prod/HY2XS_flamy
5
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

fix26: полный прод-фикс auth/jwt, import-export peer и frontend flow

Browse Source
This commit is contained in:
Crimson
2026-05-09 01:18:13 +05:00
parent 7a64d76d08
commit c13841b61a
19 changed files with 390 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/cmd/reset.go
+45 -15
View File
@@ -4,8 +4,10 @@ import (
"fmt"
"github.com/spf13/cobra"
"hy2xs-admin/dao"
"hy2xs-admin/model/entity"
"hy2xs-admin/util"
"os"
"time"
)
var resetCmd = &cobra.Command{
@@ -30,25 +32,53 @@ func runReset(cmd *cobra.Command, args []string) {
fmt.Println(err.Error())
os.Exit(1)
}
if err = dao.InitSqliteDB(); err != nil {
if err = dao.InitSql(""); err != nil {
fmt.Println(err.Error())
os.Exit(1)
}
admin, err := dao.GetAdminUser("id = ?", 1)
admin, err := dao.GetAdminUser("1 = 1")
nowMs := time.Now().UnixMilli()
if err != nil {
fmt.Println(err.Error())
os.Exit(1)
}
if err = dao.UpdateAdminUser([]int64{*admin.Id}, map[string]interface{}{
"username": username,
"password_hash": func() string {
hash, _ := util.HashPassword(password)
return hash
}(),
"force_password_change": 1,
}); err != nil {
fmt.Println(err.Error())
os.Exit(1)
tokenVersion := int64(1)
status := int64(1)
forcePasswordChange := int64(1)
passwordChangedAt := nowMs
hash, hashErr := util.HashPassword(password)
if hashErr != nil {
fmt.Println(hashErr.Error())
os.Exit(1)
}
adminUser := entity.AdminUser{
Username: &username,
PasswordHash: &hash,
Status: &status,
ForcePasswordChange: &forcePasswordChange,
PasswordChangedAt: &passwordChangedAt,
TokenVersion: &tokenVersion,
}
if _, saveErr := dao.SaveAdminUser(adminUser); saveErr != nil {
fmt.Println(saveErr.Error())
os.Exit(1)
}
} else {
tokenVersion := int64(1)
if admin.TokenVersion != nil && *admin.TokenVersion > 0 {
tokenVersion = *admin.TokenVersion + 1
}
if err = dao.UpdateAdminUser([]int64{*admin.Id}, map[string]interface{}{
"username": username,
"password_hash": func() string {
hash, _ := util.HashPassword(password)
return hash
}(),
"force_password_change": 1,
"password_changed_at": nowMs,
"token_version": tokenVersion,
"status": 1,
}); err != nil {
fmt.Println(err.Error())
os.Exit(1)
}
}
if err = dao.CloseSqliteDB(); err != nil {
fmt.Println(err.Error())
apps/controller/hysteria2.go
+2 -2
View File
@@ -2,6 +2,7 @@ package controller
import (
"github.com/gin-gonic/gin"
"github.com/sirupsen/logrus"
"hy2xs-admin/model/dto"
"hy2xs-admin/model/vo"
"hy2xs-admin/service"
@@ -27,8 +28,7 @@ func Hysteria2Auth(c *gin.Context) {
// Обновление времени последнего подключения
now := time.Now().UnixMilli()
if err = service.UpdatePeerLastConnectionAt(id, now); err != nil {
vo.Fail(err.Error(), c)
return
logrus.WithError(err).Warnf("failed to update peer last_connection_at: peer_id=%d", id)
}
vo.Hysteria2AuthSuccess(username, c)
}
apps/controller/peer.go
+4 -4
View File
@@ -10,9 +10,9 @@ import (
"time"
"github.com/gin-gonic/gin"
"hy2xs-admin/model/bo"
"hy2xs-admin/model/constant"
"hy2xs-admin/model/dto"
"hy2xs-admin/model/entity"
"hy2xs-admin/model/vo"
"hy2xs-admin/service"
"hy2xs-admin/util"
@@ -147,12 +147,12 @@ func ImportPeer(c *gin.Context) {
vo.Fail("json file read err", c)
return
}
var accounts []entity.Account
if err = json.Unmarshal(content, &accounts); err != nil {
var peerExports []bo.PeerExport
if err = json.Unmarshal(content, &peerExports); err != nil {
vo.Fail("content Unmarshal err", c)
return
}
if err = service.UpsertPeerLegacy(accounts); err != nil {
if err = service.UpsertPeerExport(peerExports); err != nil {
vo.Fail(err.Error(), c)
return
}
apps/dao/sqlite.go
+25 -20
View File
@@ -101,15 +101,19 @@ func ensureSecureBootstrapAdmin() error {
if adminUser == "" {
adminUser = "hy2xsadmin"
}
if _, err := GetAdminUser("username = ?", adminUser); err == nil {
return nil
}
adminPassword := strings.TrimSpace(os.Getenv("HY2XS_ADMIN_INITIAL_PASSWORD"))
passwordGenerated := false
if adminPassword == "" {
password, pwdErr := util.RandomString(18)
if pwdErr != nil {
return pwdErr
}
adminPassword = password
logrus.Warnf("Initial admin username: %s", adminUser)
logrus.Warnf("Initial admin password: %s", adminPassword)
passwordGenerated = true
}
forcePasswordChange := envBoolAsInt("HY2XS_FORCE_PASSWORD_CHANGE", 1)
status := int64(1)
@@ -120,25 +124,21 @@ func ensureSecureBootstrapAdmin() error {
return hashErr
}
admin, err := GetAdminUser("username = ?", adminUser)
if err != nil {
username := adminUser
account := entity.AdminUser{
Username: &username,
PasswordHash: &hash,
Status: &status,
TokenVersion: &tokenVersion,
PasswordChangedAt: &passwordChangedAt,
ForcePasswordChange: func() *int64 { v := int64(forcePasswordChange); return &v }(),
}
if _, saveErr := SaveAdminUser(account); saveErr != nil {
return saveErr
}
return nil
username := adminUser
account := entity.AdminUser{
Username: &username,
PasswordHash: &hash,
Status: &status,
TokenVersion: &tokenVersion,
PasswordChangedAt: &passwordChangedAt,
ForcePasswordChange: func() *int64 { v := int64(forcePasswordChange); return &v }(),
}
if admin.PasswordHash == nil {
return nil
if _, saveErr := SaveAdminUser(account); saveErr != nil {
return saveErr
}
if passwordGenerated {
logrus.Warnf("Initial admin username: %s", adminUser)
logrus.Warnf("Initial admin password: %s", adminPassword)
}
return nil
}
@@ -581,6 +581,11 @@ func ensureTrafficStatsSecret() error {
if existing.Value != nil && strings.TrimSpace(*existing.Value) != "" {
return nil
}
secret, secErr := util.RandomString(32)
if secErr != nil {
return secErr
}
return UpdateConfig([]string{constant.Hysteria2TrafficStatsSecret}, map[string]interface{}{"value": secret})
}
secret, secErr := util.RandomString(32)
if secErr != nil {
apps/frontend/src/api/admin/index.ts
+22 -1
View File
@@ -1,6 +1,12 @@
import request from "@/utils/request";
import { AxiosPromise } from "axios";
import { AdminInfo, AdminLoginDto, AdminLoginVo } from "./types";
import {
AdminChangePasswordDto,
AdminInfo,
AdminLoginDto,
AdminLoginVo,
AdminSecurityVo,
} from "./types";
export function loginApi(data: AdminLoginDto): AxiosPromise<AdminLoginVo> {
return request({
@@ -16,3 +22,18 @@ export function getAdminInfoApi(): AxiosPromise<AdminInfo> {
method: "get",
});
}
export function adminChangePasswordApi(data: AdminChangePasswordDto): AxiosPromise {
return request({
url: "/admin/change-password",
method: "post",
data,
});
}
export function adminSecurityApi(): AxiosPromise<AdminSecurityVo> {
return request({
url: "/admin/security",
method: "get",
});
}
apps/frontend/src/api/admin/types.ts
+11
View File
@@ -6,11 +6,22 @@ export interface AdminLoginDto {
export interface AdminLoginVo {
accessToken: string;
tokenType: string;
forcePasswordChange: boolean;
}
export interface AdminInfo {
id: number;
username: string;
roles: string[];
forcePasswordChange: boolean;
}
export interface AdminChangePasswordDto {
oldPassword: string;
newPassword: string;
}
export interface AdminSecurityVo {
forcePasswordChange: boolean;
}
apps/frontend/src/lang/package/en.ts
+14 -1
View File
@@ -21,6 +21,19 @@ export default {
password: "Password",
login: "Login",
},
dashboard: {
stale: "Dashboard data is stale. Retrying automatically...",
topPeers24h: "Top peers (24h)",
refreshFailed: "Failed to refresh dashboard data",
},
admin: {
changePasswordTitle: "Change password",
oldPassword: "Old password",
newPassword: "New password",
forcePasswordChangeNotice:
"You must change your password before continuing.",
changedSuccess: "Password updated",
},
// Локализация навигационной панели
navbar: {
logout: "Logout",
@@ -57,7 +70,7 @@ export default {
yes: "Yes",
no: "No",
securityRisk: "Security Risks",
defaultPassTip: `Please change the default login password as soon as possible, It is recommended to set a strong password to protect your account security. <a href="/#/peers/list?focus=change-pass" style="color: #00BFFF">Click here</a> to change`,
defaultPassTip: `Please change the default login password as soon as possible, It is recommended to set a strong password to protect your account security. <a href="/#/admin/change-password" style="color: #00BFFF">Click here</a> to change`,
noHttpsTip: `Your website is not using HTTPS, making data transmission insecure, Please enable HTTPS as soon as possible to protect user information. <a href="/#/config/list?focus=huiHttps" style="color: #00BFFF">Click here</a> to enable`,
required: "Required",
warning: "Warning",
apps/frontend/src/lang/package/ru.ts
+13 -1
View File
@@ -19,6 +19,18 @@ export default {
password: "Пароль",
login: "Войти",
},
dashboard: {
stale: "Данные дашборда устарели. Выполняется автоматическая повторная попытка...",
topPeers24h: "Топ пиров (24ч)",
refreshFailed: "Не удалось обновить данные дашборда",
},
admin: {
changePasswordTitle: "Смена пароля",
oldPassword: "Старый пароль",
newPassword: "Новый пароль",
forcePasswordChangeNotice: "Перед продолжением необходимо сменить пароль.",
changedSuccess: "Пароль обновлён",
},
navbar: {
logout: "Выйти",
},
@@ -54,7 +66,7 @@ export default {
yes: "Да",
no: "Нет",
securityRisk: "Риски безопасности",
defaultPassTip: `Смените пароль по умолчанию как можно скорее. <a href="/#/peers/list?focus=change-pass" style="color: #00BFFF">Перейти к смене</a>`,
defaultPassTip: `Смените пароль по умолчанию как можно скорее. <a href="/#/admin/change-password" style="color: #00BFFF">Перейти к смене</a>`,
noHttpsTip: `Панель работает без HTTPS. Включите HTTPS для защиты данных. <a href="/#/config/list?focus=huiHttps" style="color: #00BFFF">Открыть настройки</a>`,
required: "Обязательное поле",
warning: "Внимание",
apps/frontend/src/permission.ts
+9 -2
View File
@@ -24,6 +24,10 @@ router.beforeEach(async (to, from, next) => {
const adminStore = useAdminStoreHook();
const hasRoles = adminStore.roles && adminStore.roles.length > 0;
if (hasRoles) {
if (adminStore.forcePasswordChange && to.path !== "/admin/change-password") {
next({ path: "/admin/change-password", query: { redirect: to.fullPath } });
return;
}
// Если маршрут не найден, перейти на 404
if (to.matched.length === 0) {
from.name ? next({ name: from.name }) : next("/404");
@@ -32,11 +36,15 @@ router.beforeEach(async (to, from, next) => {
}
} else {
try {
const { roles } = await adminStore.getAdminInfo();
const { roles, forcePasswordChange } = await adminStore.getAdminInfo();
const accessRoutes = permissionStore.generateRoutes(roles);
accessRoutes.forEach((route) => {
router.addRoute(route);
});
if (forcePasswordChange && to.path !== "/admin/change-password") {
next({ path: "/admin/change-password", query: { redirect: to.fullPath }, replace: true });
return;
}
next({ ...to, replace: true });
} catch (error) {
// Удалить token и перейти на страницу входа
@@ -61,4 +69,3 @@ router.afterEach(() => {
NProgress.done();
});
apps/frontend/src/router/index.ts
+20 -6
View File
@@ -53,7 +53,7 @@ export const asyncRoutes: any[] = [
name: "Dashboard",
meta: {
title: "dashboard",
icon: "dashboard",
icon: "report",
roles: ["admin"],
},
children: [
@@ -63,16 +63,30 @@ export const asyncRoutes: any[] = [
name: "DashboardIndex",
meta: {
title: "dashboard",
icon: "dashboard",
icon: "report",
roles: ["admin"],
},
},
],
},
{
path: "/admin",
component: "Layout",
redirect: "/admin/change-password",
meta: { hidden: true, roles: ["admin"] },
children: [
{
path: "change-password",
component: "admin/change-password/index",
name: "AdminChangePassword",
meta: { title: "changePassword", hidden: true, roles: ["admin"] },
},
],
},
{
path: "/peers",
component: "Layout",
redirect: "/list",
redirect: "/peers/list",
name: "Peer",
meta: { title: "peer", icon: "users", roles: ["admin"] },
children: [
@@ -94,7 +108,7 @@ export const asyncRoutes: any[] = [
{
path: "/hysteria",
component: "Layout",
redirect: "/list",
redirect: "/hysteria/list",
name: "Hysteria",
meta: { title: "hysteria", icon: "hysteria", roles: ["admin"] },
children: [
@@ -113,7 +127,7 @@ export const asyncRoutes: any[] = [
{
path: "/config",
component: "Layout",
redirect: "/list",
redirect: "/config/list",
name: "Config",
meta: { title: "config", icon: "setting", roles: ["admin"] },
children: [
@@ -135,7 +149,7 @@ export const asyncRoutes: any[] = [
{
path: "/log",
component: "Layout",
redirect: "/system",
redirect: "/log/system",
name: "Log",
meta: { title: "log", icon: "error", roles: ["admin"] },
children: [
apps/frontend/src/store/modules/admin.ts
+6 -1
View File
@@ -10,6 +10,7 @@ import { useStorage } from "@vueuse/core";
export const useAdminStore = defineStore("admin", () => {
const token = useStorage("accessToken", "");
const forcePasswordChange = useStorage("forcePasswordChange", false);
const id = ref(0);
const username = ref("");
const roles = ref<Array<string>>([]);
@@ -18,8 +19,9 @@ export const useAdminStore = defineStore("admin", () => {
return new Promise<void>((resolve, reject) => {
loginApi(adminLoginDto)
.then((response) => {
const { tokenType, accessToken } = response.data;
const { tokenType, accessToken, forcePasswordChange: mustChange } = response.data;
token.value = tokenType + " " + accessToken;
forcePasswordChange.value = !!mustChange;
resolve();
})
.catch((error) => {
@@ -41,6 +43,7 @@ export const useAdminStore = defineStore("admin", () => {
id.value = data.id;
username.value = data.username;
roles.value = data.roles;
forcePasswordChange.value = !!data.forcePasswordChange;
resolve(data);
})
.catch((error) => {
@@ -59,6 +62,7 @@ export const useAdminStore = defineStore("admin", () => {
function resetToken() {
token.value = "";
forcePasswordChange.value = false;
id.value = 0;
username.value = "";
roles.value = [];
@@ -66,6 +70,7 @@ export const useAdminStore = defineStore("admin", () => {
return {
token,
forcePasswordChange,
id,
username,
roles,
apps/frontend/src/views/admin/change-password/index.vue
+85
View File
@@ -0,0 +1,85 @@
<template>
<div class="app-container">
<el-card shadow="never" class="change-password-card">
<template #header>{{ $t("admin.changePasswordTitle") }}</template>
<el-alert
:title="$t('admin.forcePasswordChangeNotice')"
type="warning"
:closable="false"
class="mb-3"
/>
<el-form ref="formRef" :model="form" :rules="rules" label-width="180px">
<el-form-item :label="$t('admin.oldPassword')" prop="oldPassword">
<el-input v-model="form.oldPassword" show-password />
</el-form-item>
<el-form-item :label="$t('admin.newPassword')" prop="newPassword">
<el-input v-model="form.newPassword" show-password />
</el-form-item>
<el-form-item>
<el-button type="primary" :loading="saving" @click="submit">{{ $t("common.confirm") }}</el-button>
</el-form-item>
</el-form>
</el-card>
</div>
</template>
<script setup lang="ts">
import { ElMessage, FormInstance, FormRules } from "element-plus";
import { useI18n } from "vue-i18n";
import { useRoute, useRouter } from "vue-router";
import { adminChangePasswordApi } from "@/api/admin";
import { useAdminStore } from "@/store/modules/admin";
const { t } = useI18n();
const route = useRoute();
const router = useRouter();
const adminStore = useAdminStore();
const formRef = ref<FormInstance>();
const saving = ref(false);
const form = reactive({
oldPassword: "",
newPassword: "",
});
const passwordPattern = /^[a-zA-Z0-9!@#$%^&*()_+-=]{6,64}$/;
const rules: FormRules = {
oldPassword: [
{ required: true, message: t("common.required"), trigger: ["change", "blur"] },
{ pattern: passwordPattern, message: t("common.invalid"), trigger: ["change", "blur"] },
],
newPassword: [
{ required: true, message: t("common.required"), trigger: ["change", "blur"] },
{ pattern: passwordPattern, message: t("common.invalid"), trigger: ["change", "blur"] },
],
};
const submit = async () => {
if (!formRef.value) {
return;
}
const valid = await formRef.value.validate();
if (!valid) {
return;
}
saving.value = true;
try {
await adminChangePasswordApi({ oldPassword: form.oldPassword, newPassword: form.newPassword });
adminStore.forcePasswordChange = false;
ElMessage.success(t("admin.changedSuccess"));
const redirect = typeof route.query.redirect === "string" ? route.query.redirect : "/";
router.push(redirect);
} finally {
saving.value = false;
}
};
</script>
<style scoped lang="scss">
.change-password-card {
max-width: 760px;
}
</style>
apps/frontend/src/views/dashboard/index.vue
+8 -5
View File
@@ -1,7 +1,7 @@
<template>
<div class="dashboard-container">
<div class="dashboard-actions mb-2">
<el-button size="small" @click="loadDashboard">Refresh</el-button>
<el-button size="small" @click="loadDashboard">{{ $t("common.refresh") }}</el-button>
</div>
<el-alert
@@ -13,7 +13,7 @@
/>
<el-alert
v-else-if="isStale"
title="Dashboard data is stale. Retrying automatically..."
:title="$t('dashboard.stale')"
type="warning"
:closable="false"
class="mb-2"
@@ -22,7 +22,7 @@
<el-alert
v-for="risk in securityRisks"
:key="risk.key"
:title="risk.key"
:title="$t(risk.key)"
:type="risk.severity === 'critical' ? 'error' : risk.severity === 'warning' ? 'warning' : 'info'"
:closable="risk.dismissible"
class="mb-2"
@@ -40,7 +40,7 @@
</el-row>
<el-card shadow="never" class="mt-3">
<template #header>Top peers (24h)</template>
<template #header>{{ $t("dashboard.topPeers24h") }}</template>
<el-table :data="topPeers" size="small">
<el-table-column prop="name" label="Peer" />
<el-table-column prop="download" label="Download">
@@ -59,10 +59,13 @@
<script setup lang="ts">
import { useIntervalFn } from "@vueuse/core";
import { useI18n } from "vue-i18n";
import { dashboardSecurityApi, dashboardSummaryApi, dashboardTopPeersApi } from "@/api/dashboard";
import { DashboardSummaryVo, DashboardTopPeerVo, SecurityRiskVo } from "@/api/dashboard/types";
import { formatBytes } from "@/utils/byte";
const { t } = useI18n();
const summary = ref<DashboardSummaryVo>({
collectedAt: 0,
system: { cpuPercent: 0, memUsedBytes: 0, memTotalBytes: 0, memPercent: 0, diskUsedBytes: 0, diskTotalBytes: 0, diskPercent: 0 },
@@ -108,7 +111,7 @@ const loadDashboard = async () => {
lastSuccessAt.value = Date.now();
loadError.value = "";
} catch (error) {
loadError.value = "Failed to refresh dashboard data";
loadError.value = t("dashboard.refreshFailed");
} finally {
loading.value = false;
}
apps/frontend/src/views/login/index.vue
+4
View File
@@ -160,6 +160,10 @@ const handleLogin = () => {
adminStore
.login(params)
.then(() => {
if (adminStore.forcePasswordChange) {
router.push({ path: "/admin/change-password" });
return;
}
const query: LocationQuery = route.query;
const redirect = (query.redirect as LocationQueryValue) ?? "/";
apps/middleware/jwt.go
+16 -1
View File
@@ -28,11 +28,26 @@ func JWTHandler() gin.HandlerFunc {
c.Abort()
return
}
if myClaims.Admin.Deleted != 0 {
admin, err := service.GetAdminForTokenValidation(myClaims.Admin.Id)
if err != nil {
vo.Fail(err.Error(), c)
c.Abort()
return
}
if admin.Status != nil && *admin.Status != 1 {
vo.Fail("this account has been disabled", c)
c.Abort()
return
}
tokenVersion := int64(1)
if admin.TokenVersion != nil && *admin.TokenVersion > 0 {
tokenVersion = *admin.TokenVersion
}
if myClaims.Admin.TokenVersion != tokenVersion {
vo.Fail(constant.IllegalTokenError, c)
c.Abort()
return
}
c.Next()
}
}
apps/model/bo/account.go
+1
View File
@@ -32,6 +32,7 @@ type AccountExport struct {
type PeerExport struct {
Id int64 `json:"id,omitempty"`
AuthId string `json:"authId,omitempty"`
Name string `json:"name"`
Remark string `json:"remark"`
Secret string `json:"secret,omitempty"`
apps/service/admin_user.go
+5
View File
@@ -8,6 +8,7 @@ import (
"hy2xs-admin/dao"
"hy2xs-admin/model/bo"
"hy2xs-admin/model/constant"
"hy2xs-admin/model/entity"
"hy2xs-admin/model/vo"
"hy2xs-admin/util"
)
@@ -96,3 +97,7 @@ func ChangeAdminPassword(c *gin.Context, oldPassword string, newPassword string)
})
}
func GetAdminForTokenValidation(id int64) (entity.AdminUser, error) {
return dao.GetAdminUser("id = ?", id)
}
apps/service/peer.go
+100 -23
View File
@@ -3,6 +3,7 @@ package service
import (
"errors"
"fmt"
"strings"
"github.com/skip2/go-qrcode"
"hy2xs-admin/dao"
@@ -36,7 +37,8 @@ func PagePeer(peerPageDto dto.PeerPageDto) ([]vo.PeerVo, int64, error) {
BannedUntil: int64Val(p.BannedUntil),
LastConnectionAt: int64Val(p.LastConnectionAt),
}
if v, ok := onlineUsers[item.AuthId]; ok {
authID := strVal(p.AuthId)
if v, ok := onlineUsers[authID]; ok {
item.Online = true
item.OnlineDevices = v
}
@@ -181,6 +183,7 @@ func ListExportPeer(includeSecrets bool) ([]bo.PeerExport, error) {
for _, item := range peers {
ex := bo.PeerExport{
Id: int64Val(item.Id),
AuthId: strVal(item.AuthId),
Name: strVal(item.Name),
Remark: strVal(item.Remark),
QuotaBytes: int64Val(item.QuotaBytes),
@@ -202,32 +205,106 @@ func ListExportPeer(includeSecrets bool) ([]bo.PeerExport, error) {
return out, nil
}
func UpsertPeerLegacy(accounts []entity.Account) error {
for _, account := range accounts {
if account.Id != nil && *account.Id > 0 {
upd := dto.PeerUpdateDto{}
upd.Name = account.Username
upd.Remark = account.Remark
upd.QuotaBytes = account.Quota
upd.ExpiresAt = account.ExpireTime
upd.MaxDevices = account.DeviceNo
upd.Disabled = account.Deleted
if err := UpdatePeer(*account.Id, upd); err != nil {
return err
func UpsertPeerExport(items []bo.PeerExport) error {
for _, item := range items {
name := strings.TrimSpace(item.Name)
if name == "" {
return errors.New(constant.InvalidError)
}
var existing entity.Peer
var err error
authID := strings.TrimSpace(item.AuthId)
if authID != "" {
existing, err = dao.GetPeer("auth_id = ?", authID)
}
if (err != nil || existing.Id == nil) && name != "" {
existing, err = dao.GetPeer("name = ?", name)
}
quota := item.QuotaBytes
expires := item.ExpiresAt
maxDevices := item.MaxDevices
if maxDevices <= 0 {
maxDevices = 3
}
disabled := item.Disabled
remark := item.Remark
if err == nil && existing.Id != nil {
updates := map[string]interface{}{
"name": name,
"remark": remark,
"quota_bytes": quota,
"download_bytes": item.DownloadBytes,
"upload_bytes": item.UploadBytes,
"expires_at": expires,
"max_devices": maxDevices,
"disabled": disabled,
"banned_until": item.BannedUntil,
"last_connection_at": item.LastConnectionAt,
}
if authID != "" {
updates["auth_id"] = authID
}
if strings.TrimSpace(item.Secret) != "" {
digest, derr := PeerSecretDigest(item.Secret)
if derr != nil {
return derr
}
enc, eerr := EncryptPeerSecret(item.Secret)
if eerr != nil {
return eerr
}
updates["secret_digest"] = digest
updates["secret_ciphertext"] = enc
}
if uerr := dao.UpdatePeer([]int64{*existing.Id}, updates); uerr != nil {
return uerr
}
continue
}
save := dto.PeerSaveDto{
Name: account.Username,
Secret: account.ConPass,
QuotaBytes: account.Quota,
ExpiresAt: account.ExpireTime,
MaxDevices: account.DeviceNo,
Disabled: account.Deleted,
Remark: account.Remark,
createSecret := strings.TrimSpace(item.Secret)
if createSecret == "" {
generated, gerr := util.RandomString(24)
if gerr != nil {
return gerr
}
createSecret = fmt.Sprintf("%s.%s", name, generated)
}
if _, err := CreatePeer(save); err != nil {
return err
secretDigest, derr := PeerSecretDigest(createSecret)
if derr != nil {
return derr
}
secretEncrypted, eerr := EncryptPeerSecret(createSecret)
if eerr != nil {
return eerr
}
if authID == "" {
authID, err = util.RandomString(18)
if err != nil {
return err
}
}
peer := entity.Peer{
Name: &name,
Remark: &remark,
AuthId: &authID,
SecretDigest: &secretDigest,
SecretEncrypted: &secretEncrypted,
QuotaBytes: &quota,
DownloadBytes: &item.DownloadBytes,
UploadBytes: &item.UploadBytes,
ExpiresAt: &expires,
MaxDevices: &maxDevices,
Disabled: &disabled,
BannedUntil: &item.BannedUntil,
LastConnectionAt: &item.LastConnectionAt,
}
if _, serr := dao.SavePeer(peer); serr != nil {
return serr
}
}
return nil
apps/util/encrypt.go
-8
View File
@@ -9,7 +9,6 @@ import (
"encoding/base64"
"errors"
"fmt"
"os"
"io"
"strings"
@@ -124,10 +123,3 @@ func DecryptAESGCM(cipherText string, key []byte) (string, error) {
return string(plain), nil
}
func PeerSecretDigest(rawSecret string) string {
secretKey := strings.TrimSpace(os.Getenv("HY2XS_PEER_SECRET_KEY"))
if secretKey == "" {
secretKey = "hy2xs-peer-secret-key"
}
return HmacSHA256Hex(rawSecret, secretKey)
}