Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-20 18:20:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(service): replace EnableShowInService with HideForGuest

Browse Source 
Mirror the server HideForGuest flag on services: rename the field
(dropping the gorm default), invert userCanViewService so a service is
visible to guests by default and hidden only when HideForGuest is set,
and flip the public-stats filter in servicesentinel accordingly. Update
the visibility and permission-matrix tests to the new semantics.
This commit is contained in:
naiba
2026-06-02 03:31:36 +00:00
parent bb38a9d4d2
commit 836f1db4b7
6 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/service_visibility_test.go
+14 -12
View File
@@ -20,29 +20,29 @@ func newServiceVisibilityCtx(viewer *model.User) *gin.Context {
}
func TestUserCanViewServiceVisibleServiceIsPublic(t *testing.T) {
visible := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: true}
assert.True(t, userCanViewService(newServiceVisibilityCtx(nil), visible), "guest must see EnableShowInService=true regardless of owner")
visible := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: false}
assert.True(t, userCanViewService(newServiceVisibilityCtx(nil), visible), "guest must see HideForGuest=false regardless of owner")
}
func TestUserCanViewServiceHiddenServiceRejectsGuest(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
assert.False(t, userCanViewService(newServiceVisibilityCtx(nil), hidden), "guest must NOT see hidden service via per-server / per-id sideband endpoints")
}
func TestUserCanViewServiceHiddenServiceRejectsForeignMember(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
foreign := &model.User{Common: model.Common{ID: 200}, Role: model.RoleMember}
assert.False(t, userCanViewService(newServiceVisibilityCtx(foreign), hidden), "foreign member must NOT see another user's hidden service")
}
func TestUserCanViewServiceHiddenServiceAllowsOwner(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
owner := &model.User{Common: model.Common{ID: 100}, Role: model.RoleMember}
assert.True(t, userCanViewService(newServiceVisibilityCtx(owner), hidden), "owner must still see their own hidden service")
}
func TestUserCanViewServiceHiddenServiceAllowsAdmin(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
assert.True(t, userCanViewService(newServiceVisibilityCtx(admin), hidden), "admin must be able to see any hidden service")
}
@@ -52,9 +52,10 @@ func TestUserCanViewServiceHiddenServiceAllowsAdmin(t *testing.T) {
// 保持对称，避免 hidden service 通过 admin 早返回泄漏给受限 PAT。
func TestUserCanViewServiceLimitedPATShouldDenyAdminWhenOutsideWhitelist(t *testing.T) {
hidden := &model.Service{
Common: model.Common{ID: 1, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{2: true},
Common: model.Common{ID: 1, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{2: true},
HideForGuest: true,
}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
tok := &model.APIToken{ID: 7, UserID: 1}
@@ -69,9 +70,10 @@ func TestUserCanViewServiceLimitedPATShouldDenyAdminWhenOutsideWhitelist(t *test
func TestUserCanViewServiceLimitedPATAllowsAdminInsideWhitelist(t *testing.T) {
visible := &model.Service{
Common: model.Common{ID: 2, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{1: true},
Common: model.Common{ID: 2, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{1: true},
HideForGuest: true,
}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
tok := &model.APIToken{ID: 7, UserID: 1}