 qinglong
|
f3a6e5fbcd
|
feat: Sentinel 数字跳动动画 + 进度条平滑过渡
- 数字 count-up/down: requestAnimationFrame + ease-out cubic, 350ms
- 中间值过渡: 15%→22% 会显示 15.2,16.1,17.5...22.0
- 进度条: CSS transition 自动处理宽度变化
- 卡片 DOM 复用: 更新值而非重建 innerHTML
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 18:12:37 +08:00 |
|
|
qinglong
|
1d0f227267
|
fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取
SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 18:07:47 +08:00 |
|
|
qinglong
|
51c1ee84f0
|
feat: Sentinel 卡片数据刷新动画
- 卡片更新时背景闪烁 (card-flash keyframe)
- 进度条平滑过渡 (cubic-bezier .6s)
- 数值涨跌颜色: 绿涨↑ 红跌↓ 不变灰色
- 渐变进度条背景
- 存储前值用于趋势对比
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 18:06:06 +08:00 |
|
|
qinglong
|
c416b04798
|
fix: Sentinel 改用前端轮询替代 SSE (解决 EventSource 认证问题)
SSE 跨 panel_auth 认证层不可靠 → 改用 setInterval 每 2s fetch /sentinel/api/nodes
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 18:00:34 +08:00 |
|
|
qinglong
|
a21e092207
|
fix: Sentinel SSE URL — /SenSu/plugin/... → /plugin/... (匹配实际路由)
|
2026-06-13 17:56:57 +08:00 |
|
|
qinglong
|
af16549524
|
chore: 清理误提交的 base_config.yaml.bak
|
2026-06-13 17:46:33 +08:00 |
|
|
qinglong
|
5e06c17b52
|
fix: WebSocket 鉴权 — Cookie 优先 (支持 HttpOnly)
根因: panel_token 是 HttpOnly cookie, JS getCookie() 读不到
→ 前端 WS ?token= 参数为空 → 认证失败 → 仪表盘无数据
修复:
- _ws_auth_wrapper: Cookie 优先 → query token 备用 → API Key
- 浏览器同源 WS 自动发送 Cookie, 无需 ?token=
- dashboard.js / logs.js 移除多余的 getCookie+?token=
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 17:45:58 +08:00 |
|
|
qinglong
|
557135c376
|
security: 配置文件模板化 — base_config.yaml 不再入库
- base_config.yaml → .gitignore (含真实密码不入库)
- 新增 base_config.yaml.example 模板 (password: CHANGE_ME)
- InitService: 检测缺失时自动从模板复制
- 首次启动自动创建配置文件
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 15:20:14 +08:00 |
|
|
qinglong
|
634496d975
|
security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护
修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-06-13 15:13:56 +08:00 |
|
 AskaEth
|
e6875f0b4b
|
Initial commit: SenSu Alpha 0.2.0
- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests
Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)
|
2026-06-10 12:28:05 +08:00 |
|