nezha_domains

Buriburizaemon/nezha_domains

Fork 0

mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00

Files

T

History

naibaandcloudcode b1d84c6b2f fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

- ServeRPC now applies real-IP + WAF interceptors to streaming RPCs
  (RequestTask, IOStream), not just unary calls; without them
  authHandler.check saw an empty real IP so brute-force BlockIP counters
  never keyed on a source and the WAF block table was bypassed at the
  stream entrypoint. Factored real-IP resolution into ctxWithRealIP shared
  by unary and stream paths.
- handleFsRead rejects negative offset/length; handleFsWrite validates
  if_match_sha256 is 64 hex chars before dispatch.
- createAPIToken always verifies each server_id exists (even for admins),
  so an admin cannot bind a PAT to a not-yet-created server id that a
  future server would auto-inherit.
- Add relay zero-length-chunk rejection regression test.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 05:51:32 +00:00

waf

fix: add a default error message for waf page (#1145 )

2025-12-04 21:52:12 +08:00

alertrule_pat_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

alertrule.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_legacy_migration_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_optional_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry_race_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_empty_doc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_config_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_test.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

api_token.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

batch_move_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

controller.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_cover_validation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_manual_csrf_test.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_service_cover_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_update_owner_uid_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

csrf_signed_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

ddns.go

ddns: support provider hurricane electric (#1036 )

2025-03-19 21:52:16 +08:00

fm.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

force_update_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

frontend_fallback_api_tokens_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

frontend_fallback_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

jwt_session_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_audit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_body_limit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_capability_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_capability.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_classify_disabled_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_enable_flag_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_end_to_end_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_kill_switch_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_method_not_allowed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_bypass_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_defaults_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_malformed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_prune_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_sdk_compat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_error_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_timeout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_fs_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_fs.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

mcp_tools_meta.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_server_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_server.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_audit_throttle_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_audit_throttle.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_cancel_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_consume_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_correctness_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_data_frame_collision_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_download_finalcheck_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_failure_audit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_gc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_no_full_buffer_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_path_cap_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_size_guard_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_spool.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_token_hmac_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

mcp_transfer_upload_args_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_zero_chunk_test.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

mcp_transfer.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

mcp.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

nat.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156 )

2026-01-10 17:29:10 +08:00

oauth2_csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

oauth2_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

oauth2.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

pat_whitelist_view_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permission_matrix_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

permissions_cover_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permissions.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

rest_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_allof_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_doc_consistency_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_doc.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group_update_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_cache_key_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_skip_enabled_only_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_enable_mcp_save_failure_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_enable_mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_reserved_hosts_test.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

setting.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

stream_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

stream_pat_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

tenant_isolation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

terminal.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_cancel_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_list_filter_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_retry_authz_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_retry_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

trigger_task_pat_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat(waf): return ip in string literal (#947 )

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

ws.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00