qinglong
f7b4908322
API 认证 (16 个未保护端点 → 全部加 panel_auth): - 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...) - 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀 - 代理管理: 3 端点 (list/add/remove) - 系统状态: 2 HTTP + 1 WS (token 校验) - 插件页面: 3 端点 (page/sse/event) - 内部路由: 3 端点 (plugins/commands/data) 认证系统加固: - 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐 - 默认密码警告: 启动时检测并打印 critical 级别日志 - 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429 基础设施: - 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy - WebSocket 鉴权: query string token 校验 Co-Authored-By: Claude <noreply@anthropic.com>
41 lines
1.7 KiB
Python
41 lines
1.7 KiB
Python
from aiohttp import web
|
|
import json, logging
|
|
from ..utils.auth import panel_auth
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
def setup_plugin_web_routes(app, service_manager):
|
|
async def plugin_page(request):
|
|
name = request.match_info.get("name","")
|
|
ps = service_manager.get_service("plugin")
|
|
plugin = ps.plugins.get(name)
|
|
if not plugin or not hasattr(plugin, "get_web_pages"):
|
|
return web.Response(text=f"Plugin {name} not found", status=404)
|
|
pages = plugin.get_web_pages()
|
|
if name in pages:
|
|
return web.Response(text=pages[name]["html"], content_type="text/html")
|
|
return web.json_response({"error": "no web page"})
|
|
|
|
async def plugin_sse(request):
|
|
name = request.match_info.get("name","")
|
|
ps = service_manager.get_service("plugin")
|
|
plugin = ps.plugins.get(name)
|
|
if plugin and hasattr(plugin, "handle_sse"):
|
|
return await plugin.handle_sse(request)
|
|
return web.json_response({"error": "SSE not supported"}, status=404)
|
|
|
|
async def plugin_event(request):
|
|
name = request.match_info.get("name","")
|
|
data = await request.json()
|
|
ps = service_manager.get_service("plugin")
|
|
plugin = ps.plugins.get(name)
|
|
if plugin and hasattr(plugin, "push_sse_event"):
|
|
await plugin.push_sse_event(data.get("type","event"), data)
|
|
return web.json_response({"ok": True})
|
|
return web.json_response({"ok": False}, status=404)
|
|
|
|
app.router.add_get("/plugin/{name}", panel_auth(plugin_page))
|
|
app.router.add_get("/plugin/{name}/sse", panel_auth(plugin_sse))
|
|
app.router.add_post("/plugin/{name}/event", panel_auth(plugin_event))
|
|
logger.info("Plugin web routes registered (已加认证)")
|