fix26: полный прод-фикс auth/jwt, import-export peer и frontend flow

2026-05-09 01:18:13 +05:00
parent 7a64d76d08
commit c13841b61a
19 changed files with 390 additions and 90 deletions
@@ -101,15 +101,19 @@ func ensureSecureBootstrapAdmin() error {
 	if adminUser == "" {
 		adminUser = "hy2xsadmin"
 	}
+	if _, err := GetAdminUser("username = ?", adminUser); err == nil {
+		return nil
+	}
+
 	adminPassword := strings.TrimSpace(os.Getenv("HY2XS_ADMIN_INITIAL_PASSWORD"))
+	passwordGenerated := false
 	if adminPassword == "" {
 		password, pwdErr := util.RandomString(18)
 		if pwdErr != nil {
 			return pwdErr
 		}
 		adminPassword = password
-		logrus.Warnf("Initial admin username: %s", adminUser)
-		logrus.Warnf("Initial admin password: %s", adminPassword)
+		passwordGenerated = true
 	}
 	forcePasswordChange := envBoolAsInt("HY2XS_FORCE_PASSWORD_CHANGE", 1)
 	status := int64(1)
@@ -120,25 +124,21 @@ func ensureSecureBootstrapAdmin() error {
 		return hashErr
 	}

-	admin, err := GetAdminUser("username = ?", adminUser)
-	if err != nil {
-		username := adminUser
-		account := entity.AdminUser{
-			Username:            &username,
-			PasswordHash:        &hash,
-			Status:              &status,
-			TokenVersion:        &tokenVersion,
-			PasswordChangedAt:   &passwordChangedAt,
-			ForcePasswordChange: func() *int64 { v := int64(forcePasswordChange); return &v }(),
-		}
-		if _, saveErr := SaveAdminUser(account); saveErr != nil {
-			return saveErr
-		}
-		return nil
+	username := adminUser
+	account := entity.AdminUser{
+		Username:            &username,
+		PasswordHash:        &hash,
+		Status:              &status,
+		TokenVersion:        &tokenVersion,
+		PasswordChangedAt:   &passwordChangedAt,
+		ForcePasswordChange: func() *int64 { v := int64(forcePasswordChange); return &v }(),
 	}
-
-	if admin.PasswordHash == nil {
-		return nil
+	if _, saveErr := SaveAdminUser(account); saveErr != nil {
+		return saveErr
+	}
+	if passwordGenerated {
+		logrus.Warnf("Initial admin username: %s", adminUser)
+		logrus.Warnf("Initial admin password: %s", adminPassword)
 	}
 	return nil
 }
@@ -581,6 +581,11 @@ func ensureTrafficStatsSecret() error {
 		if existing.Value != nil && strings.TrimSpace(*existing.Value) != "" {
 			return nil
 		}
+		secret, secErr := util.RandomString(32)
+		if secErr != nil {
+			return secErr
+		}
+		return UpdateConfig([]string{constant.Hysteria2TrafficStatsSecret}, map[string]interface{}{"value": secret})
 	}
 	secret, secErr := util.RandomString(32)
 	if secErr != nil {