mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-16 15:43:13 +08:00
shaw
0ddd58aaf9
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护： 审计日志（admin-only 可见，用户不可见） - 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理 - 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类 请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取） - 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url 保留以便追责）；非 JSON body 不入库 - 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许， 清空后同步写入留痕记录 会话 IP/UA 绑定（默认开启，可在系统设置关闭） - JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求 重新登录；旧 token 无指纹时放行以平滑升级 敏感操作 step-up 2FA（sudo 窗口 15 分钟） - 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试 - API key 查看按需求暂不加强管控 前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、 step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
70 lines
2.6 KiB
Go
70 lines
2.6 KiB
Go
package handler
|
|
|
|
import (
|
|
"github.com/Wei-Shaw/sub2api/internal/handler/admin"
|
|
)
|
|
|
|
// AdminHandlers contains all admin-related HTTP handlers
|
|
type AdminHandlers struct {
|
|
Dashboard *admin.DashboardHandler
|
|
User *admin.UserHandler
|
|
Group *admin.GroupHandler
|
|
Account *admin.AccountHandler
|
|
Announcement *admin.AnnouncementHandler
|
|
DataManagement *admin.DataManagementHandler
|
|
Backup *admin.BackupHandler
|
|
OAuth *admin.OAuthHandler
|
|
OpenAIOAuth *admin.OpenAIOAuthHandler
|
|
GeminiOAuth *admin.GeminiOAuthHandler
|
|
AntigravityOAuth *admin.AntigravityOAuthHandler
|
|
GrokOAuth *admin.GrokOAuthHandler
|
|
Proxy *admin.ProxyHandler
|
|
Redeem *admin.RedeemHandler
|
|
Promo *admin.PromoHandler
|
|
Setting *admin.SettingHandler
|
|
Ops *admin.OpsHandler
|
|
System *admin.SystemHandler
|
|
Subscription *admin.SubscriptionHandler
|
|
Usage *admin.UsageHandler
|
|
UserAttribute *admin.UserAttributeHandler
|
|
ErrorPassthrough *admin.ErrorPassthroughHandler
|
|
TLSFingerprintProfile *admin.TLSFingerprintProfileHandler
|
|
APIKey *admin.AdminAPIKeyHandler
|
|
ScheduledTest *admin.ScheduledTestHandler
|
|
Channel *admin.ChannelHandler
|
|
ChannelMonitor *admin.ChannelMonitorHandler
|
|
ChannelMonitorTemplate *admin.ChannelMonitorRequestTemplateHandler
|
|
ContentModeration *admin.ContentModerationHandler
|
|
Payment *admin.PaymentHandler
|
|
Affiliate *admin.AffiliateHandler
|
|
Compliance *admin.ComplianceHandler
|
|
AuditLog *admin.AuditLogHandler
|
|
}
|
|
|
|
// Handlers contains all HTTP handlers
|
|
type Handlers struct {
|
|
Auth *AuthHandler
|
|
User *UserHandler
|
|
APIKey *APIKeyHandler
|
|
Usage *UsageHandler
|
|
Redeem *RedeemHandler
|
|
Subscription *SubscriptionHandler
|
|
Announcement *AnnouncementHandler
|
|
ChannelMonitor *ChannelMonitorUserHandler
|
|
Admin *AdminHandlers
|
|
Gateway *GatewayHandler
|
|
OpenAIGateway *OpenAIGatewayHandler
|
|
Setting *SettingHandler
|
|
Totp *TotpHandler
|
|
Payment *PaymentHandler
|
|
PaymentWebhook *PaymentWebhookHandler
|
|
AvailableChannel *AvailableChannelHandler
|
|
BatchImage *BatchImageHandler
|
|
}
|
|
|
|
// BuildInfo contains build-time information
|
|
type BuildInfo struct {
|
|
Version string
|
|
BuildType string // "source" for manual builds, "release" for CI builds
|
|
}
|