Nexus Agent
08a0157c95
调度页执行周期可视化/单次执行/分类选机/推送源对齐；登录 IP 门控与无缝导航； 服务器批量后台任务、执行记录、凭据合并、各页激活刷新与错误提示修复。 Co-authored-by: Cursor <cursoragent@cursor.com>
1578 lines
57 KiB
Python
1578 lines
57 KiB
Python
"""Nexus — Settings & Schedules API Routes
|
||
Presentation layer — system settings + push schedules + password presets + audit logs.
|
||
|
||
Security: All write operations require JWT authentication.
|
||
Immutable settings (secret_key, api_key, encryption_key, database_url) cannot be modified via API.
|
||
Sensitive values are masked in GET responses.
|
||
"""
|
||
|
||
from typing import Optional
|
||
from pathlib import Path
|
||
import asyncio
|
||
import html
|
||
import logging
|
||
import ipaddress
|
||
import re
|
||
import socket
|
||
|
||
import bcrypt
|
||
from fastapi import APIRouter, Depends, HTTPException, Request
|
||
from pydantic import BaseModel, Field
|
||
|
||
from server.api.dependencies import get_db
|
||
from server.api.auth_jwt import get_current_admin, require_current_admin
|
||
from server.api.schemas import ScheduleCreate, ScheduleUpdate, PresetCreate, PresetUpdate, SettingUpdatePayload, ApiKeyRevealRequest, SshKeyPresetCreate, SshKeyPresetUpdate
|
||
from server.infrastructure.database.setting_repo import SettingRepositoryImpl
|
||
from server.infrastructure.database.push_schedule_repo import PushScheduleRepositoryImpl, PushRetryJobRepositoryImpl
|
||
from server.infrastructure.database.password_preset_repo import PasswordPresetRepositoryImpl
|
||
from server.infrastructure.database.ssh_key_preset_repo import SshKeyPresetRepositoryImpl
|
||
from server.infrastructure.database.audit_log_repo import AuditLogRepositoryImpl
|
||
from server.domain.models import PushSchedule, PushRetryJob, PasswordPreset, SshKeyPreset, AuditLog, Admin
|
||
|
||
logger = logging.getLogger("nexus.settings")
|
||
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
|
||
# Settings that cannot be modified via API (encryption consistency)
|
||
IMMUTABLE_KEYS = {"secret_key", "api_key", "encryption_key", "database_url"}
|
||
|
||
# Settings whose values are masked in GET responses
|
||
SENSITIVE_KEYS = {"secret_key", "api_key", "encryption_key", "telegram_bot_token"}
|
||
|
||
# S-02: Whitelist of keys accepted by PUT /{key} (superset of DB_OVERRIDE_MAP + notify toggles)
|
||
MUTABLE_KEYS: set[str] = {
|
||
"system_name", "system_title", "db_pool_size", "db_max_overflow",
|
||
"redis_url", "heartbeat_timeout", "api_base_url",
|
||
"cpu_alert_threshold", "mem_alert_threshold", "disk_alert_threshold",
|
||
"telegram_bot_token", "telegram_chat_id",
|
||
"login_allowlist_enabled", "login_subscription_url",
|
||
"login_subscription_ips", "login_manual_ips", "login_allowed_ips",
|
||
"notify_alert_cpu", "notify_alert_mem", "notify_alert_disk",
|
||
"notify_recovery", "notify_time_drift",
|
||
"notify_system_redis", "notify_system_mysql", "notify_restart",
|
||
"notify_script_complete",
|
||
"script_exec_complete_sound", # 脚本执行完成浏览器提示音 (off|beep_short|beep_double|chime_soft)
|
||
"editor_theme", # Monaco editor theme preference
|
||
"theme", # 全站主题 (dark/light)
|
||
}
|
||
|
||
SETTING_ENUM_VALIDATORS: dict[str, frozenset[str]] = {
|
||
"script_exec_complete_sound": frozenset({"off", "beep_short", "beep_double", "chime_soft"}),
|
||
"theme": frozenset({"dark", "light"}),
|
||
}
|
||
|
||
# S-02: Per-key validation rules: (type, min, max) for int settings
|
||
SETTING_VALIDATORS: dict[str, tuple] = {
|
||
"db_pool_size": (int, 1, 1000),
|
||
"db_max_overflow": (int, 1, 1000),
|
||
"heartbeat_timeout": (int, 10, 600),
|
||
"cpu_alert_threshold": (int, 1, 100),
|
||
"mem_alert_threshold": (int, 1, 100),
|
||
"disk_alert_threshold": (int, 1, 100),
|
||
}
|
||
|
||
|
||
# S-01: SSRF protection — check if hostname resolves to private/link-local IP
|
||
async def _is_private_host(hostname: str) -> bool:
|
||
"""Check if hostname resolves to any private/loopback/link-local IP."""
|
||
if not hostname:
|
||
return True
|
||
# Direct IP check
|
||
try:
|
||
ip = ipaddress.ip_address(hostname)
|
||
return ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved
|
||
except ValueError:
|
||
pass # Not a literal IP, do DNS resolution
|
||
# F-2: Async DNS resolution (non-blocking)
|
||
try:
|
||
loop = asyncio.get_running_loop()
|
||
infos = await loop.getaddrinfo(hostname, None, family=socket.AF_UNSPEC, type=socket.SOCK_STREAM)
|
||
for _family, _, _, _, sockaddr in infos:
|
||
ip = ipaddress.ip_address(sockaddr[0])
|
||
if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
|
||
return True
|
||
except (socket.gaierror, ValueError, OSError):
|
||
return True # DNS failure → block
|
||
return False
|
||
|
||
router = APIRouter(prefix="/api/settings", tags=["settings"])
|
||
|
||
|
||
async def _verify_reauth(db: AsyncSession, admin: Admin, password: str) -> None:
|
||
"""F-4: Shared re-auth helper for reveal endpoints. Raises 400 on failure."""
|
||
from server.infrastructure.database.admin_repo import AdminRepositoryImpl
|
||
admin_repo = AdminRepositoryImpl(db)
|
||
current = await admin_repo.get_by_id(admin.id)
|
||
if not current or not bcrypt.checkpw(password.encode(), current.password_hash.encode()):
|
||
raise HTTPException(status_code=400, detail="当前密码错误")
|
||
|
||
|
||
def _validate_ip_list(ips: list[str]) -> None:
|
||
"""Validate IP/CIDR/domain list. Raises 400 on invalid entry."""
|
||
for raw in ips:
|
||
ip = raw.strip()
|
||
if not ip:
|
||
continue
|
||
if not (_IP_RE.match(ip) or _DOMAIN_RE.match(ip)):
|
||
raise HTTPException(status_code=400, detail=f"无效的 IP/CIDR/域名: {ip}")
|
||
|
||
|
||
# ── System Settings ──
|
||
|
||
def _format_setting_response(key: str, value: str | None, updated_at) -> dict:
|
||
"""Build setting dict; sensitive keys never return plaintext."""
|
||
if key in SENSITIVE_KEYS and value:
|
||
return {
|
||
"key": key,
|
||
"value": "",
|
||
"value_set": True,
|
||
"updated_at": str(updated_at),
|
||
}
|
||
return {
|
||
"key": key,
|
||
"value": value,
|
||
"value_set": bool(value) if key in SENSITIVE_KEYS else None,
|
||
"updated_at": str(updated_at),
|
||
}
|
||
|
||
|
||
@router.get("/", response_model=list)
|
||
async def list_settings(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||
"""List all system settings (sensitive values masked)"""
|
||
repo = SettingRepositoryImpl(db)
|
||
settings = await repo.get_all()
|
||
return [_format_setting_response(s.key, s.value, s.updated_at) for s in settings]
|
||
|
||
|
||
@router.get("/ip-allowlist", response_model=dict)
|
||
async def get_ip_allowlist(
|
||
admin: Admin = Depends(get_current_admin),
|
||
):
|
||
"""Return full allowlist state."""
|
||
from server.config import settings as _settings
|
||
from server.background.ip_allowlist_refresh import get_last_refresh_time
|
||
|
||
allowlist_on = (_settings.LOGIN_ALLOWLIST_ENABLED or "false").lower() in ("true","1","yes","on")
|
||
sub_ips_raw = _settings.LOGIN_SUBSCRIPTION_IPS or ""
|
||
manual_raw = _settings.LOGIN_MANUAL_IPS or ""
|
||
sub_ips = [ip.strip() for ip in sub_ips_raw.split(",") if ip.strip()]
|
||
manual_ips = [ip.strip() for ip in manual_raw.split(",") if ip.strip()]
|
||
|
||
return {
|
||
"enabled": allowlist_on,
|
||
"subscription_url": _settings.LOGIN_SUBSCRIPTION_URL or "",
|
||
"subscription_ips": sub_ips,
|
||
"manual_ips": manual_ips,
|
||
"subscription_count": len(sub_ips),
|
||
"manual_count": len(manual_ips),
|
||
"total_count": len(sub_ips) + len(set(manual_ips) - set(sub_ips)),
|
||
"last_refresh": get_last_refresh_time(),
|
||
}
|
||
|
||
|
||
# ── Bing Daily Wallpaper — download 12+ images, rotate hourly ──
|
||
_WALLPAPER_DIR = Path(__file__).resolve().parent.parent.parent / "web" / "app" / "wallpapers"
|
||
_MAX_WALLPAPERS = 12 # keep 12 images (12 hours rotation before repeat)
|
||
_MAX_AGE_DAYS = 7 # auto-clean older than 7 days
|
||
|
||
_wallpaper_sync_lock = asyncio.Lock()
|
||
|
||
|
||
def _cleanup_old_wallpapers() -> int:
|
||
"""Remove wallpapers older than 7 days. Returns count removed."""
|
||
from datetime import datetime, timedelta, timezone
|
||
cutoff = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(days=_MAX_AGE_DAYS)
|
||
removed = 0
|
||
for f in sorted(_WALLPAPER_DIR.glob("*.jpg")):
|
||
try:
|
||
mtime = datetime.fromtimestamp(f.stat().st_mtime, tz=timezone.utc).replace(tzinfo=None)
|
||
if mtime < cutoff:
|
||
f.unlink()
|
||
removed += 1
|
||
except OSError as e:
|
||
logger.debug("Wallpaper cleanup skip %s: %s", f.name, e)
|
||
return removed
|
||
|
||
|
||
def _cached_wallpaper_urls() -> dict:
|
||
"""List locally cached wallpaper URLs (no outbound HTTP)."""
|
||
_WALLPAPER_DIR.mkdir(parents=True, exist_ok=True)
|
||
all_files = sorted(
|
||
_WALLPAPER_DIR.glob("*.jpg"),
|
||
key=lambda f: f.stat().st_mtime,
|
||
reverse=True,
|
||
)
|
||
urls = [
|
||
f"/app/wallpapers/{f.name}"
|
||
for f in sorted(all_files[:_MAX_WALLPAPERS], key=lambda f: f.name, reverse=True)
|
||
]
|
||
return {"urls": urls, "count": len(urls)}
|
||
|
||
|
||
async def _sync_bing_wallpapers_from_network() -> int:
|
||
"""Download recent Bing images to local cache. Returns count downloaded."""
|
||
import httpx
|
||
|
||
_WALLPAPER_DIR.mkdir(parents=True, exist_ok=True)
|
||
downloaded = 0
|
||
try:
|
||
async with httpx.AsyncClient(timeout=12.0) as client:
|
||
resp = await client.get(
|
||
"https://cn.bing.com/HPImageArchive.aspx",
|
||
params={"format": "js", "idx": 0, "n": 8, "mkt": "zh-CN"},
|
||
)
|
||
data = resp.json()
|
||
for img in (data.get("images") or []):
|
||
img_path = img.get("url")
|
||
if not img_path:
|
||
continue
|
||
date_str = img.get("startdate", "") or img.get("fullstartdate", "")[:8] or ""
|
||
if not date_str:
|
||
import re
|
||
m = re.search(r"OHR\.(\w+)_", img_path)
|
||
date_str = m.group(1) if m else f"unknown_{downloaded}"
|
||
|
||
cached = _WALLPAPER_DIR / f"{date_str}.jpg"
|
||
if cached.exists() and cached.stat().st_size > 1024:
|
||
continue
|
||
|
||
try:
|
||
img_resp = await client.get(f"https://cn.bing.com{img_path}")
|
||
if img_resp.status_code == 200:
|
||
cached.write_bytes(img_resp.content)
|
||
downloaded += 1
|
||
except httpx.HTTPError as e:
|
||
logger.debug("Bing image download failed: %s", e)
|
||
except httpx.HTTPError as e:
|
||
logger.warning("Bing wallpaper sync failed: %s", e)
|
||
|
||
_cleanup_old_wallpapers()
|
||
all_files = sorted(_WALLPAPER_DIR.glob("*.jpg"), key=lambda f: f.stat().st_mtime, reverse=True)
|
||
for f in all_files[_MAX_WALLPAPERS:]:
|
||
try:
|
||
f.unlink()
|
||
except OSError as e:
|
||
logger.debug("Wallpaper prune skip %s: %s", f.name, e)
|
||
return downloaded
|
||
|
||
|
||
async def _ensure_wallpaper_cache() -> None:
|
||
"""Populate local cache when empty (login page has no admin to trigger POST /sync)."""
|
||
if _cached_wallpaper_urls()["count"] > 0:
|
||
return
|
||
async with _wallpaper_sync_lock:
|
||
if _cached_wallpaper_urls()["count"] > 0:
|
||
return
|
||
await _sync_bing_wallpapers_from_network()
|
||
|
||
|
||
@router.get("/bing-wallpapers", response_model=dict)
|
||
async def bing_wallpapers():
|
||
"""Return cached wallpaper URLs; lazy-sync from Bing when cache is empty."""
|
||
await _ensure_wallpaper_cache()
|
||
return _cached_wallpaper_urls()
|
||
|
||
|
||
@router.post("/bing-wallpapers/sync", response_model=dict)
|
||
async def bing_wallpapers_sync(admin: Admin = Depends(require_current_admin)):
|
||
"""Admin-only: fetch latest Bing images into local cache."""
|
||
downloaded = await _sync_bing_wallpapers_from_network()
|
||
result = _cached_wallpaper_urls()
|
||
result["downloaded"] = downloaded
|
||
return result
|
||
|
||
|
||
# Keep the old single-image endpoint for backward compatibility
|
||
@router.get("/bing-wallpaper", response_model=dict)
|
||
async def bing_wallpaper():
|
||
"""Return today's cached wallpaper URL (public, read-only)."""
|
||
await _ensure_wallpaper_cache()
|
||
_WALLPAPER_DIR.mkdir(parents=True, exist_ok=True)
|
||
from datetime import datetime
|
||
|
||
today = datetime.utcnow().strftime("%Y-%m-%d")
|
||
cached = _WALLPAPER_DIR / f"{today}.jpg"
|
||
if cached.exists() and cached.stat().st_size > 1024:
|
||
return {"url": f"/app/wallpapers/{today}.jpg"}
|
||
|
||
all_files = sorted(_WALLPAPER_DIR.glob("*.jpg"), key=lambda f: f.stat().st_mtime, reverse=True)
|
||
if all_files:
|
||
return {"url": f"/app/wallpapers/{all_files[0].name}"}
|
||
return {"url": None}
|
||
|
||
|
||
@router.get("/{key}", response_model=dict)
|
||
async def get_setting(key: str, admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||
"""Get a single setting by key (sensitive values masked)"""
|
||
repo = SettingRepositoryImpl(db)
|
||
value = await repo.get(key)
|
||
if value is None:
|
||
raise HTTPException(status_code=404, detail="Setting not found")
|
||
return _format_setting_response(key, value, None)
|
||
|
||
|
||
@router.post("/api-key/reveal", response_model=dict)
|
||
async def reveal_api_key(
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Reveal global API_KEY for authenticated admin (JWT required)."""
|
||
repo = SettingRepositoryImpl(db)
|
||
value = await repo.get("api_key")
|
||
if value is None:
|
||
raise HTTPException(status_code=404, detail="API_KEY not found")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="reveal_api_key",
|
||
target_type="setting",
|
||
detail="查看全局 API Key",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
return {"key": "api_key", "value": value}
|
||
|
||
|
||
@router.put("/{key}", response_model=dict)
|
||
async def set_setting(
|
||
key: str,
|
||
payload: SettingUpdatePayload,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Set a system setting value (immutable keys are rejected)
|
||
|
||
Writes to DB AND hot-reloads the in-memory settings object so changes
|
||
take effect immediately without server restart.
|
||
"""
|
||
if key in IMMUTABLE_KEYS:
|
||
raise HTTPException(status_code=403, detail=f"Setting '{key}' is immutable and cannot be modified via API")
|
||
if key not in MUTABLE_KEYS:
|
||
raise HTTPException(status_code=403, detail=f"未知设置项: {key}")
|
||
|
||
val_str = str(payload.value)
|
||
if key in SENSITIVE_KEYS and not val_str.strip():
|
||
repo = SettingRepositoryImpl(db)
|
||
current = await repo.get(key)
|
||
if not current:
|
||
raise HTTPException(status_code=400, detail=f"'{key}' 不能为空")
|
||
return _format_setting_response(key, current, None)
|
||
|
||
if key in SETTING_ENUM_VALIDATORS:
|
||
allowed = SETTING_ENUM_VALIDATORS[key]
|
||
if val_str not in allowed:
|
||
raise HTTPException(
|
||
status_code=400,
|
||
detail=f"'{key}' 必须是: {', '.join(sorted(allowed))}",
|
||
)
|
||
|
||
# S-02: Validate value type and range for int settings
|
||
if key in SETTING_VALIDATORS:
|
||
expected_type, min_val, max_val = SETTING_VALIDATORS[key]
|
||
try:
|
||
int_val = int(val_str)
|
||
except (ValueError, TypeError):
|
||
raise HTTPException(status_code=400, detail=f"'{key}' 必须是整数") from None
|
||
if int_val < min_val or int_val > max_val:
|
||
raise HTTPException(status_code=400, detail=f"'{key}' 范围: {min_val}-{max_val}")
|
||
|
||
repo = SettingRepositoryImpl(db)
|
||
setting = await repo.set(key, str(payload.value))
|
||
|
||
# Hot-reload: update in-memory settings so changes take effect immediately
|
||
import logging
|
||
_logger = logging.getLogger("nexus.settings")
|
||
from server.config import settings as _settings
|
||
attr_name = _settings.DB_OVERRIDE_MAP.get(key)
|
||
if attr_name and hasattr(_settings, attr_name):
|
||
value = setting.value
|
||
if attr_name in _settings.INT_SETTINGS:
|
||
try:
|
||
value = int(value)
|
||
except (ValueError, TypeError):
|
||
_logger.warning("hot-reload: %s 值 '%s' 无法转为 int，已跳过热更新", attr_name, value)
|
||
value = None # Skip setattr for invalid int
|
||
if value is not None:
|
||
setattr(_settings, attr_name, value)
|
||
|
||
# Audit log
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="update_setting",
|
||
target_type="setting",
|
||
detail=f"键={key}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
if key in ("telegram_bot_token", "telegram_chat_id"):
|
||
try:
|
||
from server.application.services.ops_patrol_sync import sync_telegram_to_env
|
||
|
||
sync_telegram_to_env(_settings.TELEGRAM_BOT_TOKEN, _settings.TELEGRAM_CHAT_ID)
|
||
except Exception as exc:
|
||
_logger.warning("Layer-3 Telegram env sync failed after %s update: %s", key, exc)
|
||
|
||
return {"key": setting.key, "value": setting.value}
|
||
|
||
|
||
# ── Push Schedules ──
|
||
|
||
schedule_router = APIRouter(prefix="/api/schedules", tags=["schedules"])
|
||
|
||
|
||
@schedule_router.get("/", response_model=list)
|
||
async def list_schedules(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||
"""List all push schedules"""
|
||
repo = PushScheduleRepositoryImpl(db)
|
||
schedules = await repo.get_all()
|
||
return [_schedule_to_dict(s) for s in schedules]
|
||
|
||
|
||
@schedule_router.post("/", response_model=dict, status_code=201)
|
||
async def create_schedule(
|
||
payload: ScheduleCreate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Create a new push schedule"""
|
||
repo = PushScheduleRepositoryImpl(db)
|
||
schedule = PushSchedule(**payload.model_dump())
|
||
created = await repo.create(schedule)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="create_schedule",
|
||
target_type="schedule",
|
||
target_id=created.id,
|
||
detail=f"名称={created.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return _schedule_to_dict(created)
|
||
|
||
|
||
@schedule_router.put("/{id}", response_model=dict)
|
||
async def update_schedule(
|
||
id: int,
|
||
payload: ScheduleUpdate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Update a push schedule"""
|
||
repo = PushScheduleRepositoryImpl(db)
|
||
schedule = await repo.get_by_id(id)
|
||
if not schedule:
|
||
raise HTTPException(status_code=404, detail="Schedule not found")
|
||
# Explicit allowlist to prevent mass-assignment to sensitive columns
|
||
ALLOWED_FIELDS = {
|
||
"name", "source_path", "target_path", "server_ids", "run_mode", "cron_expr",
|
||
"fire_at", "sync_mode", "enabled", "schedule_type",
|
||
"script_id", "script_content", "exec_timeout", "long_task",
|
||
}
|
||
for key, value in payload.model_dump(exclude_unset=True).items():
|
||
if key in ALLOWED_FIELDS:
|
||
setattr(schedule, key, value)
|
||
updated = await repo.update(schedule)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="update_schedule",
|
||
target_type="schedule",
|
||
target_id=id,
|
||
detail=f"名称={updated.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return _schedule_to_dict(updated)
|
||
|
||
|
||
@schedule_router.delete("/{id}", status_code=204)
|
||
async def delete_schedule(
|
||
id: int,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Delete a push schedule"""
|
||
repo = PushScheduleRepositoryImpl(db)
|
||
result = await repo.delete(id)
|
||
if not result:
|
||
raise HTTPException(status_code=404, detail="Schedule not found")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="delete_schedule",
|
||
target_type="schedule",
|
||
target_id=id,
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
|
||
# ── Password Presets ──
|
||
|
||
preset_router = APIRouter(prefix="/api/presets", tags=["presets"])
|
||
|
||
|
||
@preset_router.get("/", response_model=list)
|
||
async def list_presets(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||
"""List all password presets"""
|
||
repo = PasswordPresetRepositoryImpl(db)
|
||
presets = await repo.get_all()
|
||
return [
|
||
{"id": p.id, "name": p.name, "username": p.username or "root", "created_at": str(p.created_at)}
|
||
for p in presets
|
||
]
|
||
|
||
|
||
@preset_router.post("/", response_model=dict, status_code=201)
|
||
async def create_preset(
|
||
payload: PresetCreate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Create a password preset (password will be encrypted)"""
|
||
from server.infrastructure.database.crypto import encrypt_value
|
||
repo = PasswordPresetRepositoryImpl(db)
|
||
encrypted = encrypt_value(payload.encrypted_pw)
|
||
preset = PasswordPreset(
|
||
name=payload.name,
|
||
username=(payload.username or "root").strip() or "root",
|
||
encrypted_pw=encrypted,
|
||
)
|
||
created = await repo.create(preset)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="create_preset",
|
||
target_type="preset",
|
||
target_id=created.id,
|
||
detail=f"名称={created.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": created.id, "name": created.name}
|
||
|
||
|
||
@preset_router.put("/{id}", response_model=dict)
|
||
async def update_preset(
|
||
id: int,
|
||
payload: PresetUpdate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Update a password preset (name and/or password — password encrypted)"""
|
||
from server.infrastructure.database.crypto import encrypt_value
|
||
|
||
repo = PasswordPresetRepositoryImpl(db)
|
||
preset = await repo.get_by_id(id)
|
||
if not preset:
|
||
raise HTTPException(status_code=404, detail="Preset not found")
|
||
|
||
updates = payload.model_dump(exclude_unset=True)
|
||
new_pw = updates.pop("encrypted_pw", None)
|
||
if updates.get("name"):
|
||
preset.name = updates["name"]
|
||
if updates.get("username"):
|
||
preset.username = updates["username"].strip() or "root"
|
||
if new_pw:
|
||
preset.encrypted_pw = encrypt_value(new_pw)
|
||
|
||
await repo.update(preset)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="update_preset",
|
||
target_type="preset",
|
||
target_id=id,
|
||
detail=f"名称={preset.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": preset.id, "name": preset.name}
|
||
|
||
|
||
@preset_router.post("/{id}/reveal", response_model=dict)
|
||
async def reveal_preset(
|
||
id: int,
|
||
payload: ApiKeyRevealRequest,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Reveal a password preset's decrypted value (re-auth + audit-logged)."""
|
||
from server.infrastructure.database.crypto import decrypt_value
|
||
await _verify_reauth(db, admin, payload.current_password)
|
||
|
||
repo = PasswordPresetRepositoryImpl(db)
|
||
preset = await repo.get_by_id(id)
|
||
if not preset:
|
||
raise HTTPException(status_code=404, detail="Preset not found")
|
||
|
||
try:
|
||
plaintext = decrypt_value(preset.encrypted_pw)
|
||
except ValueError:
|
||
raise HTTPException(status_code=500, detail="解密失败") from None
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username, action="reveal_preset",
|
||
target_type="preset", target_id=id,
|
||
detail=f"名称={preset.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": preset.id, "name": preset.name, "password": plaintext}
|
||
|
||
|
||
@preset_router.delete("/{id}", status_code=204)
|
||
async def delete_preset(
|
||
id: int,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Delete a password preset"""
|
||
repo = PasswordPresetRepositoryImpl(db)
|
||
result = await repo.delete(id)
|
||
if not result:
|
||
raise HTTPException(status_code=404, detail="Preset not found")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="delete_preset",
|
||
target_type="preset",
|
||
target_id=id,
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
|
||
# ── SSH Key Presets ──
|
||
|
||
ssh_key_preset_router = APIRouter(prefix="/api/ssh-key-presets", tags=["ssh-key-presets"])
|
||
|
||
|
||
@ssh_key_preset_router.get("/", response_model=list)
|
||
async def list_ssh_key_presets(admin: Admin = Depends(get_current_admin), db: AsyncSession = Depends(get_db)):
|
||
"""List all SSH key presets"""
|
||
repo = SshKeyPresetRepositoryImpl(db)
|
||
presets = await repo.get_all()
|
||
return [
|
||
{
|
||
"id": p.id,
|
||
"name": p.name,
|
||
"username": p.username or "root",
|
||
"public_key": p.public_key or "",
|
||
"created_at": str(p.created_at),
|
||
}
|
||
for p in presets
|
||
]
|
||
|
||
|
||
@ssh_key_preset_router.post("/", response_model=dict, status_code=201)
|
||
async def create_ssh_key_preset(
|
||
payload: SshKeyPresetCreate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Create an SSH key preset (private key will be encrypted)"""
|
||
from server.infrastructure.database.crypto import encrypt_value
|
||
repo = SshKeyPresetRepositoryImpl(db)
|
||
encrypted_private = encrypt_value(payload.private_key)
|
||
preset = SshKeyPreset(
|
||
name=payload.name,
|
||
username=(payload.username or "root").strip() or "root",
|
||
encrypted_private_key=encrypted_private,
|
||
public_key=payload.public_key,
|
||
)
|
||
created = await repo.create(preset)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="create_ssh_key_preset",
|
||
target_type="ssh_key_preset",
|
||
target_id=created.id,
|
||
detail=f"名称={created.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": created.id, "name": created.name}
|
||
|
||
|
||
@ssh_key_preset_router.put("/{id}", response_model=dict)
|
||
async def update_ssh_key_preset(
|
||
id: int,
|
||
payload: SshKeyPresetUpdate,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Update an SSH key preset (name and/or private key — private key encrypted)"""
|
||
from server.infrastructure.database.crypto import encrypt_value
|
||
|
||
repo = SshKeyPresetRepositoryImpl(db)
|
||
preset = await repo.get_by_id(id)
|
||
if not preset:
|
||
raise HTTPException(status_code=404, detail="SSH key preset not found")
|
||
|
||
updates = payload.model_dump(exclude_unset=True)
|
||
new_private_key = updates.pop("private_key", None)
|
||
if updates.get("name"):
|
||
preset.name = updates["name"]
|
||
if updates.get("username"):
|
||
preset.username = updates["username"].strip() or "root"
|
||
if new_private_key:
|
||
preset.encrypted_private_key = encrypt_value(new_private_key)
|
||
if "public_key" in updates:
|
||
preset.public_key = updates["public_key"]
|
||
|
||
await repo.update(preset)
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="update_ssh_key_preset",
|
||
target_type="ssh_key_preset",
|
||
target_id=id,
|
||
detail=f"名称={preset.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": preset.id, "name": preset.name}
|
||
|
||
|
||
@ssh_key_preset_router.post("/{id}/reveal", response_model=dict)
|
||
async def reveal_ssh_key_preset(
|
||
id: int,
|
||
payload: ApiKeyRevealRequest,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Reveal an SSH key preset's decrypted private key (re-auth + audit-logged)."""
|
||
from server.infrastructure.database.crypto import decrypt_value
|
||
await _verify_reauth(db, admin, payload.current_password)
|
||
|
||
repo = SshKeyPresetRepositoryImpl(db)
|
||
preset = await repo.get_by_id(id)
|
||
if not preset:
|
||
raise HTTPException(status_code=404, detail="SSH key preset not found")
|
||
|
||
try:
|
||
plaintext = decrypt_value(preset.encrypted_private_key)
|
||
except ValueError:
|
||
raise HTTPException(status_code=500, detail="解密失败") from None
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username, action="reveal_ssh_key_preset",
|
||
target_type="ssh_key_preset", target_id=id,
|
||
detail=f"名称={preset.name}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return {"id": preset.id, "name": preset.name, "private_key": plaintext, "public_key": preset.public_key or ""}
|
||
|
||
|
||
@ssh_key_preset_router.delete("/{id}", status_code=204)
|
||
async def delete_ssh_key_preset(
|
||
id: int,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Delete an SSH key preset"""
|
||
repo = SshKeyPresetRepositoryImpl(db)
|
||
result = await repo.delete(id)
|
||
if not result:
|
||
raise HTTPException(status_code=404, detail="SSH key preset not found")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="delete_ssh_key_preset",
|
||
target_type="ssh_key_preset",
|
||
target_id=id,
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
|
||
# ── Alert History ──
|
||
|
||
alert_history_router = APIRouter(prefix="/api/alert-history", tags=["alerts"])
|
||
|
||
|
||
@alert_history_router.get("/", response_model=dict)
|
||
async def list_alert_history(
|
||
server_id: Optional[int] = None,
|
||
alert_type: Optional[str] = None,
|
||
is_recovery: Optional[bool] = None,
|
||
date_from: Optional[str] = None,
|
||
date_to: Optional[str] = None,
|
||
limit: int = 50,
|
||
offset: int = 0,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Paginated alert/recovery history with filters."""
|
||
from sqlalchemy import select, func
|
||
from server.domain.models import AlertLog, Server
|
||
from datetime import datetime, timezone
|
||
|
||
filters = []
|
||
if server_id:
|
||
filters.append(AlertLog.server_id == server_id)
|
||
if alert_type:
|
||
filters.append(AlertLog.alert_type == alert_type)
|
||
if is_recovery is not None:
|
||
filters.append(AlertLog.is_recovery == is_recovery)
|
||
if date_from:
|
||
try:
|
||
dt = datetime.fromisoformat(date_from)
|
||
if dt.tzinfo is None:
|
||
dt = dt.replace(tzinfo=timezone.utc)
|
||
filters.append(AlertLog.created_at >= dt.replace(tzinfo=None))
|
||
except ValueError:
|
||
pass
|
||
if date_to:
|
||
try:
|
||
dt = datetime.fromisoformat(date_to)
|
||
if dt.tzinfo is None:
|
||
dt = dt.replace(tzinfo=timezone.utc)
|
||
filters.append(AlertLog.created_at <= dt.replace(tzinfo=None))
|
||
except ValueError:
|
||
pass
|
||
|
||
count_q = select(func.count(AlertLog.id))
|
||
data_q = (
|
||
select(AlertLog, Server.name.label("srv_name"))
|
||
.join(Server, AlertLog.server_id == Server.id, isouter=True)
|
||
.order_by(AlertLog.created_at.desc())
|
||
.offset(offset).limit(limit)
|
||
)
|
||
if filters:
|
||
count_q = count_q.where(*filters)
|
||
data_q = data_q.where(*filters)
|
||
|
||
total = int((await db.execute(count_q)).scalar() or 0)
|
||
rows = (await db.execute(data_q)).all()
|
||
|
||
def _to_dict(log, srv_name):
|
||
return {
|
||
"id": log.id,
|
||
"server_id": log.server_id,
|
||
"server_name": log.server_name or srv_name or f"#{log.server_id}",
|
||
"alert_type": log.alert_type,
|
||
"value": log.value,
|
||
"is_recovery": log.is_recovery,
|
||
"created_at": str(log.created_at) if log.created_at else None,
|
||
}
|
||
|
||
return {
|
||
"items": [_to_dict(log, sn) for log, sn in rows],
|
||
"total": total, "limit": limit, "offset": offset,
|
||
}
|
||
|
||
|
||
@alert_history_router.get("/stats", response_model=dict)
|
||
async def alert_stats(
|
||
days: int = 7,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Top alerting servers + daily counts for the last N days."""
|
||
from sqlalchemy import select, func, text
|
||
from server.domain.models import AlertLog
|
||
|
||
# Top 5 servers by alert count
|
||
top_q = (
|
||
select(AlertLog.server_id, AlertLog.server_name, func.count(AlertLog.id).label("cnt"))
|
||
.where(AlertLog.is_recovery == False)
|
||
.group_by(AlertLog.server_id, AlertLog.server_name)
|
||
.order_by(func.count(AlertLog.id).desc())
|
||
.limit(5)
|
||
)
|
||
top_rows = (await db.execute(top_q)).all()
|
||
|
||
# Top 5 alert types by count
|
||
type_q = (
|
||
select(AlertLog.alert_type, func.count(AlertLog.id).label("cnt"))
|
||
.where(AlertLog.is_recovery == False)
|
||
.group_by(AlertLog.alert_type)
|
||
.order_by(func.count(AlertLog.id).desc())
|
||
.limit(5)
|
||
)
|
||
type_rows = (await db.execute(type_q)).all()
|
||
|
||
# Daily counts (parameterized to avoid f-string SQL)
|
||
days_val = int(days)
|
||
daily_q = text(
|
||
"SELECT DATE(created_at) as day, "
|
||
"SUM(is_recovery=0) as alerts, SUM(is_recovery=1) as recoveries "
|
||
"FROM alert_logs "
|
||
"WHERE created_at >= DATE_SUB(NOW(), INTERVAL :days DAY) "
|
||
"GROUP BY DATE(created_at) ORDER BY day"
|
||
).bindparams(days=days_val)
|
||
daily_rows = (await db.execute(daily_q)).all()
|
||
|
||
return {
|
||
"top_types": [{"alert_type": r.alert_type, "count": r.cnt} for r in type_rows],
|
||
"top_servers": [{"server_id": r.server_id, "server_name": r.server_name or f"#{r.server_id}", "count": r.cnt} for r in top_rows],
|
||
"daily": [{"day": str(r.day), "alerts": int(r.alerts), "recoveries": int(r.recoveries)} for r in daily_rows],
|
||
}
|
||
|
||
|
||
# ── Layer-3 Host Patrol (health_monitor.sh) ──
|
||
|
||
@router.get("/ops-patrol/status", response_model=dict)
|
||
async def ops_patrol_status(
|
||
admin: Admin = Depends(get_current_admin),
|
||
):
|
||
"""Report Telegram readiness for Layer-3 cron patrol and env sync state."""
|
||
from server.config import settings as _settings
|
||
from server.application.services.ops_patrol_sync import read_telegram_env_status
|
||
|
||
app_configured = bool(_settings.TELEGRAM_BOT_TOKEN and _settings.TELEGRAM_CHAT_ID)
|
||
env_status = read_telegram_env_status()
|
||
return {
|
||
"telegram_app_configured": app_configured,
|
||
"telegram_layer3_ready": app_configured,
|
||
"telegram_env_synced": env_status["env_synced"],
|
||
"env_status": env_status,
|
||
"db_fallback_enabled": True,
|
||
"cron_install_command": "sudo nx cron",
|
||
"health_log_path": "/var/log/nexus_health.log",
|
||
}
|
||
|
||
|
||
@router.post("/ops-patrol/sync-telegram", response_model=dict)
|
||
async def ops_patrol_sync_telegram(
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Sync DB Telegram credentials to .env files readable by health_monitor.sh."""
|
||
from server.config import settings as _settings
|
||
from server.application.services.ops_patrol_sync import (
|
||
read_telegram_env_status,
|
||
sync_telegram_to_env,
|
||
)
|
||
|
||
if not _settings.TELEGRAM_BOT_TOKEN or not _settings.TELEGRAM_CHAT_ID:
|
||
raise HTTPException(status_code=400, detail="请先在上方保存 Bot Token 与 Chat ID")
|
||
|
||
result = sync_telegram_to_env(_settings.TELEGRAM_BOT_TOKEN, _settings.TELEGRAM_CHAT_ID)
|
||
if result.get("skipped"):
|
||
raise HTTPException(status_code=400, detail="Telegram 未配置，无法同步")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="sync_patrol_telegram",
|
||
target_type="setting",
|
||
detail=f"app_env={result.get('app_env')} host_env_prod={result.get('host_env_prod')}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
env_status = read_telegram_env_status()
|
||
return {
|
||
"synced": result,
|
||
"env_status": env_status,
|
||
"telegram_layer3_ready": True,
|
||
}
|
||
|
||
|
||
# ── Telegram Test + Chat ID Detection ──
|
||
|
||
async def _telegram_clear_webhook_if_set(client, base_url: str) -> None:
|
||
"""Remove active webhook so getUpdates can receive messages."""
|
||
wh_resp = await client.get(f"{base_url}/getWebhookInfo")
|
||
if wh_resp.status_code != 200:
|
||
raise HTTPException(status_code=502, detail=f"Telegram getWebhookInfo 返回 {wh_resp.status_code}")
|
||
wh_data = wh_resp.json()
|
||
if not wh_data.get("ok"):
|
||
desc = wh_data.get("description") or "getWebhookInfo 失败"
|
||
raise HTTPException(status_code=502, detail=f"Telegram API: {desc}")
|
||
if wh_data.get("result", {}).get("url"):
|
||
del_resp = await client.post(
|
||
f"{base_url}/deleteWebhook",
|
||
params={"drop_pending_updates": "false"},
|
||
)
|
||
del_data = del_resp.json()
|
||
if not del_data.get("ok"):
|
||
desc = del_data.get("description") or "deleteWebhook 失败"
|
||
raise HTTPException(status_code=502, detail=f"无法清除 Webhook: {desc}")
|
||
|
||
|
||
@router.post("/telegram/test", response_model=dict)
|
||
async def telegram_test_send(
|
||
admin: Admin = Depends(get_current_admin),
|
||
):
|
||
"""Send a test Telegram message to verify Bot Token + Chat ID configuration."""
|
||
import httpx
|
||
from server.config import settings as _settings
|
||
from server.infrastructure.telegram import TELEGRAM_API_BASE
|
||
|
||
if not _settings.TELEGRAM_BOT_TOKEN:
|
||
raise HTTPException(status_code=400, detail="TELEGRAM_BOT_TOKEN 未配置")
|
||
if not _settings.TELEGRAM_CHAT_ID:
|
||
raise HTTPException(status_code=400, detail="TELEGRAM_CHAT_ID 未配置，请先检测并填写")
|
||
|
||
from datetime import datetime, timezone
|
||
now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
|
||
sys_name = html.escape((_settings.SYSTEM_NAME or "Nexus").strip())
|
||
message = (
|
||
f"✅ <b>【Telegram 配置测试】消息发送成功</b>\n"
|
||
f"平台：{sys_name}\n"
|
||
f"具体情况：Bot Token 与 Chat ID 配置正确，Telegram 通道可用\n"
|
||
f"将接收的通知类型：\n"
|
||
f"• 子机 CPU/内存/磁盘超阈值告警与恢复\n"
|
||
f"• Redis / MySQL 连接异常与恢复\n"
|
||
f"• 子机时钟偏差、文件推送结果\n"
|
||
f"• Layer 3 宿主机巡检 /health 失败与自动重启\n"
|
||
f"说明：可在设置页关闭单项 NOTIFY_* 开关以停止对应类型推送\n"
|
||
f"时间：{now}"
|
||
)
|
||
|
||
try:
|
||
async with httpx.AsyncClient(timeout=10.0) as client:
|
||
resp = await client.post(
|
||
f"{TELEGRAM_API_BASE}/bot{_settings.TELEGRAM_BOT_TOKEN}/sendMessage",
|
||
json={
|
||
"chat_id": _settings.TELEGRAM_CHAT_ID,
|
||
"text": message,
|
||
"parse_mode": "HTML",
|
||
},
|
||
)
|
||
data = resp.json()
|
||
except HTTPException:
|
||
raise
|
||
except Exception as e:
|
||
raise HTTPException(status_code=502, detail=f"请求失败: {e}") from e
|
||
|
||
if resp.status_code == 200 and data.get("ok"):
|
||
return {"success": True}
|
||
desc = data.get("description") or f"HTTP {resp.status_code}"
|
||
raise HTTPException(status_code=502, detail=f"Telegram API: {desc}")
|
||
|
||
|
||
@router.post("/telegram/reveal-token", response_model=dict)
|
||
async def reveal_telegram_token(
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Reveal Telegram Bot Token for authenticated admin (JWT required)."""
|
||
repo = SettingRepositoryImpl(db)
|
||
value = await repo.get("telegram_bot_token")
|
||
if value is None:
|
||
raise HTTPException(status_code=404, detail="telegram_bot_token not found")
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="reveal_telegram_token",
|
||
target_type="setting",
|
||
detail="查看 Telegram Bot Token",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
return {"key": "telegram_bot_token", "value": value}
|
||
|
||
|
||
@router.get("/telegram/chats", response_model=dict)
|
||
async def telegram_get_chats(
|
||
admin: Admin = Depends(get_current_admin),
|
||
):
|
||
"""Call getUpdates to detect recent chats and extract unique chat_ids.
|
||
|
||
User must send at least one message to the Bot before calling this.
|
||
Returns up to 5 distinct chats from recent messages.
|
||
"""
|
||
import httpx
|
||
from server.config import settings as _settings
|
||
from server.infrastructure.telegram import TELEGRAM_API_BASE
|
||
|
||
token = _settings.TELEGRAM_BOT_TOKEN
|
||
if not token:
|
||
raise HTTPException(status_code=400, detail="TELEGRAM_BOT_TOKEN 未配置")
|
||
|
||
try:
|
||
async with httpx.AsyncClient(timeout=10.0) as client:
|
||
base_url = f"{TELEGRAM_API_BASE}/bot{token}"
|
||
await _telegram_clear_webhook_if_set(client, base_url)
|
||
resp = await client.get(
|
||
f"{base_url}/getUpdates",
|
||
params={"limit": 50},
|
||
)
|
||
if resp.status_code != 200:
|
||
raise HTTPException(status_code=502, detail=f"Telegram API 返回 {resp.status_code}")
|
||
data = resp.json()
|
||
if not data.get("ok"):
|
||
desc = data.get("description") or "getUpdates 失败"
|
||
raise HTTPException(status_code=502, detail=f"Telegram API: {desc}")
|
||
except HTTPException:
|
||
raise
|
||
except Exception as e:
|
||
raise HTTPException(status_code=502, detail=f"请求失败: {e}") from e
|
||
|
||
# Extract unique chats
|
||
seen: set[int] = set()
|
||
chats: list[dict] = []
|
||
for update in data.get("result", []):
|
||
msg = update.get("message") or update.get("channel_post") or {}
|
||
chat = msg.get("chat", {})
|
||
cid = chat.get("id")
|
||
if cid and cid not in seen:
|
||
seen.add(cid)
|
||
chats.append({
|
||
"id": cid,
|
||
"type": chat.get("type", ""),
|
||
"title": chat.get("title") or chat.get("first_name") or "",
|
||
"username": chat.get("username") or "",
|
||
})
|
||
if len(chats) >= 5:
|
||
break
|
||
|
||
return {"chats": chats, "count": len(chats)}
|
||
|
||
|
||
# ── IP Allowlist ──
|
||
|
||
_IP_RE = re.compile(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(/\d{1,2})?$")
|
||
_DOMAIN_RE = re.compile(r"^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z]{2,})+$")
|
||
|
||
|
||
class IpAllowlistRequest(BaseModel):
|
||
ips: list[str] = Field(..., min_length=1, max_length=100, description="IP or hostname list")
|
||
|
||
|
||
class SubscriptionParseRequest(BaseModel):
|
||
url: str = Field(..., min_length=1, description="Proxy subscription URL to fetch and parse")
|
||
|
||
|
||
@router.post("/ip-allowlist/parse-subscription", response_model=dict)
|
||
async def parse_subscription(
|
||
payload: SubscriptionParseRequest,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Fetch a proxy subscription URL, decode it, and extract node host/IP list.
|
||
|
||
Supports SS, VMess, VLESS, Trojan, Hysteria2 formats.
|
||
Returns the parsed host list for the user to review before saving.
|
||
"""
|
||
from urllib.parse import urlparse
|
||
import httpx
|
||
from server.infrastructure.subscription_parser import parse_subscription_content
|
||
|
||
url = payload.url.strip()
|
||
parsed = urlparse(url)
|
||
if parsed.scheme not in ("http", "https"):
|
||
raise HTTPException(status_code=400, detail="URL 必须以 http:// 或 https:// 开头")
|
||
|
||
# S-01: SSRF protection — block private/link-local/loopback IPs
|
||
hostname = parsed.hostname or ""
|
||
if await _is_private_host(hostname):
|
||
raise HTTPException(status_code=400, detail="不允许访问内网地址")
|
||
|
||
MAX_BODY = 1_000_000 # 1 MB
|
||
MAX_REDIRECTS = 3
|
||
try:
|
||
async with httpx.AsyncClient(timeout=15.0, follow_redirects=False) as client:
|
||
resp = await client.get(url)
|
||
# Manual redirect following with SSRF check on each hop
|
||
redirects = 0
|
||
while resp.is_redirect and redirects < MAX_REDIRECTS:
|
||
redirects += 1
|
||
location = resp.headers.get("location", "")
|
||
if not location:
|
||
break
|
||
# Resolve relative redirects
|
||
redirect_url = str(httpx.URL(location).resolve_with(url))
|
||
redir_parsed = urlparse(redirect_url)
|
||
redir_host = redir_parsed.hostname or ""
|
||
if await _is_private_host(redir_host):
|
||
raise HTTPException(status_code=400, detail="订阅链接重定向到内网地址，已阻止")
|
||
url = redirect_url
|
||
resp = await client.get(redirect_url)
|
||
|
||
if resp.status_code != 200:
|
||
raise HTTPException(status_code=400, detail=f"订阅链接返回 HTTP {resp.status_code}")
|
||
# S-01: Limit response body size
|
||
if len(resp.content) > MAX_BODY:
|
||
raise HTTPException(status_code=400, detail="订阅内容超过 1MB 限制")
|
||
raw = resp.text
|
||
except httpx.TimeoutException:
|
||
raise HTTPException(status_code=400, detail="请求订阅链接超时（15s）") from None
|
||
except HTTPException:
|
||
raise
|
||
except Exception as e:
|
||
raise HTTPException(status_code=400, detail=f"获取订阅失败: {e}") from e
|
||
|
||
hosts = parse_subscription_content(raw)
|
||
if not hosts:
|
||
raise HTTPException(status_code=400, detail="未能从订阅内容中解析出任何节点 IP / 域名")
|
||
|
||
# Audit
|
||
ip_address = request.client.host if request.client else ""
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
from server.domain.models import AuditLog
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username, action="parse_subscription",
|
||
target_type="setting", detail=f"解析订阅: {url[:80]} → {len(hosts)} 个节点",
|
||
ip_address=ip_address,
|
||
))
|
||
|
||
return {"hosts": hosts, "count": len(hosts)}
|
||
|
||
|
||
class IpAllowlistSaveRequest(BaseModel):
|
||
manual_ips: list[str] = Field(default_factory=list)
|
||
subscription_url: Optional[str] = None # None = don't change; "" = clear
|
||
enabled: Optional[bool] = None # None = don't change
|
||
|
||
|
||
@router.post("/ip-allowlist", response_model=dict)
|
||
async def set_ip_allowlist(
|
||
payload: IpAllowlistSaveRequest,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Save manual IPs, subscription URL, and/or enabled toggle."""
|
||
from server.config import settings as _settings
|
||
if payload.manual_ips:
|
||
_validate_ip_list(payload.manual_ips)
|
||
|
||
repo = SettingRepositoryImpl(db)
|
||
|
||
# Toggle enabled/disabled
|
||
if payload.enabled is not None:
|
||
val = "true" if payload.enabled else "false"
|
||
await repo.set("login_allowlist_enabled", val)
|
||
_settings.LOGIN_ALLOWLIST_ENABLED = val
|
||
|
||
# Manual IPs
|
||
manual_cleaned = [ip.strip() for ip in payload.manual_ips if ip.strip()]
|
||
manual_val = ",".join(manual_cleaned)
|
||
await repo.set("login_manual_ips", manual_val)
|
||
_settings.LOGIN_MANUAL_IPS = manual_val
|
||
|
||
# Subscription URL
|
||
sub_url_changed = False
|
||
if payload.subscription_url is not None:
|
||
sub_url = payload.subscription_url.strip()
|
||
await repo.set("login_subscription_url", sub_url)
|
||
_settings.LOGIN_SUBSCRIPTION_URL = sub_url
|
||
sub_url_changed = bool(sub_url)
|
||
|
||
# If no subscription URL, rebuild combined from manual only
|
||
if not _settings.LOGIN_SUBSCRIPTION_URL:
|
||
await repo.set("login_allowed_ips", manual_val)
|
||
await repo.set("login_subscription_ips", "")
|
||
_settings.LOGIN_ALLOWED_IPS = manual_val
|
||
_settings.LOGIN_SUBSCRIPTION_IPS = ""
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
from server.domain.models import AuditLog
|
||
ip_address = request.client.host if request.client else ""
|
||
enabled_str = "" if payload.enabled is None else f"; 白名单开关={'开' if payload.enabled else '关'}"
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username, action="update_ip_allowlist",
|
||
target_type="setting",
|
||
detail=f"手动IP {len(manual_cleaned)} 条{enabled_str}",
|
||
ip_address=ip_address,
|
||
))
|
||
|
||
# Trigger refresh if subscription URL is present
|
||
if sub_url_changed or _settings.LOGIN_SUBSCRIPTION_URL:
|
||
from server.background.ip_allowlist_refresh import _do_refresh
|
||
import asyncio
|
||
asyncio.create_task(_do_refresh())
|
||
|
||
return {"success": True, "manual_count": len(manual_cleaned)}
|
||
|
||
|
||
@router.post("/ip-allowlist/toggle", response_model=dict)
|
||
async def toggle_ip_allowlist(
|
||
request: Request,
|
||
enabled: bool,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Quick toggle for allowlist enforcement (no IP list changes)."""
|
||
from server.config import settings as _settings
|
||
|
||
val = "true" if enabled else "false"
|
||
repo = SettingRepositoryImpl(db)
|
||
await repo.set("login_allowlist_enabled", val)
|
||
_settings.LOGIN_ALLOWLIST_ENABLED = val
|
||
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
from server.domain.models import AuditLog
|
||
ip_address = request.client.host if request.client else ""
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username, action="toggle_ip_allowlist",
|
||
target_type="setting",
|
||
detail=f"登录IP白名单: {'启用' if enabled else '关闭'}",
|
||
ip_address=ip_address,
|
||
))
|
||
return {"success": True, "enabled": enabled}
|
||
|
||
|
||
@router.post("/ip-allowlist/manual", response_model=dict)
|
||
async def add_manual_ips(
|
||
payload: IpAllowlistRequest,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Append IPs to the manual list and trigger allowlist rebuild."""
|
||
from server.config import settings as _settings
|
||
_validate_ip_list(payload.ips)
|
||
|
||
existing = [ip.strip() for ip in (_settings.LOGIN_MANUAL_IPS or "").split(",") if ip.strip()]
|
||
new_ips = [ip.strip() for ip in payload.ips if ip.strip()]
|
||
merged = list(dict.fromkeys(existing + new_ips))
|
||
val = ",".join(merged)
|
||
repo = SettingRepositoryImpl(db)
|
||
await repo.set("login_manual_ips", val)
|
||
_settings.LOGIN_MANUAL_IPS = val
|
||
|
||
# S-07: Audit log
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="add_manual_ips",
|
||
target_type="setting",
|
||
detail=f"添加 {len(new_ips)} 条手动 IP: {', '.join(new_ips[:5])}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
from server.background.ip_allowlist_refresh import _do_refresh
|
||
import asyncio
|
||
asyncio.create_task(_do_refresh())
|
||
return {"success": True, "manual_ips": merged}
|
||
|
||
|
||
@router.delete("/ip-allowlist/ip", response_model=dict)
|
||
async def remove_allowlist_ip(
|
||
ip: str,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Remove one IP from the manual list and rebuild."""
|
||
from server.config import settings as _settings
|
||
|
||
existing = [i.strip() for i in (_settings.LOGIN_MANUAL_IPS or "").split(",") if i.strip()]
|
||
remaining = [i for i in existing if i != ip.strip()]
|
||
val = ",".join(remaining)
|
||
repo = SettingRepositoryImpl(db)
|
||
await repo.set("login_manual_ips", val)
|
||
_settings.LOGIN_MANUAL_IPS = val
|
||
|
||
# S-07: Audit log
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="remove_allowlist_ip",
|
||
target_type="setting",
|
||
detail=f"移除白名单 IP: {ip}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
from server.background.ip_allowlist_refresh import _do_refresh
|
||
import asyncio
|
||
asyncio.create_task(_do_refresh())
|
||
return {"success": True, "removed": ip, "remaining": remaining}
|
||
|
||
|
||
# ── Audit Logs ──
|
||
|
||
audit_router = APIRouter(prefix="/api/audit", tags=["audit"])
|
||
|
||
|
||
@audit_router.get("/", response_model=dict)
|
||
async def list_audit_logs(
|
||
action: Optional[str] = None,
|
||
admin_username: Optional[str] = None,
|
||
date_from: Optional[str] = None, # ISO date: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS
|
||
date_to: Optional[str] = None,
|
||
limit: int = 50,
|
||
offset: int = 0,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""List audit logs with pagination, action filter, admin filter, and date range."""
|
||
repo = AuditLogRepositoryImpl(db)
|
||
logs, total = await repo.query(
|
||
action=action,
|
||
admin_username=admin_username,
|
||
date_from=date_from,
|
||
date_to=date_to,
|
||
limit=limit,
|
||
offset=offset,
|
||
)
|
||
return {
|
||
"total": total,
|
||
"limit": limit,
|
||
"offset": offset,
|
||
"items": [_audit_to_dict(log) for log in logs],
|
||
}
|
||
|
||
|
||
# ── Retry Jobs ──
|
||
|
||
retry_router = APIRouter(prefix="/api/retries", tags=["retries"])
|
||
|
||
|
||
@retry_router.get("/", response_model=list)
|
||
async def list_retry_jobs(
|
||
limit: int = 100,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""List all retry jobs (not just pending)"""
|
||
repo = PushRetryJobRepositoryImpl(db)
|
||
jobs = await repo.get_all(limit)
|
||
return [_retry_to_dict(j) for j in jobs]
|
||
|
||
|
||
@retry_router.post("/{id}/retry", response_model=dict)
|
||
async def retry_job(
|
||
id: int,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Manually retry a failed/pending job"""
|
||
repo = PushRetryJobRepositoryImpl(db)
|
||
job = await repo.get_by_id(id)
|
||
if not job:
|
||
raise HTTPException(status_code=404, detail="Retry job not found")
|
||
|
||
# Reset the job to pending state for immediate retry
|
||
job = await repo.update_status(
|
||
id, "pending",
|
||
retry_count=0,
|
||
next_retry_at=None,
|
||
last_error=None,
|
||
)
|
||
|
||
# Audit log
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="retry_job",
|
||
target_type="retry",
|
||
target_id=id,
|
||
detail=f"手动重试任务 #{id}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
return _retry_to_dict(job)
|
||
|
||
|
||
@retry_router.delete("/{id}", status_code=204)
|
||
async def delete_retry_job(
|
||
id: int,
|
||
request: Request,
|
||
admin: Admin = Depends(get_current_admin),
|
||
db: AsyncSession = Depends(get_db),
|
||
):
|
||
"""Delete a retry job"""
|
||
repo = PushRetryJobRepositoryImpl(db)
|
||
job = await repo.get_by_id(id)
|
||
if not job:
|
||
raise HTTPException(status_code=404, detail="Retry job not found")
|
||
|
||
# Audit log
|
||
audit_repo = AuditLogRepositoryImpl(db)
|
||
await audit_repo.create(AuditLog(
|
||
admin_username=admin.username,
|
||
action="delete_retry",
|
||
target_type="retry",
|
||
target_id=id,
|
||
detail=f"删除重试任务 #{id}",
|
||
ip_address=request.client.host if request.client else "",
|
||
))
|
||
|
||
await repo.delete(id)
|
||
|
||
|
||
# ── Helper functions ──
|
||
|
||
def _schedule_to_dict(schedule: PushSchedule) -> dict:
|
||
from server.background.schedule_runner import compute_schedule_next_run
|
||
|
||
next_run_dt = compute_schedule_next_run(schedule)
|
||
return {
|
||
"id": schedule.id,
|
||
"name": schedule.name,
|
||
"source_path": schedule.source_path,
|
||
"target_path": getattr(schedule, "target_path", None),
|
||
"server_ids": schedule.server_ids,
|
||
"run_mode": getattr(schedule, "run_mode", None) or "once",
|
||
"cron_expr": schedule.cron_expr,
|
||
"fire_at": str(schedule.fire_at) if getattr(schedule, "fire_at", None) else None,
|
||
"sync_mode": schedule.sync_mode or "incremental",
|
||
"enabled": schedule.enabled,
|
||
"schedule_type": getattr(schedule, "schedule_type", None) or "push",
|
||
"script_id": getattr(schedule, "script_id", None),
|
||
"script_content": getattr(schedule, "script_content", None),
|
||
"exec_timeout": getattr(schedule, "exec_timeout", 60),
|
||
"long_task": getattr(schedule, "long_task", False),
|
||
"last_run_at": str(schedule.last_run_at) if schedule.last_run_at else None,
|
||
"next_run": str(next_run_dt) if next_run_dt else None,
|
||
"created_at": str(schedule.created_at) if schedule.created_at else None,
|
||
}
|
||
|
||
|
||
def _audit_to_dict(log: AuditLog) -> dict:
|
||
return {
|
||
"id": log.id,
|
||
"admin_username": log.admin_username,
|
||
"action": log.action,
|
||
"target_type": log.target_type,
|
||
"target_id": log.target_id,
|
||
# 前端历史字段别名
|
||
"resource_type": log.target_type,
|
||
"resource_id": log.target_id,
|
||
"detail": log.detail,
|
||
"ip_address": log.ip_address,
|
||
"created_at": str(log.created_at) if log.created_at else None,
|
||
}
|
||
|
||
|
||
def _retry_to_dict(job: PushRetryJob) -> dict:
|
||
return {
|
||
"id": job.id,
|
||
"server_id": job.server_id,
|
||
"server_name": job.server_name,
|
||
"operator": job.operator,
|
||
"source_path": job.source_path,
|
||
"target_path": job.target_path,
|
||
"status": job.status,
|
||
"retry_count": job.retry_count,
|
||
"max_retries": job.max_retries,
|
||
"next_retry_at": str(job.next_retry_at) if job.next_retry_at else None,
|
||
"last_error": job.last_error,
|
||
"created_at": str(job.created_at) if job.created_at else None,
|
||
}
|