shaw
0ddd58aaf9
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护： 审计日志（admin-only 可见，用户不可见） - 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理 - 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类 请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取） - 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url 保留以便追责）；非 JSON body 不入库 - 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许， 清空后同步写入留痕记录 会话 IP/UA 绑定（默认开启，可在系统设置关闭） - JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求 重新登录；旧 token 无指纹时放行以平滑升级 敏感操作 step-up 2FA（sudo 窗口 15 分钟） - 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试 - API key 查看按需求暂不加强管控 前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、 step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
73 lines
1.7 KiB
Go
73 lines
1.7 KiB
Go
package routes
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/handler"
|
|
servermiddleware "github.com/Wei-Shaw/sub2api/internal/server/middleware"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func newAuthRoutesTestRouter(redisClient *redis.Client) *gin.Engine {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
v1 := router.Group("/api/v1")
|
|
|
|
RegisterAuthRoutes(
|
|
v1,
|
|
&handler.Handlers{
|
|
Auth: &handler.AuthHandler{},
|
|
Setting: &handler.SettingHandler{},
|
|
},
|
|
servermiddleware.JWTAuthMiddleware(func(c *gin.Context) {
|
|
c.Next()
|
|
}),
|
|
servermiddleware.AuditLogMiddleware(func(c *gin.Context) {
|
|
c.Next()
|
|
}),
|
|
redisClient,
|
|
nil,
|
|
)
|
|
|
|
return router
|
|
}
|
|
|
|
func TestAuthRoutesRateLimitFailCloseWhenRedisUnavailable(t *testing.T) {
|
|
rdb := redis.NewClient(&redis.Options{
|
|
Addr: "127.0.0.1:1",
|
|
DialTimeout: 50 * time.Millisecond,
|
|
ReadTimeout: 50 * time.Millisecond,
|
|
WriteTimeout: 50 * time.Millisecond,
|
|
})
|
|
t.Cleanup(func() {
|
|
_ = rdb.Close()
|
|
})
|
|
|
|
router := newAuthRoutesTestRouter(rdb)
|
|
paths := []string{
|
|
"/api/v1/auth/register",
|
|
"/api/v1/auth/login",
|
|
"/api/v1/auth/login/2fa",
|
|
"/api/v1/auth/send-verify-code",
|
|
"/api/v1/auth/oauth/pending/send-verify-code",
|
|
}
|
|
|
|
for _, path := range paths {
|
|
req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(`{}`))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.RemoteAddr = "203.0.113.10:12345"
|
|
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusTooManyRequests, w.Code, "path=%s", path)
|
|
require.Contains(t, w.Body.String(), "rate limit exceeded", "path=%s", path)
|
|
}
|
|
}
|