-italic-CNP2SmvR.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-100-italic-GfU4zM_J.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-100-normal-D_oR061d.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-100-normal-w5umKD67.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-300-italic-Bbg0zipm.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-300-italic-BfviqnaP.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-300-normal-DEFNdjk5.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-300-normal-DzUz0kzv.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-400-italic-BSQCxleC.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-400-italic-CqC_ywG3.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-400-normal-Bjg-1-sg.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-400-normal-CBPI_iaY.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-500-italic-CFOZTHyM.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-500-italic-UnqpRRY_.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-500-normal-CBKMylY4.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-500-normal-CLao9AfR.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-700-italic-DhNJyfCT.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-700-italic-K45OuYTL.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-700-normal-C2o7G-SM.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-700-normal-DhZFXDSN.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-900-italic-CW7hKEUp.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-900-italic-Dw8LBt_T.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-900-normal-B-XH5ueX.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-900-normal-BVOxCBIE.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-100-italic-CHVV4rI0.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-100-italic-Drj7gMwC.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-100-normal-mbO7vZh1.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-100-normal-uxSc4Dbo.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-300-italic-D2iEI_X7.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-300-italic-OnrzXwVD.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-300-normal-D7ank4TF.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-300-normal-DIxttMbC.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-400-italic-4ESj9BbU.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-400-italic-MZ-G6OiW.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-400-normal-CaK1767H.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-400-normal-qHufge6k.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-500-italic-C-yqETei.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-500-italic-ExZ7-vA1.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-500-normal-BWC_xYeb.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-500-normal-DqF2hftb.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-700-italic-BPGsVrTY.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-700-italic-DEF-7i1Y.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-700-normal-CI7FH63F.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-700-normal-DmFxo5wj.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-900-italic-CSUk7NP9.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-900-italic-acKlpJv6.woff2`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-900-normal-Dy18Zgm9.woff`
|
||||
- `web/app/dist/assets/roboto-cyrillic-ext-900-normal-IZ2B0aiV.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-100-italic-BByoHCxw.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-100-italic-Cy3jdfDA.woff`
|
||||
- `web/app/dist/assets/roboto-greek-100-normal-DgpMWfbq.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-100-normal-ZuTz319d.woff`
|
||||
- `web/app/dist/assets/roboto-greek-300-italic-BlmQgaZh.woff`
|
||||
- `web/app/dist/assets/roboto-greek-300-italic-CznjWsFz.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-300-normal-C_Dgaih9.woff`
|
||||
- `web/app/dist/assets/roboto-greek-300-normal-DJEM9B4Z.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-400-italic-BUWCAFe1.woff`
|
||||
- `web/app/dist/assets/roboto-greek-400-italic-DnTUMkdF.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-400-normal-Bb5mj_fZ.woff`
|
||||
- `web/app/dist/assets/roboto-greek-400-normal-ai2Z1K3C.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-500-italic-Dqz20l7v.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-500-italic-xdwGU0k_.woff`
|
||||
- `web/app/dist/assets/roboto-greek-500-normal-C9AnhcmC.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-500-normal-oCqhoyfc.woff`
|
||||
- `web/app/dist/assets/roboto-greek-700-italic-DawR0hnC.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-700-italic-P6YHZuSy.woff`
|
||||
- `web/app/dist/assets/roboto-greek-700-normal-0aHWxGLu.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-700-normal-DjRqqLBV.woff`
|
||||
- `web/app/dist/assets/roboto-greek-900-italic-B7xCHAj9.woff`
|
||||
- `web/app/dist/assets/roboto-greek-900-italic-DvS3zuic.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-900-normal-B5AAzeOC.woff2`
|
||||
- `web/app/dist/assets/roboto-greek-900-normal-DWdVoZCP.woff`
|
||||
- `web/app/dist/assets/roboto-latin-100-italic-CMH2tK0H.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-100-italic-DZWoXrp_.woff`
|
||||
- `web/app/dist/assets/roboto-latin-100-normal-CGMktwvD.woff`
|
||||
- `web/app/dist/assets/roboto-latin-100-normal-vTzS_GaG.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-300-italic-B5i8yzYq.woff`
|
||||
- `web/app/dist/assets/roboto-latin-300-italic-zCpkrxSM.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-300-normal-BARJ-h6h.woff`
|
||||
- `web/app/dist/assets/roboto-latin-300-normal-CCzlftfr.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-400-italic-C2a9rKC1.woff`
|
||||
- `web/app/dist/assets/roboto-latin-400-italic-CSuqwwKr.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-400-normal-BqEyEoaF.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-400-normal-DyYNIH4P.woff`
|
||||
- `web/app/dist/assets/roboto-latin-500-italic-Bzx6Emny.woff`
|
||||
- `web/app/dist/assets/roboto-latin-500-italic-DOe3GFcv.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-500-normal-7RbcRiD8.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-500-normal-DQZyH_nt.woff`
|
||||
- `web/app/dist/assets/roboto-latin-700-italic-CC4lh_E9.woff`
|
||||
- `web/app/dist/assets/roboto-latin-700-italic-Cb9agdGy.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-700-normal-BZpUvMxY.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-700-normal-DLgJJpmK.woff`
|
||||
- `web/app/dist/assets/roboto-latin-900-italic-BENCS7Df.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-900-italic-DNjw4RGV.woff`
|
||||
- `web/app/dist/assets/roboto-latin-900-normal-F72S18P8.woff`
|
||||
- `web/app/dist/assets/roboto-latin-900-normal-lk0O8k6m.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-100-italic-BzoOrAFP.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-100-italic-CprbSwJf.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-100-normal-Bue4UH9m.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-100-normal-CRE1JcN2.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-300-italic-BaJRnD9g.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-300-italic-Bavh33sq.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-300-normal-B90pq-BC.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-300-normal-CTCCHkZF.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-400-italic-BilqUbDw.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-400-italic-g8iNtijM.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-400-normal-C3tdtHj3.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-400-normal-scX0fKtV.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-500-italic-B5teBpxj.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-500-italic-BlZHPPdA.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-500-normal-Cyc0AKLz.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-500-normal-pMCM9Ixg.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-700-italic-C8tIie4u.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-700-italic-CBdFfgzf.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-700-normal-BUhwtWwy.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-700-normal-DSBUz0N1.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-900-italic-CFogYjYt.woff`
|
||||
- `web/app/dist/assets/roboto-latin-ext-900-italic-CgK4zYaI.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-900-normal-Bg1HnWxG.woff2`
|
||||
- `web/app/dist/assets/roboto-latin-ext-900-normal-CUx1IrMY.woff`
|
||||
- `web/app/dist/assets/roboto-math-100-italic-B4vNMY8j.woff`
|
||||
- `web/app/dist/assets/roboto-math-100-italic-C4gy5Bp3.woff2`
|
||||
- `web/app/dist/assets/roboto-math-100-normal-3u4f34A3.woff2`
|
||||
- `web/app/dist/assets/roboto-math-100-normal-DzbsQ8e_.woff`
|
||||
- `web/app/dist/assets/roboto-math-300-italic-CIRUIJB7.woff`
|
||||
- `web/app/dist/assets/roboto-math-300-italic-XxAa5nOs.woff2`
|
||||
- `web/app/dist/assets/roboto-math-300-normal-5dF_7mZP.woff2`
|
||||
- `web/app/dist/assets/roboto-math-300-normal-Ds0YpBw2.woff`
|
||||
- `web/app/dist/assets/roboto-math-400-italic-BpybG2ZH.woff2`
|
||||
- `web/app/dist/assets/roboto-math-400-italic-CXOsqNh0.woff`
|
||||
- `web/app/dist/assets/roboto-math-400-normal-BEFej5gc.woff2`
|
||||
- `web/app/dist/assets/roboto-math-400-normal-C9RxBKAh.woff`
|
||||
- `web/app/dist/assets/roboto-math-500-italic-BaDHGWdF.woff2`
|
||||
- `web/app/dist/assets/roboto-math-500-italic-Dr-Gj3Mh.woff`
|
||||
- `web/app/dist/assets/roboto-math-500-normal-C-7mKPO3.woff`
|
||||
- `web/app/dist/assets/roboto-math-500-normal-C4NU9gLX.woff2`
|
||||
- `web/app/dist/assets/roboto-math-700-italic-B5uBDPR4.woff`
|
||||
- `web/app/dist/assets/roboto-math-700-italic-BTlAqkAP.woff2`
|
||||
- `web/app/dist/assets/roboto-math-700-normal-B8YqGHVc.woff2`
|
||||
- `web/app/dist/assets/roboto-math-700-normal-DVoD5t2k.woff`
|
||||
- `web/app/dist/assets/roboto-math-900-italic-B-PPazk1.woff`
|
||||
- `web/app/dist/assets/roboto-math-900-italic-D-7BUet6.woff2`
|
||||
- `web/app/dist/assets/roboto-math-900-normal-DQ66ivDi.woff2`
|
||||
- `web/app/dist/assets/roboto-math-900-normal-Dmeiz_CW.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-100-italic-DSe_C1Iy.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-100-italic-DkwGdnY5.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-100-normal-CjKjWFkd.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-100-normal-CqmTeVyX.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-300-italic-BfpS6Q35.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-300-italic-Dm46KJRd.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-300-normal-BCnjhQd_.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-300-normal-DDU7avhj.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-400-italic-CQIwDYNA.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-400-italic-DJOHuWBY.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-400-normal-CB1Ce4Gk.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-400-normal-DLYbZahX.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-500-italic-BiGHMB5Q.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-500-italic-Dz3aAlfh.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-500-normal-B_CZKVJS.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-500-normal-F7c8nfcH.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-700-italic-Bj79QYOr.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-700-italic-Dm-8FOP3.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-700-normal-BiFDindJ.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-700-normal-BoS6HWkc.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-900-italic-BZDs0BY5.woff`
|
||||
- `web/app/dist/assets/roboto-symbols-900-italic-QOKtSfbw.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-900-normal-1vlkxR2C.woff2`
|
||||
- `web/app/dist/assets/roboto-symbols-900-normal-9XmQV1ku.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-100-italic-BnSYtt9K.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-100-italic-Hu6kAu-e.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-100-normal-Cc5a3-TP.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-100-normal-KgOkQYnu.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-300-italic-B9qvi8_k.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-300-italic-CtUKlc4H.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-300-normal-BPvXm_f1.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-300-normal-INUupD3o.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-400-italic-C41J4i52.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-400-italic-RF0eew8q.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-400-normal-D2PTxGxD.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-400-normal-DnpnVwnf.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-500-italic-BddoBFd0.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-500-italic-CmEfQ1B1.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-500-normal-B3ncpOoB.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-500-normal-D380IkQ8.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-700-italic-By4b4cXv.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-700-italic-CVc74C74.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-700-normal-BEVeWqJt.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-700-normal-DsFyXAL4.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-900-italic-D0nMCc5h.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-900-italic-hVMOC7we.woff2`
|
||||
- `web/app/dist/assets/roboto-vietnamese-900-normal-C48YQOjq.woff`
|
||||
- `web/app/dist/assets/roboto-vietnamese-900-normal-D-H2ldSl.woff2`
|
||||
- `web/app/dist/assets/ruby-DezsRK8O.js`
|
||||
- `web/app/dist/assets/rust-DdL9SqIa.js`
|
||||
- `web/app/dist/assets/sb-CcwsVR0C.js`
|
||||
- `web/app/dist/assets/scala-DHpiXF5c.js`
|
||||
- `web/app/dist/assets/scheme-BeGwcela.js`
|
||||
- `web/app/dist/assets/scss-gp-XZpBa.js`
|
||||
- `web/app/dist/assets/shell-CC2rA5mh.js`
|
||||
- `web/app/dist/assets/solidity-BEEn4gHE.js`
|
||||
- `web/app/dist/assets/sophia-CRfGWb83.js`
|
||||
- `web/app/dist/assets/sparql-D_Lu-MrJ.js`
|
||||
- `web/app/dist/assets/sql-NEE52Syq.js`
|
||||
- `web/app/dist/assets/st-DbInun42.js`
|
||||
- `web/app/dist/assets/status-CNSle5LJ.js`
|
||||
- `web/app/dist/assets/swift-Bxkupp3x.js`
|
||||
- `web/app/dist/assets/systemverilog-Bz4Y3fRF.js`
|
||||
- `web/app/dist/assets/tcl-DISqw1ZD.js`
|
||||
- `web/app/dist/assets/ts.worker-B6r0Skfj.js`
|
||||
- `web/app/dist/assets/tsMode-B1_NfjHa.js`
|
||||
- `web/app/dist/assets/twig-De2hgUGE.js`
|
||||
- `web/app/dist/assets/typescript-B9Bb_0iF.js`
|
||||
- `web/app/dist/assets/typespec-B8J7ngcE.js`
|
||||
- `web/app/dist/assets/useServerList-CokRfazm.js`
|
||||
- `web/app/dist/assets/useSnackbar-D7YOfKok.js`
|
||||
- `web/app/dist/assets/validation-Yxuom3Du.js`
|
||||
- `web/app/dist/assets/vb-DV3o63ZY.js`
|
||||
- `web/app/dist/assets/wgsl-DpFanUEy.js`
|
||||
- `web/app/dist/assets/workers-DLQCZ--h.js`
|
||||
- `web/app/dist/assets/xml-BsJ5i10T.js`
|
||||
- `web/app/dist/assets/yaml-DT_Rfd72.js`
|
||||
- `web/app/dist/favicon.ico`
|
||||
- `web/app/dist/index.html`
|
||||
@@ -0,0 +1,148 @@
|
||||
# Nexus Release Index — 2026-07-08
|
||||
|
||||
## Status
|
||||
|
||||
```text
|
||||
local_artifact_ready=true
|
||||
online_deployed=false
|
||||
remote_ssh_blocked_by_codex_approval=true
|
||||
```
|
||||
|
||||
Codex has not modified the production server in this phase. Remote SSH/network checks were blocked by the approval auto-review endpoint returning HTTP 404.
|
||||
|
||||
## Artifact
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256:
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
Standard checksum file:
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz.sha256
|
||||
```
|
||||
|
||||
Metadata:
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.metadata.json
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-artifact-metadata-20260708.md
|
||||
```
|
||||
|
||||
Current artifact facts:
|
||||
|
||||
```text
|
||||
size_mb=27.02
|
||||
entries=2409
|
||||
files=2409
|
||||
```
|
||||
|
||||
## Main documents
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-ready-checklist-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-diff-manifest-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-manual-deploy-commands-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-app-v2-双后台实施说明-20260707.md
|
||||
```
|
||||
|
||||
## One-command local preparation
|
||||
|
||||
Run from the source snapshot:
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\prepare_release_artifact.py --old-snapshot C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236 --output-dir C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs --name nexus-release-20260708
|
||||
```
|
||||
|
||||
Verified result:
|
||||
|
||||
```text
|
||||
[prepare-release-artifact] OK
|
||||
added=381 modified=26 deleted=347
|
||||
60 passed in 1.70s
|
||||
OK: release bundle looks clean
|
||||
Validate-only mode: tarball checksum and content validation passed
|
||||
```
|
||||
|
||||
## Server-side apply command
|
||||
|
||||
Upload:
|
||||
|
||||
```cmd
|
||||
scp C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz nexus:/tmp/nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
If the new apply script is not yet on the server, extract it first:
|
||||
|
||||
```bash
|
||||
cd /tmp
|
||||
tar xzf nexus-release-20260708.tar.gz nexus-release/deploy/apply-release-bundle.sh
|
||||
```
|
||||
|
||||
Validate only:
|
||||
|
||||
```bash
|
||||
bash /tmp/nexus-release/deploy/apply-release-bundle.sh --validate-only \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
Apply:
|
||||
|
||||
```bash
|
||||
sudo bash /tmp/nexus-release/deploy/apply-release-bundle.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
## Online verification after deploy
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\verify_online_release.py --base-url https://api.synaglobal.vip
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
```text
|
||||
OK: health
|
||||
OK: /app
|
||||
OK: /app-v2
|
||||
OK: online release verification passed
|
||||
```
|
||||
|
||||
## BtPanel verification
|
||||
|
||||
After deploy:
|
||||
|
||||
1. Existing `/app/` works.
|
||||
2. New `/app-v2/` works.
|
||||
3. BtPanel one-click login works.
|
||||
4. Same server duplicate one-click login is serialized; conflict returns HTTP 409.
|
||||
5. Newly added BtPanel servers get hardcoded_3600 detection/repair before one-click login.
|
||||
6. Multiple BtPanel sessions remain logged in after 2 hours and refresh.
|
||||
|
||||
|
||||
|
||||
## Server preflight command
|
||||
|
||||
Before applying the release on the production host, run:
|
||||
|
||||
```bash
|
||||
bash /tmp/nexus-release/deploy/preflight-release-host.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
This checks required commands, checksum, release tar paths, deploy path, runtime hints, disk space, and current local endpoints before applying changes.
|
||||
|
||||
- `Nexus-release-text-integrity-gate-20260708.md`：本轮新增文本完整性 Gate、文档控制字符修复和最新制品 SHA 记录。
|
||||
- `Nexus-release-python-publisher-20260708.md`：Python 版发布辅助脚本说明，避免 PowerShell 管道/引号/编码问题。
|
||||
- `Nexus-release-publisher-tests-20260708.md`：发布辅助脚本离线测试覆盖与 diff manifest 排除 tmp 修复记录。
|
||||
@@ -0,0 +1,55 @@
|
||||
# Nexus 发布辅助脚本测试覆盖记录（2026-07-08）
|
||||
|
||||
## 本轮目的
|
||||
|
||||
继续降低线上发布风险：为 `scripts/publish_release_bundle.py` 增加离线单元测试，并修复 diff manifest 对测试临时文件的误收录。
|
||||
|
||||
## 新增测试
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
work\nexus_code_context\snapshots\nexus-source-20260707-112042\tests\test_publish_release_bundle.py
|
||||
```
|
||||
|
||||
覆盖 5 个场景：
|
||||
|
||||
1. 默认模式：上传 + preflight，不执行 apply；
|
||||
2. 显式 `--apply`：preflight 后才执行 `apply-release-bundle.sh`；
|
||||
3. `--no-upload --dry-run`：只生成远端 SSH 命令，不触发 scp；
|
||||
4. SHA256 mismatch：在任何远端命令前失败；
|
||||
5. 远端路径：始终使用 POSIX `/tmp/...`，避免 Windows `\tmp\...`。
|
||||
|
||||
## Gate 更新
|
||||
|
||||
`run_local_release_gate.py --with-pytest` 现在会执行：
|
||||
|
||||
- 宝塔专项测试：60 个；
|
||||
- 发布辅助脚本测试：5 个。
|
||||
|
||||
合计：65 个 Python 测试。
|
||||
|
||||
## Manifest 修复
|
||||
|
||||
`scripts/generate_release_diff.py` 新增排除 `tmp` 目录，避免测试临时 tarball 进入 diff manifest。
|
||||
|
||||
已确认：
|
||||
|
||||
- release bundle 不包含 `tmp/pytest-publish-release`；
|
||||
- diff manifest 不包含 `tmp/pytest-publish-release`；
|
||||
- package scan 通过；
|
||||
- validate-only 通过。
|
||||
|
||||
## 最新发布包
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
entries：`2409`
|
||||
@@ -0,0 +1,81 @@
|
||||
# Nexus Python 发布辅助脚本（2026-07-08）
|
||||
|
||||
## 目的
|
||||
|
||||
为避免 Windows PowerShell 管道、编码和引号问题，新增 Python 发布辅助脚本：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042\scripts\publish_release_bundle.py
|
||||
```
|
||||
|
||||
它使用 `subprocess` 参数列表调用 `scp` / `ssh`，不依赖本地 shell 管道；默认只上传发布包并执行服务器侧 preflight，不会直接发布。
|
||||
|
||||
## 最新发布包
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
## 推荐使用方式
|
||||
|
||||
### 1. 只上传并执行 preflight（默认安全模式）
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
### 2. 如果不使用 SSH config
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote root@你的线上服务器IP ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b ^
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
### 3. preflight 确认无误后执行 apply
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b ^
|
||||
--apply
|
||||
```
|
||||
|
||||
## 行为说明
|
||||
|
||||
脚本会：
|
||||
|
||||
1. 本地校验 tarball SHA256；
|
||||
2. 使用 `scp` 上传到 `/tmp/nexus-release-20260708.tar.gz`；
|
||||
3. 在远端从发布包解出：
|
||||
- `deploy/preflight-release-host.sh`
|
||||
- `deploy/apply-release-bundle.sh`
|
||||
4. 执行 preflight；
|
||||
5. 只有传入 `--apply` 时才执行正式 apply。
|
||||
|
||||
## 已验证
|
||||
|
||||
- `--help` 正常；
|
||||
- `--dry-run --no-upload` 正常；
|
||||
- Windows 下远端路径保持 POSIX `/tmp/...`，不会被转换成 `\tmp\...`；
|
||||
- 已纳入 `scripts/run_local_release_gate.py` 的 `py_compile`。
|
||||
|
||||
## 本轮新增测试
|
||||
|
||||
- `tests/test_publish_release_bundle.py`：5 个离线测试，覆盖默认 preflight、显式 apply、SHA mismatch、no-upload dry-run、远端 POSIX 路径。
|
||||
- 已纳入 `scripts/run_local_release_gate.py --with-pytest`。
|
||||
@@ -0,0 +1,495 @@
|
||||
# Nexus 发布前清单（2026-07-08）
|
||||
|
||||
## 结论
|
||||
|
||||
当前本地快照已经通过完整发布前 Gate：
|
||||
|
||||
```text
|
||||
py_compile + /app-v2 build:safe + app-v2 sensitive scan + 宝塔 pytest
|
||||
```
|
||||
|
||||
最终结果：
|
||||
|
||||
```text
|
||||
[release-gate] OK
|
||||
60 passed in 5.33s
|
||||
```
|
||||
|
||||
## 当前源码快照
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
```
|
||||
|
||||
对比基准快照：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236
|
||||
```
|
||||
|
||||
完整差异清单：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-diff-manifest-20260708.md
|
||||
```
|
||||
|
||||
## 差异清单汇总
|
||||
|
||||
重新生成后的清单已经排除：
|
||||
|
||||
- `.git`
|
||||
- `node_modules`
|
||||
- `.venv-*`
|
||||
- `venv`
|
||||
- `__pycache__`
|
||||
- `.ruff_cache`
|
||||
- `.playwright-mcp`
|
||||
- `.cursor`
|
||||
- `.pytest_cache`
|
||||
- `*.pyc`
|
||||
- `*.pyo`
|
||||
- `*.bak-`
|
||||
- `2025.2`
|
||||
- `=2025.2`
|
||||
- `tmp/nexus-frontend.tar.gz`
|
||||
|
||||
当前差异统计：
|
||||
|
||||
```text
|
||||
added=381
|
||||
modified=26
|
||||
deleted=347
|
||||
```
|
||||
|
||||
注意：差异里包含大量旧 `/app/` 静态构建产物变动。如果只发布本轮宝塔稳定性与 `/app-v2`，可以优先发布“核心发布集合”，不要盲目同步整个快照目录。
|
||||
|
||||
## 核心发布集合
|
||||
|
||||
### 后端宝塔一键登录稳定性
|
||||
|
||||
```text
|
||||
server/application/services/btpanel_service.py
|
||||
server/infrastructure/btpanel/bootstrap_lock.py
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
server/main.py
|
||||
```
|
||||
|
||||
### API / 服务相关历史改动
|
||||
|
||||
差异清单中还有以下后端文件发生变化，发布前需要按实际范围确认是否一起发布：
|
||||
|
||||
```text
|
||||
server/api/assets.py
|
||||
server/api/scripts.py
|
||||
server/api/sync_v2.py
|
||||
server/application/services/server_file_transfer_service.py
|
||||
server/infrastructure/ssh/remote_archive.py
|
||||
server/utils/files_chmod_policy.py
|
||||
```
|
||||
|
||||
这些文件属于此前安全巡检/文件传输/脚本执行相关改动，不是本轮宝塔一键登录最小集合；如果线上已经发布过，可跳过或只按 diff 覆盖。
|
||||
|
||||
### `/app-v2` 双后台
|
||||
|
||||
源码：
|
||||
|
||||
```text
|
||||
frontend-v2/
|
||||
```
|
||||
|
||||
构建产物：
|
||||
|
||||
```text
|
||||
web/app-v2/
|
||||
```
|
||||
|
||||
后端静态挂载：
|
||||
|
||||
```text
|
||||
server/main.py
|
||||
```
|
||||
|
||||
Docker：
|
||||
|
||||
```text
|
||||
Dockerfile
|
||||
Dockerfile.prod
|
||||
```
|
||||
|
||||
### 测试与发布脚本
|
||||
|
||||
```text
|
||||
requirements-dev.txt
|
||||
scripts/check_backend_test_env.py
|
||||
scripts/generate_release_diff.py
|
||||
scripts/run_btpanel_tests.py
|
||||
scripts/run_btpanel_tests_docker.cmd
|
||||
scripts/run_btpanel_tests_docker.sh
|
||||
scripts/run_local_release_gate.py
|
||||
scripts/scan_release_manifest.py
|
||||
```
|
||||
|
||||
### 测试文件
|
||||
|
||||
```text
|
||||
tests/test_btpanel_bootstrap_lock.py
|
||||
tests/test_btpanel_get_config.py
|
||||
tests/test_btpanel_login_url.py
|
||||
tests/test_btpanel_login_url_route.py
|
||||
tests/test_btpanel_ssh_bootstrap.py
|
||||
```
|
||||
|
||||
## 发布前验证命令
|
||||
|
||||
### 1. 重新生成差异清单
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\generate_release_diff.py --old C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236 --new C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042 --output C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-diff-manifest-20260708.md
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
added=369 modified=21 deleted=347
|
||||
```
|
||||
|
||||
### 2. 扫描发布候选文件是否包含已知环境泄露标记
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\scan_release_manifest.py --root C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042 --manifest C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-diff-manifest-20260708.md
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
OK: no known environment leak markers found in release manifest entries
|
||||
```
|
||||
|
||||
### 3. 完整发布前 Gate
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\run_local_release_gate.py --with-pytest
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
[app-v2-sensitive-scan] OK: scanned 9 file(s), no high-confidence secrets found
|
||||
collected 60 items
|
||||
60 passed in 1.79s
|
||||
[release-gate] OK
|
||||
```
|
||||
|
||||
最新 Gate 追加确认：
|
||||
|
||||
```text
|
||||
bash -n deploy/sync_webapp_to_container.sh
|
||||
60 passed in 1.70s
|
||||
[release-gate] OK
|
||||
```
|
||||
|
||||
### 4. 生成干净发布包
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\generate_release_bundle.py --root C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042 --output C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
files=2409
|
||||
```
|
||||
|
||||
发布包位置：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
发布包元数据：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.metadata.json
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-artifact-metadata-20260708.md
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
### 5. 扫描发布包
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\scan_release_bundle.py C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
size_mb=27.02
|
||||
entries=2409
|
||||
OK: release bundle looks clean
|
||||
```
|
||||
|
||||
### 6. 部署排除规则自检
|
||||
|
||||
`scripts/run_local_release_gate.py` 现在会自动执行：
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\check_deploy_excludes.py
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
OK: deploy exclusion patterns are present
|
||||
```
|
||||
|
||||
### 7. 发布后线上验证脚本
|
||||
|
||||
新增：
|
||||
|
||||
```text
|
||||
scripts/verify_online_release.py
|
||||
```
|
||||
|
||||
用途：
|
||||
|
||||
- 检查 `/health`
|
||||
- 检查旧后台 `/app/`
|
||||
- 检查新后台 `/app-v2/`
|
||||
- 检查页面里不要出现 `全局 API Key`、`Global API Key`、`tmp_login`、`tmp_token`
|
||||
|
||||
发布后执行：
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\verify_online_release.py --base-url https://api.synaglobal.vip
|
||||
```
|
||||
|
||||
## 明确不发布
|
||||
|
||||
以下内容不要同步到正式服务器：
|
||||
|
||||
```text
|
||||
.venv-py312-codex/
|
||||
.venv-py314/
|
||||
venv/
|
||||
frontend-v2/node_modules/
|
||||
.pytest_cache/
|
||||
__pycache__/
|
||||
.ruff_cache/
|
||||
.cursor/
|
||||
.playwright-mcp/
|
||||
frontend-v2/node_modules/
|
||||
*.pyc
|
||||
*.pyo
|
||||
*.bak-
|
||||
2025.2
|
||||
=2025.2
|
||||
tmp/nexus-frontend.tar.gz
|
||||
```
|
||||
|
||||
其中 `2025.2` / `=2025.2` 是 Windows CMD 执行 `tzdata>=2025.2` 时可能产生的重定向误文件，绝对不要发布。
|
||||
|
||||
## 建议发布顺序
|
||||
|
||||
### 方案 A：Docker 镜像重建发布（推荐）
|
||||
|
||||
1. 使用当前快照作为构建上下文，但确保 `.dockerignore` 排除虚拟环境、node_modules、缓存和临时文件。
|
||||
2. 构建生产镜像。
|
||||
3. 启动新容器前备份旧容器镜像/tag 和数据库。
|
||||
4. 发布后执行线上验证。
|
||||
|
||||
优点：静态资源、后端代码、依赖环境一致性更好。
|
||||
|
||||
当前已修复：
|
||||
|
||||
- `.dockerignore` 已排除 `frontend-v2/node_modules`、`.venv-*`、`.pytest_cache`、`2025.2`、`*.bak-` 等。
|
||||
- `deploy/rsync-local-to-server.sh` 已排除 `frontend-v2/node_modules`、`.venv-*`、`.pytest_cache`、`2025.2`、`*.bak-` 等。
|
||||
- `scripts/run_local_release_gate.py` 已增加 `bash -n` 检查 `deploy/deploy-production.sh` 与 `deploy/rsync-local-to-server.sh`。
|
||||
- `deploy/deploy-production.sh` 发布后健康检查已增加 `/app-v2/`。
|
||||
- `deploy/deploy-production.sh` 已显式构建并上传 `web/app-v2`，不只依赖 Dockerfile 构建。
|
||||
- `deploy/apply-release-bundle.sh` 已新增，可在服务器侧对 tar.gz 发布包执行 SHA256 校验、备份、解包、重建和本机验证。
|
||||
- `deploy/sync_webapp_to_container.sh` 已同步 `web/app-v2` 到容器，并校验 `/app-v2/` 主 bundle。
|
||||
- `scripts/run_local_release_gate.py` 已增加 `bash -n deploy/sync_webapp_to_container.sh`。
|
||||
- `scripts/check_deploy_excludes.py` 会防止发布排除规则未来被误删。
|
||||
|
||||
### 当前远程执行状态
|
||||
|
||||
本轮尝试对线上 `Host nexus` 做只读 SSH 探测时，Codex 审批系统返回 404 并拒绝执行。不是 SSH 凭据或代码错误，而是自动审批代理不可用。
|
||||
|
||||
因此本轮没有实际修改线上服务器。当前状态是：
|
||||
|
||||
```text
|
||||
本地发布包：已生成
|
||||
发布包扫描：通过
|
||||
完整 release gate：通过
|
||||
线上部署：尚未执行
|
||||
```
|
||||
|
||||
如果要由 Codex 继续实际发布，需要在下一步明确允许 SSH 发布操作。
|
||||
|
||||
## 手动发布命令清单
|
||||
|
||||
已生成：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-manual-deploy-commands-20260708.md
|
||||
```
|
||||
|
||||
该文档包含：
|
||||
|
||||
- `deploy/deploy-production.sh` 一键发布方式。
|
||||
- tar.gz 发布包上传方式。
|
||||
- 线上 SHA256 校验。
|
||||
- 线上备份、解包、Docker 重建。
|
||||
- 发布后 `/health`、`/app/`、`/app-v2/` 验证。
|
||||
- 宝塔专项验证。
|
||||
- 回滚命令。
|
||||
|
||||
## 最新最终验证
|
||||
|
||||
发布包扫描：
|
||||
|
||||
```text
|
||||
size_mb=27.02
|
||||
entries=2409
|
||||
OK: release bundle looks clean
|
||||
```
|
||||
|
||||
完整 Gate：
|
||||
|
||||
```text
|
||||
60 passed in 1.70s
|
||||
[release-gate] OK
|
||||
```
|
||||
|
||||
### 方案 B：只同步核心文件到现有线上目录
|
||||
|
||||
适合快速热修：
|
||||
|
||||
1. 同步后端核心文件。
|
||||
2. 同步 `web/app-v2/`。
|
||||
3. 重启后端服务。
|
||||
4. 验证宝塔一键登录和 `/app-v2/`。
|
||||
|
||||
缺点：如果线上依赖、静态目录或 Dockerfile 状态与本地不一致，容易遗漏。
|
||||
|
||||
## 线上验证清单
|
||||
|
||||
发布到：
|
||||
|
||||
```text
|
||||
https://api.synaglobal.vip
|
||||
```
|
||||
|
||||
后验证：
|
||||
|
||||
1. `/app/` 旧后台仍可访问。
|
||||
2. `/app-v2/` 新后台可访问。
|
||||
3. `/api/btpanel/servers/{id}/login-url` 正常返回登录地址。
|
||||
4. 同一台宝塔短时间重复点一键登录，应该只允许一个签发流程，冲突时返回 HTTP 409。
|
||||
5. 新增宝塔或配置缺失宝塔，在一键登录前会触发 session cleanup TTL 兜底检测/修复。
|
||||
6. 多台宝塔同时打开，2 小时后刷新不应因为 `task.py hardcoded_3600` 陆续掉线。
|
||||
7. 线上页面不显示全局 API Key 明文。
|
||||
|
||||
## 回滚点
|
||||
|
||||
发布前建议备份：
|
||||
|
||||
```text
|
||||
server/application/services/btpanel_service.py
|
||||
server/infrastructure/btpanel/bootstrap_lock.py
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
server/main.py
|
||||
web/app-v2/
|
||||
Dockerfile
|
||||
Dockerfile.prod
|
||||
```
|
||||
|
||||
如果发布后宝塔一键登录异常：
|
||||
|
||||
1. 先回滚上述后端文件。
|
||||
2. 重启后端服务。
|
||||
3. 保留 `/app-v2/` 不影响旧 `/app/`，必要时可以只移除 `web/app-v2/` 静态目录或取消 `server/main.py` 挂载。
|
||||
|
||||
|
||||
## 2026-07-08 validate-only verification
|
||||
|
||||
The server-side release applier now supports validate-only mode.
|
||||
|
||||
Command verified locally with Git Bash:
|
||||
|
||||
```bash
|
||||
bash deploy/apply-release-bundle.sh --validate-only --tarball /c/Users/uzuma/Documents/Codex/2026-07-06/yuu/outputs/nexus-release-20260708.tar.gz --sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
`
|
||||
|
||||
Result:
|
||||
|
||||
` ext
|
||||
SHA256 OK: 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
Extracted release tree validation OK
|
||||
Validate-only mode: tarball checksum and content validation passed
|
||||
`
|
||||
|
||||
Network/SSH production execution is still not performed because Codex approval auto-review returned HTTP 404 for read-only checks.
|
||||
|
||||
|
||||
## 2026-07-08 one-command local artifact preparation
|
||||
|
||||
A single local command now prepares and verifies the release artifact end-to-end:
|
||||
|
||||
`cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\prepare_release_artifact.py --old-snapshot C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236 --output-dir C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs --name nexus-release-20260708
|
||||
`
|
||||
|
||||
Verified result:
|
||||
|
||||
` ext
|
||||
[prepare-release-artifact] OK
|
||||
added=381 modified=26 deleted=347
|
||||
files=2409
|
||||
entries=2409
|
||||
size_mb=27.02
|
||||
sha256=46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
60 passed in 1.70s
|
||||
`
|
||||
|
||||
|
||||
## 2026-07-08 release index and checksum file
|
||||
|
||||
Release index:
|
||||
|
||||
` ext
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-index-20260708.md
|
||||
`
|
||||
|
||||
Standard SHA256 checksum file:
|
||||
|
||||
` ext
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz.sha256
|
||||
`
|
||||
|
||||
The checksum file contains:
|
||||
|
||||
` ext
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b nexus-release-20260708.tar.gz
|
||||
`
|
||||
|
||||
|
||||
## Server preflight command
|
||||
|
||||
Before applying the release on the production host, run:
|
||||
|
||||
```bash
|
||||
bash /tmp/nexus-release/deploy/preflight-release-host.sh \
|
||||
--tarball /tmp/nexus-release-20260708.tar.gz \
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b \
|
||||
--deploy-path /opt/nexus
|
||||
```
|
||||
|
||||
This checks required commands, checksum, release tar paths, deploy path, runtime hints, disk space, and current local endpoints before applying changes.
|
||||
@@ -0,0 +1,52 @@
|
||||
# Nexus 发布文本完整性 Gate 增量记录（2026-07-08）
|
||||
|
||||
## 背景
|
||||
|
||||
本轮在发布文档中发现隐藏控制字符 `0x08`，会把 Markdown 代码块显示成异常的 `bash` fence。该问题容易由 Windows PowerShell/终端编码或临时脚本拼接引入，肉眼不容易发现。
|
||||
|
||||
## 已修复
|
||||
|
||||
1. 新增源码检查脚本：
|
||||
- `scripts/check_text_integrity.py`
|
||||
2. 接入本地发布 Gate：
|
||||
- `scripts/run_local_release_gate.py`
|
||||
3. 清理文档隐藏字符：
|
||||
- `outputs/*.md` 中的 `0x08` 已清除。
|
||||
- `docs/research/jumpserver-easynode-architecture-analysis.md` 中真实 ANSI ESC 已替换为可读的 `\u001b`。
|
||||
4. 重新生成发布包：
|
||||
- `nexus-release-20260708.tar.gz`
|
||||
- SHA256: `46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b`
|
||||
- entries: `2407`
|
||||
|
||||
## Gate 覆盖
|
||||
|
||||
`check_text_integrity.py` 会检查：
|
||||
|
||||
- UTF-8 解码异常；
|
||||
- 隐藏控制字符，允许 `\n`、`\r`、`\t`；
|
||||
- 典型坏 fence：真实 backspace 混入 bash 代码块；
|
||||
- 自动跳过旧后台构建产物和 vendor 目录，避免误报 xterm/Monaco 的合法控制码表。
|
||||
|
||||
## 验证结果
|
||||
|
||||
- 文本完整性检查：`OK: scanned 1751 text file(s)`
|
||||
- `/app-v2` build:safe：通过
|
||||
- app-v2 sensitive scan：通过
|
||||
- 宝塔专项 pytest：`60 passed`
|
||||
- 发布包扫描：通过
|
||||
- 发布包 validate-only：通过
|
||||
- metadata / `.sha256` / 实际 tar SHA：一致
|
||||
|
||||
## 当前最新发布包
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
## 线上状态
|
||||
|
||||
截至本记录生成时，线上 `https://api.synaglobal.vip` 尚未由 Codex 完成发布验证；原因仍是本机 Codex 审批代理 `codex-auto-review` 不可用导致联网/SSH 操作被拒绝。
|
||||
@@ -0,0 +1,174 @@
|
||||
# Nexus 代码上下文库与局域网 Git 基线报告
|
||||
|
||||
生成时间：2026-07-07 07:18（Asia/Shanghai）
|
||||
|
||||
## 1. 当前结论
|
||||
|
||||
已经完成两件事：
|
||||
|
||||
1. 在局域网 Linux 测试机 `/opt/nexus-dev-current` 初始化了本地 Git 仓库。
|
||||
2. 在本地 Codex 工作区生成了 Nexus JSONL 代码上下文库和第一版安全审查入口报告。
|
||||
|
||||
没有使用 SQLite。
|
||||
|
||||
## 2. 局域网 Linux Git 状态
|
||||
|
||||
测试机：`192.168.124.219`
|
||||
|
||||
Nexus 目录：
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-current -> /opt/nexus-dev-20260707-054832
|
||||
```
|
||||
|
||||
Git 仓库实际位置：
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-20260707-054832/.git
|
||||
```
|
||||
|
||||
基线提交：
|
||||
|
||||
```text
|
||||
9d42fcd chore: baseline Nexus LAN test deployment snapshot
|
||||
```
|
||||
|
||||
当前分支：
|
||||
|
||||
```text
|
||||
audit/security-review
|
||||
```
|
||||
|
||||
当前状态：
|
||||
|
||||
```text
|
||||
clean
|
||||
```
|
||||
|
||||
## 3. Git 防误提交保护
|
||||
|
||||
已配置 `.git/info/exclude` 本地排除规则，防止真实运行 secrets 和本地凭据误入库。
|
||||
|
||||
已排除重点包括：
|
||||
|
||||
```text
|
||||
.env
|
||||
.env.*
|
||||
docker/.env
|
||||
docker/.env.*
|
||||
*.pem
|
||||
*.key
|
||||
*.p12
|
||||
*.pfx
|
||||
*resolved*
|
||||
*凭据*
|
||||
机器与凭据.md
|
||||
ssh-config.resolved.txt
|
||||
nexus-1panel.secrets.resolved.sh
|
||||
nexus-1panel.secrets.sh
|
||||
SECRETS.md
|
||||
.git-askpass-nexus.sh
|
||||
scripts/npm-proxy.env
|
||||
*.bak
|
||||
*.bak-*
|
||||
node_modules/
|
||||
.venv/
|
||||
venv/
|
||||
__pycache__/
|
||||
.pytest_cache/
|
||||
```
|
||||
|
||||
提交前已检查高危敏感文件名，没有发现 `.env`、pem/key、resolved secrets 等被跟踪。
|
||||
|
||||
## 4. 本地代码上下文库
|
||||
|
||||
本地源代码快照：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-070236
|
||||
```
|
||||
|
||||
本地上下文库：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context
|
||||
```
|
||||
|
||||
输出副本：
|
||||
|
||||
```text
|
||||
outputs/nexus-code-context-20260707
|
||||
```
|
||||
|
||||
## 5. 索引统计
|
||||
|
||||
| 项 | 数量 |
|
||||
|---|---:|
|
||||
| files | 2577 |
|
||||
| text_files | 2103 |
|
||||
| symbols | 2823 |
|
||||
| api_routes | 214 |
|
||||
| service_methods | 319 |
|
||||
| call_edges | 16594 |
|
||||
| db_queries | 433 |
|
||||
| redis_keys | 725 |
|
||||
| ssh_commands | 343 |
|
||||
| btpanel_flows | 172 |
|
||||
| frontend_routes | 31 |
|
||||
| secret_refs | 4425 |
|
||||
| grep_hits | 8533 |
|
||||
| chunks | 1312 |
|
||||
|
||||
## 6. 已生成的核心报告
|
||||
|
||||
```text
|
||||
reports/00-overview.md
|
||||
reports/01-api-routes.md
|
||||
reports/02-service-methods.md
|
||||
reports/03-btpanel-login-chain.md
|
||||
reports/04-ssh-risk-map.md
|
||||
reports/05-redis-lock-map.md
|
||||
reports/06-db-query-map.md
|
||||
reports/07-security-review-entrypoints.md
|
||||
```
|
||||
|
||||
## 7. 已生成的 JSONL 索引
|
||||
|
||||
```text
|
||||
index/files.jsonl
|
||||
index/symbols.jsonl
|
||||
index/api_routes.jsonl
|
||||
index/service_methods.jsonl
|
||||
index/call_edges.jsonl
|
||||
index/db_queries.jsonl
|
||||
index/redis_keys.jsonl
|
||||
index/ssh_commands.jsonl
|
||||
index/btpanel_flows.jsonl
|
||||
index/frontend_routes.jsonl
|
||||
index/secrets_inventory.jsonl
|
||||
```
|
||||
|
||||
## 8. 后续建议
|
||||
|
||||
下一步建议按这个顺序开始真正安全审查：
|
||||
|
||||
1. 先审 `03-btpanel-login-chain.md`，确认宝塔一键登录链路和长期掉线边界。
|
||||
2. 再审 `04-ssh-risk-map.md`，确认 SSH/远程命令拼接、quote、timeout、日志脱敏。
|
||||
3. 再审 `01-api-routes.md` 和 `07-security-review-entrypoints.md`，确认敏感 API 是否都有鉴权。
|
||||
4. 最后按 `05-redis-lock-map.md` 和 `06-db-query-map.md` 审 Redis 锁/TTL 和 DB 查询。
|
||||
|
||||
后续所有代码修改建议在测试机分支执行：
|
||||
|
||||
```bash
|
||||
git status
|
||||
git diff
|
||||
git add <files>
|
||||
git commit -m "fix: ..."
|
||||
```
|
||||
|
||||
修复后继续跑：
|
||||
|
||||
```bash
|
||||
python -m pytest -q
|
||||
```
|
||||
|
||||
@@ -0,0 +1,131 @@
|
||||
# Nexus 发布验证与线上代码对比报告（2026-07-09）
|
||||
|
||||
## 1. 本次发布包
|
||||
|
||||
- 发布分支：`release/20260708-axs`
|
||||
- 发布包：`C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260709-gitea-allowlist.tar.gz`
|
||||
- SHA256：以最终 `Get-FileHash` 与 `publish_release_bundle.py --sha256` 校验输出为准（本文档纳入发布包后，发布包哈希会随文档内容变化）。`n- 线上中心机：`20.24.218.235:/opt/nexus`
|
||||
- 发布方式：`publish_release_bundle.py` 上传/预检，`apply-release-bundle.sh` 远端 rsync 覆盖并执行 `deploy/nexus-1panel.sh upgrade --skip-git`
|
||||
|
||||
## 2. 本次修复点
|
||||
|
||||
### 2.1 恢复 Docker 资源档位文件
|
||||
|
||||
线上升级默认使用 `NEXUS_PROFILE=2c8g`，会读取：
|
||||
|
||||
```text
|
||||
docker/profiles/2c8g.env
|
||||
```
|
||||
|
||||
发布前分支中的 `docker/profiles/` 为空，导致升级阶段报：
|
||||
|
||||
```text
|
||||
grep: /opt/nexus/docker/profiles/2c8g.env: No such file or directory
|
||||
```
|
||||
|
||||
已恢复：
|
||||
|
||||
```text
|
||||
docker/profiles/1c4g.env
|
||||
docker/profiles/2c8g.env
|
||||
docker/profiles/4c16g.env
|
||||
```
|
||||
|
||||
### 2.2 增加 profile 缺失兜底
|
||||
|
||||
`deploy/nexus-1panel.sh` 的 `apply_pool_to_env_prod()` 已增加文件存在性判断：
|
||||
|
||||
- profile 文件存在：按档位写入数据库连接池配置；
|
||||
- profile 文件缺失：不再中断发布，保留 `docker/.env.prod` 中现有连接池配置并打印警告。
|
||||
|
||||
### 2.3 发布包扫描规则
|
||||
|
||||
发布包生成与扫描脚本已排除/拦截本地测试虚拟环境：
|
||||
|
||||
```text
|
||||
.venv-codex-test
|
||||
.venv-*
|
||||
```
|
||||
|
||||
避免本地测试环境污染发布包。
|
||||
|
||||
### 2.4 Windows OpenSSH 远端命令 quoting
|
||||
|
||||
`publish_release_bundle.py` 已修复 Windows OpenSSH 执行远端 `bash -lc` 时的引号问题，避免 `&&`、空格、shell 元字符被错误解释。
|
||||
|
||||
## 3. 发布验证结果
|
||||
|
||||
发布后线上检查结果：
|
||||
|
||||
```text
|
||||
容器：nexus-prod-nexus-1 Up (healthy)
|
||||
网络：1panel-network,nexus-prod_nexus-internal
|
||||
/health -> ok
|
||||
/app/ -> 200
|
||||
/app-v2/ -> 200
|
||||
/api/settings/gitea-allowlist -> 401 Missing Authorization header
|
||||
```
|
||||
|
||||
说明：
|
||||
|
||||
- `401 Missing Authorization header` 是正常结果，表示 Gitea 白名单接口已上线且受认证保护；
|
||||
- 容器已接入 `1panel-network`，可以访问 1Panel MySQL/Redis；
|
||||
- `/app/` 与 `/app-v2/` 均可访问。
|
||||
|
||||
## 4. 线上代码对比方式
|
||||
|
||||
采用 manifest 快速对比，而不是整目录下载：
|
||||
|
||||
1. 本地保留主分支、发布分支、working 副本；
|
||||
2. 线上只生成 `/opt/nexus` 文件 SHA256 manifest；
|
||||
3. 把 manifest 拉回本地；
|
||||
4. 本地对比 manifest。
|
||||
|
||||
这种方式比反复下载线上全量代码更快，也更容易排除运行时文件干扰。
|
||||
|
||||
## 5. 本次线上 vs 本地 working 对比
|
||||
|
||||
报告文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_compare\reports\compare-online-after-final-vs-working-20260709.md
|
||||
```
|
||||
|
||||
摘要：
|
||||
|
||||
```text
|
||||
相同文件：2446
|
||||
右侧新增：19
|
||||
右侧缺少/左侧删除：2
|
||||
内容不同：0
|
||||
读取错误：0
|
||||
```
|
||||
|
||||
结论：
|
||||
|
||||
- 核心代码内容差异为 `0`；
|
||||
- 右侧新增 19 个主要是本地开发残留，例如 `.cursor/`、`.bak-`、测试结果文件；
|
||||
- 右侧缺少 2 个是线上运行时文件，例如 `docker/.host-profile`、`var/layer3-health/fail_count`；
|
||||
- 不影响本次 Gitea 白名单、app-v2、全局 API Key 隐藏、宝塔登录相关修复上线判断。
|
||||
|
||||
## 6. 本次测试
|
||||
|
||||
本地相关测试：
|
||||
|
||||
```text
|
||||
pytest tests/test_gitea_allowlist_service.py tests/test_btpanel_login_url.py -q
|
||||
24 passed
|
||||
```
|
||||
|
||||
## 7. 建议后续固定流程
|
||||
|
||||
以后每次发布按这个顺序：
|
||||
|
||||
1. 本地生成发布包；
|
||||
2. 扫描发布包，阻止 `.venv-*`、密钥、临时文件进入；
|
||||
3. 上传到中心机并执行 preflight；
|
||||
4. apply 发布包；
|
||||
5. 验证 `/health`、`/app/`、`/app-v2/`、关键 API；
|
||||
6. 拉线上 manifest；
|
||||
7. 与本地 working/release 分支 manifest 对比；
|
||||
8. 确认 `changed: 0` 后再认为发布完成。
|
||||
@@ -0,0 +1,368 @@
|
||||
# Nexus 安全巡检阶段 4：Settings/Auth 与宝塔长期会话边界审查
|
||||
|
||||
时间：2026-07-07
|
||||
对象：测试机 `/opt/nexus-dev-current`，分支 `audit/security-review`
|
||||
最新提交：`524acd5 fix-stop-exposing-global-api-key-in-settings`
|
||||
|
||||
> 本报告不输出任何密码、API Key、Token、Cookie、PEM 内容。
|
||||
|
||||
---
|
||||
|
||||
## 1. 本轮确认结果
|
||||
|
||||
### 1.1 全局 API Key 不显示：已完成代码层修复
|
||||
|
||||
只读检查结果：
|
||||
|
||||
- 后端 `/api/settings/api-key/reveal` 已删除。
|
||||
- 前端 SettingsPage 中全局 API Key 显示/复制逻辑已删除。
|
||||
- 源码残留仅有：
|
||||
- `server/api/servers.py` 两处注释仍提到旧名字 `reveal_api_key`。
|
||||
- `frontend/src/utils/auditLabels.ts` 仍有旧审计 label `reveal_api_key: 查看 API 密钥`。
|
||||
|
||||
安全判断：
|
||||
|
||||
- 残留注释/label 不会造成 API Key 暴露。
|
||||
- 建议后续做一次小清理，避免误导维护者和审计日志翻译。
|
||||
|
||||
### 1.2 当前代码没有全局 API 限速
|
||||
|
||||
沿用上一份报告结论：
|
||||
|
||||
- 没有 slowapi / fastapi-limiter / nginx limit_req 一类全局限速。
|
||||
- 429 主要来自：
|
||||
- 管理员登录失败锁定：5 次 / 15 分钟。
|
||||
- Agent 脚本回调：job 10 次 / 60 秒，IP 60 次 / 60 秒。
|
||||
- 大多数“速度限制”是远程任务并发保护，不是 HTTP API 限速。
|
||||
|
||||
---
|
||||
|
||||
## 2. 宝塔 2 小时后刷新掉线：当前代码仍有一个关键边界
|
||||
|
||||
### 2.1 当前一键登录链路
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant UI as Nexus 前端
|
||||
participant API as /api/btpanel/servers/{id}/login-url
|
||||
participant SVC as BtPanelService.create_login_url
|
||||
participant Redis as Redis login_url_lock
|
||||
participant SSH as ssh_bootstrap_panel
|
||||
participant BT as 宝塔面板
|
||||
|
||||
UI->>API: 请求一键登录 URL
|
||||
API->>SVC: create_login_url(server_id)
|
||||
SVC->>Redis: 获取每台服务器分布式锁
|
||||
SVC->>SSH: best-effort 检查/patch 宝塔 task.py session cleanup
|
||||
SVC->>BT: config?action=set_temp_login(expire_time=now+86400)
|
||||
BT-->>SVC: 返回 tmp_token 或登录 URL
|
||||
SVC-->>UI: /login?tmp_token=...
|
||||
```
|
||||
|
||||
### 2.2 已修复的问题
|
||||
|
||||
当前代码已经解决：
|
||||
|
||||
1. `tmp_token` 使用 86400 秒 TTL，而不是宝塔默认较短 TTL。
|
||||
2. 登录 URL 不缓存，因为 `tmp_token` 是一次性链接。
|
||||
3. 对同一台服务器生成登录 URL 时使用 Redis 锁，避免并发覆盖。
|
||||
4. 登录前会 best-effort patch 宝塔 `/www/server/panel/task.py`：把硬编码 `if f_time > 3600:` 改成读取 `public.get_session_timeout() or 86400`。
|
||||
|
||||
### 2.3 仍可能导致“2 小时后刷新掉线”的关键点
|
||||
|
||||
当前 patch 的语义是：
|
||||
|
||||
```python
|
||||
session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
if f_time > session_cleanup_timeout:
|
||||
删除 session 文件
|
||||
```
|
||||
|
||||
这意味着：
|
||||
|
||||
- 如果宝塔面板里已经配置了 session timeout，例如 7200 秒（2 小时），patch 会尊重这个值。
|
||||
- `or 86400` 只在没有配置值时生效。
|
||||
- 所以用户遇到“打开 10 个宝塔，2 小时后陆续刷新掉线”，仍可能是目标宝塔的 `session_timeout` 本身就是 7200 秒。
|
||||
|
||||
结论：
|
||||
|
||||
> 现在的修复主要解决 `task.py` 硬编码 3600 秒清理问题，但不一定强制把宝塔会话生命周期提升到 24 小时。如果目标面板配置仍是 2 小时，会继续 2 小时后掉线。
|
||||
|
||||
### 2.4 并发打开 10 个宝塔的边界
|
||||
|
||||
当前 Redis 锁可以保证同一台服务器不会同时生成多个互相覆盖的 `tmp_token`。但用户说的是“同时打开 10 个不同宝塔”，这属于不同 server_id：
|
||||
|
||||
- 每台服务器独立锁，不互相等待。
|
||||
- 各自的 session 生命周期取决于各自宝塔面板配置和 task.py patch 状态。
|
||||
- 10 台里有的先掉、有的后掉，符合“每台服务器 session_timeout/task.py/定时清理状态不一致”的表现。
|
||||
|
||||
---
|
||||
|
||||
## 3. Settings/Auth 发现的问题与建议
|
||||
|
||||
### 3.1 中风险：Telegram Token reveal 不需要二次认证
|
||||
|
||||
位置：
|
||||
|
||||
- `server/api/settings.py` `/telegram/reveal-token`
|
||||
- `server/api/settings.py` `/telegram/offline/reveal-token`
|
||||
|
||||
现状：
|
||||
|
||||
- 需要 JWT。
|
||||
- 会写审计日志。
|
||||
- 但不像密码预设 reveal、SSH Key reveal 那样要求当前密码二次认证。
|
||||
|
||||
风险：
|
||||
|
||||
- 如果管理员 access token 被盗，在 token 有效期内可直接读取 Telegram Bot Token。
|
||||
- 虽然这是管理员功能，但与同文件中“密码预设/SSH 私钥 reveal 需要二次认证”的策略不一致。
|
||||
|
||||
建议：
|
||||
|
||||
- 若继续允许显示 Telegram Token，建议改成 `current_password` 二次认证。
|
||||
- 如果你倾向于“全局 API Key 一样不显示”，也可以直接删除 Telegram Token reveal，只允许覆盖写入。
|
||||
|
||||
### 3.2 中风险：TOTP setup/enable 不要求当前密码
|
||||
|
||||
位置：
|
||||
|
||||
- `server/api/auth.py` `/totp/setup`
|
||||
- `server/api/auth.py` `/totp/enable`
|
||||
|
||||
现状：
|
||||
|
||||
- 需要 JWT。
|
||||
- 只允许对自己操作。
|
||||
- enable 前会校验 TOTP code。
|
||||
- 但不要求当前密码。
|
||||
|
||||
风险：
|
||||
|
||||
- 如果 access token 被盗，攻击者可以生成自己的 TOTP secret 并启用，造成账号被锁或持久化控制风险。
|
||||
|
||||
建议：
|
||||
|
||||
- setup 或 enable 至少其中一步要求当前密码。
|
||||
- 更严格方案：setup、enable、disable、password change 都统一走“敏感操作二次认证”。
|
||||
|
||||
### 3.3 低风险：全局 API Key 相关审计 label/注释残留
|
||||
|
||||
位置：
|
||||
|
||||
- `server/api/servers.py` 注释里仍有 `same pattern as reveal_api_key`。
|
||||
- `frontend/src/utils/auditLabels.ts` 仍有 `reveal_api_key: 查看 API 密钥`。
|
||||
|
||||
风险：
|
||||
|
||||
- 不暴露 secret。
|
||||
- 但会误导后续开发，以为还有 reveal_api_key 功能。
|
||||
|
||||
建议：
|
||||
|
||||
- 后续清理为通用描述，例如 `same pattern as sensitive operation re-auth`。
|
||||
- 删除前端旧 label 或保留但标注 legacy。
|
||||
|
||||
### 3.4 低风险：refresh 接口仍接受 body refresh_token fallback
|
||||
|
||||
位置：
|
||||
|
||||
- `server/api/auth.py` `/api/auth/refresh`
|
||||
|
||||
现状：
|
||||
|
||||
- 优先读取 HttpOnly cookie。
|
||||
- 没有 cookie 时允许从 body 读取 refresh_token。
|
||||
|
||||
风险：
|
||||
|
||||
- 当前注释解释为兼容 fallback。
|
||||
- 如果没有明确的历史客户端需要，body fallback 增加了一条 token 传输路径。
|
||||
|
||||
建议：
|
||||
|
||||
- 保守：保留但加审计/废弃期。
|
||||
- 严格：只允许 HttpOnly cookie refresh。
|
||||
|
||||
---
|
||||
|
||||
## 4. 下一步修改方向：至少 6 个方案供选择
|
||||
|
||||
> 按你的要求，涉及安全策略/代码改动前先给多个选项，不直接替你定。
|
||||
|
||||
### 方案 A：只修宝塔长期会话，强制把宝塔 session timeout 提升到 24 小时
|
||||
|
||||
改动：
|
||||
|
||||
- 在 `ssh_bootstrap.py` 里增加写入/修正宝塔 session timeout 配置的逻辑。
|
||||
- 登录前 best-effort 确保目标面板的 session timeout >= 86400。
|
||||
- 保留现有 task.py patch。
|
||||
|
||||
好处：
|
||||
|
||||
- 最直接解决“2 小时后刷新掉线”。
|
||||
- 不影响 Nexus 自身安全策略。
|
||||
|
||||
风险：
|
||||
|
||||
- 会修改宝塔面板自身配置。
|
||||
- 如果用户希望宝塔短会话，这会改变预期。
|
||||
|
||||
是否需要重启/部署：
|
||||
|
||||
- 需要重建/重启 Nexus 后端容器。
|
||||
- 对目标宝塔可能需要 reload bt。
|
||||
|
||||
推荐度：高，针对当前痛点最直接。
|
||||
|
||||
### 方案 B：宝塔 session timeout 只做检测和告警，不自动修改
|
||||
|
||||
改动：
|
||||
|
||||
- Nexus 登录前 SSH 检测宝塔当前 session timeout。
|
||||
- 如果低于 86400，在 UI 或接口响应中返回 warning。
|
||||
- 不自动改宝塔。
|
||||
|
||||
好处：
|
||||
|
||||
- 风险低，不擅自改目标面板。
|
||||
- 可解释每台为什么 2 小时掉。
|
||||
|
||||
风险：
|
||||
|
||||
- 不自动解决问题，仍需要人工确认/点击修复。
|
||||
|
||||
推荐度：中。
|
||||
|
||||
### 方案 C：给宝塔登录 URL 接口增加“会话保活/会话诊断”返回字段
|
||||
|
||||
改动：
|
||||
|
||||
- `/api/btpanel/servers/{id}/login-url` 返回：
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_patched`
|
||||
- `session_timeout_seconds`
|
||||
- `warnings`
|
||||
- 前端一键登录时提示“当前宝塔会话约 2 小时后失效”。
|
||||
|
||||
好处：
|
||||
|
||||
- 用户能看到问题原因。
|
||||
- 便于排查 10 台里哪台会掉。
|
||||
|
||||
风险：
|
||||
|
||||
- 需要补前端显示。
|
||||
- 只诊断，不一定修复。
|
||||
|
||||
推荐度：中高，适合和 A/B 搭配。
|
||||
|
||||
### 方案 D：敏感 Token 全部不显示，只允许覆盖写入
|
||||
|
||||
改动：
|
||||
|
||||
- 删除 Telegram Token reveal。
|
||||
- 保留 token 是否已设置状态。
|
||||
- 修改前端：显示“已设置，留空不改”，不提供查看/复制。
|
||||
|
||||
好处：
|
||||
|
||||
- 和“全局 API Key 不显示”策略一致。
|
||||
- 降低 access token 被盗后的进一步泄露面。
|
||||
|
||||
风险：
|
||||
|
||||
- 管理员无法从 Nexus 找回 Telegram Token，只能重填。
|
||||
|
||||
推荐度：中高，安全更干净。
|
||||
|
||||
### 方案 E：保留 Telegram/密码/SSH reveal，但统一要求二次认证
|
||||
|
||||
改动：
|
||||
|
||||
- Telegram reveal 请求体增加 `current_password`。
|
||||
- 前端弹窗输入当前密码。
|
||||
- 可以同时把 reveal 审计统一标准化。
|
||||
|
||||
好处：
|
||||
|
||||
- 兼顾可用性和安全。
|
||||
- 与密码预设、SSH Key reveal 保持一致。
|
||||
|
||||
风险：
|
||||
|
||||
- 使用上多一步。
|
||||
|
||||
推荐度：高，如果你还想保留“查看 Telegram Token”。
|
||||
|
||||
### 方案 F：统一敏感操作二次认证框架
|
||||
|
||||
改动范围更大：
|
||||
|
||||
- TOTP setup/enable/disable。
|
||||
- 修改密码。
|
||||
- reveal 密码预设/SSH Key/Telegram Token。
|
||||
- 宝塔 API Key 修改/显示类操作。
|
||||
- 服务器凭据 reveal/更新。
|
||||
|
||||
好处：
|
||||
|
||||
- 安全策略统一，不会每个接口散落实现。
|
||||
- 后续审计更清晰。
|
||||
|
||||
风险：
|
||||
|
||||
- 改动较大，测试量更大。
|
||||
- 前端交互也要统一。
|
||||
|
||||
推荐度：长期推荐，短期可分阶段做。
|
||||
|
||||
### 方案 G：refresh token 只允许 HttpOnly Cookie，不再接受 body fallback
|
||||
|
||||
改动：
|
||||
|
||||
- `/api/auth/refresh` 删除 body refresh_token fallback。
|
||||
- 如有历史客户端，先加配置开关或废弃日志。
|
||||
|
||||
好处：
|
||||
|
||||
- Token 传输路径更少。
|
||||
- 更符合当前注释里的安全目标。
|
||||
|
||||
风险：
|
||||
|
||||
- 如果有脚本/旧前端依赖 body refresh，会受影响。
|
||||
|
||||
推荐度：中，先确认没有兼容需求再做。
|
||||
|
||||
---
|
||||
|
||||
## 5. 我建议的执行顺序
|
||||
|
||||
如果目标是先解决“宝塔 2 小时掉线”，建议：
|
||||
|
||||
1. 先做方案 C 的诊断字段或 SSH 检测脚本，确认目标面板 session timeout 是否为 7200。
|
||||
2. 再做方案 A：自动把宝塔 session timeout 提升到 86400。
|
||||
3. 回归测试：同一台宝塔一键登录后刷新不掉；多台并发生成登录 URL 不互相覆盖。
|
||||
4. 然后再做 settings/auth 安全收口：优先方案 D 或 E。
|
||||
|
||||
如果目标是先收安全面，建议：
|
||||
|
||||
1. 方案 D 或 E 处理 Telegram Token。
|
||||
2. 方案 F 分阶段统一敏感操作二次认证。
|
||||
3. 方案 G 作为兼容性确认后的增强项。
|
||||
|
||||
---
|
||||
|
||||
## 6. 待用户选择
|
||||
|
||||
请在以下方向里选一个或多个：
|
||||
|
||||
1. A：自动强制宝塔 session timeout >= 86400，优先解决掉线。
|
||||
2. B：只检测告警，不自动改宝塔。
|
||||
3. C：一键登录返回会话诊断字段，前端提示原因。
|
||||
4. D：Telegram Token 像全局 API Key 一样完全不显示。
|
||||
5. E：Telegram Token 继续可显示，但必须当前密码二次认证。
|
||||
6. F：做统一敏感操作二次认证框架。
|
||||
7. G：refresh token 只允许 HttpOnly Cookie。
|
||||
|
||||
@@ -0,0 +1,224 @@
|
||||
# Nexus 宝塔 Session 自动修复正式发布记录
|
||||
|
||||
日期：2026-07-07
|
||||
正式域名：`https://api.synaglobal.vip`
|
||||
正式主机：`20.24.218.235`
|
||||
正式容器：`nexus-prod-nexus-1`
|
||||
测试提交：`5ac3f56 fix: auto repair btpanel session cleanup ttl`
|
||||
|
||||
## 发布目标
|
||||
|
||||
把“新增宝塔自动检测/修复 hardcoded_3600”与“一键登录前兜底检测/修复”发布到正式环境，解决宝塔 tmp_login session 被 `/www/server/panel/task.py` 固定 3600 秒清理导致一键登录后 1~2 小时刷新掉线的问题。
|
||||
|
||||
## 本次正式发布范围
|
||||
|
||||
发布方式：`docker cp` 热更新正式容器内文件，然后重启容器。
|
||||
说明：正式机 `/opt/nexus` 工作树较脏，本次没有执行 `git reset` / `git pull`，避免覆盖线上已有改动。
|
||||
|
||||
覆盖正式容器内文件：
|
||||
|
||||
- `/app/server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
- `/app/server/infrastructure/btpanel/bootstrap_state.py`
|
||||
- `/app/server/application/services/btpanel_service.py`
|
||||
|
||||
来源文件本地留存：
|
||||
|
||||
- `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\prod-release-20260707-bt-session\ssh_bootstrap.py`
|
||||
- `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\prod-release-20260707-bt-session\bootstrap_state.py`
|
||||
- `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\prod-release-20260707-bt-session\btpanel_service.py`
|
||||
|
||||
正式机 staging 目录：
|
||||
|
||||
- `/tmp/nexus_bt_session_release_20260707/`
|
||||
|
||||
正式机备份目录：
|
||||
|
||||
- `/tmp/nexus_bt_session_backup_20260707_194326/`
|
||||
|
||||
## 已发布能力
|
||||
|
||||
### 1. 新增宝塔 / bootstrap 阶段自动修复
|
||||
|
||||
在远程宝塔服务器上检查：
|
||||
|
||||
- `/www/server/panel/task.py`
|
||||
|
||||
如果发现旧版精确模式：
|
||||
|
||||
```python
|
||||
if f_time > 3600:
|
||||
```
|
||||
|
||||
则自动执行：
|
||||
|
||||
1. 备份原文件为 `/www/server/panel/task.py.nexus-session-ttl.bak`；
|
||||
2. 改为读取宝塔自身 session timeout 配置：
|
||||
|
||||
```python
|
||||
session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
if f_time > session_cleanup_timeout:
|
||||
```
|
||||
|
||||
3. 保留原文件权限；
|
||||
4. 写入前执行 `compile(...)` 与 `py_compile.compile(..., doraise=True)`；
|
||||
5. 通过临时文件 + `os.replace(...)` 原子替换；
|
||||
6. 变更后执行 `/etc/init.d/bt reload`。
|
||||
|
||||
如果 task.py 结构不是已知安全模式，则记录 `unknown_task_pattern`，不做模糊替换，避免误改宝塔代码。
|
||||
|
||||
### 2. 一键登录前兜底检测/修复
|
||||
|
||||
`BtPanelService.create_login_url()` 生成一键登录 URL 前会检查已配置宝塔 API 的服务器：
|
||||
|
||||
- 成功修复/确认后：24 小时内不重复检查；
|
||||
- 失败后：1 小时后允许重试；
|
||||
- 兜底检查失败不会阻断本次一键登录，只会记录 diagnostics 和状态字段。
|
||||
|
||||
### 3. 状态字段
|
||||
|
||||
状态写入：`servers.extra_attrs.bt_panel`
|
||||
|
||||
新增/更新字段：
|
||||
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_patched`
|
||||
- `session_cleanup_task_state`
|
||||
- `session_cleanup_ttl_checked_at`
|
||||
- `session_cleanup_ttl_last_error`
|
||||
- `panel_ssl`
|
||||
|
||||
`session_cleanup_task_state` 常见值：
|
||||
|
||||
- `patched_timeout`：已修好或本次修好；
|
||||
- `unknown_task_pattern`：存在 task.py，但结构不是可安全自动 patch 的已知模式；
|
||||
- `no_panel`：未找到宝塔面板 task.py；
|
||||
- `error`：检测/修复异常。
|
||||
|
||||
一键登录响应 diagnostics 会返回非敏感诊断字段，例如：
|
||||
|
||||
```json
|
||||
{
|
||||
"session_cleanup_ttl_ok": true,
|
||||
"session_cleanup_ttl_patched": true,
|
||||
"session_cleanup_task_state": "patched_timeout"
|
||||
}
|
||||
```
|
||||
|
||||
不会输出宝塔临时登录 token。
|
||||
|
||||
## 验证记录
|
||||
|
||||
### 测试部署机验证
|
||||
|
||||
测试部署机：`192.168.124.219`
|
||||
项目目录：`/opt/nexus-dev-current`
|
||||
分支：`audit/security-review`
|
||||
|
||||
执行测试：
|
||||
|
||||
```bash
|
||||
.venv/bin/python -m pytest \
|
||||
tests/test_btpanel_ssh_bootstrap.py \
|
||||
tests/test_btpanel_login_url.py \
|
||||
tests/test_btpanel_bootstrap_loop.py \
|
||||
tests/test_btpanel_login_url_route.py \
|
||||
tests/test_btpanel_ssh_login.py \
|
||||
tests/test_btpanel_temp_login_ttl.py -q
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
39 passed in 0.61s
|
||||
```
|
||||
|
||||
### 正式容器发布前检查
|
||||
|
||||
正式容器临时目录内 3 个 Python 文件编译通过：
|
||||
|
||||
```bash
|
||||
python -m py_compile \
|
||||
/tmp/nexus_bt_session_release_20260707/ssh_bootstrap.py \
|
||||
/tmp/nexus_bt_session_release_20260707/bootstrap_state.py \
|
||||
/tmp/nexus_bt_session_release_20260707/btpanel_service.py
|
||||
```
|
||||
|
||||
### 正式容器覆盖后检查
|
||||
|
||||
覆盖到 `/app/server/...` 后再次编译通过：
|
||||
|
||||
```bash
|
||||
python -m py_compile \
|
||||
/app/server/infrastructure/btpanel/ssh_bootstrap.py \
|
||||
/app/server/infrastructure/btpanel/bootstrap_state.py \
|
||||
/app/server/application/services/btpanel_service.py
|
||||
```
|
||||
|
||||
代码关键字确认已生效：
|
||||
|
||||
- `unknown_task_pattern`
|
||||
- `py_compile.compile(tmp, doraise=True)`
|
||||
- `session_cleanup_task_state`
|
||||
|
||||
### 正式健康检查
|
||||
|
||||
正式容器重启后：
|
||||
|
||||
```text
|
||||
nexus-prod-nexus-1 Up / healthy
|
||||
http://127.0.0.1:8600/health => ok
|
||||
https://api.synaglobal.vip/health => ok
|
||||
```
|
||||
|
||||
## 安全边界
|
||||
|
||||
本次没有做以下高风险动作：
|
||||
|
||||
- 不显示、不保存、不输出宝塔 `tmp_token`；
|
||||
- 不输出 API Key、JWT、Cookie、密码、私钥；
|
||||
- 不自动关闭宝塔 `check_client_hash()`；
|
||||
- 不自动修改宝塔面板 SSL 开关；
|
||||
- 不对未知 task.py 结构做模糊替换；
|
||||
- 不对正式机代码仓库做 `git reset` / `git pull`；
|
||||
- 不批量重启用户业务服务器，只在需要 patch 宝塔 task.py 时 reload 宝塔面板。
|
||||
|
||||
## 回滚方式
|
||||
|
||||
如需回滚本次正式热更新，可在正式主机执行以下思路：
|
||||
|
||||
```bash
|
||||
# 1. 从备份目录恢复 3 个文件到容器
|
||||
sudo docker cp /tmp/nexus_bt_session_backup_20260707_194326/ssh_bootstrap.py \
|
||||
nexus-prod-nexus-1:/app/server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
|
||||
sudo docker cp /tmp/nexus_bt_session_backup_20260707_194326/bootstrap_state.py \
|
||||
nexus-prod-nexus-1:/app/server/infrastructure/btpanel/bootstrap_state.py
|
||||
|
||||
sudo docker cp /tmp/nexus_bt_session_backup_20260707_194326/btpanel_service.py \
|
||||
nexus-prod-nexus-1:/app/server/application/services/btpanel_service.py
|
||||
|
||||
# 2. 编译检查
|
||||
sudo docker exec nexus-prod-nexus-1 python -m py_compile \
|
||||
/app/server/infrastructure/btpanel/ssh_bootstrap.py \
|
||||
/app/server/infrastructure/btpanel/bootstrap_state.py \
|
||||
/app/server/application/services/btpanel_service.py
|
||||
|
||||
# 3. 重启并检查健康
|
||||
sudo docker restart nexus-prod-nexus-1
|
||||
curl -sf http://127.0.0.1:8600/health
|
||||
```
|
||||
|
||||
## 后续建议
|
||||
|
||||
1. 后续新增宝塔：bootstrap 阶段会自动检测/修复 hardcoded_3600。
|
||||
2. 老的已绑定宝塔：用户点击一键登录前会兜底检测/修复。
|
||||
3. 如果某台机器 diagnostics 显示 `unknown_task_pattern`，需要单独人工看那台宝塔的 `/www/server/panel/task.py`，不要自动硬替换。
|
||||
4. 如果用户仍反馈“刷新后掉线”，优先检查该服务器的 diagnostics：
|
||||
- `session_cleanup_task_state`
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_last_error`
|
||||
- 面板 SSL / 浏览器混合内容 / Cookie SameSite 等。
|
||||
|
||||
## 结论
|
||||
|
||||
正式环境 `https://api.synaglobal.vip` 已发布“新增宝塔自动检测/修复 hardcoded_3600”和“一键登录前兜底检测/修复”。当前正式健康检查通过，测试机相关用例全部通过。后续新增宝塔和老宝塔的一键登录入口都会自动进入这套检测/修复流程。
|
||||
@@ -0,0 +1,132 @@
|
||||
# Nexus 宝塔 `hardcoded_3600` 批量修复完成记录（2026-07-07）
|
||||
|
||||
## 修复范围
|
||||
|
||||
来源：`work/bt_bulk_session_audit.before_patch_20260707-1838.jsonl`。
|
||||
|
||||
本次只处理：
|
||||
|
||||
- 在线服务器
|
||||
- `task_state=hardcoded_3600`
|
||||
- 共 148 台
|
||||
|
||||
本次没有处理：
|
||||
|
||||
- `panel_ssl=0` 的 112 台
|
||||
- `unknown_task_pattern` 的 268 台
|
||||
- 其它异常/无面板机器
|
||||
|
||||
## 修复动作
|
||||
|
||||
对每台目标服务器执行：
|
||||
|
||||
1. 检查 `/www/server/panel/task.py`。
|
||||
2. 查找硬编码逻辑：
|
||||
- `if f_time > 3600:`
|
||||
3. 在 session 清理循环前插入：
|
||||
- 默认 `session_cleanup_timeout = 86400`
|
||||
- 优先读取 `public.get_session_timeout()`
|
||||
4. 把条件改成：
|
||||
- `if f_time > session_cleanup_timeout:`
|
||||
5. 写入前做备份：
|
||||
- `/www/server/panel/task.py.nexus-session-ttl.bak`
|
||||
6. 写入临时文件并执行 Python 编译检查。
|
||||
7. 原子替换 `task.py`。
|
||||
8. 如果本次确实发生修改，则执行 `/etc/init.d/bt reload`。
|
||||
|
||||
## 执行批次
|
||||
|
||||
第一批 10 台：执行 ID `5944`。
|
||||
|
||||
剩余 138 台按 20 台一批执行：
|
||||
|
||||
| 批次 | 执行 ID | 数量 | 结果 |
|
||||
|---:|---:|---:|---|
|
||||
| 1 | 5944 | 10 | 成功 |
|
||||
| 2 | 5945 | 20 | 成功 |
|
||||
| 3 | 5946 | 20 | 成功 |
|
||||
| 4 | 5947 | 20 | 成功 |
|
||||
| 5 | 5948 | 20 | 成功 |
|
||||
| 6 | 5949 | 20 | 成功 |
|
||||
| 7 | 5950 | 20 | 成功 |
|
||||
| 8 | 5951 | 18 | 成功 |
|
||||
|
||||
总计：148 / 148 成功。
|
||||
|
||||
## 执行结果
|
||||
|
||||
所有目标机器返回：
|
||||
|
||||
- `exit_code=0`
|
||||
- `patch_result=patched`
|
||||
- `after_patched=True`
|
||||
|
||||
本地结果文件：
|
||||
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183535.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183648_exec5945.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183658_exec5946.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183707_exec5947.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183717_exec5948.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183727_exec5949.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183737_exec5950.json`
|
||||
- `work/bt_session_ttl_patch_batch_20260707-183747_exec5951.json`
|
||||
- `work/bt_session_ttl_patch_summary_20260707-183747.json`
|
||||
|
||||
## 修复后全量只读复查
|
||||
|
||||
复查范围：在线 420 台。
|
||||
|
||||
复查结果：
|
||||
|
||||
| 状态 | 数量 |
|
||||
|---|---:|
|
||||
| `patched_timeout` | 149 |
|
||||
| `unknown_task_pattern` | 268 |
|
||||
| `no_panel` | 1 |
|
||||
| `error` | 2 |
|
||||
| `hardcoded_3600` | 0 |
|
||||
|
||||
关键验证：
|
||||
|
||||
- 修复前 `hardcoded_3600`：148 台
|
||||
- 修复后这 148 台全部变为：`patched_timeout`
|
||||
- 修复后剩余 `hardcoded_3600`：0 台
|
||||
|
||||
全量复查中有 2 台轮询超时/解析异常：
|
||||
|
||||
- server_id `225`
|
||||
- server_id `1`
|
||||
|
||||
这 2 台不是本轮 `hardcoded_3600` 未修复目标；本轮 148 台目标已全部验证成功。
|
||||
|
||||
## 当前剩余问题
|
||||
|
||||
仍有 112 台 `panel_ssl=0`，它们主要是另一类问题：
|
||||
|
||||
- 多数为 Ubuntu 24.04.4
|
||||
- 多数为腾讯云 `VM-*` 主机名
|
||||
- 多数属于 `unknown_task_pattern`
|
||||
- 不适合直接套本轮 `hardcoded_3600` 补丁
|
||||
|
||||
建议下一步：对 112 台 `panel_ssl=0` 抽样 5-10 台读取 `task.py` / `public.py`，按宝塔版本分类后再决定策略。
|
||||
|
||||
## 回滚方式
|
||||
|
||||
单台回滚：
|
||||
|
||||
```bash
|
||||
cp -a /www/server/panel/task.py.nexus-session-ttl.bak /www/server/panel/task.py
|
||||
python -m py_compile /www/server/panel/task.py
|
||||
/etc/init.d/bt reload
|
||||
```
|
||||
|
||||
如果宝塔使用独立 pyenv，编译命令可替换为：
|
||||
|
||||
```bash
|
||||
/www/server/panel/pyenv/bin/python3 -m py_compile /www/server/panel/task.py
|
||||
```
|
||||
|
||||
## 结论
|
||||
|
||||
148 台 `hardcoded_3600` 已全部修复并通过复查，当前在线 420 台里 `hardcoded_3600` 已清零。
|
||||
@@ -0,0 +1,403 @@
|
||||
# Nexus 宝塔一键登录 2 小时掉线阶段诊断报告（2026-07-07）
|
||||
|
||||
## 1. 本轮结论
|
||||
|
||||
针对服务器 `42.193.182.190`（Nexus server_id 约为 `395`）排查后，目前结论是：
|
||||
|
||||
1. **Nexus 生成的一键登录临时 token TTL 是 24 小时，不是 2 小时。**
|
||||
2. 目标宝塔最近生成的 `temp_login` 记录 `ttl_seconds` 为 `86399/86400` 秒。
|
||||
3. 宝塔面板登录超时配置文件 `/www/server/panel/data/session_timeout.pl` 缺失，按宝塔源码 `public.get_session_timeout()` 默认应为 `86400` 秒。
|
||||
4. 宝塔 `task.py` 已经是按 `public.get_session_timeout()` 清理 session，不再是旧的硬编码 3600 秒清理。
|
||||
5. 目标宝塔未开启面板 SSL：`/www/server/panel/data/ssl.pl` 缺失。
|
||||
6. 未开启 SSL 时，宝塔源码 `public.check_client_hash()` 会启用客户端 HASH 校验；一旦客户端 HASH 变化，宝塔会清空 session 并要求重新登录。这个更符合“同时打开 10 个宝塔，过一段时间刷新陆续掉线”的现象。
|
||||
|
||||
## 2. 已验证证据
|
||||
|
||||
### 2.1 最新 temp_login TTL
|
||||
|
||||
实际表位置：
|
||||
|
||||
```text
|
||||
/www/server/panel/data/db/default.db
|
||||
```
|
||||
|
||||
最新记录示例：
|
||||
|
||||
```text
|
||||
id=108
|
||||
state=0
|
||||
add_local=2026-07-07 13:56:57
|
||||
expire_local=2026-07-08 13:56:56
|
||||
ttl_seconds=86399
|
||||
seconds_left≈86377
|
||||
```
|
||||
|
||||
说明 Nexus 生成的临时登录有效期约等于 24 小时。
|
||||
|
||||
### 2.2 宝塔登录超时配置
|
||||
|
||||
目标机：
|
||||
|
||||
```text
|
||||
/www/server/panel/data/session_timeout.pl = missing
|
||||
```
|
||||
|
||||
宝塔源码逻辑：文件缺失时默认：
|
||||
|
||||
```text
|
||||
86400 seconds = 24 hours
|
||||
```
|
||||
|
||||
### 2.3 宝塔 task.py session 清理
|
||||
|
||||
目标机 `/www/server/panel/task.py` 已存在：
|
||||
|
||||
```python
|
||||
session_cleanup_timeout = 86400
|
||||
try:
|
||||
session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
if f_time > session_cleanup_timeout:
|
||||
os.remove(filename)
|
||||
```
|
||||
|
||||
所以当前不是旧版每 1 小时清理 session 的问题。
|
||||
|
||||
### 2.4 宝塔 SSL/client_hash 风险
|
||||
|
||||
目标机：
|
||||
|
||||
```text
|
||||
missing ssl.pl
|
||||
```
|
||||
|
||||
宝塔源码中：
|
||||
|
||||
```python
|
||||
def is_ssl():
|
||||
return os.path.exists(get_panel_path() + '/data/ssl.pl')
|
||||
|
||||
def check_client_hash():
|
||||
if is_ssl(): return True
|
||||
...
|
||||
if session[skey] != client_hash:
|
||||
WriteLog('用户登录', '客户端HASH验证失败，已强制退出登录...建议开启面板SSL或关闭IP-HASH验证!')
|
||||
return False
|
||||
```
|
||||
|
||||
推断：如果浏览器/代理/出口 IP/UA/客户端特征变化，或者多个宝塔窗口处于不同访问链路，刷新时可能触发 client_hash 校验失败，被宝塔强制退出。
|
||||
|
||||
## 3. 本轮已修 Nexus 问题
|
||||
|
||||
发现当前 `POST /api/btpanel/servers/395/login-url` 曾返回 502：
|
||||
|
||||
```text
|
||||
ModuleNotFoundError: No module named 'public'
|
||||
```
|
||||
|
||||
根因：Nexus SSH fallback 用系统 Python 或未完整设置宝塔源码路径执行临时登录脚本。
|
||||
|
||||
已修改文件：
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-current/server/infrastructure/btpanel/ssh_login.py
|
||||
```
|
||||
|
||||
提交：
|
||||
|
||||
```text
|
||||
fa44439 fix btpanel ssh temp login python env
|
||||
```
|
||||
|
||||
改动要点：
|
||||
|
||||
1. Python 优先级调整为：
|
||||
- `/www/server/panel/pyenv/bin/python3`
|
||||
- `/www/server/panel/pyenv/bin/python`
|
||||
- `python3`
|
||||
2. 临时登录脚本执行前：
|
||||
- `os.chdir('/www/server/panel')`
|
||||
- 加入 `/www/server/panel`
|
||||
- 加入 `/www/server/panel/class`
|
||||
3. 已热更新到运行中容器并重启。
|
||||
4. 验证：
|
||||
- `tests/test_btpanel_login_url.py`: `6 passed`
|
||||
- 一键登录接口再次返回 `200 OK`
|
||||
|
||||
注意：当前容器是单文件热更新；源码已提交。如果后续重新创建容器但不 rebuild 镜像，热更新会丢失。建议下一次部署时执行正式 build。
|
||||
|
||||
## 4. 为什么仍可能“2 小时后刷新掉线”
|
||||
|
||||
目前不是以下原因：
|
||||
|
||||
- 不是 Nexus temp token 只有 2 小时。
|
||||
- 不是 `public.get_session_timeout()` 配置成 2 小时。
|
||||
- 不是 `task.py` 仍按 3600 秒删除 session。
|
||||
|
||||
更可能是：
|
||||
|
||||
1. 宝塔未开启面板 SSL，`check_client_hash()` 生效。
|
||||
2. 多个宝塔窗口、代理链路、出口 IP、浏览器 UA 或客户端指纹发生变化。
|
||||
3. 宝塔刷新请求时发现当前 session 内保存的 client_hash 与本次请求不同，于是清 session。
|
||||
4. 宝塔日志里这类错误通常是“客户端 HASH 验证失败，已强制退出登录”。
|
||||
|
||||
## 5. 下一步修复方案（待选择）
|
||||
|
||||
### 方案 A：开启宝塔面板 SSL（推荐优先验证）
|
||||
|
||||
- 原理：宝塔源码 `if is_ssl(): return True`，开启 SSL 后跳过 client_hash 校验。
|
||||
- 好处：遵循宝塔自身逻辑，不改源码。
|
||||
- 风险：需要处理证书、访问协议、端口和浏览器信任问题。
|
||||
- 影响：可能需要 reload/restart 宝塔。
|
||||
|
||||
### 方案 B：Nexus 增加宝塔登录诊断提示
|
||||
|
||||
- 内容：一键登录返回/审计中记录 `ttl_seconds`、`panel_ssl`、`client_hash_risk` 等非敏感信息。
|
||||
- 好处：以后看到某台机器掉线，可直接确认风险点。
|
||||
- 风险：要严格避免返回 token/cookie/API key。
|
||||
- 影响：小改动。
|
||||
|
||||
### 方案 C：只对临时登录 session 放宽 client_hash
|
||||
|
||||
- 内容：patch 宝塔源码，若 `session['tmp_login'] == True` 则跳过或降低 client_hash 校验。
|
||||
- 好处：针对 Nexus 一键登录最直接。
|
||||
- 风险：改宝塔源码，升级可能覆盖；安全性低于开启 SSL。
|
||||
- 影响：需要 reload/restart 宝塔。
|
||||
|
||||
### 方案 D：关闭宝塔 IP-HASH/client_hash 校验
|
||||
|
||||
- 好处：最直接。
|
||||
- 风险：全局安全性下降，不建议默认。
|
||||
- 影响：所有宝塔登录会话受影响。
|
||||
|
||||
### 方案 E：Nexus 自动定期生成新临时登录 URL
|
||||
|
||||
- 内容：掉线时重新点一键登录；或前端提供刷新登录入口。
|
||||
- 好处：不改宝塔。
|
||||
- 风险：不能解决当前会话刷新被踢，只是降低恢复成本。
|
||||
- 影响：小到中。
|
||||
|
||||
### 方案 F：前端/代理层保活
|
||||
|
||||
- 内容：定时请求宝塔保持 session 活跃。
|
||||
- 好处：对 session_timeout 问题有帮助。
|
||||
- 风险：对 client_hash 失败基本无效；跨域限制多。
|
||||
- 影响：不推荐作为主方案。
|
||||
|
||||
### 方案 G：Nexus 代理式宝塔访问
|
||||
|
||||
- 内容：Nexus 托管/代理宝塔访问链路，减少客户端 HASH 变化。
|
||||
- 好处：长期可控。
|
||||
- 风险：大改；安全边界复杂。
|
||||
- 影响：开发量最大。
|
||||
|
||||
## 6. 当前推荐
|
||||
|
||||
推荐顺序：
|
||||
|
||||
1. 先选 **方案 A：开启宝塔面板 SSL**，验证多开 10 个宝塔 2 小时后刷新是否仍掉线。
|
||||
2. 同时做 **方案 B：Nexus 诊断提示**，以后每台宝塔能直接看 TTL/SSL/client_hash 风险。
|
||||
3. 如果 A 不方便或仍失败，再考虑 **方案 C：仅对临时登录放宽 client_hash**。
|
||||
|
||||
## 7. 待办
|
||||
|
||||
- [ ] 用户确认选 A/B/C/D/E/F/G 哪个方向。
|
||||
- [ ] 若选 A：在测试机上开启面板 SSL 并记录回滚方式。
|
||||
- [ ] 若选 B：实现 Nexus 只读诊断，不返回敏感 token/cookie。
|
||||
- [ ] 若选 C/D：先备份宝塔源码，再 patch，并保留一键回滚脚本。
|
||||
- [ ] 正式重建 Nexus Docker 镜像，让 `fa44439` 固化进镜像。
|
||||
|
||||
## 8. 补充：get_client_hash 精确逻辑
|
||||
|
||||
后续只读查看 `/www/server/panel/class/public.py` 后确认：
|
||||
|
||||
```python
|
||||
def get_client_hash():
|
||||
is_tmp_login = session.get('tmp_login')
|
||||
is_session_safe_mode = session.get('session_safe_mode')
|
||||
if is_tmp_login or is_session_safe_mode:
|
||||
client_hash = md5(request.remote_addr)
|
||||
else:
|
||||
...
|
||||
```
|
||||
|
||||
因此对 Nexus 一键登录这种 `tmp_login=True` 的会话，宝塔主要绑定的是：
|
||||
|
||||
```text
|
||||
request.remote_addr
|
||||
```
|
||||
|
||||
也就是宝塔看到的客户端来源 IP。
|
||||
|
||||
这进一步解释了“同时打开多个宝塔，约 2 小时后刷新陆续掉线”：如果浏览器代理、网络出口、反代、CDN、VPN 或宝塔前面的转发链路导致 `request.remote_addr` 变化，宝塔刷新时会认为客户端 HASH 不一致，然后清空 session。
|
||||
|
||||
所以最优先验证项变为：
|
||||
|
||||
1. 开启宝塔面板 SSL，让 `check_client_hash()` 直接返回 True。
|
||||
2. 或保证访问宝塔时来源 IP 固定。
|
||||
3. 或只对 Nexus 临时登录会话放宽 `tmp_login` 的 IP 绑定。
|
||||
|
||||
---
|
||||
|
||||
## 2026-07-07 诊断字段落地与验证
|
||||
|
||||
### 本次代码改动
|
||||
|
||||
已在 Nexus 后端增加宝塔一键登录的非敏感诊断字段 `diagnostics`：
|
||||
|
||||
- `temp_login_ttl_seconds`：Nexus 申请宝塔临时登录链接的 TTL，当前为 `86400` 秒。
|
||||
- `session_cleanup_ttl_ok`：宝塔 `task.py` 会话清理阈值巡检/修复是否成功。
|
||||
- `session_cleanup_ttl_patched`：本次/最近一次 SSH bootstrap 是否修补过会话清理阈值。
|
||||
- `session_cleanup_ttl_checked_at`：最近一次巡检时间。
|
||||
- `session_cleanup_ttl_last_error`：最近一次巡检错误码，非敏感。
|
||||
- `panel_ssl`：宝塔面板是否启用面板 SSL（检测 `/www/server/panel/data/ssl.pl`），与 Nexus 的 `verify_ssl` 不是一个概念。
|
||||
- `client_hash_risk`：当 `panel_ssl=false` 时为 `true`，表示宝塔临时登录 session 仍有来源 IP 变化后被 `check_client_hash()` 清掉的风险。
|
||||
|
||||
### 改动文件
|
||||
|
||||
远端测试部署机 `/opt/nexus-dev-current`：
|
||||
|
||||
- `server/application/services/btpanel_service.py`
|
||||
- `server/infrastructure/btpanel/bootstrap_state.py`
|
||||
- `server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
- `tests/test_btpanel_login_url.py`
|
||||
|
||||
### 安全边界
|
||||
|
||||
- 没有返回或记录 `api_key`、cookie、`tmp_token`、宝塔密码、SSH 密钥等敏感值。
|
||||
- `diagnostics` 只包含 TTL、布尔状态、时间、短错误码。
|
||||
- 审计日志里新增的也是同一份非敏感 `diagnostics`。
|
||||
- 没有直接修改宝塔 SSL 开关或宝塔源码；只是把已知风险显式化。
|
||||
|
||||
### 测试结果
|
||||
|
||||
在 Nexus 测试部署机执行：
|
||||
|
||||
```text
|
||||
python -m py_compile server/infrastructure/btpanel/ssh_bootstrap.py \
|
||||
server/infrastructure/btpanel/bootstrap_state.py \
|
||||
server/application/services/btpanel_service.py \
|
||||
tests/test_btpanel_login_url.py \
|
||||
tests/test_btpanel_ssh_bootstrap.py
|
||||
|
||||
pytest tests/test_btpanel_login_url.py tests/test_btpanel_login_url_route.py tests/test_btpanel_ssh_bootstrap.py -q
|
||||
# 24 passed
|
||||
|
||||
pytest -q
|
||||
# 748 passed, 1 skipped
|
||||
```
|
||||
|
||||
### 部署验证
|
||||
|
||||
已热更新 Nexus 测试容器：
|
||||
|
||||
```text
|
||||
docker cp server/application/services/btpanel_service.py nexus-nexus-1:/app/server/application/services/btpanel_service.py
|
||||
docker cp server/infrastructure/btpanel/bootstrap_state.py nexus-nexus-1:/app/server/infrastructure/btpanel/bootstrap_state.py
|
||||
docker cp server/infrastructure/btpanel/ssh_bootstrap.py nexus-nexus-1:/app/server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
docker restart nexus-nexus-1
|
||||
curl http://127.0.0.1:18600/health
|
||||
# ok
|
||||
```
|
||||
|
||||
注意：当前是测试机容器热更新，正式固化仍建议 rebuild 镜像并按发布流程部署。
|
||||
|
||||
### 当前结论
|
||||
|
||||
代码层面已能区分：
|
||||
|
||||
1. Nexus 一键登录 token TTL（24h）。
|
||||
2. 宝塔 session 清理阈值是否已修复到 24h。
|
||||
3. 宝塔面板 SSL 是否开启。
|
||||
4. 未开启面板 SSL 时，`tmp_login` 绑定来源 IP 导致“刷新后掉线”的风险。
|
||||
|
||||
下一步如果要彻底解决“多开 10 个宝塔，过 2 小时刷新陆续掉线”，优先建议在用户确认方案后处理宝塔侧：启用面板 SSL，或统一浏览器访问出口/反代来源 IP；不建议默认改宝塔 `check_client_hash()`。
|
||||
|
||||
### 宝塔官方文档补充
|
||||
|
||||
宝塔官方文档「面板基础设置」中说明：面板“超时时间”默认设置为 **24 小时**，可选 1小时、6小时、12小时、24小时、3天、7天；超过该时间未操作面板会自动退出登录。参考：https://docs.bt.cn/10.0/user-guide/config/panel-settings
|
||||
|
||||
这与目标机源码 `public.get_session_timeout()` 在缺少 `session_timeout.pl` 时默认 86400 秒的结果一致，因此目前“约 2 小时刷新掉线”的主因仍更像是未开启面板 SSL 时的 `client_hash` 来源 IP 绑定，而不是正常超时时间到了。
|
||||
|
||||
## 2026-07-07 正式环境 `api.synaglobal.vip` 最小热更新记录
|
||||
|
||||
### 部署方式
|
||||
|
||||
正式主机 `/opt/nexus` 当前工作树存在大量本地修改和未跟踪前端构建文件，因此没有执行 `git pull`、`git reset` 或整仓覆盖。
|
||||
|
||||
本次采用最小风险热更新：只把测试机已验证通过的 3 个后端 Python 文件复制进正式容器 `nexus-prod-nexus-1`：
|
||||
|
||||
- `/app/server/application/services/btpanel_service.py`
|
||||
- `/app/server/infrastructure/btpanel/bootstrap_state.py`
|
||||
- `/app/server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
|
||||
正式容器旧文件已先备份到：
|
||||
|
||||
```text
|
||||
/tmp/nexus-bt-diag-backup-20260707-153452
|
||||
```
|
||||
|
||||
### 部署校验
|
||||
|
||||
容器内 `py_compile` 通过，容器已重启，健康检查通过：
|
||||
|
||||
```text
|
||||
container: nexus-prod-nexus-1
|
||||
health: ok
|
||||
status: Up About a minute (healthy)
|
||||
```
|
||||
|
||||
部署后 3 个文件在正式容器内的 SHA256：
|
||||
|
||||
```text
|
||||
eacf143745b14727fa66de99551e88e26c2f7ece3b4b0f82a071484da8b2dbd8 btpanel_service.py
|
||||
3f84246b6b0635c3a8f74848fe606b23cac407e9a775feb729d9c0f9185ffb4a bootstrap_state.py
|
||||
c4a2a1010392249dec8de68fc89def5935440df18c5c7c24a79be87763708806 ssh_bootstrap.py
|
||||
```
|
||||
|
||||
### 正式接口验证
|
||||
|
||||
通过 `https://api.synaglobal.vip` 调用 `POST /api/btpanel/servers/395/login-url` 验证成功：
|
||||
|
||||
```text
|
||||
auth_status: HTTP/1.1 200 OK
|
||||
login_url_status: HTTP/1.1 200 OK
|
||||
method: api
|
||||
bootstrapped: false
|
||||
url_sanitized: https://42.193.182.190:31701/login?tmp_token=***
|
||||
```
|
||||
|
||||
正式接口返回的非敏感诊断字段：
|
||||
|
||||
```json
|
||||
{
|
||||
"client_hash_risk": false,
|
||||
"panel_ssl": true,
|
||||
"session_cleanup_ttl_checked_at": "2026-07-07T07:35:19Z",
|
||||
"session_cleanup_ttl_last_error": null,
|
||||
"session_cleanup_ttl_ok": true,
|
||||
"session_cleanup_ttl_patched": false,
|
||||
"temp_login_ttl_seconds": 86400
|
||||
}
|
||||
```
|
||||
|
||||
说明：
|
||||
|
||||
- `temp_login_ttl_seconds=86400`：Nexus 一键登录临时链接仍是 24 小时。
|
||||
- `panel_ssl=true` 且 `client_hash_risk=false`：当前正式记录里这台宝塔面板已检测到面板 SSL 开启，因此“未开启 SSL 导致 tmp_login 绑定来源 IP”的风险在这次返回里不成立。
|
||||
- `session_cleanup_ttl_ok=true`：宝塔会话清理阈值检查成功。
|
||||
- `session_cleanup_ttl_patched=false`：表示本次检查没有新改动 `task.py`；不是失败。是否已经被旧补丁覆盖，要结合 `session_cleanup_ttl_ok` 和目标机源码再判断。
|
||||
|
||||
### 风险与后续
|
||||
|
||||
本次只是正式容器热更新，不是镜像固化发布。后续如果 1Panel/Docker 重新构建或重新拉镜像，这 3 个文件可能被镜像内容覆盖；建议下一步按正式发布流程把提交 `b5aaf5a feat: add btpanel login diagnostics` 合入正式镜像构建链路。
|
||||
|
||||
当前现网诊断结果显示 42.193.182.190 这台宝塔的 `panel_ssl=true`、`client_hash_risk=false`，如果用户仍复现“多开 10 个宝塔，约 2 小时后刷新陆续掉线”，下一步应优先抓以下现场：
|
||||
|
||||
1. 掉线前后重新调用 `login-url`，比较 `diagnostics` 是否变化。
|
||||
2. 在宝塔机上检查 session 文件创建/删除时间和 `request.remote_addr` 来源变化。
|
||||
3. 检查浏览器/代理/反代是否对不同标签页或不同时间切换出口。
|
||||
4. 检查宝塔自身是否还有其它 session 清理逻辑或安全插件清理逻辑。
|
||||
5. 检查 Nexus 返回的 `method` 是否一直为 `api`，是否在某些机器上触发 SSH bootstrap 或 fallback。
|
||||
@@ -0,0 +1,987 @@
|
||||
# Nexus 宝塔一键登录长期掉线修复方案与代码改进
|
||||
|
||||
生成时间：2026-07-07（Asia/Shanghai）
|
||||
项目路径：`C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus`
|
||||
生产 API：`https://api.synaglobal.vip`
|
||||
排查机器：`42.193.182.190`
|
||||
Nexus server id：`395`
|
||||
|
||||
> 本文档不包含任何密码、token、私钥、API key。所有敏感凭据均已省略。
|
||||
|
||||
---
|
||||
|
||||
## 1. 问题背景
|
||||
|
||||
用户反馈：
|
||||
|
||||
- Nexus 一键登录宝塔本身能成功。
|
||||
- 同时打开多个宝塔面板后，约 1～2 小时刷新会陆续掉线。
|
||||
- 目标机器示例：`42.193.182.190`。
|
||||
|
||||
一开始怀疑点：
|
||||
|
||||
1. Nexus 生成的宝塔临时登录 token TTL 太短。
|
||||
2. Nexus 一键登录 URL 缓存导致返回已消费的一次性 token。
|
||||
3. 多 worker / 多请求并发生成宝塔临时登录，互相覆盖或失效。
|
||||
4. 宝塔自身 session 清理策略导致登录态被清掉。
|
||||
|
||||
最终确认：**根因是第 4 点，宝塔自身 `BT-Task` 定期清理 session 文件时硬编码 3600 秒。**
|
||||
|
||||
---
|
||||
|
||||
## 2. 排查结论
|
||||
|
||||
### 2.1 Nexus 生产生成的一键登录 token 已经是 24 小时
|
||||
|
||||
通过生产 Nexus 调用：
|
||||
|
||||
```http
|
||||
POST /api/btpanel/servers/395/login-url
|
||||
```
|
||||
|
||||
返回：
|
||||
|
||||
```text
|
||||
method=api
|
||||
url=https://42.193.182.190:31701/login?tmp_token=***
|
||||
```
|
||||
|
||||
随后在目标机宝塔 DB 查到最新 `temp_login`：
|
||||
|
||||
```text
|
||||
state=0
|
||||
ttl_seconds≈86399
|
||||
remain_seconds≈86398
|
||||
```
|
||||
|
||||
因此 Nexus 当前生产生成的宝塔临时登录不是 2/3 小时，而是约 **24 小时**。
|
||||
|
||||
### 2.2 目标机器宝塔配置也是 24 小时
|
||||
|
||||
目标机器：`42.193.182.190`
|
||||
|
||||
```text
|
||||
/www/server/panel/data/session_timeout.pl = 86400
|
||||
宝塔版本：11.0.0
|
||||
宝塔端口：31701
|
||||
```
|
||||
|
||||
### 2.3 真正根因：宝塔 task.py 硬编码清理 1 小时 session
|
||||
|
||||
宝塔后台任务文件：
|
||||
|
||||
```text
|
||||
/www/server/panel/task.py
|
||||
```
|
||||
|
||||
原始逻辑片段：
|
||||
|
||||
```python
|
||||
if f_time > 3600:
|
||||
os.remove(filename)
|
||||
continue
|
||||
```
|
||||
|
||||
宝塔每 10 分钟跑一次 session 清理，超过 3600 秒的 session 文件会被删除。
|
||||
|
||||
临时登录刷新时又依赖 session 文件存在。相关逻辑在：
|
||||
|
||||
```text
|
||||
/www/server/panel/class/common.py
|
||||
```
|
||||
|
||||
核心逻辑：
|
||||
|
||||
```python
|
||||
if 'tmp_login_expire' in session:
|
||||
s_file = 'data/session/{}'.format(session['tmp_login_id'])
|
||||
if session['tmp_login_expire'] < time.time():
|
||||
session.clear()
|
||||
if os.path.exists(s_file):
|
||||
os.remove(s_file)
|
||||
return ...
|
||||
if not os.path.exists(s_file):
|
||||
session.clear()
|
||||
return ...
|
||||
```
|
||||
|
||||
也就是说：
|
||||
|
||||
```text
|
||||
Nexus 一键登录成功
|
||||
→ 宝塔生成 tmp_login session 文件
|
||||
→ BT-Task 每 10 分钟清理 session
|
||||
→ task.py 硬编码超过 3600 秒删除
|
||||
→ 用户 1～2 小时后刷新
|
||||
→ tmp_login session 文件不存在
|
||||
→ 宝塔清空 session
|
||||
→ 用户被踢出
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. 总体修复方案
|
||||
|
||||
### 3.1 Nexus 侧改进
|
||||
|
||||
Nexus 后端做四类改进：
|
||||
|
||||
1. **不缓存成功的一键登录 URL**
|
||||
- 宝塔 `tmp_token` 是一次性链接。
|
||||
- 如果缓存成功 URL，用户再次拿到的可能是已消费 token。
|
||||
|
||||
2. **一键登录生成加 Redis 分布式锁**
|
||||
- 同一台宝塔服务器同时只允许一个 Nexus worker 生成登录 URL。
|
||||
- 避免 10 个页面同时一键登录时互相覆盖临时登录 token。
|
||||
|
||||
3. **宝塔临时登录 TTL 固定为 86400 秒**
|
||||
- `set_temp_login` 传入 24 小时过期时间。
|
||||
|
||||
4. **Nexus bootstrap/repair 自动修复宝塔 session 清理硬编码**
|
||||
- 检查 `/www/server/panel/task.py`。
|
||||
- 把 `if f_time > 3600:` 改为 `if f_time > session_cleanup_timeout:`。
|
||||
- `session_cleanup_timeout` 从宝塔 `public.get_session_timeout()` 读取。
|
||||
- 修改前备份。
|
||||
- 修改前做 Python 语法校验。
|
||||
- 保留原文件权限。
|
||||
|
||||
### 3.2 目标机器热修复
|
||||
|
||||
已对 `42.193.182.190` 执行热修复：
|
||||
|
||||
- 备份：`/www/server/panel/task.py.nexus-session-ttl.bak`
|
||||
- 修改：`/www/server/panel/task.py`
|
||||
- reload：`/etc/init.d/bt reload`
|
||||
- 状态：`Bt-Panel` 与 `Bt-Task` 均 running
|
||||
|
||||
---
|
||||
|
||||
## 4. 调用链图：Nexus 一键登录 API / 服务 / 数据库 / 宝塔调用链
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A["前端点击：宝塔一键登录"] --> B["POST /api/btpanel/servers/{server_id}/login-url"]
|
||||
B --> C["server/api/btpanel.py:create_bt_login_url"]
|
||||
C --> D["BtPanelService.create_login_url"]
|
||||
D --> E["Redis 分布式锁 login_url_lock(server_id)"]
|
||||
E --> F["_create_login_url_fresh"]
|
||||
F --> G{"bt_panel credentials 是否已配置"}
|
||||
G -- "否" --> H["bootstrap_server(force=True)"]
|
||||
H --> I["ssh_bootstrap_panel"]
|
||||
I --> J["远程修改宝塔 api.json / 白名单 / session cleanup TTL"]
|
||||
J --> K["更新 Server.extra_attrs.bt_panel"]
|
||||
G -- "是" --> L["read_bt_panel_credentials"]
|
||||
K --> L
|
||||
L --> M["BtPanelClient.post /config?action=set_temp_login"]
|
||||
M --> N["宝塔 default.db.temp_login 写入临时登录记录"]
|
||||
N --> O["resolve_temp_login_url / normalize_temp_login_url"]
|
||||
O --> P["写 AuditLog: bt_panel_login_url"]
|
||||
P --> Q["返回 login URL 给前端"]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. 本地 Nexus 代码改进清单
|
||||
|
||||
### 5.1 新增 Redis 分布式锁
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\server\infrastructure\btpanel\login_url_lock.py
|
||||
```
|
||||
|
||||
完整新增代码：
|
||||
|
||||
```python
|
||||
"""Distributed per-server lock for BT Panel one-click login URL generation.
|
||||
|
||||
BT Panel temporary login tokens are effectively single-use and creating a new token can
|
||||
invalidate a previous unused token. A process-local ``asyncio.Lock`` is not sufficient
|
||||
when Nexus runs with multiple workers/containers, so this lock is backed by Redis.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
import logging
|
||||
import secrets
|
||||
from contextlib import asynccontextmanager
|
||||
from typing import AsyncIterator
|
||||
|
||||
from server.infrastructure.redis.client import get_redis
|
||||
|
||||
logger = logging.getLogger("nexus.btpanel.login_url_lock")
|
||||
|
||||
_LOCK_KEY_PREFIX = "btpanel:login_url:lock"
|
||||
_LOCK_TTL_SECONDS = 600
|
||||
_LOCK_WAIT_TIMEOUT_SECONDS = 120.0
|
||||
_LOCK_POLL_SECONDS = 0.2
|
||||
|
||||
_RELEASE_SCRIPT = """
|
||||
if redis.call("get", KEYS[1]) == ARGV[1] then
|
||||
return redis.call("del", KEYS[1])
|
||||
end
|
||||
return 0
|
||||
"""
|
||||
|
||||
|
||||
class LoginUrlLockTimeout(RuntimeError):
|
||||
"""Raised when another worker is already generating a login URL too long."""
|
||||
|
||||
|
||||
def _lock_key(server_id: int) -> str:
|
||||
return f"{_LOCK_KEY_PREFIX}:{server_id}"
|
||||
|
||||
|
||||
@asynccontextmanager
|
||||
async def login_url_lock(server_id: int) -> AsyncIterator[None]:
|
||||
"""Serialize login URL generation across all Nexus workers.
|
||||
|
||||
Redis is mandatory in Nexus, so lock backend errors are treated as hard failures
|
||||
rather than silently falling back to an unsafe process-local lock.
|
||||
"""
|
||||
|
||||
redis = get_redis()
|
||||
key = _lock_key(server_id)
|
||||
token = secrets.token_urlsafe(24)
|
||||
deadline = asyncio.get_running_loop().time() + _LOCK_WAIT_TIMEOUT_SECONDS
|
||||
while True:
|
||||
acquired = bool(await redis.set(key, token, ex=_LOCK_TTL_SECONDS, nx=True))
|
||||
if acquired:
|
||||
break
|
||||
if asyncio.get_running_loop().time() >= deadline:
|
||||
raise LoginUrlLockTimeout("BT Panel login URL is already being generated; please retry shortly")
|
||||
await asyncio.sleep(_LOCK_POLL_SECONDS)
|
||||
|
||||
try:
|
||||
yield
|
||||
finally:
|
||||
try:
|
||||
await redis.eval(_RELEASE_SCRIPT, 1, key, token)
|
||||
except Exception: # noqa: BLE001 - lock expires automatically; log release failures for ops visibility
|
||||
logger.warning("failed to release bt panel login url lock server=%s", server_id, exc_info=True)
|
||||
```
|
||||
|
||||
设计点：
|
||||
|
||||
- 锁 key：`btpanel:login_url:lock:{server_id}`。
|
||||
- 锁 TTL：600 秒，避免 worker 崩溃后死锁。
|
||||
- 等待超时：120 秒。
|
||||
- Lua 释放锁，避免误删其它请求持有的新锁。
|
||||
|
||||
---
|
||||
|
||||
### 5.2 登录 URL 不再缓存，始终 fresh 生成
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\server\application\services\btpanel_service.py
|
||||
```
|
||||
|
||||
核心代码：
|
||||
|
||||
```python
|
||||
async def create_login_url(
|
||||
self,
|
||||
server_id: int,
|
||||
*,
|
||||
admin_username: str,
|
||||
ip_address: str | None,
|
||||
) -> dict[str, str | bool]:
|
||||
# BT Panel tmp_token is a one-time login link. Do not cache successful
|
||||
# URLs: a repeated request after the user opens the link could receive
|
||||
# an already-consumed token. Redis lock still prevents concurrent
|
||||
# workers from creating tokens at the same time and invalidating each other.
|
||||
try:
|
||||
async with login_url_lock(server_id):
|
||||
return await self._create_login_url_fresh(
|
||||
server_id,
|
||||
admin_username=admin_username,
|
||||
ip_address=ip_address,
|
||||
)
|
||||
except Exception as exc:
|
||||
await self._audit_login_url_failure(
|
||||
server_id,
|
||||
admin_username=admin_username,
|
||||
ip_address=ip_address,
|
||||
error=exc.__class__.__name__,
|
||||
)
|
||||
raise
|
||||
```
|
||||
|
||||
关键变化：
|
||||
|
||||
- 成功 URL 不缓存。
|
||||
- 所有一键登录请求进入 Redis 分布式锁。
|
||||
- 异常统一写 audit，便于排查。
|
||||
|
||||
---
|
||||
|
||||
### 5.3 临时登录 token TTL 固定为 24 小时
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\server\infrastructure\btpanel\constants.py
|
||||
```
|
||||
|
||||
代码：
|
||||
|
||||
```python
|
||||
"""Baota panel integration constants."""
|
||||
|
||||
# Temporary login token/session upper bound in seconds; passed to BT Panel set_temp_login expire_time.
|
||||
BT_TEMP_LOGIN_TTL_SECONDS = 86400
|
||||
|
||||
# Login URL success results are intentionally not cached: BT Panel tmp_token is one-time.
|
||||
# Concurrent generation is guarded by the Redis distributed lock in login_url_lock.py.
|
||||
```
|
||||
|
||||
调用点：
|
||||
|
||||
```python
|
||||
expire_time = int(time.time()) + BT_TEMP_LOGIN_TTL_SECONDS
|
||||
client = BtPanelClient(creds, server.id)
|
||||
data = await client.post(
|
||||
"/config?action=set_temp_login",
|
||||
{"expire_time": expire_time},
|
||||
)
|
||||
```
|
||||
|
||||
效果：
|
||||
|
||||
- Nexus 调宝塔 `set_temp_login` 时传入 24 小时绝对过期时间。
|
||||
- 生产实测 `temp_login` 记录 TTL 约 86399 秒。
|
||||
|
||||
---
|
||||
|
||||
### 5.4 API 层把锁超时映射为 409
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\server\api\btpanel.py
|
||||
```
|
||||
|
||||
代码：
|
||||
|
||||
```python
|
||||
def _http_error(exc: Exception) -> HTTPException:
|
||||
if isinstance(exc, ValueError):
|
||||
return HTTPException(status_code=400, detail=str(exc))
|
||||
if isinstance(exc, BtPanelApiError):
|
||||
return HTTPException(status_code=502, detail=str(exc))
|
||||
if isinstance(exc, LoginUrlLockTimeout):
|
||||
return HTTPException(status_code=409, detail=str(exc))
|
||||
if isinstance(exc, RuntimeError):
|
||||
return HTTPException(status_code=502, detail=str(exc))
|
||||
logger.exception("btpanel error")
|
||||
return HTTPException(status_code=500, detail="宝塔操作失败")
|
||||
```
|
||||
|
||||
设计点：
|
||||
|
||||
- 同一服务器一键登录并发过多时，返回 `409 Conflict`。
|
||||
- 前端可以提示“正在生成登录链接，请稍后重试”。
|
||||
- 不返回 500，避免误判成系统异常。
|
||||
|
||||
---
|
||||
|
||||
### 5.5 Nexus bootstrap 自动修复宝塔 session 清理 TTL
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\server\infrastructure\btpanel\ssh_bootstrap.py
|
||||
```
|
||||
|
||||
新增函数：
|
||||
|
||||
```python
|
||||
def ensure_session_cleanup_ttl():
|
||||
# Make Baota session cleanup honor session_timeout.pl instead of a hard-coded 1h.
|
||||
task_path = os.path.join(PANEL_ROOT, "task.py")
|
||||
if not os.path.isfile(task_path):
|
||||
return False
|
||||
with open(task_path, "r", encoding="utf-8") as f:
|
||||
source = f.read()
|
||||
marker = "session_cleanup_timeout = int(public.get_session_timeout() or 86400)"
|
||||
patched_condition = " if f_time > session_cleanup_timeout:\n"
|
||||
if marker in source:
|
||||
if patched_condition not in source:
|
||||
raise RuntimeError("task.py session cleanup patch incomplete")
|
||||
return False
|
||||
anchor = (
|
||||
" s_time = time.time()\n"
|
||||
" f_list = os.listdir(sess_path)\n"
|
||||
" f_num = len(f_list)\n"
|
||||
)
|
||||
replacement = (
|
||||
" s_time = time.time()\n"
|
||||
" session_cleanup_timeout = 86400\n"
|
||||
" try:\n"
|
||||
" session_cleanup_timeout = int(public.get_session_timeout() or 86400)\n"
|
||||
" except Exception:\n"
|
||||
" pass\n"
|
||||
" f_list = os.listdir(sess_path)\n"
|
||||
" f_num = len(f_list)\n"
|
||||
)
|
||||
hard_coded = " if f_time > 3600:\n"
|
||||
anchor_index = source.find(anchor)
|
||||
if anchor_index < 0:
|
||||
raise RuntimeError("task.py session cleanup anchor not found")
|
||||
patched = source[:anchor_index] + replacement + source[anchor_index + len(anchor):]
|
||||
condition_index = patched.find(hard_coded, anchor_index + len(replacement))
|
||||
if condition_index < 0:
|
||||
raise RuntimeError("task.py session cleanup threshold not found")
|
||||
patched = patched[:condition_index] + patched_condition + patched[condition_index + len(hard_coded):]
|
||||
compile(patched, task_path, "exec")
|
||||
original_mode = os.stat(task_path).st_mode & 0o7777
|
||||
backup = task_path + ".nexus-session-ttl.bak"
|
||||
if not os.path.exists(backup):
|
||||
with open(backup, "w", encoding="utf-8") as f:
|
||||
f.write(source)
|
||||
os.chmod(backup, 0o600)
|
||||
tmp = task_path + ".nexus.tmp"
|
||||
with open(tmp, "w", encoding="utf-8") as f:
|
||||
f.write(patched)
|
||||
os.chmod(tmp, original_mode)
|
||||
os.replace(tmp, task_path)
|
||||
return True
|
||||
```
|
||||
|
||||
接入 bootstrap 主流程：
|
||||
|
||||
```python
|
||||
actions = []
|
||||
warnings = []
|
||||
try:
|
||||
if ensure_session_cleanup_ttl():
|
||||
actions.append("patched_session_cleanup_ttl")
|
||||
except Exception as exc:
|
||||
warnings.append(f"session_cleanup_ttl_patch_failed:{exc.__class__.__name__}")
|
||||
```
|
||||
|
||||
返回结果新增 warnings：
|
||||
|
||||
```python
|
||||
emit({
|
||||
"ok": True,
|
||||
"base_url": base,
|
||||
"api_key": token,
|
||||
"actions": actions,
|
||||
"warnings": warnings,
|
||||
"reloaded": bool(actions),
|
||||
"verify_ssl": False,
|
||||
})
|
||||
```
|
||||
|
||||
设计点：
|
||||
|
||||
- **精确匹配**：只匹配 `sess_expire` 中 `s_time/f_list/f_num` 附近的固定片段。
|
||||
- **幂等**：已经包含 `session_cleanup_timeout` 时不重复 patch。
|
||||
- **半补丁检测**：有 marker 但没有新判断时报警。
|
||||
- **备份**：首次修改前备份到 `task.py.nexus-session-ttl.bak`。
|
||||
- **语法校验**：写入前 `compile(patched, task_path, "exec")`。
|
||||
- **权限保留**：新文件保留原 `task.py` mode。
|
||||
- **不阻断 bootstrap**：patch 失败只进 `warnings`，不影响 API token/bootstrap 主流程。
|
||||
|
||||
---
|
||||
|
||||
## 6. 测试改进
|
||||
|
||||
文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\tests\test_btpanel_ssh_bootstrap.py
|
||||
```
|
||||
|
||||
新增测试：
|
||||
|
||||
```python
|
||||
def test_remote_bootstrap_patches_session_cleanup_ttl():
|
||||
from server.infrastructure.btpanel import ssh_bootstrap as mod
|
||||
|
||||
script = mod._REMOTE_SCRIPT
|
||||
assert "patched_session_cleanup_ttl" in script
|
||||
assert "session_cleanup_timeout = int(public.get_session_timeout() or 86400)" in script
|
||||
assert "if f_time > session_cleanup_timeout" in script
|
||||
assert "hard_coded = \" if f_time > 3600:\\n\"" in script
|
||||
assert "compile(patched, task_path, \"exec\")" in script
|
||||
assert "original_mode = os.stat(task_path).st_mode & 0o7777" in script
|
||||
assert "os.chmod(tmp, original_mode)" in script
|
||||
assert ".nexus-session-ttl.bak" in script
|
||||
```
|
||||
|
||||
已做静态验证：
|
||||
|
||||
```text
|
||||
compile ok server\infrastructure\btpanel\ssh_bootstrap.py
|
||||
remote script compile ok
|
||||
compile ok tests\test_btpanel_ssh_bootstrap.py
|
||||
```
|
||||
|
||||
完整 pytest 暂未跑完，原因见第 11 节。
|
||||
|
||||
---
|
||||
|
||||
## 7. 生产热修复：42.193.182.190
|
||||
|
||||
### 7.1 已执行动作
|
||||
|
||||
通过生产 Nexus API 走 SOCKS5：
|
||||
|
||||
```text
|
||||
SOCKS5: 127.0.0.1:10808
|
||||
Nexus API: https://api.synaglobal.vip
|
||||
server_id: 395
|
||||
```
|
||||
|
||||
对目标机执行：
|
||||
|
||||
1. 检查 `/www/server/panel/task.py` 当前逻辑。
|
||||
2. 备份为 `/www/server/panel/task.py.nexus-session-ttl.bak`。
|
||||
3. 修改 session 清理阈值。
|
||||
4. reload 宝塔。
|
||||
5. 回查修改结果和宝塔状态。
|
||||
|
||||
### 7.2 生产执行结果
|
||||
|
||||
执行结果：
|
||||
|
||||
```text
|
||||
exec_status HTTP/1.1 200 OK execution_id 5917
|
||||
status completed exit 0
|
||||
```
|
||||
|
||||
修复前：
|
||||
|
||||
```text
|
||||
998: if f_time > 3600:
|
||||
```
|
||||
|
||||
修复后：
|
||||
|
||||
```text
|
||||
992: session_cleanup_timeout = 86400
|
||||
994: session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
1003: if f_time > session_cleanup_timeout:
|
||||
```
|
||||
|
||||
备份：
|
||||
|
||||
```text
|
||||
backup 600 root:root 61810 2026-07-07 05:08:05 +0800 /www/server/panel/task.py.nexus-session-ttl.bak
|
||||
```
|
||||
|
||||
宝塔状态：
|
||||
|
||||
```text
|
||||
Bt-Panel already running
|
||||
Bt-Task already running
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 生产远程修复脚本模板
|
||||
|
||||
> 注意：以下脚本不包含任何 Nexus 登录凭据。实际执行应通过 Nexus 脚本执行功能或 SSH，在目标机 root/sudo 环境运行。
|
||||
|
||||
```bash
|
||||
set -e
|
||||
P=/www/server/panel/pyenv/bin/python3
|
||||
[ -x "$P" ] || P=/www/server/panel/pyenv/bin/python
|
||||
[ -x "$P" ] || P=python3
|
||||
RESULT_FILE=/tmp/nexus_bt_session_ttl_patch.result
|
||||
rm -f "$RESULT_FILE"
|
||||
|
||||
cat /www/server/panel/data/session_timeout.pl 2>/dev/null | sed 's/^/session_timeout=/' || true
|
||||
sudo grep -n 'session_cleanup_timeout\|if f_time > 3600\|if f_time > session_cleanup_timeout' /www/server/panel/task.py || true
|
||||
|
||||
sudo "$P" - <<'PY'
|
||||
import os
|
||||
import py_compile
|
||||
import stat
|
||||
|
||||
PANEL_ROOT = "/www/server/panel"
|
||||
task_path = os.path.join(PANEL_ROOT, "task.py")
|
||||
result_file = "/tmp/nexus_bt_session_ttl_patch.result"
|
||||
|
||||
with open(task_path, "r", encoding="utf-8") as f:
|
||||
source = f.read()
|
||||
|
||||
marker = "session_cleanup_timeout = int(public.get_session_timeout() or 86400)"
|
||||
patched_condition = " if f_time > session_cleanup_timeout:\n"
|
||||
|
||||
if marker in source:
|
||||
if patched_condition not in source:
|
||||
raise SystemExit("patch_incomplete")
|
||||
result = "already_patched"
|
||||
else:
|
||||
anchor = (
|
||||
" s_time = time.time()\n"
|
||||
" f_list = os.listdir(sess_path)\n"
|
||||
" f_num = len(f_list)\n"
|
||||
)
|
||||
replacement = (
|
||||
" s_time = time.time()\n"
|
||||
" session_cleanup_timeout = 86400\n"
|
||||
" try:\n"
|
||||
" session_cleanup_timeout = int(public.get_session_timeout() or 86400)\n"
|
||||
" except Exception:\n"
|
||||
" pass\n"
|
||||
" f_list = os.listdir(sess_path)\n"
|
||||
" f_num = len(f_list)\n"
|
||||
)
|
||||
hard_coded = " if f_time > 3600:\n"
|
||||
anchor_index = source.find(anchor)
|
||||
if anchor_index < 0:
|
||||
raise SystemExit("anchor_not_found")
|
||||
patched = source[:anchor_index] + replacement + source[anchor_index + len(anchor):]
|
||||
condition_index = patched.find(hard_coded, anchor_index + len(replacement))
|
||||
if condition_index < 0:
|
||||
raise SystemExit("threshold_not_found")
|
||||
patched = patched[:condition_index] + patched_condition + patched[condition_index + len(hard_coded):]
|
||||
|
||||
backup = task_path + ".nexus-session-ttl.bak"
|
||||
if not os.path.exists(backup):
|
||||
with open(backup, "w", encoding="utf-8") as f:
|
||||
f.write(source)
|
||||
os.chmod(backup, 0o600)
|
||||
|
||||
st = os.stat(task_path)
|
||||
tmp = task_path + ".nexus.tmp"
|
||||
with open(tmp, "w", encoding="utf-8") as f:
|
||||
f.write(patched)
|
||||
os.chmod(tmp, stat.S_IMODE(st.st_mode))
|
||||
py_compile.compile(tmp, doraise=True)
|
||||
os.replace(tmp, task_path)
|
||||
result = "patched"
|
||||
|
||||
with open(result_file, "w", encoding="utf-8") as f:
|
||||
f.write(result)
|
||||
print(result)
|
||||
PY
|
||||
|
||||
RESULT=$(cat "$RESULT_FILE")
|
||||
echo "patch_result=$RESULT"
|
||||
|
||||
if [ "$RESULT" = "patched" ]; then
|
||||
sudo /etc/init.d/bt reload || true
|
||||
fi
|
||||
|
||||
sudo grep -n 'session_cleanup_timeout\|if f_time > 3600\|if f_time > session_cleanup_timeout' /www/server/panel/task.py || true
|
||||
sudo stat -c 'backup %a %U:%G %s %y %n' /www/server/panel/task.py.nexus-session-ttl.bak 2>/dev/null || true
|
||||
sudo /etc/init.d/bt status 2>/dev/null || true
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 9. 部署方案
|
||||
|
||||
### 9.1 本地代码部署到 Nexus 生产
|
||||
|
||||
建议流程：
|
||||
|
||||
1. 备份当前生产 Nexus 代码/镜像。
|
||||
2. 合入以下文件变更：
|
||||
|
||||
```text
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/infrastructure/btpanel/constants.py
|
||||
server/application/services/btpanel_service.py
|
||||
server/api/btpanel.py
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
tests/test_btpanel_ssh_bootstrap.py
|
||||
```
|
||||
|
||||
3. 构建后端镜像。
|
||||
4. 发布到生产。
|
||||
5. 重启后端服务。
|
||||
6. 回归测试：
|
||||
|
||||
```http
|
||||
POST /api/btpanel/servers/{server_id}/login-url
|
||||
```
|
||||
|
||||
7. 检查 audit：
|
||||
|
||||
```text
|
||||
action=bt_panel_login_url
|
||||
method=api 或 ssh
|
||||
lock=redis
|
||||
```
|
||||
|
||||
8. 对一台测试机器触发 bootstrap/repair，确认返回：
|
||||
|
||||
```json
|
||||
{
|
||||
"actions": ["patched_session_cleanup_ttl"],
|
||||
"warnings": [],
|
||||
"reloaded": true
|
||||
}
|
||||
```
|
||||
|
||||
或者已修复时：
|
||||
|
||||
```json
|
||||
{
|
||||
"actions": [],
|
||||
"warnings": [],
|
||||
"reloaded": false
|
||||
}
|
||||
```
|
||||
|
||||
### 9.2 对已有机器批量修复
|
||||
|
||||
建议分批执行，不要一次修全部：
|
||||
|
||||
1. 先选 1 台验证。
|
||||
2. 再选 5～10 台。
|
||||
3. 最后批量。
|
||||
|
||||
每台机器执行前检查：
|
||||
|
||||
```bash
|
||||
cat /www/server/panel/data/session_timeout.pl
|
||||
sudo grep -n 'if f_time > 3600\|session_cleanup_timeout' /www/server/panel/task.py
|
||||
```
|
||||
|
||||
执行后检查：
|
||||
|
||||
```bash
|
||||
sudo grep -n 'session_cleanup_timeout\|if f_time > session_cleanup_timeout' /www/server/panel/task.py
|
||||
sudo stat /www/server/panel/task.py.nexus-session-ttl.bak
|
||||
sudo /etc/init.d/bt status
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 10. 回滚方案
|
||||
|
||||
### 10.1 单机宝塔回滚
|
||||
|
||||
如果某台宝塔修复后异常，可以回滚：
|
||||
|
||||
```bash
|
||||
sudo cp -a /www/server/panel/task.py /www/server/panel/task.py.nexus-session-ttl.rollback-copy
|
||||
sudo cp -a /www/server/panel/task.py.nexus-session-ttl.bak /www/server/panel/task.py
|
||||
sudo /etc/init.d/bt reload
|
||||
sudo /etc/init.d/bt status
|
||||
```
|
||||
|
||||
回滚后会恢复宝塔原始 3600 秒 session 清理行为。
|
||||
|
||||
### 10.2 Nexus 代码回滚
|
||||
|
||||
回滚以下逻辑即可：
|
||||
|
||||
- `ssh_bootstrap.py` 中 `ensure_session_cleanup_ttl()` 及调用。
|
||||
- `login_url_lock.py` 及 `create_login_url()` 内 Redis 锁使用。
|
||||
- `constants.py` 中 86400 TTL 如需恢复原值。
|
||||
- `btpanel.py` 对 `LoginUrlLockTimeout` 的 409 映射。
|
||||
|
||||
不建议回滚“不缓存 login URL”的逻辑，因为宝塔 `tmp_token` 是一次性链接，缓存成功 URL 本身有风险。
|
||||
|
||||
---
|
||||
|
||||
## 11. 依赖安装与测试现状
|
||||
|
||||
### 11.1 已创建虚拟环境
|
||||
|
||||
路径：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-pytest-venv
|
||||
```
|
||||
|
||||
Python / pip：
|
||||
|
||||
```text
|
||||
pip 26.0.1
|
||||
python 3.14
|
||||
```
|
||||
|
||||
### 11.2 安装依赖尝试
|
||||
|
||||
用户要求安装：
|
||||
|
||||
```text
|
||||
pytest/sqlalchemy
|
||||
```
|
||||
|
||||
项目依赖文件：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\requirements.txt
|
||||
C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus\requirements-dev.txt
|
||||
```
|
||||
|
||||
尝试 SOCKS5 安装：
|
||||
|
||||
```powershell
|
||||
python -m pip install --proxy socks5://127.0.0.1:10808 -r requirements.txt -r requirements-dev.txt
|
||||
```
|
||||
|
||||
失败原因：
|
||||
|
||||
```text
|
||||
ERROR: Could not install packages due to an OSError: Missing dependencies for SOCKS support.
|
||||
```
|
||||
|
||||
含义：当前 venv 的 pip/requests 缺 `PySocks`，所以不能直接识别 `socks5://`。
|
||||
|
||||
尝试直连安装：
|
||||
|
||||
```powershell
|
||||
python -m pip install -r requirements.txt -r requirements-dev.txt
|
||||
```
|
||||
|
||||
失败原因：
|
||||
|
||||
```text
|
||||
SSLError(SSLEOFError: UNEXPECTED_EOF_WHILE_READING)
|
||||
No matching distribution found for fastapi==0.115.6
|
||||
```
|
||||
|
||||
含义：直连 PyPI SSL 被中断或网络不可用。
|
||||
|
||||
### 11.3 推荐安装方案
|
||||
|
||||
方案 A：如果本机有 HTTP 代理端口，优先用 HTTP 代理安装：
|
||||
|
||||
```powershell
|
||||
$venv = "C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-pytest-venv"
|
||||
$proj = "C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus"
|
||||
& "$venv\Scripts\python.exe" -m pip install --proxy http://127.0.0.1:端口 -r "$proj\requirements.txt" -r "$proj\requirements-dev.txt"
|
||||
```
|
||||
|
||||
方案 B：先离线/手动安装 PySocks，再走 SOCKS5：
|
||||
|
||||
```powershell
|
||||
$venv = "C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-pytest-venv"
|
||||
& "$venv\Scripts\python.exe" -m pip install PySocks
|
||||
& "$venv\Scripts\python.exe" -m pip install --proxy socks5://127.0.0.1:10808 -r requirements.txt -r requirements-dev.txt
|
||||
```
|
||||
|
||||
但 B 的第一步仍需要能联网，所以如果直连不可用，仍建议使用 HTTP 代理或镜像源。
|
||||
|
||||
方案 C：使用国内镜像源：
|
||||
|
||||
```powershell
|
||||
$venv = "C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-pytest-venv"
|
||||
$proj = "C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus"
|
||||
& "$venv\Scripts\python.exe" -m pip install -i https://pypi.tuna.tsinghua.edu.cn/simple -r "$proj\requirements.txt" -r "$proj\requirements-dev.txt"
|
||||
```
|
||||
|
||||
### 11.4 依赖安装成功后运行测试
|
||||
|
||||
```powershell
|
||||
$venv = "C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-pytest-venv"
|
||||
$proj = "C:\Users\uzuma\Desktop\1111\nexus-transfer-20260706\Nexus"
|
||||
cd $proj
|
||||
$env:PYTHONDONTWRITEBYTECODE = "1"
|
||||
& "$venv\Scripts\python.exe" -m pytest tests/test_btpanel_ssh_bootstrap.py tests/test_btpanel_temp_login_ttl.py tests/test_btpanel_login_url.py -q
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 12. 代码审查结果
|
||||
|
||||
### 12.1 已解决风险
|
||||
|
||||
| 风险 | 原状态 | 改进后 |
|
||||
|---|---|---|
|
||||
| 宝塔 tmp_token 一次性 URL 被缓存 | 可能返回已消费 token | 不缓存成功 login URL |
|
||||
| 多 worker 并发生成 token | 可能互相覆盖/失效 | Redis per-server lock |
|
||||
| token TTL 太短 | 已确认不是短 TTL，但需固定 | 统一 86400 秒 |
|
||||
| 宝塔 session 文件 3600 秒硬清 | 1～2 小时刷新掉线 | 跟随 session_timeout.pl |
|
||||
| 宝塔 task.py 误改风险 | 直接替换可能误伤 | 精确 anchor + 语法校验 |
|
||||
| 远程修复不可回滚 | 无备份风险 | `.nexus-session-ttl.bak` 备份 |
|
||||
| 文件权限变化 | 可能破坏宝塔运行 | 保留原 task.py mode |
|
||||
| bootstrap patch 失败影响主流程 | 可能导致 API 配置失败 | warning，不阻断主 bootstrap |
|
||||
|
||||
### 12.2 剩余注意事项
|
||||
|
||||
1. **宝塔升级可能覆盖 `task.py`**
|
||||
- 升级后需要重新触发 Nexus bootstrap/repair 或批量修复。
|
||||
|
||||
2. **当前不是永久登录**
|
||||
- 当前按 `session_timeout.pl=86400`，约 24 小时。
|
||||
- 如果想更久，需要调大宝塔 `session_timeout.pl`，并接受安全风险。
|
||||
|
||||
3. **reload 宝塔可能让当前面板短暂重连**
|
||||
- 单台修复时影响较小。
|
||||
- 批量修复建议低峰执行。
|
||||
|
||||
4. **Redis 必须可用**
|
||||
- `login_url_lock` 不做不安全 fallback。
|
||||
- Redis 故障时一键登录会失败，避免并发隐患静默放大。
|
||||
|
||||
---
|
||||
|
||||
## 13. 验证清单
|
||||
|
||||
### 13.1 立即验证
|
||||
|
||||
对 `42.193.182.190`：
|
||||
|
||||
```bash
|
||||
sudo grep -n 'session_cleanup_timeout\|if f_time > session_cleanup_timeout' /www/server/panel/task.py
|
||||
sudo stat /www/server/panel/task.py.nexus-session-ttl.bak
|
||||
sudo /etc/init.d/bt status
|
||||
```
|
||||
|
||||
期望：
|
||||
|
||||
```text
|
||||
session_cleanup_timeout = 86400
|
||||
session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
if f_time > session_cleanup_timeout
|
||||
Bt-Panel running
|
||||
Bt-Task running
|
||||
```
|
||||
|
||||
### 13.2 业务验证
|
||||
|
||||
1. Nexus 一键登录 `42.193.182.190`。
|
||||
2. 同时打开 10 个宝塔页面。
|
||||
3. 等待 2 小时。
|
||||
4. 刷新页面。
|
||||
5. 期望：不再因为 3600 秒 session 清理导致掉线。
|
||||
|
||||
### 13.3 24 小时边界验证
|
||||
|
||||
如果需要验证 24 小时边界：
|
||||
|
||||
- 24 小时内刷新应保持登录。
|
||||
- 超过 `session_timeout.pl` 后刷新可能要求重新登录，这是预期行为。
|
||||
|
||||
---
|
||||
|
||||
## 14. 最终结论
|
||||
|
||||
本次修复后，`42.193.182.190` 的“宝塔一键登录后 1～2 小时刷新掉线”问题已针对根因修复：
|
||||
|
||||
```text
|
||||
宝塔 task.py 不再硬编码 3600 秒清理 session，改为跟随 session_timeout.pl。
|
||||
```
|
||||
|
||||
Nexus 后端也已补上长期改进：
|
||||
|
||||
```text
|
||||
不缓存一次性登录 URL
|
||||
+ Redis 分布式锁串行化同一服务器登录 URL 生成
|
||||
+ 24 小时 temp_login TTL
|
||||
+ bootstrap 自动修复宝塔 session 清理 TTL
|
||||
+ audit/warnings 可观测
|
||||
```
|
||||
|
||||
建议下一步：
|
||||
|
||||
1. 安装 Python 测试依赖并跑相关 pytest。
|
||||
2. 把本地 Nexus 改动发布到生产。
|
||||
3. 对其它宝塔机器分批执行同类修复。
|
||||
4. 加一个周期性巡检：检测 `task.py` 是否被宝塔升级覆盖。
|
||||
@@ -0,0 +1,91 @@
|
||||
# 宝塔批量 Session 巡检共性分析（2026-07-07）
|
||||
|
||||
数据来源：`work/bt_bulk_session_audit.jsonl` + `work/bulk_servers_list.json`。本次为离线聚合分析，未重新 SSH 扫描服务器。
|
||||
|
||||
## 总体
|
||||
|
||||
在线巡检记录：420 台。
|
||||
|
||||
| 分类 | 数量 |
|
||||
|---|---:|
|
||||
| Alibaba Cloud Linux / OpenAnolis | 200 |
|
||||
| Ubuntu | 155 |
|
||||
| Debian | 65 |
|
||||
|
||||
## hardcoded_3600 的 148 台
|
||||
|
||||
结论：不是 Ubuntu 为主，不全是 Ubuntu。
|
||||
|
||||
| OS | 数量 |
|
||||
|---|---:|
|
||||
| Alibaba Cloud Linux / OpenAnolis | 77 |
|
||||
| Debian 12 bookworm | 43 |
|
||||
| Ubuntu | 28 |
|
||||
|
||||
更细：
|
||||
|
||||
| 版本 | 数量 |
|
||||
|---|---:|
|
||||
| Alibaba Cloud Linux 4.0.3 | 49 |
|
||||
| Debian GNU/Linux 12 bookworm | 43 |
|
||||
| Ubuntu 24.04.4 LTS | 25 |
|
||||
| Alibaba Cloud Linux 3.2104 U12.2 | 21 |
|
||||
| Alibaba Cloud Linux 3.2104 U12.3 | 6 |
|
||||
| Ubuntu 24.04.3 LTS | 3 |
|
||||
| Alibaba Cloud Linux 3.2104 U12.1 | 1 |
|
||||
|
||||
共性：
|
||||
|
||||
- 148 台全部 `panel_ssl=1`。
|
||||
- 148 台全部 `check_client_hash=1`。
|
||||
- 148 台全部 `session_timeout=86400`，说明配置值存在。
|
||||
- 但 `task.py` 仍匹配到硬编码清理逻辑 `f_time > 3600`，所以属于“配置是 86400，但清理代码仍按 3600 秒删 session”的类型。
|
||||
- 主机名分布：阿里云风格 `iZ*` 114 台，腾讯云风格 `VM-*` 34 台。
|
||||
|
||||
## 未开启面板 SSL 的 112 台
|
||||
|
||||
结论：这批基本是 Ubuntu，但不是 100%。
|
||||
|
||||
| OS | 数量 |
|
||||
|---|---:|
|
||||
| Ubuntu | 104 |
|
||||
| Alibaba Cloud Linux / OpenAnolis | 5 |
|
||||
| Debian | 3 |
|
||||
|
||||
更细：
|
||||
|
||||
| 版本 | 数量 |
|
||||
|---|---:|
|
||||
| Ubuntu 24.04.4 LTS | 104 |
|
||||
| Alibaba Cloud Linux 3.2104 U12.3 | 4 |
|
||||
| Debian GNU/Linux 12 bookworm | 3 |
|
||||
| Alibaba Cloud Linux 3.2104 U13 | 1 |
|
||||
|
||||
共性：
|
||||
|
||||
- 112 台全部 `panel_ssl=0`。
|
||||
- 111 台是 `unknown_task_pattern`，1 台 `no_panel`。
|
||||
- 105 台 `session_timeout=missing_default_86400`。
|
||||
- 105 台 `check_client_hash=0`。
|
||||
- 主机名分布：腾讯云风格 `VM-*` 98 台，阿里云风格 `iZ*` 7 台，其它自定义主机名 7 台。
|
||||
|
||||
## 关键关系
|
||||
|
||||
`hardcoded_3600` 和 `panel_ssl=0` 当前没有重叠：
|
||||
|
||||
| 组合 | 数量 |
|
||||
|---|---:|
|
||||
| hardcoded_3600 且 panel_ssl=0 | 0 |
|
||||
| hardcoded_3600 且 panel_ssl=1 | 148 |
|
||||
| unknown_task_pattern 且 panel_ssl=0 | 111 |
|
||||
|
||||
所以这不是同一类问题：
|
||||
|
||||
1. `hardcoded_3600`：主要是宝塔 session 清理代码硬编码 3600 秒，且面板 SSL 已开启。
|
||||
2. `panel_ssl=0`：主要是 Ubuntu 24.04.4 + 腾讯云 VM-* 这一批，面板未开 SSL，且 task.py 代码模式与前一批不同，需要抽样后分类修。
|
||||
|
||||
## 处理建议
|
||||
|
||||
1. 先处理 148 台 `hardcoded_3600`：备份 `/www/server/panel/task.py` 后把 3600 秒硬编码改成读取 `public.get_session_timeout()`，这批模式清晰。
|
||||
2. 对 112 台 `panel_ssl=0` 不要套同一个 patch；先抽样 5~10 台看 `task.py` 与 `public.py/check_client_hash` 版本差异。
|
||||
3. `panel_ssl=0` 是否要统一开启 SSL，是策略问题，不建议默认自动改；需要单独定方案。
|
||||
@@ -0,0 +1,138 @@
|
||||
# Nexus 宝塔批量 Session 巡检报告 - 2026-07-07
|
||||
|
||||
- 总服务器数：467
|
||||
- 在线目标数：420
|
||||
- 巡检结果数：420
|
||||
|
||||
## task.py session 清理状态统计
|
||||
- `error`: 2
|
||||
- `no_panel`: 1
|
||||
- `patched_timeout`: 149
|
||||
- `unknown_task_pattern`: 268
|
||||
|
||||
## 面板 SSL 状态统计
|
||||
- `panel_ssl=0`: 112
|
||||
- `panel_ssl=1`: 306
|
||||
- `panel_ssl=None`: 2
|
||||
|
||||
## 需要修复 `task.py 3600` 的机器：0
|
||||
|
||||
| server_id | domain | task_state | session_timeout | panel_ssl |
|
||||
|---:|---|---|---|---:|
|
||||
|
||||
## 未开启面板 SSL 的宝塔机器：112
|
||||
|
||||
| server_id | domain | task_state | session_timeout | panel_ssl |
|
||||
|---:|---|---|---|---:|
|
||||
| 508 | 119.29.98.54 | no_panel | missing_default_86400 | 0 |
|
||||
| 509 | 43.139.95.214 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 505 | 42.193.140.122 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 506 | 111.230.27.20 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 507 | 106.55.44.161 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 503 | 111.230.71.100 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 504 | 134.175.126.92 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 510 | 159.75.154.203 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 489 | 139.199.59.208 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 490 | 119.91.117.54 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 467 | 111.230.90.201 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 468 | 119.29.80.171 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 453 | 119.29.114.23 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 454 | 175.178.40.17 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 452 | 43.139.143.211 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 449 | 1.12.47.125 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 450 | 106.55.22.208 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 451 | 134.175.227.87 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 448 | 43.138.249.111 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 447 | 122.152.235.93 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 446 | 42.193.252.88 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 445 | 134.175.67.244 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 430 | 20.2.235.101 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 443 | 42.193.214.33 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 436 | 106.52.242.218 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 431 | 193.112.70.74 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 432 | 43.139.133.179 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 435 | 139.199.72.167 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 433 | 119.91.195.218 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 429 | 43.138.248.173 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 444 | 159.75.29.226 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 428 | 123.207.4.3 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 422 | 104.214.187.235 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 434 | 42.194.204.225 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 424 | 159.75.203.210 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 426 | 42.194.226.62 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 425 | 119.29.93.168 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 427 | 106.52.179.21 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 418 | 106.53.75.192 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 417 | 119.91.139.218 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 416 | 42.193.200.77 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 414 | 42.193.186.43 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 415 | 114.132.210.151 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 406 | 20.189.126.177 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 404 | 104.214.176.182 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 403 | 40.81.22.70 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 412 | 1.14.141.27 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 411 | 119.29.18.166 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 410 | 43.138.205.6 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 413 | 159.75.108.190 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 401 | 119.91.225.50 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 400 | 106.53.183.89 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 409 | 111.230.28.100 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 398 | 114.132.95.88 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 397 | 139.199.84.10 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 395 | 42.193.182.190 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 394 | 119.91.108.108 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 399 | 139.199.172.228 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 393 | 119.91.254.157 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 388 | 139.199.19.233 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 381 | 20.239.6.127 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 389 | 106.55.92.145 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 387 | 118.126.97.140 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 385 | 42.193.180.53 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 386 | 123.207.39.88 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 396 | 175.178.110.156 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 370 | 52.184.87.139 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 352 | 118.195.145.210 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 351 | 119.45.120.154 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 346 | 119.91.56.90 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 345 | 43.138.141.171 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 343 | 43.139.22.128 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 344 | 119.29.20.35 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 342 | 124.220.63.74 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 341 | 115.159.225.242 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 336 | 119.91.193.11 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 337 | 106.55.106.122 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 338 | 193.112.168.105 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 335 | 43.136.17.135 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 306 | 139.199.186.231 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 305 | 175.178.234.26 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 304 | 129.204.131.206 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 300 | 118.126.97.2 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 296 | 1.12.55.146 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 299 | 134.175.220.13 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 295 | 175.178.3.33 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 303 | 159.75.74.94 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 279 | 42.193.183.168 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 280 | 43.136.121.184 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 273 | 159.75.14.33 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 265 | 106.55.172.50 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 260 | 106.52.124.36 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 258 | 81.71.154.172 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 259 | 134.175.237.241 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 256 | 114.132.46.237 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 255 | 119.91.37.28 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 254 | 42.193.215.87 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 257 | 43.136.98.34 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 253 | 43.139.204.116 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 246 | 43.136.118.134 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 245 | 193.112.191.239 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 218 | 118.31.51.101 | unknown_task_pattern | 86400 | 0 |
|
||||
| 175 | 8.163.42.25 | unknown_task_pattern | 86400 | 0 |
|
||||
| 168 | 39.108.112.104 | unknown_task_pattern | 86400 | 0 |
|
||||
| 167 | 120.76.53.162 | unknown_task_pattern | 86400 | 0 |
|
||||
| 147 | 119.29.250.198 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 148 | 42.194.218.55 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 136 | 119.91.140.22 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 135 | 159.75.238.16 | unknown_task_pattern | missing_default_86400 | 0 |
|
||||
| 123 | 47.106.77.23 | unknown_task_pattern | 86400 | 0 |
|
||||
| 112 | 39.108.77.77 | unknown_task_pattern | 86400 | 0 |
|
||||
| 117 | 8.163.108.1 | unknown_task_pattern | 86400 | 0 |
|
||||
@@ -0,0 +1,425 @@
|
||||
# Nexus 宝塔长期掉线修复与测试部署记录（2026-07-07）
|
||||
|
||||
## 1. 当前结论
|
||||
|
||||
本轮重点处理的是：宝塔面板“一键登录成功后，多个面板同时打开，约 1-2 小时后刷新陆续掉线”的问题。
|
||||
|
||||
当前状态：
|
||||
|
||||
- Nexus 测试部署机：`192.168.124.219`
|
||||
- Nexus 项目目录：`/opt/nexus-dev-current`
|
||||
- Git 分支：`audit/security-review`
|
||||
- 最新提交：`99edd30 chore: default compose ports for nexus test deploy`
|
||||
- 宝塔长期会话修复提交：`a538358 fix: keep bt panel sessions alive after one-click login`
|
||||
- Docker 服务已恢复：
|
||||
- Nexus：`0.0.0.0:18600 -> 8600`
|
||||
- MySQL：`0.0.0.0:13306 -> 3306`
|
||||
- Redis：`0.0.0.0:16379 -> 6379`
|
||||
- Health check：`http://127.0.0.1:18600/health` 返回 `ok`
|
||||
- 容器内确认补丁已生效：
|
||||
- `_SESSION_CLEANUP_TTL_CHECK_SECONDS = 86400`
|
||||
- `_SESSION_CLEANUP_TTL_FAILED_RETRY_SECONDS = 3600`
|
||||
|
||||
---
|
||||
|
||||
## 2. 用户现象与根因判断
|
||||
|
||||
用户反馈：
|
||||
|
||||
> 不是登录失败，是登录宝塔以后几个小时后自动退出；一键登录同时打开 10 个宝塔，过 2 个小时陆续掉；刷新就掉线。
|
||||
|
||||
这个现象不像是 Nexus 生成登录 URL 失败，也不像 tmp_token 本身立即失效。更符合下面链路：
|
||||
|
||||
1. Nexus 一键登录宝塔时生成临时登录 token。
|
||||
2. 用户成功进入宝塔面板。
|
||||
3. 之后是否持续在线，取决于宝塔面板内部 session 过期/清理逻辑。
|
||||
4. 如果宝塔面板仍然按老逻辑清理 session，例如 `task.py` 中固定 `if f_time > 3600:`，那么即使 Nexus 生成的 tmp_token TTL 是 86400 秒，登录后的 session 仍可能在约 1 小时左右被宝塔清理。
|
||||
5. 用户刷新页面时，宝塔发现 session 已被清理，于是表现为掉线。
|
||||
|
||||
因此，本轮修复重点不是“能不能生成一键登录 URL”，而是：
|
||||
|
||||
- 确保已配置过宝塔 API 的服务器，也会在一键登录前做一次 session cleanup TTL 检查/修复。
|
||||
- 避免老服务器因为已经配置过 API 而跳过 bootstrap，导致宝塔 session 清理阈值仍停留在 3600 秒。
|
||||
|
||||
---
|
||||
|
||||
## 3. 本次代码改动摘要
|
||||
|
||||
### 3.1 `server/application/services/btpanel_service.py`
|
||||
|
||||
新增/调整逻辑：
|
||||
|
||||
- 新增检查周期：
|
||||
- `_SESSION_CLEANUP_TTL_CHECK_SECONDS = 24 * 3600`
|
||||
- `_SESSION_CLEANUP_TTL_FAILED_RETRY_SECONDS = 3600`
|
||||
- 在 `create_login_url()` / `_create_login_url_fresh()` 的一键登录链路中，针对已经配置过宝塔 API 的服务器，也会 best-effort 触发 session cleanup TTL 检查。
|
||||
- 检查成功后 24 小时内不重复检查。
|
||||
- 检查失败后 1 小时内不反复重试，避免频繁 SSH。
|
||||
- 无 SSH 授权、缺中心 IP、SSH 失败时，不阻断用户登录，只记录状态。
|
||||
|
||||
### 3.2 `server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
|
||||
增强宝塔 bootstrap 输出：
|
||||
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_patched`
|
||||
- warnings 中记录 patch 失败或异常信息。
|
||||
|
||||
宝塔侧修复目标是将固定 3600 秒清理逻辑改成读取面板 session timeout：
|
||||
|
||||
```python
|
||||
session_cleanup_timeout = int(public.get_session_timeout() or 86400)
|
||||
if f_time > session_cleanup_timeout:
|
||||
...
|
||||
```
|
||||
|
||||
### 3.3 `server/infrastructure/btpanel/bootstrap_state.py`
|
||||
|
||||
公开并记录 session cleanup 状态字段：
|
||||
|
||||
- `bootstrap_last_warnings`
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_checked_at`
|
||||
- `session_cleanup_ttl_last_error`
|
||||
- `session_cleanup_ttl_patched`
|
||||
|
||||
这些字段方便后续在后端/前端展示每台宝塔服务器是否已经做过长期 session 修复。
|
||||
|
||||
### 3.4 `tests/test_btpanel_login_url.py`
|
||||
|
||||
新增测试：
|
||||
|
||||
- 已配置宝塔 API 的服务器，一键登录前会执行一次 session cleanup TTL 检查。
|
||||
- 第二次一键登录不会在 24 小时窗口内重复执行。
|
||||
- 登录 URL 仍然是 fresh 生成，不缓存一次性 URL。
|
||||
|
||||
### 3.5 `docker-compose.yml`
|
||||
|
||||
新增防复发修复：
|
||||
|
||||
- 默认 MySQL 发布端口从 `3306` 改为 `13306`。
|
||||
- 默认 Redis 发布端口从 `6379` 改为 `16379`。
|
||||
- 默认 Nexus 发布端口从 `8600` 改为 `18600`。
|
||||
- 默认 CORS/API base 改到 `18600`。
|
||||
- Usage 注释改成推荐：
|
||||
|
||||
```bash
|
||||
docker compose --env-file docker/.env up -d --build
|
||||
```
|
||||
|
||||
修复原因：Docker Compose 的 `env_file` 只会传给容器环境，不一定参与 compose 变量插值；如果忘记 `--env-file docker/.env`，端口会落回默认值。之前默认值是 `3306/6379/8600`，会和测试机上的宝塔 Redis 等服务冲突。
|
||||
|
||||
---
|
||||
|
||||
## 4. 宝塔一键登录调用链
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
UI["前端：一键登录按钮"] --> API["POST /api/btpanel/servers/{server_id}/login-url"]
|
||||
API --> SVC["BtPanelService.create_login_url"]
|
||||
SVC --> LOCK["Redis login_url_lock(server_id)"]
|
||||
LOCK --> FRESH["_create_login_url_fresh"]
|
||||
FRESH --> CHECK["_ensure_session_cleanup_ttl_for_login"]
|
||||
CHECK --> NEEDSSH{"需要/允许 SSH 检查?"}
|
||||
NEEDSSH -- "否" --> APIURL["_try_login_url_via_api"]
|
||||
NEEDSSH -- "是" --> SSHBOOT["ssh_bootstrap_panel"]
|
||||
SSHBOOT --> PATCH["ensure_session_cleanup_ttl patch 宝塔 task.py"]
|
||||
PATCH --> STATE["apply_bootstrap_success 写入 extra_attrs.bt_panel"]
|
||||
STATE --> APIURL
|
||||
APIURL --> BTAPI["宝塔 API: /config?action=set_temp_login"]
|
||||
BTAPI --> TOKEN["生成 tmp_token, TTL 86400"]
|
||||
TOKEN --> RESOLVE["resolve_temp_login_url"]
|
||||
RESOLVE --> URL["返回登录 URL"]
|
||||
APIURL -- "API 不可用" --> SSHLOGIN["ssh_temp_login_url fallback"]
|
||||
SSHLOGIN --> URL
|
||||
```
|
||||
|
||||
关键点：
|
||||
|
||||
- Redis lock 防止同一台服务器并发点击互相覆盖 tmp_token。
|
||||
- tmp_token TTL 是 86400 秒。
|
||||
- 本次补上的是“登录后 session cleanup TTL”的检查，解决成功进入宝塔后过一段时间刷新掉线的问题。
|
||||
|
||||
---
|
||||
|
||||
## 5. 已验证测试
|
||||
|
||||
在测试机 `/opt/nexus-dev-current` 上通过：
|
||||
|
||||
```bash
|
||||
.venv/bin/python -m pytest tests/test_btpanel_login_url.py tests/test_btpanel_temp_login_ttl.py tests/test_btpanel_ssh_bootstrap.py -q
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
25 passed
|
||||
```
|
||||
|
||||
完整后端测试：
|
||||
|
||||
```bash
|
||||
.venv/bin/python -m pytest -q
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
728 passed, 1 skipped
|
||||
```
|
||||
|
||||
运行容器验证：
|
||||
|
||||
```text
|
||||
Nexus health: ok
|
||||
SESSION_CLEANUP_TTL_CHECK_SECONDS: 86400
|
||||
FAILED_RETRY_SECONDS: 3600
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. 测试机 Docker 状态
|
||||
|
||||
当前容器状态：
|
||||
|
||||
```text
|
||||
nexus-nexus-1 Up healthy 0.0.0.0:18600->8600/tcp
|
||||
nexus-mysql-1 Up healthy 0.0.0.0:13306->3306/tcp
|
||||
nexus-redis-1 Up healthy 0.0.0.0:16379->6379/tcp
|
||||
```
|
||||
|
||||
宿主机宝塔 Redis：
|
||||
|
||||
```text
|
||||
127.0.0.1:6379
|
||||
```
|
||||
|
||||
已避免 Nexus Redis 占用宿主机 `6379`。
|
||||
|
||||
---
|
||||
|
||||
## 7. Docker 镜像构建代理问题
|
||||
|
||||
本轮执行 `docker compose --env-file docker/.env up -d --build` 时，Docker build 阶段失败过一次：
|
||||
|
||||
```text
|
||||
proxyconnect tcp: dial tcp 127.0.0.1:10808: connect: connection refused
|
||||
```
|
||||
|
||||
原因：测试机上的 Docker daemon 使用了 `127.0.0.1:10808` 代理；但这里的 `127.0.0.1` 指的是 Linux 测试机自己，不是 Windows 主机。如果 Linux 测试机本地没有运行代理服务，Docker 就无法通过这个地址拉镜像。
|
||||
|
||||
本轮恢复方式：
|
||||
|
||||
- 使用测试机已有的本地镜像 `nexus-nexus:latest`。
|
||||
- 执行 `docker compose --env-file docker/.env up -d --no-build` 恢复服务。
|
||||
- 容器内确认代码已经包含本次宝塔长期会话修复。
|
||||
|
||||
后续建议二选一：
|
||||
|
||||
1. 在 Linux 测试机本地启动可用代理，并确保 Docker daemon 能访问。
|
||||
2. 不使用 `127.0.0.1:10808`，改成测试机能访问的局域网代理地址，或者直接使用可用 Docker registry mirror。
|
||||
|
||||
---
|
||||
|
||||
## 8. 回滚方案
|
||||
|
||||
如需回滚本次宝塔长期会话修复：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
git revert a538358
|
||||
```
|
||||
|
||||
如需只回滚 compose 默认端口防复发修复：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
git revert 99edd30
|
||||
```
|
||||
|
||||
恢复部署推荐命令：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
docker compose --env-file docker/.env up -d --no-build
|
||||
```
|
||||
|
||||
如果镜像代理问题已解决，再使用：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
docker compose --env-file docker/.env up -d --build
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 9. 仍需关注的边界问题
|
||||
|
||||
1. `_ensure_session_cleanup_ttl_for_login()` 复用了 `ssh_bootstrap_panel()`，会同时检查/修复宝塔 API token、IP 白名单和 session cleanup TTL。
|
||||
- 优点：能顺便修复 API 白名单漂移。
|
||||
- 风险：首次检查会增加一次 SSH 耗时。
|
||||
|
||||
2. `_server_has_ssh_auth()` 对 preset 的判断偏粗，只看配置里是否存在 preset id。
|
||||
- 后续安全巡检要确认 preset 缺失、失效、被删时是否降级得足够安全。
|
||||
|
||||
3. `apply_bootstrap_success()` 现在也可能把 session cleanup 维护检查计入 `bootstrap_attempts`。
|
||||
- 如果后续要精细统计，可以拆出单独的 maintenance check counter。
|
||||
|
||||
4. Docker build 代理配置需要单独治理。
|
||||
- 当前运行服务没问题，但未来如果要重新 build，需要先修 Docker daemon 代理或镜像源。
|
||||
|
||||
---
|
||||
|
||||
## 10. 后续安全巡检计划
|
||||
|
||||
### 阶段 1：宝塔登录链路复审
|
||||
|
||||
- [x] 一键登录 tmp_token TTL 检查
|
||||
- [x] Redis per-server lock 检查
|
||||
- [x] 已配置 API 老服务器跳过 bootstrap 的边界修复
|
||||
- [x] session cleanup TTL 检查/修复
|
||||
- [x] 单测与完整后端测试
|
||||
- [x] Docker 测试机运行验证
|
||||
|
||||
### 阶段 2：SSH / 命令执行风险巡检
|
||||
|
||||
重点文件：
|
||||
|
||||
- `server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
- `server/infrastructure/btpanel/ssh_login.py`
|
||||
- `server/application/services/server_file_transfer_service.py`
|
||||
- `server/infrastructure/ssh/*`
|
||||
|
||||
检查项：
|
||||
|
||||
- 是否存在 shell 注入风险。
|
||||
- 是否所有远程命令都有 timeout。
|
||||
- 是否所有用户输入进入命令前都做 quote/escape。
|
||||
- 是否有敏感信息进入日志。
|
||||
- 是否有 sudo / root 权限边界问题。
|
||||
|
||||
### 阶段 3：API 鉴权与权限边界巡检
|
||||
|
||||
重点：
|
||||
|
||||
- `server/api/*.py`
|
||||
- 依赖注入中的 `Depends` / 当前用户获取逻辑
|
||||
- API key / session / CSRF / CORS
|
||||
|
||||
检查项：
|
||||
|
||||
- 是否存在未鉴权管理接口。
|
||||
- 是否存在越权访问其他服务器资源。
|
||||
- 是否存在批量操作缺少权限校验。
|
||||
- CORS 是否过宽。
|
||||
|
||||
### 阶段 4：数据库与敏感字段巡检
|
||||
|
||||
重点：
|
||||
|
||||
- `server/models/*`
|
||||
- `server/repositories/*`
|
||||
- `server/application/services/*`
|
||||
|
||||
检查项：
|
||||
|
||||
- 密码、token、key 是否加密存储。
|
||||
- 查询是否存在 SQL 注入风险。
|
||||
- extra_attrs 是否可能被污染或写入不可控结构。
|
||||
- 数据迁移是否兼容老数据。
|
||||
|
||||
### 阶段 5：Redis / 锁 / 并发巡检
|
||||
|
||||
重点：
|
||||
|
||||
- 登录 URL 锁
|
||||
- bootstrap 锁
|
||||
- 批量 bootstrap 并发
|
||||
- 缓存失效策略
|
||||
|
||||
检查项：
|
||||
|
||||
- 锁 TTL 是否足够。
|
||||
- 异常时锁是否释放。
|
||||
- 并发点击是否导致 token 覆盖。
|
||||
- 多 worker/多容器下是否一致。
|
||||
|
||||
---
|
||||
|
||||
## 11. 当前建议
|
||||
|
||||
短期：
|
||||
|
||||
1. 用当前部署继续测试“一键登录同时打开 10 个宝塔，2 小时后刷新是否还掉线”。
|
||||
2. 优先测试之前最容易掉线的服务器，例如用户提到的 `42.193.182.190`。
|
||||
3. 如果仍掉线，下一步要查看该目标宝塔机器的 session cleanup patch 状态字段，而不是只看 Nexus 登录 URL 是否生成成功。
|
||||
|
||||
中期：
|
||||
|
||||
1. 修 Docker daemon 代理，保证以后可稳定 `--build`。
|
||||
2. 把 session cleanup 状态展示到 Nexus 后台，方便看到每台宝塔是否已修复。
|
||||
3. 继续做 SSH/API/DB/Redis 安全巡检。
|
||||
|
||||
---
|
||||
|
||||
## 12. SSH/文件管理安全巡检阶段 1 补充（2026-07-07）
|
||||
|
||||
用户已确认：`script_service` 是设计内“管理员远程执行命令”能力，天然允许任意 shell，不作为漏洞修复项。后续仅检查其鉴权、审计、敏感信息日志边界。
|
||||
|
||||
本轮继续修复非脚本服务的命令参数边界：
|
||||
|
||||
- `112e617 fix: stop archive option injection via filenames`
|
||||
- `remote_archive.py` 的 tar/zip 压缩命令增加 `--` 参数终止符。
|
||||
- `bcec78f fix: harden file manager shell operations`
|
||||
- 文件管理 `rm/mv/mkdir/cp` 命令增加 `--` 参数终止符。
|
||||
- 递归 chmod/chown 禁止关键系统目录子树，例如 `/etc/nginx`、`/usr/*`、`/var/log/*`。
|
||||
- 仍允许常见 Web 根目录，例如 `/www/wwwroot/site`、`/var/www/html`。
|
||||
|
||||
验证：
|
||||
|
||||
```text
|
||||
pytest tests/test_file_permissions.py tests/test_schema_path_validators.py tests/test_remote_archive_commands.py -q
|
||||
22 passed in 0.54s
|
||||
|
||||
pytest -q
|
||||
733 passed, 1 skipped in 11.77s
|
||||
```
|
||||
|
||||
运行容器已热更新并重启，`http://127.0.0.1:18600/health` 返回 `ok`。
|
||||
|
||||
---
|
||||
|
||||
## 13. SSH/文件管理安全巡检阶段 2：安全解压（2026-07-07）
|
||||
|
||||
新增提交：
|
||||
|
||||
```text
|
||||
845d7e2 fix: validate remote archives before extraction
|
||||
```
|
||||
|
||||
修复内容：
|
||||
|
||||
- `/api/sync/decompress` 不再直接执行 `tar xzf` / `unzip -o`。
|
||||
- 新增 `run_remote_decompress()`：先列归档成员，再校验，再解压。
|
||||
- 拒绝归档内部：
|
||||
- 绝对路径，例如 `/etc/passwd`
|
||||
- 路径穿越，例如 `../evil.txt`
|
||||
- Windows 反斜杠路径，例如 `dir\evil.txt`
|
||||
- 符号链接、硬链接、设备文件、FIFO、socket
|
||||
- tar 解压增加：
|
||||
|
||||
```bash
|
||||
tar --no-same-owner --no-same-permissions -xzf <archive> -C <dest>
|
||||
```
|
||||
|
||||
验证：
|
||||
|
||||
```text
|
||||
pytest tests/test_remote_archive_commands.py tests/test_schema_path_validators.py tests/test_file_permissions.py -q
|
||||
31 passed in 0.55s
|
||||
|
||||
pytest -q
|
||||
742 passed, 1 skipped in 11.83s
|
||||
```
|
||||
|
||||
运行容器已热更新并重启，`http://127.0.0.1:18600/health` 返回 `ok`。
|
||||
@@ -0,0 +1,123 @@
|
||||
# Nexus 新增宝塔 Session 自动检测/修复记录
|
||||
|
||||
日期：2026-07-07
|
||||
测试部署机：192.168.124.219
|
||||
项目目录：/opt/nexus-dev-current
|
||||
分支：audit/security-review
|
||||
提交：5ac3f56 fix: auto repair btpanel session cleanup ttl
|
||||
|
||||
## 目标
|
||||
|
||||
1. 新增服务器/新增宝塔自动检测宝塔 `/www/server/panel/task.py` 是否存在 `if f_time > 3600:` 的 session 清理硬编码。
|
||||
2. 只在识别到精确可修复模式时自动备份并 patch。
|
||||
3. 一键登录前增加兜底检测/修复，避免已经配置过 API Key 的老服务器继续因为 1 小时清理而刷新掉线。
|
||||
4. 把检测/修复状态保存到 `servers.extra_attrs.bt_panel`，并在登录 URL 响应 diagnostics 里返回非敏感诊断信息。
|
||||
|
||||
## 修改文件
|
||||
|
||||
- `/opt/nexus-dev-current/server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
- `/opt/nexus-dev-current/server/infrastructure/btpanel/bootstrap_state.py`
|
||||
- `/opt/nexus-dev-current/server/application/services/btpanel_service.py`
|
||||
- `/opt/nexus-dev-current/tests/test_btpanel_login_url.py`
|
||||
- `/opt/nexus-dev-current/tests/test_btpanel_ssh_bootstrap.py`
|
||||
|
||||
## 核心逻辑
|
||||
|
||||
### 新增/绑定宝塔时
|
||||
|
||||
`ssh_bootstrap_panel()` 远程执行 bootstrap 脚本时会：
|
||||
|
||||
1. 检查 `/www/server/panel/task.py`。
|
||||
2. 如果已经包含 `session_cleanup_timeout = int(public.get_session_timeout() or 86400)` 且清理条件为 `if f_time > session_cleanup_timeout:`，记录为 `patched_timeout`。
|
||||
3. 如果命中旧模式：
|
||||
- 备份到 `/www/server/panel/task.py.nexus-session-ttl.bak`；
|
||||
- 将固定 3600 秒改成读取 `public.get_session_timeout()`；
|
||||
- 保留原文件权限；
|
||||
- 先执行 Python compile 和 `py_compile.compile(tmp, doraise=True)`；
|
||||
- 原子替换 task.py；
|
||||
- 重载宝塔 `/etc/init.d/bt reload`。
|
||||
4. 如果 task.py 结构不匹配，记录 `unknown_task_pattern`，不盲改。
|
||||
|
||||
### 一键登录前
|
||||
|
||||
`BtPanelService.create_login_url()` 在生成宝塔一键登录 URL 前会：
|
||||
|
||||
1. 若服务器已配置宝塔 API，则调用 `_ensure_session_cleanup_ttl_for_login()`。
|
||||
2. 该检查按缓存节流：
|
||||
- 成功后 24 小时内不重复修复；
|
||||
- 失败后 1 小时后可重试。
|
||||
3. 修复失败不会阻断本次一键登录，只会记录 diagnostics 和状态。
|
||||
|
||||
## 新增状态字段
|
||||
|
||||
保存到：`servers.extra_attrs.bt_panel`
|
||||
|
||||
- `session_cleanup_ttl_ok`
|
||||
- `session_cleanup_ttl_patched`
|
||||
- `session_cleanup_task_state`
|
||||
- `session_cleanup_ttl_checked_at`
|
||||
- `session_cleanup_ttl_last_error`
|
||||
- `panel_ssl`
|
||||
|
||||
`session_cleanup_task_state` 当前可能值：
|
||||
|
||||
- `patched_timeout`：已经修好或本次修好；
|
||||
- `unknown_task_pattern`：task.py 存在，但不是已知可安全 patch 的结构；
|
||||
- `no_panel`：未找到 task.py；
|
||||
- `error`：检查/修复异常。
|
||||
|
||||
## 安全边界
|
||||
|
||||
- 不保存、不输出宝塔 tmp_token。
|
||||
- 不显示 API Key 明文。
|
||||
- 不自动修改 `panel_ssl=0`。
|
||||
- 不自动改 `check_client_hash()`。
|
||||
- 不对未知 task.py 结构做模糊替换。
|
||||
- 修改 task.py 前一定备份，写入前做编译检查，写入使用原子替换。
|
||||
|
||||
## 验证
|
||||
|
||||
在测试部署机 `/opt/nexus-dev-current` 执行：
|
||||
|
||||
```bash
|
||||
.venv/bin/python -m py_compile \
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py \
|
||||
server/infrastructure/btpanel/bootstrap_state.py \
|
||||
server/application/services/btpanel_service.py \
|
||||
tests/test_btpanel_login_url.py \
|
||||
tests/test_btpanel_ssh_bootstrap.py
|
||||
|
||||
.venv/bin/python -m pytest \
|
||||
tests/test_btpanel_ssh_bootstrap.py \
|
||||
tests/test_btpanel_login_url.py \
|
||||
tests/test_btpanel_bootstrap_loop.py \
|
||||
tests/test_btpanel_login_url_route.py \
|
||||
tests/test_btpanel_ssh_login.py \
|
||||
tests/test_btpanel_temp_login_ttl.py -q
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
39 passed in 0.61s
|
||||
```
|
||||
|
||||
测试容器已热更新并重启：
|
||||
|
||||
```text
|
||||
curl http://127.0.0.1:18600/health => ok
|
||||
nexus-nexus-1 healthy
|
||||
```
|
||||
|
||||
注意：测试机 `docker compose up -d --build nexus` 曾因为远端 docker 代理 `127.0.0.1:10808` 不可达导致 metadata 拉取失败，所以本次测试环境采用 `docker cp + docker restart` 热更新容器。代码已提交到工作树，后续可在代理可用时重建镜像。
|
||||
|
||||
## 后续发布正式环境建议
|
||||
|
||||
正式环境不要 `git reset`，建议继续采用之前方式：
|
||||
|
||||
1. 备份正式容器内对应文件；
|
||||
2. `docker cp` 本次 3 个后端文件到正式容器；
|
||||
3. 容器内 `python -m py_compile`；
|
||||
4. restart 容器；
|
||||
5. `/health` 检查；
|
||||
6. 抽一台新增/未修复宝塔做一键登录验证，确认 diagnostics 返回 `session_cleanup_task_state=patched_timeout`。
|
||||
@@ -0,0 +1,246 @@
|
||||
# Nexus 最新代码上下文索引与 Zvec 部署报告
|
||||
|
||||
生成时间：2026-07-07
|
||||
测试机：`192.168.124.219`
|
||||
本地工作区：`C:\Users\uzuma\Documents\Codex\2026-07-06\yuu`
|
||||
|
||||
---
|
||||
|
||||
## 1. 已完成结论
|
||||
|
||||
已处理完成：
|
||||
|
||||
1. 已从 Nexus 测试机同步最新代码快照，并重建代码上下文索引。
|
||||
2. 已清理上下文索引污染源：本地快照中误带入的 `.megamemory/knowledge.db` 已删除。
|
||||
3. 已确认本地上下文库没有 `.db/.sqlite/.sqlite3/.duckdb/.faiss` 文件残留。
|
||||
4. 已确认最新快照没有敏感命名文件纳入索引，例如 `.env`、`.pem`、`.key`、`secret`、`resolved`、`凭据` 等。
|
||||
5. 已增强索引脚本脱敏规则：排除 `.megamemory/vendor` 等目录，并对 PEM 私钥块做整体脱敏。
|
||||
6. 已在测试机安装 Zvec：独立安装在 `/opt/nexus-code-context/.venv`，不改 Nexus 主项目虚拟环境。
|
||||
7. 已建立 Zvec 本地代码向量库：`/opt/nexus-code-context/data/nexus_code_chunks.zvec`。
|
||||
8. 已导入清理后的脱敏 chunks：`1440` 条，导入失败数 `0`。
|
||||
9. 已验证 Zvec 向量检索可查到宝塔一键登录/session 相关代码。
|
||||
10. 没有使用 SQLite 作为新的上下文数据库；结构化索引仍是 JSONL/Markdown，向量库是 Zvec。
|
||||
|
||||
---
|
||||
|
||||
## 2. 最新上下文索引统计
|
||||
|
||||
来源快照：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
```
|
||||
|
||||
统计：
|
||||
|
||||
| 项 | 数量 |
|
||||
|---|---:|
|
||||
| 文件总数 | 2214 |
|
||||
| 文本索引文件 | 2020 |
|
||||
| Python/前端符号 | 2861 |
|
||||
| API 路由 | 214 |
|
||||
| Service 方法 | 324 |
|
||||
| 调用边 | 16780 |
|
||||
| 数据库调用点 | 437 |
|
||||
| Redis key/调用点 | 729 |
|
||||
| SSH/远程命令调用点 | 346 |
|
||||
| 宝塔相关流 | 183 |
|
||||
| 前端路由 | 31 |
|
||||
| 脱敏代码块 | 1440 |
|
||||
| 生成时间 | 2026-07-07 11:47:00 +0800 |
|
||||
|
||||
本地索引目录：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context
|
||||
```
|
||||
|
||||
主要产物：
|
||||
|
||||
```text
|
||||
work/nexus_code_context/context_summary.json
|
||||
work/nexus_code_context/index/api_routes.jsonl
|
||||
work/nexus_code_context/index/service_methods.jsonl
|
||||
work/nexus_code_context/index/call_edges.jsonl
|
||||
work/nexus_code_context/index/db_queries.jsonl
|
||||
work/nexus_code_context/index/redis_keys.jsonl
|
||||
work/nexus_code_context/index/ssh_commands.jsonl
|
||||
work/nexus_code_context/index/btpanel_flows.jsonl
|
||||
work/nexus_code_context/cache/chunks.redacted.jsonl
|
||||
work/nexus_code_context/reports/*.md
|
||||
work/nexus_code_context/scripts/build_context_index.py
|
||||
work/nexus_code_context/scripts/query_context.py
|
||||
work/nexus_code_context/scripts/import_chunks_to_zvec.py
|
||||
work/nexus_code_context/scripts/query_zvec_context.py
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. SQLite / 污染处理结果
|
||||
|
||||
用户之前明确不喜欢 SQLite，也担心上下文库污染。处理结果：
|
||||
|
||||
### 3.1 已发现并清理的问题
|
||||
|
||||
本地最新源码快照中曾误包含：
|
||||
|
||||
```text
|
||||
work/nexus_code_context/snapshots/.../.megamemory/knowledge.db
|
||||
```
|
||||
|
||||
该文件属于项目外部记忆/缓存目录，不应进入 Nexus 代码上下文库。已删除，并在索引脚本中加入排除：
|
||||
|
||||
```python
|
||||
.megamemory
|
||||
.cursor
|
||||
.playwright-mcp
|
||||
.skills
|
||||
vendor
|
||||
```
|
||||
|
||||
### 3.2 当前检查结果
|
||||
|
||||
当前本地上下文目录检查：
|
||||
|
||||
```text
|
||||
.db/.sqlite/.sqlite3/.duckdb/.faiss: 0 个
|
||||
敏感命名文件: 0 个
|
||||
PEM 私钥块命中: 0 个
|
||||
JWT 样式 token 命中: 0 个
|
||||
AWS AKIA key 命中: 0 个
|
||||
未脱敏 password/token/key 赋值命中: 0 个
|
||||
```
|
||||
|
||||
因此当前上下文库不再包含 SQLite 数据库，也没有发现上述明显 secret 形态污染。
|
||||
|
||||
---
|
||||
|
||||
## 4. Zvec 安装结果
|
||||
|
||||
Zvec 没有装进 Nexus 主项目 `.venv`，而是独立放在测试机：
|
||||
|
||||
```text
|
||||
/opt/nexus-code-context/.venv
|
||||
```
|
||||
|
||||
版本：
|
||||
|
||||
```text
|
||||
zvec 0.5.1
|
||||
```
|
||||
|
||||
Zvec 数据目录：
|
||||
|
||||
```text
|
||||
/opt/nexus-code-context/data/nexus_code_chunks.zvec
|
||||
```
|
||||
|
||||
Manifest：
|
||||
|
||||
```json
|
||||
{
|
||||
"collection": "/opt/nexus-code-context/data/nexus_code_chunks.zvec",
|
||||
"chunks_file": "/opt/nexus-code-context/input/chunks.redacted.jsonl",
|
||||
"embedding": "local_hashing_vector_no_external_api",
|
||||
"dimension": 256,
|
||||
"inserted_attempted": 1440,
|
||||
"insert_status_non_ok": 0
|
||||
}
|
||||
```
|
||||
|
||||
说明：
|
||||
|
||||
- 没有用 Docker 部署 Zvec，所以不会占用宝塔/Nexus 端口。
|
||||
- 没有公网暴露 Zvec 服务。
|
||||
- 没有调用外部 embedding API 上传私有代码。
|
||||
- embedding 使用本地确定性 hashing vector，只用于代码上下文召回，不用于语义模型训练。
|
||||
- 原始输入是 `chunks.redacted.jsonl`，不是未脱敏源码。
|
||||
|
||||
---
|
||||
|
||||
## 5. Zvec 查询验证
|
||||
|
||||
已在测试机验证向量检索：
|
||||
|
||||
查询：
|
||||
|
||||
```bash
|
||||
/opt/nexus-code-context/.venv/bin/python /opt/nexus-code-context/bin/query_zvec_context.py 'bt panel session cleanup keep alive one click login' --topk 5 --mode vector
|
||||
```
|
||||
|
||||
返回命中包括：
|
||||
|
||||
```text
|
||||
server/infrastructure/btpanel/constants.py
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/application/services/btpanel_service.py
|
||||
```
|
||||
|
||||
这说明当前 Zvec 代码上下文库可以召回宝塔一键登录/session 保活相关代码。
|
||||
|
||||
---
|
||||
|
||||
## 6. 后续使用命令
|
||||
|
||||
### 6.1 本地重建 JSONL/Markdown 索引
|
||||
|
||||
在本地工作区执行：
|
||||
|
||||
```powershell
|
||||
$env:PYTHONIOENCODING='utf-8'
|
||||
python work/nexus_code_context/scripts/build_context_index.py
|
||||
```
|
||||
|
||||
### 6.2 重新导入测试机 Zvec
|
||||
|
||||
先把清理后的 chunks 和脚本同步到测试机，再执行：
|
||||
|
||||
```bash
|
||||
/opt/nexus-code-context/.venv/bin/python /opt/nexus-code-context/bin/import_chunks_to_zvec.py --chunks /opt/nexus-code-context/input/chunks.redacted.jsonl --collection /opt/nexus-code-context/data/nexus_code_chunks.zvec --recreate
|
||||
```
|
||||
|
||||
### 6.3 查询 Zvec 上下文库
|
||||
|
||||
```bash
|
||||
/opt/nexus-code-context/.venv/bin/python /opt/nexus-code-context/bin/query_zvec_context.py '你的问题关键词' --topk 8 --mode vector
|
||||
```
|
||||
|
||||
示例：
|
||||
|
||||
```bash
|
||||
/opt/nexus-code-context/.venv/bin/python /opt/nexus-code-context/bin/query_zvec_context.py 'archive extract tar zip path traversal' --topk 8 --mode vector
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. 对 Nexus 代码审查的帮助
|
||||
|
||||
现在的上下文库可以辅助后续安全巡检：
|
||||
|
||||
1. 通过 `api_routes.jsonl` 快速定位 API 入口。
|
||||
2. 通过 `service_methods.jsonl` 找业务服务边界。
|
||||
3. 通过 `call_edges.jsonl` 拼 API → Service → Repo/SSH/Redis 调用链。
|
||||
4. 通过 `db_queries.jsonl` 聚合 SQLAlchemy 查询和写入点。
|
||||
5. 通过 `ssh_commands.jsonl` 聚合远程 shell/SSH/SFTP/文件管理风险点。
|
||||
6. 通过 `btpanel_flows.jsonl` 专门追踪宝塔一键登录、session、token、保活修复相关代码。
|
||||
7. 通过 Zvec 对关键词/问题做代码块召回，先定位上下文，再做人工审查。
|
||||
|
||||
---
|
||||
|
||||
## 8. 当前限制
|
||||
|
||||
1. 当前 Zvec 检索优先使用本地 hashing vector。它稳定、离线、不上传代码，但语义能力弱于大模型 embedding。
|
||||
2. Zvec FTS 字段已按 schema 配置，但当前实际使用以 vector 模式为主；后续如果要做精确全文检索，可再单独调优 FTS index/tokenizer。
|
||||
3. 上下文库只用于辅助定位，不替代测试和人工安全审查。
|
||||
|
||||
---
|
||||
|
||||
## 9. 下一步建议
|
||||
|
||||
建议后续 Nexus 安全巡检按这个顺序推进：
|
||||
|
||||
1. 先用 `api_routes.jsonl` + `service_methods.jsonl` 画全量 API/服务/数据库调用链。
|
||||
2. 对 `btpanel_flows.jsonl` 做二次审查，重点检查：token TTL、并发一键登录、Redis lock、审计日志、失败回退。
|
||||
3. 对 `ssh_commands.jsonl` 做逐项确认：鉴权、超时、输出截断、日志脱敏、危险 shell 参数边界。
|
||||
4. 对 `db_queries.jsonl` 检查多租户/权限过滤、分页限制、事务提交/回滚。
|
||||
5. 每次修复后重新跑索引和 Zvec 导入，确保上下文库跟代码同步。
|
||||
@@ -0,0 +1,109 @@
|
||||
# Nexus 正式环境遗漏补发记录（2026-07-07）
|
||||
|
||||
## 背景
|
||||
|
||||
用户反馈：正式页面里“全局 API Key / API Key”仍可见。排查后确认：此前正式环境只热更新了宝塔 diagnostics 相关后端文件，`524acd5 fix-stop-exposing-global-api-key-in-settings` 与 `fa44439 fix btpanel ssh temp login python env` 未完整补发到正式容器。
|
||||
|
||||
## 本次补发范围
|
||||
|
||||
来源：局域网测试机 `/opt/nexus-dev-current`。
|
||||
|
||||
补发到正式容器 `nexus-prod-nexus-1` 的文件：
|
||||
|
||||
- `server/api/settings.py`
|
||||
- GET `/api/settings/` 对敏感设置不再返回明文值。
|
||||
- `api_key` / `secret_key` / `encryption_key` / Telegram Bot Token 返回 `value=""` + `value_set=true/false`。
|
||||
- `server/infrastructure/btpanel/ssh_login.py`
|
||||
- 补发 SSH 临时登录 Python 环境兼容修复。
|
||||
- `web/app/index.html`
|
||||
- `web/app/assets/`
|
||||
- 补发 SettingsPage 前端构建产物，使当前设置页不再展示旧的全局 API Key 明文字段。
|
||||
|
||||
## 补丁包
|
||||
|
||||
测试机生成：
|
||||
|
||||
- `/tmp/nexus-settings-frontend-patch-20260707.tar.gz`
|
||||
- SHA256：`a56153c16ca74a80597ffd134bed3aa2bcdcef1c77b7e67a0998bdd1b85a13d6`
|
||||
|
||||
本地留存：
|
||||
|
||||
- `C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus-settings-frontend-patch-20260707.tar.gz`
|
||||
|
||||
正式机上传：
|
||||
|
||||
- `/tmp/nexus-settings-frontend-patch-20260707.tar.gz`
|
||||
|
||||
## 正式环境热更新结果
|
||||
|
||||
正式主机：`20.24.218.235`
|
||||
|
||||
容器：`nexus-prod-nexus-1`
|
||||
|
||||
执行动作：
|
||||
|
||||
1. 校验补丁包 SHA256。
|
||||
2. 解压到 staging 目录。
|
||||
3. 备份容器旧文件。
|
||||
4. `docker cp` 覆盖后端与前端构建产物。
|
||||
5. `python -m py_compile` 检查两个 Python 文件语法。
|
||||
6. 重启容器。
|
||||
7. 访问 `/health` 健康检查。
|
||||
|
||||
结果：
|
||||
|
||||
- 备份目录：`/tmp/nexus-settings-patch-backup-20260707-170246`
|
||||
- staging 目录：`/tmp/nexus-settings-patch-20260707-170246`
|
||||
- 健康检查：`ok`
|
||||
|
||||
## 验证结果
|
||||
|
||||
### 1. API 不再返回全局 API Key 明文
|
||||
|
||||
通过正式域名 `https://api.synaglobal.vip` 登录后调用：
|
||||
|
||||
- `GET /api/settings/`
|
||||
|
||||
验证结果：
|
||||
|
||||
- 登录：`HTTP/1.1 200 OK`
|
||||
- Settings：`HTTP/1.1 200 OK`
|
||||
- settings_count：`33`
|
||||
- sensitive_keys_present：`api_key`, `secret_key`, `telegram_bot_token`, `telegram_offline_bot_token`
|
||||
- sensitive_values_plaintext：`NO`
|
||||
- `api_key_value_set`：`True`
|
||||
|
||||
说明：正式 API 仍会告诉前端“已配置过 API Key”，但不会返回真实值。
|
||||
|
||||
### 2. 当前前端入口已更新
|
||||
|
||||
正式容器当前入口：
|
||||
|
||||
- `/app/web/app/index.html`
|
||||
- 引用入口 JS：`/app/assets/index-CASoZdpL.js`
|
||||
- 当前 SettingsPage 构建文件：`SettingsPage-DFgw8KT9.js`
|
||||
|
||||
检查当前 SettingsPage 构建文件未发现 `API` 文案输出；目录内旧的 `SettingsPage-*.js` 残留不代表正在被当前入口使用。
|
||||
|
||||
## 用户侧注意事项
|
||||
|
||||
如果浏览器还看到旧的“全局 API Key / API Key”区块，优先按以下顺序处理：
|
||||
|
||||
1. 强制刷新页面（Windows：`Ctrl + F5`）。
|
||||
2. 退出 Nexus 后重新登录。
|
||||
3. 清除 `api.synaglobal.vip` 站点缓存。
|
||||
4. 确认访问的是正式域名 `https://api.synaglobal.vip`，不是本地 `http://localhost:18600/app/` 旧代理页面。
|
||||
|
||||
## 回滚方式
|
||||
|
||||
如需回滚本次热更新，可从正式机备份目录恢复：
|
||||
|
||||
- `/tmp/nexus-settings-patch-backup-20260707-170246/settings.py`
|
||||
- `/tmp/nexus-settings-patch-backup-20260707-170246/ssh_login.py`
|
||||
- `/tmp/nexus-settings-patch-backup-20260707-170246/web-app`
|
||||
|
||||
恢复后重启容器并检查 `/health`。
|
||||
|
||||
## 结论
|
||||
|
||||
本次已经把之前遗漏的正式环境文件补发完成。当前正式 API 不再泄露全局 API Key 明文；前端当前入口也已切到新的 SettingsPage 构建产物。
|
||||
@@ -0,0 +1,292 @@
|
||||
# Nexus 测试部署机环境修复与验证报告
|
||||
|
||||
生成时间：2026-07-07 06:55（Asia/Shanghai）
|
||||
|
||||
## 1. 本轮结论
|
||||
|
||||
Nexus 局域网测试部署机 `192.168.124.219` 当前可作为测试部署机使用：
|
||||
|
||||
- Docker 部署正常，Nexus / MySQL / Redis 三个容器均为 healthy。
|
||||
- Nexus 健康接口正常：`http://127.0.0.1:18600/health` 返回 `200 OK` / `ok`。
|
||||
- Web 入口正常：`http://192.168.124.219:18600/app/`。
|
||||
- 后端全量 pytest 已通过：`727 passed, 1 skipped in 11.75s`。
|
||||
- 前端 `type-check` 与 `build` 已通过。
|
||||
- 已确认机器已使用国内源，未执行 `linuxmirrors.cn` 换源脚本，避免重复改源带来风险。
|
||||
|
||||
## 2. 当前部署状态
|
||||
|
||||
部署目录：
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-current -> /opt/nexus-dev-20260707-054832
|
||||
```
|
||||
|
||||
Docker 端口：
|
||||
|
||||
| 服务 | 容器端口 | 宿主端口 | 状态 |
|
||||
|---|---:|---:|---|
|
||||
| Nexus | 8600 | 18600 | healthy |
|
||||
| MySQL | 3306 | 13306 | healthy |
|
||||
| Redis | 6379 | 16379 | healthy |
|
||||
|
||||
测试机上同时存在宝塔服务，本轮没有修改宝塔文件，也没有重启宝塔：
|
||||
|
||||
| 服务 | 端口 |
|
||||
|---|---:|
|
||||
| 宝塔面板 | 29938 |
|
||||
| 宝塔 nginx | 80 / 888 |
|
||||
|
||||
## 3. 国内源与代理状态
|
||||
|
||||
已检查到当前测试机已配置国内源：
|
||||
|
||||
- Ubuntu apt：阿里云源。
|
||||
- Docker CE：腾讯云源。
|
||||
- pip：清华源。
|
||||
- npm：`https://registry.npmmirror.com`。
|
||||
- Docker registry mirror：`https://docker.1ms.run/`。
|
||||
|
||||
Docker daemon 代理已配置为：
|
||||
|
||||
```text
|
||||
HTTP_PROXY=socks5h://127.0.0.1:10808
|
||||
HTTPS_PROXY=socks5h://127.0.0.1:10808
|
||||
```
|
||||
|
||||
注意：这个 Docker 代理依赖本机到测试机的 SSH reverse tunnel；如果隧道断开，已存在镜像和容器不受影响，但后续拉新镜像可能失败。
|
||||
|
||||
## 4. 本轮已修复文件
|
||||
|
||||
所有上传到远端的文件均先在远端做了 `.bak-时间戳` 备份。
|
||||
|
||||
### 4.1 之前已上传的环境/测试修复
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-current/pytest.ini
|
||||
/opt/nexus-dev-current/tests/conftest.py
|
||||
/opt/nexus-dev-current/tests/test_agent_version.py
|
||||
/opt/nexus-dev-current/tests/test_agent_heartbeat_stop.py
|
||||
/opt/nexus-dev-current/tests/test_btpanel_login_url.py
|
||||
/opt/nexus-dev-current/server/infrastructure/ssh/remote_probe.py
|
||||
/opt/nexus-dev-current/tests/test_server_connectivity.py
|
||||
```
|
||||
|
||||
主要修复点：
|
||||
|
||||
1. 新增 `pytest.ini`，限制 pytest 只收集 `tests/`，避免误收集 `scripts/_browse_test.py`。
|
||||
2. `tests/conftest.py` 默认把普通测试设置为已安装模式，避免裸跑 pytest 时进入安装模式导致 API 返回 503。
|
||||
3. 测试环境缺少 `ENCRYPTION_KEY` 时注入固定测试 Fernet key，避免测试依赖真实部署 secrets。
|
||||
4. Agent 版本测试从旧的 `2.0.0` 更新为当前代码版本 `2.1.1`。
|
||||
5. 宝塔一键登录 URL 单测更新为“不缓存一次性 tmp_token URL”，符合近期长期掉线修复方向。
|
||||
6. `remote_probe.py` 对缺少 `psutil` 的目标机增加 `/proc` 降级采集，避免监控命令直接失败。
|
||||
7. `test_server_connectivity.py` 修复 mock 行字段数不足的问题。
|
||||
|
||||
### 4.2 本轮继续上传的链路测试修复
|
||||
|
||||
本轮新增上传：
|
||||
|
||||
```text
|
||||
/opt/nexus-dev-current/tests/chain/test_batch_job_flow.py
|
||||
/opt/nexus-dev-current/tests/chain/test_script_exec_flow.py
|
||||
```
|
||||
|
||||
远端备份时间戳：
|
||||
|
||||
```text
|
||||
20260707-064723
|
||||
```
|
||||
|
||||
修复原因：
|
||||
|
||||
两个链路测试原来 monkeypatch 了全局 `asyncio.create_task`，导致 SQLAlchemy / aiosqlite 在测试 teardown 关闭连接时也拿到 `MagicMock`，最终报错：
|
||||
|
||||
```text
|
||||
TypeError: An asyncio.Future, a coroutine or an awaitable is required
|
||||
RuntimeWarning: coroutine 'AsyncConnection.close' was never awaited
|
||||
```
|
||||
|
||||
修复方式：
|
||||
|
||||
- 不再污染全局 `asyncio` 模块。
|
||||
- 只替换业务模块里的 `asyncio` 引用。
|
||||
- 用 `_AsyncioProxy` 保留其他 `asyncio` 能力，只拦截业务代码创建后台任务的 `create_task()`。
|
||||
|
||||
示意：
|
||||
|
||||
```python
|
||||
class _AsyncioProxy:
|
||||
def __getattr__(self, name):
|
||||
return getattr(asyncio, name)
|
||||
|
||||
def create_task(self, coro):
|
||||
return capture_create_task(coro)
|
||||
|
||||
monkeypatch.setattr(
|
||||
"server.application.services.server_batch_service.asyncio",
|
||||
_AsyncioProxy(),
|
||||
)
|
||||
```
|
||||
|
||||
另一个文件同理替换：
|
||||
|
||||
```python
|
||||
monkeypatch.setattr(
|
||||
"server.application.services.script_service.asyncio",
|
||||
_AsyncioProxy(),
|
||||
)
|
||||
```
|
||||
|
||||
## 5. 验证结果
|
||||
|
||||
### 5.1 本轮 targeted 测试
|
||||
|
||||
命令：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
. .venv/bin/activate
|
||||
python -m pytest -q \
|
||||
tests/chain/test_batch_job_flow.py::test_batch_category_job_completes_and_persists \
|
||||
tests/chain/test_script_exec_flow.py::test_execute_script_reaches_completed
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
2 passed in 0.97s
|
||||
```
|
||||
|
||||
### 5.2 后端全量 pytest
|
||||
|
||||
命令：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current
|
||||
. .venv/bin/activate
|
||||
python -m pytest -q
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
727 passed, 1 skipped in 11.75s
|
||||
```
|
||||
|
||||
### 5.3 Docker / HTTP 健康检查
|
||||
|
||||
检查时间：2026-07-07 06:48:38 +08:00
|
||||
|
||||
```text
|
||||
nexus-mysql-1 Up / healthy 0.0.0.0:13306->3306
|
||||
nexus-redis-1 Up / healthy 0.0.0.0:16379->6379
|
||||
nexus-nexus-1 Up / healthy 0.0.0.0:18600->8600
|
||||
```
|
||||
|
||||
健康接口：
|
||||
|
||||
```text
|
||||
HTTP/1.1 200 OK
|
||||
ok
|
||||
```
|
||||
|
||||
Web 入口：
|
||||
|
||||
```text
|
||||
HTTP/1.1 200 OK
|
||||
/app/
|
||||
```
|
||||
|
||||
### 5.4 前端检查
|
||||
|
||||
命令：
|
||||
|
||||
```bash
|
||||
cd /opt/nexus-dev-current/frontend
|
||||
npm run type-check -- --pretty false
|
||||
npm run build
|
||||
```
|
||||
|
||||
结果：
|
||||
|
||||
```text
|
||||
type-check 通过
|
||||
build 通过
|
||||
```
|
||||
|
||||
存在非阻断 warning：
|
||||
|
||||
1. `:deep(...)` CSS 伪类 warning：
|
||||
- 构建器提示 `deep` 不是有效 pseudo-class，建议 `::deep`。
|
||||
- 当前不阻断 build，但建议后续统一检查 Vue scoped CSS 写法。
|
||||
2. dynamic import warning：
|
||||
- `src/router/index.ts` 同时被静态和动态导入，影响拆包效果，不影响功能。
|
||||
3. chunk size warning：
|
||||
- Monaco / Vuetify 相关 bundle 较大，建议后续做按需加载和 chunk 拆分。
|
||||
|
||||
## 6. 宝塔长期掉线问题现状
|
||||
|
||||
用户描述的问题是：
|
||||
|
||||
> 不是登录失败，而是一键登录同时打开多个宝塔后，过几个小时陆续掉线，刷新就掉。
|
||||
|
||||
当前 Nexus 代码方向已经覆盖了关键点：
|
||||
|
||||
1. 每次一键登录 fresh 生成宝塔 tmp_token。
|
||||
2. 不缓存一次性登录 URL。
|
||||
3. Redis per-server lock 避免同一服务器并发生成 tmp_token 互相覆盖。
|
||||
4. temp login TTL 目标为 86400 秒。
|
||||
|
||||
但测试机宝塔本体此前检查到仍可能存在边界风险：
|
||||
|
||||
```text
|
||||
/www/server/panel/data/session_timeout.pl = 86400
|
||||
/www/server/panel/task.py 仍有 if f_time > 3600:
|
||||
```
|
||||
|
||||
这意味着即使 session_timeout 设置为 86400，宝塔后台某些清理逻辑仍可能按 3600 秒判断，从而造成几个小时后刷新掉线。
|
||||
|
||||
本轮没有修改宝塔本体文件。后续如果要验证/修复，需要明确执行以下步骤：
|
||||
|
||||
1. 备份 `/www/server/panel/task.py`。
|
||||
2. 只修改硬编码 session 清理阈值相关逻辑。
|
||||
3. 尽量不重启宝塔；如必须重启，先告知影响。
|
||||
4. 再做 2 小时以上多窗口一键登录保活测试。
|
||||
|
||||
## 7. 后续建议的代码安全巡检顺序
|
||||
|
||||
建议按下面顺序继续做 Nexus 安全巡检：
|
||||
|
||||
1. **配置与 secrets**
|
||||
- 检查 `.env`、Docker env、日志输出是否泄露 token/password/key。
|
||||
- 检查测试文件是否写入真实密钥。
|
||||
2. **认证与授权**
|
||||
- JWT 登录、安装模式、白名单、管理员接口鉴权。
|
||||
- 一键登录宝塔的权限边界与审计日志。
|
||||
3. **宝塔一键登录链路**
|
||||
- tmp_token 生成、并发锁、TTL、错误重试、URL 不缓存策略。
|
||||
- 多窗口/多服务器/刷新场景。
|
||||
4. **SSH 执行链路**
|
||||
- 命令拼接、参数转义、超时、输出脱敏、失败回滚。
|
||||
5. **数据库访问**
|
||||
- SQLAlchemy 查询是否参数化。
|
||||
- 事务边界、异步 session 生命周期。
|
||||
6. **Redis 缓存/锁**
|
||||
- key 命名空间、TTL、锁释放、异常路径。
|
||||
7. **文件/脚本执行**
|
||||
- 上传路径限制、脚本内容校验、目录穿越风险。
|
||||
8. **前端安全**
|
||||
- XSS、URL 拼接、iframe/window.open、token 存储位置。
|
||||
9. **部署安全**
|
||||
- Docker 端口暴露、默认密码、CORS、安全响应头、Nginx 代理配置。
|
||||
10. **回归测试补齐**
|
||||
- 为本次发现的安装模式、一次性 URL、asyncio monkeypatch、psutil 降级补长期回归用例。
|
||||
|
||||
## 8. 当前是否还有环境问题
|
||||
|
||||
按本轮检查结果：
|
||||
|
||||
- 测试机 Docker 部署没有发现阻断问题。
|
||||
- 后端 pytest 没有剩余失败。
|
||||
- 前端 type-check/build 没有失败。
|
||||
- 仍需关注的是前端 build warning 和宝塔本体 `task.py` 的 3600 秒清理逻辑。
|
||||
|
||||
@@ -0,0 +1,314 @@
|
||||
# Nexus 项目说明文档（2026-07-08）
|
||||
|
||||
## 1. 项目定位
|
||||
|
||||
Nexus 是一个服务器资产管理、远程运维、宝塔面板管理和自动化发布平台。当前重点能力包括：
|
||||
|
||||
- 服务器资产管理；
|
||||
- SSH / WebSSH / 文件管理；
|
||||
- 批量脚本执行；
|
||||
- 宝塔面板一键登录；
|
||||
- 宝塔 Session TTL 自动检测与修复；
|
||||
- 审计日志与安全巡检；
|
||||
- 旧后台 `/app/` 与新后台 `/app-v2/` 双后台并行；
|
||||
- 发布包制品化与 Gitea / Act Runner 自动发布方向。
|
||||
|
||||
## 2. 当前项目路径
|
||||
|
||||
源码快照目录：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
```
|
||||
|
||||
发布文档目录：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs
|
||||
```
|
||||
|
||||
最新发布包：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
## 3. 技术栈概览
|
||||
|
||||
### 后端
|
||||
|
||||
- Python / FastAPI 风格 API；
|
||||
- SQLAlchemy；
|
||||
- Redis；
|
||||
- SSH / Paramiko 相关远程能力；
|
||||
- Docker / 1Panel 部署脚本；
|
||||
- 宝塔 API + SSH bootstrap 混合修复链路。
|
||||
|
||||
### 前端
|
||||
|
||||
旧后台：
|
||||
|
||||
```text
|
||||
web/app/
|
||||
```
|
||||
|
||||
新后台：
|
||||
|
||||
```text
|
||||
frontend-v2/
|
||||
web/app-v2/
|
||||
```
|
||||
|
||||
新后台技术栈：
|
||||
|
||||
- React；
|
||||
- TypeScript；
|
||||
- Vite；
|
||||
- Tailwind / shadcn 风格组件；
|
||||
- TanStack Query；
|
||||
- TanStack Table；
|
||||
- Zustand。
|
||||
|
||||
### 部署/发布
|
||||
|
||||
- Docker / 1Panel；
|
||||
- `deploy/apply-release-bundle.sh`；
|
||||
- `deploy/preflight-release-host.sh`；
|
||||
- `scripts/prepare_release_artifact.py`；
|
||||
- `scripts/publish_release_bundle.py`。
|
||||
|
||||
## 4. 重要目录说明
|
||||
|
||||
```text
|
||||
server/ 后端 API、服务、基础设施代码
|
||||
server/api/ FastAPI 路由层
|
||||
server/application/services/ 业务服务层
|
||||
server/infrastructure/ Redis、SSH、宝塔等基础设施封装
|
||||
frontend-v2/ 新后台源码
|
||||
web/app/ 旧后台静态产物
|
||||
web/app-v2/ 新后台静态产物
|
||||
deploy/ 部署、升级、回滚、1Panel 脚本
|
||||
scripts/ 本地 gate、打包、发布辅助脚本
|
||||
tests/ 后端和发布辅助脚本测试
|
||||
outputs/ 本轮审查、发布、说明文档
|
||||
```
|
||||
|
||||
## 5. 当前核心改动
|
||||
|
||||
### 5.1 宝塔长期不掉线修复
|
||||
|
||||
问题根因：部分宝塔版本 `task.py` 中硬编码 `3600` 秒清理 `tmp_login` session，导致 Nexus 一键登录后 1～2 小时刷新掉线。
|
||||
|
||||
当前修复方向：
|
||||
|
||||
- 登录前自动检测/修复宝塔 hardcoded `3600`；
|
||||
- 改为基于 `public.get_session_timeout()` 或默认 `86400`；
|
||||
- 新增 Redis 分布式锁，避免同一宝塔并发签发 login URL 时 tmp_token 互相覆盖；
|
||||
- SSH bootstrap 增加远端 flock / mktemp / atomic replace；
|
||||
- 新增测试覆盖宝塔登录、TTL、bootstrap、并发锁等场景。
|
||||
|
||||
关键文件：
|
||||
|
||||
```text
|
||||
server/application/services/btpanel_service.py
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/infrastructure/btpanel/bootstrap_lock.py
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
server/api/btpanel.py
|
||||
```
|
||||
|
||||
### 5.2 `/app-v2` 第二后台
|
||||
|
||||
新增第二后台 `/app-v2/`，与旧后台 `/app/` 并行，方便逐步替换旧后台。
|
||||
|
||||
关键特性：
|
||||
|
||||
- 更现代的 UI；
|
||||
- 响应更快；
|
||||
- 保留原功能入口；
|
||||
- 敏感信息不展示；
|
||||
- 全局 API Key 只显示“已配置/未配置”，不显示真实值；
|
||||
- 前端构建产物有敏感扫描。
|
||||
|
||||
关键文件：
|
||||
|
||||
```text
|
||||
frontend-v2/
|
||||
web/app-v2/
|
||||
frontend-v2/scripts/scan-app-v2-sensitive.mjs
|
||||
server/main.py
|
||||
Dockerfile
|
||||
Dockerfile.prod
|
||||
```
|
||||
|
||||
### 5.3 发布制品化
|
||||
|
||||
当前发布不再只靠零散文件复制，而是生成完整 tar.gz 发布包。
|
||||
|
||||
关键脚本：
|
||||
|
||||
```text
|
||||
scripts/prepare_release_artifact.py 一键本地 gate + manifest + tar.gz + scan + metadata + validate-only
|
||||
scripts/generate_release_bundle.py 生成干净发布包
|
||||
scripts/scan_release_bundle.py 扫描发布包是否含敏感/脏文件
|
||||
scripts/write_release_metadata.py 写 metadata 和 .sha256
|
||||
scripts/publish_release_bundle.py Python 版上传 + preflight + 可选 apply
|
||||
scripts/check_text_integrity.py 检查 UTF-8 / 控制字符 / Markdown fence
|
||||
```
|
||||
|
||||
服务器侧脚本：
|
||||
|
||||
```text
|
||||
deploy/preflight-release-host.sh 服务器发布前检查
|
||||
deploy/apply-release-bundle.sh 校验、备份、应用发布包、重建、验证
|
||||
deploy/sync_webapp_to_container.sh 同步 /app 与 /app-v2 静态资源到容器
|
||||
```
|
||||
|
||||
## 6. 当前验证状态
|
||||
|
||||
本地 release gate 已通过：
|
||||
|
||||
- Python 编译检查；
|
||||
- deploy shell `bash -n`；
|
||||
- deploy excludes 检查；
|
||||
- 文本完整性检查；
|
||||
- `/app-v2 build:safe`；
|
||||
- app-v2 敏感扫描；
|
||||
- 宝塔专项测试 60 个；
|
||||
- 发布辅助脚本测试 5 个。
|
||||
|
||||
合计 Python 测试：
|
||||
|
||||
```text
|
||||
65 passed
|
||||
```
|
||||
|
||||
发布包验证：
|
||||
|
||||
- tarball scan 通过；
|
||||
- `apply-release-bundle.sh --validate-only` 通过；
|
||||
- metadata / `.sha256` / tar 实际 SHA 一致；
|
||||
- 不包含 `tmp/pytest-publish-release`；
|
||||
- 不包含高置信真实敏感信息。
|
||||
|
||||
## 7. 发布方式
|
||||
|
||||
### 7.1 当前推荐：发布包方式
|
||||
|
||||
发布包：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
只上传并执行 preflight：
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs
|
||||
exus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
确认 preflight 没问题后正式发布：
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs
|
||||
exus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b ^
|
||||
--apply
|
||||
```
|
||||
|
||||
### 7.2 Gitea 发布方向
|
||||
|
||||
已有远端 Gitea 仓库：
|
||||
|
||||
```text
|
||||
http://66.154.115.8:3000/admin/Nexus.git
|
||||
```
|
||||
|
||||
如果要用局域网机器 `192.168.124.219` 做新的代码托管平台，建议安装：
|
||||
|
||||
```text
|
||||
Gitea + Act Runner
|
||||
```
|
||||
|
||||
含义：
|
||||
|
||||
- Gitea：代码仓库、分支、Web 管理；
|
||||
- Act Runner：执行 Gitea Actions / CI/CD / 自动发布。
|
||||
|
||||
推荐最终流程：
|
||||
|
||||
```text
|
||||
开发机 / Codex
|
||||
-> git push 到 Gitea
|
||||
-> Gitea Actions 触发
|
||||
-> Act Runner 跑 gate / 打包
|
||||
-> SSH 到正式服务器
|
||||
-> apply-release-bundle.sh 发布
|
||||
-> 验证 /health /app/ /app-v2/
|
||||
```
|
||||
|
||||
第一次建议先做手动触发或 release 分支触发，不要一 push 就直接发布生产。
|
||||
|
||||
## 8. 测试部署机说明
|
||||
|
||||
局域网测试部署机：
|
||||
|
||||
```text
|
||||
192.168.124.219
|
||||
```
|
||||
|
||||
已知用途：
|
||||
|
||||
- Nexus 测试部署机；
|
||||
- Web 入口曾记录为：`http://192.168.124.219:18600/app/`；
|
||||
- 本地 Git 工作树：`/opt/nexus-dev-current`；
|
||||
- 曾用于 pytest、代码上下文索引、Zvec 部署等。
|
||||
|
||||
当前记录显示：它有本地 Git 仓库/工作树，但没有明确证据表明已安装 Gitea 服务。
|
||||
|
||||
## 9. 安全注意事项
|
||||
|
||||
1. 不要提交 `.env`、私钥、真实 token、宝塔 key、数据库密码；
|
||||
2. 发布包已排除 `.env`、`docker/.env.prod`、`web/data`、venv、node_modules、缓存等；
|
||||
3. `/app-v2` 不显示全局 API Key；
|
||||
4. 宝塔一键登录必须走后端接口，不在前端生成 tmp token；
|
||||
5. `script_service` 是管理员远程执行命令功能，属于产品能力，不按普通漏洞处理；
|
||||
6. Gitea Actions 如要生产发布，必须先配置好 Secrets 和最小权限 SSH Key。
|
||||
|
||||
## 10. 重要文档索引
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-index-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-ready-checklist-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-manual-deploy-commands-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-python-publisher-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-release-publisher-tests-20260708.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-app-v2-双后台实施说明-20260707.md
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\Nexus-API服务数据库调用链索引报告-20260707.md
|
||||
```
|
||||
|
||||
## 11. 当前未完成事项
|
||||
|
||||
- 线上 `https://api.synaglobal.vip` 尚未由 Codex 亲自完成 SSH 发布验证；
|
||||
- 原因是本线程仍使用 `auto_review` 审批，当前 CC Switch 不支持 `codex-auto-review`；
|
||||
- 用户可手动执行发布命令，或改用 Gitea/Act Runner 发布。
|
||||
|
||||
@@ -0,0 +1,297 @@
|
||||
# Nexus 分支合并清单：`main` ↔ `release/20260708-axs`
|
||||
|
||||
> **编写日期**：2026-07-09
|
||||
> **用途**：合并评审 / Gitea PR 描述 / 冲突解决对照表
|
||||
> **Gitea**：https://axs.kuma1xn.vip/admin/Nexus
|
||||
|
||||
---
|
||||
|
||||
## 1. 两分支现状
|
||||
|
||||
| 分支 | 提交 | 说明 |
|
||||
|------|------|------|
|
||||
| **`main`** | `5520434d` | 主项目全量历史（598 提交）；含运维侧 6～7 月功能 + **一键登录 bootstrap→SSH 回退** |
|
||||
| **`release/20260708-axs`** | `74149e0d` | 发布快照（孤儿 squash）；含 **宝塔 Session 1～2h 掉线修复** + **`/app-v2`** + 发布制品链 |
|
||||
|
||||
两分支 **无共同祖先**，不能普通 fast-forward，需 `--allow-unrelated-histories` 或按模块 cherry-pick。
|
||||
|
||||
**推荐合并方向**：`release/20260708-axs` → `main`（保留 main 历史，吸收 release 独有能力）。
|
||||
|
||||
```bash
|
||||
cd /path/to/Nexus
|
||||
git fetch https://axs.kuma1xn.vip/admin/Nexus.git main release/20260708-axs
|
||||
git checkout main
|
||||
git merge FETCH_HEAD:release/20260708-axs -m "merge: release/20260708-axs 宝塔 Session + app-v2" --allow-unrelated-histories
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. `main` 已有、合并时需保留的功能
|
||||
|
||||
### 2.1 宝塔一键登录：bootstrap 失败恢复 SSH 回退（2026-07-08 · 运维侧）
|
||||
|
||||
**问题**：2026-06-21「自动 bootstrap」后，新机 API 未就绪时 bootstrap 失败直接 `raise`，不再走 SSH `tools.py`，一键登录整链中断。
|
||||
|
||||
**行为**：
|
||||
|
||||
- 未配置 API 时仍先 `source=immediate` bootstrap（best-effort）
|
||||
- 非凭据类错误（`ssh_command_failed`、`bt_not_installed` 等）→ **继续 SSH 临时登录**
|
||||
- 仅 `ssh_auth_failed` / `ssh_no_credentials` / `ssh_sudo_required` / `missing_center_ip` 硬中断
|
||||
|
||||
**关键代码**：
|
||||
|
||||
| 文件 | 要点 |
|
||||
|------|------|
|
||||
| `server/application/services/btpanel_service.py` | `BOOTSTRAP_LOGIN_HARD_FAIL_ERRORS`、`_create_login_url_fresh` |
|
||||
| `server/infrastructure/btpanel/ssh_bootstrap.py` | 检测 `class/common.py`（非空 panel 目录）；写 `api.json` 前 `makedirs` config |
|
||||
| `tests/test_btpanel_login_url.py` | `test_create_login_url_falls_back_to_ssh_when_bootstrap_fails` |
|
||||
|
||||
**Changelog**：`docs/changelog/2026-07-08-btpanel-bootstrap-bt-installed-check.md`
|
||||
|
||||
---
|
||||
|
||||
### 2.2 宝塔一键登录：基础能力（main 历史，release 亦有部分重叠）
|
||||
|
||||
| 功能 | 文件 |
|
||||
|------|------|
|
||||
| 未配置时自动 bootstrap + 倒计时 | `useBtPanelLogin.ts`、`btpanel_service.py`（2026-06-21） |
|
||||
| 临时 token 24h | `BT_TEMP_LOGIN_TTL_SECONDS`、`btpanel_service._login_url_via_api` |
|
||||
| 登录 URL 短窗口 Redis 缓存 + 去重 | `login_url_lock.py`、`create_login_url` 双检锁 |
|
||||
| 主列表/终端一键登录按钮 | `ServersPage.vue`、`TerminalPage.vue`、`ServerTableRowActions.vue` |
|
||||
| 批量获取 API | `useBtPanelBatchBootstrap.ts` |
|
||||
| API 端口漂移 SSH 修复 | `_try_login_url_via_api`、`_repair_ip_whitelist` |
|
||||
|
||||
---
|
||||
|
||||
### 2.3 Agent 监测与告警
|
||||
|
||||
| 功能 | 文件 | Changelog |
|
||||
|------|------|-----------|
|
||||
| 告警连续超阈门控（默认 3 次才 Telegram） | `server/utils/alert_streak.py`、`alert_metrics.py`、`watch_alerts.py` | `2026-07-04-alert-streak-gate.md` |
|
||||
| Agent CPU 双模式采样 | `web/agent/cpu_metrics.py`、`server/api/agent.py` | `2026-07-02-agent-cpu-sampling.md` |
|
||||
| 监测槽双模式 / Pin | `watch_service.py`、`useWatchPins.ts` | `2026-07-01-agent-watch-dual-mode.md` |
|
||||
| 离线巡检发报前 SSH 复检心跳 | `offline_daily_report_schedule.py` | `d50120d1` |
|
||||
| 统计卡：未设路径 / 离线 | `useServerStatsCards.ts` | `2026-07-02-stats-unset-path-offline-card.md` |
|
||||
|
||||
---
|
||||
|
||||
### 2.4 服务器列表与批量
|
||||
|
||||
| 功能 | 文件 |
|
||||
|------|------|
|
||||
| 分类筛选栏 / 备注弹窗 / 站点链接 | `ServerCategoryFilterBar.vue`、`ServerRemarkDialog.vue`、`serverSiteUrl.ts` |
|
||||
| 未设路径表与主表对齐 | `ServerUnsetPathPanel.vue` |
|
||||
| 检测路径：搜 `crmeb` 目录 | `server_batch_common.py` | `2026-07-05-detect-path-crmeb.md` |
|
||||
| IP/域名定时检测 | `ip_domain_detect_schedule.py`、`ip_domain_detect_loop.py` | `2026-06-24-ip-domain-detect-schedule.md` |
|
||||
| nginx 域名探测 | `nginx_domain_detect.py`、`site_host.py` |
|
||||
| 跨服务器文件传输增强 | `server_file_transfer_service.py`、`useServerFileTransfer.ts` |
|
||||
| 上传目录权限探测 | `files_upload_permissions.py` |
|
||||
|
||||
---
|
||||
|
||||
### 2.5 后台清理与配置
|
||||
|
||||
| 功能 | 文件 |
|
||||
|------|------|
|
||||
| 告警日志 / 审计日志定期清理 | `alert_log_purge.py`、`audit_log_purge.py`、`alert_log_repo.py` |
|
||||
| 订阅 IP 刷新主 IP 修复 | `ip_allowlist_refresh.py` | `2026-06-23-subscription-ip-refresh-primary-fix.md` |
|
||||
|
||||
---
|
||||
|
||||
### 2.6 部署与发布源
|
||||
|
||||
| 功能 | 文件 |
|
||||
|------|------|
|
||||
| 默认 Gitea：`axs.kuma1xn.vip`（HTTPS） | `deploy/nexus-1panel.sh`、`nexus-1panel.secrets.sh.example` |
|
||||
| 全量分批推送（避 Cloudflare 524） | `scripts/git-push-axs-full.sh` |
|
||||
| 本机 rsync 生产部署 | `deploy/rsync-local-to-server.sh`、`deploy-production.sh` |
|
||||
|
||||
---
|
||||
|
||||
## 3. `release/20260708-axs` 独有、合并时必须带入 `main` 的功能
|
||||
|
||||
> 详见 release 内 `docs/release/20260708/PR-MERGE-说明-20260709.md`
|
||||
|
||||
### 3.1 宝塔 Session 1～2 小时掉线修复（核心）
|
||||
|
||||
**现象**：多窗口一键登录宝塔，约 1～2h 刷新后陆续掉线。
|
||||
|
||||
**根因**：部分宝塔 `task.py` 硬编码 `3600` 秒清理 `tmp_login` session，与 Nexus 24h tmp_token 不一致。
|
||||
|
||||
**行为**：
|
||||
|
||||
- SSH bootstrap / 一键登录前检测并 patch `task.py` → 读 `public.get_session_timeout()`，默认 `86400`
|
||||
- 远端 `flock` + `mktemp` + atomic replace
|
||||
- `extra_attrs.bt_panel` 记录 `session_cleanup_ttl_ok`、`session_cleanup_task_state` 等
|
||||
- 登录 API 响应带 `diagnostics`（TTL 修补状态）
|
||||
- `bootstrap_lock` 带 `wait_timeout_seconds`，避免并发 bootstrap 互踢
|
||||
|
||||
**关键文件**：
|
||||
|
||||
```text
|
||||
server/application/services/btpanel_service.py # _ensure_session_cleanup_ttl_for_login 等
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py # ensure_session_cleanup_ttl() 远端脚本
|
||||
server/infrastructure/btpanel/bootstrap_lock.py
|
||||
server/api/btpanel.py # diagnostics 字段
|
||||
tests/test_btpanel_temp_login_ttl.py
|
||||
tests/test_btpanel_bootstrap_lock.py
|
||||
tests/test_btpanel_get_config.py
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3.2 `/app-v2` 第二后台
|
||||
|
||||
| 项 | 说明 |
|
||||
|----|------|
|
||||
| 路径 | `/app-v2/`（旧 `/app/` 保留） |
|
||||
| 技术栈 | React + TS + Vite + shadcn/ui + TanStack Query/Table + Zustand |
|
||||
| 目录 | `frontend-v2/`、`web/app-v2/` |
|
||||
| 构建 | `Dockerfile.prod` 多阶段、`frontend-v2/scripts/scan-app-v2-sensitive.mjs` |
|
||||
| 路由 | `server/main.py` 挂载静态 |
|
||||
|
||||
---
|
||||
|
||||
### 3.3 发布制品化工具链
|
||||
|
||||
```text
|
||||
scripts/prepare_release_artifact.py
|
||||
scripts/generate_release_bundle.py
|
||||
scripts/scan_release_bundle.py
|
||||
scripts/write_release_metadata.py
|
||||
scripts/publish_release_bundle.py
|
||||
scripts/run_local_release_gate.py
|
||||
deploy/preflight-release-host.sh
|
||||
deploy/apply-release-bundle.sh
|
||||
```
|
||||
|
||||
发布包 SHA256（release 记录）：`46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b`
|
||||
|
||||
---
|
||||
|
||||
### 3.4 文档与 Skill（release 独有目录）
|
||||
|
||||
```text
|
||||
docs/release/20260708/ # 宝塔 Session、app-v2、安全巡检、发布记录
|
||||
.skills/nexus-btpanel-review/
|
||||
.skills/nexus-security-review/
|
||||
.skills/nexus-ssh-safety/
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. 合并冲突热点（必须手工合）
|
||||
|
||||
### 4.1 `server/application/services/btpanel_service.py`
|
||||
|
||||
**两边都要保留**：
|
||||
|
||||
| 来源 | 保留内容 |
|
||||
|------|----------|
|
||||
| **main** | `BOOTSTRAP_LOGIN_HARD_FAIL_ERRORS`；bootstrap 失败 → SSH 回退（非凭据类不 raise） |
|
||||
| **release** | `_ensure_session_cleanup_ttl_for_login`；`_session_cleanup_ttl_*`；`diagnostics`；`BootstrapLockTimeout` |
|
||||
|
||||
合并后 `_create_login_url_fresh` 推荐顺序：
|
||||
|
||||
1. 未配置 → immediate bootstrap（失败按 main 规则决定是否继续）
|
||||
2. 已配置 → `_ensure_session_cleanup_ttl_for_login`
|
||||
3. API 临时登录 → SSH 回退
|
||||
|
||||
### 4.2 `server/infrastructure/btpanel/ssh_bootstrap.py`
|
||||
|
||||
| 来源 | 保留 |
|
||||
|------|------|
|
||||
| **main** | `common.py` 真安装检测；`makedirs` config |
|
||||
| **release** | `ensure_session_cleanup_ttl()`；`atomic_write_json`；`flock`；`session_cleanup_*` 字段 |
|
||||
|
||||
### 4.3 `server/main.py` / `Dockerfile.prod`
|
||||
|
||||
- 从 **release** 带入 `/app-v2` 静态挂载与构建阶段
|
||||
- 保留 **main** 现有中间件与安装向导逻辑
|
||||
|
||||
### 4.4 `tests/test_btpanel_login_url.py`
|
||||
|
||||
- 合并 release 的 session TTL / lock 测试
|
||||
- 保留 main 的 `test_create_login_url_falls_back_to_ssh_when_bootstrap_fails`
|
||||
|
||||
---
|
||||
|
||||
## 5. 合并后验证清单
|
||||
|
||||
```bash
|
||||
# 单元测试（合并冲突解决后）
|
||||
.venv/bin/pytest tests/test_btpanel_login_url.py tests/test_btpanel_ssh_bootstrap.py \
|
||||
tests/test_btpanel_temp_login_ttl.py tests/test_btpanel_bootstrap_lock.py -q
|
||||
|
||||
# 发布门禁（若合并了 release 脚本）
|
||||
bash scripts/run_local_release_gate.sh
|
||||
```
|
||||
|
||||
**人工验收**：
|
||||
|
||||
- [ ] `/app/` 旧后台 200
|
||||
- [ ] `/app-v2/` 新后台 200（若合并 app-v2）
|
||||
- [ ] 新机一键登录：bootstrap 失败仍能 SSH 打开（main 修复）
|
||||
- [ ] 已装宝塔一键登录后 **2h 刷新仍在线**（release Session 修复）
|
||||
- [ ] 同一子机连点一键登录不互踢 token（login_url_lock）
|
||||
- [ ] `GET /api/btpanel/servers/{id}/login-url` 含 `diagnostics`（release）
|
||||
|
||||
---
|
||||
|
||||
## 6. 合并后部署
|
||||
|
||||
```bash
|
||||
# 生产（中心机）
|
||||
cd /opt/nexus
|
||||
git remote set-url origin https://axs.kuma1xn.vip/admin/Nexus.git
|
||||
git fetch origin main && git checkout main && git reset --hard origin/main
|
||||
sudo env NEXUS_ROOT=/opt/nexus bash deploy/nexus-1panel.sh upgrade --skip-git
|
||||
|
||||
# 或 release 包路径
|
||||
bash deploy/preflight-release-host.sh
|
||||
bash deploy/apply-release-bundle.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Gitea PR 摘要（可直接粘贴）
|
||||
|
||||
```markdown
|
||||
## 合并摘要
|
||||
|
||||
将 `release/20260708-axs` 合并入 `main`，统一 SSOT。
|
||||
|
||||
### release 带入
|
||||
|
||||
- 宝塔 task.py hardcoded 3600 → session_timeout 自动修复（解决 1～2h 掉线）
|
||||
- `/app-v2` 第二后台
|
||||
- 发布制品化 / preflight / apply-release-bundle
|
||||
- bootstrap_lock、login diagnostics
|
||||
|
||||
### main 保留
|
||||
|
||||
- 一键登录 bootstrap 失败 → SSH 临时登录回退（新机 API 未就绪）
|
||||
- ssh_bootstrap 真安装检测（common.py）+ config makedirs
|
||||
- 6～7 月运维功能：告警连续门控、crmeb 路径检测、文件传输、日志清理等
|
||||
- axs Gitea 默认发布源 + 分批推送脚本
|
||||
|
||||
### 冲突重点
|
||||
|
||||
`btpanel_service.py`、`ssh_bootstrap.py` — 两套宝塔逻辑必须同时保留，见本文 §4。
|
||||
|
||||
### 验证
|
||||
|
||||
pytest 宝塔专项 + `/app` + `/app-v2` + 2h 刷新不掉线
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 相关文档索引
|
||||
|
||||
| 文档 | 路径 |
|
||||
|------|------|
|
||||
| release 原 PR 说明 | `docs/release/20260708/PR-MERGE-说明-20260709.md`（在 release 分支） |
|
||||
| 宝塔掉线方案 | `docs/release/20260708/Nexus-宝塔一键登录长期掉线修复方案与代码改进.md` |
|
||||
| app-v2 说明 | `docs/release/20260708/Nexus-app-v2-双后台实施说明-20260707.md` |
|
||||
| main bootstrap 回退 | `docs/changelog/2026-07-08-btpanel-bootstrap-bt-installed-check.md` |
|
||||
| Gitea 发布说明 | `docs/release/20260708/README-Gitea发布说明-20260708.md` |
|
||||
@@ -0,0 +1,105 @@
|
||||
# PR 合并说明：选择性合并 release/20260708-axs 到 main
|
||||
|
||||
> 工作分支：`merge/release-20260708-axs-into-main`
|
||||
> 目标分支：`main`
|
||||
> 编写日期：2026-07-09
|
||||
|
||||
## 1. 为什么不是直接 merge
|
||||
|
||||
`main` 与 `release/20260708-axs` 不是同源历史，普通 merge 会报 `refusing to merge unrelated histories`。本分支采用文件级/功能级选择性移植，避免大面积冲突和误删。
|
||||
|
||||
## 2. 本次合并内容
|
||||
|
||||
### 2.1 宝塔一键登录稳定性
|
||||
|
||||
合入：
|
||||
|
||||
- Redis 分布式 `login_url_lock`，一键登录使用 fail-fast，避免同一服务器并发生成多个 single-use tmp_token；
|
||||
- 取消短窗口缓存登录 URL，避免返回已被消费的 tmp_token；
|
||||
- 一键登录前执行宝塔 session cleanup TTL 兜底检测/修复；
|
||||
- 支持相对 `/login?tmp_token=...` URL 规范化，不再额外依赖 SSH resolve；
|
||||
- `bootstrap_lock` 改为 Redis 分布式锁；
|
||||
- `bootstrap_state` 增加 session cleanup TTL 修复状态字段。
|
||||
|
||||
特别保留 main 最新修复：
|
||||
|
||||
- 未安装宝塔时抛出友好错误；
|
||||
- bootstrap 非硬失败时仍允许 SSH 临时登录回退。
|
||||
|
||||
### 2.2 Gitea 白名单同步
|
||||
|
||||
合入：
|
||||
|
||||
- `server/application/services/gitea_allowlist_service.py`；
|
||||
- `/api/settings/gitea-allowlist` 查询/保存/同步接口；
|
||||
- `server/config.py` 中 `GITEA_ALLOWLIST_*` 可变配置；
|
||||
- 登录 IP 白名单订阅刷新后自动同步到 Gitea nginx allowlist；
|
||||
- 无订阅 URL 时手动增删 IP 也会更新有效白名单并触发 Gitea auto-sync。
|
||||
|
||||
### 2.3 全局 API Key 隐藏
|
||||
|
||||
合入：
|
||||
|
||||
- 删除后端 `POST /api/settings/api-key/reveal` 明文返回入口；
|
||||
- 旧后台 `SettingsPage.vue` 删除 API Key 显示/复制卡片；
|
||||
- app-v2 设置页继续通过 safe display keys 过滤敏感配置。
|
||||
|
||||
### 2.4 /app-v2 第二后台
|
||||
|
||||
新增并提交：
|
||||
|
||||
- `frontend-v2/` React + TypeScript + Vite 源码；
|
||||
- `web/app-v2/` 构建产物；
|
||||
- 不替换旧后台 `/app/`。
|
||||
|
||||
### 2.5 发布包/部署链路
|
||||
|
||||
合入：
|
||||
|
||||
- `scripts/generate_release_bundle.py`；
|
||||
- `scripts/scan_release_bundle.py`；
|
||||
- `scripts/publish_release_bundle.py`；
|
||||
- `deploy/preflight-release-host.sh`；
|
||||
- `deploy/apply-release-bundle.sh`；
|
||||
- `deploy/nexus-1panel.sh` 的 profile 缺失兜底和 `upgrade --skip-git` 支持。
|
||||
|
||||
保留 main 的 AXS 默认 Gitea 源：
|
||||
|
||||
- `NEXUS_GITEA_HOST=axs.kuma1xn.vip`；
|
||||
- `git_remote_url()` 的 https/http scheme-aware 逻辑。
|
||||
|
||||
## 3. 本次刻意没有覆盖的内容
|
||||
|
||||
- 没有覆盖 `web/app/` 旧后台构建产物，避免重新引入 `/app/#/servers` 白屏风险；
|
||||
- 没有覆盖 `frontend/src/pages/ServersPage.vue`，保留 main 中 selectedItems 初始化顺序修复；
|
||||
- 没有整文件覆盖 `deploy/nexus-1panel.sh` 的默认源配置；
|
||||
- 没有提交 `frontend-v2/node_modules/`。
|
||||
|
||||
## 4. 验证结果
|
||||
|
||||
已执行：
|
||||
|
||||
```text
|
||||
python -m py_compile server/api/settings.py server/config.py server/background/ip_allowlist_refresh.py server/application/services/gitea_allowlist_service.py server/application/services/btpanel_service.py server/infrastructure/btpanel/login_url_lock.py server/infrastructure/btpanel/bootstrap_lock.py server/infrastructure/btpanel/bootstrap_state.py scripts/generate_release_bundle.py scripts/scan_release_bundle.py scripts/publish_release_bundle.py
|
||||
|
||||
.venv-codex-test\Scripts\python.exe -m pytest tests/test_gitea_allowlist_service.py tests/test_btpanel_login_url.py tests/test_publish_release_bundle.py -q
|
||||
|
||||
30 passed in 0.70s
|
||||
```
|
||||
|
||||
静态确认：
|
||||
|
||||
- `web/app` 未改动；
|
||||
- `frontend/src/pages/ServersPage.vue` 未改动；
|
||||
- `frontend/src/pages/SettingsPage.vue` 和 `server/api/settings.py` 中已无 `api-key/reveal`；
|
||||
- `frontend-v2/node_modules` 被 ignore，未进入待提交文件。
|
||||
|
||||
## 5. 合并后建议验证
|
||||
|
||||
1. 打开 `/app/#/servers`，确认旧后台服务器页不白屏；
|
||||
2. 打开 `/app-v2/`，确认第二后台可访问；
|
||||
3. 后台设置页确认不再显示全局 API Key；
|
||||
4. 对一台已安装宝塔的服务器执行一键登录，确认能打开；
|
||||
5. 对一台无宝塔服务器执行一键登录，确认返回友好提示；
|
||||
6. 对启用 Gitea 白名单的环境执行一次手动同步；
|
||||
7. 新增宝塔或一键登录前确认 hardcoded_3600/session cleanup TTL 兜底检测有日志记录。
|
||||
@@ -0,0 +1,362 @@
|
||||
# Nexus PR 合并说明：宝塔 Session 稳定性修复与 /app-v2 双后台
|
||||
|
||||
> 目标分支：`release/20260708-axs`
|
||||
> 本地提交基线：`1933f0af6e647818e716ed194cdb92d7ed7bb47a`
|
||||
> 编写日期：2026-07-09
|
||||
> 推荐用途：复制本文件核心内容到 Gitea Pull Request 描述，用于合并评审。
|
||||
|
||||
## 1. 合并结论
|
||||
|
||||
建议合并。该分支主要解决 Nexus 的宝塔一键登录在 1～2 小时后刷新掉线的问题，同时加入 `/app-v2` 第二后台与发布制品化工具链。
|
||||
|
||||
本分支不是单点热修，而是一组围绕“宝塔长期登录稳定性 + 新后台并行上线 + 发布可验证”的完整改进：
|
||||
|
||||
- 一键登录前自动检测并修复宝塔 `task.py` 中硬编码 `3600` 秒清理 `tmp_login` session 的问题；
|
||||
- 对同一台宝塔服务器的一键登录生成过程加锁，避免并发打开多个宝塔时 tmp token / session 互相覆盖；
|
||||
- 新增 `/app-v2` 第二后台，保持旧后台 `/app/` 可继续使用，支持渐进替换；
|
||||
- 增强发布包、发布前检查、发布验证和回滚脚本；
|
||||
- 补齐代码审查、调用链、安全巡检、发布记录等文档。
|
||||
|
||||
## 2. 背景问题
|
||||
|
||||
用户实际现象：
|
||||
|
||||
```text
|
||||
Nexus 一键登录宝塔成功
|
||||
同时打开多台/多窗口宝塔
|
||||
约 1～2 小时后刷新页面陆续掉线
|
||||
```
|
||||
|
||||
根因链路：
|
||||
|
||||
```text
|
||||
Nexus 一键登录成功
|
||||
→ 宝塔生成 tmp_login session 文件
|
||||
→ 宝塔 BT-Task 定时清理 session
|
||||
→ 部分宝塔 task.py 硬编码超过 3600 秒删除 tmp_login session
|
||||
→ 1～2 小时后刷新
|
||||
→ tmp_login session 已被删除
|
||||
→ 宝塔判定掉线
|
||||
```
|
||||
|
||||
此外，同时打开多个宝塔时，同一台宝塔如果被重复触发一键登录，可能出现登录 URL / tmp token 生成冲突，因此本分支加入了分布式锁与远端 bootstrap 锁。
|
||||
|
||||
## 3. 本次核心改动
|
||||
|
||||
### 3.1 宝塔一键登录长期不掉线修复
|
||||
|
||||
关键能力：
|
||||
|
||||
- 登录前自动检测宝塔 `task.py` 是否存在 hardcoded `3600` 清理逻辑；
|
||||
- 自动修复为读取 `public.get_session_timeout()`，无法读取时使用默认 `86400`；
|
||||
- 对新增宝塔也执行兜底检测/修复；
|
||||
- 一键登录前再次兜底检测/修复，避免漏修服务器；
|
||||
- 修复过程使用 SSH bootstrap，包含远端 `flock`、`mktemp`、atomic replace，降低并发和半写入风险；
|
||||
- 同一宝塔登录 URL 生成加 Redis 分布式锁，防止同一服务器被并发打开时 token/session 互相覆盖。
|
||||
|
||||
重点文件：
|
||||
|
||||
```text
|
||||
server/application/services/btpanel_service.py
|
||||
server/infrastructure/btpanel/login_url_lock.py
|
||||
server/infrastructure/btpanel/bootstrap_lock.py
|
||||
server/infrastructure/btpanel/ssh_bootstrap.py
|
||||
server/api/btpanel.py
|
||||
```
|
||||
|
||||
相关测试：
|
||||
|
||||
```text
|
||||
tests/test_btpanel_bootstrap_lock.py
|
||||
tests/test_btpanel_get_config.py
|
||||
tests/test_btpanel_login_url.py
|
||||
tests/test_btpanel_login_url_route.py
|
||||
tests/test_btpanel_ssh_bootstrap.py
|
||||
tests/test_btpanel_temp_login_ttl.py
|
||||
```
|
||||
|
||||
### 3.2 `/app-v2` 第二后台
|
||||
|
||||
新增第二后台，路径为：
|
||||
|
||||
```text
|
||||
/app-v2/
|
||||
```
|
||||
|
||||
设计目标：
|
||||
|
||||
- 不替换旧后台 `/app/`，双后台并行；
|
||||
- 保留原功能入口，逐步迁移；
|
||||
- 更现代、更快、更适合后续 UI 重构；
|
||||
- 全局 API Key 等敏感值不直接展示真实值。
|
||||
|
||||
技术栈：
|
||||
|
||||
```text
|
||||
React + TypeScript + Vite
|
||||
shadcn/ui + Tailwind
|
||||
TanStack Query
|
||||
TanStack Table
|
||||
Zustand
|
||||
```
|
||||
|
||||
重点文件：
|
||||
|
||||
```text
|
||||
frontend-v2/
|
||||
web/app-v2/
|
||||
frontend-v2/scripts/scan-app-v2-sensitive.mjs
|
||||
server/main.py
|
||||
Dockerfile
|
||||
Dockerfile.prod
|
||||
```
|
||||
|
||||
### 3.3 发布制品化与验证工具链
|
||||
|
||||
本分支加入/增强了发布包生成、扫描、元数据、发布前检查和发布辅助脚本：
|
||||
|
||||
```text
|
||||
scripts/prepare_release_artifact.py
|
||||
scripts/generate_release_bundle.py
|
||||
scripts/scan_release_bundle.py
|
||||
scripts/write_release_metadata.py
|
||||
scripts/publish_release_bundle.py
|
||||
scripts/check_text_integrity.py
|
||||
scripts/generate_release_diff.py
|
||||
scripts/run_local_release_gate.py
|
||||
```
|
||||
|
||||
服务器侧脚本：
|
||||
|
||||
```text
|
||||
deploy/preflight-release-host.sh
|
||||
deploy/apply-release-bundle.sh
|
||||
deploy/sync_webapp_to_container.sh
|
||||
```
|
||||
|
||||
发布包：
|
||||
|
||||
```text
|
||||
C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz
|
||||
```
|
||||
|
||||
SHA256：
|
||||
|
||||
```text
|
||||
46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
## 4. 验证结果
|
||||
|
||||
本地 release gate 已通过：
|
||||
|
||||
```text
|
||||
Python py_compile
|
||||
bash -n deploy shell
|
||||
部署排除规则检查
|
||||
文本完整性检查
|
||||
/app-v2 build:safe
|
||||
app-v2 sensitive scan
|
||||
宝塔专项 pytest
|
||||
发布辅助脚本测试
|
||||
```
|
||||
|
||||
测试结果：
|
||||
|
||||
```text
|
||||
65 passed
|
||||
```
|
||||
|
||||
发布包验证：
|
||||
|
||||
```text
|
||||
size_mb=27.02
|
||||
entries=2409
|
||||
OK: release bundle looks clean
|
||||
apply-release-bundle.sh --validate-only passed
|
||||
metadata / .sha256 / tar 实际 SHA 一致
|
||||
```
|
||||
|
||||
重点人工验证建议：
|
||||
|
||||
- `/app/` 旧后台可访问；
|
||||
- `/app-v2/` 新后台可访问；
|
||||
- 宝塔一键登录可打开；
|
||||
- 同一台宝塔连续/并发触发一键登录不会互相覆盖；
|
||||
- 新增宝塔在一键登录前会自动检测/修复 hardcoded `3600`；
|
||||
- 典型宝塔登录 2 小时后刷新仍保持登录状态。
|
||||
|
||||
## 5. 合并风险与边界
|
||||
|
||||
### 5.1 主要风险
|
||||
|
||||
1. **宝塔远端 patch 风险**
|
||||
修复逻辑会通过 SSH 修改目标宝塔服务器上的 `task.py`。本项目定位中，管理员远程执行命令属于产品能力，因此这不是普通越权漏洞，但合并后需要继续保持审计日志与失败可见性。
|
||||
|
||||
2. **不同宝塔版本兼容性**
|
||||
部分宝塔版本 `task.py` 内容可能不同。当前逻辑已经使用检测/备份/原子替换/失败回退策略，但建议继续抽检更多系统版本。
|
||||
|
||||
3. **双后台静态资源体积**
|
||||
分支包含旧后台和新后台静态资源，仓库和发布包会变大。当前发布包约 27MB，可接受。
|
||||
|
||||
4. **远端批量修复节奏**
|
||||
线上 420 台里曾识别出 148 台存在 hardcoded_3600。合并后建议继续采用分批检测/修复，不建议一次性对全部服务器无观察窗口地全量变更。
|
||||
|
||||
### 5.2 不属于本次合并要解决的问题
|
||||
|
||||
- 不在本次合并中重构所有后台 UI；
|
||||
- 不强制删除旧后台 `/app/`；
|
||||
- 不改变 `script_service` 管理员远程执行命令的产品定位；
|
||||
- 不依赖账号密码替代宝塔 API 登录；账号密码一键登录可作为后续增强方案单独设计。
|
||||
|
||||
## 6. 推荐合并方式
|
||||
|
||||
### 6.1 推荐路径
|
||||
|
||||
推荐在 Gitea 上创建 Pull Request：
|
||||
|
||||
```text
|
||||
source: release/20260708-axs
|
||||
target: main
|
||||
```
|
||||
|
||||
PR 地址：
|
||||
|
||||
```text
|
||||
https://axs.kuma1xn.vip/admin/Nexus/pulls/new/release/20260708-axs
|
||||
```
|
||||
|
||||
建议标题：
|
||||
|
||||
```text
|
||||
release: 宝塔 Session 长期登录修复与 /app-v2 双后台
|
||||
```
|
||||
|
||||
建议合并策略：
|
||||
|
||||
```text
|
||||
Create merge commit
|
||||
```
|
||||
|
||||
理由：本分支是发布型分支，包含后端修复、前端新增、发布脚本和文档。保留 merge commit 更方便后续定位整次发布。
|
||||
|
||||
### 6.2 合并前检查
|
||||
|
||||
合并前建议在 Gitea 页面确认：
|
||||
|
||||
- 目标分支是 `main`；
|
||||
- source 分支是 `release/20260708-axs`；
|
||||
- 文件变更中包含 `docs/release/20260708/` 说明；
|
||||
- 没有 `.venv`、`node_modules`、`.env`、`.pem` 等运行环境文件；
|
||||
- PR 描述中粘贴本说明的第 1～8 节。
|
||||
|
||||
## 7. 合并后部署方式
|
||||
|
||||
### 7.1 仅上传 + preflight
|
||||
|
||||
```cmd
|
||||
cd /d C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\work\nexus_code_context\snapshots\nexus-source-20260707-112042
|
||||
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b
|
||||
```
|
||||
|
||||
### 7.2 正式 apply
|
||||
|
||||
preflight 无异常后再加 `--apply`：
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\publish_release_bundle.py ^
|
||||
--remote nexus ^
|
||||
--tarball C:\Users\uzuma\Documents\Codex\2026-07-06\yuu\outputs\nexus-release-20260708.tar.gz ^
|
||||
--sha256 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b ^
|
||||
--apply
|
||||
```
|
||||
|
||||
### 7.3 部署后验证
|
||||
|
||||
```cmd
|
||||
.venv-py312-codex\Scripts\python.exe scripts\verify_online_release.py --base-url https://api.synaglobal.vip
|
||||
```
|
||||
|
||||
期望：
|
||||
|
||||
```text
|
||||
OK: health
|
||||
OK: /app
|
||||
OK: /app-v2
|
||||
OK: online release verification passed
|
||||
```
|
||||
|
||||
## 8. 回滚策略
|
||||
|
||||
如果合并后未部署：
|
||||
|
||||
```text
|
||||
在 Gitea revert merge commit 即可。
|
||||
```
|
||||
|
||||
如果已经部署：
|
||||
|
||||
1. 使用 `deploy/apply-release-bundle.sh` 生成的备份目录回滚；
|
||||
2. 恢复上一版 `/opt/nexus` 文件；
|
||||
3. 重启 Nexus 服务/容器；
|
||||
4. 验证 `/health`、`/app/`；
|
||||
5. 如果问题只影响 `/app-v2/`，可临时隐藏 `/app-v2/` 路由或静态资源，不影响旧后台 `/app/`。
|
||||
|
||||
宝塔远端 `task.py` 修复属于向更长 session timeout 的兼容性修复。若个别宝塔异常，优先按单台服务器恢复宝塔备份文件，不建议全局回滚。
|
||||
|
||||
## 9. 文档索引
|
||||
|
||||
本分支已包含详细文档，集中在：
|
||||
|
||||
```text
|
||||
docs/release/20260708/
|
||||
```
|
||||
|
||||
建议优先阅读：
|
||||
|
||||
```text
|
||||
docs/release/20260708/Nexus-项目说明文档-20260708.md
|
||||
docs/release/20260708/Nexus-release-index-20260708.md
|
||||
docs/release/20260708/Nexus-release-ready-checklist-20260708.md
|
||||
docs/release/20260708/Nexus-宝塔一键登录长期掉线修复方案与代码改进.md
|
||||
docs/release/20260708/Nexus-app-v2-双后台实施说明-20260707.md
|
||||
docs/release/20260708/Nexus-manual-deploy-commands-20260708.md
|
||||
```
|
||||
|
||||
## 10. 可直接复制到 Gitea PR 的摘要
|
||||
|
||||
```markdown
|
||||
## 合并摘要
|
||||
|
||||
本 PR 修复 Nexus 宝塔一键登录 1～2 小时后刷新掉线的问题，并新增 /app-v2 第二后台与发布制品化工具链。
|
||||
|
||||
### 核心改动
|
||||
|
||||
- 一键登录前自动检测/修复宝塔 task.py hardcoded 3600 清理 tmp_login session 的问题；
|
||||
- 基于 public.get_session_timeout() 或默认 86400 延长 tmp_login session 有效期；
|
||||
- 新增 Redis 分布式锁，避免同一宝塔并发生成登录 URL/token 互相覆盖；
|
||||
- SSH bootstrap 使用 flock / mktemp / atomic replace 降低远端 patch 风险；
|
||||
- 新增 /app-v2 第二后台，旧后台 /app/ 保留；
|
||||
- 增强发布包生成、扫描、preflight、validate-only、apply 与回滚脚本；
|
||||
- 补齐发布说明、调用链、安全巡检、宝塔修复记录等文档。
|
||||
|
||||
### 验证
|
||||
|
||||
- release gate 通过；
|
||||
- 宝塔专项测试通过；
|
||||
- 发布辅助脚本测试通过；
|
||||
- 合计 65 passed；
|
||||
- 发布包扫描通过；
|
||||
- apply-release-bundle.sh --validate-only 通过；
|
||||
- 发布包 SHA256: 46299832fb78e8cc196f85cf1928f34eea4deee82dbc83b67883394f0359036b。
|
||||
|
||||
### 风险
|
||||
|
||||
- 会通过 SSH 对目标宝塔服务器 task.py 做自动修复，已加入检测、备份、锁和原子替换；
|
||||
- /app-v2 与 /app 双后台并行，不删除旧后台；
|
||||
- 建议合并后先 preflight，再 apply，并对宝塔一键登录做 2 小时刷新验证。
|
||||
```
|
||||
@@ -0,0 +1,25 @@
|
||||
# Nexus Gitea 鍙戝竷璇存槑锛?026-07-08锛?
|
||||
|
||||
鏈洰褰曟敹褰曟湰娆?Nexus 鍙戝竷銆佸鏌ャ€佸疂濉?Session 淇銆?app-v2 鍙屽悗鍙般€佺幆澧冧慨澶嶄笌鍙戝竷楠岃瘉鐩稿叧璇存槑鏂囨。銆?
|
||||
|
||||
## 鏈鏍稿績鍐呭
|
||||
|
||||
- 瀹濆涓€閿櫥褰曢暱鏈熸帀绾夸慨澶嶏細鐧诲綍鍓嶈嚜鍔ㄦ娴?淇 hardcoded_3600锛岄伩鍏?tmp_login session 琚?1 灏忔椂纭竻銆?
|
||||
- 鏂板瀹濆鑷姩鍏滃簳锛氭柊澧炴湇鍔″櫒鍜屼竴閿櫥褰曞墠閮戒細杩涜 session 淇妫€娴嬨€?
|
||||
- /app-v2 绗簩鍚庡彴锛歊eact + TypeScript + Vite + shadcn/ui + Tailwind + TanStack Query/Table + Zustand銆?
|
||||
- 鍙戝竷鍖呬笌鍙戝竷宸ュ叿閾撅細鏈湴 release gate銆乥undle scan銆乿alidate-only 宸查€氳繃銆?
|
||||
|
||||
## 鎺ㄨ崘鍏ュ彛鏂囨。
|
||||
|
||||
- Nexus-椤圭洰璇存槑鏂囨。-20260708.md
|
||||
- Nexus-release-index-20260708.md
|
||||
- Nexus-release-ready-checklist-20260708.md
|
||||
- Nexus-manual-deploy-commands-20260708.md
|
||||
- Nexus-瀹濆涓€閿櫥褰曢暱鏈熸帀绾夸慨澶嶆柟妗堜笌浠ｇ爜鏀硅繘.md
|
||||
- Nexus-app-v2-鍙屽悗鍙板疄鏂借鏄?20260707.md
|
||||
|
||||
|
||||
## 合并说明入口
|
||||
|
||||
- PR-MERGE-说明-20260709.md：用于 Gitea Pull Request 合并评审，可直接复制到 PR 描述。
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta name="theme-color" content="#070b16" />
|
||||
<title>Nexus App V2</title>
|
||||
</head>
|
||||
<body>
|
||||
<div id="root"></div>
|
||||
<script type="module" src="/src/main.tsx"></script>
|
||||
</body>
|
||||
</html>
|
||||
Generated
+3087
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"name": "nexus-app-v2",
|
||||
"private": true,
|
||||
"version": "0.1.0",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"dev": "vite --host 0.0.0.0 --port 3002",
|
||||
"build": "tsc --noEmit && vite build",
|
||||
"preview": "vite preview --host 0.0.0.0 --port 3003",
|
||||
"scan:sensitive": "node ./scripts/scan-app-v2-sensitive.mjs",
|
||||
"build:safe": "npm run build && npm run scan:sensitive"
|
||||
},
|
||||
"dependencies": {
|
||||
"@tanstack/react-query": "^5.91.2",
|
||||
"@tanstack/react-table": "^8.21.3",
|
||||
"@tanstack/react-virtual": "^3.13.12",
|
||||
"@vitejs/plugin-react": "^5.1.1",
|
||||
"class-variance-authority": "^0.7.1",
|
||||
"clsx": "^2.1.1",
|
||||
"cmdk": "^1.1.1",
|
||||
"lucide-react": "^0.562.0",
|
||||
"react": "^19.2.3",
|
||||
"react-dom": "^19.2.3",
|
||||
"tailwind-merge": "^3.4.0",
|
||||
"vite": "^8.0.0",
|
||||
"zustand": "^5.0.9"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/node": "^24.12.0",
|
||||
"@types/react": "^19.2.7",
|
||||
"@types/react-dom": "^19.2.3",
|
||||
"autoprefixer": "^10.4.22",
|
||||
"postcss": "^8.5.6",
|
||||
"tailwindcss": "^3.4.18",
|
||||
"typescript": "~5.9.3"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
export default {
|
||||
plugins: {
|
||||
tailwindcss: {},
|
||||
autoprefixer: {},
|
||||
},
|
||||
}
|
||||
@@ -0,0 +1,145 @@
|
||||
#!/usr/bin/env node
|
||||
import fs from 'node:fs'
|
||||
import path from 'node:path'
|
||||
import { fileURLToPath } from 'node:url'
|
||||
|
||||
const __dirname = path.dirname(fileURLToPath(import.meta.url))
|
||||
const appRoot = path.resolve(__dirname, '..')
|
||||
const defaultTarget = path.resolve(appRoot, '..', 'web', 'app-v2')
|
||||
const targetDir = path.resolve(process.argv[2] || defaultTarget)
|
||||
|
||||
const TEXT_FILE_EXTENSIONS = new Set(['.html', '.js', '.css', '.json', '.txt', '.svg', '.map'])
|
||||
const MAX_CONTEXT = 110
|
||||
|
||||
const checks = [
|
||||
{
|
||||
id: 'forbidden-global-api-key-copy',
|
||||
severity: 'error',
|
||||
pattern: /全局\s*API\s*Key|Global\s+API\s+Key/gi,
|
||||
description: 'UI/build output must not expose the global API Key copy.',
|
||||
},
|
||||
{
|
||||
id: 'private-key-block',
|
||||
severity: 'error',
|
||||
pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]{0,4096}?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
|
||||
description: 'Private key material must never be present in app-v2 output.',
|
||||
},
|
||||
{
|
||||
id: 'certificate-request-private-material',
|
||||
severity: 'error',
|
||||
pattern: /-----BEGIN CERTIFICATE REQUEST-----[\s\S]{0,4096}?-----END CERTIFICATE REQUEST-----/g,
|
||||
description: 'CSR/PEM material should not be bundled into app-v2 output.',
|
||||
},
|
||||
{
|
||||
id: 'jwt-like-token',
|
||||
severity: 'error',
|
||||
pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
|
||||
description: 'JWT-like token detected in app-v2 output.',
|
||||
},
|
||||
{
|
||||
id: 'openai-or-generic-sk-token',
|
||||
severity: 'error',
|
||||
pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g,
|
||||
description: 'High-confidence secret key token detected.',
|
||||
},
|
||||
{
|
||||
id: 'github-token',
|
||||
severity: 'error',
|
||||
pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{30,}\b/g,
|
||||
description: 'GitHub token detected.',
|
||||
},
|
||||
{
|
||||
id: 'aws-access-key',
|
||||
severity: 'error',
|
||||
pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
|
||||
description: 'AWS access key id detected.',
|
||||
},
|
||||
{
|
||||
id: 'bearer-token',
|
||||
severity: 'error',
|
||||
pattern: /\bBearer\s+(?!\[REDACTED\]|REDACTED|<redacted>)[A-Za-z0-9._~+\/-]{24,}/gi,
|
||||
description: 'Bearer token detected.',
|
||||
},
|
||||
{
|
||||
id: 'tmp-login-token-value',
|
||||
severity: 'error',
|
||||
pattern: /\btmp_(?:login|token)=(?!\[REDACTED\]|REDACTED|<redacted>)[^&\s"'<>]{8,}/gi,
|
||||
description: 'Baota temporary login token value detected.',
|
||||
},
|
||||
{
|
||||
id: 'url-basic-auth-credentials',
|
||||
severity: 'error',
|
||||
pattern: /https?:\/\/[^\s\/:'"<>@]{1,80}:[^\s\/"'<>@]{1,120}@/gi,
|
||||
description: 'URL contains embedded username/password credentials.',
|
||||
},
|
||||
{
|
||||
id: 'inline-secret-assignment',
|
||||
severity: 'error',
|
||||
pattern: /\b(?:password|passwd|pwd|api[_-]?key|access[_-]?key|secret|private[_-]?key|bt[_-]?key)\b["'\s:=]{1,8}(?!\[REDACTED\]|REDACTED|<redacted>|隐藏|脱敏|null|false|true|undefined)[A-Za-z0-9_./+=:@-]{16,}/gi,
|
||||
description: 'High-confidence inline secret assignment detected.',
|
||||
},
|
||||
]
|
||||
|
||||
function walk(dir) {
|
||||
const entries = fs.readdirSync(dir, { withFileTypes: true })
|
||||
const files = []
|
||||
for (const entry of entries) {
|
||||
const full = path.join(dir, entry.name)
|
||||
if (entry.isDirectory()) files.push(...walk(full))
|
||||
else if (entry.isFile() && TEXT_FILE_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) files.push(full)
|
||||
}
|
||||
return files
|
||||
}
|
||||
|
||||
function contextOf(text, index, length) {
|
||||
const start = Math.max(0, index - MAX_CONTEXT)
|
||||
const end = Math.min(text.length, index + length + MAX_CONTEXT)
|
||||
return text
|
||||
.slice(start, end)
|
||||
.replace(/[\r\n\t]+/g, ' ')
|
||||
.replace(/\s{2,}/g, ' ')
|
||||
}
|
||||
|
||||
function redactMatch(match) {
|
||||
if (match.length <= 18) return match
|
||||
return match.slice(0, 8) + '...[' + match.length + ' chars]...' + match.slice(-6)
|
||||
}
|
||||
|
||||
if (!fs.existsSync(targetDir)) {
|
||||
console.error('[app-v2-sensitive-scan] target directory does not exist: ' + targetDir)
|
||||
process.exit(2)
|
||||
}
|
||||
|
||||
const files = walk(targetDir)
|
||||
const findings = []
|
||||
for (const file of files) {
|
||||
const rel = path.relative(targetDir, file).replace(/\\/g, '/')
|
||||
const text = fs.readFileSync(file, 'utf8')
|
||||
for (const check of checks) {
|
||||
check.pattern.lastIndex = 0
|
||||
for (const match of text.matchAll(check.pattern)) {
|
||||
findings.push({
|
||||
file: rel,
|
||||
check: check.id,
|
||||
severity: check.severity,
|
||||
description: check.description,
|
||||
offset: match.index ?? 0,
|
||||
match: redactMatch(match[0]),
|
||||
context: contextOf(text, match.index ?? 0, match[0].length),
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (findings.length > 0) {
|
||||
console.error('[app-v2-sensitive-scan] FAILED: ' + findings.length + ' finding(s) in ' + targetDir)
|
||||
for (const finding of findings) {
|
||||
console.error('- [' + finding.severity + '] ' + finding.check + ' ' + finding.file + '@' + finding.offset)
|
||||
console.error(' ' + finding.description)
|
||||
console.error(' match: ' + finding.match)
|
||||
console.error(' context: ' + finding.context)
|
||||
}
|
||||
process.exit(1)
|
||||
}
|
||||
|
||||
console.log('[app-v2-sensitive-scan] OK: scanned ' + files.length + ' file(s), no high-confidence secrets found in ' + targetDir)
|
||||
@@ -0,0 +1,11 @@
|
||||
import { lazy, Suspense } from 'react'
|
||||
|
||||
const DashboardPage = lazy(() => import('~features/dashboard/DashboardPage'))
|
||||
|
||||
export default function App(): JSX.Element {
|
||||
return (
|
||||
<Suspense fallback={<div className="min-h-screen bg-nexus-bg text-slate-100" />}>
|
||||
<DashboardPage />
|
||||
</Suspense>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
import type { ReactNode } from 'react'
|
||||
import { cn } from '@/lib/utils'
|
||||
|
||||
interface BadgeProps {
|
||||
children: ReactNode
|
||||
tone?: 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
dot?: boolean
|
||||
className?: string
|
||||
}
|
||||
|
||||
const toneClass = {
|
||||
green: 'bg-emerald-400/15 text-emerald-200',
|
||||
blue: 'bg-sky-400/15 text-sky-200',
|
||||
amber: 'bg-amber-400/15 text-amber-200',
|
||||
red: 'bg-red-400/15 text-red-200',
|
||||
slate: 'bg-slate-400/10 text-slate-200',
|
||||
purple: 'bg-violet-400/15 text-violet-200',
|
||||
}
|
||||
|
||||
const dotClass = {
|
||||
green: 'bg-emerald-400',
|
||||
blue: 'bg-sky-400',
|
||||
amber: 'bg-amber-400',
|
||||
red: 'bg-red-400',
|
||||
slate: 'bg-slate-400',
|
||||
purple: 'bg-violet-400',
|
||||
}
|
||||
|
||||
export function Badge({ children, tone = 'slate', dot = false, className }: BadgeProps): JSX.Element {
|
||||
return (
|
||||
<span className={cn('inline-flex items-center gap-2 rounded-full px-3 py-1 text-xs font-bold', toneClass[tone], className)}>
|
||||
{dot ? <span className={cn('h-1.5 w-1.5 rounded-full', dotClass[tone])} /> : null}
|
||||
{children}
|
||||
</span>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
import type { HTMLAttributes, ReactNode } from 'react'
|
||||
import { cn } from '@/lib/utils'
|
||||
|
||||
interface PanelProps extends HTMLAttributes<HTMLDivElement> {
|
||||
children: ReactNode
|
||||
}
|
||||
|
||||
export function Panel({ className, children, ...props }: PanelProps): JSX.Element {
|
||||
return <section className={cn('glass-panel rounded-[1.65rem]', className)} {...props}>{children}</section>
|
||||
}
|
||||
@@ -0,0 +1,308 @@
|
||||
import { Component, useCallback, useState } from 'react'
|
||||
import type { ErrorInfo, ReactNode } from 'react'
|
||||
import { useMutation } from '@tanstack/react-query'
|
||||
import { Activity, AlertTriangle, ArrowUpRight, Gauge, Radio, ShieldCheck, Sparkles } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { ApiError } from '@/lib/api'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import { AppShell } from './components/AppShell'
|
||||
import { AssetInventoryPage } from './components/AssetInventoryPage'
|
||||
import { BtPanelPage } from './components/BtPanelPage'
|
||||
import { BtResourceOverviewPage } from './components/BtResourceOverviewPage'
|
||||
import { BtDomainSslPage } from './components/BtDomainSslPage'
|
||||
import { AuditTimeline } from './components/AuditTimeline'
|
||||
import { AuditLogPage } from './components/AuditLogPage'
|
||||
import { CommandPalette } from './components/CommandPalette'
|
||||
import { ExecutionRecordsPage } from './components/ExecutionRecordsPage'
|
||||
import { GlobalSearchPage } from './components/GlobalSearchPage'
|
||||
import { HealthScore } from './components/HealthScore'
|
||||
import { SecurityInspectionPage } from './components/SecurityInspectionPage'
|
||||
import { SettingsOverviewPage } from './components/SettingsOverviewPage'
|
||||
import { ScriptLibraryPage } from './components/ScriptLibraryPage'
|
||||
import { ServerDrawer } from './components/ServerDrawer'
|
||||
import { ServerTable } from './components/ServerTable'
|
||||
import { StatCard } from './components/StatCard'
|
||||
import { TaskCenter } from './components/TaskCenter'
|
||||
import { TaskCenterPage } from './components/TaskCenterPage'
|
||||
import { TerminalFilesPage } from './components/TerminalFilesPage'
|
||||
import { TrendPanel } from './components/TrendPanel'
|
||||
import { WatchMonitoringPage } from './components/WatchMonitoringPage'
|
||||
import { OperationLogsPage } from './components/OperationLogsPage'
|
||||
import { TtlMatrix } from './components/TtlMatrix'
|
||||
import { createBtLoginUrl } from './api/dashboardApi'
|
||||
import { useDashboardData } from './hooks/useDashboardData'
|
||||
import type { ServerAsset } from './data/dashboardData'
|
||||
|
||||
const releaseCards = [
|
||||
{ label: 'V2 当前策略', value: '双后台并行', icon: Sparkles, tone: 'text-cyan-300', desc: '/app 保留，/app-v2 分阶段替换。' },
|
||||
{ label: '登录稳定性', value: 'TTL 兜底修复', icon: ShieldCheck, tone: 'text-emerald-300', desc: '一键登录前检测 hardcoded_3600。' },
|
||||
{ label: '响应优化', value: 'Query 缓存', icon: Gauge, tone: 'text-blue-300', desc: '减少重复请求，首屏分块加载。' },
|
||||
{ label: '实时能力', value: 'Agent 心跳', icon: Radio, tone: 'text-violet-300', desc: '后续接入 WebSocket 事件流。' },
|
||||
]
|
||||
|
||||
interface DashboardErrorBoundaryProps {
|
||||
children: ReactNode
|
||||
fallback: (error: Error) => ReactNode
|
||||
}
|
||||
|
||||
interface DashboardErrorBoundaryState {
|
||||
error: Error | null
|
||||
}
|
||||
|
||||
class DashboardErrorBoundary extends Component<DashboardErrorBoundaryProps, DashboardErrorBoundaryState> {
|
||||
state: DashboardErrorBoundaryState = { error: null }
|
||||
|
||||
static getDerivedStateFromError(error: Error): DashboardErrorBoundaryState {
|
||||
return { error }
|
||||
}
|
||||
|
||||
componentDidCatch(_error: Error, _errorInfo: ErrorInfo): void {
|
||||
// TanStack Query suspense throws into this boundary; UI fallback handles auth/API errors.
|
||||
}
|
||||
|
||||
render(): ReactNode {
|
||||
if (this.state.error) return this.props.fallback(this.state.error)
|
||||
return this.props.children
|
||||
}
|
||||
}
|
||||
|
||||
export default function DashboardPage(): JSX.Element {
|
||||
const sessionStatus = useAppStore((state) => state.sessionStatus)
|
||||
|
||||
return (
|
||||
<AppShell>
|
||||
{sessionStatus === 'checking' ? <CheckingState /> : null}
|
||||
{sessionStatus === 'guest' ? <LoginRequired reason="当前 /app-v2 需要复用 Nexus 后台登录态。" /> : null}
|
||||
{sessionStatus === 'authenticated' ? (
|
||||
<DashboardErrorBoundary fallback={(error) => <DashboardErrorState error={error} />}>
|
||||
<DashboardContent />
|
||||
</DashboardErrorBoundary>
|
||||
) : null}
|
||||
</AppShell>
|
||||
)
|
||||
}
|
||||
|
||||
function DashboardContent(): JSX.Element {
|
||||
const { servers, stats, total, mode, warning } = useDashboardData()
|
||||
const activeModule = useAppStore((state) => state.activeModule)
|
||||
const [loginLoadingId, setLoginLoadingId] = useState<string | null>(null)
|
||||
const [loginMessage, setLoginMessage] = useState<string | null>(null)
|
||||
|
||||
const { mutate: requestBtLogin } = useMutation({
|
||||
mutationFn: async (server: ServerAsset) => {
|
||||
if (!server.sourceId) throw new Error('该服务器缺少后端 ID，无法创建宝塔一键登录链接。')
|
||||
return createBtLoginUrl(server.sourceId)
|
||||
},
|
||||
onSuccess: (data, server) => {
|
||||
window.open(data.url, '_blank', 'noopener,noreferrer')
|
||||
setLoginMessage(server.name + ' 已生成一键登录链接；后端已执行 TTL 兜底检测。')
|
||||
},
|
||||
onError: (error) => {
|
||||
setLoginMessage(error instanceof Error ? error.message : '一键登录失败，请稍后重试。')
|
||||
},
|
||||
onSettled: () => setLoginLoadingId(null),
|
||||
})
|
||||
|
||||
const handleBtLogin = useCallback((server: ServerAsset): void => {
|
||||
setLoginMessage(null)
|
||||
setLoginLoadingId(server.id)
|
||||
requestBtLogin(server)
|
||||
}, [requestBtLogin])
|
||||
|
||||
return (
|
||||
<>
|
||||
<CommandPalette servers={servers} onBtLogin={handleBtLogin} />
|
||||
<div className="space-y-6 p-5 lg:p-10">
|
||||
{warning ? <Notice tone="amber" title="已切换演示数据" message={warning} /> : null}
|
||||
{loginMessage ? <Notice tone={loginMessage.includes('失败') || loginMessage.includes('无法') ? 'red' : 'green'} title="一键登录" message={loginMessage} /> : null}
|
||||
</div>
|
||||
|
||||
{activeModule === 'assets' ? (
|
||||
<AssetInventoryPage servers={servers} total={total} mode={mode} loginLoadingId={loginLoadingId} onBtLogin={handleBtLogin} />
|
||||
) : activeModule === 'btpanel' ? (
|
||||
<BtPanelPage servers={servers} total={total} mode={mode} loginLoadingId={loginLoadingId} onBtLogin={handleBtLogin} />
|
||||
) : activeModule === 'btresources' ? (
|
||||
<BtResourceOverviewPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'btdomainssl' ? (
|
||||
<BtDomainSslPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'search' ? (
|
||||
<GlobalSearchPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'tasks' ? (
|
||||
<TaskCenterPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'workspace' ? (
|
||||
<TerminalFilesPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'monitoring' ? (
|
||||
<WatchMonitoringPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'operations' ? (
|
||||
<OperationLogsPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'scripts' ? (
|
||||
<ScriptLibraryPage mode={mode} />
|
||||
) : activeModule === 'executions' ? (
|
||||
<ExecutionRecordsPage mode={mode} />
|
||||
) : activeModule === 'audit' ? (
|
||||
<AuditLogPage mode={mode} />
|
||||
) : activeModule === 'security' ? (
|
||||
<SecurityInspectionPage servers={servers} total={total} mode={mode} />
|
||||
) : activeModule === 'settings' ? (
|
||||
<SettingsOverviewPage servers={servers} total={total} mode={mode} />
|
||||
) : (
|
||||
<div id="dashboard" className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-5">
|
||||
{stats.map((stat) => (
|
||||
<StatCard key={stat.title} {...stat} />
|
||||
))}
|
||||
<HealthScore servers={servers} />
|
||||
</section>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[1.1fr_.75fr_.8fr]">
|
||||
<TrendPanel mode={mode} />
|
||||
<TtlMatrix servers={servers} />
|
||||
<TaskCenter servers={servers} total={total} mode={mode} />
|
||||
</section>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
{releaseCards.map((card) => (
|
||||
<Panel key={card.label} className="group overflow-hidden p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<card.icon className={'h-5 w-5 ' + card.tone} />
|
||||
</div>
|
||||
<ArrowUpRight className="h-4 w-4 text-slate-600 transition group-hover:text-cyan-300" />
|
||||
</div>
|
||||
<div className="mt-5 text-xs font-black uppercase tracking-[0.14em] text-slate-500">{card.label}</div>
|
||||
<div className="mt-2 text-lg font-black text-white">{card.value}</div>
|
||||
<p className="mt-2 text-sm font-medium leading-6 text-slate-500">{card.desc}</p>
|
||||
</Panel>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[minmax(0,1fr)_28rem]">
|
||||
<ServerTable servers={servers} total={total} mode={mode} loginLoadingId={loginLoadingId} onBtLogin={handleBtLogin} />
|
||||
<ServerDrawer servers={servers} onBtLogin={handleBtLogin} />
|
||||
</section>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[minmax(0,1fr)_28rem]">
|
||||
<AuditTimeline />
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-10 -top-10 h-36 w-36 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-tight text-white">迁移看板</h2>
|
||||
<p className="mt-1 text-sm font-medium text-slate-500">功能不减少：未迁移入口全部保留旧后台回退。</p>
|
||||
</div>
|
||||
<Badge tone="green" dot>安全</Badge>
|
||||
</div>
|
||||
<div className="mt-6 space-y-4">
|
||||
<MigrationRow label="总览 Dashboard" value="V2 首屏已完成" progress="100%" tone="bg-emerald-400" />
|
||||
<MigrationRow label="服务器资产" value="表格 / 详情已接真实 API" progress="80%" tone="bg-cyan-400" />
|
||||
<MigrationRow label="宝塔面板 / 一键登录" value="V2 页面已接入，配置编辑回旧后台" progress="85%" tone="bg-blue-400" />
|
||||
<MigrationRow label="任务中心" value="只读运行态已迁移，执行/重试回旧后台" progress="60%" tone="bg-violet-400" />
|
||||
<MigrationRow label="审计日志" value="审计 / 告警只读查询已迁移" progress="70%" tone="bg-sky-400" />
|
||||
<MigrationRow label="安全巡检" value="风险总览已迁移，修复动作回旧后台" progress="65%" tone="bg-amber-400" />
|
||||
<MigrationRow label="系统设置" value="只读概览已迁移，敏感写操作回旧后台" progress="55%" tone="bg-slate-400" />
|
||||
<MigrationRow label="终端 / 文件" value="安全入口已迁移，真实执行/写文件回旧后台" progress="45%" tone="bg-purple-400" />
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring mt-7 inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<Activity className="h-4 w-4" /> 打开旧后台完整功能
|
||||
</a>
|
||||
</Panel>
|
||||
</section>
|
||||
</div>
|
||||
)}
|
||||
</>
|
||||
)
|
||||
}
|
||||
|
||||
interface NoticeProps {
|
||||
tone: 'green' | 'amber' | 'red'
|
||||
title: string
|
||||
message: string
|
||||
}
|
||||
|
||||
function Notice({ tone, title, message }: NoticeProps): JSX.Element {
|
||||
const toneClass = tone === 'green'
|
||||
? 'border-emerald-400/20 bg-emerald-400/10 text-emerald-100'
|
||||
: tone === 'red'
|
||||
? 'border-red-400/20 bg-red-400/10 text-red-100'
|
||||
: 'border-amber-400/20 bg-amber-400/10 text-amber-100'
|
||||
return (
|
||||
<div className={'rounded-3xl border px-5 py-4 text-sm font-semibold ' + toneClass}>
|
||||
<span className="font-black">{title}：</span>{message}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function CheckingState(): JSX.Element {
|
||||
return (
|
||||
<div className="p-5 lg:p-10">
|
||||
<Panel className="p-8">
|
||||
<div className="h-5 w-40 animate-pulse rounded-full bg-slate-700" />
|
||||
<div className="mt-4 h-4 w-96 max-w-full animate-pulse rounded-full bg-slate-800" />
|
||||
<div className="mt-8 grid gap-4 md:grid-cols-4">
|
||||
{Array.from({ length: 4 }, (_, index) => <div key={index} className="h-28 animate-pulse rounded-3xl bg-slate-800/70" />)}
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function LoginRequired({ reason }: { reason: string }): JSX.Element {
|
||||
return (
|
||||
<div className="p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-8">
|
||||
<div className="absolute -right-10 -top-10 h-40 w-40 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="flex max-w-3xl flex-col gap-4">
|
||||
<Badge tone="amber" dot className="w-fit px-4 py-2">需要登录</Badge>
|
||||
<h2 className="text-3xl font-black tracking-tight text-white">请先登录 Nexus 后台</h2>
|
||||
<p className="text-sm font-semibold leading-7 text-slate-400">{reason} 登录后再进入 /app-v2，可直接读取真实服务器、宝塔状态，并复用一键登录前 TTL 兜底修复。</p>
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<a href="/app/login" className="focus-ring rounded-2xl bg-cyan-400 px-5 py-3 text-sm font-black text-slate-950">去登录</a>
|
||||
<a href="/app/" className="focus-ring rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-slate-200">打开旧后台</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function DashboardErrorState({ error }: { error: Error }): JSX.Element {
|
||||
if (error instanceof ApiError && error.status === 401) {
|
||||
return <LoginRequired reason="当前登录态已过期或刷新失败，请回旧后台重新登录。" />
|
||||
}
|
||||
return (
|
||||
<div className="p-5 lg:p-10">
|
||||
<Panel className="p-8">
|
||||
<div className="flex items-start gap-4">
|
||||
<div className="grid h-12 w-12 place-items-center rounded-2xl bg-red-400/15 text-red-200"><AlertTriangle className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-2xl font-black text-white">App V2 数据加载异常</h2>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-400">{error.message || '未知错误'}。旧后台仍可正常使用，未迁移功能不会丢失。</p>
|
||||
<a href="/app/" className="focus-ring mt-5 inline-flex rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200">打开旧后台</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface MigrationRowProps {
|
||||
label: string
|
||||
value: string
|
||||
progress: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function MigrationRow({ label, value, progress, tone }: MigrationRowProps): JSX.Element {
|
||||
return (
|
||||
<div>
|
||||
<div className="mb-2 flex items-center justify-between text-sm">
|
||||
<span className="font-black text-slate-200">{label}</span>
|
||||
<span className="font-bold text-slate-500">{value}</span>
|
||||
</div>
|
||||
<div className="h-2 overflow-hidden rounded-full bg-slate-800">
|
||||
<div className={tone + ' h-full rounded-full'} style={{ width: progress }} />
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,138 @@
|
||||
import type { ReactNode } from 'react'
|
||||
import { useEffect } from 'react'
|
||||
import { Activity, Bell, BookOpen, Database, FileClock, Globe2, LayoutDashboard, Search, Server, Settings, ShieldCheck, TerminalSquare, Radio, ListChecks, Wrench, Zap } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import { restoreSession } from '@/lib/api'
|
||||
import { cn } from '@/lib/utils'
|
||||
import type { AppModule } from '@/stores/appStore'
|
||||
|
||||
interface AppShellProps {
|
||||
children: ReactNode
|
||||
}
|
||||
|
||||
interface NavItem {
|
||||
label: string
|
||||
icon: LucideIcon
|
||||
module?: AppModule
|
||||
legacyPath?: string
|
||||
}
|
||||
|
||||
const navItems: NavItem[] = [
|
||||
{ label: '总览 Dashboard', icon: LayoutDashboard, module: 'dashboard' },
|
||||
{ label: '全局搜索', icon: Search, module: 'search' },
|
||||
{ label: '服务器资产', icon: Server, module: 'assets' },
|
||||
{ label: '宝塔面板', icon: ShieldCheck, module: 'btpanel' },
|
||||
{ label: '宝塔资源', icon: Database, module: 'btresources' },
|
||||
{ label: '域名 / SSL', icon: Globe2, module: 'btdomainssl' },
|
||||
{ label: '任务中心', icon: Activity, module: 'tasks' },
|
||||
{ label: '终端 / 文件', icon: TerminalSquare, module: 'workspace' },
|
||||
{ label: '实时监控', icon: Radio, module: 'monitoring' },
|
||||
{ label: '命令日志', icon: ListChecks, module: 'operations' },
|
||||
{ label: '脚本库', icon: BookOpen, module: 'scripts' },
|
||||
{ label: '执行记录', icon: FileClock, module: 'executions' },
|
||||
{ label: '安全巡检', icon: Wrench, module: 'security' },
|
||||
{ label: '审计日志', icon: FileClock, module: 'audit' },
|
||||
{ label: '系统设置', icon: Settings, module: 'settings' },
|
||||
]
|
||||
|
||||
export function AppShell({ children }: AppShellProps): JSX.Element {
|
||||
const setCommandOpen = useAppStore((state) => state.setCommandOpen)
|
||||
const activeModule = useAppStore((state) => state.activeModule)
|
||||
const setActiveModule = useAppStore((state) => state.setActiveModule)
|
||||
const admin = useAppStore((state) => state.admin)
|
||||
const sessionStatus = useAppStore((state) => state.sessionStatus)
|
||||
const setAdmin = useAppStore((state) => state.setAdmin)
|
||||
const setSessionStatus = useAppStore((state) => state.setSessionStatus)
|
||||
|
||||
useEffect(() => {
|
||||
let cancelled = false
|
||||
restoreSession()
|
||||
.then((profile) => {
|
||||
if (cancelled) return
|
||||
setAdmin(profile)
|
||||
setSessionStatus(profile ? 'authenticated' : 'guest')
|
||||
})
|
||||
.catch(() => {
|
||||
if (cancelled) return
|
||||
setAdmin(null)
|
||||
setSessionStatus('guest')
|
||||
})
|
||||
return () => { cancelled = true }
|
||||
}, [setAdmin, setSessionStatus])
|
||||
|
||||
useEffect(() => {
|
||||
const handleKeyDown = (event: KeyboardEvent): void => {
|
||||
if ((event.ctrlKey || event.metaKey) && event.key.toLowerCase() === 'k') {
|
||||
event.preventDefault()
|
||||
setCommandOpen(true)
|
||||
}
|
||||
}
|
||||
window.addEventListener('keydown', handleKeyDown)
|
||||
return () => window.removeEventListener('keydown', handleKeyDown)
|
||||
}, [setCommandOpen])
|
||||
|
||||
return (
|
||||
<div className="min-h-screen bg-nexus-radial text-slate-100">
|
||||
<aside className="fixed inset-y-0 left-0 z-30 hidden w-72 border-r border-white/10 bg-slate-950/70 p-7 backdrop-blur-2xl lg:block">
|
||||
<div className="flex items-center gap-4">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-gradient-to-br from-cyan-300 via-blue-500 to-violet-500 shadow-cyan">
|
||||
<Zap className="h-6 w-6 text-white" />
|
||||
</div>
|
||||
<div>
|
||||
<div className="text-2xl font-black tracking-[-0.06em] text-white">Nexus</div>
|
||||
<div className="text-xs font-black uppercase tracking-[0.18em] text-cyan-300">App V2</div>
|
||||
</div>
|
||||
</div>
|
||||
<nav className="mt-10 space-y-2">
|
||||
{navItems.map((item) => {
|
||||
const isActive = item.module === activeModule
|
||||
const className = cn('focus-ring flex w-full items-center gap-3 rounded-2xl px-4 py-3 text-left text-sm font-black transition', isActive ? 'border border-blue-300/25 bg-blue-400/15 text-white' : 'text-slate-400 hover:bg-white/[0.04] hover:text-white')
|
||||
if (item.module) {
|
||||
const module = item.module
|
||||
return (
|
||||
<button key={item.label} type="button" onClick={() => setActiveModule(module)} className={className} title="App V2 已迁移页面">
|
||||
<item.icon className="h-4 w-4" />
|
||||
{item.label}
|
||||
<span className="ml-auto rounded-full bg-cyan-400/10 px-2 py-0.5 text-[10px] text-cyan-200">V2</span>
|
||||
</button>
|
||||
)
|
||||
}
|
||||
return (
|
||||
<a key={item.label} href={item.legacyPath} className={className} title="迁移中：先回到旧后台对应功能">
|
||||
<item.icon className="h-4 w-4" />
|
||||
{item.label}
|
||||
<span className="ml-auto rounded-full bg-slate-800 px-2 py-0.5 text-[10px] text-slate-400">/app</span>
|
||||
</a>
|
||||
)
|
||||
})}
|
||||
</nav>
|
||||
<div className="absolute bottom-7 left-7 right-7 rounded-3xl border border-white/10 bg-slate-900/70 p-5">
|
||||
<div className="text-sm font-black text-white">双后台并行</div>
|
||||
<p className="mt-2 text-xs font-medium leading-5 text-slate-400">旧 /app 不动，新 /app-v2 逐页替换；未迁移功能先跳回旧后台。</p>
|
||||
<div className="mt-4 flex gap-2"><Badge tone="green" dot>旧后台在线</Badge><Badge tone="blue" dot>V2 灰度</Badge></div>
|
||||
</div>
|
||||
</aside>
|
||||
<main className="lg:pl-72">
|
||||
<header className="sticky top-0 z-20 border-b border-white/10 bg-slate-950/30 px-5 py-4 backdrop-blur-2xl lg:px-10">
|
||||
<div className="flex flex-wrap items-center justify-between gap-4">
|
||||
<div>
|
||||
<h1 className="text-2xl font-black tracking-[-0.05em] text-white lg:text-4xl">Nexus 运维安全控制台</h1>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-400">暗色运维 + 安全中心混合风格 · 功能不减少，组件增强体验</p>
|
||||
</div>
|
||||
<div className="flex items-center gap-3">
|
||||
<button onClick={() => setCommandOpen(true)} className="focus-ring hidden min-w-80 items-center gap-3 rounded-2xl border border-white/10 bg-slate-900/70 px-4 py-3 text-left text-sm font-bold text-slate-400 shadow-glow md:flex">
|
||||
<Search className="h-4 w-4" /> Ctrl K 搜索服务器 / IP / 任务 / 风险
|
||||
</button>
|
||||
<button className="focus-ring relative grid h-12 w-12 place-items-center rounded-2xl border border-white/10 bg-slate-900/70 text-amber-300"><Bell className="h-5 w-5" /><span className="absolute -right-1 -top-1 grid h-5 w-5 place-items-center rounded-full bg-amber-400 text-xs font-black text-slate-950">9</span></button>
|
||||
<a href="/app/" className="focus-ring rounded-2xl border border-cyan-300/25 bg-cyan-400/15 px-4 py-3 text-sm font-black text-cyan-200">旧后台</a>
|
||||
<Badge tone={admin ? 'green' : sessionStatus === 'checking' ? 'blue' : 'slate'} dot className="hidden px-4 py-3 md:inline-flex">{admin?.username ?? (sessionStatus === 'checking' ? '检测登录' : '未登录')}</Badge>
|
||||
</div>
|
||||
</div>
|
||||
</header>
|
||||
{children}
|
||||
</main>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,157 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { ExternalLink, Filter, Search, ShieldCheck, SlidersHorizontal } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { ServerDrawer } from './ServerDrawer'
|
||||
import { ServerTable } from './ServerTable'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface AssetInventoryPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
loginLoadingId?: string | null
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
type StatusFilter = 'all' | ServerAsset['panelStatus']
|
||||
type RiskFilter = 'all' | ServerAsset['risk']
|
||||
|
||||
const statusFilters: Array<{ label: string; value: StatusFilter }> = [
|
||||
{ label: '全部状态', value: 'all' },
|
||||
{ label: '在线', value: 'online' },
|
||||
{ label: '已修复', value: 'patched' },
|
||||
{ label: '待配置', value: 'test' },
|
||||
{ label: '离线', value: 'offline' },
|
||||
]
|
||||
|
||||
const riskFilters: Array<{ label: string; value: RiskFilter }> = [
|
||||
{ label: '全部风险', value: 'all' },
|
||||
{ label: '健康', value: 'healthy' },
|
||||
{ label: '已修复', value: 'patched' },
|
||||
{ label: '建议', value: 'warning' },
|
||||
{ label: '关注', value: 'critical' },
|
||||
]
|
||||
|
||||
function countBy<T extends string>(items: ServerAsset[], getter: (server: ServerAsset) => T, value: T): number {
|
||||
return items.filter((server) => getter(server) === value).length
|
||||
}
|
||||
|
||||
export function AssetInventoryPage({ servers, total, mode, loginLoadingId, onBtLogin }: AssetInventoryPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [status, setStatus] = useState<StatusFilter>('all')
|
||||
const [risk, setRisk] = useState<RiskFilter>('all')
|
||||
|
||||
const filteredServers = useMemo(() => {
|
||||
const keyword = query.trim().toLowerCase()
|
||||
return servers.filter((server) => {
|
||||
const matchesKeyword = !keyword || [server.name, server.ip, server.region, server.ttl, server.btBootstrapState ?? '']
|
||||
.some((value) => value.toLowerCase().includes(keyword))
|
||||
const matchesStatus = status === 'all' || server.panelStatus === status
|
||||
const matchesRisk = risk === 'all' || server.risk === risk
|
||||
return matchesKeyword && matchesStatus && matchesRisk
|
||||
})
|
||||
}, [query, risk, servers, status])
|
||||
|
||||
const onlineCount = useMemo(() => servers.filter((server) => server.online !== false).length, [servers])
|
||||
const patchedCount = useMemo(() => countBy(servers, (server) => server.risk, 'patched'), [servers])
|
||||
const warningCount = useMemo(() => servers.filter((server) => server.risk === 'warning' || server.risk === 'critical').length, [servers])
|
||||
const ttlOkCount = useMemo(() => servers.filter((server) => server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s').length, [servers])
|
||||
|
||||
return (
|
||||
<div id="assets" className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-16 h-48 w-48 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="flex flex-wrap items-start justify-between gap-5">
|
||||
<div className="max-w-3xl">
|
||||
<Badge tone="blue" dot className="px-4 py-2">V2 已迁移页面</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">服务器资产中心</h2>
|
||||
<p className="mt-3 text-sm font-semibold leading-7 text-slate-400">
|
||||
先把高频资产检索、宝塔状态、一键登录入口迁到 /app-v2；旧后台完整功能仍可从右上角或侧栏回退。
|
||||
</p>
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ExternalLink className="h-4 w-4" /> 旧后台完整资产管理
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
<AssetMetric label="在线资产" value={String(onlineCount)} sub={'当前接口返回 ' + String(servers.length) + ' / 总计 ' + String(total)} tone="text-emerald-300" />
|
||||
<AssetMetric label="TTL 兜底通过" value={String(ttlOkCount)} sub="一键登录前仍由后端再次检测" tone="text-cyan-300" />
|
||||
<AssetMetric label="已修复宝塔" value={String(patchedCount)} sub="hardcoded_3600 修复状态" tone="text-blue-300" />
|
||||
<AssetMetric label="需关注" value={String(warningCount)} sub="SSL / TTL / Agent 建议项" tone="text-amber-300" />
|
||||
</section>
|
||||
|
||||
<Panel className="p-5">
|
||||
<div className="flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-cyan-400/10 text-cyan-200"><Filter className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-base font-black text-white">资产筛选</div>
|
||||
<div className="text-xs font-bold text-slate-500">搜索和筛选都在前端缓存内完成，减少重复请求。</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid gap-3 md:grid-cols-[minmax(16rem,1fr)_12rem_12rem] xl:min-w-[46rem]">
|
||||
<label className="focus-within:ring-2 focus-within:ring-cyan-300/70 flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索名称 / IP / 区域 / TTL" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<select value={status} onChange={(event) => setStatus(event.target.value as StatusFilter)} className="focus-ring rounded-2xl border border-white/10 bg-slate-950/70 px-4 py-3 text-sm font-black text-slate-200">
|
||||
{statusFilters.map((item) => <option key={item.value} value={item.value}>{item.label}</option>)}
|
||||
</select>
|
||||
<select value={risk} onChange={(event) => setRisk(event.target.value as RiskFilter)} className="focus-ring rounded-2xl border border-white/10 bg-slate-950/70 px-4 py-3 text-sm font-black text-slate-200">
|
||||
{riskFilters.map((item) => <option key={item.value} value={item.value}>{item.label}</option>)}
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[minmax(0,1fr)_28rem]">
|
||||
<ServerTable servers={filteredServers} total={mode === 'live' ? total : filteredServers.length} mode={mode} loginLoadingId={loginLoadingId} onBtLogin={onBtLogin} />
|
||||
<div className="space-y-6">
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-emerald-400/10 text-emerald-200"><ShieldCheck className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">登录稳定性说明</h3>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-400">
|
||||
V2 的一键登录只调用后端 /api/btpanel/servers/:id/login-url，不在前端生成 token；后端登录前会做 hardcoded_3600 TTL 兜底检测/修复。
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-blue-400/10 text-blue-200"><SlidersHorizontal className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">迁移边界</h3>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-400">
|
||||
当前页覆盖资产搜索、状态查看、宝塔一键登录；批量编辑、凭据管理、深度审计暂时继续回旧后台，避免功能缺口。
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
<ServerDrawer servers={filteredServers.length ? filteredServers : servers} onBtLogin={onBtLogin} />
|
||||
</div>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface AssetMetricProps {
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function AssetMetric({ label, value, sub, tone }: AssetMetricProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-5">
|
||||
<div className="text-xs font-black uppercase tracking-[0.14em] text-slate-500">{label}</div>
|
||||
<div className={'mt-3 text-4xl font-black tracking-[-0.05em] ' + tone}>{value}</div>
|
||||
<div className="mt-2 text-sm font-semibold leading-6 text-slate-500">{sub}</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,272 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { AlertTriangle, BellRing, CalendarClock, ExternalLink, FileClock, Filter, KeyRound, Search, Server, ShieldCheck, UserRound } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchAuditLogData } from '../api/dashboardApi'
|
||||
import type { AlertHistoryEntry, AuditLogEntry } from '../api/dashboardApi'
|
||||
|
||||
type AuditFilter = 'all' | 'admin' | 'server' | 'btpanel' | 'security' | 'alert'
|
||||
type Severity = 'info' | 'success' | 'warning' | 'danger'
|
||||
|
||||
interface AuditLogPageProps {
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
interface NormalizedAuditEvent {
|
||||
id: string
|
||||
source: 'audit' | 'alert'
|
||||
title: string
|
||||
actor: string
|
||||
target: string
|
||||
detail: string
|
||||
time: string
|
||||
ip: string
|
||||
category: AuditFilter
|
||||
severity: Severity
|
||||
icon: LucideIcon
|
||||
}
|
||||
|
||||
const filters: Array<{ label: string; value: AuditFilter }> = [
|
||||
{ label: '全部', value: 'all' },
|
||||
{ label: '管理员', value: 'admin' },
|
||||
{ label: '服务器', value: 'server' },
|
||||
{ label: '宝塔', value: 'btpanel' },
|
||||
{ label: '安全', value: 'security' },
|
||||
{ label: '告警', value: 'alert' },
|
||||
]
|
||||
|
||||
function sanitizeText(value?: string | number | null): string {
|
||||
return redactSensitiveText(value, '-', 240)
|
||||
}
|
||||
|
||||
|
||||
function formatDateTime(value?: string | null): string {
|
||||
if (!value) return '未知时间'
|
||||
const timestamp = Date.parse(value)
|
||||
if (!Number.isFinite(timestamp)) return value
|
||||
return new Intl.DateTimeFormat('zh-CN', { dateStyle: 'short', timeStyle: 'medium' }).format(timestamp)
|
||||
}
|
||||
|
||||
function inferCategory(item: AuditLogEntry): AuditFilter {
|
||||
const haystack = [item.action, item.target_type, item.detail, item.target_name].filter(Boolean).join(' ').toLowerCase()
|
||||
if (haystack.includes('bt') || haystack.includes('宝塔') || haystack.includes('ttl') || haystack.includes('login')) return 'btpanel'
|
||||
if (haystack.includes('server') || haystack.includes('agent') || haystack.includes('服务器')) return 'server'
|
||||
if (haystack.includes('auth') || haystack.includes('key') || haystack.includes('allowlist') || haystack.includes('security')) return 'security'
|
||||
return 'admin'
|
||||
}
|
||||
|
||||
function inferSeverity(item: AuditLogEntry): Severity {
|
||||
const action = item.action.toLowerCase()
|
||||
const detail = String(item.detail || '').toLowerCase()
|
||||
if (action.includes('delete') || action.includes('remove') || detail.includes('failed') || detail.includes('失败')) return 'warning'
|
||||
if (action.includes('login') || action.includes('create') || action.includes('update') || detail.includes('成功')) return 'success'
|
||||
return 'info'
|
||||
}
|
||||
|
||||
function normalizeAudit(item: AuditLogEntry): NormalizedAuditEvent {
|
||||
const category = inferCategory(item)
|
||||
const targetName = item.target_name || item.target_id || item.target_type || '-'
|
||||
return {
|
||||
id: 'audit-' + String(item.id),
|
||||
source: 'audit',
|
||||
title: sanitizeText(item.action).replaceAll('_', ' '),
|
||||
actor: sanitizeText(item.admin_username),
|
||||
target: sanitizeText(targetName),
|
||||
detail: sanitizeText(item.detail || item.action),
|
||||
time: formatDateTime(item.created_at),
|
||||
ip: sanitizeText(item.ip_address),
|
||||
category,
|
||||
severity: inferSeverity(item),
|
||||
icon: category === 'btpanel' ? KeyRound : category === 'server' ? Server : category === 'security' ? ShieldCheck : UserRound,
|
||||
}
|
||||
}
|
||||
|
||||
function normalizeAlert(item: AlertHistoryEntry): NormalizedAuditEvent {
|
||||
const severity: Severity = item.is_recovery ? 'success' : 'danger'
|
||||
return {
|
||||
id: 'alert-' + String(item.id),
|
||||
source: 'alert',
|
||||
title: item.is_recovery ? '告警恢复：' + sanitizeText(item.alert_type) : '活跃告警：' + sanitizeText(item.alert_type),
|
||||
actor: 'system',
|
||||
target: sanitizeText(item.server_name || item.server_id || '-'),
|
||||
detail: 'value=' + sanitizeText(item.value),
|
||||
time: formatDateTime(item.created_at),
|
||||
ip: '-',
|
||||
category: 'alert',
|
||||
severity,
|
||||
icon: item.is_recovery ? ShieldCheck : AlertTriangle,
|
||||
}
|
||||
}
|
||||
|
||||
function severityTone(severity: Severity): 'green' | 'amber' | 'red' | 'blue' | 'slate' {
|
||||
if (severity === 'success') return 'green'
|
||||
if (severity === 'warning') return 'amber'
|
||||
if (severity === 'danger') return 'red'
|
||||
if (severity === 'info') return 'blue'
|
||||
return 'slate'
|
||||
}
|
||||
|
||||
function severityLabel(severity: Severity): string {
|
||||
if (severity === 'success') return '成功'
|
||||
if (severity === 'warning') return '关注'
|
||||
if (severity === 'danger') return '告警'
|
||||
return '信息'
|
||||
}
|
||||
|
||||
export function AuditLogPage({ mode }: AuditLogPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [filter, setFilter] = useState<AuditFilter>('all')
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['audit-log-v2'],
|
||||
queryFn: fetchAuditLogData,
|
||||
staleTime: 20_000,
|
||||
})
|
||||
|
||||
const events = useMemo(() => {
|
||||
const normalized = [
|
||||
...data.auditItems.map(normalizeAudit),
|
||||
...data.alertItems.map(normalizeAlert),
|
||||
]
|
||||
return normalized.slice(0, 120)
|
||||
}, [data.alertItems, data.auditItems])
|
||||
|
||||
const keyword = query.trim().toLowerCase()
|
||||
const filteredEvents = useMemo(() => events.filter((event) => {
|
||||
const matchesFilter = filter === 'all' || event.category === filter
|
||||
const matchesKeyword = !keyword || [event.title, event.actor, event.target, event.detail, event.ip, event.time]
|
||||
.some((value) => value.toLowerCase().includes(keyword))
|
||||
return matchesFilter && matchesKeyword
|
||||
}), [events, filter, keyword])
|
||||
|
||||
const adminCount = events.filter((event) => event.source === 'audit').length
|
||||
const alertCount = events.filter((event) => event.source === 'alert').length
|
||||
const riskyCount = events.filter((event) => event.severity === 'danger' || event.severity === 'warning').length
|
||||
const btCount = events.filter((event) => event.category === 'btpanel').length
|
||||
|
||||
return (
|
||||
<div id="audit" className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-20 h-56 w-56 rounded-full bg-sky-400/10 blur-3xl" />
|
||||
<div className="flex flex-wrap items-start justify-between gap-5">
|
||||
<div className="max-w-3xl">
|
||||
<Badge tone="blue" dot className="px-4 py-2">V2 审计日志</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">审计日志 / 告警时间线</h2>
|
||||
<p className="mt-3 text-sm font-semibold leading-7 text-slate-400">
|
||||
读取现有 /api/audit/ 和 /api/alert-history/，合并展示管理员操作、宝塔登录兜底、服务器风险和告警恢复。V2 只做只读查询，并在前端再次隐藏疑似密码、Cookie、Token、密钥类字段、私钥片段。
|
||||
</p>
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ExternalLink className="h-4 w-4" /> 旧后台完整查询
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
{data.warning ? (
|
||||
<div className="rounded-3xl border border-amber-400/20 bg-amber-400/10 px-5 py-4 text-sm font-semibold text-amber-100">
|
||||
<span className="font-black">审计数据提示：</span>{data.warning}
|
||||
</div>
|
||||
) : null}
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
<AuditMetric icon={FileClock} label="审计记录" value={String(data.auditTotal || adminCount)} sub="管理员操作记录" tone="text-cyan-300" />
|
||||
<AuditMetric icon={BellRing} label="告警记录" value={String(data.alertTotal || alertCount)} sub="活跃 / 恢复历史" tone="text-amber-300" />
|
||||
<AuditMetric icon={AlertTriangle} label="需关注" value={String(riskyCount)} sub="删除、失败或活跃告警" tone={riskyCount ? 'text-red-300' : 'text-emerald-300'} />
|
||||
<AuditMetric icon={KeyRound} label="宝塔相关" value={String(btCount)} sub="登录、TTL、面板操作" tone="text-violet-300" />
|
||||
</section>
|
||||
|
||||
<Panel className="p-5">
|
||||
<div className="flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-cyan-400/10 text-cyan-200"><Filter className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-lg font-black text-white">审计过滤器</div>
|
||||
<div className="text-sm font-semibold text-slate-500">当前页面数据：{data.mode === 'live' ? '实时 API' : mode === 'live' ? '审计 fallback' : '演示 fallback'}</div>
|
||||
</div>
|
||||
</div>
|
||||
<label className="flex min-w-0 flex-1 items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 xl:max-w-md">
|
||||
<Search className="h-4 w-4 text-slate-500" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索动作、管理员、目标、IP、详情" className="min-w-0 flex-1 bg-transparent text-sm font-semibold text-white outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
<div className="mt-5 flex flex-wrap gap-2">
|
||||
{filters.map((item) => (
|
||||
<button key={item.value} type="button" onClick={() => setFilter(item.value)} className={cn('focus-ring rounded-2xl px-4 py-2 text-sm font-black transition', filter === item.value ? 'bg-cyan-400 text-slate-950' : 'border border-white/10 bg-white/[0.03] text-slate-400 hover:text-white')}>
|
||||
{item.label}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="grid grid-cols-[1fr_auto] gap-4 border-b border-white/10 px-5 py-4">
|
||||
<div>
|
||||
<div className="text-lg font-black text-white">合并时间线</div>
|
||||
<div className="text-sm font-semibold text-slate-500">展示 {String(filteredEvents.length)} 条，敏感字段已隐藏</div>
|
||||
</div>
|
||||
<Badge tone="slate" className="h-fit">只读</Badge>
|
||||
</div>
|
||||
<div className="divide-y divide-white/10">
|
||||
{filteredEvents.map((event) => (
|
||||
<AuditEventRow key={event.id} event={event} />
|
||||
))}
|
||||
{filteredEvents.length === 0 ? (
|
||||
<div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有匹配的审计记录。</div>
|
||||
) : null}
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface AuditMetricProps {
|
||||
icon: LucideIcon
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function AuditMetric({ icon: Icon, label, value, sub, tone }: AuditMetricProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="group overflow-hidden p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<Icon className={'h-5 w-5 ' + tone} />
|
||||
</div>
|
||||
<CalendarClock className="h-4 w-4 text-slate-600 transition group-hover:text-cyan-300" />
|
||||
</div>
|
||||
<div className="mt-5 text-xs font-black uppercase tracking-[0.14em] text-slate-500">{label}</div>
|
||||
<div className="mt-2 text-3xl font-black text-white">{value}</div>
|
||||
<p className="mt-2 text-sm font-medium leading-6 text-slate-500">{sub}</p>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
function AuditEventRow({ event }: { event: NormalizedAuditEvent }): JSX.Element {
|
||||
return (
|
||||
<div className="grid gap-4 px-5 py-5 transition hover:bg-white/[0.03] lg:grid-cols-[auto_minmax(0,1fr)_12rem] lg:items-center">
|
||||
<div className="flex items-start gap-4">
|
||||
<div className="grid h-12 w-12 shrink-0 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<event.icon className="h-5 w-5 text-cyan-200" />
|
||||
</div>
|
||||
<div className="min-w-0">
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<div className="font-black text-white">{event.title}</div>
|
||||
<Badge tone={severityTone(event.severity)} dot>{severityLabel(event.severity)}</Badge>
|
||||
</div>
|
||||
<div className="mt-2 text-sm font-semibold leading-6 text-slate-500">{event.detail}</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid gap-2 text-sm font-semibold text-slate-400 md:grid-cols-3">
|
||||
<div><span className="text-slate-600">操作者：</span>{event.actor}</div>
|
||||
<div><span className="text-slate-600">目标：</span>{event.target}</div>
|
||||
<div><span className="text-slate-600">IP：</span>{event.ip}</div>
|
||||
</div>
|
||||
<div className="text-sm font-black text-slate-500 lg:text-right">{event.time}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { auditEvents } from '../data/dashboardData'
|
||||
import { cn } from '@/lib/utils'
|
||||
|
||||
export function AuditTimeline(): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-6">
|
||||
<h2 className="text-xl font-black tracking-tight text-white">审计时间线</h2>
|
||||
<div className="mt-6 space-y-4">
|
||||
{auditEvents.map((event, index) => (
|
||||
<div key={event.time + '-' + event.title} className="flex gap-4">
|
||||
<div className="w-12 shrink-0 text-xs font-bold text-slate-500">{event.time}</div>
|
||||
<div className="relative flex shrink-0 justify-center">
|
||||
<span className={cn('mt-1 h-2.5 w-2.5 rounded-full', event.color)} />
|
||||
{index < auditEvents.length - 1 ? <span className="absolute top-5 h-8 w-px bg-white/10" /> : null}
|
||||
</div>
|
||||
<div className="text-sm font-semibold text-slate-200">{event.title}</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,324 @@
|
||||
import { useCallback, useEffect, useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { ArrowUpRight, CalendarClock, Globe2, LockKeyhole, Network, Search, Server, ShieldAlert, ShieldCheck } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { redactSensitiveText, summarizeCertificatePayload } from '@/lib/redaction'
|
||||
import { fetchBtDomainSslData } from '../api/dashboardApi'
|
||||
import type { BtDomainSslData, BtResourceRecord, BtSiteDomainGroup } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface BtDomainSslPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type Tone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
|
||||
function field(record: BtResourceRecord | undefined, keys: string[], fallback = '-'): string {
|
||||
if (!record) return fallback
|
||||
for (const key of keys) {
|
||||
const value = record[key]
|
||||
if (value === null || value === undefined || value === '') continue
|
||||
if (typeof value === 'object') continue
|
||||
return redactSensitiveText(value, fallback, 180)
|
||||
}
|
||||
return fallback
|
||||
}
|
||||
|
||||
function recordId(record: BtResourceRecord | undefined): string {
|
||||
return field(record, ['id', 'site_id', 'pid'], '')
|
||||
}
|
||||
|
||||
function siteName(record: BtResourceRecord | undefined): string {
|
||||
return field(record, ['name', 'siteName', 'site_name', 'domain'], '未命名站点')
|
||||
}
|
||||
|
||||
function sitePath(record: BtResourceRecord | undefined): string {
|
||||
return field(record, ['path', 'root_path', 'rootPath'], '-')
|
||||
}
|
||||
|
||||
function siteStatus(record: BtResourceRecord | undefined): { label: string; tone: Tone } {
|
||||
const value = field(record, ['status', 'state'], '').toLowerCase()
|
||||
if (['1', 'running', 'enabled', 'true'].includes(value)) return { label: '运行中', tone: 'green' }
|
||||
if (['0', 'stopped', 'disabled', 'false'].includes(value)) return { label: '已停用', tone: 'amber' }
|
||||
return { label: value || '未知', tone: 'slate' }
|
||||
}
|
||||
|
||||
function domainName(record: BtResourceRecord): string {
|
||||
return field(record, ['name', 'domain', 'Domain', 'domain_name', 'host'], '未命名域名')
|
||||
}
|
||||
|
||||
function sslPayload(record: BtResourceRecord | undefined): unknown {
|
||||
return record?.ssl ?? record?.cert ?? record?.certificate ?? record?.ssl_info
|
||||
}
|
||||
|
||||
function sslSummary(record: BtResourceRecord | undefined): { label: string; detail: string; tone: Tone; expiresAt?: string } {
|
||||
const payload = sslPayload(record)
|
||||
if (payload === -1 || payload === 0 || payload === false || payload === null || payload === undefined || payload === '') {
|
||||
return { label: '未配置', detail: '未发现证书信息', tone: 'amber' }
|
||||
}
|
||||
if (typeof payload === 'object' && !Array.isArray(payload)) {
|
||||
const data = payload as Record<string, unknown>
|
||||
const subject = redactSensitiveText(data.subject || data.dns || data.issuer || data.brand || '证书主体', '证书主体', 120)
|
||||
const expiresAt = String(data.notAfter || data.endtime || data.end_time || data.valid_to || data.expire || '')
|
||||
if (expiresAt) {
|
||||
const timestamp = Date.parse(expiresAt)
|
||||
if (Number.isFinite(timestamp)) {
|
||||
const days = Math.ceil((timestamp - Date.now()) / 86_400_000)
|
||||
if (days < 0) return { label: '已过期', detail: subject + ' · ' + expiresAt, tone: 'red', expiresAt }
|
||||
if (days <= 14) return { label: '即将过期', detail: subject + ' · 剩余 ' + String(days) + ' 天', tone: 'amber', expiresAt }
|
||||
return { label: '有效', detail: subject + ' · 剩余 ' + String(days) + ' 天', tone: 'green', expiresAt }
|
||||
}
|
||||
return { label: '已配置', detail: subject + ' · ' + expiresAt, tone: 'blue', expiresAt }
|
||||
}
|
||||
return { label: '已配置', detail: subject, tone: 'blue' }
|
||||
}
|
||||
return { label: '已配置', detail: summarizeCertificatePayload(payload) || '证书内容已脱敏', tone: 'blue' }
|
||||
}
|
||||
|
||||
function matchSslRecord(site: BtResourceRecord, sslSites: BtResourceRecord[]): BtResourceRecord | undefined {
|
||||
const id = recordId(site)
|
||||
const name = siteName(site)
|
||||
return sslSites.find((item) => {
|
||||
const itemId = recordId(item)
|
||||
const itemName = siteName(item)
|
||||
return (id && itemId && id === itemId) || (name && itemName && name === itemName)
|
||||
})
|
||||
}
|
||||
|
||||
function expiringCount(data: BtDomainSslData): number {
|
||||
return data.sites.filter((site) => sslSummary(matchSslRecord(site, data.sslSites)).tone === 'amber').length
|
||||
}
|
||||
|
||||
function invalidCount(data: BtDomainSslData): number {
|
||||
return data.sites.filter((site) => sslSummary(matchSslRecord(site, data.sslSites)).tone === 'red').length
|
||||
}
|
||||
|
||||
function domainTotal(groups: BtSiteDomainGroup[]): number {
|
||||
return groups.reduce((sum, item) => sum + item.domains.length, 0)
|
||||
}
|
||||
|
||||
export function BtDomainSslPage({ servers, total, mode }: BtDomainSslPageProps): JSX.Element {
|
||||
const btServers = useMemo(() => servers.filter((server) => server.sourceId), [servers])
|
||||
const [selectedServerId, setSelectedServerId] = useState<number | undefined>(() => btServers[0]?.sourceId)
|
||||
const [query, setQuery] = useState('')
|
||||
|
||||
useEffect(() => {
|
||||
if (!selectedServerId && btServers[0]?.sourceId) setSelectedServerId(btServers[0].sourceId)
|
||||
}, [btServers, selectedServerId])
|
||||
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['bt-domain-ssl', selectedServerId],
|
||||
queryFn: () => fetchBtDomainSslData(selectedServerId),
|
||||
staleTime: 60_000,
|
||||
})
|
||||
|
||||
const selectedServer = useMemo(() => btServers.find((server) => server.sourceId === selectedServerId), [btServers, selectedServerId])
|
||||
const normalizedQuery = query.trim().toLowerCase()
|
||||
const filteredSites = useMemo(() => {
|
||||
if (!normalizedQuery) return data.sites
|
||||
return data.sites.filter((site) => [siteName(site), sitePath(site), field(site, ['ps', 'remark', 'note'], '')]
|
||||
.some((value) => value.toLowerCase().includes(normalizedQuery)))
|
||||
}, [data.sites, normalizedQuery])
|
||||
|
||||
const handleServerChange = useCallback((event: React.ChangeEvent<HTMLSelectElement>): void => {
|
||||
const value = Number(event.target.value)
|
||||
setSelectedServerId(Number.isFinite(value) ? value : undefined)
|
||||
}, [])
|
||||
|
||||
const handleQueryChange = useCallback((event: React.ChangeEvent<HTMLInputElement>): void => {
|
||||
setQuery(event.target.value)
|
||||
}, [])
|
||||
|
||||
return (
|
||||
<div id="bt-domain-ssl" className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<Panel className="relative overflow-hidden p-6 lg:p-8">
|
||||
<div className="absolute -right-24 -top-24 h-72 w-72 rounded-full bg-emerald-400/10 blur-3xl" />
|
||||
<div className="relative grid gap-6 xl:grid-cols-[minmax(0,1fr)_28rem]">
|
||||
<div>
|
||||
<Badge tone="green" dot className="px-4 py-2">宝塔域名 / SSL 只读</Badge>
|
||||
<h1 className="mt-5 text-3xl font-black tracking-tight text-white md:text-4xl">集中查看网站、绑定域名和证书状态</h1>
|
||||
<p className="mt-3 max-w-3xl text-sm font-semibold leading-7 text-slate-400">
|
||||
V2 只调用宝塔 GET 接口读取站点、域名、SSL 站点和 PHP 版本；申请证书、上传证书、添加/删除域名、启停网站全部继续回旧后台，避免早期界面误操作生产宝塔。
|
||||
</p>
|
||||
<div className="mt-6 grid gap-3 md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)]">
|
||||
<label className="rounded-3xl border border-white/10 bg-slate-950/70 px-4 py-3">
|
||||
<span className="text-xs font-black uppercase tracking-[0.18em] text-slate-500">宝塔服务器</span>
|
||||
<select value={selectedServerId ?? ''} onChange={handleServerChange} className="mt-2 h-11 w-full bg-transparent text-sm font-black text-white outline-none">
|
||||
{btServers.map((server) => <option key={server.id} value={server.sourceId} className="bg-slate-950 text-white">{server.name} · {server.ip}</option>)}
|
||||
{btServers.length === 0 ? <option value="" className="bg-slate-950 text-white">暂无已配置宝塔服务器</option> : null}
|
||||
</select>
|
||||
</label>
|
||||
<label className="flex items-center gap-3 rounded-3xl border border-white/10 bg-slate-950/70 px-4 py-3">
|
||||
<Search className="h-5 w-5 text-cyan-300" />
|
||||
<input value={query} onChange={handleQueryChange} placeholder="搜索站点 / 路径 / 备注" className="h-12 flex-1 bg-transparent text-sm font-bold text-white outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid gap-3 sm:grid-cols-2">
|
||||
<MetricCard icon={Server} label="当前服务器" value={selectedServer?.name || '未选择'} tone="blue" />
|
||||
<MetricCard icon={Globe2} label="站点数量" value={String(data.sites.length)} tone="green" />
|
||||
<MetricCard icon={Network} label="已读取域名" value={String(domainTotal(data.domainGroups))} tone="purple" />
|
||||
<MetricCard icon={ShieldAlert} label="需关注证书" value={String(expiringCount(data) + invalidCount(data))} tone={invalidCount(data) > 0 ? 'red' : 'amber'} />
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
{data.warning ? <Notice tone="amber" title="已切换演示数据" message={data.warning} /> : null}
|
||||
{data.mode === 'live' && data.sites.length > data.domainGroups.length ? <Notice tone="blue" title="读取限制" message="为避免一次打开数百站点时压垮宝塔面板，V2 只预读前 12 个站点的域名列表；完整域名增删仍回旧后台。" /> : null}
|
||||
{mode === 'fallback' ? <Notice tone="amber" title="资产数据兜底" message={'当前 Dashboard 资产接口处于演示模式，总资产数显示为 ' + String(total) + '。'} /> : null}
|
||||
|
||||
<section className="grid gap-5 xl:grid-cols-[minmax(0,1fr)_24rem]">
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="flex items-center justify-between gap-3 border-b border-white/10 p-6">
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">网站与证书状态</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">只展示证书摘要和到期信息，不展示证书私钥或 CSR 内容。</p>
|
||||
</div>
|
||||
<Badge tone="blue">{filteredSites.length} / {data.sites.length}</Badge>
|
||||
</div>
|
||||
<div className="overflow-x-auto">
|
||||
<table className="w-full min-w-[880px] text-left text-sm">
|
||||
<thead className="bg-slate-950/60 text-xs font-black uppercase tracking-[0.12em] text-slate-500">
|
||||
<tr>
|
||||
<th className="px-5 py-4">站点</th>
|
||||
<th className="px-5 py-4">状态</th>
|
||||
<th className="px-5 py-4">SSL</th>
|
||||
<th className="px-5 py-4">路径</th>
|
||||
<th className="px-5 py-4">备注</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10">
|
||||
{filteredSites.map((site) => {
|
||||
const status = siteStatus(site)
|
||||
const ssl = sslSummary(matchSslRecord(site, data.sslSites))
|
||||
return (
|
||||
<tr key={recordId(site) || siteName(site)} className="bg-white/[0.015] hover:bg-white/[0.04]">
|
||||
<td className="px-5 py-4">
|
||||
<div className="font-black text-white">{siteName(site)}</div>
|
||||
<div className="mt-1 font-mono text-xs text-slate-600">ID {recordId(site) || '-'}</div>
|
||||
</td>
|
||||
<td className="px-5 py-4"><Badge tone={status.tone}>{status.label}</Badge></td>
|
||||
<td className="px-5 py-4">
|
||||
<Badge tone={ssl.tone}>{ssl.label}</Badge>
|
||||
<div className="mt-2 max-w-xs truncate text-xs font-semibold text-slate-500">{ssl.detail}</div>
|
||||
</td>
|
||||
<td className="px-5 py-4"><span className="font-mono text-xs text-slate-400">{sitePath(site)}</span></td>
|
||||
<td className="px-5 py-4 text-slate-400">{field(site, ['ps', 'remark', 'note'], '-')}</td>
|
||||
</tr>
|
||||
)
|
||||
})}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<div className="space-y-5">
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">PHP 版本</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">来自 php-versions GET，只读展示。</p>
|
||||
</div>
|
||||
<Badge tone="purple">{data.phpVersions.length} 个</Badge>
|
||||
</div>
|
||||
<div className="mt-5 flex flex-wrap gap-2">
|
||||
{data.phpVersions.length > 0 ? data.phpVersions.map((item, index) => (
|
||||
<Badge key={String(field(item, ['version', 'name'], String(index)))} tone="slate">{field(item, ['name', 'version', 'title'], 'PHP')}</Badge>
|
||||
)) : <span className="text-sm font-semibold text-slate-500">暂无 PHP 版本数据</span>}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">域名绑定预览</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">最多预读 12 个站点。</p>
|
||||
</div>
|
||||
<Badge tone="green">{domainTotal(data.domainGroups)} 条</Badge>
|
||||
</div>
|
||||
<div className="mt-5 space-y-3">
|
||||
{data.domainGroups.map((group) => (
|
||||
<div key={recordId(group.site) || siteName(group.site)} className="rounded-3xl border border-white/10 bg-white/[0.03] p-4">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div className="min-w-0">
|
||||
<div className="truncate font-black text-white">{siteName(group.site)}</div>
|
||||
{group.domainWarning ? <div className="mt-1 text-xs font-semibold text-amber-300">{group.domainWarning}</div> : null}
|
||||
</div>
|
||||
<Badge tone="blue">{group.domains.length}</Badge>
|
||||
</div>
|
||||
<div className="mt-3 flex flex-wrap gap-2">
|
||||
{group.domains.length > 0 ? group.domains.slice(0, 6).map((domain) => (
|
||||
<span key={domainName(domain)} className="rounded-full bg-slate-950/70 px-3 py-1 font-mono text-xs text-slate-300">{domainName(domain)}</span>
|
||||
)) : <span className="text-xs font-semibold text-slate-600">暂无域名明细</span>}
|
||||
</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start gap-4">
|
||||
<div className="grid h-12 w-12 place-items-center rounded-2xl bg-emerald-400/10 text-emerald-200"><LockKeyhole className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">安全边界</h2>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-500">V2 不申请证书、不上传证书、不新增/删除域名、不启停网站。需要写操作时继续使用旧后台。</p>
|
||||
<a href="/app/btpanel/ssl" className="focus-ring mt-4 inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ArrowUpRight className="h-4 w-4" /> 打开旧后台 SSL 管理
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface MetricCardProps {
|
||||
icon: typeof Server
|
||||
label: string
|
||||
value: string
|
||||
tone: Tone
|
||||
}
|
||||
|
||||
function MetricCard({ icon: Icon, label, value, tone }: MetricCardProps): JSX.Element {
|
||||
const toneClass = tone === 'green'
|
||||
? 'from-emerald-400/20 to-emerald-400/5 text-emerald-200'
|
||||
: tone === 'purple'
|
||||
? 'from-violet-400/20 to-violet-400/5 text-violet-200'
|
||||
: tone === 'red'
|
||||
? 'from-red-400/20 to-red-400/5 text-red-200'
|
||||
: tone === 'amber'
|
||||
? 'from-amber-400/20 to-amber-400/5 text-amber-200'
|
||||
: 'from-cyan-400/20 to-cyan-400/5 text-cyan-200'
|
||||
return (
|
||||
<div className={cn('rounded-3xl border border-white/10 bg-gradient-to-br p-5', toneClass)}>
|
||||
<Icon className="h-5 w-5" />
|
||||
<div className="mt-4 text-xs font-black uppercase tracking-[0.2em] text-slate-500">{label}</div>
|
||||
<div className="mt-1 truncate text-2xl font-black text-white">{value}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface NoticeProps {
|
||||
tone: Tone
|
||||
title: string
|
||||
message: string
|
||||
}
|
||||
|
||||
function Notice({ tone, title, message }: NoticeProps): JSX.Element {
|
||||
const className = tone === 'blue'
|
||||
? 'border-cyan-400/20 bg-cyan-400/10 text-cyan-100'
|
||||
: tone === 'green'
|
||||
? 'border-emerald-400/20 bg-emerald-400/10 text-emerald-100'
|
||||
: 'border-amber-400/20 bg-amber-400/10 text-amber-100'
|
||||
return (
|
||||
<div className={cn('rounded-3xl border px-5 py-4 text-sm font-semibold', className)}>
|
||||
<span className="font-black">{title}：</span>{message}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,218 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { ExternalLink, Loader2, LockKeyhole, Search, ShieldAlert, ShieldCheck, TimerReset, Wrench } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface BtPanelPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
loginLoadingId?: string | null
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
type PanelFilter = 'all' | 'configured' | 'ttl-ok' | 'needs-fix' | 'ssl-off'
|
||||
|
||||
const filters: Array<{ label: string; value: PanelFilter }> = [
|
||||
{ label: '全部宝塔', value: 'all' },
|
||||
{ label: '已配置', value: 'configured' },
|
||||
{ label: 'TTL 已兜底', value: 'ttl-ok' },
|
||||
{ label: '需要兜底', value: 'needs-fix' },
|
||||
{ label: 'SSL 未开', value: 'ssl-off' },
|
||||
]
|
||||
|
||||
function isTtlProtected(server: ServerAsset): boolean {
|
||||
return Boolean(server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s')
|
||||
}
|
||||
|
||||
function formatDateTime(value?: string | null): string {
|
||||
if (!value) return '未检查'
|
||||
const timestamp = Date.parse(value)
|
||||
if (!Number.isFinite(timestamp)) return value
|
||||
return new Intl.DateTimeFormat('zh-CN', { dateStyle: 'short', timeStyle: 'short' }).format(timestamp)
|
||||
}
|
||||
|
||||
function filterPanel(server: ServerAsset, filter: PanelFilter, keyword: string): boolean {
|
||||
const matchesKeyword = !keyword || [server.name, server.ip, server.region, server.ttl, server.btBaseUrl ?? '', server.btBootstrapState ?? '']
|
||||
.some((value) => value.toLowerCase().includes(keyword))
|
||||
if (!matchesKeyword) return false
|
||||
if (filter === 'configured') return server.btConfigured === true
|
||||
if (filter === 'ttl-ok') return isTtlProtected(server)
|
||||
if (filter === 'needs-fix') return server.btConfigured === true && !isTtlProtected(server)
|
||||
if (filter === 'ssl-off') return server.ssl === 'disabled'
|
||||
return server.btConfigured === true || Boolean(server.btBaseUrl) || server.panelStatus !== 'offline'
|
||||
}
|
||||
|
||||
export function BtPanelPage({ servers, total, mode, loginLoadingId, onBtLogin }: BtPanelPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [filter, setFilter] = useState<PanelFilter>('all')
|
||||
|
||||
const keyword = query.trim().toLowerCase()
|
||||
const panelServers = useMemo(() => servers.filter((server) => filterPanel(server, filter, keyword)), [filter, keyword, servers])
|
||||
const configuredCount = useMemo(() => servers.filter((server) => server.btConfigured).length, [servers])
|
||||
const ttlProtectedCount = useMemo(() => servers.filter(isTtlProtected).length, [servers])
|
||||
const needsFixCount = useMemo(() => servers.filter((server) => server.btConfigured && !isTtlProtected(server)).length, [servers])
|
||||
const sslOffCount = useMemo(() => servers.filter((server) => server.ssl === 'disabled').length, [servers])
|
||||
|
||||
return (
|
||||
<div id="btpanel" className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-20 h-56 w-56 rounded-full bg-emerald-400/10 blur-3xl" />
|
||||
<div className="flex flex-wrap items-start justify-between gap-5">
|
||||
<div className="max-w-3xl">
|
||||
<Badge tone="green" dot className="px-4 py-2">V2 宝塔面板</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">宝塔登录稳定性中心</h2>
|
||||
<p className="mt-3 text-sm font-semibold leading-7 text-slate-400">
|
||||
重点围绕你遇到的“打开多个宝塔后 1-2 小时陆续掉线”问题：集中展示 TTL 兜底状态、SSL 建议、一键登录入口；配置编辑仍回旧后台。
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ExternalLink className="h-4 w-4" /> 旧后台宝塔配置
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
<BtMetric icon={ShieldCheck} label="已配置宝塔" value={String(configuredCount)} sub={'当前接口返回 ' + String(servers.length) + ' / 总计 ' + String(total)} tone="text-emerald-300" />
|
||||
<BtMetric icon={TimerReset} label="TTL 兜底通过" value={String(ttlProtectedCount)} sub="已 OK 或已自动 patch" tone="text-cyan-300" />
|
||||
<BtMetric icon={Wrench} label="待兜底修复" value={String(needsFixCount)} sub="一键登录前会再次检测/修复" tone={needsFixCount ? 'text-amber-300' : 'text-emerald-300'} />
|
||||
<BtMetric icon={ShieldAlert} label="面板 SSL 建议" value={String(sslOffCount)} sub="公网面板建议开启 SSL" tone={sslOffCount ? 'text-amber-300' : 'text-emerald-300'} />
|
||||
</section>
|
||||
|
||||
<Panel className="p-5">
|
||||
<div className="flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-emerald-400/10 text-emerald-200"><LockKeyhole className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-base font-black text-white">登录前兜底策略</div>
|
||||
<div className="text-xs font-bold text-slate-500">V2 只触发后端接口；真正的 tmp_login / task.py TTL 修复仍由后端执行。</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid gap-3 md:grid-cols-[minmax(16rem,1fr)_12rem] xl:min-w-[34rem]">
|
||||
<label className="focus-within:ring-2 focus-within:ring-emerald-300/70 flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索宝塔名称 / IP / 地址 / 状态" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<select value={filter} onChange={(event) => setFilter(event.target.value as PanelFilter)} className="focus-ring rounded-2xl border border-white/10 bg-slate-950/70 px-4 py-3 text-sm font-black text-slate-200">
|
||||
{filters.map((item) => <option key={item.value} value={item.value}>{item.label}</option>)}
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 xl:grid-cols-2">
|
||||
{panelServers.map((server) => (
|
||||
<BtPanelCard key={server.id} server={server} loading={loginLoadingId === server.id} onBtLogin={onBtLogin} />
|
||||
))}
|
||||
{panelServers.length === 0 ? (
|
||||
<Panel className="p-10 text-center">
|
||||
<div className="text-lg font-black text-white">没有匹配的宝塔面板</div>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">换一个关键词或筛选条件；完整配置仍可回旧后台查看。</p>
|
||||
</Panel>
|
||||
) : null}
|
||||
</section>
|
||||
|
||||
<Panel className="p-6">
|
||||
<h3 className="text-lg font-black text-white">边界说明</h3>
|
||||
<div className="mt-4 grid gap-3 text-sm font-semibold leading-7 text-slate-400 md:grid-cols-3">
|
||||
<p>1. V2 不保存、不显示宝塔密码、Cookie、tmp_login token。</p>
|
||||
<p>2. 一键登录前由后端兜底检测 hardcoded_3600，新加入的宝塔也会走同一链路。</p>
|
||||
<p>3. 宝塔凭据编辑、批量导入、危险配置修改暂时继续走旧后台，避免迁移期功能缺口。</p>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface BtMetricProps {
|
||||
icon: typeof ShieldCheck
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function BtMetric({ icon: Icon, label, value, sub, tone }: BtMetricProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div>
|
||||
<div className="text-xs font-black uppercase tracking-[0.14em] text-slate-500">{label}</div>
|
||||
<div className={'mt-3 text-4xl font-black tracking-[-0.05em] ' + tone}>{value}</div>
|
||||
</div>
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]"><Icon className={'h-5 w-5 ' + tone} /></div>
|
||||
</div>
|
||||
<div className="mt-3 text-sm font-semibold leading-6 text-slate-500">{sub}</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
interface BtPanelCardProps {
|
||||
server: ServerAsset
|
||||
loading: boolean
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
function BtPanelCard({ server, loading, onBtLogin }: BtPanelCardProps): JSX.Element {
|
||||
const ttlProtected = isTtlProtected(server)
|
||||
const canLogin = Boolean(server.sourceId && server.btConfigured)
|
||||
return (
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="border-b border-white/[0.06] p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4">
|
||||
<div>
|
||||
<div className="text-xl font-black tracking-tight text-white">{server.name}</div>
|
||||
<div className="mt-1 font-mono text-sm font-medium text-slate-500">{server.ip} · {server.region}</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={server.btConfigured ? 'green' : 'amber'} dot>{server.btConfigured ? '已配置' : '待配置'}</Badge>
|
||||
<Badge tone={ttlProtected ? 'green' : 'amber'} dot>{ttlProtected ? 'TTL 通过' : '登录前兜底'}</Badge>
|
||||
<Badge tone={server.ssl === 'disabled' ? 'amber' : 'blue'}>{server.ssl === 'enabled' ? 'SSL 开启' : server.ssl === 'internal' ? '内网' : server.ssl === 'disabled' ? 'SSL 建议' : 'SSL 未知'}</Badge>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="grid gap-4 p-5 md:grid-cols-[1fr_13rem]">
|
||||
<div className="space-y-3">
|
||||
<BtDiagnosis label="面板地址" value={server.btBaseUrl || '未返回 / 未配置'} good={Boolean(server.btBaseUrl || server.btConfigured)} />
|
||||
<BtDiagnosis label="Session TTL" value={ttlProtected ? '86400s / 已兜底' : '待复查 / 登录前修复'} good={ttlProtected} />
|
||||
<BtDiagnosis label="最近检测" value={formatDateTime(server.btLastCheckAt)} good={!server.btLastError} />
|
||||
<BtDiagnosis label="Bootstrap" value={server.btBootstrapState || (server.btConfigured ? '已配置' : '未配置')} good={server.btConfigured !== false} />
|
||||
{server.btLastError ? <BtDiagnosis label="最近错误" value={server.btLastError} good={false} /> : null}
|
||||
</div>
|
||||
<div className="flex flex-col gap-3">
|
||||
<button
|
||||
className="focus-ring inline-flex items-center justify-center gap-2 rounded-2xl bg-emerald-400 px-4 py-3 text-sm font-black text-slate-950 disabled:cursor-not-allowed disabled:opacity-50"
|
||||
disabled={!canLogin || loading}
|
||||
onClick={() => onBtLogin(server)}
|
||||
>
|
||||
{loading ? <Loader2 className="h-4 w-4 animate-spin" /> : <ExternalLink className="h-4 w-4" />}
|
||||
一键登录宝塔
|
||||
</button>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center justify-center rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">旧后台配置</a>
|
||||
<div className="rounded-2xl bg-slate-950/55 p-4 text-xs font-semibold leading-5 text-slate-500">
|
||||
点击一键登录时，后端会先执行 TTL 兜底检测；如果仍有 hardcoded_3600，会先修复再生成登录地址。
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
interface BtDiagnosisProps {
|
||||
label: string
|
||||
value: string
|
||||
good: boolean
|
||||
}
|
||||
|
||||
function BtDiagnosis({ label, value, good }: BtDiagnosisProps): JSX.Element {
|
||||
return (
|
||||
<div className="flex items-center justify-between gap-4 rounded-2xl border border-white/[0.06] bg-slate-950/35 px-4 py-3 text-sm">
|
||||
<span className="font-bold text-slate-500">{label}</span>
|
||||
<span className={good ? 'text-right font-black text-emerald-300' : 'text-right font-black text-amber-300'}>{value}</span>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,300 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { Activity, ArrowUpRight, CalendarClock, Database, Globe2, HardDrive, LockKeyhole, RefreshCcw, Search, Server, ShieldCheck } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { isSensitiveKey, redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchBtResourceOverviewData } from '../api/dashboardApi'
|
||||
import type { BtResourceRecord } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface BtResourceOverviewPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type ResourceKind = 'sites' | 'databases' | 'crontabs'
|
||||
|
||||
function textOf(record: BtResourceRecord, keys: string[], fallback = '-'): string {
|
||||
for (const key of keys) {
|
||||
const value = record[key]
|
||||
if (value !== undefined && value !== null && String(value).trim() !== '') return String(value)
|
||||
}
|
||||
return fallback
|
||||
}
|
||||
|
||||
function numberOf(record: BtResourceRecord, keys: string[], fallback = 0): number {
|
||||
for (const key of keys) {
|
||||
const value = record[key]
|
||||
if (typeof value === 'number' && Number.isFinite(value)) return value
|
||||
if (typeof value === 'string') {
|
||||
const parsed = Number(value.replace('%', ''))
|
||||
if (Number.isFinite(parsed)) return parsed
|
||||
}
|
||||
}
|
||||
return fallback
|
||||
}
|
||||
|
||||
function formatMaybeBytes(value: unknown): string {
|
||||
if (typeof value === 'string' && value.trim()) return value
|
||||
if (typeof value !== 'number' || !Number.isFinite(value)) return '-'
|
||||
if (value < 1024) return String(value) + ' B'
|
||||
if (value < 1024 * 1024) return (value / 1024).toFixed(1) + ' KB'
|
||||
if (value < 1024 * 1024 * 1024) return (value / 1024 / 1024).toFixed(1) + ' MB'
|
||||
return (value / 1024 / 1024 / 1024).toFixed(1) + ' GB'
|
||||
}
|
||||
|
||||
function redactText(value: unknown): string {
|
||||
return redactSensitiveText(value, '-', 180)
|
||||
}
|
||||
|
||||
|
||||
function enabledStatus(record: BtResourceRecord): boolean {
|
||||
const value = String(record.status ?? record.active ?? record.open ?? '').toLowerCase()
|
||||
return value === '1' || value === 'true' || value === 'on' || value === 'running' || value === 'open'
|
||||
}
|
||||
|
||||
function filterRecord(record: BtResourceRecord, query: string): boolean {
|
||||
if (!query) return true
|
||||
const joined = Object.entries(record)
|
||||
.filter(([key]) => !isSensitiveKey(key))
|
||||
.map(([, value]) => String(value || '').toLowerCase())
|
||||
.join(' ')
|
||||
return joined.includes(query)
|
||||
}
|
||||
|
||||
function dateText(record: BtResourceRecord): string {
|
||||
return textOf(record, ['addtime', 'add_time', 'created_at', 'time', 'backup_time'])
|
||||
}
|
||||
|
||||
export function BtResourceOverviewPage({ servers, total, mode }: BtResourceOverviewPageProps): JSX.Element {
|
||||
const configuredServers = useMemo(() => servers.filter((server) => server.btConfigured && typeof server.sourceId === 'number'), [servers])
|
||||
const [selectedServer, setSelectedServer] = useState(() => String(configuredServers[0]?.sourceId || ''))
|
||||
const [query, setQuery] = useState('')
|
||||
const [activeKind, setActiveKind] = useState<ResourceKind>('sites')
|
||||
const selectedServerId = selectedServer ? Number(selectedServer) : undefined
|
||||
const selectedServerInfo = configuredServers.find((server) => String(server.sourceId) === selectedServer)
|
||||
|
||||
const { data, refetch, isFetching } = useSuspenseQuery({
|
||||
queryKey: ['bt-resource-overview-v2', selectedServerId ?? 'none'],
|
||||
queryFn: () => fetchBtResourceOverviewData(selectedServerId),
|
||||
staleTime: 30_000,
|
||||
})
|
||||
|
||||
const normalizedQuery = query.trim().toLowerCase()
|
||||
const filteredSites = useMemo(() => data.sites.filter((item) => filterRecord(item, normalizedQuery)), [data.sites, normalizedQuery])
|
||||
const filteredDatabases = useMemo(() => data.databases.filter((item) => filterRecord(item, normalizedQuery)), [data.databases, normalizedQuery])
|
||||
const filteredCrontabs = useMemo(() => data.crontabs.filter((item) => filterRecord(item, normalizedQuery)), [data.crontabs, normalizedQuery])
|
||||
|
||||
const resourceRows = activeKind === 'sites' ? filteredSites : activeKind === 'databases' ? filteredDatabases : filteredCrontabs
|
||||
const activeSites = useMemo(() => data.sites.filter(enabledStatus).length, [data.sites])
|
||||
const activeCrons = useMemo(() => data.crontabs.filter(enabledStatus).length, [data.crontabs])
|
||||
|
||||
return (
|
||||
<div className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4 border-b border-white/10 pb-5">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-sky-400/15 text-sky-200"><Globe2 className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-[-0.04em] text-white">宝塔资源只读总览</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">集中查看站点、数据库、计划任务和系统资源；V2 当前不做站点启停、建站、改库密码、备份、计划任务编辑或服务启停。</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '实时 API' : '降级数据'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>Dashboard {mode}</Badge>
|
||||
<Badge tone="purple"><LockKeyhole className="mr-1 h-3 w-3" />只读 GET</Badge>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
|
||||
<div className="mt-5 grid gap-3 xl:grid-cols-[1fr_auto_auto]">
|
||||
<label className="focus-within:ring-nexus flex items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索站点 / 数据库 / 计划任务 / 备注" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Server className="h-4 w-4" />
|
||||
<select value={selectedServer} onChange={(event) => setSelectedServer(event.target.value)} className="max-w-72 bg-transparent text-slate-100 outline-none">
|
||||
{configuredServers.length === 0 ? <option value="">暂无已配置宝塔服务器</option> : null}
|
||||
{configuredServers.map((server) => <option key={server.sourceId} value={server.sourceId}>{server.name} / {server.ip}</option>)}
|
||||
</select>
|
||||
</label>
|
||||
<button type="button" onClick={() => void refetch()} className="focus-ring inline-flex items-center justify-center gap-2 rounded-2xl border border-cyan-300/20 bg-cyan-400/10 px-4 py-3 text-sm font-black text-cyan-100">
|
||||
<RefreshCcw className={cn('h-4 w-4', isFetching ? 'animate-spin' : '')} />刷新
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<div className="mt-5 grid gap-4 md:grid-cols-4">
|
||||
<MetricCard icon={Globe2} label="站点" value={String(data.sites.length)} hint={String(activeSites) + ' 个启用'} tone="text-sky-300" />
|
||||
<MetricCard icon={Database} label="数据库" value={String(data.databases.length)} hint="不展示密码 / 连接串" tone="text-emerald-300" />
|
||||
<MetricCard icon={CalendarClock} label="计划任务" value={String(data.crontabs.length)} hint={String(activeCrons) + ' 个启用'} tone="text-amber-300" />
|
||||
<MetricCard icon={Server} label="Nexus 资产" value={String(total)} hint={selectedServerInfo ? selectedServerInfo.ip : '全部服务器'} tone="text-violet-300" />
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[24rem_minmax(0,1fr)]">
|
||||
<Panel className="p-6">
|
||||
<div className="mb-4">
|
||||
<h3 className="text-lg font-black text-white">系统资源快照</h3>
|
||||
<p className="mt-1 text-xs font-semibold text-slate-500">来自宝塔 system total / disk / network 只读接口。</p>
|
||||
</div>
|
||||
<div className="space-y-3">
|
||||
<InfoRow label="服务器" value={selectedServerInfo ? selectedServerInfo.name + ' / ' + selectedServerInfo.ip : '-'} />
|
||||
<InfoRow label="系统" value={textOf(data.systemTotal, ['system', 'os', 'platform'])} />
|
||||
<InfoRow label="宝塔版本" value={textOf(data.systemTotal, ['version', 'bt_version', 'panel_version'])} />
|
||||
<InfoRow label="运行时间" value={textOf(data.systemTotal, ['time', 'uptime', 'run_time'])} />
|
||||
<InfoRow label="CPU 核心" value={textOf(data.systemTotal, ['cpuNum', 'cpu_num', 'cpu'], '-')} />
|
||||
<InfoRow label="内存" value={formatMaybeBytes(data.systemTotal.memRealUsed) + ' / ' + formatMaybeBytes(data.systemTotal.memTotal)} />
|
||||
<InfoRow label="上行" value={textOf(data.network, ['up', 'upTotal', 'up_total'])} />
|
||||
<InfoRow label="下行" value={textOf(data.network, ['down', 'downTotal', 'down_total'])} />
|
||||
</div>
|
||||
|
||||
<div className="mt-6 space-y-3">
|
||||
<div className="text-sm font-black text-slate-300">磁盘</div>
|
||||
{data.disks.map((disk, index) => <DiskCard key={String(textOf(disk, ['path', 'filesystem'], String(index)))} disk={disk} />)}
|
||||
{data.disks.length === 0 ? <div className="rounded-3xl border border-white/10 bg-slate-950/40 p-4 text-sm font-bold text-slate-500">暂无磁盘数据</div> : null}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="flex flex-wrap items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">宝塔资源列表</h3>
|
||||
<p className="mt-1 text-xs font-semibold text-slate-500">所有危险动作回旧后台，V2 当前只做聚合查看。</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<KindButton active={activeKind === 'sites'} icon={Globe2} label="站点" onClick={() => setActiveKind('sites')} />
|
||||
<KindButton active={activeKind === 'databases'} icon={Database} label="数据库" onClick={() => setActiveKind('databases')} />
|
||||
<KindButton active={activeKind === 'crontabs'} icon={CalendarClock} label="计划任务" onClick={() => setActiveKind('crontabs')} />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="mt-5 space-y-3">
|
||||
{activeKind === 'sites' ? filteredSites.map((item, index) => <SiteRow key={textOf(item, ['id', 'name'], String(index))} item={item} />) : null}
|
||||
{activeKind === 'databases' ? filteredDatabases.map((item, index) => <DatabaseRow key={textOf(item, ['id', 'name'], String(index))} item={item} />) : null}
|
||||
{activeKind === 'crontabs' ? filteredCrontabs.map((item, index) => <CronRow key={textOf(item, ['id', 'name'], String(index))} item={item} />) : null}
|
||||
{resourceRows.length === 0 ? <div className="rounded-3xl border border-white/10 bg-slate-950/40 px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的数据</div> : null}
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3 rounded-3xl border border-sky-300/10 bg-sky-400/5 p-4">
|
||||
<div className="text-sm font-semibold leading-6 text-slate-400">
|
||||
V2 不调用站点启停、建站、改库密码、备份、计划任务编辑、服务启停等写接口；这些操作继续回旧后台执行，避免误触发。
|
||||
</div>
|
||||
<a href="/app/btpanel/sites" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-sky-300/25 bg-sky-400/15 px-4 py-3 text-sm font-black text-sky-100">
|
||||
去旧后台管理 <ArrowUpRight className="h-4 w-4" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function MetricCard({ icon: Icon, label, value, hint, tone }: { icon: LucideIcon; label: string; value: string; hint: string; tone: string }): JSX.Element {
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5">
|
||||
<div className="flex items-center justify-between">
|
||||
<div className="text-sm font-black text-slate-400">{label}</div>
|
||||
<Icon className={cn('h-5 w-5', tone)} />
|
||||
</div>
|
||||
<div className={cn('mt-4 text-3xl font-black tracking-[-0.05em]', tone)}>{value}</div>
|
||||
<div className="mt-2 text-xs font-semibold text-slate-500">{hint}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function InfoRow({ label, value }: { label: string; value: string }): JSX.Element {
|
||||
return (
|
||||
<div className="flex items-center justify-between gap-3 rounded-2xl border border-white/10 bg-slate-950/40 px-4 py-3 text-sm">
|
||||
<span className="font-bold text-slate-500">{label}</span>
|
||||
<span className="truncate text-right font-black text-slate-200">{value}</span>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function DiskCard({ disk }: { disk: BtResourceRecord }): JSX.Element {
|
||||
const percent = Math.max(0, Math.min(100, numberOf(disk, ['percent', 'used_percent', 'usage'], 0)))
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div className="flex items-center gap-2 text-sm font-black text-white"><HardDrive className="h-4 w-4 text-slate-500" />{textOf(disk, ['path', 'filesystem', 'name'])}</div>
|
||||
<span className="text-xs font-black text-slate-500">{percent}%</span>
|
||||
</div>
|
||||
<div className="mt-3 h-2 overflow-hidden rounded-full bg-slate-800"><div className="h-full rounded-full bg-sky-400" style={{ width: String(percent) + '%' }} /></div>
|
||||
<div className="mt-2 text-xs font-semibold text-slate-500">{textOf(disk, ['used', 'used_size'])} / {textOf(disk, ['size', 'total'])}，剩余 {textOf(disk, ['free', 'available'])}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function KindButton({ active, icon: Icon, label, onClick }: { active: boolean; icon: LucideIcon; label: string; onClick: () => void }): JSX.Element {
|
||||
return (
|
||||
<button type="button" onClick={onClick} className={cn('focus-ring inline-flex items-center gap-2 rounded-2xl px-4 py-3 text-sm font-black transition', active ? 'border border-cyan-300/25 bg-cyan-400/15 text-cyan-100' : 'border border-white/10 bg-slate-950/40 text-slate-400 hover:text-white')}>
|
||||
<Icon className="h-4 w-4" />{label}
|
||||
</button>
|
||||
)
|
||||
}
|
||||
|
||||
function SiteRow({ item }: { item: BtResourceRecord }): JSX.Element {
|
||||
const running = enabledStatus(item)
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-3">
|
||||
<div>
|
||||
<div className="flex flex-wrap items-center gap-2"><Badge tone={running ? 'green' : 'slate'} dot>{running ? '运行中' : '已停止/未知'}</Badge><span className="text-sm font-black text-white">{textOf(item, ['name', 'siteName', 'domain'])}</span></div>
|
||||
<div className="mt-2 font-mono text-xs font-semibold text-slate-500">{textOf(item, ['path'])}</div>
|
||||
</div>
|
||||
<Badge tone="blue">ID {textOf(item, ['id'])}</Badge>
|
||||
</div>
|
||||
<div className="mt-3 grid gap-2 text-xs font-semibold text-slate-500 md:grid-cols-3">
|
||||
<span>PHP：{textOf(item, ['php_version', 'phpVersion', 'php'])}</span>
|
||||
<span>备注：{redactText(textOf(item, ['ps', 'remark', 'note']))}</span>
|
||||
<span>创建：{dateText(item)}</span>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function DatabaseRow({ item }: { item: BtResourceRecord }): JSX.Element {
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-3">
|
||||
<div>
|
||||
<div className="flex flex-wrap items-center gap-2"><Badge tone="green" dot>{textOf(item, ['type', 'db_type'], 'MySQL')}</Badge><span className="text-sm font-black text-white">{textOf(item, ['name', 'db_name'])}</span></div>
|
||||
<div className="mt-2 text-xs font-semibold text-slate-500">用户：{textOf(item, ['username', 'user'])} · 备份：{textOf(item, ['backup_count', 'backupCount'], '0')}</div>
|
||||
</div>
|
||||
<Badge tone="purple">不展示密码</Badge>
|
||||
</div>
|
||||
<div className="mt-3 grid gap-2 text-xs font-semibold text-slate-500 md:grid-cols-2">
|
||||
<span>备注：{redactText(textOf(item, ['ps', 'remark', 'note']))}</span>
|
||||
<span>创建：{dateText(item)}</span>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function CronRow({ item }: { item: BtResourceRecord }): JSX.Element {
|
||||
const running = enabledStatus(item)
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-3">
|
||||
<div>
|
||||
<div className="flex flex-wrap items-center gap-2"><Badge tone={running ? 'green' : 'amber'} dot>{running ? '启用' : '停用/未知'}</Badge><span className="text-sm font-black text-white">{textOf(item, ['name', 'title'])}</span></div>
|
||||
<div className="mt-2 text-xs font-semibold text-slate-500">类型：{textOf(item, ['type'])} · 目标：{textOf(item, ['sName', 'target', 'db_name'])}</div>
|
||||
</div>
|
||||
<Badge tone="slate">ID {textOf(item, ['id'])}</Badge>
|
||||
</div>
|
||||
<div className="mt-3 rounded-2xl border border-white/10 bg-slate-950/60 px-4 py-3 font-mono text-xs leading-6 text-slate-300">{redactText(textOf(item, ['sBody', 'script', 'command', 'url']))}</div>
|
||||
<div className="mt-3 grid gap-2 text-xs font-semibold text-slate-500 md:grid-cols-3">
|
||||
<span>小时：{textOf(item, ['hour', 'where_hour'])}</span>
|
||||
<span>分钟：{textOf(item, ['minute', 'where_minute', 'where1'])}</span>
|
||||
<span>创建：{dateText(item)}</span>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
import { Command } from 'cmdk'
|
||||
import { ExternalLink, Globe2, Search } from 'lucide-react'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface CommandPaletteProps {
|
||||
servers: ServerAsset[]
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
export function CommandPalette({ servers, onBtLogin }: CommandPaletteProps): JSX.Element | null {
|
||||
const open = useAppStore((state) => state.commandOpen)
|
||||
const setOpen = useAppStore((state) => state.setCommandOpen)
|
||||
const setSelectedServerId = useAppStore((state) => state.setSelectedServerId)
|
||||
const setActiveModule = useAppStore((state) => state.setActiveModule)
|
||||
|
||||
if (!open) return null
|
||||
|
||||
return (
|
||||
<div className="fixed inset-0 z-50 grid place-items-start bg-slate-950/70 px-4 pt-[12vh] backdrop-blur" onClick={() => setOpen(false)}>
|
||||
<Command className="mx-auto w-full max-w-2xl overflow-hidden rounded-3xl border border-white/10 bg-slate-950 shadow-glow" onClick={(event) => event.stopPropagation()}>
|
||||
<div className="flex items-center gap-3 border-b border-white/10 px-5 py-4">
|
||||
<Search className="h-5 w-5 text-cyan-300" />
|
||||
<Command.Input autoFocus placeholder="搜索服务器、IP、任务、风险，或输入操作..." className="h-10 flex-1 bg-transparent text-sm font-bold text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</div>
|
||||
<Command.List className="max-h-96 overflow-auto p-3">
|
||||
<Command.Empty className="px-4 py-8 text-center text-sm font-bold text-slate-500">没有找到结果</Command.Empty>
|
||||
<Command.Group heading="服务器" className="text-xs font-black text-slate-500 [&_[cmdk-group-heading]]:px-3 [&_[cmdk-group-heading]]:py-2">
|
||||
{servers.map((server) => (
|
||||
<Command.Item
|
||||
key={server.id}
|
||||
value={server.name + ' ' + server.ip + ' ' + server.region + ' ' + server.risk}
|
||||
className="flex cursor-pointer items-center justify-between rounded-2xl px-3 py-3 text-sm font-bold text-slate-200 aria-selected:bg-cyan-400/10 aria-selected:text-white"
|
||||
onSelect={() => {
|
||||
setSelectedServerId(server.id)
|
||||
setOpen(false)
|
||||
}}
|
||||
>
|
||||
<span>{server.name}<span className="ml-2 font-mono text-xs text-slate-500">{server.ip}</span></span>
|
||||
<span className="text-xs text-slate-500">{server.ttl}</span>
|
||||
</Command.Item>
|
||||
))}
|
||||
</Command.Group>
|
||||
<Command.Group heading="快捷操作" className="mt-2 text-xs font-black text-slate-500 [&_[cmdk-group-heading]]:px-3 [&_[cmdk-group-heading]]:py-2">
|
||||
{servers.filter((server) => server.sourceId).slice(0, 6).map((server) => (
|
||||
<Command.Item
|
||||
key={'login-' + server.id}
|
||||
value={'一键登录 ' + server.name + ' ' + server.ip}
|
||||
className="flex cursor-pointer items-center gap-3 rounded-2xl px-3 py-3 text-sm font-bold text-cyan-200 aria-selected:bg-cyan-400/10 aria-selected:text-white"
|
||||
onSelect={() => {
|
||||
onBtLogin(server)
|
||||
setOpen(false)
|
||||
}}
|
||||
>
|
||||
<ExternalLink className="h-4 w-4" /> 一键登录 {server.name}
|
||||
</Command.Item>
|
||||
))}
|
||||
<Command.Item
|
||||
value="打开全局搜索 搜索 服务器 脚本 凭据 计划任务"
|
||||
className="flex cursor-pointer items-center gap-3 rounded-2xl px-3 py-3 text-sm font-bold text-cyan-200 aria-selected:bg-cyan-400/10 aria-selected:text-white"
|
||||
onSelect={() => {
|
||||
setActiveModule('search')
|
||||
setOpen(false)
|
||||
}}
|
||||
>
|
||||
<Search className="h-4 w-4" /> 打开全局搜索
|
||||
</Command.Item>
|
||||
<Command.Item
|
||||
value="打开域名 SSL 宝塔 网站 证书 PHP 只读"
|
||||
className="flex cursor-pointer items-center gap-3 rounded-2xl px-3 py-3 text-sm font-bold text-cyan-200 aria-selected:bg-cyan-400/10 aria-selected:text-white"
|
||||
onSelect={() => {
|
||||
setActiveModule('btdomainssl')
|
||||
setOpen(false)
|
||||
}}
|
||||
>
|
||||
<Globe2 className="h-4 w-4" /> 打开域名 / SSL
|
||||
</Command.Item>
|
||||
<Command.Item
|
||||
value="打开旧后台"
|
||||
className="flex cursor-pointer items-center gap-3 rounded-2xl px-3 py-3 text-sm font-bold text-slate-200 aria-selected:bg-cyan-400/10 aria-selected:text-white"
|
||||
onSelect={() => { window.location.href = '/app/' }}
|
||||
>
|
||||
打开旧后台完整功能
|
||||
</Command.Item>
|
||||
</Command.Group>
|
||||
</Command.List>
|
||||
</Command>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { flexRender, getCoreRowModel, getFilteredRowModel, getSortedRowModel, useReactTable } from '@tanstack/react-table'
|
||||
import type { ColumnDef } from '@tanstack/react-table'
|
||||
import { Activity, ArrowUpRight, Clock3, FileClock, Filter, LockKeyhole, Search, Server, ShieldCheck, TerminalSquare } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchExecutionRecordsData } from '../api/dashboardApi'
|
||||
import type { ExecutionRecordItem, ExecutionRecordKind, ExecutionRecordStatus } from '../api/dashboardApi'
|
||||
|
||||
interface ExecutionRecordsPageProps {
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type FilterKind = 'all' | ExecutionRecordKind
|
||||
|
||||
type StatusTone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
|
||||
function statusTone(status: ExecutionRecordStatus): StatusTone {
|
||||
if (status === 'completed') return 'green'
|
||||
if (status === 'running') return 'blue'
|
||||
if (status === 'partial') return 'amber'
|
||||
if (status === 'failed') return 'red'
|
||||
if (status === 'cancelled') return 'slate'
|
||||
return 'purple'
|
||||
}
|
||||
|
||||
function statusLabel(status: ExecutionRecordStatus): string {
|
||||
const labels: Record<string, string> = {
|
||||
completed: '已完成',
|
||||
running: '运行中',
|
||||
failed: '失败',
|
||||
partial: '部分完成',
|
||||
cancelled: '已取消',
|
||||
}
|
||||
return labels[String(status)] || String(status || '未知')
|
||||
}
|
||||
|
||||
function kindLabel(kind: ExecutionRecordKind): string {
|
||||
return kind === 'script' ? '脚本执行' : '服务器批量任务'
|
||||
}
|
||||
|
||||
function formatDateTime(value?: string | null): string {
|
||||
if (!value) return '-'
|
||||
const date = new Date(value)
|
||||
if (Number.isNaN(date.getTime())) return value
|
||||
return date.toLocaleString('zh-CN', { hour12: false })
|
||||
}
|
||||
|
||||
function redactText(value?: string | null): string {
|
||||
return redactSensitiveText(value, '-', 120)
|
||||
}
|
||||
|
||||
function durationText(startedAt?: string | null, completedAt?: string | null): string {
|
||||
if (!startedAt) return '-'
|
||||
const start = Date.parse(startedAt)
|
||||
const end = completedAt ? Date.parse(completedAt) : Date.now()
|
||||
if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return '-'
|
||||
const seconds = Math.round((end - start) / 1000)
|
||||
if (seconds < 60) return String(seconds) + 's'
|
||||
const minutes = Math.round(seconds / 60)
|
||||
if (minutes < 60) return String(minutes) + 'm'
|
||||
return String(Math.round(minutes / 60)) + 'h'
|
||||
}
|
||||
|
||||
function metricValue(items: ExecutionRecordItem[], matcher: (item: ExecutionRecordItem) => boolean): number {
|
||||
return items.filter(matcher).length
|
||||
}
|
||||
|
||||
export function ExecutionRecordsPage({ mode }: ExecutionRecordsPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [kind, setKind] = useState<FilterKind>('all')
|
||||
const [status, setStatus] = useState<string>('all')
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['execution-records-v2'],
|
||||
queryFn: fetchExecutionRecordsData,
|
||||
staleTime: 20_000,
|
||||
})
|
||||
|
||||
const filteredItems = useMemo(() => {
|
||||
const text = query.trim().toLowerCase()
|
||||
return data.items.filter((item) => {
|
||||
const kindMatched = kind === 'all' || item.kind === kind
|
||||
const statusMatched = status === 'all' || item.status === status
|
||||
const textMatched = !text || [item.label, item.operator, item.op, item.command, String(item.id)].some((value) => String(value || '').toLowerCase().includes(text))
|
||||
return kindMatched && statusMatched && textMatched
|
||||
})
|
||||
}, [data.items, kind, query, status])
|
||||
|
||||
const statusOptions = useMemo(() => Array.from(new Set(data.items.map((item) => String(item.status || 'unknown')))), [data.items])
|
||||
|
||||
const columns = useMemo<ColumnDef<ExecutionRecordItem>[]>(() => [
|
||||
{
|
||||
accessorKey: 'label',
|
||||
header: '任务',
|
||||
cell: ({ row }) => {
|
||||
const item = row.original
|
||||
return (
|
||||
<div className="min-w-72">
|
||||
<div className="flex items-center gap-2">
|
||||
<Badge tone={item.kind === 'script' ? 'purple' : 'blue'}>{kindLabel(item.kind)}</Badge>
|
||||
<span className="text-sm font-black text-white">#{item.id}</span>
|
||||
</div>
|
||||
<div className="mt-2 text-sm font-black text-white">{redactText(item.label)}</div>
|
||||
<div className="mt-1 text-xs font-semibold text-slate-500">命令/操作：{redactText(item.op || item.command)}</div>
|
||||
</div>
|
||||
)
|
||||
},
|
||||
},
|
||||
{
|
||||
accessorKey: 'status',
|
||||
header: '状态',
|
||||
cell: ({ row }) => <Badge tone={statusTone(row.original.status)} dot>{statusLabel(row.original.status)}</Badge>,
|
||||
},
|
||||
{
|
||||
accessorKey: 'progress',
|
||||
header: '进度',
|
||||
cell: ({ row }) => <span className="text-sm font-black text-cyan-200">{row.original.progress || '-'}</span>,
|
||||
},
|
||||
{
|
||||
accessorKey: 'server_count',
|
||||
header: '服务器',
|
||||
cell: ({ row }) => <span className="text-sm font-bold text-slate-300">{row.original.server_count ?? 0} 台</span>,
|
||||
},
|
||||
{
|
||||
accessorKey: 'operator',
|
||||
header: '操作者',
|
||||
cell: ({ row }) => <span className="text-sm font-semibold text-slate-400">{row.original.operator || '-'}</span>,
|
||||
},
|
||||
{
|
||||
accessorKey: 'started_at',
|
||||
header: '时间',
|
||||
cell: ({ row }) => (
|
||||
<div className="text-xs font-semibold leading-5 text-slate-400">
|
||||
<div>{formatDateTime(row.original.started_at)}</div>
|
||||
<div className="text-slate-600">耗时 {durationText(row.original.started_at, row.original.completed_at)}</div>
|
||||
</div>
|
||||
),
|
||||
},
|
||||
], [])
|
||||
|
||||
const table = useReactTable({
|
||||
data: filteredItems,
|
||||
columns,
|
||||
getCoreRowModel: getCoreRowModel(),
|
||||
getSortedRowModel: getSortedRowModel(),
|
||||
getFilteredRowModel: getFilteredRowModel(),
|
||||
})
|
||||
|
||||
const cards = [
|
||||
{ label: '执行记录', value: String(data.total), sub: data.mode === 'live' ? '来自后端实时 API' : '安全降级演示', icon: FileClock, tone: 'text-cyan-300' },
|
||||
{ label: '运行中', value: String(metricValue(data.items, (item) => item.status === 'running')), sub: '只读观察，不在 V2 停止任务', icon: Activity, tone: 'text-blue-300' },
|
||||
{ label: '异常/部分完成', value: String(metricValue(data.items, (item) => item.status === 'failed' || item.status === 'partial')), sub: '详情深查回旧后台', icon: ShieldCheck, tone: 'text-amber-300' },
|
||||
{ label: '涉及服务器', value: String(data.items.reduce((sum, item) => sum + (item.server_count || 0), 0)), sub: '合计 server_count', icon: Server, tone: 'text-emerald-300' },
|
||||
]
|
||||
|
||||
return (
|
||||
<div id="executions" className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
{cards.map((card) => (
|
||||
<Panel key={card.label} className="p-5">
|
||||
<div className="flex items-center justify-between">
|
||||
<div className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">{card.label}</div>
|
||||
<card.icon className={cn('h-5 w-5', card.tone)} />
|
||||
</div>
|
||||
<div className="mt-3 text-3xl font-black tracking-[-0.05em] text-white">{card.value}</div>
|
||||
<div className="mt-2 text-sm font-semibold text-slate-500">{card.sub}</div>
|
||||
</Panel>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<Panel className="overflow-hidden p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4 border-b border-white/10 pb-5">
|
||||
<div>
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-violet-400/15 text-violet-200"><TerminalSquare className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-[-0.04em] text-white">执行记录只读中心</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">接入 /api/execution-records；V2 只展示、筛选和脱敏，不执行/停止/重试命令。</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '实时 API' : '降级数据'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>Dashboard {mode}</Badge>
|
||||
<Badge tone="purple"><LockKeyhole className="mr-1 h-3 w-3" />敏感字段已隐藏</Badge>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
|
||||
<div className="mt-5 grid gap-3 xl:grid-cols-[1fr_auto_auto]">
|
||||
<label className="focus-within:ring-nexus flex items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索任务名 / 操作者 / 操作 / ID" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Filter className="h-4 w-4" />
|
||||
<select value={kind} onChange={(event) => setKind(event.target.value as FilterKind)} className="bg-transparent text-slate-100 outline-none">
|
||||
<option value="all">全部类型</option>
|
||||
<option value="script">脚本执行</option>
|
||||
<option value="server_batch">服务器批量任务</option>
|
||||
</select>
|
||||
</label>
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Clock3 className="h-4 w-4" />
|
||||
<select value={status} onChange={(event) => setStatus(event.target.value)} className="bg-transparent text-slate-100 outline-none">
|
||||
<option value="all">全部状态</option>
|
||||
{statusOptions.map((option) => <option key={option} value={option}>{statusLabel(option)}</option>)}
|
||||
</select>
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div className="mt-5 overflow-x-auto rounded-3xl border border-white/10">
|
||||
<table className="min-w-full divide-y divide-white/10">
|
||||
<thead className="bg-white/[0.03]">
|
||||
{table.getHeaderGroups().map((headerGroup) => (
|
||||
<tr key={headerGroup.id}>
|
||||
{headerGroup.headers.map((header) => (
|
||||
<th key={header.id} className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">
|
||||
{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
|
||||
</th>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10 bg-slate-950/20">
|
||||
{table.getRowModel().rows.map((row) => (
|
||||
<tr key={row.id} className="transition hover:bg-white/[0.03]">
|
||||
{row.getVisibleCells().map((cell) => (
|
||||
<td key={cell.id} className="px-5 py-4 align-top">
|
||||
{flexRender(cell.column.columnDef.cell, cell.getContext())}
|
||||
</td>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
{filteredItems.length === 0 ? <div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的执行记录</div> : null}
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3 rounded-3xl border border-cyan-300/10 bg-cyan-400/5 p-4">
|
||||
<div className="text-sm font-semibold leading-6 text-slate-400">
|
||||
写操作仍保留在旧后台：执行脚本、停止任务、重试任务、查看完整日志都从旧后台进入，避免 V2 早期迁移误触发远程 shell。
|
||||
</div>
|
||||
<a href="/app/scripts" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-cyan-300/25 bg-cyan-400/15 px-4 py-3 text-sm font-black text-cyan-100">
|
||||
去旧后台处理 <ArrowUpRight className="h-4 w-4" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,252 @@
|
||||
import { useEffect, useMemo, useState } from 'react'
|
||||
import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
|
||||
import { AlertTriangle, CheckCircle2, RefreshCw, Save, ShieldCheck, Server, TerminalSquare } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { ApiError } from '@/lib/api'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { fetchGiteaAllowlist, saveGiteaAllowlist, syncGiteaAllowlist } from '../api/dashboardApi'
|
||||
import type { GiteaAllowlistState } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface GiteaAllowlistPanelProps {
|
||||
servers: ServerAsset[]
|
||||
}
|
||||
|
||||
function formatSyncStatus(state?: GiteaAllowlistState): { tone: 'green' | 'amber' | 'red' | 'slate'; label: string } {
|
||||
if (!state?.last_sync_at) return { tone: 'slate', label: '尚未同步' }
|
||||
if (state.last_sync_ok === true) return { tone: 'green', label: '最近同步成功' }
|
||||
if (state.last_sync_ok === false) return { tone: 'red', label: '最近同步失败' }
|
||||
return { tone: 'amber', label: '同步状态未知' }
|
||||
}
|
||||
|
||||
function formatError(error: unknown): string {
|
||||
if (!error) return ''
|
||||
if (error instanceof ApiError) return error.message
|
||||
if (error instanceof Error) return error.message
|
||||
return String(error)
|
||||
}
|
||||
|
||||
export function GiteaAllowlistPanel({ servers }: GiteaAllowlistPanelProps): JSX.Element {
|
||||
const queryClient = useQueryClient()
|
||||
const { data, isLoading, error } = useQuery({
|
||||
queryKey: ['gitea-allowlist'],
|
||||
queryFn: fetchGiteaAllowlist,
|
||||
staleTime: 30_000,
|
||||
})
|
||||
|
||||
const [enabled, setEnabled] = useState(false)
|
||||
const [autoSync, setAutoSync] = useState(false)
|
||||
const [serverIdDraft, setServerIdDraft] = useState('')
|
||||
const [remotePath, setRemotePath] = useState('/etc/nginx/gitea-allowlist.conf')
|
||||
const [reloadCommand, setReloadCommand] = useState('nginx -t && systemctl reload nginx')
|
||||
const [reloadNginx, setReloadNginx] = useState(true)
|
||||
const [message, setMessage] = useState<string | null>(null)
|
||||
|
||||
useEffect(() => {
|
||||
if (!data) return
|
||||
setEnabled(data.enabled)
|
||||
setAutoSync(data.auto_sync)
|
||||
setServerIdDraft(data.server_id ? String(data.server_id) : '')
|
||||
setRemotePath(data.remote_path || '/etc/nginx/gitea-allowlist.conf')
|
||||
setReloadCommand(data.reload_command || 'nginx -t && systemctl reload nginx')
|
||||
}, [data])
|
||||
|
||||
const serverOptions = useMemo(() => {
|
||||
return servers
|
||||
.filter((server) => typeof server.sourceId === 'number')
|
||||
.slice(0, 500)
|
||||
.map((server) => ({ id: server.sourceId!, label: `${server.name} / ${server.ip}` }))
|
||||
}, [servers])
|
||||
|
||||
const selectedServer = useMemo(() => {
|
||||
const id = Number(serverIdDraft)
|
||||
return serverOptions.find((item) => item.id === id)
|
||||
}, [serverIdDraft, serverOptions])
|
||||
|
||||
const saveMutation = useMutation({
|
||||
mutationFn: () => saveGiteaAllowlist({
|
||||
enabled,
|
||||
auto_sync: autoSync,
|
||||
server_id: serverIdDraft.trim() ? Number(serverIdDraft) : 0,
|
||||
remote_path: remotePath,
|
||||
reload_command: reloadCommand,
|
||||
}),
|
||||
onSuccess: async () => {
|
||||
setMessage('Gitea 白名单配置已保存。')
|
||||
await queryClient.invalidateQueries({ queryKey: ['gitea-allowlist'] })
|
||||
await queryClient.invalidateQueries({ queryKey: ['settings-overview-v2'] })
|
||||
},
|
||||
onError: (saveError) => setMessage('保存失败：' + formatError(saveError)),
|
||||
})
|
||||
|
||||
const syncMutation = useMutation({
|
||||
mutationFn: () => syncGiteaAllowlist(reloadNginx),
|
||||
onSuccess: async (result) => {
|
||||
setMessage(result.success ? result.message : `同步失败：${result.message}`)
|
||||
await queryClient.invalidateQueries({ queryKey: ['gitea-allowlist'] })
|
||||
await queryClient.invalidateQueries({ queryKey: ['settings-overview-v2'] })
|
||||
},
|
||||
onError: (syncError) => setMessage('同步失败：' + formatError(syncError)),
|
||||
})
|
||||
|
||||
const status = formatSyncStatus(data)
|
||||
const busy = saveMutation.isPending || syncMutation.isPending
|
||||
|
||||
return (
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="border-b border-white/10 p-6">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4">
|
||||
<div>
|
||||
<Badge tone="purple" dot className="px-4 py-2">Gitea 白名单同步</Badge>
|
||||
<h3 className="mt-4 text-2xl font-black tracking-tight text-white">Nexus IP 白名单 → Gitea Nginx</h3>
|
||||
<p className="mt-2 max-w-3xl text-sm font-semibold leading-6 text-slate-400">
|
||||
不改 Gitea 源码；Nexus 生成 nginx include 文件，Gitea 入口只放行 Nexus 当前合并后的 IP/CIDR 白名单。
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<Badge tone={status.tone} dot>{status.label}</Badge>
|
||||
<Badge tone={data?.enabled ? 'green' : 'slate'} dot>{data?.enabled ? 'Gitea 拦截启用' : 'Gitea 拦截关闭'}</Badge>
|
||||
</div>
|
||||
</div>
|
||||
{error ? <Notice tone="red" message={'读取 Gitea 白名单配置失败：' + formatError(error)} /> : null}
|
||||
{message ? <Notice tone={message.includes('失败') ? 'red' : 'green'} message={message} /> : null}
|
||||
</div>
|
||||
|
||||
<div className="grid gap-0 xl:grid-cols-[minmax(0,.95fr)_minmax(0,1.05fr)]">
|
||||
<div className="space-y-5 border-b border-white/10 p-6 xl:border-b-0 xl:border-r">
|
||||
<div className="grid gap-3 md:grid-cols-2">
|
||||
<ToggleCard
|
||||
title="启用 Gitea 白名单"
|
||||
desc="启用后 include 文件会写入 allow + deny all；无可用 IP 时后端会阻止写入。"
|
||||
checked={enabled}
|
||||
onChange={setEnabled}
|
||||
/>
|
||||
<ToggleCard
|
||||
title="Nexus 变更后自动同步"
|
||||
desc="保存 Nexus 白名单、增删手动 IP、订阅刷新后，自动写入 Gitea include 并 reload nginx。"
|
||||
checked={autoSync}
|
||||
onChange={setAutoSync}
|
||||
/>
|
||||
</div>
|
||||
|
||||
<label className="block">
|
||||
<span className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">Gitea 所在服务器 ID</span>
|
||||
<input
|
||||
list="gitea-server-options"
|
||||
value={serverIdDraft}
|
||||
onChange={(event) => setServerIdDraft(event.target.value.replace(/[^0-9]/g, ''))}
|
||||
placeholder="例如 219"
|
||||
className="mt-2 w-full rounded-2xl border border-white/10 bg-slate-950/60 px-4 py-3 font-mono text-sm font-bold text-white outline-none transition focus:border-cyan-300/40"
|
||||
/>
|
||||
<datalist id="gitea-server-options">
|
||||
{serverOptions.map((server) => <option key={server.id} value={server.id}>{server.label}</option>)}
|
||||
</datalist>
|
||||
<span className="mt-2 block text-xs font-semibold text-slate-500">
|
||||
{selectedServer ? `已选择：${selectedServer.label}` : data?.server ? `当前后端记录：${data.server.name || data.server.id} / ${data.server.domain || '-'}` : '可输入 Nexus 服务器资产 ID。'}
|
||||
</span>
|
||||
</label>
|
||||
|
||||
<label className="block">
|
||||
<span className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">远端 include 文件路径</span>
|
||||
<input
|
||||
value={remotePath}
|
||||
onChange={(event) => setRemotePath(event.target.value)}
|
||||
className="mt-2 w-full rounded-2xl border border-white/10 bg-slate-950/60 px-4 py-3 font-mono text-sm font-bold text-white outline-none transition focus:border-cyan-300/40"
|
||||
/>
|
||||
</label>
|
||||
|
||||
<label className="block">
|
||||
<span className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">Reload 命令</span>
|
||||
<input
|
||||
value={reloadCommand}
|
||||
onChange={(event) => setReloadCommand(event.target.value)}
|
||||
className="mt-2 w-full rounded-2xl border border-white/10 bg-slate-950/60 px-4 py-3 font-mono text-sm font-bold text-white outline-none transition focus:border-cyan-300/40"
|
||||
/>
|
||||
</label>
|
||||
|
||||
<label className="flex items-start gap-3 rounded-2xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<input type="checkbox" checked={reloadNginx} onChange={(event) => setReloadNginx(event.target.checked)} className="mt-1 h-4 w-4 accent-cyan-300" />
|
||||
<span>
|
||||
<span className="block text-sm font-black text-white">立即同步时执行 nginx reload</span>
|
||||
<span className="mt-1 block text-xs font-semibold leading-5 text-slate-500">如果你只想先写文件检查内容，可以取消勾选。</span>
|
||||
</span>
|
||||
</label>
|
||||
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<button
|
||||
type="button"
|
||||
disabled={busy || isLoading}
|
||||
onClick={() => saveMutation.mutate()}
|
||||
className="focus-ring inline-flex items-center gap-2 rounded-2xl bg-cyan-400 px-5 py-3 text-sm font-black text-slate-950 disabled:cursor-not-allowed disabled:opacity-60"
|
||||
>
|
||||
<Save className="h-4 w-4" /> 保存配置
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
disabled={busy || isLoading}
|
||||
onClick={() => syncMutation.mutate()}
|
||||
className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-emerald-300/25 bg-emerald-400/10 px-5 py-3 text-sm font-black text-emerald-100 disabled:cursor-not-allowed disabled:opacity-60"
|
||||
>
|
||||
<RefreshCw className={cn('h-4 w-4', syncMutation.isPending && 'animate-spin')} /> 立即同步
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="space-y-5 p-6">
|
||||
<div className="grid gap-3 md:grid-cols-3">
|
||||
<Metric icon={ShieldCheck} label="Nexus 合并白名单" value={String(data?.effective_count ?? 0)} tone="text-cyan-200" />
|
||||
<Metric icon={Server} label="Nginx 可写 IP/CIDR" value={String(data?.nginx_allowed_count ?? 0)} tone="text-emerald-200" />
|
||||
<Metric icon={AlertTriangle} label="跳过域名/非法项" value={String(data?.skipped_count ?? 0)} tone={(data?.skipped_count ?? 0) > 0 ? 'text-amber-200' : 'text-slate-300'} />
|
||||
</div>
|
||||
|
||||
{data?.preview_error ? <Notice tone="amber" message={data.preview_error} /> : null}
|
||||
{data?.last_sync_error ? <Notice tone="red" message={'最近同步错误：' + data.last_sync_error} /> : null}
|
||||
|
||||
<CodeBlock title="Nginx include 示例" value={data?.include_snippet || '加载中...'} />
|
||||
<CodeBlock title="即将写入的 include 文件预览" value={data?.preview || (isLoading ? '加载中...' : '当前配置无法生成预览')} tall />
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
function Notice({ tone, message }: { tone: 'green' | 'amber' | 'red'; message: string }): JSX.Element {
|
||||
const klass = tone === 'green'
|
||||
? 'border-emerald-400/20 bg-emerald-400/10 text-emerald-100'
|
||||
: tone === 'red'
|
||||
? 'border-red-400/20 bg-red-400/10 text-red-100'
|
||||
: 'border-amber-400/20 bg-amber-400/10 text-amber-100'
|
||||
return <div className={'mt-4 rounded-2xl border px-4 py-3 text-sm font-semibold leading-6 ' + klass}>{message}</div>
|
||||
}
|
||||
|
||||
function ToggleCard({ title, desc, checked, onChange }: { title: string; desc: string; checked: boolean; onChange: (value: boolean) => void }): JSX.Element {
|
||||
return (
|
||||
<button type="button" onClick={() => onChange(!checked)} className={cn('rounded-3xl border p-4 text-left transition', checked ? 'border-cyan-300/30 bg-cyan-400/10' : 'border-white/10 bg-slate-950/40 hover:bg-white/[0.04]')}>
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<span className="text-sm font-black text-white">{title}</span>
|
||||
{checked ? <CheckCircle2 className="h-5 w-5 text-cyan-200" /> : <span className="h-5 w-5 rounded-full border border-white/20" />}
|
||||
</div>
|
||||
<p className="mt-2 text-xs font-semibold leading-5 text-slate-500">{desc}</p>
|
||||
</button>
|
||||
)
|
||||
}
|
||||
|
||||
function Metric({ icon: Icon, label, value, tone }: { icon: LucideIcon; label: string; value: string; tone: string }): JSX.Element {
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex items-center gap-2 text-xs font-black uppercase tracking-[0.14em] text-slate-500"><Icon className={'h-4 w-4 ' + tone} /> {label}</div>
|
||||
<div className="mt-3 text-3xl font-black text-white">{value}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function CodeBlock({ title, value, tall = false }: { title: string; value: string; tall?: boolean }): JSX.Element {
|
||||
return (
|
||||
<div className="overflow-hidden rounded-3xl border border-white/10 bg-slate-950/60">
|
||||
<div className="flex items-center gap-2 border-b border-white/10 px-4 py-3 text-xs font-black uppercase tracking-[0.14em] text-slate-500"><TerminalSquare className="h-4 w-4 text-cyan-200" /> {title}</div>
|
||||
<pre className={cn('overflow-auto p-4 text-xs font-semibold leading-5 text-slate-200', tall ? 'max-h-80' : 'max-h-52')}><code>{value}</code></pre>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,266 @@
|
||||
import { useCallback, useEffect, useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { ArrowUpRight, BookOpen, Database, Filter, KeyRound, Search, Server, ShieldCheck, Sparkles, TimerReset } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { hasSensitiveMarker } from '@/lib/redaction'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { fetchGlobalSearchData } from '../api/dashboardApi'
|
||||
import type { GlobalSearchData, GlobalSearchEntity, GlobalSearchItem } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface GlobalSearchPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type SearchGroupKey = 'servers' | 'scripts' | 'credentials' | 'schedules'
|
||||
|
||||
type Tone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
|
||||
interface SearchGroupMeta {
|
||||
key: SearchGroupKey
|
||||
title: string
|
||||
subtitle: string
|
||||
icon: typeof Server
|
||||
tone: Tone
|
||||
legacyPath: string
|
||||
}
|
||||
|
||||
const groups: SearchGroupMeta[] = [
|
||||
{ key: 'servers', title: '服务器', subtitle: '名称、域名、分组、在线状态', icon: Server, tone: 'blue', legacyPath: '/app/servers' },
|
||||
{ key: 'scripts', title: '脚本库', subtitle: '脚本名称、分类、描述', icon: BookOpen, tone: 'purple', legacyPath: '/app/scripts' },
|
||||
{ key: 'credentials', title: '凭据元数据', subtitle: '只显示名称、类型、主机，不展示密码', icon: KeyRound, tone: 'amber', legacyPath: '/app/settings' },
|
||||
{ key: 'schedules', title: '计划任务', subtitle: '计划名称、Cron 表达式、启停状态', icon: TimerReset, tone: 'green', legacyPath: '/app/tasks' },
|
||||
]
|
||||
|
||||
function normalizeQuery(value: string): string {
|
||||
return value.trim().replace(/\s+/g, ' ').slice(0, 100)
|
||||
}
|
||||
|
||||
function itemTitle(item: GlobalSearchItem, entity: GlobalSearchEntity): string {
|
||||
if (entity === 'servers') return String(item.name || item.domain || '未命名服务器')
|
||||
if (entity === 'scripts') return String(item.name || '未命名脚本')
|
||||
if (entity === 'credentials') return String(item.name || '未命名凭据')
|
||||
return String(item.name || '未命名计划')
|
||||
}
|
||||
|
||||
function itemSubtitle(item: GlobalSearchItem, entity: GlobalSearchEntity): string {
|
||||
if (entity === 'servers') return [item.domain, item.category, item.is_online ? '在线' : '离线/未知'].filter(Boolean).join(' · ')
|
||||
if (entity === 'scripts') return [item.category, '只读跳转'].filter(Boolean).join(' · ')
|
||||
if (entity === 'credentials') return [item.db_type, item.host ? '主机：' + String(item.host) : undefined, '不展示敏感值'].filter(Boolean).join(' · ')
|
||||
return [item.cron_expr, item.enabled === true ? '已启用' : item.enabled === false ? '已停用' : undefined].filter(Boolean).join(' · ')
|
||||
}
|
||||
|
||||
function itemRouteHint(entity: GlobalSearchEntity, item: GlobalSearchItem): string {
|
||||
if (entity === 'servers') return '/app/servers' + (item.id ? '?highlight=' + encodeURIComponent(String(item.id)) : '')
|
||||
if (entity === 'scripts') return '/app/scripts'
|
||||
if (entity === 'credentials') return '/app/settings'
|
||||
return '/app/tasks'
|
||||
}
|
||||
|
||||
function visibleItems(data: GlobalSearchData, key: SearchGroupKey): GlobalSearchItem[] {
|
||||
return data[key].slice(0, 10)
|
||||
}
|
||||
|
||||
function queryFingerprint(value: string): string {
|
||||
let hash = 2166136261
|
||||
for (let index = 0; index < value.length; index += 1) {
|
||||
hash ^= value.charCodeAt(index)
|
||||
hash = Math.imul(hash, 16777619)
|
||||
}
|
||||
return value.length + ':' + (hash >>> 0).toString(36)
|
||||
}
|
||||
|
||||
export function GlobalSearchPage({ servers, total, mode }: GlobalSearchPageProps): JSX.Element {
|
||||
const [rawQuery, setRawQuery] = useState('')
|
||||
const [debouncedQuery, setDebouncedQuery] = useState('')
|
||||
const normalizedQuery = normalizeQuery(debouncedQuery)
|
||||
const blockedQuery = hasSensitiveMarker(normalizedQuery)
|
||||
const normalizedQueryKey = blockedQuery ? 'blocked-sensitive-query' : queryFingerprint(normalizedQuery)
|
||||
|
||||
useEffect(() => {
|
||||
const handle = window.setTimeout(() => setDebouncedQuery(rawQuery), 350)
|
||||
return () => window.clearTimeout(handle)
|
||||
}, [rawQuery])
|
||||
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['global-search', normalizedQueryKey],
|
||||
queryFn: () => fetchGlobalSearchData(blockedQuery ? '' : normalizedQuery),
|
||||
staleTime: 0,
|
||||
gcTime: 0,
|
||||
})
|
||||
|
||||
const localMatches = useMemo(() => {
|
||||
const query = normalizeQuery(rawQuery).toLowerCase()
|
||||
if (query.length < 2 || hasSensitiveMarker(query)) return []
|
||||
return servers
|
||||
.filter((server) => [server.name, server.ip, server.region, server.risk, server.ttl].some((value) => String(value || '').toLowerCase().includes(query)))
|
||||
.slice(0, 8)
|
||||
}, [rawQuery, servers])
|
||||
|
||||
const hasQuery = normalizedQuery.length >= 2 && !blockedQuery
|
||||
const hasServerFallback = localMatches.length > 0 && visibleItems(data, 'servers').length === 0
|
||||
const handleQueryChange = useCallback((event: React.ChangeEvent<HTMLInputElement>): void => {
|
||||
setRawQuery(event.target.value)
|
||||
}, [])
|
||||
|
||||
return (
|
||||
<div id="global-search" className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<Panel className="relative overflow-hidden p-6 lg:p-8">
|
||||
<div className="absolute -right-20 -top-20 h-72 w-72 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="relative grid gap-6 xl:grid-cols-[minmax(0,1fr)_24rem]">
|
||||
<div>
|
||||
<Badge tone="blue" dot className="px-4 py-2">全局只读搜索</Badge>
|
||||
<h1 className="mt-5 text-3xl font-black tracking-tight text-white md:text-4xl">跨服务器 / 脚本 / 凭据元数据 / 计划任务快速定位</h1>
|
||||
<p className="mt-3 max-w-3xl text-sm font-semibold leading-7 text-slate-400">
|
||||
复用后端 <span className="font-mono text-cyan-200">GET /api/search/</span>，输入防通配符膨胀由后端 escape 兜底。V2 当前只读展示搜索结果，不展示密码、Cookie、Token、密钥类字段、私钥或宝塔 tmp_login。
|
||||
</p>
|
||||
<div className="mt-6 flex flex-col gap-3 sm:flex-row">
|
||||
<label className="focus-within:ring-cyan-300/40 flex min-h-14 flex-1 items-center gap-3 rounded-3xl border border-white/10 bg-slate-950/70 px-5 ring-0 transition focus-within:ring-4">
|
||||
<Search className="h-5 w-5 text-cyan-300" />
|
||||
<input
|
||||
value={rawQuery}
|
||||
onChange={handleQueryChange}
|
||||
placeholder="搜索 IP、服务器名、脚本、凭据名称、计划任务..."
|
||||
className="h-12 flex-1 bg-transparent text-sm font-bold text-white outline-none placeholder:text-slate-600"
|
||||
/>
|
||||
</label>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center justify-center gap-2 rounded-3xl border border-white/10 bg-white/[0.04] px-5 py-4 text-sm font-black text-cyan-100 hover:bg-cyan-400/10">
|
||||
<ArrowUpRight className="h-4 w-4" /> 旧后台完整搜索
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid gap-3 sm:grid-cols-3 xl:grid-cols-1">
|
||||
<MetricCard icon={Sparkles} label="搜索模式" value={data.mode === 'live' ? '真实 API' : '演示兜底'} tone="blue" />
|
||||
<MetricCard icon={Database} label="结果总数" value={String(data.total)} tone="green" />
|
||||
<MetricCard icon={ShieldCheck} label="资产来源" value={mode === 'live' ? String(total) + ' 台' : '演示数据'} tone="purple" />
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
{data.warning ? <Notice tone="amber" title="已切换演示数据" message={data.warning} /> : null}
|
||||
{!hasQuery ? <Notice tone="blue" title="输入提示" message="请输入至少 2 个字符开始搜索；前端会做 350ms 防抖，避免每次按键都请求后端。" /> : null}
|
||||
{hasServerFallback ? <Notice tone="green" title="本地资产命中" message="后端搜索没有返回服务器结果，但 V2 当前已加载资产表中有匹配项，下面会单独显示本地命中。" /> : null}
|
||||
|
||||
{hasServerFallback ? (
|
||||
<Panel className="p-6">
|
||||
<div className="mb-4 flex items-center justify-between gap-3">
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">本地已加载服务器命中</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">来自当前 Dashboard 资产缓存，只读展示，不触发写操作。</p>
|
||||
</div>
|
||||
<Badge tone="blue">{localMatches.length} 条</Badge>
|
||||
</div>
|
||||
<div className="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
|
||||
{localMatches.map((server) => (
|
||||
<div key={server.id} className="rounded-3xl border border-white/10 bg-white/[0.03] p-4">
|
||||
<div className="font-black text-white">{server.name}</div>
|
||||
<div className="mt-1 font-mono text-xs text-slate-500">{server.ip}</div>
|
||||
<div className="mt-3 flex flex-wrap gap-2">
|
||||
<Badge tone={server.online ? 'green' : 'slate'}>{server.online ? '在线' : '离线/未知'}</Badge>
|
||||
<Badge tone="slate">{server.region}</Badge>
|
||||
</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
) : null}
|
||||
|
||||
<section className="grid gap-5 xl:grid-cols-2">
|
||||
{groups.map((group) => (
|
||||
<SearchGroupPanel key={group.key} group={group} items={visibleItems(data, group.key)} query={normalizedQuery} />
|
||||
))}
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface MetricCardProps {
|
||||
icon: typeof Search
|
||||
label: string
|
||||
value: string
|
||||
tone: Tone
|
||||
}
|
||||
|
||||
function MetricCard({ icon: Icon, label, value, tone }: MetricCardProps): JSX.Element {
|
||||
const toneClass = tone === 'green'
|
||||
? 'from-emerald-400/20 to-emerald-400/5 text-emerald-200'
|
||||
: tone === 'purple'
|
||||
? 'from-violet-400/20 to-violet-400/5 text-violet-200'
|
||||
: 'from-cyan-400/20 to-cyan-400/5 text-cyan-200'
|
||||
return (
|
||||
<div className={cn('rounded-3xl border border-white/10 bg-gradient-to-br p-5', toneClass)}>
|
||||
<Icon className="h-5 w-5" />
|
||||
<div className="mt-4 text-xs font-black uppercase tracking-[0.2em] text-slate-500">{label}</div>
|
||||
<div className="mt-1 text-2xl font-black text-white">{value}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface NoticeProps {
|
||||
tone: Tone
|
||||
title: string
|
||||
message: string
|
||||
}
|
||||
|
||||
function Notice({ tone, title, message }: NoticeProps): JSX.Element {
|
||||
const className = tone === 'green'
|
||||
? 'border-emerald-400/20 bg-emerald-400/10 text-emerald-100'
|
||||
: tone === 'blue'
|
||||
? 'border-cyan-400/20 bg-cyan-400/10 text-cyan-100'
|
||||
: 'border-amber-400/20 bg-amber-400/10 text-amber-100'
|
||||
return (
|
||||
<div className={cn('rounded-3xl border px-5 py-4 text-sm font-semibold', className)}>
|
||||
<span className="font-black">{title}：</span>{message}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface SearchGroupPanelProps {
|
||||
group: SearchGroupMeta
|
||||
items: GlobalSearchItem[]
|
||||
query: string
|
||||
}
|
||||
|
||||
function SearchGroupPanel({ group, items, query }: SearchGroupPanelProps): JSX.Element {
|
||||
const Icon = group.icon
|
||||
return (
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="flex items-start justify-between gap-3 border-b border-white/10 p-6">
|
||||
<div className="flex items-start gap-4">
|
||||
<div className="grid h-12 w-12 place-items-center rounded-2xl border border-white/10 bg-white/[0.04] text-cyan-200">
|
||||
<Icon className="h-5 w-5" />
|
||||
</div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black text-white">{group.title}</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">{group.subtitle}</p>
|
||||
</div>
|
||||
</div>
|
||||
<Badge tone={group.tone}>{items.length} 条</Badge>
|
||||
</div>
|
||||
<div className="space-y-3 p-4">
|
||||
{items.length > 0 ? items.map((item) => (
|
||||
<a
|
||||
key={group.key + '-' + String(item.id)}
|
||||
href={itemRouteHint(group.key, item)}
|
||||
className="focus-ring group flex items-start justify-between gap-3 rounded-3xl border border-white/10 bg-slate-950/40 p-4 transition hover:border-cyan-300/30 hover:bg-cyan-400/10"
|
||||
>
|
||||
<div className="min-w-0">
|
||||
<div className="truncate text-sm font-black text-white">{itemTitle(item, group.key)}</div>
|
||||
<div className="mt-1 line-clamp-2 text-xs font-semibold leading-5 text-slate-500">{itemSubtitle(item, group.key)}</div>
|
||||
</div>
|
||||
<ArrowUpRight className="mt-1 h-4 w-4 shrink-0 text-slate-600 transition group-hover:text-cyan-200" />
|
||||
</a>
|
||||
)) : (
|
||||
<div className="rounded-3xl border border-dashed border-white/10 bg-white/[0.02] px-5 py-8 text-center">
|
||||
<Filter className="mx-auto h-6 w-6 text-slate-600" />
|
||||
<div className="mt-3 text-sm font-black text-slate-400">{query.length >= 2 ? '暂无命中' : '等待输入'}</div>
|
||||
<p className="mt-1 text-xs font-semibold leading-5 text-slate-600">{query.length >= 2 ? '可以换一个关键词，或打开旧后台继续使用完整功能。' : '输入至少 2 个字符后开始查询。'}</p>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface HealthScoreProps {
|
||||
servers: ServerAsset[]
|
||||
}
|
||||
|
||||
function calculateScore(servers: ServerAsset[]): number {
|
||||
if (servers.length === 0) return 0
|
||||
const onlineRate = servers.filter((server) => server.online !== false).length / servers.length
|
||||
const ttlRate = servers.filter((server) => server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s').length / servers.length
|
||||
const critical = servers.filter((server) => server.risk === 'critical').length
|
||||
const warning = servers.filter((server) => server.risk === 'warning').length
|
||||
const score = Math.round(onlineRate * 45 + ttlRate * 45 + Math.max(0, 10 - critical * 4 - warning * 2))
|
||||
return Math.max(0, Math.min(100, score))
|
||||
}
|
||||
|
||||
export function HealthScore({ servers }: HealthScoreProps): JSX.Element {
|
||||
const score = calculateScore(servers)
|
||||
const highRisk = servers.filter((server) => server.risk === 'critical').length
|
||||
const fixedToday = servers.filter((server) => server.btSessionCleanupPatched || server.btSessionCleanupOk).length
|
||||
|
||||
return (
|
||||
<Panel className="flex items-center justify-between p-5">
|
||||
<div>
|
||||
<div className="text-xs font-bold text-slate-400">健康评分</div>
|
||||
<div className="mt-3 flex items-end gap-3">
|
||||
<div className="text-5xl font-black tracking-[-0.08em] text-white">{score}</div>
|
||||
<div className="pb-2 text-xs font-bold text-emerald-300">HEALTH</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="grid grid-cols-2 gap-3">
|
||||
<div className="soft-panel rounded-2xl p-3">
|
||||
<div className="text-xs font-bold text-slate-500">高危</div>
|
||||
<div className="mt-1 text-2xl font-black text-red-300">{highRisk}</div>
|
||||
</div>
|
||||
<div className="soft-panel rounded-2xl p-3">
|
||||
<div className="text-xs font-bold text-slate-500">已修复</div>
|
||||
<div className="mt-1 text-2xl font-black text-emerald-300">{fixedToday}</div>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,301 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { flexRender, getCoreRowModel, getSortedRowModel, useReactTable } from '@tanstack/react-table'
|
||||
import type { ColumnDef } from '@tanstack/react-table'
|
||||
import { ArrowUpRight, Clock3, FileText, History, LockKeyhole, Search, Server, ShieldCheck, TerminalSquare, UserRound, Wifi } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { hasSensitiveMarker, redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchOperationLogsData } from '../api/dashboardApi'
|
||||
import type { OperationCommandLogItem, OperationSshSessionItem } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface OperationLogsPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type SessionStatusTone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
|
||||
function formatDate(value?: string | null): string {
|
||||
if (!value) return '-'
|
||||
const date = new Date(value)
|
||||
if (Number.isNaN(date.getTime())) return String(value)
|
||||
return date.toLocaleString('zh-CN', { hour12: false })
|
||||
}
|
||||
|
||||
function durationText(start?: string | null, end?: string | null): string {
|
||||
if (!start) return '-'
|
||||
const startTime = Date.parse(start)
|
||||
const endTime = end ? Date.parse(end) : Date.now()
|
||||
if (!Number.isFinite(startTime) || !Number.isFinite(endTime)) return '-'
|
||||
const minutes = Math.max(0, Math.round((endTime - startTime) / 60000))
|
||||
if (minutes < 1) return '<1 分钟'
|
||||
if (minutes < 60) return String(minutes) + ' 分钟'
|
||||
const hours = Math.floor(minutes / 60)
|
||||
const rest = minutes % 60
|
||||
return rest ? String(hours) + ' 小时 ' + String(rest) + ' 分钟' : String(hours) + ' 小时'
|
||||
}
|
||||
|
||||
function redactCommand(value?: string | null): string {
|
||||
return redactSensitiveText(value, '-', 240)
|
||||
}
|
||||
|
||||
|
||||
function statusTone(status?: string | null): SessionStatusTone {
|
||||
const value = String(status || '').toLowerCase()
|
||||
if (['active', 'open', 'running', 'connected'].some((item) => value.includes(item))) return 'green'
|
||||
if (['closed', 'finished', 'done'].some((item) => value.includes(item))) return 'slate'
|
||||
if (['failed', 'error', 'timeout'].some((item) => value.includes(item))) return 'red'
|
||||
if (['idle', 'waiting'].some((item) => value.includes(item))) return 'amber'
|
||||
return 'blue'
|
||||
}
|
||||
|
||||
function sessionLabel(status?: string | null): string {
|
||||
return String(status || 'unknown')
|
||||
}
|
||||
|
||||
function hasRedaction(command?: string | null): boolean {
|
||||
return hasSensitiveMarker(command)
|
||||
}
|
||||
|
||||
|
||||
function commandSearchText(item: OperationCommandLogItem): string {
|
||||
return [item.id, item.session_id, item.server_id, item.server_name, item.admin_username, item.remote_addr, item.command]
|
||||
.map((value) => String(value || '').toLowerCase())
|
||||
.join(' ')
|
||||
}
|
||||
|
||||
export function OperationLogsPage({ servers, total, mode }: OperationLogsPageProps): JSX.Element {
|
||||
const [selectedServer, setSelectedServer] = useState('all')
|
||||
const [query, setQuery] = useState('')
|
||||
const [redactedOnly, setRedactedOnly] = useState(false)
|
||||
const selectedServerId = selectedServer === 'all' ? undefined : Number(selectedServer)
|
||||
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['operation-logs-v2', selectedServerId ?? 'all'],
|
||||
queryFn: () => fetchOperationLogsData(selectedServerId),
|
||||
staleTime: 20_000,
|
||||
})
|
||||
|
||||
const selectableServers = useMemo(() => servers.filter((server) => typeof server.sourceId === 'number'), [servers])
|
||||
|
||||
const filteredCommands = useMemo(() => {
|
||||
const text = query.trim().toLowerCase()
|
||||
return data.commands.filter((item) => {
|
||||
const textMatched = !text || commandSearchText(item).includes(text)
|
||||
const redactedMatched = !redactedOnly || hasRedaction(item.command)
|
||||
return textMatched && redactedMatched
|
||||
})
|
||||
}, [data.commands, query, redactedOnly])
|
||||
|
||||
const activeSessions = useMemo(() => data.sessions.filter((item) => statusTone(item.status) === 'green').length, [data.sessions])
|
||||
const redactedCommands = useMemo(() => data.commands.filter((item) => hasRedaction(item.command)).length, [data.commands])
|
||||
|
||||
const columns = useMemo<ColumnDef<OperationCommandLogItem>[]>(() => [
|
||||
{
|
||||
accessorKey: 'created_at',
|
||||
header: '时间',
|
||||
cell: ({ row }) => (
|
||||
<div className="min-w-36 text-sm font-semibold leading-6 text-slate-400">
|
||||
<div className="flex items-center gap-2 text-slate-200"><Clock3 className="h-4 w-4 text-slate-600" />{formatDate(row.original.created_at)}</div>
|
||||
<div className="text-xs text-slate-600">#{row.original.id}</div>
|
||||
</div>
|
||||
),
|
||||
},
|
||||
{
|
||||
accessorKey: 'server_name',
|
||||
header: '服务器 / 会话',
|
||||
cell: ({ row }) => (
|
||||
<div className="min-w-48 text-sm font-semibold leading-6 text-slate-400">
|
||||
<div className="flex items-center gap-2 text-white"><Server className="h-4 w-4 text-cyan-300" />{row.original.server_name || ('#' + String(row.original.server_id || '-'))}</div>
|
||||
<div className="font-mono text-xs text-slate-600">{row.original.session_id || '-'}</div>
|
||||
</div>
|
||||
),
|
||||
},
|
||||
{
|
||||
accessorKey: 'admin_username',
|
||||
header: '操作者',
|
||||
cell: ({ row }) => (
|
||||
<div className="min-w-32 text-sm font-semibold leading-6 text-slate-400">
|
||||
<div className="flex items-center gap-2"><UserRound className="h-4 w-4 text-slate-600" />{row.original.admin_username || ('admin#' + String(row.original.admin_id || '-'))}</div>
|
||||
<div className="font-mono text-xs text-slate-600">{row.original.remote_addr || '-'}</div>
|
||||
</div>
|
||||
),
|
||||
},
|
||||
{
|
||||
accessorKey: 'command',
|
||||
header: '命令摘要',
|
||||
cell: ({ row }) => {
|
||||
const command = redactCommand(row.original.command)
|
||||
return (
|
||||
<div className="min-w-[32rem]">
|
||||
<code className="block rounded-2xl border border-white/10 bg-slate-950/70 px-4 py-3 font-mono text-xs leading-6 text-slate-200">{command}</code>
|
||||
<div className="mt-2 flex flex-wrap gap-2">
|
||||
<Badge tone={hasRedaction(command) ? 'amber' : 'green'} dot>{hasRedaction(command) ? '已做敏感片段脱敏' : '未命中敏感片段'}</Badge>
|
||||
<Badge tone="slate">V2 只读</Badge>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
},
|
||||
},
|
||||
], [])
|
||||
|
||||
const table = useReactTable({
|
||||
data: filteredCommands,
|
||||
columns,
|
||||
getCoreRowModel: getCoreRowModel(),
|
||||
getSortedRowModel: getSortedRowModel(),
|
||||
})
|
||||
|
||||
return (
|
||||
<div className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4 border-b border-white/10 pb-5">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-emerald-400/15 text-emerald-200"><History className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-[-0.04em] text-white">SSH 会话 / 命令日志只读中心</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">V2 仅读取 /api/assets/ssh-sessions 与 /api/assets/command-logs?redact=true；不执行命令、不打开 WebSSH、不暴露敏感参数。</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '实时 API' : '降级数据'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>Dashboard {mode}</Badge>
|
||||
<Badge tone="purple"><LockKeyhole className="mr-1 h-3 w-3" />服务端脱敏</Badge>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
|
||||
<div className="mt-5 grid gap-4 md:grid-cols-4">
|
||||
<MetricCard icon={TerminalSquare} label="SSH 会话" value={String(data.sessionTotal)} hint={String(activeSessions) + ' 个活动中'} tone="text-emerald-300" />
|
||||
<MetricCard icon={FileText} label="命令记录" value={String(data.commandTotal)} hint="当前读取最近 120 条" tone="text-cyan-300" />
|
||||
<MetricCard icon={ShieldCheck} label="脱敏命令" value={String(redactedCommands)} hint="服务端 + 前端双层兜底" tone="text-amber-300" />
|
||||
<MetricCard icon={Server} label="资产规模" value={String(total)} hint="可按服务器筛选" tone="text-violet-300" />
|
||||
</div>
|
||||
|
||||
<div className="mt-5 grid gap-3 xl:grid-cols-[1fr_auto_auto]">
|
||||
<label className="focus-within:ring-nexus flex items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索命令 / 服务器 / 会话 / 操作者 / 来源 IP" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Server className="h-4 w-4" />
|
||||
<select value={selectedServer} onChange={(event) => setSelectedServer(event.target.value)} className="max-w-64 bg-transparent text-slate-100 outline-none">
|
||||
<option value="all">全部服务器</option>
|
||||
{selectableServers.map((server) => <option key={server.sourceId} value={server.sourceId}>{server.name} / {server.ip}</option>)}
|
||||
</select>
|
||||
</label>
|
||||
<label className="flex cursor-pointer items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-300">
|
||||
<input type="checkbox" checked={redactedOnly} onChange={(event) => setRedactedOnly(event.target.checked)} className="h-4 w-4 accent-cyan-400" />
|
||||
只看已脱敏命令
|
||||
</label>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[25rem_minmax(0,1fr)]">
|
||||
<Panel className="p-6">
|
||||
<div className="mb-4 flex items-center justify-between">
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">最近 SSH 会话</h3>
|
||||
<p className="mt-1 text-xs font-semibold text-slate-500">仅展示会话元数据，不建立交互终端。</p>
|
||||
</div>
|
||||
<Badge tone="blue" dot>{data.sessions.length} 条</Badge>
|
||||
</div>
|
||||
<div className="space-y-3">
|
||||
{data.sessions.map((session) => <SessionCard key={session.id} session={session} />)}
|
||||
{data.sessions.length === 0 ? <div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5 text-center text-sm font-bold text-slate-500">暂无 SSH 会话记录</div> : null}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="mb-4 flex flex-wrap items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">命令日志摘要</h3>
|
||||
<p className="mt-1 text-xs font-semibold text-slate-500">后端 redact=true 先脱敏，前端再次兜底；V2 不提供执行、重放、复制敏感正文能力。</p>
|
||||
</div>
|
||||
<Badge tone="green" dot>{filteredCommands.length} / {data.commandTotal}</Badge>
|
||||
</div>
|
||||
<div className="overflow-x-auto rounded-3xl border border-white/10">
|
||||
<table className="min-w-full divide-y divide-white/10">
|
||||
<thead className="bg-white/[0.03]">
|
||||
{table.getHeaderGroups().map((headerGroup) => (
|
||||
<tr key={headerGroup.id}>
|
||||
{headerGroup.headers.map((header) => (
|
||||
<th key={header.id} className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">
|
||||
{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
|
||||
</th>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10 bg-slate-950/20">
|
||||
{table.getRowModel().rows.map((row) => (
|
||||
<tr key={row.id} className="transition hover:bg-white/[0.03]">
|
||||
{row.getVisibleCells().map((cell) => (
|
||||
<td key={cell.id} className="px-5 py-4 align-top">
|
||||
{flexRender(cell.column.columnDef.cell, cell.getContext())}
|
||||
</td>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
{filteredCommands.length === 0 ? <div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的命令日志</div> : null}
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3 rounded-3xl border border-emerald-300/10 bg-emerald-400/5 p-4">
|
||||
<div className="text-sm font-semibold leading-6 text-slate-400">
|
||||
V2 只做审计查看；真实 WebSSH、命令执行、会话回放、日志导出和权限变更仍回旧后台，继续走原鉴权、审计与风险控制。
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-emerald-300/25 bg-emerald-400/15 px-4 py-3 text-sm font-black text-emerald-100">
|
||||
回旧后台处理写操作 <ArrowUpRight className="h-4 w-4" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface MetricCardProps {
|
||||
icon: typeof TerminalSquare
|
||||
label: string
|
||||
value: string
|
||||
hint: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function MetricCard({ icon: Icon, label, value, hint, tone }: MetricCardProps): JSX.Element {
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-5">
|
||||
<div className="flex items-center justify-between">
|
||||
<div className="text-sm font-black text-slate-400">{label}</div>
|
||||
<Icon className={cn('h-5 w-5', tone)} />
|
||||
</div>
|
||||
<div className={cn('mt-4 text-3xl font-black tracking-[-0.05em]', tone)}>{value}</div>
|
||||
<div className="mt-2 text-xs font-semibold text-slate-500">{hint}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function SessionCard({ session }: { session: OperationSshSessionItem }): JSX.Element {
|
||||
const tone = statusTone(session.status)
|
||||
return (
|
||||
<div className="rounded-3xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex flex-wrap items-center justify-between gap-2">
|
||||
<Badge tone={tone} dot>{sessionLabel(session.status)}</Badge>
|
||||
<span className="font-mono text-xs font-bold text-slate-600">{session.id}</span>
|
||||
</div>
|
||||
<div className="mt-3 flex items-center gap-2 text-sm font-black text-white"><Server className="h-4 w-4 text-cyan-300" />{session.server_name || ('#' + String(session.server_id || '-'))}</div>
|
||||
<div className="mt-2 grid gap-2 text-xs font-semibold text-slate-500">
|
||||
<div className="flex items-center gap-2"><Wifi className="h-3.5 w-3.5" />来源：{session.remote_addr || '-'}</div>
|
||||
<div className="flex items-center gap-2"><Clock3 className="h-3.5 w-3.5" />开始：{formatDate(session.started_at)}</div>
|
||||
<div className="flex items-center gap-2"><Clock3 className="h-3.5 w-3.5" />时长：{durationText(session.started_at, session.closed_at)}</div>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,231 @@
|
||||
import { useCallback, useEffect, useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { ArrowUp, ExternalLink, File, FolderOpen, HardDrive, LockKeyhole, RefreshCw, Search, Server } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { redactFilePathText } from '@/lib/redaction'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { fetchFileBrowseData } from '../api/dashboardApi'
|
||||
import type { RemoteFileItem } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface ReadOnlyFileBrowserProps {
|
||||
servers: ServerAsset[]
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
function normalizePathInput(value: string): string {
|
||||
const trimmed = value.trim()
|
||||
if (!trimmed) return '/'
|
||||
return trimmed.startsWith('/') ? trimmed : '/' + trimmed
|
||||
}
|
||||
|
||||
function joinRemotePath(base: string, name: string): string {
|
||||
const normalizedBase = normalizePathInput(base)
|
||||
if (normalizedBase === '/') return '/' + name
|
||||
return normalizedBase.replace(/\/+$/g, '') + '/' + name
|
||||
}
|
||||
|
||||
function parentRemotePath(path: string): string {
|
||||
const normalized = normalizePathInput(path).replace(/\/+$/g, '')
|
||||
if (!normalized || normalized === '/') return '/'
|
||||
const index = normalized.lastIndexOf('/')
|
||||
return index <= 0 ? '/' : normalized.slice(0, index)
|
||||
}
|
||||
|
||||
function pathFingerprint(value: string): string {
|
||||
let hash = 2166136261
|
||||
for (let index = 0; index < value.length; index += 1) {
|
||||
hash ^= value.charCodeAt(index)
|
||||
hash = Math.imul(hash, 16777619)
|
||||
}
|
||||
return value.length + ':' + (hash >>> 0).toString(36)
|
||||
}
|
||||
|
||||
function formatSize(value?: number | null): string {
|
||||
const size = typeof value === 'number' && Number.isFinite(value) ? value : 0
|
||||
if (size < 1024) return String(size) + ' B'
|
||||
if (size < 1024 * 1024) return (size / 1024).toFixed(1) + ' KB'
|
||||
return (size / 1024 / 1024).toFixed(1) + ' MB'
|
||||
}
|
||||
|
||||
function formatFileTime(value?: string | null): string {
|
||||
if (!value) return '-'
|
||||
if (value === 'demo') return '演示数据'
|
||||
const parsed = Date.parse(value)
|
||||
if (!Number.isFinite(parsed)) return value
|
||||
return new Date(parsed).toLocaleString('zh-CN', { hour12: false })
|
||||
}
|
||||
|
||||
function itemTone(item: RemoteFileItem): 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple' {
|
||||
if (item.type === 'directory') return 'blue'
|
||||
if (item.type === 'symlink') return 'purple'
|
||||
const name = item.name.toLowerCase()
|
||||
if (name.endsWith('.sh') || name.endsWith('.py') || name.endsWith('.js')) return 'amber'
|
||||
return 'slate'
|
||||
}
|
||||
|
||||
function sortItems(items: RemoteFileItem[]): RemoteFileItem[] {
|
||||
return [...items].sort((a, b) => {
|
||||
if (a.type === 'directory' && b.type !== 'directory') return -1
|
||||
if (a.type !== 'directory' && b.type === 'directory') return 1
|
||||
return a.name.localeCompare(b.name, 'zh-CN')
|
||||
})
|
||||
}
|
||||
|
||||
export function ReadOnlyFileBrowser({ servers, mode }: ReadOnlyFileBrowserProps): JSX.Element {
|
||||
const browseableServers = useMemo(() => servers.filter((server) => server.sourceId && server.online !== false), [servers])
|
||||
const [serverId, setServerId] = useState<number | undefined>(browseableServers[0]?.sourceId)
|
||||
const [pathInput, setPathInput] = useState('/')
|
||||
const [browsePath, setBrowsePath] = useState('/')
|
||||
const redactedBrowsePath = redactFilePathText(browsePath, '/', 180)
|
||||
const browsePathKey = redactedBrowsePath.includes('[HIDDEN]') ? 'blocked-sensitive-path' : pathFingerprint(browsePath)
|
||||
const [nameQuery, setNameQuery] = useState('')
|
||||
|
||||
useEffect(() => {
|
||||
if (serverId && browseableServers.some((server) => server.sourceId === serverId)) return
|
||||
setServerId(browseableServers[0]?.sourceId)
|
||||
}, [browseableServers, serverId])
|
||||
|
||||
const selectedServer = useMemo(() => browseableServers.find((server) => server.sourceId === serverId), [browseableServers, serverId])
|
||||
const { data, refetch } = useSuspenseQuery({
|
||||
queryKey: ['readonly-file-browser-v2', serverId || 0, browsePathKey],
|
||||
queryFn: () => fetchFileBrowseData(serverId, browsePath),
|
||||
staleTime: 10_000,
|
||||
})
|
||||
|
||||
const visibleItems = useMemo(() => {
|
||||
const text = nameQuery.trim().toLowerCase()
|
||||
return sortItems(data.items).filter((item) => !text || [item.name, item.type, item.owner, item.group, item.permissions].some((value) => String(value || '').toLowerCase().includes(text)))
|
||||
}, [data.items, nameQuery])
|
||||
|
||||
const directoryCount = useMemo(() => data.items.filter((item) => item.type === 'directory').length, [data.items])
|
||||
const fileCount = useMemo(() => data.items.filter((item) => item.type !== 'directory').length, [data.items])
|
||||
const totalSize = useMemo(() => data.items.reduce((sum, item) => sum + (item.type === 'file' ? (item.size || 0) : 0), 0), [data.items])
|
||||
|
||||
const handleBrowse = useCallback((): void => {
|
||||
const nextPath = normalizePathInput(pathInput)
|
||||
setBrowsePath(nextPath)
|
||||
setPathInput(nextPath)
|
||||
}, [pathInput])
|
||||
|
||||
const handleServerChange = useCallback((value: string): void => {
|
||||
const nextServerId = Number(value) || undefined
|
||||
setServerId(nextServerId)
|
||||
}, [])
|
||||
|
||||
const handleDirectoryOpen = useCallback((item: RemoteFileItem): void => {
|
||||
if (item.type !== 'directory' || item.name === '[HIDDEN]') return
|
||||
const nextPath = joinRemotePath(browsePath, item.name)
|
||||
setBrowsePath(nextPath)
|
||||
setPathInput(nextPath)
|
||||
}, [browsePath])
|
||||
|
||||
const handleParent = useCallback((): void => {
|
||||
const nextPath = parentRemotePath(browsePath)
|
||||
setBrowsePath(nextPath)
|
||||
setPathInput(nextPath)
|
||||
}, [browsePath])
|
||||
|
||||
const handleRefresh = useCallback((): void => {
|
||||
void refetch()
|
||||
}, [refetch])
|
||||
|
||||
return (
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4 border-b border-white/10 pb-5">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-emerald-400/15 text-emerald-200">
|
||||
<FolderOpen className="h-5 w-5" />
|
||||
</div>
|
||||
<div>
|
||||
<h3 className="text-xl font-black tracking-[-0.04em] text-white">真实只读文件浏览</h3>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">
|
||||
调用 /api/files/browse 只列目录；不读取文件正文，不上传、不删除、不写入。
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '远程目录' : '降级演示'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>Dashboard {mode}</Badge>
|
||||
<Badge tone="purple"><LockKeyhole className="mr-1 h-3 w-3" />只读</Badge>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
{data.error ? <div className="mt-4 rounded-2xl border border-red-300/20 bg-red-400/10 px-4 py-3 text-sm font-semibold text-red-100">远程返回错误：{data.error}</div> : null}
|
||||
|
||||
<div className="mt-5 grid gap-3 xl:grid-cols-[280px_1fr_auto_auto]">
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Server className="h-4 w-4" />
|
||||
<select value={serverId ?? 0} onChange={(event) => handleServerChange(event.target.value)} className="min-w-0 flex-1 bg-transparent text-slate-100 outline-none">
|
||||
{browseableServers.map((server) => <option key={server.id} value={server.sourceId ?? 0}>{server.name} / {server.ip}</option>)}
|
||||
{browseableServers.length === 0 ? <option value={0}>无在线服务器</option> : null}
|
||||
</select>
|
||||
</label>
|
||||
<label className="focus-within:ring-nexus flex items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-semibold text-slate-500">
|
||||
<HardDrive className="h-4 w-4" />
|
||||
<input value={pathInput} onChange={(event) => setPathInput(event.target.value)} onKeyDown={(event) => { if (event.key === 'Enter') handleBrowse() }} placeholder="/www/wwwroot" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<button type="button" onClick={handleBrowse} className="focus-ring rounded-2xl bg-cyan-400 px-4 py-3 text-sm font-black text-slate-950">浏览</button>
|
||||
<button type="button" onClick={handleRefresh} className="focus-ring inline-flex items-center justify-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-100"><RefreshCw className="h-4 w-4" />刷新</button>
|
||||
</div>
|
||||
|
||||
<div className="mt-4 grid gap-3 md:grid-cols-4">
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-4"><div className="text-xs font-black text-slate-500">当前服务器</div><div className="mt-1 truncate text-sm font-black text-white">{selectedServer ? selectedServer.name + ' / ' + selectedServer.ip : '未选择'}</div></div>
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-4"><div className="text-xs font-black text-slate-500">当前路径</div><div className="mt-1 truncate text-sm font-black text-cyan-100">{data.path}</div></div>
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-4"><div className="text-xs font-black text-slate-500">目录 / 文件</div><div className="mt-1 text-sm font-black text-white">{directoryCount} / {fileCount}</div></div>
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-4"><div className="text-xs font-black text-slate-500">文件体积合计</div><div className="mt-1 text-sm font-black text-white">{formatSize(totalSize)}</div></div>
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3">
|
||||
<button type="button" onClick={handleParent} className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-2 text-xs font-black text-slate-200"><ArrowUp className="h-4 w-4" />上级目录</button>
|
||||
<label className="focus-within:ring-nexus flex min-w-72 items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-2 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={nameQuery} onChange={(event) => setNameQuery(event.target.value)} placeholder="过滤名称 / owner / 权限" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div className="mt-4 overflow-x-auto rounded-3xl border border-white/10">
|
||||
<table className="min-w-full divide-y divide-white/10">
|
||||
<thead className="bg-white/[0.03]">
|
||||
<tr>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">名称</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">权限</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">Owner</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">大小</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">修改时间</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10 bg-slate-950/20">
|
||||
{visibleItems.map((item) => (
|
||||
<tr key={item.name + ':' + item.type + ':' + (item.link_target || '')} className="transition hover:bg-white/[0.03]">
|
||||
<td className="px-5 py-4">
|
||||
<button type="button" onClick={() => handleDirectoryOpen(item)} disabled={item.type !== 'directory' || item.name === '[HIDDEN]'} className={cn('flex max-w-md items-center gap-3 text-left text-sm font-black', item.type === 'directory' ? 'text-cyan-100 hover:text-cyan-300' : 'cursor-default text-slate-300')}>
|
||||
{item.type === 'directory' ? <FolderOpen className="h-4 w-4 shrink-0 text-cyan-300" /> : <File className="h-4 w-4 shrink-0 text-slate-500" />}
|
||||
<span className="truncate">{item.name}</span>
|
||||
</button>
|
||||
{item.link_target ? <div className="mt-1 text-xs font-semibold text-slate-600">→ {item.link_target}</div> : null}
|
||||
</td>
|
||||
<td className="px-5 py-4"><Badge tone={itemTone(item)}>{item.permissions || item.mode_octal || '-'}</Badge></td>
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-400">{item.owner || '-'}:{item.group || '-'}</td>
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-400">{item.type === 'file' ? formatSize(item.size) : '-'}</td>
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-500">{formatFileTime(item.modified)}</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
{visibleItems.length === 0 ? <div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的目录项</div> : null}
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3 rounded-3xl border border-emerald-300/10 bg-emerald-400/5 p-4">
|
||||
<div className="text-sm font-semibold leading-6 text-slate-400">
|
||||
该浏览器只执行远程 ls 目录列表；文件读取、上传、删除、chmod、压缩/解压、跨服务器推送仍回旧后台处理。
|
||||
</div>
|
||||
<a href="/app/files" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-emerald-300/25 bg-emerald-400/15 px-4 py-3 text-sm font-black text-emerald-100">
|
||||
去旧文件管理 <ExternalLink className="h-4 w-4" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,233 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { flexRender, getCoreRowModel, getFilteredRowModel, getSortedRowModel, useReactTable } from '@tanstack/react-table'
|
||||
import type { ColumnDef } from '@tanstack/react-table'
|
||||
import { ArrowUpRight, BookOpen, Code2, FileText, Filter, LockKeyhole, Search, ShieldCheck, Tags, UserRound } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchScriptLibraryData } from '../api/dashboardApi'
|
||||
import type { ScriptSummaryItem } from '../api/dashboardApi'
|
||||
|
||||
interface ScriptLibraryPageProps {
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type CategoryFilter = 'all' | string
|
||||
|
||||
function formatDate(value?: string | null): string {
|
||||
if (!value) return '-'
|
||||
const date = new Date(value)
|
||||
if (Number.isNaN(date.getTime())) return value
|
||||
return date.toLocaleString('zh-CN', { hour12: false })
|
||||
}
|
||||
|
||||
function formatSize(value?: number | null): string {
|
||||
const size = typeof value === 'number' && Number.isFinite(value) ? value : 0
|
||||
if (size < 1024) return String(size) + ' B'
|
||||
if (size < 1024 * 1024) return (size / 1024).toFixed(1) + ' KB'
|
||||
return (size / 1024 / 1024).toFixed(1) + ' MB'
|
||||
}
|
||||
|
||||
function redactText(value?: string | null): string {
|
||||
return redactSensitiveText(value, '-', 160)
|
||||
}
|
||||
|
||||
function categoryTone(category?: string | null): 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple' {
|
||||
const value = String(category || '').toLowerCase()
|
||||
if (value.includes('security') || value.includes('safe')) return 'green'
|
||||
if (value.includes('bt') || value.includes('panel')) return 'blue'
|
||||
if (value.includes('agent')) return 'purple'
|
||||
if (value.includes('db') || value.includes('mysql')) return 'amber'
|
||||
return 'slate'
|
||||
}
|
||||
|
||||
function scriptAgeDays(value?: string | null): number | null {
|
||||
if (!value) return null
|
||||
const time = Date.parse(value)
|
||||
if (!Number.isFinite(time)) return null
|
||||
return Math.max(0, Math.round((Date.now() - time) / 86400000))
|
||||
}
|
||||
|
||||
export function ScriptLibraryPage({ mode }: ScriptLibraryPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [category, setCategory] = useState<CategoryFilter>('all')
|
||||
const [contentOnly, setContentOnly] = useState(false)
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['script-library-v2'],
|
||||
queryFn: fetchScriptLibraryData,
|
||||
staleTime: 30_000,
|
||||
})
|
||||
|
||||
const filteredItems = useMemo(() => {
|
||||
const text = query.trim().toLowerCase()
|
||||
return data.items.filter((item) => {
|
||||
const categoryMatched = category === 'all' || (item.category || '未分类') === category
|
||||
const contentMatched = !contentOnly || item.has_content === true
|
||||
const textMatched = !text || [item.name, item.category, item.description, item.created_by, String(item.id)].some((value) => String(value || '').toLowerCase().includes(text))
|
||||
return categoryMatched && contentMatched && textMatched
|
||||
})
|
||||
}, [category, contentOnly, data.items, query])
|
||||
|
||||
const columns = useMemo<ColumnDef<ScriptSummaryItem>[]>(() => [
|
||||
{
|
||||
accessorKey: 'name',
|
||||
header: '脚本',
|
||||
cell: ({ row }) => {
|
||||
const item = row.original
|
||||
return (
|
||||
<div className="min-w-80">
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<Badge tone={categoryTone(item.category)}>{item.category || '未分类'}</Badge>
|
||||
<span className="text-sm font-black text-white">#{item.id}</span>
|
||||
{item.has_content ? <Badge tone="green" dot>有正文</Badge> : <Badge tone="slate">空正文</Badge>}
|
||||
</div>
|
||||
<div className="mt-2 text-sm font-black text-white">{redactText(item.name)}</div>
|
||||
<div className="mt-1 max-w-2xl text-xs font-semibold leading-5 text-slate-500">{redactText(item.description)}</div>
|
||||
</div>
|
||||
)
|
||||
},
|
||||
},
|
||||
{
|
||||
accessorKey: 'created_by',
|
||||
header: '创建者',
|
||||
cell: ({ row }) => (
|
||||
<div className="flex items-center gap-2 text-sm font-semibold text-slate-400">
|
||||
<UserRound className="h-4 w-4 text-slate-600" /> {row.original.created_by || '-'}
|
||||
</div>
|
||||
),
|
||||
},
|
||||
{
|
||||
accessorKey: 'line_count',
|
||||
header: '规模',
|
||||
cell: ({ row }) => (
|
||||
<div className="text-sm font-semibold leading-6 text-slate-300">
|
||||
<div>{row.original.line_count || 0} 行</div>
|
||||
<div className="text-xs text-slate-600">{formatSize(row.original.content_size)}</div>
|
||||
</div>
|
||||
),
|
||||
},
|
||||
{
|
||||
accessorKey: 'updated_at',
|
||||
header: '更新时间',
|
||||
cell: ({ row }) => {
|
||||
const days = scriptAgeDays(row.original.updated_at)
|
||||
return (
|
||||
<div className="text-xs font-semibold leading-5 text-slate-400">
|
||||
<div>{formatDate(row.original.updated_at)}</div>
|
||||
<div className="text-slate-600">{days === null ? '-' : String(days) + ' 天前'}</div>
|
||||
</div>
|
||||
)
|
||||
},
|
||||
},
|
||||
], [])
|
||||
|
||||
const table = useReactTable({
|
||||
data: filteredItems,
|
||||
columns,
|
||||
getCoreRowModel: getCoreRowModel(),
|
||||
getSortedRowModel: getSortedRowModel(),
|
||||
getFilteredRowModel: getFilteredRowModel(),
|
||||
})
|
||||
|
||||
const totalLines = data.items.reduce((sum, item) => sum + (item.line_count || 0), 0)
|
||||
const totalSize = data.items.reduce((sum, item) => sum + (item.content_size || 0), 0)
|
||||
const cards = [
|
||||
{ label: '脚本数量', value: String(data.total), sub: data.mode === 'live' ? '来自 summary-only API' : '安全降级演示', icon: BookOpen, tone: 'text-cyan-300' },
|
||||
{ label: '分类', value: String(data.categories.length), sub: '按 category 聚合', icon: Tags, tone: 'text-blue-300' },
|
||||
{ label: '正文规模', value: formatSize(totalSize), sub: String(totalLines) + ' 行；不返回正文', icon: Code2, tone: 'text-violet-300' },
|
||||
{ label: '安全边界', value: '只读', sub: '不编辑、不执行、不复制正文', icon: ShieldCheck, tone: 'text-emerald-300' },
|
||||
]
|
||||
|
||||
return (
|
||||
<div id="scripts" className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
{cards.map((card) => (
|
||||
<Panel key={card.label} className="p-5">
|
||||
<div className="flex items-center justify-between">
|
||||
<div className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">{card.label}</div>
|
||||
<card.icon className={cn('h-5 w-5', card.tone)} />
|
||||
</div>
|
||||
<div className="mt-3 text-3xl font-black tracking-[-0.05em] text-white">{card.value}</div>
|
||||
<div className="mt-2 text-sm font-semibold text-slate-500">{card.sub}</div>
|
||||
</Panel>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<Panel className="overflow-hidden p-5">
|
||||
<div className="flex flex-wrap items-start justify-between gap-4 border-b border-white/10 pb-5">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-cyan-400/15 text-cyan-200"><FileText className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-[-0.04em] text-white">脚本库只读浏览</h2>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">V2 使用 /api/scripts/summaries，只拿元数据，不让脚本正文进入浏览器响应。</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '实时 API' : '降级数据'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>Dashboard {mode}</Badge>
|
||||
<Badge tone="purple"><LockKeyhole className="mr-1 h-3 w-3" />不返回 content</Badge>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
|
||||
<div className="mt-5 grid gap-3 xl:grid-cols-[1fr_auto_auto]">
|
||||
<label className="focus-within:ring-nexus flex items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索脚本名 / 分类 / 描述 / 创建者 / ID" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
<label className="flex items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-400">
|
||||
<Filter className="h-4 w-4" />
|
||||
<select value={category} onChange={(event) => setCategory(event.target.value)} className="bg-transparent text-slate-100 outline-none">
|
||||
<option value="all">全部分类</option>
|
||||
{data.categories.map((item) => <option key={item} value={item}>{item}</option>)}
|
||||
</select>
|
||||
</label>
|
||||
<label className="flex cursor-pointer items-center gap-2 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 text-sm font-bold text-slate-300">
|
||||
<input type="checkbox" checked={contentOnly} onChange={(event) => setContentOnly(event.target.checked)} className="h-4 w-4 accent-cyan-400" />
|
||||
只看有正文
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div className="mt-5 overflow-x-auto rounded-3xl border border-white/10">
|
||||
<table className="min-w-full divide-y divide-white/10">
|
||||
<thead className="bg-white/[0.03]">
|
||||
{table.getHeaderGroups().map((headerGroup) => (
|
||||
<tr key={headerGroup.id}>
|
||||
{headerGroup.headers.map((header) => (
|
||||
<th key={header.id} className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">
|
||||
{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
|
||||
</th>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10 bg-slate-950/20">
|
||||
{table.getRowModel().rows.map((row) => (
|
||||
<tr key={row.id} className="transition hover:bg-white/[0.03]">
|
||||
{row.getVisibleCells().map((cell) => (
|
||||
<td key={cell.id} className="px-5 py-4 align-top">
|
||||
{flexRender(cell.column.columnDef.cell, cell.getContext())}
|
||||
</td>
|
||||
))}
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
{filteredItems.length === 0 ? <div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的脚本摘要</div> : null}
|
||||
</div>
|
||||
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3 rounded-3xl border border-cyan-300/10 bg-cyan-400/5 p-4">
|
||||
<div className="text-sm font-semibold leading-6 text-slate-400">
|
||||
V2 只读列表不返回脚本正文；编辑、复制正文、执行、删除、凭据选择仍回旧后台，继续走原有鉴权、危险命令检查和审计链路。
|
||||
</div>
|
||||
<a href="/app/scripts" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-cyan-300/25 bg-cyan-400/15 px-4 py-3 text-sm font-black text-cyan-100">
|
||||
去旧后台脚本库 <ArrowUpRight className="h-4 w-4" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,340 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { AlertTriangle, CheckCircle2, ExternalLink, Eye, FileSearch, Filter, KeyRound, LockKeyhole, Search, Server, ShieldAlert, ShieldCheck, TerminalSquare, TimerReset, Wrench } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { fetchAuditLogData } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface SecurityInspectionPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type FindingSeverity = 'critical' | 'warning' | 'passed' | 'info'
|
||||
type FindingCategory = 'btpanel' | 'ssl' | 'agent' | 'audit' | 'script' | 'secret'
|
||||
type FindingFilter = 'all' | FindingSeverity | FindingCategory
|
||||
|
||||
interface SecurityFinding {
|
||||
id: string
|
||||
title: string
|
||||
desc: string
|
||||
category: FindingCategory
|
||||
severity: FindingSeverity
|
||||
affected: number
|
||||
total: number
|
||||
evidence: string
|
||||
action: string
|
||||
icon: LucideIcon
|
||||
}
|
||||
|
||||
const filters: Array<{ label: string; value: FindingFilter }> = [
|
||||
{ label: '全部', value: 'all' },
|
||||
{ label: '严重', value: 'critical' },
|
||||
{ label: '关注', value: 'warning' },
|
||||
{ label: '通过', value: 'passed' },
|
||||
{ label: '宝塔', value: 'btpanel' },
|
||||
{ label: 'SSL', value: 'ssl' },
|
||||
{ label: 'Agent', value: 'agent' },
|
||||
{ label: '审计', value: 'audit' },
|
||||
]
|
||||
|
||||
function isTtlProtected(server: ServerAsset): boolean {
|
||||
return Boolean(server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s')
|
||||
}
|
||||
|
||||
function percent(done: number, total: number): number {
|
||||
if (total <= 0) return 0
|
||||
return Math.max(0, Math.min(100, Math.round((done / total) * 100)))
|
||||
}
|
||||
|
||||
function severityTone(severity: FindingSeverity): 'green' | 'amber' | 'red' | 'blue' | 'slate' {
|
||||
if (severity === 'critical') return 'red'
|
||||
if (severity === 'warning') return 'amber'
|
||||
if (severity === 'passed') return 'green'
|
||||
return 'blue'
|
||||
}
|
||||
|
||||
function severityLabel(severity: FindingSeverity): string {
|
||||
if (severity === 'critical') return '严重'
|
||||
if (severity === 'warning') return '需关注'
|
||||
if (severity === 'passed') return '通过'
|
||||
return '信息'
|
||||
}
|
||||
|
||||
function severityBar(severity: FindingSeverity): string {
|
||||
if (severity === 'critical') return 'bg-red-400'
|
||||
if (severity === 'warning') return 'bg-amber-400'
|
||||
if (severity === 'passed') return 'bg-emerald-400'
|
||||
return 'bg-cyan-400'
|
||||
}
|
||||
|
||||
function categoryLabel(category: FindingCategory): string {
|
||||
if (category === 'btpanel') return '宝塔'
|
||||
if (category === 'ssl') return 'SSL'
|
||||
if (category === 'agent') return 'Agent'
|
||||
if (category === 'audit') return '审计'
|
||||
if (category === 'script') return '脚本'
|
||||
return '敏感信息'
|
||||
}
|
||||
|
||||
function buildFindings(servers: ServerAsset[], total: number, auditRiskCount: number): SecurityFinding[] {
|
||||
const effectiveTotal = Math.max(total, servers.length)
|
||||
const configuredBt = servers.filter((server) => server.btConfigured).length
|
||||
const ttlUnprotected = servers.filter((server) => server.btConfigured && !isTtlProtected(server)).length
|
||||
const sslOff = servers.filter((server) => server.ssl === 'disabled').length
|
||||
const offline = servers.filter((server) => server.online === false || server.panelStatus === 'offline').length
|
||||
const criticalAssets = servers.filter((server) => server.risk === 'critical').length
|
||||
const publicBt = servers.filter((server) => server.btConfigured && server.ssl !== 'internal').length
|
||||
|
||||
return [
|
||||
{
|
||||
id: 'bt-ttl-hardcoded-3600',
|
||||
title: '宝塔 Session TTL 兜底',
|
||||
desc: '检查一键登录前 hardcoded_3600 清理风险；新增宝塔仍依赖后端登录前自动检测/修复。',
|
||||
category: 'btpanel',
|
||||
severity: ttlUnprotected > 0 ? 'warning' : 'passed',
|
||||
affected: ttlUnprotected > 0 ? ttlUnprotected : configuredBt,
|
||||
total: Math.max(configuredBt, 1),
|
||||
evidence: ttlUnprotected > 0 ? String(ttlUnprotected) + ' 台已配置宝塔仍需复查 TTL' : String(configuredBt) + ' 台已配置宝塔当前 TTL 兜底通过',
|
||||
action: '一键登录前继续走后端 TTL guard，不在前端生成 tmp_login token。',
|
||||
icon: TimerReset,
|
||||
},
|
||||
{
|
||||
id: 'bt-panel-ssl',
|
||||
title: '公网宝塔面板 SSL',
|
||||
desc: '识别 verify_ssl 未开启的公网宝塔面板；V2 只展示建议，开启/证书改动回旧后台。',
|
||||
category: 'ssl',
|
||||
severity: sslOff > 0 ? 'warning' : 'passed',
|
||||
affected: sslOff > 0 ? sslOff : publicBt,
|
||||
total: Math.max(publicBt, servers.length, 1),
|
||||
evidence: sslOff > 0 ? String(sslOff) + ' 台公网面板未开启 SSL 校验' : '公网面板 SSL 状态未发现异常',
|
||||
action: '优先处理公网面板；内网测试机可保留 internal 标记。',
|
||||
icon: LockKeyhole,
|
||||
},
|
||||
{
|
||||
id: 'agent-heartbeat-risk',
|
||||
title: 'Agent 在线与资产同步',
|
||||
desc: '检查离线服务器、心跳异常和关键资产风险；离线资产会影响巡检覆盖率。',
|
||||
category: 'agent',
|
||||
severity: offline + criticalAssets > 0 ? 'critical' : 'passed',
|
||||
affected: offline + criticalAssets,
|
||||
total: effectiveTotal,
|
||||
evidence: String(offline) + ' 台离线，' + String(criticalAssets) + ' 台 critical 风险',
|
||||
action: '离线机器先回旧后台或 SSH 检查 Agent/网络，再重新同步。',
|
||||
icon: Server,
|
||||
},
|
||||
{
|
||||
id: 'audit-risk-events',
|
||||
title: '审计/告警异常事件',
|
||||
desc: '基于审计日志和告警历史统计删除、失败、活跃告警等需关注事件。',
|
||||
category: 'audit',
|
||||
severity: auditRiskCount > 0 ? 'warning' : 'passed',
|
||||
affected: auditRiskCount,
|
||||
total: Math.max(auditRiskCount, 1),
|
||||
evidence: auditRiskCount > 0 ? String(auditRiskCount) + ' 条近期审计/告警事件需要复核' : '近期审计/告警没有明显风险项',
|
||||
action: '详细时间线已迁移到 V2 审计日志页，深度追溯仍可回旧后台。',
|
||||
icon: FileSearch,
|
||||
},
|
||||
{
|
||||
id: 'script-service-admin-shell',
|
||||
title: '管理员远程执行命令边界',
|
||||
desc: 'script_service 是管理员远程执行命令能力，允许 shell 属于预期设计；关注点是权限、审计和二次确认。',
|
||||
category: 'script',
|
||||
severity: 'info',
|
||||
affected: 0,
|
||||
total: 1,
|
||||
evidence: 'V2 当前不直接执行/停止/重试脚本，只提供旧后台入口。',
|
||||
action: '后续迁移写操作时再加显式确认、审计说明和最小暴露字段。',
|
||||
icon: TerminalSquare,
|
||||
},
|
||||
{
|
||||
id: 'secret-visibility',
|
||||
title: '敏感信息前端可见性',
|
||||
desc: '检查 V2 页面是否展示密码、Cookie、tmp_login token、密钥类字段、私钥等敏感字段。',
|
||||
category: 'secret',
|
||||
severity: 'passed',
|
||||
affected: 0,
|
||||
total: 1,
|
||||
evidence: 'V2 仅保存内存 access token；页面不展示密钥类敏感值和宝塔凭据。',
|
||||
action: '继续保持设置、凭据、批量导入等敏感编辑回旧后台或做强确认。',
|
||||
icon: KeyRound,
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
export function SecurityInspectionPage({ servers, total, mode }: SecurityInspectionPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [filter, setFilter] = useState<FindingFilter>('all')
|
||||
const { data: auditData } = useSuspenseQuery({
|
||||
queryKey: ['security-audit-signal-v2'],
|
||||
queryFn: fetchAuditLogData,
|
||||
staleTime: 30_000,
|
||||
})
|
||||
|
||||
const auditRiskCount = useMemo(() => {
|
||||
const riskyAudits = auditData.auditItems.filter((item) => {
|
||||
const text = [item.action, item.detail, item.target_type].filter(Boolean).join(' ').toLowerCase()
|
||||
return text.includes('delete') || text.includes('remove') || text.includes('failed') || text.includes('失败')
|
||||
}).length
|
||||
const activeAlerts = auditData.alertItems.filter((item) => item.is_recovery !== true).length
|
||||
return riskyAudits + activeAlerts
|
||||
}, [auditData.alertItems, auditData.auditItems])
|
||||
|
||||
const findings = useMemo(() => buildFindings(servers, total, auditRiskCount), [auditRiskCount, servers, total])
|
||||
const keyword = query.trim().toLowerCase()
|
||||
const filteredFindings = useMemo(() => findings.filter((finding) => {
|
||||
const matchesFilter = filter === 'all' || finding.severity === filter || finding.category === filter
|
||||
const matchesKeyword = !keyword || [finding.title, finding.desc, finding.evidence, finding.action, categoryLabel(finding.category), severityLabel(finding.severity)]
|
||||
.some((value) => value.toLowerCase().includes(keyword))
|
||||
return matchesFilter && matchesKeyword
|
||||
}), [filter, findings, keyword])
|
||||
|
||||
const criticalCount = findings.filter((finding) => finding.severity === 'critical').length
|
||||
const warningCount = findings.filter((finding) => finding.severity === 'warning').length
|
||||
const passedCount = findings.filter((finding) => finding.severity === 'passed').length
|
||||
const score = percent(passedCount, findings.length)
|
||||
|
||||
return (
|
||||
<div id="security" className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-20 h-56 w-56 rounded-full bg-amber-400/10 blur-3xl" />
|
||||
<div className="flex flex-wrap items-start justify-between gap-5">
|
||||
<div className="max-w-3xl">
|
||||
<Badge tone={criticalCount ? 'red' : warningCount ? 'amber' : 'green'} dot className="px-4 py-2">V2 安全巡检</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">安全巡检 / 风险总览</h2>
|
||||
<p className="mt-3 text-sm font-semibold leading-7 text-slate-400">
|
||||
这一版先迁移只读风险总览：围绕宝塔 TTL、面板 SSL、Agent 在线、审计告警、脚本执行边界和敏感信息可见性做快速判断。深度扫描、修复、删除、执行类动作仍回旧后台，避免绕过现有权限与审计链路。
|
||||
</p>
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ExternalLink className="h-4 w-4" /> 旧后台深度巡检
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
{auditData.warning ? (
|
||||
<div className="rounded-3xl border border-amber-400/20 bg-amber-400/10 px-5 py-4 text-sm font-semibold text-amber-100">
|
||||
<span className="font-black">巡检数据提示：</span>{auditData.warning}
|
||||
</div>
|
||||
) : null}
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
<SecurityMetric icon={ShieldCheck} label="巡检得分" value={String(score) + '%'} sub={mode === 'live' ? '实时资产 + 审计信号' : '演示资产 + 审计信号'} tone={score >= 80 ? 'text-emerald-300' : score >= 60 ? 'text-amber-300' : 'text-red-300'} />
|
||||
<SecurityMetric icon={ShieldAlert} label="严重项" value={String(criticalCount)} sub="离线 / critical 风险" tone={criticalCount ? 'text-red-300' : 'text-emerald-300'} />
|
||||
<SecurityMetric icon={AlertTriangle} label="需关注" value={String(warningCount)} sub="TTL / SSL / 审计告警" tone={warningCount ? 'text-amber-300' : 'text-emerald-300'} />
|
||||
<SecurityMetric icon={CheckCircle2} label="通过项" value={String(passedCount)} sub="当前符合预期" tone="text-emerald-300" />
|
||||
</section>
|
||||
|
||||
<Panel className="p-5">
|
||||
<div className="flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-amber-400/10 text-amber-200"><Filter className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-lg font-black text-white">巡检过滤器</div>
|
||||
<div className="text-sm font-semibold text-slate-500">审计信号：{auditData.mode === 'live' ? '实时 API' : 'fallback'}，资产信号：{mode === 'live' ? '实时 API' : 'fallback'}</div>
|
||||
</div>
|
||||
</div>
|
||||
<label className="flex min-w-0 flex-1 items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 xl:max-w-md">
|
||||
<Search className="h-4 w-4 text-slate-500" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索巡检项、证据、建议" className="min-w-0 flex-1 bg-transparent text-sm font-semibold text-white outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
<div className="mt-5 flex flex-wrap gap-2">
|
||||
{filters.map((item) => (
|
||||
<button key={item.value} type="button" onClick={() => setFilter(item.value)} className={cn('focus-ring rounded-2xl px-4 py-2 text-sm font-black transition', filter === item.value ? 'bg-cyan-400 text-slate-950' : 'border border-white/10 bg-white/[0.03] text-slate-400 hover:text-white')}>
|
||||
{item.label}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 xl:grid-cols-2">
|
||||
{filteredFindings.map((finding) => (
|
||||
<FindingCard key={finding.id} finding={finding} />
|
||||
))}
|
||||
</section>
|
||||
|
||||
<Panel className="grid gap-5 p-6 lg:grid-cols-[minmax(0,1fr)_22rem] lg:items-center">
|
||||
<div>
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-cyan-400/10 text-cyan-200"><Eye className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-xl font-black text-white">V2 巡检边界</div>
|
||||
<div className="text-sm font-semibold text-slate-500">当前只读，不触发修复、不执行脚本、不泄露凭据。</div>
|
||||
</div>
|
||||
</div>
|
||||
<p className="mt-4 text-sm font-semibold leading-7 text-slate-500">
|
||||
这个页面用于快速判断优先级；真正会改服务器状态的操作，例如修复 SSL、修改宝塔凭据、执行 shell、清理审计日志，仍然从旧后台入口处理或后续增加明确二次确认后再迁移。
|
||||
</p>
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center justify-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-slate-200 hover:bg-white/[0.08]">
|
||||
<ExternalLink className="h-4 w-4" /> 打开旧后台安全巡检
|
||||
</a>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface SecurityMetricProps {
|
||||
icon: LucideIcon
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function SecurityMetric({ icon: Icon, label, value, sub, tone }: SecurityMetricProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="group overflow-hidden p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<Icon className={'h-5 w-5 ' + tone} />
|
||||
</div>
|
||||
<Wrench className="h-4 w-4 text-slate-600 transition group-hover:text-cyan-300" />
|
||||
</div>
|
||||
<div className="mt-5 text-xs font-black uppercase tracking-[0.14em] text-slate-500">{label}</div>
|
||||
<div className="mt-2 text-3xl font-black text-white">{value}</div>
|
||||
<p className="mt-2 text-sm font-medium leading-6 text-slate-500">{sub}</p>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
function FindingCard({ finding }: { finding: SecurityFinding }): JSX.Element {
|
||||
const Icon = finding.icon
|
||||
return (
|
||||
<Panel className="relative overflow-hidden p-5">
|
||||
<div className="absolute -right-12 -top-12 h-32 w-32 rounded-full bg-amber-400/5 blur-3xl" />
|
||||
<div className="relative flex items-start justify-between gap-4">
|
||||
<div className="flex min-w-0 gap-4">
|
||||
<div className="grid h-12 w-12 shrink-0 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<Icon className="h-5 w-5 text-cyan-200" />
|
||||
</div>
|
||||
<div className="min-w-0">
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<h3 className="text-lg font-black text-white">{finding.title}</h3>
|
||||
<Badge tone={severityTone(finding.severity)} dot>{severityLabel(finding.severity)}</Badge>
|
||||
<Badge tone="slate">{categoryLabel(finding.category)}</Badge>
|
||||
</div>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-500">{finding.desc}</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="relative mt-5">
|
||||
<div className="mb-2 flex items-center justify-between text-sm">
|
||||
<span className="font-black text-slate-300">证据：{finding.evidence}</span>
|
||||
<span className="font-black text-slate-500">{finding.affected} / {finding.total}</span>
|
||||
</div>
|
||||
<div className="h-2.5 overflow-hidden rounded-full bg-slate-800/90">
|
||||
<div className={severityBar(finding.severity) + ' h-full rounded-full'} style={{ width: String(finding.severity === 'passed' ? 100 : percent(finding.total - finding.affected, finding.total)) + '%' }} />
|
||||
</div>
|
||||
<div className="mt-4 rounded-2xl border border-white/10 bg-slate-950/40 px-4 py-3 text-sm font-semibold leading-6 text-slate-400">
|
||||
<span className="font-black text-slate-200">建议：</span>{finding.action}
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
import { ExternalLink } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface ServerDrawerProps {
|
||||
servers: ServerAsset[]
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
function formatDateTime(value?: string | null): string {
|
||||
if (!value) return '未检查'
|
||||
const timestamp = Date.parse(value)
|
||||
if (!Number.isFinite(timestamp)) return value
|
||||
return new Intl.DateTimeFormat('zh-CN', { dateStyle: 'short', timeStyle: 'short' }).format(timestamp)
|
||||
}
|
||||
|
||||
export function ServerDrawer({ servers, onBtLogin }: ServerDrawerProps): JSX.Element {
|
||||
const selectedServerId = useAppStore((state) => state.selectedServerId)
|
||||
const server = servers.find((item) => item.id === selectedServerId) ?? servers[0]
|
||||
|
||||
return (
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<h2 className="text-xl font-black tracking-tight text-white">服务器详情</h2>
|
||||
<Badge tone="blue" dot>当前选中</Badge>
|
||||
</div>
|
||||
{server ? (
|
||||
<>
|
||||
<div className="mt-7">
|
||||
<div className="text-2xl font-black tracking-tight text-white">{server.name}</div>
|
||||
<div className="mt-1 font-mono text-sm font-medium text-slate-500">{server.ip} · {server.region}</div>
|
||||
</div>
|
||||
<div className="mt-7 grid grid-cols-2 gap-3">
|
||||
<Metric label="CPU" value={String(server.cpu) + '%'} tone="text-emerald-300" />
|
||||
<Metric label="内存" value={String(server.memory) + '%'} tone="text-cyan-300" />
|
||||
<Metric label="磁盘" value={String(server.disk) + '%'} tone="text-amber-300" />
|
||||
<Metric label="心跳" value={server.latency} tone="text-emerald-300" />
|
||||
</div>
|
||||
<div className="mt-8">
|
||||
<div className="mb-3 text-sm font-black text-slate-200">快捷操作</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<button
|
||||
className="focus-ring inline-flex items-center gap-2 rounded-full bg-sky-400/15 px-4 py-2 text-xs font-bold text-sky-200 disabled:cursor-not-allowed disabled:opacity-50"
|
||||
disabled={!server.sourceId}
|
||||
onClick={() => onBtLogin(server)}
|
||||
>
|
||||
<ExternalLink className="h-3.5 w-3.5" /> 一键登录宝塔
|
||||
</button>
|
||||
<a href="/app/" className="focus-ring rounded-full bg-violet-400/15 px-4 py-2 text-xs font-bold text-violet-200">打开终端</a>
|
||||
<a href="/app/" className="focus-ring rounded-full bg-slate-400/10 px-4 py-2 text-xs font-bold text-slate-200">执行脚本</a>
|
||||
</div>
|
||||
</div>
|
||||
<div className="mt-8">
|
||||
<div className="mb-4 text-sm font-black text-slate-200">最近诊断</div>
|
||||
<Diagnosis label="Session TTL" value={server.ttl === '86400s' ? '86400s · 健康' : server.ttl + ' · 待修复'} good={server.ttl === '86400s'} />
|
||||
<Diagnosis label="BT Task 清理" value={server.btSessionCleanupPatched ? '已补丁 / 兜底' : server.btSessionCleanupOk ? '已验证' : '登录前自动检测'} good={Boolean(server.btSessionCleanupOk || server.btSessionCleanupPatched)} />
|
||||
<Diagnosis label="面板 SSL" value={server.ssl === 'enabled' ? '已开启' : server.ssl === 'internal' ? '内网' : server.ssl === 'disabled' ? '建议开启' : '未知'} good={server.ssl !== 'disabled'} />
|
||||
<Diagnosis label="凭据展示" value="敏感值已隐藏" good />
|
||||
<Diagnosis label="上次检查" value={formatDateTime(server.btLastCheckAt)} good={!server.btLastError} />
|
||||
{server.btLastError ? <Diagnosis label="最近错误" value={server.btLastError} good={false} /> : null}
|
||||
</div>
|
||||
</>
|
||||
) : (
|
||||
<div className="mt-8 rounded-3xl border border-dashed border-white/10 p-8 text-center text-sm font-bold text-slate-500">暂无服务器数据</div>
|
||||
)}
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
interface MetricProps { label: string; value: string; tone: string }
|
||||
function Metric({ label, value, tone }: MetricProps): JSX.Element {
|
||||
return <div className="soft-panel rounded-2xl p-4"><div className="text-xs font-bold text-slate-500">{label}</div><div className={'mt-1 text-2xl font-black ' + tone}>{value}</div></div>
|
||||
}
|
||||
|
||||
interface DiagnosisProps { label: string; value: string; good: boolean }
|
||||
function Diagnosis({ label, value, good }: DiagnosisProps): JSX.Element {
|
||||
return <div className="flex items-center justify-between gap-4 border-b border-white/[0.06] py-3 text-sm"><span className="font-bold text-slate-500">{label}</span><span className={good ? 'text-right font-black text-emerald-300' : 'text-right font-black text-amber-300'}>{value}</span></div>
|
||||
}
|
||||
@@ -0,0 +1,140 @@
|
||||
import { useMemo } from 'react'
|
||||
import { createColumnHelper, flexRender, getCoreRowModel, useReactTable } from '@tanstack/react-table'
|
||||
import { ExternalLink, Loader2 } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
type PanelStatus = ServerAsset['panelStatus']
|
||||
type Risk = ServerAsset['risk']
|
||||
|
||||
interface ServerTableProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
loginLoadingId?: string | null
|
||||
onBtLogin: (server: ServerAsset) => void
|
||||
}
|
||||
|
||||
function statusBadge(status: PanelStatus): JSX.Element {
|
||||
if (status === 'online') return <Badge tone="green" dot>在线</Badge>
|
||||
if (status === 'patched') return <Badge tone="green" dot>已修复</Badge>
|
||||
if (status === 'test') return <Badge tone="blue" dot>待配置</Badge>
|
||||
return <Badge tone="red" dot>离线</Badge>
|
||||
}
|
||||
|
||||
function riskBadge(risk: Risk): JSX.Element {
|
||||
if (risk === 'healthy') return <Badge tone="green">健康</Badge>
|
||||
if (risk === 'patched') return <Badge tone="green">已修复</Badge>
|
||||
if (risk === 'warning') return <Badge tone="amber">建议</Badge>
|
||||
return <Badge tone="red">关注</Badge>
|
||||
}
|
||||
|
||||
function sslLabel(value: ServerAsset['ssl']): string {
|
||||
if (value === 'enabled') return '开启'
|
||||
if (value === 'disabled') return '未开启'
|
||||
if (value === 'internal') return '内网'
|
||||
return '未知'
|
||||
}
|
||||
|
||||
const columnHelper = createColumnHelper<ServerAsset>()
|
||||
|
||||
export function ServerTable({ servers, total, mode, loginLoadingId, onBtLogin }: ServerTableProps): JSX.Element {
|
||||
const selectedServerId = useAppStore((state) => state.selectedServerId)
|
||||
const setSelectedServerId = useAppStore((state) => state.setSelectedServerId)
|
||||
|
||||
const columns = useMemo(() => [
|
||||
columnHelper.accessor('name', {
|
||||
header: '服务器',
|
||||
cell: (info) => <span className="font-black text-slate-100">{info.getValue()}</span>,
|
||||
}),
|
||||
columnHelper.accessor((row) => row.ip + ' · ' + row.region, {
|
||||
id: 'ipRegion',
|
||||
header: 'IP / 区域',
|
||||
cell: (info) => <span className="font-mono text-slate-300">{info.getValue()}</span>,
|
||||
}),
|
||||
columnHelper.accessor('panelStatus', {
|
||||
header: '宝塔',
|
||||
cell: (info) => statusBadge(info.getValue()),
|
||||
}),
|
||||
columnHelper.accessor('ttl', {
|
||||
header: 'TTL',
|
||||
cell: (info) => <span className={info.getValue() === '86400s' ? 'font-bold text-emerald-300' : 'font-bold text-amber-300'}>{info.getValue()}</span>,
|
||||
}),
|
||||
columnHelper.accessor('ssl', {
|
||||
header: 'SSL',
|
||||
cell: (info) => {
|
||||
const value = info.getValue()
|
||||
return <span className={value === 'disabled' ? 'font-bold text-amber-300' : 'font-bold text-slate-200'}>{sslLabel(value)}</span>
|
||||
},
|
||||
}),
|
||||
columnHelper.accessor('risk', {
|
||||
header: '风险',
|
||||
cell: (info) => riskBadge(info.getValue()),
|
||||
}),
|
||||
columnHelper.display({
|
||||
id: 'action',
|
||||
header: '操作',
|
||||
cell: (info) => {
|
||||
const server = info.row.original
|
||||
const loading = loginLoadingId === server.id
|
||||
return (
|
||||
<button
|
||||
className="inline-flex items-center gap-1 font-black text-cyan-300 hover:text-cyan-100 disabled:cursor-not-allowed disabled:opacity-50"
|
||||
disabled={loading || !server.sourceId}
|
||||
onClick={(event) => {
|
||||
event.stopPropagation()
|
||||
onBtLogin(server)
|
||||
}}
|
||||
>
|
||||
{loading ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <ExternalLink className="h-3.5 w-3.5" />}
|
||||
{server.action}
|
||||
</button>
|
||||
)
|
||||
},
|
||||
}),
|
||||
], [loginLoadingId, onBtLogin])
|
||||
|
||||
const table = useReactTable({ data: servers, columns, getCoreRowModel: getCoreRowModel() })
|
||||
|
||||
return (
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="flex flex-wrap items-center justify-between gap-3 p-6">
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-tight text-white">服务器资产 / 宝塔状态</h2>
|
||||
<p className="mt-1 text-sm font-medium text-slate-500">
|
||||
{mode === 'live' ? '实时 API 数据 · 共 ' + String(total) + ' 台资产' : '演示数据 · 实时 API 暂不可用'}
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={mode === 'live' ? 'green' : 'amber'} dot className="px-4 py-2">{mode === 'live' ? '实时' : 'Fallback'}</Badge>
|
||||
<Badge tone="green" dot className="px-4 py-2">一键登录前 TTL 兜底</Badge>
|
||||
<Badge tone="slate" className="px-4 py-2">导出</Badge>
|
||||
</div>
|
||||
</div>
|
||||
<div className="overflow-x-auto">
|
||||
<table className="w-full min-w-[920px] border-collapse text-sm">
|
||||
<thead>
|
||||
{table.getHeaderGroups().map((headerGroup) => (
|
||||
<tr key={headerGroup.id} className="border-y border-white/10 text-left text-xs uppercase tracking-[0.08em] text-slate-500">
|
||||
{headerGroup.headers.map((header) => <th key={header.id} className="px-6 py-4 font-black">{flexRender(header.column.columnDef.header, header.getContext())}</th>)}
|
||||
</tr>
|
||||
))}
|
||||
</thead>
|
||||
<tbody>
|
||||
{table.getRowModel().rows.map((row) => (
|
||||
<tr
|
||||
key={row.id}
|
||||
className={'cursor-pointer border-b border-white/[0.06] transition hover:bg-white/[0.04] ' + (selectedServerId === row.original.id ? 'bg-cyan-400/[0.06]' : '')}
|
||||
onClick={() => setSelectedServerId(row.original.id)}
|
||||
>
|
||||
{row.getVisibleCells().map((cell) => <td key={cell.id} className="px-6 py-4">{flexRender(cell.column.columnDef.cell, cell.getContext())}</td>)}
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,290 @@
|
||||
import { useMemo } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { AlertTriangle, CheckCircle2, DatabaseZap, ExternalLink, EyeOff, LockKeyhole, ServerCog, Settings, ShieldCheck, SlidersHorizontal, UserRound } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { isSensitiveKey, redactSensitiveText } from '@/lib/redaction'
|
||||
import { useAppStore } from '@/stores/appStore'
|
||||
import { fetchSettingsOverviewData } from '../api/dashboardApi'
|
||||
import { GiteaAllowlistPanel } from './GiteaAllowlistPanel'
|
||||
import type { SettingsOverviewData } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface SettingsOverviewPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type StatusTone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
|
||||
interface SettingCard {
|
||||
title: string
|
||||
value: string
|
||||
desc: string
|
||||
tone: StatusTone
|
||||
icon: LucideIcon
|
||||
}
|
||||
|
||||
interface BoundaryItem {
|
||||
title: string
|
||||
desc: string
|
||||
tone: StatusTone
|
||||
icon: LucideIcon
|
||||
}
|
||||
|
||||
const safeDisplayKeys = [
|
||||
'system_name',
|
||||
'system_title',
|
||||
'api_base_url',
|
||||
'heartbeat_timeout',
|
||||
'cpu_alert_threshold',
|
||||
'mem_alert_threshold',
|
||||
'disk_alert_threshold',
|
||||
'alert_streak_required',
|
||||
'theme',
|
||||
'editor_theme',
|
||||
]
|
||||
|
||||
function displaySettingValue(key: string, value: string | null | undefined, valueSet?: boolean | null): string {
|
||||
if (isSensitiveKey(key)) return valueSet || Boolean(value) ? '已配置（隐藏）' : '未配置'
|
||||
if (!value) return '未设置'
|
||||
const safeValue = redactSensitiveText(value, '')
|
||||
if (safeValue.length > 64) return safeValue.slice(0, 61) + '...'
|
||||
return safeValue
|
||||
}
|
||||
|
||||
function settingValue(data: SettingsOverviewData, key: string): string | null {
|
||||
const item = data.settings.find((setting) => setting.key === key)
|
||||
return item?.value || null
|
||||
}
|
||||
|
||||
function hasSetting(data: SettingsOverviewData, key: string): boolean {
|
||||
const item = data.settings.find((setting) => setting.key === key)
|
||||
return Boolean(item?.value_set || item?.value)
|
||||
}
|
||||
|
||||
function ttlProtected(server: ServerAsset): boolean {
|
||||
return Boolean(server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s')
|
||||
}
|
||||
|
||||
function formatDate(value: string | null | undefined): string {
|
||||
if (!value) return '暂无记录'
|
||||
const timestamp = Date.parse(value)
|
||||
if (!Number.isFinite(timestamp)) return value
|
||||
return new Intl.DateTimeFormat('zh-CN', { month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit' }).format(new Date(timestamp))
|
||||
}
|
||||
|
||||
function buildCards(data: SettingsOverviewData, servers: ServerAsset[], total: number): SettingCard[] {
|
||||
const configuredBt = servers.filter((server) => server.btConfigured).length
|
||||
const protectedBt = servers.filter((server) => server.btConfigured && ttlProtected(server)).length
|
||||
const allowlist = data.allowlist
|
||||
const apiBaseUrl = settingValue(data, 'api_base_url') || '跟随后端环境配置'
|
||||
const heartbeat = settingValue(data, 'heartbeat_timeout') || '默认阈值'
|
||||
return [
|
||||
{
|
||||
title: '管理员会话',
|
||||
value: '内存 Access Token',
|
||||
desc: 'V2 启动时通过 refresh cookie 恢复登录态；页面不把访问令牌写入 localStorage。',
|
||||
tone: 'green',
|
||||
icon: LockKeyhole,
|
||||
},
|
||||
{
|
||||
title: '登录白名单',
|
||||
value: allowlist?.enabled ? '已启用' : '未启用 / 未读取',
|
||||
desc: allowlist ? '订阅 ' + String(allowlist.subscription_count) + ' 条，手动 ' + String(allowlist.manual_count) + ' 条，共 ' + String(allowlist.total_count) + ' 条。' : '未读取到白名单 API，写操作仍回旧后台。',
|
||||
tone: allowlist?.enabled ? 'green' : 'slate',
|
||||
icon: ShieldCheck,
|
||||
},
|
||||
{
|
||||
title: '宝塔 TTL 兜底',
|
||||
value: String(protectedBt) + ' / ' + String(Math.max(configuredBt, 1)),
|
||||
desc: '一键登录继续走后端 login-url，登录前自动检测/修复 hardcoded_3600。',
|
||||
tone: protectedBt >= configuredBt && configuredBt > 0 ? 'green' : 'amber',
|
||||
icon: ServerCog,
|
||||
},
|
||||
{
|
||||
title: '中心 API 地址',
|
||||
value: apiBaseUrl,
|
||||
desc: '用于 Agent / 宝塔回连判断；这里仅显示非敏感公开地址。',
|
||||
tone: 'blue',
|
||||
icon: DatabaseZap,
|
||||
},
|
||||
{
|
||||
title: '心跳阈值',
|
||||
value: heartbeat,
|
||||
desc: '当前资产 ' + String(total) + ' 台；离线判断和风险看板依赖该配置。',
|
||||
tone: 'purple',
|
||||
icon: SlidersHorizontal,
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
function buildBoundaries(data: SettingsOverviewData): BoundaryItem[] {
|
||||
const hiddenCount = data.settings.filter((setting) => isSensitiveKey(setting.key) && (setting.value_set || setting.value)).length
|
||||
return [
|
||||
{
|
||||
title: '敏感值默认隐藏',
|
||||
desc: '检测到 ' + String(hiddenCount) + ' 个敏感配置仅显示状态；V2 不展示密码、Cookie、Token、私钥和密钥类敏感值。',
|
||||
tone: 'green',
|
||||
icon: EyeOff,
|
||||
},
|
||||
{
|
||||
title: '高风险写操作回旧后台',
|
||||
desc: '凭据编辑、密钥修改、SSH 私钥、白名单增删、系统级写入暂不在 V2 直接执行。',
|
||||
tone: 'amber',
|
||||
icon: AlertTriangle,
|
||||
},
|
||||
{
|
||||
title: '只读概览先迁移',
|
||||
desc: '本页优先迁移查看、核对和跳转能力，后续按风险逐项拆分设置写入表单。',
|
||||
tone: 'blue',
|
||||
icon: CheckCircle2,
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
export function SettingsOverviewPage({ servers, total, mode }: SettingsOverviewPageProps): JSX.Element {
|
||||
const admin = useAppStore((state) => state.admin)
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['settings-overview-v2'],
|
||||
queryFn: fetchSettingsOverviewData,
|
||||
staleTime: 60_000,
|
||||
})
|
||||
|
||||
const cards = useMemo(() => buildCards(data, servers, total), [data, servers, total])
|
||||
const boundaries = useMemo(() => buildBoundaries(data), [data])
|
||||
const visibleSettings = useMemo(() => data.settings.filter((setting) => safeDisplayKeys.includes(setting.key)), [data])
|
||||
const btConfigured = useMemo(() => servers.filter((server) => server.btConfigured).length, [servers])
|
||||
const sslDisabled = useMemo(() => servers.filter((server) => server.ssl === 'disabled').length, [servers])
|
||||
|
||||
return (
|
||||
<div className="space-y-6 p-5 lg:p-10">
|
||||
<section className="grid gap-6 xl:grid-cols-[1.1fr_.9fr]">
|
||||
<Panel className="relative overflow-hidden p-7">
|
||||
<div className="absolute -right-16 -top-16 h-56 w-56 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="relative flex flex-col gap-5 lg:flex-row lg:items-end lg:justify-between">
|
||||
<div>
|
||||
<Badge tone="blue" dot className="px-4 py-2">系统设置 V2 · 只读概览</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">设置安全边界先迁移</h2>
|
||||
<p className="mt-4 max-w-3xl text-sm font-semibold leading-7 text-slate-400">
|
||||
V2 先提供管理员、登录安全、密钥类配置状态、白名单、宝塔 TTL 兜底的只读总览；任何可能泄漏或改坏生产配置的写操作，继续跳回旧后台处理。
|
||||
</p>
|
||||
</div>
|
||||
<div className="grid min-w-64 gap-3 rounded-3xl border border-white/10 bg-slate-950/50 p-5">
|
||||
<div className="flex items-center justify-between gap-4">
|
||||
<span className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">当前管理员</span>
|
||||
<Badge tone={admin?.totp_enabled ? 'green' : 'amber'} dot>{admin?.totp_enabled ? 'TOTP 已启用' : 'TOTP 未启用'}</Badge>
|
||||
</div>
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-cyan-400/15 text-cyan-200"><UserRound className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-lg font-black text-white">{admin?.username || '未知管理员'}</div>
|
||||
<div className="text-xs font-bold text-slate-500">创建：{formatDate(admin?.created_at)}</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="p-7">
|
||||
<div className="flex items-center justify-between gap-4">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">迁移状态</h3>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">当前设置页不直接写入生产配置。</p>
|
||||
</div>
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'} dot>{data.mode === 'live' ? '真实 API' : '降级数据'}</Badge>
|
||||
</div>
|
||||
{data.warning ? <div className="mt-5 rounded-3xl border border-amber-400/20 bg-amber-400/10 p-4 text-sm font-semibold leading-6 text-amber-100">{data.warning}</div> : null}
|
||||
<div className="mt-5 grid gap-3">
|
||||
<StatusLine label="设置读取" value={data.mode === 'live' ? '已连接 /api/settings' : '使用安全降级'} tone={data.mode === 'live' ? 'green' : 'amber'} />
|
||||
<StatusLine label="宝塔配置" value={String(btConfigured) + ' 台已配置'} tone="blue" />
|
||||
<StatusLine label="面板 SSL" value={String(sslDisabled) + ' 台未开启 SSL'} tone={sslDisabled > 0 ? 'amber' : 'green'} />
|
||||
<StatusLine label="数据源" value={mode === 'live' ? '资产 API 实时' : '资产演示数据'} tone={mode === 'live' ? 'green' : 'slate'} />
|
||||
</div>
|
||||
</Panel>
|
||||
</section>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 2xl:grid-cols-3">
|
||||
{cards.map((card) => (
|
||||
<Panel key={card.title} className="group p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className={cn('grid h-12 w-12 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]', card.tone === 'green' ? 'text-emerald-200' : card.tone === 'amber' ? 'text-amber-200' : card.tone === 'purple' ? 'text-violet-200' : 'text-cyan-200')}>
|
||||
<card.icon className="h-5 w-5" />
|
||||
</div>
|
||||
<Badge tone={card.tone} dot>{card.title}</Badge>
|
||||
</div>
|
||||
<div className="mt-5 break-words text-2xl font-black text-white">{card.value}</div>
|
||||
<p className="mt-3 text-sm font-semibold leading-6 text-slate-500">{card.desc}</p>
|
||||
</Panel>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<GiteaAllowlistPanel servers={servers} />
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[.9fr_1.1fr]">
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-center justify-between gap-4">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">安全边界</h3>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">先把“能安全看”的迁移到 V2。</p>
|
||||
</div>
|
||||
<Settings className="h-5 w-5 text-slate-500" />
|
||||
</div>
|
||||
<div className="mt-6 space-y-4">
|
||||
{boundaries.map((item) => (
|
||||
<div key={item.title} className="rounded-3xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex items-start gap-3">
|
||||
<div className="grid h-10 w-10 shrink-0 place-items-center rounded-2xl bg-white/[0.04] text-cyan-200"><item.icon className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<span className="font-black text-white">{item.title}</span>
|
||||
<Badge tone={item.tone}>{item.tone === 'green' ? '已约束' : item.tone === 'amber' ? '回旧后台' : 'V2 规划'}</Badge>
|
||||
</div>
|
||||
<p className="mt-2 text-sm font-semibold leading-6 text-slate-500">{item.desc}</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring mt-6 inline-flex items-center gap-2 rounded-2xl border border-cyan-300/25 bg-cyan-400/10 px-4 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/15">
|
||||
<ExternalLink className="h-4 w-4" /> 打开旧后台设置写操作
|
||||
</a>
|
||||
</Panel>
|
||||
|
||||
<Panel className="overflow-hidden p-0">
|
||||
<div className="flex flex-wrap items-center justify-between gap-4 border-b border-white/10 p-6">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">可安全展示的设置</h3>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">只列出非敏感键；敏感键仅统计状态不显示值。</p>
|
||||
</div>
|
||||
<Badge tone="slate">{String(visibleSettings.length)} 项</Badge>
|
||||
</div>
|
||||
<div className="divide-y divide-white/10">
|
||||
{visibleSettings.map((setting) => (
|
||||
<div key={setting.key} className="grid gap-3 p-5 md:grid-cols-[220px_1fr_140px] md:items-center">
|
||||
<div className="font-mono text-xs font-black text-cyan-200">{setting.key}</div>
|
||||
<div className="break-words text-sm font-semibold text-slate-200">{displaySettingValue(setting.key, setting.value, setting.value_set)}</div>
|
||||
<div className="text-xs font-bold text-slate-500 md:text-right">{formatDate(setting.updated_at)}</div>
|
||||
</div>
|
||||
))}
|
||||
{visibleSettings.length === 0 ? (
|
||||
<div className="p-8 text-sm font-semibold text-slate-500">暂无可安全展示的设置项，或当前环境未写入 settings 表。</div>
|
||||
) : null}
|
||||
</div>
|
||||
</Panel>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function StatusLine({ label, value, tone }: { label: string; value: string; tone: StatusTone }): JSX.Element {
|
||||
return (
|
||||
<div className="flex items-center justify-between gap-4 rounded-2xl border border-white/10 bg-slate-950/40 px-4 py-3">
|
||||
<span className="text-sm font-bold text-slate-500">{label}</span>
|
||||
<Badge tone={tone} dot>{value}</Badge>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
import { ArrowUpRight } from 'lucide-react'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
|
||||
interface StatCardProps {
|
||||
title: string
|
||||
value: string
|
||||
sub: string
|
||||
accent: string
|
||||
}
|
||||
|
||||
export function StatCard({ title, value, sub, accent }: StatCardProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-5">
|
||||
<div className="text-xs font-bold text-slate-400">{title}</div>
|
||||
<div className="mt-3 flex items-end justify-between">
|
||||
<div className="text-4xl font-black tracking-[-0.07em] text-slate-50">{value}</div>
|
||||
<ArrowUpRight className={cn('h-5 w-5', accent)} />
|
||||
</div>
|
||||
<div className={cn('mt-3 text-xs font-bold', accent)}>{sub}</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface TaskCenterProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
function percent(done: number, total: number): number {
|
||||
if (total <= 0) return 0
|
||||
return Math.max(0, Math.min(100, Math.round((done / total) * 100)))
|
||||
}
|
||||
|
||||
export function TaskCenter({ servers, total, mode }: TaskCenterProps): JSX.Element {
|
||||
const effectiveTotal = Math.max(total, servers.length)
|
||||
const ttlFixed = servers.filter((server) => server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s').length
|
||||
const sslReady = servers.filter((server) => server.ssl === 'enabled' || server.ssl === 'internal').length
|
||||
const online = servers.filter((server) => server.online !== false).length
|
||||
const tasks = [
|
||||
{ name: 'BT TTL 自动巡检', progress: percent(ttlFixed, servers.length), done: String(ttlFixed) + ' / ' + String(servers.length), color: 'bg-emerald-400' },
|
||||
{ name: 'SSL 批量扫描', progress: percent(sslReady, servers.length), done: String(sslReady) + ' / ' + String(servers.length), color: 'bg-amber-400' },
|
||||
{ name: 'Agent 心跳同步', progress: percent(online, effectiveTotal), done: String(online) + ' / ' + String(effectiveTotal), color: 'bg-cyan-400' },
|
||||
]
|
||||
|
||||
return (
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<h2 className="text-xl font-black tracking-tight text-white">任务中心</h2>
|
||||
<span className="text-xs font-black text-slate-500">{mode === 'live' ? 'LIVE' : 'DEMO'}</span>
|
||||
</div>
|
||||
<div className="mt-6 space-y-5">
|
||||
{tasks.map((task) => (
|
||||
<div key={task.name}>
|
||||
<div className="mb-2 flex items-center justify-between text-sm">
|
||||
<span className="font-bold text-slate-200">{task.name}</span>
|
||||
<span className="font-bold text-slate-500">{task.done}</span>
|
||||
</div>
|
||||
<div className="h-2.5 overflow-hidden rounded-full bg-slate-800/80">
|
||||
<div className={task.color + ' h-full rounded-full'} style={{ width: String(task.progress) + '%' }} />
|
||||
</div>
|
||||
<div className="mt-1 text-xs font-black text-slate-500">{task.progress}%</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,312 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { Activity, AlertTriangle, CheckCircle2, Clock3, ExternalLink, Filter, Gauge, PlayCircle, RotateCw, Search, Server, ShieldCheck, TimerReset, Wrench } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface TaskCenterPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type TaskStatus = 'running' | 'completed' | 'attention' | 'queued'
|
||||
type TaskFilter = 'all' | TaskStatus
|
||||
|
||||
interface TaskItem {
|
||||
id: string
|
||||
name: string
|
||||
desc: string
|
||||
type: string
|
||||
status: TaskStatus
|
||||
progress: number
|
||||
affected: number
|
||||
total: number
|
||||
updatedAt: string
|
||||
icon: LucideIcon
|
||||
tone: string
|
||||
bar: string
|
||||
}
|
||||
|
||||
const filters: Array<{ label: string; value: TaskFilter }> = [
|
||||
{ label: '全部任务', value: 'all' },
|
||||
{ label: '运行中', value: 'running' },
|
||||
{ label: '已完成', value: 'completed' },
|
||||
{ label: '需要关注', value: 'attention' },
|
||||
{ label: '排队中', value: 'queued' },
|
||||
]
|
||||
|
||||
function percent(done: number, total: number): number {
|
||||
if (total <= 0) return 0
|
||||
return Math.max(0, Math.min(100, Math.round((done / total) * 100)))
|
||||
}
|
||||
|
||||
function isTtlProtected(server: ServerAsset): boolean {
|
||||
return Boolean(server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s')
|
||||
}
|
||||
|
||||
function statusLabel(status: TaskStatus): string {
|
||||
if (status === 'running') return '运行中'
|
||||
if (status === 'completed') return '已完成'
|
||||
if (status === 'attention') return '需要关注'
|
||||
return '排队中'
|
||||
}
|
||||
|
||||
function statusTone(status: TaskStatus): 'green' | 'amber' | 'red' | 'blue' {
|
||||
if (status === 'completed') return 'green'
|
||||
if (status === 'attention') return 'red'
|
||||
if (status === 'running') return 'blue'
|
||||
return 'amber'
|
||||
}
|
||||
|
||||
function buildTasks(servers: ServerAsset[], total: number): TaskItem[] {
|
||||
const effectiveTotal = Math.max(total, servers.length)
|
||||
const configuredBt = servers.filter((server) => server.btConfigured).length
|
||||
const ttlProtected = servers.filter(isTtlProtected).length
|
||||
const needsTtlFix = servers.filter((server) => server.btConfigured && !isTtlProtected(server)).length
|
||||
const sslReady = servers.filter((server) => server.ssl === 'enabled' || server.ssl === 'internal').length
|
||||
const sslOff = servers.filter((server) => server.ssl === 'disabled').length
|
||||
const online = servers.filter((server) => server.online !== false).length
|
||||
const risks = servers.filter((server) => server.risk === 'warning' || server.risk === 'critical').length
|
||||
const now = new Intl.DateTimeFormat('zh-CN', { hour: '2-digit', minute: '2-digit' }).format(new Date())
|
||||
|
||||
return [
|
||||
{
|
||||
id: 'bt-ttl-sweep',
|
||||
name: 'BT TTL 自动巡检',
|
||||
desc: '持续检查宝塔 task.py hardcoded_3600，登录前仍由后端兜底检测/修复。',
|
||||
type: '宝塔稳定性',
|
||||
status: needsTtlFix > 0 ? 'attention' : 'completed',
|
||||
progress: percent(ttlProtected, Math.max(servers.length, 1)),
|
||||
affected: ttlProtected,
|
||||
total: servers.length,
|
||||
updatedAt: now,
|
||||
icon: TimerReset,
|
||||
tone: needsTtlFix > 0 ? 'text-amber-300' : 'text-emerald-300',
|
||||
bar: needsTtlFix > 0 ? 'bg-amber-400' : 'bg-emerald-400',
|
||||
},
|
||||
{
|
||||
id: 'bt-login-guard',
|
||||
name: '宝塔一键登录兜底队列',
|
||||
desc: '新增宝塔或未复查宝塔，在一键登录前先触发 TTL 兜底，不在前端生成 tmp_login token。',
|
||||
type: '登录安全',
|
||||
status: configuredBt > ttlProtected ? 'running' : 'completed',
|
||||
progress: percent(ttlProtected, Math.max(configuredBt, 1)),
|
||||
affected: configuredBt,
|
||||
total: configuredBt,
|
||||
updatedAt: now,
|
||||
icon: ShieldCheck,
|
||||
tone: 'text-cyan-300',
|
||||
bar: 'bg-cyan-400',
|
||||
},
|
||||
{
|
||||
id: 'ssl-advice',
|
||||
name: '面板 SSL 建议扫描',
|
||||
desc: '识别公网宝塔 verify_ssl 未开启的服务器，先展示建议，高风险改动回旧后台确认。',
|
||||
type: '安全建议',
|
||||
status: sslOff > 0 ? 'attention' : 'completed',
|
||||
progress: percent(sslReady, Math.max(servers.length, 1)),
|
||||
affected: sslOff,
|
||||
total: servers.length,
|
||||
updatedAt: now,
|
||||
icon: Wrench,
|
||||
tone: sslOff > 0 ? 'text-amber-300' : 'text-emerald-300',
|
||||
bar: sslOff > 0 ? 'bg-amber-400' : 'bg-emerald-400',
|
||||
},
|
||||
{
|
||||
id: 'agent-heartbeat',
|
||||
name: 'Agent 心跳同步',
|
||||
desc: '同步服务器在线状态、CPU、内存、磁盘和最近心跳，用于资产中心快速响应。',
|
||||
type: '资产同步',
|
||||
status: online < effectiveTotal ? 'running' : 'completed',
|
||||
progress: percent(online, effectiveTotal),
|
||||
affected: online,
|
||||
total: effectiveTotal,
|
||||
updatedAt: now,
|
||||
icon: Activity,
|
||||
tone: 'text-blue-300',
|
||||
bar: 'bg-blue-400',
|
||||
},
|
||||
{
|
||||
id: 'asset-risk-sync',
|
||||
name: '服务器资产风险同步',
|
||||
desc: '汇总离线、TTL、SSL、宝塔配置状态；写操作和批量修复仍回旧后台执行。',
|
||||
type: '风险汇总',
|
||||
status: risks > 0 ? 'attention' : 'completed',
|
||||
progress: percent(Math.max(servers.length - risks, 0), Math.max(servers.length, 1)),
|
||||
affected: risks,
|
||||
total: servers.length,
|
||||
updatedAt: now,
|
||||
icon: Server,
|
||||
tone: risks > 0 ? 'text-red-300' : 'text-emerald-300',
|
||||
bar: risks > 0 ? 'bg-red-400' : 'bg-emerald-400',
|
||||
},
|
||||
{
|
||||
id: 'script-audit',
|
||||
name: '脚本执行审计同步',
|
||||
desc: '管理员远程执行命令属于预期能力；V2 第一版只展示入口，执行/停止/重试先回旧后台。',
|
||||
type: '管理员脚本',
|
||||
status: 'queued',
|
||||
progress: 30,
|
||||
affected: 0,
|
||||
total: effectiveTotal,
|
||||
updatedAt: now,
|
||||
icon: PlayCircle,
|
||||
tone: 'text-violet-300',
|
||||
bar: 'bg-violet-400',
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
export function TaskCenterPage({ servers, total, mode }: TaskCenterPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const [filter, setFilter] = useState<TaskFilter>('all')
|
||||
|
||||
const tasks = useMemo(() => buildTasks(servers, total), [servers, total])
|
||||
const keyword = query.trim().toLowerCase()
|
||||
const filteredTasks = useMemo(() => tasks.filter((task) => {
|
||||
const matchesKeyword = !keyword || [task.name, task.desc, task.type, statusLabel(task.status)]
|
||||
.some((value) => value.toLowerCase().includes(keyword))
|
||||
const matchesStatus = filter === 'all' || task.status === filter
|
||||
return matchesKeyword && matchesStatus
|
||||
}), [filter, keyword, tasks])
|
||||
|
||||
const runningCount = tasks.filter((task) => task.status === 'running').length
|
||||
const completedCount = tasks.filter((task) => task.status === 'completed').length
|
||||
const attentionCount = tasks.filter((task) => task.status === 'attention').length
|
||||
const queuedCount = tasks.filter((task) => task.status === 'queued').length
|
||||
|
||||
return (
|
||||
<div id="tasks" className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-20 h-56 w-56 rounded-full bg-violet-400/10 blur-3xl" />
|
||||
<div className="flex flex-wrap items-start justify-between gap-5">
|
||||
<div className="max-w-3xl">
|
||||
<Badge tone="blue" dot className="px-4 py-2">V2 任务中心</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">任务中心 / 自动化运行态</h2>
|
||||
<p className="mt-3 text-sm font-semibold leading-7 text-slate-400">
|
||||
这一版先迁移只读运行态和任务入口：集中展示宝塔 TTL 兜底、SSL 建议、Agent 同步、资产风险汇总。脚本执行、停止、重试等高风险写操作暂时回旧后台，避免绕过既有权限和审计链路。
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<a href="/app/" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
<ExternalLink className="h-4 w-4" /> 旧后台执行/重试
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
|
||||
<TaskMetric icon={Gauge} label="运行中" value={String(runningCount)} sub="同步 / 兜底队列" tone="text-blue-300" />
|
||||
<TaskMetric icon={CheckCircle2} label="已完成" value={String(completedCount)} sub="当前检查通过" tone="text-emerald-300" />
|
||||
<TaskMetric icon={AlertTriangle} label="需要关注" value={String(attentionCount)} sub="TTL / SSL / 离线风险" tone={attentionCount ? 'text-amber-300' : 'text-emerald-300'} />
|
||||
<TaskMetric icon={Clock3} label="排队中" value={String(queuedCount)} sub="深度功能回旧后台" tone="text-violet-300" />
|
||||
</section>
|
||||
|
||||
<Panel className="p-5">
|
||||
<div className="flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-violet-400/10 text-violet-200"><Filter className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<div className="text-lg font-black text-white">任务过滤器</div>
|
||||
<div className="text-sm font-semibold text-slate-500">当前数据源：{mode === 'live' ? '实时 API' : '演示 fallback'}</div>
|
||||
</div>
|
||||
</div>
|
||||
<label className="flex min-w-0 flex-1 items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-3 xl:max-w-md">
|
||||
<Search className="h-4 w-4 text-slate-500" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索任务、类型、状态" className="min-w-0 flex-1 bg-transparent text-sm font-semibold text-white outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
<div className="mt-5 flex flex-wrap gap-2">
|
||||
{filters.map((item) => (
|
||||
<button key={item.value} type="button" onClick={() => setFilter(item.value)} className={cn('focus-ring rounded-2xl px-4 py-2 text-sm font-black transition', filter === item.value ? 'bg-cyan-400 text-slate-950' : 'border border-white/10 bg-white/[0.03] text-slate-400 hover:text-white')}>
|
||||
{item.label}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 xl:grid-cols-2">
|
||||
{filteredTasks.map((task) => (
|
||||
<TaskCard key={task.id} task={task} />
|
||||
))}
|
||||
</section>
|
||||
|
||||
<Panel className="grid gap-4 p-6 lg:grid-cols-[1fr_auto] lg:items-center">
|
||||
<div>
|
||||
<div className="text-xl font-black text-white">安全边界</div>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-500">
|
||||
V2 任务中心当前不直接调用脚本执行 API，不展示凭据、不展示 Cookie/Token/密钥类字段。宝塔一键登录仍在宝塔页面和资产页面走后端接口，后端继续负责 TTL 兜底修复和审计。
|
||||
</p>
|
||||
</div>
|
||||
<a href="/app/" className="focus-ring inline-flex items-center justify-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-5 py-3 text-sm font-black text-slate-200 hover:bg-white/[0.08]">
|
||||
<ExternalLink className="h-4 w-4" /> 打开旧后台完整任务
|
||||
</a>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface TaskMetricProps {
|
||||
icon: LucideIcon
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function TaskMetric({ icon: Icon, label, value, sub, tone }: TaskMetricProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="group overflow-hidden p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<Icon className={'h-5 w-5 ' + tone} />
|
||||
</div>
|
||||
<RotateCw className="h-4 w-4 text-slate-600 transition group-hover:text-cyan-300" />
|
||||
</div>
|
||||
<div className="mt-5 text-xs font-black uppercase tracking-[0.14em] text-slate-500">{label}</div>
|
||||
<div className="mt-2 text-3xl font-black text-white">{value}</div>
|
||||
<p className="mt-2 text-sm font-medium leading-6 text-slate-500">{sub}</p>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
function TaskCard({ task }: { task: TaskItem }): JSX.Element {
|
||||
return (
|
||||
<Panel className="relative overflow-hidden p-5">
|
||||
<div className="absolute -right-12 -top-12 h-32 w-32 rounded-full bg-cyan-400/5 blur-3xl" />
|
||||
<div className="relative flex items-start justify-between gap-4">
|
||||
<div className="flex min-w-0 gap-4">
|
||||
<div className="grid h-12 w-12 shrink-0 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]">
|
||||
<task.icon className={'h-5 w-5 ' + task.tone} />
|
||||
</div>
|
||||
<div className="min-w-0">
|
||||
<div className="flex flex-wrap items-center gap-2">
|
||||
<h3 className="text-lg font-black text-white">{task.name}</h3>
|
||||
<Badge tone={statusTone(task.status)} dot>{statusLabel(task.status)}</Badge>
|
||||
</div>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-500">{task.desc}</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="hidden text-right lg:block">
|
||||
<div className="text-xs font-black uppercase tracking-[0.16em] text-slate-600">{task.type}</div>
|
||||
<div className="mt-2 text-sm font-black text-slate-400">{task.updatedAt}</div>
|
||||
</div>
|
||||
</div>
|
||||
<div className="relative mt-5 grid gap-4 md:grid-cols-[1fr_auto] md:items-end">
|
||||
<div>
|
||||
<div className="mb-2 flex items-center justify-between text-sm">
|
||||
<span className="font-black text-slate-300">进度</span>
|
||||
<span className="font-black text-slate-500">{task.affected} / {task.total}</span>
|
||||
</div>
|
||||
<div className="h-2.5 overflow-hidden rounded-full bg-slate-800/90">
|
||||
<div className={task.bar + ' h-full rounded-full'} style={{ width: String(task.progress) + '%' }} />
|
||||
</div>
|
||||
</div>
|
||||
<div className="text-2xl font-black text-white">{task.progress}%</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,303 @@
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { Activity, AlertTriangle, Archive, Code2, ExternalLink, FileClock, FileSearch, FolderOpen, LockKeyhole, Search, Server, ShieldCheck, TerminalSquare, UploadCloud } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { ReadOnlyFileBrowser } from './ReadOnlyFileBrowser'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { redactSensitiveText } from '@/lib/redaction'
|
||||
import { fetchAuditLogData } from '../api/dashboardApi'
|
||||
import type { AuditLogEntry } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface TerminalFilesPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
type CapabilityTone = 'green' | 'blue' | 'amber' | 'red' | 'slate' | 'purple'
|
||||
type CapabilityStatus = 'v2-readonly' | 'legacy-action' | 'guarded'
|
||||
|
||||
interface CapabilityCard {
|
||||
title: string
|
||||
desc: string
|
||||
status: CapabilityStatus
|
||||
tone: CapabilityTone
|
||||
icon: LucideIcon
|
||||
legacyPath: string
|
||||
metrics: string
|
||||
}
|
||||
|
||||
interface SafeActivity {
|
||||
id: string
|
||||
title: string
|
||||
detail: string
|
||||
actor: string
|
||||
time: string
|
||||
tone: CapabilityTone
|
||||
}
|
||||
|
||||
function maskSensitive(value: string | null | undefined): string {
|
||||
return redactSensitiveText(value, '已隐藏', 180)
|
||||
}
|
||||
|
||||
|
||||
function includesAny(value: string, words: string[]): boolean {
|
||||
const lower = value.toLowerCase()
|
||||
return words.some((word) => lower.includes(word))
|
||||
}
|
||||
|
||||
function formatDate(value: string | null | undefined): string {
|
||||
if (!value) return '未知时间'
|
||||
const timestamp = Date.parse(value)
|
||||
if (!Number.isFinite(timestamp)) return value
|
||||
return new Intl.DateTimeFormat('zh-CN', { month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit' }).format(new Date(timestamp))
|
||||
}
|
||||
|
||||
function statusLabel(status: CapabilityStatus): string {
|
||||
if (status === 'v2-readonly') return 'V2 只读'
|
||||
if (status === 'guarded') return '后端兜底'
|
||||
return '旧后台执行'
|
||||
}
|
||||
|
||||
function buildCapabilities(servers: ServerAsset[], total: number): CapabilityCard[] {
|
||||
const online = servers.filter((server) => server.online).length
|
||||
const btConfigured = servers.filter((server) => server.btConfigured).length
|
||||
const risky = servers.filter((server) => server.risk === 'critical' || server.risk === 'warning').length
|
||||
return [
|
||||
{
|
||||
title: 'WebSSH 终端',
|
||||
desc: 'V2 先展示入口和安全边界；真实交互终端继续回旧后台，避免在迁移阶段重写 WebSocket 输入输出链路。',
|
||||
status: 'legacy-action',
|
||||
tone: 'amber',
|
||||
icon: TerminalSquare,
|
||||
legacyPath: '/app/terminal',
|
||||
metrics: String(online) + ' / ' + String(total) + ' 台在线',
|
||||
},
|
||||
{
|
||||
title: '远程文件浏览',
|
||||
desc: '后端已有 /api/files/browse + ETag 只读浏览能力；V2 本页先做入口，文件写入/删除/上传仍留在旧后台。',
|
||||
status: 'v2-readonly',
|
||||
tone: 'blue',
|
||||
icon: FolderOpen,
|
||||
legacyPath: '/app/files',
|
||||
metrics: 'GET browse 可接入',
|
||||
},
|
||||
{
|
||||
title: '文件推送 / 上传',
|
||||
desc: '上传、解压、权限修改、跨服务器传输属于会改变远端状态的操作，当前继续由旧后台完整处理。',
|
||||
status: 'legacy-action',
|
||||
tone: 'amber',
|
||||
icon: UploadCloud,
|
||||
legacyPath: '/app/push',
|
||||
metrics: '写操作回旧后台',
|
||||
},
|
||||
{
|
||||
title: '脚本库 / 命令执行',
|
||||
desc: 'script_service 是管理员远程执行 shell 的预期能力；V2 不绕过后端、不直接执行、不展示脚本内容中的敏感片段。',
|
||||
status: 'guarded',
|
||||
tone: 'purple',
|
||||
icon: Code2,
|
||||
legacyPath: '/app/scripts',
|
||||
metrics: String(risky) + ' 台风险资产',
|
||||
},
|
||||
{
|
||||
title: '命令日志 / 执行记录',
|
||||
desc: 'V2 只显示审计摘要，并二次脱敏 detail；执行详情、停止、重试、日志拉取仍回旧后台。',
|
||||
status: 'v2-readonly',
|
||||
tone: 'green',
|
||||
icon: FileClock,
|
||||
legacyPath: '/app/commands',
|
||||
metrics: '审计摘要已接入',
|
||||
},
|
||||
{
|
||||
title: '宝塔联动保护',
|
||||
desc: '宝塔一键登录仍在资产/宝塔页调用后端 login-url；登录前 TTL hardcoded_3600 兜底修复不受本页影响。',
|
||||
status: 'guarded',
|
||||
tone: 'green',
|
||||
icon: ShieldCheck,
|
||||
legacyPath: '/app/',
|
||||
metrics: String(btConfigured) + ' 台宝塔配置',
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
function normalizeActivities(items: AuditLogEntry[]): SafeActivity[] {
|
||||
const keywords = ['terminal', 'webssh', 'ssh', 'command', 'script', 'sync', 'file', 'browse', 'upload', 'download', 'chmod', 'compress', 'decompress']
|
||||
return items
|
||||
.filter((item) => includesAny([item.action, item.target_type, item.target_name, item.detail].filter(Boolean).join(' '), keywords))
|
||||
.slice(0, 8)
|
||||
.map((item) => {
|
||||
const rawTitle = item.action || item.target_type || 'operation'
|
||||
const danger = includesAny(rawTitle + ' ' + (item.detail || ''), ['delete', 'chmod', 'write', 'upload', 'exec', 'script'])
|
||||
return {
|
||||
id: String(item.id),
|
||||
title: rawTitle.replaceAll('_', ' '),
|
||||
detail: maskSensitive(item.detail || item.target_name || item.target_type),
|
||||
actor: item.admin_username || 'system',
|
||||
time: formatDate(item.created_at),
|
||||
tone: danger ? 'amber' : 'blue',
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export function TerminalFilesPage({ servers, total, mode }: TerminalFilesPageProps): JSX.Element {
|
||||
const [query, setQuery] = useState('')
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['terminal-files-audit-v2'],
|
||||
queryFn: fetchAuditLogData,
|
||||
staleTime: 45_000,
|
||||
})
|
||||
|
||||
const capabilities = useMemo(() => buildCapabilities(servers, total), [servers, total])
|
||||
const filteredCapabilities = useMemo(() => {
|
||||
const normalized = query.trim().toLowerCase()
|
||||
if (!normalized) return capabilities
|
||||
return capabilities.filter((item) => [item.title, item.desc, item.metrics].join(' ').toLowerCase().includes(normalized))
|
||||
}, [capabilities, query])
|
||||
const activities = useMemo(() => normalizeActivities(data.auditItems), [data.auditItems])
|
||||
const online = useMemo(() => servers.filter((server) => server.online).length, [servers])
|
||||
const writableActions = useMemo(() => capabilities.filter((item) => item.status === 'legacy-action').length, [capabilities])
|
||||
|
||||
return (
|
||||
<div className="space-y-6 p-5 lg:p-10">
|
||||
<Panel className="relative overflow-hidden p-7">
|
||||
<div className="absolute -right-20 -top-20 h-64 w-64 rounded-full bg-violet-400/10 blur-3xl" />
|
||||
<div className="relative grid gap-6 xl:grid-cols-[1fr_360px] xl:items-end">
|
||||
<div>
|
||||
<Badge tone="purple" dot className="px-4 py-2">终端 / 文件 V2 · 安全入口</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white lg:text-5xl">高风险操作先分层迁移</h2>
|
||||
<p className="mt-4 max-w-4xl text-sm font-semibold leading-7 text-slate-400">
|
||||
终端、文件写入、脚本执行都可能直接改变服务器状态。V2 当前先迁移导航、只读摘要、审计脱敏和安全边界；真正执行、上传、删除、停止、重试仍回旧后台，保证功能不减少且不绕过后端审计。
|
||||
</p>
|
||||
</div>
|
||||
<div className="grid gap-3 rounded-3xl border border-white/10 bg-slate-950/50 p-5">
|
||||
<MetricRow label="在线资产" value={String(online) + ' / ' + String(total)} tone="green" />
|
||||
<MetricRow label="V2 数据源" value={mode === 'live' ? '实时 API' : '演示数据'} tone={mode === 'live' ? 'green' : 'slate'} />
|
||||
<MetricRow label="写操作策略" value={String(writableActions) + ' 类回旧后台'} tone="amber" />
|
||||
<MetricRow label="审计来源" value={data.mode === 'live' ? '真实审计' : '降级审计'} tone={data.mode === 'live' ? 'blue' : 'amber'} />
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<ReadOnlyFileBrowser servers={servers} mode={mode} />
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[1fr_360px]">
|
||||
<div className="space-y-5">
|
||||
<div className="flex flex-wrap items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">能力分层</h3>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">先把可安全看的放到 V2，会改变服务器的动作继续跳旧后台。</p>
|
||||
</div>
|
||||
<label className="focus-within:ring-2 focus-within:ring-cyan-300/40 flex w-full max-w-md items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/60 px-4 py-3 text-sm font-semibold text-slate-400">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索终端、文件、脚本、审计" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
<div className="grid gap-4 md:grid-cols-2">
|
||||
{filteredCapabilities.map((item) => (
|
||||
<Panel key={item.title} className="group p-5">
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div className={cn('grid h-12 w-12 place-items-center rounded-2xl border border-white/10 bg-white/[0.04]', item.tone === 'green' ? 'text-emerald-200' : item.tone === 'amber' ? 'text-amber-200' : item.tone === 'purple' ? 'text-violet-200' : 'text-cyan-200')}>
|
||||
<item.icon className="h-5 w-5" />
|
||||
</div>
|
||||
<Badge tone={item.tone} dot>{statusLabel(item.status)}</Badge>
|
||||
</div>
|
||||
<div className="mt-5 text-xl font-black text-white">{item.title}</div>
|
||||
<p className="mt-3 text-sm font-semibold leading-6 text-slate-500">{item.desc}</p>
|
||||
<div className="mt-5 flex flex-wrap items-center justify-between gap-3">
|
||||
<span className="rounded-full bg-slate-900 px-3 py-1 text-xs font-black text-slate-300">{item.metrics}</span>
|
||||
<a href={item.legacyPath} className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-2 text-xs font-black text-cyan-200 hover:bg-cyan-400/10">
|
||||
旧后台打开 <ExternalLink className="h-3.5 w-3.5" />
|
||||
</a>
|
||||
</div>
|
||||
</Panel>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="space-y-5">
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">安全边界</h3>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">本页不会直接执行 shell。</p>
|
||||
</div>
|
||||
<LockKeyhole className="h-5 w-5 text-emerald-300" />
|
||||
</div>
|
||||
<div className="mt-5 space-y-3 text-sm font-semibold leading-6 text-slate-400">
|
||||
<BoundaryLine icon={TerminalSquare} text="不创建 WebSSH 会话，不发送键盘输入。" />
|
||||
<BoundaryLine icon={FolderOpen} text="不上传、不删除、不写文件、不 chmod。" />
|
||||
<BoundaryLine icon={Code2} text="不调用 /api/scripts/exec，不绕过危险命令检查。" />
|
||||
<BoundaryLine icon={FileSearch} text="审计 detail 在前端二次脱敏后展示。" />
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-xl font-black text-white">最近相关审计</h3>
|
||||
<p className="mt-2 text-sm font-semibold text-slate-500">终端 / 文件 / 脚本相关摘要。</p>
|
||||
</div>
|
||||
<Activity className="h-5 w-5 text-cyan-300" />
|
||||
</div>
|
||||
{data.warning ? <div className="mt-4 rounded-2xl border border-amber-400/20 bg-amber-400/10 p-3 text-xs font-bold leading-5 text-amber-100">{data.warning}</div> : null}
|
||||
<div className="mt-5 space-y-3">
|
||||
{activities.map((item) => (
|
||||
<div key={item.id} className="rounded-2xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div className="min-w-0">
|
||||
<div className="truncate text-sm font-black text-white">{item.title}</div>
|
||||
<p className="mt-1 line-clamp-2 text-xs font-semibold leading-5 text-slate-500">{item.detail}</p>
|
||||
</div>
|
||||
<Badge tone={item.tone}>{item.time}</Badge>
|
||||
</div>
|
||||
<div className="mt-2 text-xs font-bold text-slate-600">operator: {item.actor}</div>
|
||||
</div>
|
||||
))}
|
||||
{activities.length === 0 ? (
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-5 text-sm font-semibold text-slate-500">暂无终端 / 文件 / 脚本相关审计摘要。</div>
|
||||
) : null}
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<Panel className="p-6">
|
||||
<div className="flex flex-wrap items-center justify-between gap-4">
|
||||
<div className="flex items-start gap-3">
|
||||
<div className="grid h-11 w-11 place-items-center rounded-2xl bg-amber-400/15 text-amber-200"><AlertTriangle className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h3 className="text-lg font-black text-white">迁移提醒</h3>
|
||||
<p className="mt-1 text-sm font-semibold leading-6 text-slate-500">后续如果要把真实终端和文件写操作搬到 V2，需要先拆 WebSocket token、路径校验、二次确认、审计日志和权限提示，不能只重做界面。</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<a href="/app/terminal" className="focus-ring inline-flex items-center gap-2 rounded-2xl bg-cyan-400 px-4 py-3 text-sm font-black text-slate-950"><TerminalSquare className="h-4 w-4" /> 旧终端</a>
|
||||
<a href="/app/files" className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-200"><Archive className="h-4 w-4" /> 旧文件管理</a>
|
||||
</div>
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function MetricRow({ label, value, tone }: { label: string; value: string; tone: CapabilityTone }): JSX.Element {
|
||||
return (
|
||||
<div className="flex items-center justify-between gap-4 rounded-2xl border border-white/10 bg-slate-950/40 px-4 py-3">
|
||||
<span className="text-sm font-bold text-slate-500">{label}</span>
|
||||
<Badge tone={tone} dot>{value}</Badge>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function BoundaryLine({ icon: Icon, text }: { icon: LucideIcon; text: string }): JSX.Element {
|
||||
return (
|
||||
<div className="flex items-center gap-3 rounded-2xl bg-slate-950/40 px-4 py-3">
|
||||
<Icon className="h-4 w-4 shrink-0 text-cyan-300" />
|
||||
<span>{text}</span>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
|
||||
interface TrendPanelProps {
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
export function TrendPanel({ mode }: TrendPanelProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start justify-between">
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-tight text-white">资产健康趋势</h2>
|
||||
<p className="mt-1 text-sm font-medium text-slate-500">API 响应、在线率、一键登录成功率</p>
|
||||
</div>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'amber'}>{mode === 'live' ? '实时' : '演示'}</Badge>
|
||||
</div>
|
||||
<div className="mt-7 h-40 rounded-3xl border border-white/10 bg-slate-950/35 p-4">
|
||||
<svg viewBox="0 0 580 150" className="h-full w-full overflow-visible">
|
||||
<path d="M8 120 C70 86 108 104 160 58 S262 2 336 48 S450 132 570 34" fill="none" stroke="#38bdf8" strokeWidth="8" strokeLinecap="round" />
|
||||
<path d="M8 134 C96 122 138 90 224 98 S362 102 428 62 S510 32 570 50" fill="none" stroke="#22c55e" strokeWidth="8" strokeLinecap="round" opacity="0.72" />
|
||||
</svg>
|
||||
</div>
|
||||
<div className="mt-4 flex flex-wrap gap-2">
|
||||
<Badge tone="blue" dot>响应 126ms</Badge>
|
||||
<Badge tone="green" dot>成功率 98.7%</Badge>
|
||||
<Badge tone="purple" dot>缓存命中 82%</Badge>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { ttlCells } from '../data/dashboardData'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface TtlMatrixProps {
|
||||
servers: ServerAsset[]
|
||||
}
|
||||
|
||||
function cellClass(server: ServerAsset | undefined, fallback: string): string {
|
||||
if (!server) return fallback
|
||||
if (server.online === false) return 'bg-red-400'
|
||||
if (server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s') return 'bg-emerald-400'
|
||||
if (server.btConfigured) return 'bg-amber-400'
|
||||
return 'bg-slate-600'
|
||||
}
|
||||
|
||||
export function TtlMatrix({ servers }: TtlMatrixProps): JSX.Element {
|
||||
const fixed = servers.filter((server) => server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s').length
|
||||
const needsCheck = servers.filter((server) => server.btConfigured && !(server.btSessionCleanupOk || server.btSessionCleanupPatched || server.ttl === '86400s')).length
|
||||
const offline = servers.filter((server) => server.online === false).length
|
||||
|
||||
return (
|
||||
<Panel className="p-6">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div>
|
||||
<h2 className="text-xl font-black tracking-tight text-white">宝塔 TTL 健康矩阵</h2>
|
||||
<p className="mt-1 text-sm font-medium text-slate-500">一键登录前会自动检测 / 修复 hardcoded_3600。</p>
|
||||
</div>
|
||||
<Badge tone="green" dot>自动兜底</Badge>
|
||||
</div>
|
||||
<div className="mt-6 grid grid-cols-8 gap-2">
|
||||
{ttlCells.map((fallback, index) => {
|
||||
const server = servers[index % Math.max(servers.length, 1)]
|
||||
return <span key={fallback + '-' + String(index)} title={server?.name ?? '演示节点'} className={'h-7 rounded-xl shadow-glow ' + cellClass(server, fallback)} />
|
||||
})}
|
||||
</div>
|
||||
<div className="mt-5 grid grid-cols-3 gap-3 text-center text-xs font-black">
|
||||
<div className="rounded-2xl bg-emerald-400/10 p-3 text-emerald-200">健康 {fixed}</div>
|
||||
<div className="rounded-2xl bg-amber-400/10 p-3 text-amber-200">待查 {needsCheck}</div>
|
||||
<div className="rounded-2xl bg-red-400/10 p-3 text-red-200">离线 {offline}</div>
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,340 @@
|
||||
import { useCallback, useMemo, useState } from 'react'
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { Activity, Clock, Cpu, ExternalLink, HardDrive, MemoryStick, Radio, RefreshCw, Search, Server } from 'lucide-react'
|
||||
import type { LucideIcon } from 'lucide-react'
|
||||
import { Badge } from '~components/ui/Badge'
|
||||
import { Panel } from '~components/ui/Panel'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { fetchWatchMonitoringData } from '../api/dashboardApi'
|
||||
import type { WatchMetricPoint, WatchProbeRecordItem, WatchSessionItem, WatchSlotItem } from '../api/dashboardApi'
|
||||
import type { ServerAsset } from '../data/dashboardData'
|
||||
|
||||
interface WatchMonitoringPageProps {
|
||||
servers: ServerAsset[]
|
||||
total: number
|
||||
mode: 'live' | 'fallback'
|
||||
}
|
||||
|
||||
function toNumber(value: number | null | undefined): number {
|
||||
return typeof value === 'number' && Number.isFinite(value) ? value : 0
|
||||
}
|
||||
|
||||
function formatPercent(value: number | null | undefined): string {
|
||||
return toNumber(value).toFixed(1) + '%'
|
||||
}
|
||||
|
||||
function formatBps(value: number | null | undefined): string {
|
||||
const bps = toNumber(value)
|
||||
if (bps < 1024) return bps.toFixed(0) + ' B/s'
|
||||
if (bps < 1024 * 1024) return (bps / 1024).toFixed(1) + ' KB/s'
|
||||
return (bps / 1024 / 1024).toFixed(1) + ' MB/s'
|
||||
}
|
||||
|
||||
function formatDateTime(value?: string | null): string {
|
||||
if (!value) return '-'
|
||||
const parsed = Date.parse(value)
|
||||
if (!Number.isFinite(parsed)) return value
|
||||
return new Date(parsed).toLocaleString('zh-CN', { hour12: false })
|
||||
}
|
||||
|
||||
function formatRemaining(value?: number | null): string {
|
||||
if (value === null || value === undefined) return '暂停'
|
||||
const seconds = Math.max(0, value)
|
||||
const minutes = Math.floor(seconds / 60)
|
||||
const rest = seconds % 60
|
||||
if (minutes <= 0) return rest + ' 秒'
|
||||
return minutes + ' 分 ' + rest + ' 秒'
|
||||
}
|
||||
|
||||
function probeTone(status?: string | null): 'green' | 'amber' | 'red' | 'slate' {
|
||||
if (!status) return 'slate'
|
||||
const normalized = status.toLowerCase()
|
||||
if (normalized === 'ok' || normalized === 'success') return 'green'
|
||||
if (normalized.includes('timeout') || normalized.includes('warn')) return 'amber'
|
||||
return 'red'
|
||||
}
|
||||
|
||||
function agentTone(action?: string | null): 'green' | 'amber' | 'red' | 'slate' | 'purple' {
|
||||
if (!action || action === 'ok') return 'green'
|
||||
if (action === 'upgrade') return 'amber'
|
||||
if (action === 'install') return 'purple'
|
||||
return 'slate'
|
||||
}
|
||||
|
||||
function averageMetric(slots: WatchSlotItem[], selector: (point: WatchMetricPoint) => number | null | undefined): number {
|
||||
const values = slots
|
||||
.map((slot) => slot.metrics ? selector(slot.metrics) : null)
|
||||
.filter((value): value is number => typeof value === 'number' && Number.isFinite(value))
|
||||
if (values.length === 0) return 0
|
||||
return values.reduce((sum, value) => sum + value, 0) / values.length
|
||||
}
|
||||
|
||||
function latestProbeTime(slots: WatchSlotItem[]): string {
|
||||
const timestamps = slots
|
||||
.map((slot) => slot.metrics?.recorded_at || slot.metrics?.timestamp || null)
|
||||
.filter((value): value is string => Boolean(value))
|
||||
.map((value) => Date.parse(value))
|
||||
.filter((value) => Number.isFinite(value))
|
||||
if (timestamps.length === 0) return '-'
|
||||
return formatDateTime(new Date(Math.max(...timestamps)).toISOString())
|
||||
}
|
||||
|
||||
function sparklineBars(points?: WatchMetricPoint[]): JSX.Element {
|
||||
const safePoints = points && points.length > 0 ? points.slice(-18) : []
|
||||
if (safePoints.length === 0) return <div className="h-10 rounded-2xl bg-slate-900/60" />
|
||||
return (
|
||||
<div className="flex h-10 items-end gap-1 rounded-2xl bg-slate-950/50 p-2">
|
||||
{safePoints.map((point, index) => {
|
||||
const height = Math.max(8, Math.min(100, toNumber(point.cpu_pct || point.mem_pct)))
|
||||
return <span key={String(point.recorded_at || point.timestamp || index)} className="flex-1 rounded-full bg-cyan-300/70" style={{ height: height + '%' }} />
|
||||
})}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function findServer(servers: ServerAsset[], slot: WatchSlotItem): ServerAsset | undefined {
|
||||
if (!slot.server_id) return undefined
|
||||
return servers.find((server) => server.sourceId === slot.server_id || String(server.id) === String(slot.server_id))
|
||||
}
|
||||
|
||||
export function WatchMonitoringPage({ servers, total, mode }: WatchMonitoringPageProps): JSX.Element {
|
||||
const [hours, setHours] = useState(24)
|
||||
const [query, setQuery] = useState('')
|
||||
const { data, refetch } = useSuspenseQuery({
|
||||
queryKey: ['watch-monitoring-v2', hours],
|
||||
queryFn: () => fetchWatchMonitoringData(hours),
|
||||
staleTime: 8_000,
|
||||
})
|
||||
|
||||
const activeSlots = useMemo(() => data.slots.filter((slot) => !slot.empty), [data.slots])
|
||||
const emptySlots = useMemo(() => data.slots.filter((slot) => slot.empty).length, [data.slots])
|
||||
const avgCpu = useMemo(() => averageMetric(activeSlots, (point) => point.cpu_pct), [activeSlots])
|
||||
const avgMem = useMemo(() => averageMetric(activeSlots, (point) => point.mem_pct), [activeSlots])
|
||||
const avgDisk = useMemo(() => averageMetric(activeSlots, (point) => point.disk_pct), [activeSlots])
|
||||
const failedProbeCount = useMemo(() => data.probes.filter((probe) => probe.probe_status && probe.probe_status !== 'ok').length, [data.probes])
|
||||
|
||||
const filteredProbes = useMemo(() => {
|
||||
const text = query.trim().toLowerCase()
|
||||
return data.probes.filter((probe) => !text || [probe.server_name, probe.server_id, probe.session_id, probe.probe_status, probe.error].some((value) => String(value || '').toLowerCase().includes(text)))
|
||||
}, [data.probes, query])
|
||||
|
||||
const recentSessions = useMemo(() => data.sessions.slice(0, 8), [data.sessions])
|
||||
|
||||
const handleRefresh = useCallback((): void => {
|
||||
void refetch()
|
||||
}, [refetch])
|
||||
|
||||
return (
|
||||
<div className="space-y-6 px-5 pb-5 lg:px-10 lg:pb-10">
|
||||
<Panel className="relative overflow-hidden p-6">
|
||||
<div className="absolute -right-16 -top-16 h-56 w-56 rounded-full bg-cyan-400/10 blur-3xl" />
|
||||
<div className="relative flex flex-wrap items-start justify-between gap-5">
|
||||
<div>
|
||||
<Badge tone="blue" dot className="px-4 py-2">Watch Metrics V2</Badge>
|
||||
<h2 className="mt-4 text-3xl font-black tracking-[-0.05em] text-white md:text-4xl">实时监控只读中心</h2>
|
||||
<p className="mt-3 max-w-3xl text-sm font-semibold leading-7 text-slate-400">
|
||||
复用 /api/watch 的 pins、live、sessions、probe-records 只读接口，先把监控态势、Agent 状态、探针历史搬到新后台；新增监控槽、停止监控、安装 psutil 等写操作仍回旧后台。
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
<Badge tone={data.mode === 'live' ? 'green' : 'amber'}>{data.mode === 'live' ? '实时 API' : '演示降级'}</Badge>
|
||||
<Badge tone={mode === 'live' ? 'blue' : 'slate'}>资产 {mode}</Badge>
|
||||
<Badge tone="purple">资产总数 {total}</Badge>
|
||||
</div>
|
||||
</div>
|
||||
{data.warning ? <div className="relative mt-5 rounded-2xl border border-amber-300/20 bg-amber-400/10 px-4 py-3 text-sm font-semibold text-amber-100">{data.warning}</div> : null}
|
||||
</Panel>
|
||||
|
||||
<section className="grid gap-4 md:grid-cols-2 xl:grid-cols-5">
|
||||
<MetricCard icon={Radio} label="监控槽" value={String(activeSlots.length) + ' / 4'} sub={'空槽 ' + emptySlots + ' 个'} tone="text-cyan-300" />
|
||||
<MetricCard icon={Cpu} label="平均 CPU" value={formatPercent(avgCpu)} sub="当前活跃槽均值" tone="text-emerald-300" />
|
||||
<MetricCard icon={MemoryStick} label="平均内存" value={formatPercent(avgMem)} sub="当前活跃槽均值" tone="text-blue-300" />
|
||||
<MetricCard icon={HardDrive} label="平均磁盘" value={formatPercent(avgDisk)} sub="当前活跃槽均值" tone="text-violet-300" />
|
||||
<MetricCard icon={Clock} label="最近探针" value={latestProbeTime(activeSlots)} sub={'异常 ' + failedProbeCount + ' 条'} tone="text-amber-300" />
|
||||
</section>
|
||||
|
||||
<section className="grid gap-6 xl:grid-cols-[1fr_380px]">
|
||||
<div className="space-y-5">
|
||||
<div className="flex flex-wrap items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-xl font-black tracking-[-0.03em] text-white">监控槽实时快照</h3>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">只读展示当前 pinned servers，不在 V2 增删槽位。</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
{[6, 24, 72].map((value) => (
|
||||
<button key={value} type="button" onClick={() => setHours(value)} className={cn('focus-ring rounded-2xl px-4 py-2 text-xs font-black', hours === value ? 'bg-cyan-400 text-slate-950' : 'border border-white/10 bg-white/[0.04] text-slate-300')}>{value}h</button>
|
||||
))}
|
||||
<button type="button" onClick={handleRefresh} className="focus-ring inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-2 text-xs font-black text-cyan-100"><RefreshCw className="h-4 w-4" />刷新</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="grid gap-4 md:grid-cols-2">
|
||||
{data.slots.map((slot) => {
|
||||
const server = findServer(servers, slot)
|
||||
return (
|
||||
<Panel key={slot.slot_index} className="p-5">
|
||||
{slot.empty ? (
|
||||
<div className="flex min-h-56 flex-col items-center justify-center rounded-3xl border border-dashed border-white/10 bg-slate-950/30 text-center">
|
||||
<div className="grid h-12 w-12 place-items-center rounded-2xl bg-slate-800 text-slate-400"><Server className="h-5 w-5" /></div>
|
||||
<div className="mt-4 text-sm font-black text-slate-300">槽位 {slot.slot_index + 1} 空闲</div>
|
||||
<p className="mt-2 max-w-xs text-xs font-semibold leading-6 text-slate-600">V2 暂不创建监控槽，避免误触发后台状态变更。</p>
|
||||
</div>
|
||||
) : (
|
||||
<div>
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div className="min-w-0">
|
||||
<div className="flex items-center gap-2">
|
||||
<Badge tone="blue">槽位 {slot.slot_index + 1}</Badge>
|
||||
<Badge tone={slot.monitoring_enabled === false ? 'slate' : 'green'}>{slot.monitoring_enabled === false ? '暂停' : '监控中'}</Badge>
|
||||
</div>
|
||||
<h4 className="mt-3 truncate text-lg font-black text-white">{slot.server_name || server?.name || 'Server #' + slot.server_id}</h4>
|
||||
<div className="mt-1 text-xs font-semibold text-slate-500">{server?.ip || 'server_id=' + slot.server_id}</div>
|
||||
</div>
|
||||
<Badge tone={agentTone(slot.agent_action)}>{slot.agent_action || 'ok'}</Badge>
|
||||
</div>
|
||||
|
||||
<div className="mt-4 grid grid-cols-3 gap-3">
|
||||
<MiniMetric label="CPU" value={formatPercent(slot.metrics?.cpu_pct)} />
|
||||
<MiniMetric label="内存" value={formatPercent(slot.metrics?.mem_pct)} />
|
||||
<MiniMetric label="磁盘" value={formatPercent(slot.metrics?.disk_pct)} />
|
||||
</div>
|
||||
|
||||
<div className="mt-4">{sparklineBars(slot.sparkline)}</div>
|
||||
|
||||
<div className="mt-4 grid gap-2 text-xs font-semibold text-slate-500">
|
||||
<div className="flex items-center justify-between"><span>剩余时间</span><span className="font-black text-slate-200">{formatRemaining(slot.remaining_sec)}</span></div>
|
||||
<div className="flex items-center justify-between"><span>TTL</span><span className="font-black text-slate-200">{slot.ttl_minutes || '-'} min</span></div>
|
||||
<div className="flex items-center justify-between"><span>上行 / 下行</span><span className="font-black text-slate-200">{formatBps(slot.metrics?.net_up_bps)} / {formatBps(slot.metrics?.net_down_bps)}</span></div>
|
||||
<div className="flex items-center justify-between"><span>Agent</span><span className="font-black text-slate-200">{slot.agent_version || '-'}</span></div>
|
||||
</div>
|
||||
{slot.agent_action_message ? <div className="mt-4 rounded-2xl border border-amber-300/20 bg-amber-400/10 p-3 text-xs font-semibold leading-6 text-amber-100">{slot.agent_action_message}</div> : null}
|
||||
</div>
|
||||
)}
|
||||
</Panel>
|
||||
)
|
||||
})}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<aside className="space-y-5">
|
||||
<Panel className="p-5">
|
||||
<div className="flex items-center gap-3">
|
||||
<div className="grid h-10 w-10 place-items-center rounded-2xl bg-blue-400/15 text-blue-200"><Activity className="h-5 w-5" /></div>
|
||||
<div>
|
||||
<h3 className="font-black text-white">监控会话</h3>
|
||||
<p className="text-xs font-semibold text-slate-500">最近 168 小时</p>
|
||||
</div>
|
||||
</div>
|
||||
<div className="mt-4 space-y-3">
|
||||
{recentSessions.map((session) => <SessionRow key={session.session_id} session={session} />)}
|
||||
{recentSessions.length === 0 ? <div className="rounded-2xl bg-slate-950/40 p-4 text-sm font-semibold text-slate-500">暂无监控会话。</div> : null}
|
||||
</div>
|
||||
</Panel>
|
||||
|
||||
<Panel className="p-5">
|
||||
<h3 className="font-black text-white">写操作仍回旧后台</h3>
|
||||
<p className="mt-2 text-sm font-semibold leading-7 text-slate-500">添加/替换监控槽、启停监控、调整 TTL、安装 psutil 都会改变远程状态，V2 当前只放只读视图。</p>
|
||||
<a href="/app/watch" className="focus-ring mt-4 inline-flex items-center gap-2 rounded-2xl border border-white/10 bg-white/[0.04] px-4 py-3 text-sm font-black text-cyan-100">打开旧监控页 <ExternalLink className="h-4 w-4" /></a>
|
||||
</Panel>
|
||||
</aside>
|
||||
</section>
|
||||
|
||||
<Panel className="overflow-hidden p-6">
|
||||
<div className="flex flex-wrap items-center justify-between gap-3">
|
||||
<div>
|
||||
<h3 className="text-xl font-black tracking-[-0.03em] text-white">探针记录</h3>
|
||||
<p className="mt-1 text-sm font-semibold text-slate-500">读取 /api/watch/probe-records，最多展示最近 40 条。</p>
|
||||
</div>
|
||||
<label className="focus-within:ring-nexus flex min-w-72 items-center gap-3 rounded-2xl border border-white/10 bg-slate-950/50 px-4 py-2 text-sm font-semibold text-slate-500">
|
||||
<Search className="h-4 w-4" />
|
||||
<input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="过滤服务器 / 状态 / 错误" className="w-full bg-transparent text-slate-100 outline-none placeholder:text-slate-600" />
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div className="mt-4 overflow-x-auto rounded-3xl border border-white/10">
|
||||
<table className="min-w-full divide-y divide-white/10">
|
||||
<thead className="bg-white/[0.03]">
|
||||
<tr>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">时间</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">服务器</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">状态</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">CPU / 内存 / 磁盘</th>
|
||||
<th className="px-5 py-4 text-left text-xs font-black uppercase tracking-[0.14em] text-slate-500">耗时</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-white/10 bg-slate-950/20">
|
||||
{filteredProbes.map((probe) => <ProbeRow key={probe.id} probe={probe} />)}
|
||||
</tbody>
|
||||
</table>
|
||||
{filteredProbes.length === 0 ? <div className="px-5 py-12 text-center text-sm font-bold text-slate-500">没有符合条件的探针记录</div> : null}
|
||||
</div>
|
||||
</Panel>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
interface MetricCardProps {
|
||||
icon: LucideIcon
|
||||
label: string
|
||||
value: string
|
||||
sub: string
|
||||
tone: string
|
||||
}
|
||||
|
||||
function MetricCard({ icon: Icon, label, value, sub, tone }: MetricCardProps): JSX.Element {
|
||||
return (
|
||||
<Panel className="p-5">
|
||||
<div className="flex items-start justify-between gap-3">
|
||||
<div>
|
||||
<div className="text-xs font-black uppercase tracking-[0.16em] text-slate-500">{label}</div>
|
||||
<div className="mt-2 text-2xl font-black tracking-[-0.04em] text-white">{value}</div>
|
||||
<div className="mt-1 text-xs font-semibold text-slate-500">{sub}</div>
|
||||
</div>
|
||||
<Icon className={cn('h-5 w-5', tone)} />
|
||||
</div>
|
||||
</Panel>
|
||||
)
|
||||
}
|
||||
|
||||
function MiniMetric({ label, value }: { label: string; value: string }): JSX.Element {
|
||||
return (
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-3">
|
||||
<div className="text-[10px] font-black uppercase tracking-[0.14em] text-slate-600">{label}</div>
|
||||
<div className="mt-1 text-sm font-black text-white">{value}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function SessionRow({ session }: { session: WatchSessionItem }): JSX.Element {
|
||||
const failCount = toNumber(session.probe_fail_count)
|
||||
return (
|
||||
<div className="rounded-2xl border border-white/10 bg-slate-950/40 p-4">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div className="min-w-0">
|
||||
<div className="truncate text-sm font-black text-white">{session.server_name || 'Server #' + session.server_id}</div>
|
||||
<div className="mt-1 text-xs font-semibold text-slate-500">Session #{session.session_id}</div>
|
||||
</div>
|
||||
<Badge tone={failCount > 0 ? 'amber' : 'green'}>{failCount > 0 ? '有异常' : '正常'}</Badge>
|
||||
</div>
|
||||
<div className="mt-3 grid grid-cols-2 gap-2 text-xs font-semibold text-slate-500">
|
||||
<div>OK <span className="font-black text-slate-200">{session.probe_ok_count || 0}</span></div>
|
||||
<div>Fail <span className="font-black text-slate-200">{failCount}</span></div>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function ProbeRow({ probe }: { probe: WatchProbeRecordItem }): JSX.Element {
|
||||
return (
|
||||
<tr className="transition hover:bg-white/[0.03]">
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-500">{formatDateTime(probe.recorded_at || probe.timestamp)}</td>
|
||||
<td className="px-5 py-4">
|
||||
<div className="text-sm font-black text-white">{probe.server_name || 'Server #' + probe.server_id}</div>
|
||||
<div className="mt-1 text-xs font-semibold text-slate-600">Session #{probe.session_id || '-'}</div>
|
||||
</td>
|
||||
<td className="px-5 py-4"><Badge tone={probeTone(probe.probe_status)}>{probe.probe_status || '-'}</Badge></td>
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-400">{formatPercent(probe.cpu_pct)} / {formatPercent(probe.mem_pct)} / {formatPercent(probe.disk_pct)}</td>
|
||||
<td className="px-5 py-4 text-sm font-semibold text-slate-500">{probe.duration_ms ? probe.duration_ms + ' ms' : '-'}</td>
|
||||
</tr>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
export type ServerRisk = 'healthy' | 'warning' | 'critical' | 'patched'
|
||||
|
||||
export interface ServerAsset {
|
||||
id: string
|
||||
sourceId?: number
|
||||
name: string
|
||||
ip: string
|
||||
region: string
|
||||
panelStatus: 'online' | 'offline' | 'patched' | 'test'
|
||||
ttl: string
|
||||
ssl: 'enabled' | 'disabled' | 'internal' | 'unknown'
|
||||
risk: ServerRisk
|
||||
action: string
|
||||
cpu: number
|
||||
memory: number
|
||||
disk: number
|
||||
latency: string
|
||||
btConfigured?: boolean
|
||||
btBaseUrl?: string | null
|
||||
btVerifySsl?: boolean | null
|
||||
btSessionCleanupOk?: boolean
|
||||
btSessionCleanupPatched?: boolean
|
||||
btBootstrapState?: string | null
|
||||
btLastCheckAt?: string | null
|
||||
btLastError?: string | null
|
||||
online?: boolean
|
||||
}
|
||||
|
||||
export interface DashboardStatSeed {
|
||||
title: string
|
||||
value: string
|
||||
sub: string
|
||||
accent: string
|
||||
}
|
||||
|
||||
export interface AuditEvent {
|
||||
time: string
|
||||
title: string
|
||||
color: string
|
||||
}
|
||||
|
||||
export const stats: DashboardStatSeed[] = [
|
||||
{ title: '在线服务器', value: '420', sub: '+18 今日接入', accent: 'text-emerald-300' },
|
||||
{ title: '宝塔已修复', value: '148', sub: 'TTL 86400s', accent: 'text-emerald-300' },
|
||||
{ title: '活跃任务', value: '26', sub: '脚本 / 巡检 / 同步', accent: 'text-cyan-300' },
|
||||
{ title: '风险告警', value: '12', sub: 'SSL / TTL / Agent', accent: 'text-amber-300' },
|
||||
]
|
||||
|
||||
export const servers: ServerAsset[] = [
|
||||
{ id: 'prod-bt-042', name: 'prod-bt-042', ip: '42.193.182.190', region: 'Tencent', panelStatus: 'patched', ttl: '86400s', ssl: 'enabled', risk: 'patched', action: '一键登录', cpu: 18, memory: 42, disk: 61, latency: '42ms', btConfigured: true, btSessionCleanupOk: true, btSessionCleanupPatched: true, online: true },
|
||||
{ id: 'aliyun-web-12', name: 'aliyun-web-12', ip: '120.79.213.154', region: 'Aliyun', panelStatus: 'patched', ttl: '86400s', ssl: 'disabled', risk: 'warning', action: '一键登录', cpu: 24, memory: 48, disk: 66, latency: '58ms', btConfigured: true, btSessionCleanupOk: true, btSessionCleanupPatched: true, online: true },
|
||||
{ id: 'lan-test-node', name: 'lan-test-node', ip: '192.168.124.219', region: 'LAN', panelStatus: 'test', ttl: '86400s', ssl: 'internal', risk: 'healthy', action: '测试部署', cpu: 12, memory: 34, disk: 43, latency: '3ms', btConfigured: true, btSessionCleanupOk: true, online: true },
|
||||
{ id: 'legacy-bt-148', name: 'legacy-bt-148', ip: '159.75.154.203', region: 'Tencent', panelStatus: 'patched', ttl: '86400s', ssl: 'enabled', risk: 'patched', action: '一键登录', cpu: 31, memory: 52, disk: 72, latency: '49ms', btConfigured: true, btSessionCleanupOk: true, btSessionCleanupPatched: true, online: true },
|
||||
{ id: 'edge-hk-018', name: 'edge-hk-018', ip: '8.210.xx.xx', region: 'HK', panelStatus: 'online', ttl: '待复查', ssl: 'enabled', risk: 'warning', action: '检测修复', cpu: 20, memory: 38, disk: 54, latency: '88ms', btConfigured: true, btSessionCleanupOk: false, online: true },
|
||||
{ id: 'cold-backup-03', name: 'cold-backup-03', ip: '172.18.xx.xx', region: 'VPC', panelStatus: 'offline', ttl: '未知', ssl: 'unknown', risk: 'critical', action: '重试', cpu: 0, memory: 0, disk: 81, latency: '-', btConfigured: false, online: false },
|
||||
]
|
||||
|
||||
export const auditEvents: AuditEvent[] = [
|
||||
{ time: '12:05', title: '一键登录 159.75.154.203 成功，登录前 TTL 兜底通过', color: 'bg-emerald-400' },
|
||||
{ time: '12:03', title: '自动修复 hardcoded_3600：37 台宝塔面板完成', color: 'bg-emerald-400' },
|
||||
{ time: '11:58', title: '批量检测宝塔 SSL：112 台未开启，已进入建议队列', color: 'bg-amber-400' },
|
||||
{ time: '11:42', title: '脚本任务 #1024 完成：成功 140 / 148', color: 'bg-cyan-400' },
|
||||
]
|
||||
|
||||
export const ttlCells = Array.from({ length: 32 }, (_, index) => {
|
||||
if ([7, 21].includes(index)) return 'bg-amber-400'
|
||||
if (index === 14) return 'bg-red-400'
|
||||
return 'bg-emerald-400'
|
||||
})
|
||||
@@ -0,0 +1,12 @@
|
||||
import { useSuspenseQuery } from '@tanstack/react-query'
|
||||
import { fetchDashboardData } from '../api/dashboardApi'
|
||||
import type { DashboardData } from '../api/dashboardApi'
|
||||
|
||||
export function useDashboardData(): DashboardData {
|
||||
const { data } = useSuspenseQuery({
|
||||
queryKey: ['dashboard-v2'],
|
||||
queryFn: fetchDashboardData,
|
||||
staleTime: 30_000,
|
||||
})
|
||||
return data
|
||||
}
|
||||
@@ -0,0 +1,104 @@
|
||||
export interface AdminProfile {
|
||||
id: number
|
||||
username: string
|
||||
totp_enabled: boolean
|
||||
created_at: string
|
||||
}
|
||||
|
||||
export class ApiError extends Error {
|
||||
constructor(public readonly status: number, message: string, public readonly detail?: unknown) {
|
||||
super(message)
|
||||
this.name = 'ApiError'
|
||||
}
|
||||
}
|
||||
|
||||
const BASE_URL = import.meta.env.VITE_API_BASE || '/api'
|
||||
let accessToken: string | null = null
|
||||
let refreshInFlight: Promise<boolean> | null = null
|
||||
|
||||
function buildUrl(path: string, params?: Record<string, string | number | boolean | undefined>): string {
|
||||
const url = new URL(`${BASE_URL}${path}`, window.location.origin)
|
||||
if (params) {
|
||||
Object.entries(params).forEach(([key, value]) => {
|
||||
if (value !== undefined) url.searchParams.set(key, String(value))
|
||||
})
|
||||
}
|
||||
return url.pathname + url.search
|
||||
}
|
||||
|
||||
function authHeaders(init?: RequestInit): HeadersInit {
|
||||
const headers = new Headers(init?.headers)
|
||||
if (!(init?.body instanceof FormData) && !headers.has('Content-Type')) {
|
||||
headers.set('Content-Type', 'application/json')
|
||||
}
|
||||
if (accessToken) headers.set('Authorization', `Bearer ${accessToken}`)
|
||||
return headers
|
||||
}
|
||||
|
||||
export function setAccessToken(token: string | null): void {
|
||||
accessToken = token
|
||||
}
|
||||
|
||||
async function parseResponseBody(res: Response): Promise<unknown> {
|
||||
const text = await res.text()
|
||||
if (!text) return undefined
|
||||
try { return JSON.parse(text) } catch { return text }
|
||||
}
|
||||
|
||||
async function refreshSession(): Promise<boolean> {
|
||||
if (refreshInFlight) return refreshInFlight
|
||||
refreshInFlight = (async () => {
|
||||
try {
|
||||
const res = await fetch(buildUrl('/auth/refresh'), {
|
||||
method: 'POST',
|
||||
credentials: 'include',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: '{}',
|
||||
})
|
||||
if (!res.ok) return false
|
||||
const data = await res.json() as { access_token?: string }
|
||||
if (!data.access_token) return false
|
||||
setAccessToken(data.access_token)
|
||||
return true
|
||||
} catch {
|
||||
return false
|
||||
} finally {
|
||||
refreshInFlight = null
|
||||
}
|
||||
})()
|
||||
return refreshInFlight
|
||||
}
|
||||
|
||||
export async function apiFetch<T>(
|
||||
path: string,
|
||||
init: RequestInit & { params?: Record<string, string | number | boolean | undefined>; retry?: boolean } = {},
|
||||
): Promise<T> {
|
||||
const { params, retry, ...requestInit } = init
|
||||
const res = await fetch(buildUrl(path, params), {
|
||||
...requestInit,
|
||||
headers: authHeaders(requestInit),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (res.status === 401 && !retry && !path.startsWith('/auth/')) {
|
||||
const refreshed = await refreshSession()
|
||||
if (refreshed) return apiFetch<T>(path, { ...init, retry: true })
|
||||
}
|
||||
|
||||
const data = await parseResponseBody(res)
|
||||
if (!res.ok) {
|
||||
const detail = typeof data === 'object' && data && 'detail' in data ? (data as { detail?: unknown }).detail : data
|
||||
throw new ApiError(res.status, typeof detail === 'string' ? detail : res.statusText, detail)
|
||||
}
|
||||
return data as T
|
||||
}
|
||||
|
||||
export async function restoreSession(): Promise<AdminProfile | null> {
|
||||
const refreshed = await refreshSession()
|
||||
if (!refreshed) return null
|
||||
try {
|
||||
return await apiFetch<AdminProfile>('/auth/me')
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
const REDACTED = '[REDACTED]'
|
||||
const HIDDEN = '[HIDDEN]'
|
||||
const MAX_SANITIZE_DEPTH = 5
|
||||
|
||||
const SENSITIVE_KEY_PATTERNS = [
|
||||
/password/i,
|
||||
/passwd/i,
|
||||
/\bpwd\b/i,
|
||||
/token/i,
|
||||
/cookie/i,
|
||||
/secret/i,
|
||||
/api[_\s-]?key/i,
|
||||
/access[_\s-]?key/i,
|
||||
/private[_\s-]?key/i,
|
||||
/bt[_\s-]?key/i,
|
||||
/bt[_\s-]?panel/i,
|
||||
/tmp[_\s-]?(login|token)/i,
|
||||
/\bpem\b/i,
|
||||
/\bcsr\b/i,
|
||||
/cert(ificate)?[_\s-]?pem/i,
|
||||
]
|
||||
|
||||
const SENSITIVE_TEXT_KEYS = '(?:password|passwd|pwd|token|cookie|secret|api[_\\s-]?key|access[_\\s-]?key|private[_\\s-]?key|bt[_\\s-]?key|bt[_\\s-]?panel|tmp[_\\s-]?(?:login|token)|pem|csr|cert(?:ificate)?[_\\s-]?pem|BT_PANEL|BT_KEY|Authorization)'
|
||||
|
||||
const TEXT_PATTERNS: Array<[RegExp, string]> = [
|
||||
[/-----BEGIN [A-Z0-9 ]+-----[\s\S]*?-----END [A-Z0-9 ]+-----/gi, '-----BEGIN PEM BLOCK-----' + HIDDEN + '-----END PEM BLOCK-----'],
|
||||
[new RegExp(`([\"']${SENSITIVE_TEXT_KEYS}[\"']\\s*:\\s*)([\"'])([\\s\\S]*?)(\\2)`, 'gi'), '$1$2' + REDACTED + '$4'],
|
||||
[new RegExp(`(${SENSITIVE_TEXT_KEYS}\\s*[:=]\\s*)(\".*?\"|'.*?'|[^\\s,;]+)`, 'gi'), '$1' + REDACTED],
|
||||
[/(Authorization\s*:\s*Bearer\s+)([^\s'";,]+)/gi, '$1' + REDACTED],
|
||||
[/(Bearer\s+)([^\s'";,]+)/gi, '$1' + REDACTED],
|
||||
[/((?:--password|--passwd|--token|--secret|--api-key|--cookie)\s+)([^\s]+)/gi, '$1' + REDACTED],
|
||||
[/((?:sshpass\s+-p\s+|\s-p)\s*)([^\s]+)/gi, '$1' + REDACTED],
|
||||
[/((?:tmp_login|tmp_token)=)([^&\s]+)/gi, '$1' + REDACTED],
|
||||
]
|
||||
|
||||
const SENSITIVE_FILE_PATTERNS = [
|
||||
/^\.env(?:\.|$)/i,
|
||||
/^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.|$)/i,
|
||||
/^\.(?:ssh|gnupg|aws|azure|kube|docker)$/i,
|
||||
/^(?:credentials|authorized_keys|known_hosts)$/i,
|
||||
/(?:^|[._-])(?:password|passwd|pwd|token|cookie|secret|api[_-]?key|access[_-]?key|private[_-]?key|bt[_-]?key|tmp[_-]?(?:login|token))(?:[._-]|$)/i,
|
||||
/\.(?:pem|key|csr|p12|pfx|kdbx|pgpass)$/i,
|
||||
]
|
||||
|
||||
export function isSensitiveKey(key: string): boolean {
|
||||
const normalized = String(key || '').toLowerCase()
|
||||
return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(normalized))
|
||||
}
|
||||
|
||||
export function redactSensitiveText(value: unknown, fallback = '-', maxLength = 240): string {
|
||||
if (value === null || value === undefined || value === '') return fallback
|
||||
let text = String(value)
|
||||
for (const [pattern, replacement] of TEXT_PATTERNS) text = text.replace(pattern, replacement)
|
||||
if (text.length > maxLength) return text.slice(0, Math.max(0, maxLength - 3)) + '...'
|
||||
return text
|
||||
}
|
||||
|
||||
export function hasSensitiveMarker(value: unknown): boolean {
|
||||
const text = String(value || '')
|
||||
if (!text) return false
|
||||
if (text.includes(REDACTED) || text.includes('[REDACTED]') || /-----BEGIN [A-Z0-9 ]+-----/i.test(text)) return true
|
||||
if (new RegExp(SENSITIVE_TEXT_KEYS, 'i').test(text)) return true
|
||||
return TEXT_PATTERNS.some(([pattern]) => {
|
||||
pattern.lastIndex = 0
|
||||
const matched = pattern.test(text)
|
||||
pattern.lastIndex = 0
|
||||
return matched
|
||||
})
|
||||
}
|
||||
|
||||
export function isSensitiveFileName(value: unknown): boolean {
|
||||
const name = String(value || '').split(/[\\/]/).filter(Boolean).pop() || ''
|
||||
if (!name) return false
|
||||
return SENSITIVE_FILE_PATTERNS.some((pattern) => pattern.test(name)) || hasSensitiveMarker(name)
|
||||
}
|
||||
|
||||
export function redactFilePathText(value: unknown, fallback = '-', maxLength = 160): string {
|
||||
if (value === null || value === undefined || value === '') return fallback
|
||||
const text = String(value)
|
||||
const parts = text.split(/([\\/]+)/)
|
||||
const redacted = parts.map((part) => {
|
||||
if (!part || /^[\\/]+$/.test(part)) return part
|
||||
return isSensitiveFileName(part) ? HIDDEN : redactSensitiveText(part, part, maxLength)
|
||||
}).join('')
|
||||
if (redacted.length > maxLength) return redacted.slice(0, Math.max(0, maxLength - 3)) + '...'
|
||||
return redacted
|
||||
}
|
||||
|
||||
function sanitizeValue(value: unknown, key = '', depth = 0): unknown {
|
||||
if (isSensitiveKey(key)) return value === null || value === undefined || value === '' ? value : HIDDEN
|
||||
if (typeof value === 'string') return redactSensitiveText(value, value, 240)
|
||||
if (value === null || value === undefined) return value
|
||||
if (typeof value !== 'object') return value
|
||||
if (depth >= MAX_SANITIZE_DEPTH) return HIDDEN
|
||||
if (Array.isArray(value)) return value.map((item) => sanitizeValue(item, key, depth + 1))
|
||||
const output: Record<string, unknown> = {}
|
||||
for (const [childKey, childValue] of Object.entries(value as Record<string, unknown>)) {
|
||||
output[childKey] = sanitizeValue(childValue, childKey, depth + 1)
|
||||
}
|
||||
return output
|
||||
}
|
||||
|
||||
export function sanitizePlainRecord<T extends Record<string, unknown>>(record: T, allowedKeys?: string[]): Record<string, unknown> {
|
||||
const output: Record<string, unknown> = {}
|
||||
const entries = allowedKeys ? allowedKeys.map((key) => [key, record[key]] as const) : Object.entries(record)
|
||||
for (const [key, value] of entries) {
|
||||
if (value === undefined) continue
|
||||
output[key] = sanitizeValue(value, key, 0)
|
||||
}
|
||||
return output
|
||||
}
|
||||
|
||||
export function sanitizeSettingEntry<T extends { key: string; value?: string | null; value_set?: boolean | null }>(setting: T): T {
|
||||
if (!isSensitiveKey(setting.key)) {
|
||||
return { ...setting, value: redactSensitiveText(setting.value, '') || null }
|
||||
}
|
||||
return {
|
||||
...setting,
|
||||
value: null,
|
||||
value_set: Boolean(setting.value_set || setting.value),
|
||||
}
|
||||
}
|
||||
|
||||
export function summarizeCertificatePayload(value: unknown): string {
|
||||
if (value === -1 || value === 0 || value === false || value === null || value === undefined || value === '') return ''
|
||||
if (typeof value === 'object' && !Array.isArray(value)) {
|
||||
const data = value as Record<string, unknown>
|
||||
const safe = [data.subject, data.dns, data.issuer, data.brand, data.notAfter, data.endtime, data.end_time, data.valid_to, data.expire]
|
||||
.filter((item) => item !== null && item !== undefined && item !== '')
|
||||
.map((item) => redactSensitiveText(item, '', 80))
|
||||
return safe.length ? safe.join(' / ') : 'certificate metadata hidden'
|
||||
}
|
||||
const text = redactSensitiveText(value, '', 160)
|
||||
if (!text) return ''
|
||||
if (/PRIVATE KEY|CERTIFICATE REQUEST|BEGIN CERTIFICATE|tmp_login|tmp_token|Bearer|BT_KEY|BT_PANEL|password|passwd|secret|api[_\s-]?key/i.test(String(value))) {
|
||||
return 'certificate metadata hidden'
|
||||
}
|
||||
return text
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
import { clsx, type ClassValue } from 'clsx'
|
||||
import { twMerge } from 'tailwind-merge'
|
||||
|
||||
export function cn(...inputs: ClassValue[]): string {
|
||||
return twMerge(clsx(inputs))
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
import { StrictMode, Suspense } from 'react'
|
||||
import { createRoot } from 'react-dom/client'
|
||||
import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
|
||||
import App from './App'
|
||||
import './styles.css'
|
||||
|
||||
const queryClient = new QueryClient({
|
||||
defaultOptions: {
|
||||
queries: {
|
||||
staleTime: 60_000,
|
||||
gcTime: 10 * 60_000,
|
||||
retry: 1,
|
||||
refetchOnWindowFocus: false,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
createRoot(document.getElementById('root')!).render(
|
||||
<StrictMode>
|
||||
<QueryClientProvider client={queryClient}>
|
||||
<Suspense fallback={<div className="min-h-screen bg-nexus-bg text-slate-100" />}>
|
||||
<App />
|
||||
</Suspense>
|
||||
</QueryClientProvider>
|
||||
</StrictMode>,
|
||||
)
|
||||
@@ -0,0 +1,32 @@
|
||||
import { create } from 'zustand'
|
||||
import type { AdminProfile } from '@/lib/api'
|
||||
|
||||
export type AppModule = 'dashboard' | 'assets' | 'btpanel' | 'btresources' | 'btdomainssl' | 'search' | 'tasks' | 'workspace' | 'monitoring' | 'operations' | 'scripts' | 'executions' | 'audit' | 'security' | 'settings'
|
||||
|
||||
type SessionStatus = 'checking' | 'authenticated' | 'guest'
|
||||
|
||||
interface AppState {
|
||||
selectedServerId: string
|
||||
commandOpen: boolean
|
||||
activeModule: AppModule
|
||||
admin: AdminProfile | null
|
||||
sessionStatus: SessionStatus
|
||||
setSelectedServerId: (id: string) => void
|
||||
setCommandOpen: (open: boolean) => void
|
||||
setActiveModule: (module: AppModule) => void
|
||||
setAdmin: (admin: AdminProfile | null) => void
|
||||
setSessionStatus: (status: SessionStatus) => void
|
||||
}
|
||||
|
||||
export const useAppStore = create<AppState>((set) => ({
|
||||
selectedServerId: 'prod-bt-042',
|
||||
commandOpen: false,
|
||||
activeModule: 'dashboard',
|
||||
admin: null,
|
||||
sessionStatus: 'checking',
|
||||
setSelectedServerId: (id) => set({ selectedServerId: id }),
|
||||
setCommandOpen: (open) => set({ commandOpen: open }),
|
||||
setActiveModule: (activeModule) => set({ activeModule }),
|
||||
setAdmin: (admin) => set({ admin }),
|
||||
setSessionStatus: (sessionStatus) => set({ sessionStatus }),
|
||||
}))
|
||||
@@ -0,0 +1,27 @@
|
||||
@tailwind base;
|
||||
@tailwind components;
|
||||
@tailwind utilities;
|
||||
|
||||
:root {
|
||||
color-scheme: dark;
|
||||
font-synthesis: none;
|
||||
text-rendering: optimizeLegibility;
|
||||
-webkit-font-smoothing: antialiased;
|
||||
-moz-osx-font-smoothing: grayscale;
|
||||
}
|
||||
|
||||
* { box-sizing: border-box; }
|
||||
html, body, #root { min-height: 100%; }
|
||||
body { margin: 0; background: #070b16; }
|
||||
|
||||
@layer components {
|
||||
.glass-panel {
|
||||
@apply border border-white/10 bg-slate-900/75 shadow-glow backdrop-blur-xl;
|
||||
}
|
||||
.soft-panel {
|
||||
@apply border border-white/10 bg-slate-950/35 backdrop-blur;
|
||||
}
|
||||
.focus-ring {
|
||||
@apply focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-300 focus-visible:ring-offset-2 focus-visible:ring-offset-slate-950;
|
||||
}
|
||||
}
|
||||
Vendored
+11
@@ -0,0 +1,11 @@
|
||||
/// <reference types="vite/client" />
|
||||
|
||||
import type { ReactElement } from 'react'
|
||||
|
||||
declare global {
|
||||
namespace JSX {
|
||||
type Element = ReactElement
|
||||
}
|
||||
}
|
||||
|
||||
export {}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user