fix(channel,user): owner 车道只认白名单，堵住群主/伪造 role 冒充主人（裁决 06.4.2/06.4.3/06.4.4）
- 适配器只描述平台身份：qq_obv11 的 owner/admin 一律上报 RoleMember，不再上报 RoleOwner - session 层唯一判主点只认白名单（owner.yaml Accounts ∪ 每渠道 adminIds），nil 档案 fail-closed 拒绝 - 新增「每渠道管理员层」：channels.json ChannelAccount.adminIds[] → runtimeconfig.AdminIDs → OwnerProfile.SetPlatformAdmins（整体替换语义，热重载后移除的 id 立即失效） - 组合根接线：启动即播种、面板保存先灌白名单再重载适配器（cmd/cyrene/wire_channels.go + 4 条端到端单测） - 06.4.3 节流与参与度状态按会话独立计数（ConversationKey 三处统一，空会话 GC）；06.4.4 未知平台主动发言保守默认 1 条/分钟
This commit is contained in:
AskaEth committed
1 parent
7e7f53bb41
commit
af8591b78a
30 files changed
+1289
-144
No files matched your search
@@ -31,19 +31,26 @@ type GateVerdict struct {
|
||||
Pruned []UnifiedMessage
|
||||
}
|
||||
|
||||
// FlowGateOptions configures a per-adapter ingress gate. Every limit is
|
||||
// FlowGateOptions configures a per-account ingress gate. Every limit is
|
||||
// independent and a zero value disables that limit, so an account that does not
|
||||
// declare the new fields keeps its previous unlocked behavior (backward
|
||||
// compatible, design/12 §6 实现要点).
|
||||
//
|
||||
// **计数键 = 会话级**（裁决 06.4.3）：GroupMsgPerMin 与 MaxMessages 都按
|
||||
// ConversationKey（`platform+channelID+groupID/peerID`）每个群聊/私聊独立计数，不再在
|
||||
// 适配器顶层汇总——两个群并发互不挤占。MsgPerMin 是防刷屏的**账号级总量护栏**，按设计
|
||||
// 口径仍留在适配器顶层，不随会话拆分。
|
||||
type FlowGateOptions struct {
|
||||
// GroupMsgPerMin caps group-chat inbound messages per minute (design/12 §6
|
||||
// 策略三). Zero disables the group limit.
|
||||
// GroupMsgPerMin caps group-chat inbound messages per minute **per
|
||||
// conversation** (design/12 §6 策略三 / 裁决 06.4.3). Zero disables the limit.
|
||||
GroupMsgPerMin int
|
||||
// MsgPerMin caps total inbound non-owner messages per minute. Zero disables it.
|
||||
// MsgPerMin caps total inbound non-owner messages per minute across the whole
|
||||
// account — the anti-flood total guard. Zero disables it.
|
||||
MsgPerMin int
|
||||
// MaxMessages is the total pending-message cap. When the pending set nears it
|
||||
// the Reviewer is invoked to prune noise; with no Reviewer the oldest messages
|
||||
// are evicted FIFO. Zero disables the cap (design/12 §6 策略四).
|
||||
// MaxMessages is the **per-conversation** pending-message cap (design/12 §6
|
||||
// 策略四 / 裁决 06.4.3). When a conversation's pending set nears it the Reviewer
|
||||
// is invoked to prune noise; with no Reviewer the oldest messages are evicted
|
||||
// FIFO. Zero disables the cap.
|
||||
MaxMessages int
|
||||
// Window is the sliding window over which the per-minute limits are counted.
|
||||
// Zero uses defaultRateWindow.
|
||||
@@ -72,9 +79,45 @@ const (
|
||||
// FlowCapDefault is the protective default total-cap of 50 pending messages
|
||||
// (design/12 §6 策略四).
|
||||
FlowCapDefault = 50
|
||||
// sessionGCInterval is how many admissions pass between idle-conversation sweeps,
|
||||
// so a long-lived gate that has seen many conversations does not grow unbounded.
|
||||
sessionGCInterval = 256
|
||||
)
|
||||
|
||||
// FlowGate is a concurrency-safe, per-adapter ingress gate implementing the two
|
||||
// ConversationKey 返回一条消息所属会话的节流键（裁决 06.4.3）：
|
||||
// `platform+channelID+groupID/peerID`——群聊按 (平台, 群) 独立计数，私聊按 (平台, 对端)
|
||||
// 独立计数。它同时被入站滑窗（本文件的 FlowGate）与出处参与引擎
|
||||
// (channelbridge.engageKey) 使用，使「每会话独立计数」只有一处口径。
|
||||
// 多账号（platform:confId）之间的隔离由每个账号各自的 FlowGate/适配器实例承担。
|
||||
func ConversationKey(msg UnifiedMessage) string {
|
||||
conv := msg.GroupID
|
||||
if msg.IsGroup() {
|
||||
if conv == "" {
|
||||
// 群聊缺 group id 时退回 channel id（qq-obv11 里 channelID 就是群号），
|
||||
// 避免同一个群被拆成多个桶而让限流失效。
|
||||
conv = msg.ChannelID
|
||||
}
|
||||
} else {
|
||||
conv = msg.SenderID
|
||||
if conv == "" {
|
||||
conv = msg.Sender.UserID
|
||||
}
|
||||
if conv == "" {
|
||||
conv = msg.ChannelID
|
||||
}
|
||||
}
|
||||
return msg.Platform + "|" + msg.ChannelID + "|" + conv
|
||||
}
|
||||
|
||||
// flowSession 是一个会话（群聊/私聊）独立的节流状态。FlowGate 按 ConversationKey 为
|
||||
// 每个会话保存一份，因此两个群并发互不挤占（裁决 06.4.3）。
|
||||
type flowSession struct {
|
||||
groupHits []time.Time
|
||||
buffer []queuedMsg
|
||||
lastReview time.Time
|
||||
}
|
||||
|
||||
// FlowGate is a concurrency-safe, per-account ingress gate implementing the two
|
||||
// measures from design/12 §6 策略三/四:
|
||||
//
|
||||
// - 策略三: a sliding-window rate limit on group chat (and, optionally, all
|
||||
@@ -84,6 +127,8 @@ const (
|
||||
// invoked to prune low-value messages; with no Reviewer the oldest messages are
|
||||
// evicted FIFO. Either way every dropped message is audited.
|
||||
//
|
||||
// 两个策略的计数都按会话独立（裁决 06.4.3），只有 MsgPerMin 总量护栏按账号汇总。
|
||||
//
|
||||
// Owner-private messages are not routed through the gate (the caller bypasses it),
|
||||
// so the owner is never throttled or pruned. Identity is never examined here.
|
||||
type FlowGate struct {
|
||||
@@ -96,12 +141,11 @@ type FlowGate struct {
|
||||
onPruned func(UnifiedMessage, string)
|
||||
now func() time.Time
|
||||
|
||||
mu sync.Mutex
|
||||
groupHits []time.Time
|
||||
totalHits []time.Time
|
||||
buffer []queuedMsg
|
||||
lastReview time.Time
|
||||
seq uint64
|
||||
mu sync.Mutex
|
||||
totalHits []time.Time
|
||||
sessions map[string]*flowSession
|
||||
admitted uint64
|
||||
seq uint64
|
||||
}
|
||||
|
||||
// queuedMsg wraps a buffer entry with a stable sequence so pruning decisions can
|
||||
@@ -123,6 +167,7 @@ func NewFlowGate(opts FlowGateOptions) *FlowGate {
|
||||
review: opts.Review,
|
||||
onPruned: opts.OnPruned,
|
||||
now: opts.Now,
|
||||
sessions: make(map[string]*flowSession),
|
||||
}
|
||||
if g.window <= 0 {
|
||||
g.window = defaultRateWindow
|
||||
@@ -139,23 +184,30 @@ func NewFlowGate(opts FlowGateOptions) *FlowGate {
|
||||
return g
|
||||
}
|
||||
|
||||
// Admit applies the rate limit then the total-cap/review gate to one inbound
|
||||
// message. It returns a verdict telling the caller whether to proceed; messages
|
||||
// that the gate drops are returned (and audited) so nothing is lost silently.
|
||||
// Admit applies the rate limits then the per-conversation cap/review gate to one
|
||||
// inbound message. It returns a verdict telling the caller whether to proceed;
|
||||
// messages that the gate drops are returned (and audited) so nothing is lost
|
||||
// silently.
|
||||
//
|
||||
// 计数按会话独立（裁决 06.4.3）：群聊滑窗与待处理上限都落在 ConversationKey 对应的
|
||||
// flowSession 上（两个群并发互不挤占），只有 MsgPerMin 这一账号级总量护栏仍按适配器汇总。
|
||||
func (g *FlowGate) Admit(ctx context.Context, msg UnifiedMessage) GateVerdict {
|
||||
now := g.now()
|
||||
key := ConversationKey(msg)
|
||||
g.mu.Lock()
|
||||
defer g.mu.Unlock()
|
||||
g.maybeGCLocked(now)
|
||||
|
||||
// 策略三: sliding-window rate limits. Group chat has its own cap; MsgPerMin is
|
||||
// an optional total cap across all non-owner messages. Over-limit messages are
|
||||
// dropped at the door (downgraded) instead of blocking.
|
||||
// 策略三（会话级）: sliding-window rate limits. 群聊上限按每个群独立计数；MsgPerMin
|
||||
// 是账号级的非主人消息总量护栏。Over-limit messages are dropped at the door
|
||||
// (downgraded) instead of blocking.
|
||||
if g.groupPerMin > 0 && msg.ChannelType == ChannelGroup {
|
||||
g.groupHits = g.trimHits(g.groupHits, now)
|
||||
if len(g.groupHits) >= g.groupPerMin {
|
||||
st := g.sessionLocked(key)
|
||||
st.groupHits = g.trimHits(st.groupHits, now)
|
||||
if len(st.groupHits) >= g.groupPerMin {
|
||||
return g.drop("rate_limited", msg)
|
||||
}
|
||||
g.groupHits = append(g.groupHits, now)
|
||||
st.groupHits = append(st.groupHits, now)
|
||||
}
|
||||
if g.msgPerMin > 0 {
|
||||
g.totalHits = g.trimHits(g.totalHits, now)
|
||||
@@ -169,29 +221,31 @@ func (g *FlowGate) Admit(ctx context.Context, msg UnifiedMessage) GateVerdict {
|
||||
return GateVerdict{Proceed: true}
|
||||
}
|
||||
|
||||
// 策略四: add to the pending set, then prune when it nears the cap.
|
||||
// 策略四（会话级）: add to this conversation's pending set, then prune when it
|
||||
// nears the cap.
|
||||
st := g.sessionLocked(key)
|
||||
g.seq++
|
||||
seq := g.seq
|
||||
g.buffer = append(g.buffer, queuedMsg{seq: seq, msg: msg})
|
||||
st.buffer = append(st.buffer, queuedMsg{seq: seq, msg: msg})
|
||||
|
||||
var dropped []queuedMsg
|
||||
if g.review != nil && len(g.buffer) >= g.reviewAt && !g.reviewRecently(now) {
|
||||
keep, err := g.review(ctx, queueMessages(g.buffer))
|
||||
if g.review != nil && len(st.buffer) >= g.reviewAt && !g.reviewRecently(st, now) {
|
||||
keep, err := g.review(ctx, queueMessages(st.buffer))
|
||||
if err == nil {
|
||||
g.buffer, dropped = g.applyReview(g.buffer, keep)
|
||||
g.lastReview = now
|
||||
st.buffer, dropped = g.applyReview(st.buffer, keep)
|
||||
st.lastReview = now
|
||||
g.auditDropped(dropped, "review_pruned")
|
||||
}
|
||||
}
|
||||
if len(g.buffer) > g.maxMessages {
|
||||
n := len(g.buffer) - g.maxMessages
|
||||
if len(st.buffer) > g.maxMessages {
|
||||
n := len(st.buffer) - g.maxMessages
|
||||
var evicted []queuedMsg
|
||||
g.buffer, evicted = g.dropFront(g.buffer, n)
|
||||
st.buffer, evicted = g.dropFront(st.buffer, n)
|
||||
dropped = append(dropped, evicted...)
|
||||
g.auditDropped(evicted, "capped")
|
||||
}
|
||||
|
||||
if !g.containsSeq(seq) {
|
||||
if !bufferHasSeq(st.buffer, seq) {
|
||||
reason := "capped"
|
||||
if containsSeq(dropped, seq) {
|
||||
reason = "review_pruned"
|
||||
@@ -213,13 +267,41 @@ func (g *FlowGate) drop(reason string, msg UnifiedMessage) GateVerdict {
|
||||
return v
|
||||
}
|
||||
|
||||
// sessionLocked 返回 key 对应的会话节流状态，首次使用时惰性创建。调用方须持有 g.mu。
|
||||
func (g *FlowGate) sessionLocked(key string) *flowSession {
|
||||
if g.sessions == nil {
|
||||
g.sessions = make(map[string]*flowSession)
|
||||
}
|
||||
st := g.sessions[key]
|
||||
if st == nil {
|
||||
st = &flowSession{}
|
||||
g.sessions[key] = st
|
||||
}
|
||||
return st
|
||||
}
|
||||
|
||||
// maybeGCLocked 每 sessionGCInterval 次放行清理一次空闲会话，避免会话状态表随历史会话
|
||||
// 无界增长：滑窗时间戳全部过期且待处理队列为空的会话直接删除。调用方须持有 g.mu。
|
||||
func (g *FlowGate) maybeGCLocked(now time.Time) {
|
||||
g.admitted++
|
||||
if g.admitted%sessionGCInterval != 0 {
|
||||
return
|
||||
}
|
||||
for key, st := range g.sessions {
|
||||
st.groupHits = g.trimHits(st.groupHits, now)
|
||||
if len(st.groupHits) == 0 && len(st.buffer) == 0 {
|
||||
delete(g.sessions, key)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// reviewRecently throttles review so it does not run on every message: it fires at
|
||||
// most once per window, which is the cost guard for the review model.
|
||||
func (g *FlowGate) reviewRecently(now time.Time) bool {
|
||||
if g.lastReview.IsZero() {
|
||||
// most once per window per conversation, which is the cost guard for the review model.
|
||||
func (g *FlowGate) reviewRecently(st *flowSession, now time.Time) bool {
|
||||
if st == nil || st.lastReview.IsZero() {
|
||||
return false
|
||||
}
|
||||
return now.Sub(g.lastReview) < g.window
|
||||
return now.Sub(st.lastReview) < g.window
|
||||
}
|
||||
|
||||
// trimHits drops event timestamps older than the sliding window.
|
||||
@@ -265,9 +347,10 @@ func (g *FlowGate) dropFront(buffer []queuedMsg, n int) (kept, dropped []queuedM
|
||||
return buffer[n:], append([]queuedMsg(nil), buffer[:n]...)
|
||||
}
|
||||
|
||||
// containsSeq reports whether an entry with the given sequence is still buffered.
|
||||
func (g *FlowGate) containsSeq(seq uint64) bool {
|
||||
for _, e := range g.buffer {
|
||||
// bufferHasSeq reports whether an entry with the given sequence is still buffered
|
||||
// in the conversation's pending set.
|
||||
func bufferHasSeq(buffer []queuedMsg, seq uint64) bool {
|
||||
for _, e := range buffer {
|
||||
if e.seq == seq {
|
||||
return true
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user