Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-20 10:10:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): split inventory scope out of server scope

Browse Source 
Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).

Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.
This commit is contained in:
naiba
2026-05-31 15:14:41 +00:00
parent f7f8264ec0
commit 083bc985c5
17 changed files with 257 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/scope_doc_consistency_test.go
+7 -7
View File
@@ -32,25 +32,25 @@ type scopedRoute struct {
func canonicalRoutes() []scopedRoute {
return []scopedRoute{
{"GET", "/api/v1/server", "nezha:server:read"},
{"GET", "/api/v1/server", "nezha:inventory:read"},
{"PATCH", "/api/v1/server/{id}", "nezha:server:write"},
{"GET", "/api/v1/server/config/{id}", "nezha:server:write"},
{"POST", "/api/v1/server/config", "nezha:server:write"},
{"POST", "/api/v1/batch-delete/server", "nezha:server:delete"},
{"POST", "/api/v1/batch-delete/server", "nezha:inventory:delete"},
{"POST", "/api/v1/batch-move/server", "nezha:server:write"},
{"POST", "/api/v1/force-update/server", "nezha:server:write"},
{"POST", "/api/v1/server-group", "nezha:server:write"},
{"PATCH", "/api/v1/server-group/{id}", "nezha:server:write"},
{"POST", "/api/v1/batch-delete/server-group", "nezha:server:delete"},
{"POST", "/api/v1/batch-delete/server-group", "nezha:inventory:delete"},
{"POST", "/api/v1/terminal", "nezha:server:exec"},
{"GET", "/api/v1/ws/terminal/{id}", "nezha:server:exec"},
{"POST", "/api/v1/file", "nezha:server:write"},
{"GET", "/api/v1/ws/file/{id}", "nezha:server:write"},
{"POST", "/api/v1/file", "nezha:server:read+write+delete"},
{"GET", "/api/v1/ws/file/{id}", "nezha:server:read+write+delete"},
// optional-auth scoped routes（controller.go:91-98）。这些 GET 端点既支持
// 未登录访客，也接受 PAT；当走 PAT 路径时 restScopeMiddleware 会强制对应的
// read scope。漏掉这一段会让 scope_doc.go 与实际 router 漂移而测试不报错。
{"GET", "/api/v1/ws/server", "nezha:server:read"},
{"GET", "/api/v1/server-group", "nezha:server:read"},
{"GET", "/api/v1/ws/server", "nezha:inventory:read"},
{"GET", "/api/v1/server-group", "nezha:inventory:read"},
{"GET", "/api/v1/service", "nezha:service:read"},
{"GET", "/api/v1/service/server", "nezha:service:read"},
{"GET", "/api/v1/service/{id}/history", "nezha:service:read"},