应对管理员访问凭证失守导致的数据外泄风险,新增三层防护: 审计日志(admin-only 可见,用户不可见) - 新增 append-only audit_logs 表(migration 180)+ 异步批量写入 + 保留期清理 - 审计中间件挂在 admin/user/auth/admin-payment 组认证之后:记录所有变更类 请求 + 白名单敏感读取(账号/代理导出、备份下载、admin/user API key 读取) - 请求头凭证首尾掩码;请求体 JSON 递归脱敏(api_key/password 等擦除,base_url 保留以便追责);非 JSON body 不入库 - 无单条删除;全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许, 清空后同步写入留痕记录 会话 IP/UA 绑定(默认开启,可在系统设置关闭) - JWT 携带 session id + IP/UA 指纹哈希;IP 或 UA 任一变化即撤销会话家族并要求 重新登录;旧 token 无指纹时放行以平滑升级 敏感操作 step-up 2FA(sudo 窗口 15 分钟) - 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证;admin API key 一律拒绝;前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试 - API key 查看按需求暂不加强管控 前端:新增 /admin/audit-logs 操作日志页面(筛选/详情/2FA 清空)、侧边栏入口、 step-up 弹窗接入导出与备份流程、安全设置项(绑定开关 + 日志保留天数)、zh/en i18n
Layout Components
Vue 3 layout components for the Sub2API frontend, built with Composition API, TypeScript, and TailwindCSS.
Components
1. AppLayout.vue
Main application layout with sidebar and header.
Usage:
<template>
<AppLayout>
<!-- Your page content here -->
<h1>Dashboard</h1>
<p>Welcome to your dashboard!</p>
</AppLayout>
</template>
<script setup lang="ts">
import { AppLayout } from '@/components/layout'
</script>
Features:
- Responsive sidebar (collapsible)
- Fixed header at top
- Main content area with slot
- Automatically adjusts margin based on sidebar state
2. AppSidebar.vue
Navigation sidebar with user and admin sections.
Features:
- Logo/brand at top
- User navigation links:
- Dashboard
- API Keys
- Usage
- Redeem
- Profile
- Admin navigation links (shown only if user is admin):
- Admin Dashboard
- Users
- Groups
- Accounts
- Proxies
- Redeem Codes
- Collapsible sidebar with toggle button
- Active route highlighting
- Icons using HTML entities
- Responsive (mobile-friendly)
Used automatically by AppLayout - no need to import separately.
3. AppHeader.vue
Top header with user info and actions.
Features:
- Mobile menu toggle button
- Page title (from route meta or slot)
- User balance display (desktop only)
- User dropdown menu with:
- Profile link
- Logout button
- User avatar with initials
- Click-outside handling for dropdown
- Responsive design
Usage with custom title:
<template>
<AppLayout>
<template #title> Custom Page Title </template>
<!-- Your content -->
</AppLayout>
</template>
Used automatically by AppLayout - no need to import separately.
4. AuthLayout.vue
Simple centered layout for authentication pages (login/register).
Usage:
<template>
<AuthLayout>
<!-- Login/Register form content -->
<h2 class="mb-6 text-2xl font-bold">Login</h2>
<form @submit.prevent="handleLogin">
<!-- Form fields -->
</form>
<!-- Optional footer slot -->
<template #footer>
<p>
Don't have an account?
<router-link to="/register" class="text-indigo-600 hover:underline"> Sign up </router-link>
</p>
</template>
</AuthLayout>
</template>
<script setup lang="ts">
import { AuthLayout } from '@/components/layout'
function handleLogin() {
// Login logic
}
</script>
Features:
- Centered card container
- Gradient background
- Logo/brand at top
- Main content slot
- Optional footer slot for links
- Fully responsive
Route Configuration
To set page titles in the header, add meta to your routes:
// router/index.ts
const routes = [
{
path: '/dashboard',
component: DashboardView,
meta: { title: 'Dashboard' }
},
{
path: '/api-keys',
component: ApiKeysView,
meta: { title: 'API Keys' }
}
// ...
]
Store Dependencies
These components use the following Pinia stores:
- useAuthStore: For user authentication state, role checking, and logout
- useAppStore: For sidebar state management and toast notifications
Make sure these stores are properly initialized in your app.
Styling
All components use TailwindCSS utility classes. Make sure your tailwind.config.js includes the component paths:
module.exports = {
content: ['./index.html', './src/**/*.{vue,js,ts,jsx,tsx}']
// ...
}
Icons
Components use HTML entity icons for simplicity:
- 📈 Chart (Dashboard)
- 🔑 Key (API Keys)
- 📊 Bar Chart (Usage)
- 🎁 Gift (Redeem)
- 👤 User (Profile)
- 🔌 Admin
- 👥 Users
- 📁 Folder (Groups)
- 🌐 Globe (Accounts)
- 🔄 Network (Proxies)
- 🏷 Ticket (Redeem Codes)
You can replace these with your preferred icon library (e.g., Heroicons, Font Awesome) if needed.
Mobile Responsiveness
All components are fully responsive:
- AppSidebar: Fixed positioning on desktop, hidden by default on mobile
- AppHeader: Shows mobile menu toggle on small screens, hides balance display
- AuthLayout: Adapts padding and card size for mobile devices
The sidebar uses Tailwind's responsive breakpoints (md:) to adjust behavior.