9f6eb29820
feat: API Key 系统 — CRUD + panel_auth 集成 + 持久化
...
新增:
- services/web_panel/routes/apikeys.py — 创建/列表/删除 API Key
- panel_auth() 双重验证: Session Store → API Key fallback
- _check_plugin_auth() 支持 API Key
- API Key 持久化到 SenSuDB (config_kv 表)
- 格式: sk- + 48 hex chars
- 脱敏显示 (前8后4)
- 删除后立即失效 (401)
WebPanelManager 注册 apikeys 路由
Co-Authored-By: Claude <noreply@anthropic.com >
2026-06-13 14:25:55 +08:00
2da52e80d0
security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token
...
面板密码安全:
- 支持哈希存储 (password_hash/password_salt)
- 登录使用 secrets.compare_digest 时序安全比较
- 回退明文兼容旧配置
- 默认密码 admin 时打印 CRITICAL 警告
文件上传安全:
- 拒绝危险扩展名: .exe/.dll/.so/.sh/.bat/.ps1 等
- 拒绝敏感文件名: .htaccess/Makefile/Dockerfile 等
- 上传时检查并返回 403
CSRF 防护:
- panel_auth(csrf_protect=True) 参数
- 写操作需 X-CSRF-Token header 匹配 session token
- 保护范围: 文件删除/写入/创建/上传/重命名 + 项目启停 + 代理管理
Co-Authored-By: Claude <noreply@anthropic.com >
2026-06-13 14:07:38 +08:00
ff02b2e16d
security: P3 — 插件隔离默认开启 + SenSuDB 注册 + 审计日志
...
- plugins.isolation 默认 true (生产环境进程隔离)
- main.py 注册 SenSuDB 服务
- WebPanelManager 注入 sensu_db 到 app context
- 文件删除/写入操作写入审计日志 (audit_log 表)
- 修复 Session 持久化所需的数据库依赖
Co-Authored-By: Claude <noreply@anthropic.com >
2026-06-13 13:56:58 +08:00
fd715eac2b
feat: 文件管理器 + Windows兼容 + SVG主题适配 (v0.6.0)
...
新增:
- services/web_panel/routes/files.py — 全功能文件管理后端API (11个端点)
- pages/files.html + files.js — 文件管理前端 (浏览/编辑/上传/删除/右键菜单)
- 插件Picker API: window.open+postMessage唤出文件选择器
- 符号链接目录双层面包屑 (逻辑路径+物理路径)
- 文件系统全访问+跨平台 (Linux/Windows/macOS)
- permission_rules.yaml新增4个filemanager.*权限
修复:
- SVG fill=currentColor 日夜模式自适应
- 特殊目录容错 (/dev/fd损坏符号链接/proc)
- 面包屑每层级独立可点击+可编辑路径跳转
- ..行返回上级+data-is-dir补全
- rmlint→lstat回退 损坏符号链接不炸页面
文档:
- 插件开发指南新增第八章(文件管理器集成)
- 开发踩坑记录新增4条(特殊目录/双面包屑/SVG颜色/Windows)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-11 18:23:32 +08:00
fd0a97fec5
Fix login redirect: add /SenSu/index.html route, restart picks up new app.js
...
- /SenSu/index.html now serves login page (was 404 after cookie expiry)
- Fresh restart with latest page loader + inline script execution
- All routes verified: 200 OK
2026-06-11 14:47:37 +08:00
dd8a31e29a
Fix: proxy API prefix, version from config, remove auth from framework/system endpoints
...
- Proxy routes now use /SenSu/api/proxy (was missing prefix)
- Projects routes use dynamic prefix
- Version reads from config/framework/base_config.yaml
- Framework/System APIs no longer require auth (public info)
- Proxy init separated from route setup (avoids frozen router error)
- Version updated to v0.6.0
2026-06-11 14:37:28 +08:00
AskaEth
e52f7f3566
Phase 3: PluginWebMixin SDK + web plugin control panels
...
- New: sdk/plugin_web.py (PluginWebMixin: web pages, API routes, SSE)
- New: services/web_panel/routes/plugin_web.py (3 endpoints)
- New: plugins/example_plugin/dashboard.html (counter + SSE demo)
- Updated: example_plugin uses PluginWebMixin
- Tests: 28/28 passing
2026-06-10 20:54:11 +08:00
AskaEth
c680fea8e0
Phase 2: ProxyService reverse proxy (HTTP+WebSocket forwarding)
...
- New: services/proxy_service.py (path->URL mapping)
- New: services/web_panel/routes/proxy.py (3 REST endpoints)
- New: static/web_panel/pages/proxy.html (WebUI)
- Tests: 28/28 passing
2026-06-10 20:47:17 +08:00
AskaEth
8dbf628dd6
Phase 1: ProjectEngine + PyEnvManager + project management WebUI
...
- New: services/project_engine.py (async subprocess manager)
- New: services/pyenv_manager.py (Python version + venv + git clone)
- New: services/web_panel/routes/projects.py (5 REST endpoints)
- New: static/web_panel/pages/projects.html (WebUI)
- Tests: 28/28 passing, API verified (GET /api/projects)
- Docs: Phase1_Progress.md (local)
2026-06-10 20:41:24 +08:00
AskaEth
e6875f0b4b
Initial commit: SenSu Alpha 0.2.0
...
- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests
Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)
2026-06-10 12:28:05 +08:00
qinglong
AskaEth