Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(service): replace EnableShowInService with HideForGuest

Browse Source 
Mirror the server HideForGuest flag on services: rename the field
(dropping the gorm default), invert userCanViewService so a service is
visible to guests by default and hidden only when HideForGuest is set,
and flip the public-stats filter in servicesentinel accordingly. Update
the visibility and permission-matrix tests to the new semantics.
This commit is contained in:
naiba
2026-06-02 03:31:36 +00:00
parent bb38a9d4d2
commit 836f1db4b7
6 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/permission_matrix_test.go
+2 -2
View File
@@ -261,8 +261,8 @@ func TestShowServiceFiltersCycleTransferStatsLikeServerList(t *testing.T) {
assert.NoError(t, singleton.DB.Create(&model.Server{Common: model.Common{ID: 3, UserID: 200}, Name: "hidden member server", UUID: "hidden-member-server", HideForGuest: true}).Error)
singleton.ServerShared = singleton.NewServerClass()
assert.NoError(t, singleton.DB.Create(&model.Service{Common: model.Common{ID: 10, UserID: 1}, Name: "shown service", EnableShowInService: true}).Error)
assert.NoError(t, singleton.DB.Create(&model.Service{Common: model.Common{ID: 11, UserID: 1}, Name: "hidden service"}).Error)
assert.NoError(t, singleton.DB.Create(&model.Service{Common: model.Common{ID: 10, UserID: 1}, Name: "shown service"}).Error)
assert.NoError(t, singleton.DB.Create(&model.Service{Common: model.Common{ID: 11, UserID: 1}, Name: "hidden service", HideForGuest: true}).Error)
originalServiceSentinel := singleton.ServiceSentinelShared
serviceSentinel, err := singleton.NewServiceSentinel(make(chan *model.Service, 2))
cmd/dashboard/controller/permissions.go
+6 -8
View File
@@ -489,19 +489,17 @@ func userCanViewService(c *gin.Context, service *model.Service) bool {
if service == nil {
return false
}
// EnableShowInService 是显式公开旗标：guest 都可看，PAT 白名单不收窄
// 公开视图（公开 service 本来就不绑特定 server）。其它分支才走 PAT。
if service.EnableShowInService {
return true
}
// HideForGuest 默认公开，置 true 才对 guest 隐藏，语义与 Server.HideForGuest 对齐。
if service.HideForGuest {
if _, isMember := c.Get(model.CtxKeyAuthorizedUser); !isMember {
return false
}
// 关键：必须先让 Service.HasPermission 跑 PAT 白名单收口，再让 admin
// 身份在没有 PAT 的请求上短路放行。否则 admin 自己签发的 server_ids
// 受限 PAT 会被 admin 早返回直接放过，绕过 list/history 入口的 PAT 边界。
// 必须先让 Service.HasPermission 跑 PAT 白名单收口，再让 admin 在无 PAT 请求上
// 短路放行，否则 admin 自签的受限 PAT 会被早返回绕过 list/history 的 PAT 边界。
return service.HasPermission(c)
}
return true
}
func assertOwnsNotificationGroup(c *gin.Context, groupID uint64) error {
if groupID == 0 {
cmd/dashboard/controller/service.go
+2 -2
View File
@@ -489,7 +489,7 @@ func createService(c *gin.Context) (uint64, error) {
m.LatencyNotify = mf.LatencyNotify
m.MinLatency = mf.MinLatency
m.MaxLatency = mf.MaxLatency
m.EnableShowInService = mf.EnableShowInService
m.HideForGuest = mf.HideForGuest
m.EnableTriggerTask = mf.EnableTriggerTask
m.RecoverTriggerTasks = mf.RecoverTriggerTasks
m.FailTriggerTasks = mf.FailTriggerTasks
@@ -558,7 +558,7 @@ func updateService(c *gin.Context) (any, error) {
m.LatencyNotify = mf.LatencyNotify
m.MinLatency = mf.MinLatency
m.MaxLatency = mf.MaxLatency
m.EnableShowInService = mf.EnableShowInService
m.HideForGuest = mf.HideForGuest
m.EnableTriggerTask = mf.EnableTriggerTask
m.RecoverTriggerTasks = mf.RecoverTriggerTasks
m.FailTriggerTasks = mf.FailTriggerTasks
cmd/dashboard/controller/service_visibility_test.go
+8 -6
View File
@@ -20,29 +20,29 @@ func newServiceVisibilityCtx(viewer *model.User) *gin.Context {
}
func TestUserCanViewServiceVisibleServiceIsPublic(t *testing.T) {
visible := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: true}
assert.True(t, userCanViewService(newServiceVisibilityCtx(nil), visible), "guest must see EnableShowInService=true regardless of owner")
visible := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: false}
assert.True(t, userCanViewService(newServiceVisibilityCtx(nil), visible), "guest must see HideForGuest=false regardless of owner")
}
func TestUserCanViewServiceHiddenServiceRejectsGuest(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
assert.False(t, userCanViewService(newServiceVisibilityCtx(nil), hidden), "guest must NOT see hidden service via per-server / per-id sideband endpoints")
}
func TestUserCanViewServiceHiddenServiceRejectsForeignMember(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
foreign := &model.User{Common: model.Common{ID: 200}, Role: model.RoleMember}
assert.False(t, userCanViewService(newServiceVisibilityCtx(foreign), hidden), "foreign member must NOT see another user's hidden service")
}
func TestUserCanViewServiceHiddenServiceAllowsOwner(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
owner := &model.User{Common: model.Common{ID: 100}, Role: model.RoleMember}
assert.True(t, userCanViewService(newServiceVisibilityCtx(owner), hidden), "owner must still see their own hidden service")
}
func TestUserCanViewServiceHiddenServiceAllowsAdmin(t *testing.T) {
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, EnableShowInService: false}
hidden := &model.Service{Common: model.Common{ID: 1, UserID: 100}, HideForGuest: true}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
assert.True(t, userCanViewService(newServiceVisibilityCtx(admin), hidden), "admin must be able to see any hidden service")
}
@@ -55,6 +55,7 @@ func TestUserCanViewServiceLimitedPATShouldDenyAdminWhenOutsideWhitelist(t *test
Common: model.Common{ID: 1, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{2: true},
HideForGuest: true,
}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
tok := &model.APIToken{ID: 7, UserID: 1}
@@ -72,6 +73,7 @@ func TestUserCanViewServiceLimitedPATAllowsAdminInsideWhitelist(t *testing.T) {
Common: model.Common{ID: 2, UserID: 100},
Cover: model.ServiceCoverIgnoreAll,
SkipServers: map[uint64]bool{1: true},
HideForGuest: true,
}
admin := &model.User{Common: model.Common{ID: 1}, Role: model.RoleAdmin}
tok := &model.APIToken{ID: 7, UserID: 1}
model/service.go
+1 -1
View File
@@ -216,7 +216,7 @@ type Service struct {
Cover uint8 `json:"cover"`
EnableTriggerTask bool `gorm:"default: false" json:"enable_trigger_task,omitempty"`
EnableShowInService bool `gorm:"default: false" json:"enable_show_in_service,omitempty"`
HideForGuest bool `json:"hide_for_guest,omitempty"` // 对游客隐藏
FailTriggerTasksRaw string `gorm:"default:'[]'" json:"-"`
RecoverTriggerTasksRaw string `gorm:"default:'[]'" json:"-"`
model/service_api.go
+1 -1
View File
@@ -14,7 +14,7 @@ type ServiceForm struct {
MaxLatency float32 `json:"max_latency,omitempty" default:"0.0"`
LatencyNotify bool `json:"latency_notify,omitempty" validate:"optional"`
EnableTriggerTask bool `json:"enable_trigger_task,omitempty" validate:"optional"`
EnableShowInService bool `json:"enable_show_in_service,omitempty" validate:"optional"`
HideForGuest bool `json:"hide_for_guest,omitempty" validate:"optional"`
FailTriggerTasks []uint64 `json:"fail_trigger_tasks,omitempty"`
RecoverTriggerTasks []uint64 `json:"recover_trigger_tasks,omitempty"`
SkipServers map[uint64]bool `json:"skip_servers,omitempty"`