Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Browse Source 
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-30 15:56:44 +00:00
co-authored by cloudcode
parent 029695344c
commit e8dabf5bc6
153 changed files with 16974 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/jwt.go
+11 -6
View File
@@ -35,7 +35,10 @@ func issueJWTSession(c *gin.Context, user *model.User, jwtTimeoutHours int) (map
if err != nil {
return nil, err
}
hashUID, err := idcodec.Encode(user.ID)
// encodedUID is reversible Sqids obfuscation keyed by JWTSecretKey, NOT
// a one-way hash. It exists to defeat enumeration on the wire, not to
// keep the uid confidential — see L2 note in idcodec docs.
encodedUID, err := idcodec.Encode(user.ID)
if err != nil {
return nil, err
}
@@ -54,7 +57,7 @@ func issueJWTSession(c *gin.Context, user *model.User, jwtTimeoutHours int) (map
return nil, err
}
return map[string]interface{}{
jwtClaimUserID: hashUID,
jwtClaimUserID: encodedUID,
jwtClaimKeyID: keyID,
}, nil
}
@@ -91,6 +94,7 @@ func initParams() *jwt.GinJWTMiddleware {
TimeFunc: time.Now,
LoginResponse: func(c *gin.Context, code int, token string, expire time.Time) {
setCSRFCookie(c)
c.JSON(http.StatusOK, model.CommonResponse[model.LoginResponse]{
Success: true,
Data: model.LoginResponse{
@@ -120,11 +124,11 @@ func identityHandler() func(c *gin.Context) any {
if !ok || keyID == "" {
return nil
}
hashUID, ok := claims[jwtClaimUserID].(string)
if !ok || hashUID == "" {
encodedUID, ok := claims[jwtClaimUserID].(string)
if !ok || encodedUID == "" {
return nil
}
claimUID, err := idcodec.Decode(hashUID)
claimUID, err := idcodec.Decode(encodedUID)
if err != nil {
realIP := c.GetString(model.CtxKeyRealIPStr)
model.BlockIP(singleton.DB, realIP, model.WAFBlockReasonTypeBruteForceToken, model.BlockIDToken)
@@ -237,7 +241,7 @@ func unauthorized() func(c *gin.Context, code int, message string) {
// @Tags auth required
// @Produce json
// @Success 200 {object} model.CommonResponse[model.LoginResponse]
// @Router /refresh-token [get]
// @Router /refresh-token [post]
func refreshResponse(c *gin.Context, code int, token string, expire time.Time) {
if keyID := c.GetString(jwtClaimKeyID); keyID != "" {
_ = singleton.DB.Model(&model.JWTSession{}).
@@ -247,6 +251,7 @@ func refreshResponse(c *gin.Context, code int, token string, expire time.Time) {
"last_used_at": time.Now(),
}).Error
}
setCSRFCookie(c)
c.JSON(http.StatusOK, model.CommonResponse[model.LoginResponse]{
Success: true,
Data: model.LoginResponse{