Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-20 02:00:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): split inventory scope out of server scope

Browse Source 
Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).

Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.
This commit is contained in:
naiba
2026-05-31 15:14:41 +00:00
parent f7f8264ec0
commit 083bc985c5
17 changed files with 257 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/scope_doc.go
+13 -9
View File
@@ -11,10 +11,14 @@
// # Scope naming
//
// nezha:{resource}:{verb}
// resource: server | service | alertrule | cron | ddns | nat |
// resource: inventory | server | service | alertrule | cron | ddns | nat |
// notification | notification-group | transfer | admin
// verb: read | write | delete | exec
//
// inventory vs server：inventory 管“能看到/能删哪些机器”（列出 server /
// server-group、删除 server / server-group、MCP server.list）；server 管对
// 已知机器的运行态操作（exec / 文件读写 / 编辑配置 / metrics / server.get）。
//
// nezha:* Admin-only superuser
// nezha:admin:* Admin-only user/waf/setting/online-user management
// nezha:<res>:* All actions on a resource
@@ -22,7 +26,7 @@
// # MCP tools (POST /mcp tools/call)
//
// meta.whoami — (any scope)
// server.list nezha:server:read
// server.list nezha:inventory:read
// server.get nezha:server:read
// server.exec nezha:server:exec
// fs.list nezha:server:read
@@ -34,22 +38,22 @@
//
// # REST endpoints (PAT required scope)
//
// GET /api/v1/server nezha:server:read
// GET /api/v1/server nezha:inventory:read
// PATCH /api/v1/server/{id} nezha:server:write
// GET /api/v1/server/config/{id} nezha:server:write
// POST /api/v1/server/config nezha:server:write
// POST /api/v1/batch-delete/server nezha:server:delete
// POST /api/v1/batch-delete/server nezha:inventory:delete
// POST /api/v1/batch-move/server nezha:server:write
// POST /api/v1/force-update/server nezha:server:write
// POST /api/v1/server-group nezha:server:write
// PATCH /api/v1/server-group/{id} nezha:server:write
// POST /api/v1/batch-delete/server-group nezha:server:delete
// POST /api/v1/batch-delete/server-group nezha:inventory:delete
// POST /api/v1/terminal nezha:server:exec
// GET /api/v1/ws/terminal/{id} nezha:server:exec
// POST /api/v1/file nezha:server:write
// GET /api/v1/ws/file/{id} nezha:server:write
// GET /api/v1/ws/server nezha:server:read
// GET /api/v1/server-group nezha:server:read
// POST /api/v1/file nezha:server:read+write+delete
// GET /api/v1/ws/file/{id} nezha:server:read+write+delete
// GET /api/v1/ws/server nezha:inventory:read
// GET /api/v1/server-group nezha:inventory:read
// GET /api/v1/service nezha:service:read
// GET /api/v1/service/server nezha:service:read
// GET /api/v1/service/{id}/history nezha:service:read