AskaEth
e6875f0b4b
- 13-service async plugin framework - Textual TUI with CLI fallback - Plugin hot-reload + permission system - Web management panel (aiohttp) - Bridge-based inter-module communication - 10 regression tests Fixes applied: - PBKDF2-SHA256 auth (was plain SHA256) - Auth bypass removed (was allow-all on fail) - Bare excepts replaced with logged errors - CatFramework/DreamSu -> SenSu naming unified - ServiceManager: health checks + startup_order - Env var credentials (SENSU_ADMIN_PASSWORD etc)
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
|
|
import functools
|
|
from aiohttp import web
|
|
|
|
def panel_auth(handler):
|
|
"""面板专用鉴权装饰器：基于面板自有的 Session Store 验证"""
|
|
@functools.wraps(handler)
|
|
async def wrapper(request, *args, **kwargs):
|
|
# 1. 获取 Token
|
|
token = request.cookies.get("panel_token")
|
|
if not token and request.headers.get("Authorization", "").startswith("Bearer "):
|
|
token = request.headers["Authorization"].split(" ", 1)[1]
|
|
|
|
is_valid = False
|
|
|
|
# 2. 从面板 Session Store 验证
|
|
session_store = request.app.get('panel_session_store', {})
|
|
if token and token in session_store:
|
|
is_valid = True
|
|
# 验证通过，将用户信息注入 request 供后续使用
|
|
request['user'] = session_store[token]
|
|
|
|
# 3. 拦截逻辑 (不再依赖外部 AuthService，确保安全隔离)
|
|
if not is_valid:
|
|
# 返回 401 并附带提示，前端可据此判断状态
|
|
return web.json_response({
|
|
"error": "未认证或会话已过期",
|
|
"status": 401
|
|
}, status=401)
|
|
|
|
return await handler(request, *args, **kwargs)
|
|
return wrapper
|