mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 17:50:12 +00:00
naibaandcloudcode
e8dabf5bc6
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.
Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.
Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.
Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
85 lines
2.5 KiB
Go
85 lines
2.5 KiB
Go
package controller
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
)
|
|
|
|
// M10 regression: a PATCH /setting payload that omits "enable_mcp" must
|
|
// preserve the current value. With EnableMCP as a plain bool + omitempty,
|
|
// any partial update silently set EnableMCP=false and tripped the MCP
|
|
// kill switch (PurgeTransferEntries + RevokeStreamsForPurpose +
|
|
// CancelAllMCPInflight). Switching to *bool makes "field absent" a real
|
|
// signal at decode time.
|
|
func TestSettingForm_OmittedEnableMCPLeavesConfigUnchanged(t *testing.T) {
|
|
body := []byte(`{"site_name":"X"}`)
|
|
var sf model.SettingForm
|
|
if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if sf.EnableMCP != nil {
|
|
t.Fatalf("EnableMCP must be nil when JSON omits the key, got %v", sf.EnableMCP)
|
|
}
|
|
}
|
|
|
|
func TestSettingForm_ExplicitEnableMCPTrueDecodes(t *testing.T) {
|
|
body := []byte(`{"enable_mcp":true}`)
|
|
var sf model.SettingForm
|
|
if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if sf.EnableMCP == nil || !*sf.EnableMCP {
|
|
t.Fatalf("EnableMCP must be *true, got %v", sf.EnableMCP)
|
|
}
|
|
}
|
|
|
|
func TestSettingForm_ExplicitEnableMCPFalseDecodes(t *testing.T) {
|
|
body := []byte(`{"enable_mcp":false}`)
|
|
var sf model.SettingForm
|
|
if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if sf.EnableMCP == nil || *sf.EnableMCP {
|
|
t.Fatalf("EnableMCP must be *false, got %v", sf.EnableMCP)
|
|
}
|
|
}
|
|
|
|
// updateMCPEnableFromForm is the resolver helper: nil = keep current,
|
|
// non-nil = use the explicit value. Kept as a small pure function so the
|
|
// kill-switch wiring stays trivial to audit.
|
|
func TestUpdateMCPEnableFromForm_NilKeepsCurrent(t *testing.T) {
|
|
_, w := newRecorderCtxForMCPSettingTest(t)
|
|
prev := true
|
|
got := resolveSettingEnableMCP(nil, prev)
|
|
if got != prev {
|
|
t.Fatalf("nil form value must keep current=%v, got %v", prev, got)
|
|
}
|
|
if w.Code != 200 {
|
|
t.Fatal("resolver must not write to response")
|
|
}
|
|
}
|
|
|
|
func TestUpdateMCPEnableFromForm_NonNilOverrides(t *testing.T) {
|
|
f := false
|
|
if got := resolveSettingEnableMCP(&f, true); got != false {
|
|
t.Fatal("explicit *false must override current=true")
|
|
}
|
|
tr := true
|
|
if got := resolveSettingEnableMCP(&tr, false); got != true {
|
|
t.Fatal("explicit *true must override current=false")
|
|
}
|
|
}
|
|
|
|
func newRecorderCtxForMCPSettingTest(t *testing.T) (*gin.Context, *httptest.ResponseRecorder) {
|
|
t.Helper()
|
|
w := httptest.NewRecorder()
|
|
c, _ := gin.CreateTestContext(w)
|
|
return c, w
|
|
}
|