Nexus Deploy
b866e944ab
Apply sync/install/auth/schedule/retry/agent/settings fixes from full code review; document accepted WS and Agent legacy risks for solo ops. Co-authored-by: Cursor <cursoragent@cursor.com>
1.7 KiB
1.7 KiB
审计 — 2026-06-04 Code Review P0/P1 修复
Step 3 规则扫描（H）
| H | 规则 | 文件 | 结论 |
|---|---|---|---|
| H1 | PY-08 静默吞错 | sync_engine_v2, auth_service | SAFE — 保留 logger，无空 pass |
| H2 | SEC 安装无 JWT | install.py | FIXED — install_token + compare_digest |
| H3 | SEC 路径遍历 | posix_paths.py | FIXED — 统一 resolve_nexus_push_source_path |
| H4 | CONC AsyncSession | sync_engine_v2.py | FIXED — _db_lock 串行 DB |
| H5 | CONC refresh 双花 | auth_service.py | FIXED — Redis Lua SREM+SADD |
| H6 | FE 开放重定向 | LoginPage.vue | FIXED |
| H7 | FE WS 泄漏 | usePushProgress.ts | FIXED |
Closure
| H | 判定 | 依据 |
|---|---|---|
| H1 | SAFE | except 均 logging |
| H2 | FIXED | install.py:572+ _verify_install_token |
| H3 | FIXED | posix_paths.py:103-114 |
| H4 | FIXED | sync_engine_v2.py _db_lock |
| H5 | FIXED | auth_service _rotate_refresh_token Lua |
| H6 | FIXED | LoginPage redirect 校验 |
| H7 | FIXED | disconnectProgressWs + 4001 logout |
改动文件清单
- server/application/services/sync_engine_v2.py
- server/application/services/auth_service.py
- server/api/install.py
- server/api/sync_v2.py
- server/utils/posix_paths.py
- server/main.py
- server/background/schedule_runner.py
- web/app/install.html
- frontend/src/pages/LoginPage.vue
- frontend/src/composables/push/usePushProgress.ts
- tests/test_security_unit.py
DoD
- ruff 零错误（改动文件）
- import server.main 成功
- pytest test_security_unit 通过
- frontend type-check 通过
- changelog ≥10 行
- 生产部署与健康检查（待用户推送后执行）