security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期

4.3 文件管理器路径收紧:
- 默认移除 Path('/') 全文件系统访问
- 仅允许项目目录 + data/ + 环境变量 SENSU_FILE_ROOTS 指定路径

3.4 插件路由鉴权修复:
- _check_plugin_auth 增加 panel_token 用户身份验证
- 先验证用户登录, 再检查插件权限

4.2 错误脱敏:
- security middleware 捕获异常 → 通用 'Internal server error'
- 堆栈详情仅写入日志, 不暴露给客户端

4.4 命令参数校验:
- POST /api/command 拒绝 shell 元字符 (;&|`$(){}!#~<>)
- 防止命令注入

4.5 Session 持久化:
- 登录/退出时保存到 SenSuDB.config_kv
- 框架重启后自动恢复已持久化会话

4.6 Token 过期: 24h → 2h

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/routes/auth.py

@@ -49,14 +49,57 @@ def _clear_fails(ip: str):
     _LOGIN_FAILS.pop(ip, None)
 
 
+def _load_sessions_from_db(app):
+    """从数据库恢复持久化的 session"""
+    try:
+        db = app.get("sensu_db")
+        if not db:
+            sm = app.get("service_manager")
+            if sm:
+                try:
+                    db = sm.get_service("sensu_db")
+                except Exception:
+                    pass
+        if db:
+            raw = db.get_config("panel_sessions", "{}")
+            stored = json.loads(raw) if raw else {}
+            for token, info in stored.items():
+                PANEL_SESSION_STORE[token] = info
+            if stored:
+                logger.info(f"📦 从数据库恢复了 {len(stored)} 个会话")
+    except Exception as e:
+        logger.warning(f"会话恢复失败: {e}")
+
+
+def _save_sessions_to_db(app):
+    """持久化当前 session 到数据库"""
+    try:
+        db = app.get("sensu_db")
+        if not db:
+            sm = app.get("service_manager")
+            if sm:
+                try:
+                    db = sm.get_service("sensu_db")
+                except Exception:
+                    pass
+        if db:
+            db.set_config("panel_sessions", json.dumps(PANEL_SESSION_STORE))
+    except Exception as e:
+        logger.debug(f"会话持久化失败: {e}")
+
+
 def setup_routes(app, prefix=''):
     """注册面板认证路由"""
+    import json as _json
+
     # 🟢 关键：将 Session Store 挂载到 app，供拦截器读取
     app['panel_session_store'] = PANEL_SESSION_STORE
-    
+
+    # 从数据库恢复持久化会话
+    _load_sessions_from_db(app)
+
     # 路由注册
     app.router.add_post(f'{prefix}/api/login', handle_login)
-    # 退出和状态检查都需要拦截
     app.router.add_post(f'{prefix}/api/logout', panel_auth(handle_logout))
     app.router.add_get(f'{prefix}/api/auth/status', panel_auth(handle_auth_status))
 
@@ -92,7 +135,8 @@ async def handle_login(req):
                 "login_time": __import__('time').time()
             }
             PANEL_SESSION_STORE[token] = user_info
-            
+            _save_sessions_to_db(req.app)  # 持久化到数据库
+
             logger.info(f"✅ 面板登录成功: {username} (Session: {token[:4]}...)")
             
             resp = web.json_response({"success": True, "username": username})
@@ -113,8 +157,9 @@ async def handle_logout(req):
     token = req.cookies.get("panel_token")
     if token and token in PANEL_SESSION_STORE:
         del PANEL_SESSION_STORE[token]
+        _save_sessions_to_db(req.app)  # 持久化删除
         logger.info(f"👋 用户退出登录")
-        
+
     resp = web.json_response({"success": True})
     resp.del_cookie("panel_token")
     return resp