mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 17:50:12 +00:00
naiba
083bc985c5
Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).
Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.
162 lines
6.7 KiB
Go
162 lines
6.7 KiB
Go
package controller
|
||
|
||
// Pins the human-readable PAT scope table in scope_doc.go to the actual
|
||
// REST routes registered in controller.go. Without this, the table drifts
|
||
// silently every time a route is added/changed — and the table is the
|
||
// source LLM clients (and our frontend SCOPE_OPTIONS copy) read from.
|
||
//
|
||
// The check is intentionally textual: scope_doc.go is a doc-only file with
|
||
// no runtime hooks, and routers() bakes scopes into closures at boot, so
|
||
// there is no cheap way to reflect them at test time without an invasive
|
||
// refactor. Instead we maintain a single canonical (method, path, scope)
|
||
// list here and assert both directions:
|
||
// - every entry appears verbatim in scope_doc.go
|
||
// - every scope-bearing line in scope_doc.go appears in the table
|
||
// Adding a new scoped route must update both files, and forgetting either
|
||
// is a compile-on-demand failure.
|
||
|
||
import (
|
||
"os"
|
||
"regexp"
|
||
"strings"
|
||
"testing"
|
||
|
||
"github.com/stretchr/testify/require"
|
||
)
|
||
|
||
type scopedRoute struct {
|
||
Method string
|
||
Path string
|
||
Scope string
|
||
}
|
||
|
||
func canonicalRoutes() []scopedRoute {
|
||
return []scopedRoute{
|
||
{"GET", "/api/v1/server", "nezha:inventory:read"},
|
||
{"PATCH", "/api/v1/server/{id}", "nezha:server:write"},
|
||
{"GET", "/api/v1/server/config/{id}", "nezha:server:write"},
|
||
{"POST", "/api/v1/server/config", "nezha:server:write"},
|
||
{"POST", "/api/v1/batch-delete/server", "nezha:inventory:delete"},
|
||
{"POST", "/api/v1/batch-move/server", "nezha:server:write"},
|
||
{"POST", "/api/v1/force-update/server", "nezha:server:write"},
|
||
{"POST", "/api/v1/server-group", "nezha:server:write"},
|
||
{"PATCH", "/api/v1/server-group/{id}", "nezha:server:write"},
|
||
{"POST", "/api/v1/batch-delete/server-group", "nezha:inventory:delete"},
|
||
{"POST", "/api/v1/terminal", "nezha:server:exec"},
|
||
{"GET", "/api/v1/ws/terminal/{id}", "nezha:server:exec"},
|
||
{"POST", "/api/v1/file", "nezha:server:read+write+delete"},
|
||
{"GET", "/api/v1/ws/file/{id}", "nezha:server:read+write+delete"},
|
||
// optional-auth scoped routes（controller.go:91-98）。这些 GET 端点既支持
|
||
// 未登录访客，也接受 PAT；当走 PAT 路径时 restScopeMiddleware 会强制对应的
|
||
// read scope。漏掉这一段会让 scope_doc.go 与实际 router 漂移而测试不报错。
|
||
{"GET", "/api/v1/ws/server", "nezha:inventory:read"},
|
||
{"GET", "/api/v1/server-group", "nezha:inventory:read"},
|
||
{"GET", "/api/v1/service", "nezha:service:read"},
|
||
{"GET", "/api/v1/service/server", "nezha:service:read"},
|
||
{"GET", "/api/v1/service/{id}/history", "nezha:service:read"},
|
||
{"GET", "/api/v1/server/{id}/service", "nezha:service:read"},
|
||
{"GET", "/api/v1/server/{id}/metrics", "nezha:server:read"},
|
||
|
||
{"GET", "/api/v1/transfer", "nezha:transfer:read"},
|
||
{"POST", "/api/v1/transfer/{id}/cancel", "nezha:transfer:write"},
|
||
{"POST", "/api/v1/transfer/{id}/retry", "nezha:transfer:write"},
|
||
{"GET", "/api/v1/ws/transfer", "nezha:transfer:read"},
|
||
|
||
{"GET", "/api/v1/service/list", "nezha:service:read"},
|
||
{"POST", "/api/v1/service", "nezha:service:write"},
|
||
{"PATCH", "/api/v1/service/{id}", "nezha:service:write"},
|
||
{"POST", "/api/v1/batch-delete/service", "nezha:service:delete"},
|
||
|
||
{"GET", "/api/v1/alert-rule", "nezha:alertrule:read"},
|
||
{"POST", "/api/v1/alert-rule", "nezha:alertrule:write"},
|
||
{"PATCH", "/api/v1/alert-rule/{id}", "nezha:alertrule:write"},
|
||
{"POST", "/api/v1/batch-delete/alert-rule", "nezha:alertrule:delete"},
|
||
|
||
{"GET", "/api/v1/cron", "nezha:cron:read"},
|
||
{"POST", "/api/v1/cron", "nezha:cron:write"},
|
||
{"PATCH", "/api/v1/cron/{id}", "nezha:cron:write"},
|
||
{"POST", "/api/v1/cron/{id}/manual", "nezha:cron:exec"},
|
||
{"POST", "/api/v1/batch-delete/cron", "nezha:cron:delete"},
|
||
|
||
{"GET", "/api/v1/ddns", "nezha:ddns:read"},
|
||
{"GET", "/api/v1/ddns/providers", "nezha:ddns:read"},
|
||
{"POST", "/api/v1/ddns", "nezha:ddns:write"},
|
||
{"PATCH", "/api/v1/ddns/{id}", "nezha:ddns:write"},
|
||
{"POST", "/api/v1/batch-delete/ddns", "nezha:ddns:delete"},
|
||
|
||
{"GET", "/api/v1/nat", "nezha:nat:read"},
|
||
{"POST", "/api/v1/nat", "nezha:nat:write"},
|
||
{"PATCH", "/api/v1/nat/{id}", "nezha:nat:write"},
|
||
{"POST", "/api/v1/batch-delete/nat", "nezha:nat:delete"},
|
||
|
||
{"GET", "/api/v1/notification", "nezha:notification:read"},
|
||
{"POST", "/api/v1/notification", "nezha:notification:write"},
|
||
{"PATCH", "/api/v1/notification/{id}", "nezha:notification:write"},
|
||
{"POST", "/api/v1/batch-delete/notification", "nezha:notification:delete"},
|
||
|
||
{"GET", "/api/v1/notification-group", "nezha:notification-group:read"},
|
||
{"POST", "/api/v1/notification-group", "nezha:notification-group:write"},
|
||
{"PATCH", "/api/v1/notification-group/{id}", "nezha:notification-group:write"},
|
||
{"POST", "/api/v1/batch-delete/notification-group", "nezha:notification-group:delete"},
|
||
|
||
{"GET", "/api/v1/user", "nezha:admin:*"},
|
||
{"POST", "/api/v1/user", "nezha:admin:*"},
|
||
{"POST", "/api/v1/batch-delete/user", "nezha:admin:*"},
|
||
{"GET", "/api/v1/waf", "nezha:admin:*"},
|
||
{"POST", "/api/v1/batch-delete/waf", "nezha:admin:*"},
|
||
{"GET", "/api/v1/online-user", "nezha:admin:*"},
|
||
{"POST", "/api/v1/online-user/batch-block", "nezha:admin:*"},
|
||
{"PATCH", "/api/v1/setting", "nezha:admin:*"},
|
||
{"POST", "/api/v1/maintenance", "nezha:admin:*"},
|
||
}
|
||
}
|
||
|
||
var scopeDocLineRE = regexp.MustCompile(`^(GET|POST|PATCH|DELETE|PUT)\s+(/api/v1/\S+)\s+(nezha:\S+)$`)
|
||
|
||
func extractScopeDocEntries(t *testing.T) map[string]scopedRoute {
|
||
t.Helper()
|
||
raw, err := os.ReadFile("scope_doc.go")
|
||
require.NoError(t, err)
|
||
entries := map[string]scopedRoute{}
|
||
for _, line := range strings.Split(string(raw), "\n") {
|
||
stripped := strings.TrimPrefix(line, "//")
|
||
stripped = strings.TrimSpace(stripped)
|
||
stripped = strings.Join(strings.Fields(stripped), " ")
|
||
m := scopeDocLineRE.FindStringSubmatch(stripped)
|
||
if m == nil {
|
||
continue
|
||
}
|
||
r := scopedRoute{Method: m[1], Path: m[2], Scope: m[3]}
|
||
entries[r.Method+" "+r.Path] = r
|
||
}
|
||
return entries
|
||
}
|
||
|
||
func TestScopeDocMatchesCanonicalRoutes(t *testing.T) {
|
||
doc := extractScopeDocEntries(t)
|
||
for _, want := range canonicalRoutes() {
|
||
key := want.Method + " " + want.Path
|
||
got, ok := doc[key]
|
||
if !ok {
|
||
t.Errorf("scope_doc.go missing entry: %s %s (expected scope %s)", want.Method, want.Path, want.Scope)
|
||
continue
|
||
}
|
||
if got.Scope != want.Scope {
|
||
t.Errorf("scope_doc.go scope mismatch for %s %s: doc=%s code=%s", want.Method, want.Path, got.Scope, want.Scope)
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestCanonicalRoutesCoverScopeDoc(t *testing.T) {
|
||
doc := extractScopeDocEntries(t)
|
||
canonical := map[string]scopedRoute{}
|
||
for _, r := range canonicalRoutes() {
|
||
canonical[r.Method+" "+r.Path] = r
|
||
}
|
||
for key, entry := range doc {
|
||
if _, ok := canonical[key]; !ok {
|
||
t.Errorf("scope_doc.go has %s %s (scope %s) with no canonical route — stale doc or missing test entry", entry.Method, entry.Path, entry.Scope)
|
||
}
|
||
}
|
||
}
|