qinglong
f7b4908322
API 认证 (16 个未保护端点 → 全部加 panel_auth): - 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...) - 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀 - 代理管理: 3 端点 (list/add/remove) - 系统状态: 2 HTTP + 1 WS (token 校验) - 插件页面: 3 端点 (page/sse/event) - 内部路由: 3 端点 (plugins/commands/data) 认证系统加固: - 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐 - 默认密码警告: 启动时检测并打印 critical 级别日志 - 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429 基础设施: - 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy - WebSocket 鉴权: query string token 校验 Co-Authored-By: Claude <noreply@anthropic.com>
33 lines
1.4 KiB
Python
33 lines
1.4 KiB
Python
from aiohttp import web, ClientSession
|
|
import json, logging, asyncio
|
|
from ..utils.auth import panel_auth
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
def setup_proxy_routes(app, service_manager, prefix=''):
|
|
async def list_proxies(request):
|
|
ps = service_manager.get_service("proxy")
|
|
return web.json_response({"proxies": ps.list_proxies() if ps else []})
|
|
|
|
async def add_proxy(request):
|
|
try:
|
|
data = await request.json()
|
|
ps = service_manager.get_service("proxy")
|
|
ok = await ps.register_proxy(
|
|
path=data.get("path",""), target_url=data.get("target",""),
|
|
description=data.get("description",""), is_external=data.get("external",False))
|
|
return web.json_response({"ok": ok})
|
|
except Exception as e:
|
|
return web.json_response({"ok": False, "error": str(e)}, status=400)
|
|
|
|
async def remove_proxy(request):
|
|
path = request.match_info.get("path","")
|
|
ps = service_manager.get_service("proxy")
|
|
ps.unregister_proxy(path)
|
|
return web.json_response({"ok": True})
|
|
|
|
app.router.add_get(f'{prefix}/api/proxy', panel_auth(list_proxies))
|
|
app.router.add_post(f'{prefix}/api/proxy', panel_auth(add_proxy))
|
|
app.router.add_delete(f'{prefix}/api/proxy/{{path}}', panel_auth(remove_proxy))
|
|
logger.info(f'🔀 代理路由已注册 ({prefix}/api/proxy) (已加认证)')
|