Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,011 Commits 1 Branch 2 Tags
24c7a898cf27ec83e89db7f5b42af8534089b876
Commit Graph
31 Commits
Author SHA1 Message Date
naibaandnaiba/CloudCode c756ef9385 fix(rpc): make IO stream lifecycle race-safe 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:26:19 +00:00
naibaandcloudcode e8dabf5bc6 feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation 
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
 2026-05-30 15:56:44 +00:00
naiba 6b88cdb012 feat: server transfer rotation 2026-05-25 10:17:34 +00:00
naibaandnaiba/CloudCode 8d21062c3b fix(rpc): authorize agent task results 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-21 02:02:02 +00:00
naibaandnaiba/CloudCode e38a0ef469 fix(cron): restrict task delivery by owner 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
UUBulb f34b263b69 improve transfer record logic (#1033) 
* improve transfer record logic

* refactor

* modernize loops

* remove unused type conversions

* update dependencies

* script: keep .gitkeep files

* fix

* remove clear
 2025-03-19 22:21:21 +08:00
UUBulb af55fae652 improve check for offline rules (#1013) 
* improve check for offline rules

* bug fixes

* update dependencies

* fix error wrap

* fix offline check

* improve readability
 2025-03-02 15:37:21 +08:00
UUBulb ea068d4db1 refactor: simplify server & service manipulation (#993) 
* refactor: simplify server & service manipulation

* update

* fix

* update for nat, ddns & notification

* chore

* update cron

* update dependencies

* use of function iterators

* update default dns servers
 2025-02-21 23:08:12 +08:00
UUBulb dc0132c9aa feat: user roles (#852) 
* [WIP] feat: user roles

* update

* update

* admin handler

* update

* feat: user-specific connection secret

* simplify some logics

* cleanup

* update waf

* update user api error handling

* update waf api

* fix codeql

* update waf table

* fix several problems

* add pagination for waf api

* update permission checks

* switch to runtime check

* 1

* cover?

* some changes
 2024-12-22 00:05:41 +08:00
UUBulb 3e3994d3c9 chore: use cmp (#568) 2024-12-08 20:21:35 +08:00
naiba a7e4fe0909 rename repo 2024-11-28 19:38:54 +08:00
UUBulb e4c6502363 optimize sorting, fix a bug (#15) 2024-11-23 01:13:39 +08:00
UUBulb 1c3fd9af1c add force update server api (#13) 2024-11-20 21:36:21 +08:00
uubulb d56224a118 feat: add i18n support 2024-11-01 05:07:04 +08:00
UUBulb 8bfe70d519 add cron, nat api & refactor alert rule (#459) 
* add cron api & refactor alert rule

* add nat api

* fix swagger

* remove unnecessary steps
 2024-10-26 23:57:47 +08:00
UUBulb 28b606ef7b implement notification group (#450) 
* implement notification group

* some fixes

* fix sql

* add listNotification

* retrieve notification from map

* create notification_group_notification if non-exist

* NotificationIDToGroup -> NotificationIDToGroups

* clean
 2024-10-23 21:55:12 +08:00
naiba 1e704d38ad ✨ 内置HTTP内网穿透 2024-07-14 19:41:50 +08:00
naiba 946ce73096 🚀 dashboard v0.14.6 with installer v0.11.0 2022-10-31 21:54:37 +08:00
naiba df2e8aac06 rename CronCoverSelf to CronCoverAlertTrigger 2022-09-14 22:14:47 +08:00
Akkia 201214fd54 update for CodeQL 2022-09-14 11:37:00 +08:00
Akkia c900941f3b feat: 报警规则支持绑定触发任务 2022-09-14 11:14:23 +08:00
Akkia 048dd35129 添加触发任务类型 2022-09-13 06:14:47 +08:00
Akkia 56e9f5a637 update: 发送消息前对服务器状态进行拷贝 保证消息发送的状态指标与触发该请求的状态指标相同 2022-04-18 19:59:42 +08:00
Akkia 6e14bdb4eb optimize: 在查找到Server对象后移除ServerID标识符 2022-04-17 18:08:30 +08:00
Akkia f64c7b6301 fix: 修复修改通知方式所在组后 不会移除其原有map映射关系的问题 2022-04-15 23:23:51 +08:00
Akkia 050c613ec3 update: 调度失败的计划任务仅通知其所属的通知组 2022-04-15 10:55:21 +08:00
Akkia 9ac2052fbf fix "for range" pointer issue 2022-04-15 03:20:42 +08:00
Akkia 4d2ee1fc14 Merge branch 'master' into enhance-notification 2022-04-14 21:22:37 +08:00
Akkia 2ebcc13ab8 WIP: 通知方式分组 支持将不同的报警｜监控｜计划任务的通知 发送到指定的通知分组 2022-04-14 21:06:42 +08:00
naiba ff94e8809a ⬆️ Upgrade dependencies 2022-04-14 16:41:34 +08:00
Akkia 09d3607cee refactor: 优化代码组织结构 2022-04-12 13:16:33 +08:00