The initial selective strip covered only the Authorization header, but the
dashboard also accepts its JWT via the ?token= query parameter and the
nz-jwt cookie (jwt.go TokenLookup channels). A dashboard credential arriving
through those channels would still reach a NAT backend.
Apply the same classify-then-strip rule to all three channels at NAT
ingress: values verified as dashboard-issued are removed, foreign values
are preserved byte-for-byte. Adds a ServeNAT flow test exercising the live
classifier and a wiring test pinning the gate injection in main().
Since 2640b86 (v2.2.11, 2026-07-20) the NAT ingress deleted the entire
Authorization header, breaking self-hosted apps behind the tunnel that
authenticate with their own Bearer tokens (e.g. the Qinglong panel login
loop).
Strip only credentials issued by this dashboard and forward foreign ones:
- controller.IsDashboardCredential classifies an Authorization value as
dashboard-issued via a signature-only JWT parser derived from the auth
middleware (same key, HS256 pinned, claims validation deliberately
skipped so an expired panel token is still recognized and kept out of
the tunnel) or an api_tokens lookup for PAT-shaped values. Unknown PATs,
foreign signatures, other schemes and missing values pass through. When
classification cannot complete (parser not ready, DB nil or error) the
verdict fails closed (strip) and the log carries a fixed reason only,
never credential content.
- Both NAT capability variants (default, and agent-compat legacy /
invalid-capability / post-consume paths) replace the unconditional
Del("Authorization") with stripDashboardCredential. The rpc package
receives the classifier through SetNATDashboardCredentialGate, the same
injection pattern as SetMCPKillSwitchObserver; an unwired gate keeps the
historical strip-everything behavior.
Tests: controller classification semantics (panel JWT, expired panel JWT
and panel PAT stripped; foreign-signed JWT, unknown nzp_ token, random
strings, non-Bearer schemes and missing header pass through; parser
unavailable, DB nil and DB error fail closed with credential-free logs)
plus rpc unit and flow coverage for both variants (dashboard credentials
never reach the forwarded bytes; foreign and missing Authorization are
forwarded untouched).
Compatibility: no API, database or frontend changes; NAT backends that do
not use Authorization behave exactly as before.
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.
Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.
Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.
Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Replace the {user_id, ip} claim pair with {keyId, uid}:
- keyId is a 32-byte random id that points to a row in the new
jwt_sessions table holding the real user id, bound IP, UA hash,
TokenVersion and expiry.
- uid is the user id encoded through pkg/idcodec; mismatch between
claim uid and session.UserID trips WAF block on the caller IP.
- identityHandler now rejects unknown/revoked/expired sessions, IP
drift and stale TokenVersion. Refresh updates session.ExpiresAt.
User.TokenVersion bumps on password change and revokes outstanding
sessions, so a leaked JWT secret alone is no longer enough to forge
a token. JWTSession rows are GC'd every 10 minutes (expired + grace
or revoked >24h). OAuth2 callback shares the same issue path.
Includes regression tests for happy path, mismatched claim uid,
revoked session, TokenVersion bump, IP drift and unknown keyId.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
* feat: tsdb
* fix(ci): remove --parseGoList=false from swag init to fix dependency resolution
* fix(ci): fix swag init directory and temporary remove s390x support due to cgo issues
* fix(ci): fix swag init output directory to cmd/dashboard/docs
* fix(ci): set GOTOOLCHAIN=auto for gosec
* feat: add system storage maintenance for SQLite and TSDB
* shit
* feat: add s390x support and improve service monitoring
* ci: upgrade goreleaser-cross image to v1.25
* ci: add libzstd-dev:s390x for cross-compilation
* ci: build libzstd for s390x from source
* ci: add libzstd_linux_s390x.go for gozstd linking
* ci: use vendor mode for s390x gozstd build
* ci: clone zstd source for s390x build
* refactor(tsdb): rename MaxDiskUsageGB to MinFreeDiskSpaceGB and optimize queries
- Rename config to accurately reflect VictoriaMetrics behavior: minimum free disk space threshold
- Add QueryServiceHistoryByServerID for batch query optimization
- Fix hasStatus to avoid false status counting when only delay data exists
- Fix service aggregation boundary: use successCount*2 >= count
- Fix serviceID parsing with strconv.ParseUint error handling
- Add TagFiltersCacheSize for better query performance
* feat(api): add server metrics endpoint and simplify service history response
- Add /server/:id/metrics API for querying TSDB server metrics
- Simplify getServiceHistory by removing redundant data conversion
- Change AvgDelay type from float32 to float64
- Remove generated swagger docs (to be regenerated)
- Update TSDB query, writer and tests
* chore: 临时禁用不支持前端
* ci: cache zstd build for s390x to speed up CI
* fix(tsdb): fix race conditions, data correctness and optimize performance
- Fix TOCTOU race between IsClosed() and write/query by holding RLock
- Fix delay=0 excluded from stats by using hasDelay flag instead of value > 0
- Fix fmt.Sscanf -> strconv.ParseUint for server_id parsing with error logging
- Fix buffer unbounded growth by flushing inside lock when over maxSize
- Split makeMetricRow into makeServerMetricRow/makeServiceMetricRow
- Extract InitGlobalSettings() from Open() for VictoriaMetrics globals
- Remove redundant instance/GetInstance/SetInstance singleton
- Add error logging for silently skipped block decode errors
- Optimize WriteBatch* to build all rows in single write call
- Optimize downsample to use linear scan instead of map for sorted data
- Optimize query slice reuse across block iterations
* 服务添加DisplayIndex (#1166)
* 服务添加DisplayIndex
* 根据ai建议修改
---------
Co-authored-by: huYang <306061454@qq.com>
* fix(tsdb): restore SQLite fallback and monthly status reload on restart
- Restore ServiceHistory model and SQLite write fallback when TSDB is disabled
- Reload monthlyStatus (30-day) and serviceStatusToday from TSDB/SQLite on startup
- Add SQLite fallback query for /service/:id/history and /server/:id/service
- Remove breaking GET /service/:id endpoint, keep /service/:id/history only
- Add QueryServiceDailyStats to TSDB for per-day aggregation
- Add tests for monthly status and today stats loading from both TSDB and SQLite
- Migrate ServiceHistory table only when TSDB is disabled
* ci: exclude false-positive gosec rules G117, G703, G704
* feat(api): expose tsdb_enabled in setting response
* ci: restore G115 exclusion accidentally dropped in previous commit
* fix: update version numbers for OfficialAdmin and Official templates
* chore: upgrade frontend
* chore: upgrade frontend
---------
Co-authored-by: 胡说丷刂 <34758853+laosan-xx@users.noreply.github.com>
Co-authored-by: huYang <306061454@qq.com>
* feat: support listening https
* refactor
* modernize
* support snake case in config
* more precise control of config fields
* update goreleaser config
* remove kubeyaml
* fix: expose agent_secret
* chore
* Refactor: Load UserTemplates from embedded yaml file
* feat: add version field to UserTemplates
* refactor: use shell script to fetch frontends
* chore: add *-dist to .gitignore
* refactor: rename to FrontendTemplates
BREAKING CHANGE: This commit changes the `user_templates` filed
in the communication json between backend and the admin-frontend.
Keep user config.yml `user_template` filed.
Sam5440andnaiba/CloudCode
naiba
xvkong233
UUBulb
igophperandigophper
Moraxyc
uubulb
Moraxyc
卖女孩的小火柴
Akkia