qinglong
f7b4908322
API 认证 (16 个未保护端点 → 全部加 panel_auth): - 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...) - 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀 - 代理管理: 3 端点 (list/add/remove) - 系统状态: 2 HTTP + 1 WS (token 校验) - 插件页面: 3 端点 (page/sse/event) - 内部路由: 3 端点 (plugins/commands/data) 认证系统加固: - 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐 - 默认密码警告: 启动时检测并打印 critical 级别日志 - 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429 基础设施: - 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy - WebSocket 鉴权: query string token 校验 Co-Authored-By: Claude <noreply@anthropic.com>
63 lines
2.6 KiB
Python
63 lines
2.6 KiB
Python
from aiohttp import web
|
|
import json, logging
|
|
from ..utils.auth import panel_auth
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
def _get_engine(request):
|
|
sm = request.app.get("service_manager")
|
|
if sm and sm.has_service("project_engine"):
|
|
return sm.get_service("project_engine")
|
|
return None
|
|
|
|
def setup_project_routes(app, service_manager, prefix=''):
|
|
app["service_manager"] = service_manager
|
|
|
|
async def list_projects(request):
|
|
eng = _get_engine(request)
|
|
return web.json_response({"projects": eng.list_projects() if eng else []})
|
|
|
|
async def run_project(request):
|
|
try:
|
|
data = await request.json()
|
|
eng = _get_engine(request)
|
|
if not eng:
|
|
return web.json_response({"ok": False, "error": "engine not ready"}, status=503)
|
|
ok = await eng.run_project(
|
|
name=data.get("name","unnamed"), cmd=data.get("cmd",[]),
|
|
cwd=data.get("cwd","."), env=data.get("env",{}),
|
|
port=data.get("port",0), proxy_path=data.get("proxy_path",""))
|
|
return web.json_response({"ok": ok})
|
|
except Exception as e:
|
|
return web.json_response({"ok": False, "error": str(e)}, status=400)
|
|
|
|
async def stop_project(request):
|
|
name = request.match_info.get("name","")
|
|
eng = _get_engine(request)
|
|
ok = await eng.stop_project(name) if eng else False
|
|
return web.json_response({"ok": ok})
|
|
|
|
async def get_logs(request):
|
|
name = request.match_info.get("name","")
|
|
tail = int(request.query.get("tail", 50))
|
|
eng = _get_engine(request)
|
|
return web.json_response({"logs": eng.get_logs(name, tail) if eng else []})
|
|
|
|
async def send_stdin(request):
|
|
name = request.match_info.get("name","")
|
|
data = await request.json()
|
|
eng = _get_engine(request)
|
|
ok = await eng.send_stdin(name, data.get("text","")) if eng else False
|
|
return web.json_response({"ok": ok})
|
|
|
|
async def project_page(request):
|
|
return web.FileResponse("static/web_panel/pages/projects.html")
|
|
|
|
app.router.add_get(f'{prefix}/api/projects', panel_auth(list_projects))
|
|
app.router.add_post(f'{prefix}/api/projects/run', panel_auth(run_project))
|
|
app.router.add_get(f'{prefix}/api/projects/{{name}}/logs', panel_auth(get_logs))
|
|
app.router.add_post(f'{prefix}/api/projects/{{name}}/stop', panel_auth(stop_project))
|
|
app.router.add_post(f'{prefix}/api/projects/{{name}}/stdin', panel_auth(send_stdin))
|
|
app.router.add_get(f'{prefix}/pages/projects', panel_auth(project_page))
|
|
logger.info("📦 项目管理路由已注册 (已加认证)")
|