SKYMirror
6f1a925833
- 数据库默认文件 filecodebox.db → fileshare.db（config.go 默认值与全部文档/编排同步）
- Go module filecodebox → fileshare（全部 import 同步，build/vet/test 全绿）
- 应用版本 APP_VERSION 2.5.6 → 26.9（health 接口已验证返回 26.9）
- deploy 编排统一：compose 项目名、Postgres 默认凭据、minio 桶名、env 注释
- JWT issuer、存储临时目录前缀、web 包名同步 fileshare
- CI：镜像 tag 以 APP_VERSION 为唯一版本源，main/tag 推送即发布
${VER} + latest；tag 触发时校验 tag 名与 APP_VERSION 一致，防错版
- 本地开发库文件已改名 fileshare.db（含 -shm/-wal 清理）
262 lines
7.7 KiB
Go
262 lines
7.7 KiB
Go
package middleware
|
||
|
||
import (
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"fileshare/internal/audit"
|
||
"fileshare/internal/model"
|
||
"fileshare/internal/response"
|
||
)
|
||
|
||
// auditHooks 审计钩子：由 API 层在响应前后填充与落库。
|
||
// 中间件负责计时与公共字段（IP/UA/设备/耗时），业务上下文通过 auditEntry 传递。
|
||
type auditEntry struct {
|
||
Entry audit.Entry
|
||
// start 请求进入审计中间件的时刻，用于计算耗时。
|
||
start time.Time
|
||
// writer 下载动作时包装的响应计数器。
|
||
writer *bytesCountWriter
|
||
// skip 为 true 表示业务 handler 显式跳过审计（AuditSkip）。
|
||
skip bool
|
||
// recorded 防止重复落库。
|
||
recorded bool
|
||
}
|
||
|
||
// bytesCountWriter 统计响应体写出字节数（用于下载审计）。
|
||
type bytesCountWriter struct {
|
||
gin.ResponseWriter
|
||
count int64
|
||
}
|
||
|
||
func (w *bytesCountWriter) Write(b []byte) (int, error) {
|
||
n, err := w.ResponseWriter.Write(b)
|
||
w.count += int64(n)
|
||
return n, err
|
||
}
|
||
|
||
func (w *bytesCountWriter) WriteString(s string) (int, error) {
|
||
n, err := w.ResponseWriter.WriteString(s)
|
||
w.count += int64(n)
|
||
return n, err
|
||
}
|
||
|
||
// Classifier 判定请求是否属于需审计的动作；返回动作名与是否命中。
|
||
type Classifier func(c *gin.Context) (action string, ok bool)
|
||
|
||
// DefaultClassifier 按任务合同的默认路由语义分类：
|
||
// - 上传：POST /share/file、/share/text、/chunk/upload*、/presign*
|
||
// - 下载：GET /share/download、/share/select、/share/metadata
|
||
// - 管理（L5）：POST/PATCH/DELETE 的敏感管理操作——登录/登出、配置与密码
|
||
// 修改、存储引擎切换、文件更新/删除/策略动作
|
||
//
|
||
// API 层可传入自定义分类器覆盖。
|
||
func DefaultClassifier(c *gin.Context) (string, bool) {
|
||
path := c.FullPath()
|
||
if path == "" {
|
||
path = c.Request.URL.Path
|
||
}
|
||
p := strings.TrimRight(path, "/")
|
||
switch c.Request.Method {
|
||
case http.MethodPost, http.MethodPut:
|
||
switch {
|
||
case p == "/share/file" || p == "/share/text":
|
||
return audit.ActionUpload, true
|
||
case strings.HasPrefix(p, "/chunk/upload"):
|
||
return audit.ActionUpload, true
|
||
case strings.HasPrefix(p, "/presign"):
|
||
return audit.ActionUpload, true
|
||
}
|
||
if adminAuditActions[p] {
|
||
return audit.ActionAdmin, true
|
||
}
|
||
case http.MethodPatch, http.MethodDelete:
|
||
if adminAuditActions[p] {
|
||
return audit.ActionAdmin, true
|
||
}
|
||
case http.MethodGet:
|
||
switch p {
|
||
case "/share/download", "/share/select", "/share/metadata":
|
||
return audit.ActionDownload, true
|
||
}
|
||
}
|
||
return "", false
|
||
}
|
||
|
||
// adminAuditActions 需要审计的管理端敏感操作路由（L5）。
|
||
var adminAuditActions = map[string]bool{
|
||
"/admin/login": true,
|
||
"/admin/logout": true,
|
||
"/admin/config/update": true,
|
||
"/admin/settings/password": true,
|
||
"/admin/storage/switch": true,
|
||
"/admin/file/update": true,
|
||
"/admin/file/delete": true,
|
||
"/admin/file/batch-delete": true,
|
||
"/admin/file/batch-update": true,
|
||
"/admin/file/policy-action": true,
|
||
"/admin/file/batch-policy-action": true,
|
||
}
|
||
|
||
// Audit 审计中间件：对分类器命中的 upload/download/admin 动作写审计日志。
|
||
// handler 通过 AuditSet 填充取件码/文件名/字节数等业务字段；
|
||
// handler 未显式 AuditRecordRequest 时按 HTTP 状态兜底落库。
|
||
func Audit(service *audit.Service, classify Classifier) gin.HandlerFunc {
|
||
if classify == nil {
|
||
classify = DefaultClassifier
|
||
}
|
||
return func(c *gin.Context) {
|
||
start := time.Now()
|
||
|
||
action, ok := classify(c)
|
||
// 未命中审计动作的请求直接放行，不产生审计记录。
|
||
// L5：admin 类动作同样需要建 auditEntry 并落库（登录失败/配置变更等）。
|
||
if !ok {
|
||
c.Next()
|
||
return
|
||
}
|
||
|
||
entry := audit.Entry{
|
||
Action: action,
|
||
IP: GetClientIP(c),
|
||
UserAgent: c.Request.UserAgent(),
|
||
}
|
||
info := audit.ParseUserAgent(entry.UserAgent)
|
||
entry.DeviceOS = info.OS
|
||
entry.DeviceBrowser = info.Browser
|
||
entry.DeviceType = info.Type
|
||
|
||
// 交给后续 handler 填充
|
||
state := &auditEntry{Entry: entry, start: start}
|
||
c.Set("auditEntry", state)
|
||
|
||
// 下载动作：包装 Writer 以捕获实际写出字节数（必须在 c.Next() 前替换）
|
||
if action == audit.ActionDownload {
|
||
state.writer = &bytesCountWriter{ResponseWriter: c.Writer}
|
||
c.Writer = state.writer
|
||
}
|
||
|
||
c.Next()
|
||
|
||
// 下载兜底统计：handler 未填 TransferredBytes 时取响应写出字节
|
||
if action == audit.ActionDownload && state.Entry.TransferredBytes == 0 &&
|
||
!state.recorded && !state.skip && state.writer != nil {
|
||
state.Entry.TransferredBytes = state.writer.count
|
||
}
|
||
|
||
// handler 未显式落库时兜底记录
|
||
ae, exists := c.Get("auditEntry")
|
||
if !exists {
|
||
return
|
||
}
|
||
state, isState := ae.(*auditEntry)
|
||
if !isState || state.recorded || state.skip {
|
||
return
|
||
}
|
||
state.Entry.Duration = time.Since(start)
|
||
state.Entry.Actor = resolveActor(c)
|
||
status := c.Writer.Status()
|
||
switch {
|
||
case state.Entry.Result != "":
|
||
// handler 已给出结论
|
||
case status >= 500:
|
||
state.Entry.Result = model.AuditResultFailed
|
||
case status == 401 || status == 403 || status == 423 || status == 429 || status == 428:
|
||
state.Entry.Result = model.AuditResultDenied
|
||
case status >= 400:
|
||
state.Entry.Result = model.AuditResultFailed
|
||
default:
|
||
state.Entry.Result = model.AuditResultSuccess
|
||
}
|
||
switch {
|
||
case state.Entry.ErrorMsg != "":
|
||
// handler 已给出错误信息
|
||
case c.Errors.String() != "":
|
||
state.Entry.ErrorMsg = c.Errors.String()
|
||
case status >= 400:
|
||
// 兜底：记录 HTTP 状态
|
||
state.Entry.ErrorMsg = "HTTP " + itoa64(int64(status))
|
||
}
|
||
service.Record(state.Entry)
|
||
state.recorded = true
|
||
}
|
||
}
|
||
|
||
// AuditEntry 获取当前请求的审计状态（由 Audit 中间件创建）。
|
||
func AuditEntry(c *gin.Context) *auditEntry {
|
||
if v, ok := c.Get("auditEntry"); ok {
|
||
if ae, ok := v.(*auditEntry); ok {
|
||
return ae
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// AuditSet 填充当前请求的审计字段；仅对已启用审计的请求生效。
|
||
func AuditSet(c *gin.Context, fn func(e *audit.Entry)) {
|
||
if ae := AuditEntry(c); ae != nil && fn != nil {
|
||
fn(&ae.Entry)
|
||
}
|
||
}
|
||
|
||
// AuditRecordRequest 显式触发落库（含耗时）；由 handler 在响应前调用。
|
||
func AuditRecordRequest(c *gin.Context, service *audit.Service, result, errMsg string) {
|
||
ae := AuditEntry(c)
|
||
if ae == nil || ae.recorded || ae.skip {
|
||
return
|
||
}
|
||
ae.Entry.Duration = time.Since(ae.start)
|
||
ae.Entry.Result = result
|
||
ae.Entry.ErrorMsg = errMsg
|
||
ae.Entry.Actor = resolveActor(c)
|
||
service.Record(ae.Entry)
|
||
ae.recorded = true
|
||
}
|
||
|
||
// AuditSkip 标记当前请求不写审计。
|
||
func AuditSkip(c *gin.Context) {
|
||
if ae := AuditEntry(c); ae != nil {
|
||
ae.skip = true
|
||
}
|
||
}
|
||
|
||
// resolveActor 判断请求者角色：管理员 JWT 有效 → admin，否则 guest。
|
||
func resolveActor(c *gin.Context) string {
|
||
header := c.GetHeader("Authorization")
|
||
if len(header) > 7 && header[:7] == "Bearer " {
|
||
// 仅检查声明是否有效，不重复校验签名逻辑（AdminAuth 已处理受保护路由）
|
||
if _, ok := c.Get("claims"); ok {
|
||
return audit.ActorAdmin
|
||
}
|
||
}
|
||
return audit.ActorGuest
|
||
}
|
||
|
||
// AuditRecord 显式按结果落库；duration 由中间件按起始时间计算。
|
||
func AuditRecord(c *gin.Context, service *audit.Service, result, errMsg string) {
|
||
ae := AuditEntry(c)
|
||
if ae == nil || ae.recorded || ae.skip {
|
||
return
|
||
}
|
||
AuditRecordRequest(c, service, result, errMsg)
|
||
}
|
||
|
||
// GuardNotInitialized 系统未初始化守卫：除 setup/health 外返回 428。
|
||
func GuardNotInitialized(isInit func() bool) gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
if isInit() {
|
||
c.Next()
|
||
return
|
||
}
|
||
path := c.Request.URL.Path
|
||
if path == "/setup" || path == "/api/v1/health" {
|
||
c.Next()
|
||
return
|
||
}
|
||
response.Fail(c, 428, "系统未初始化，请先完成初始化")
|
||
}
|
||
}
|