fix(fix4): enforce runtime contract and orchestrator guardrails

apps/controller/config.go

@@ -19,6 +19,21 @@ import (
 	"time"
 )
 
+func isOrchestratorManagedConfigKey(key string) bool {
+	switch key {
+	case constant.HUIWebPort,
+		constant.HUIWebContext,
+		constant.HUICrtPath,
+		constant.HUIKeyPath,
+		constant.Hysteria2Enable,
+		constant.Hysteria2Config,
+		constant.Hysteria2TrafficStatsSecret:
+		return true
+	default:
+		return false
+	}
+}
+
 func UpdateConfigs(c *gin.Context) {
 	configsUpdateDto, err := validateField(c, dto.ConfigsUpdateDto{})
 	if err != nil {
@@ -37,6 +52,11 @@ func UpdateConfigs(c *gin.Context) {
 		key := *item.Key
 		value := *item.Value
 
+		if isOrchestratorManagedConfigKey(key) {
+			vo.Fail(fmt.Sprintf("%s managed by orchestrator: use hy2xs-orchestrator reconfigure", key), c)
+			return
+		}
+
 		if key == constant.HUIWebPort && strconv.FormatInt(port, 10) != value {
 			port, err := strconv.Atoi(value)
 			if err != nil {
@@ -117,17 +137,12 @@ func GetConfig(c *gin.Context) {
 	}
 
 	running := service.Hysteria2IsRunning()
-
-	if (*config.Value == "1") != running {
-		enable := "0"
+	if *config.Key == constant.Hysteria2Enable {
 		if running {
-			enable = "1"
+			configVo.Value = "1"
+		} else {
+			configVo.Value = "0"
 		}
-		if err := service.UpdateConfig(constant.Hysteria2Enable, enable); err != nil {
-			vo.Fail(err.Error(), c)
-			return
-		}
-		configVo.Value = enable
 	}
 
 	vo.Success(configVo, c)
@@ -284,6 +299,12 @@ func ImportConfig(c *gin.Context) {
 		vo.Fail("content Unmarshal err", c)
 		return
 	}
+	for _, cfg := range configs {
+		if cfg.Key != nil && isOrchestratorManagedConfigKey(*cfg.Key) {
+			vo.Fail(fmt.Sprintf("%s managed by orchestrator: use hy2xs-orchestrator reconfigure", *cfg.Key), c)
+			return
+		}
+	}
 	if err = service.UpsertConfig(configs); err != nil {
 		vo.Fail(err.Error(), c)
 		return