mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 17:50:12 +00:00
naibaandcloudcode
ab25662ddd
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.
Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.
Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.
Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
50 lines
1.3 KiB
Go
50 lines
1.3 KiB
Go
package controller
|
|
|
|
import (
|
|
"encoding/json"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
)
|
|
|
|
// meta.whoami 让 LLM 启动时知道自己拿的是哪张 PAT、能干什么、能动哪些服务器。
|
|
// 不要求任何 scope（任意有效 PAT 均可调用）。
|
|
type whoamiResult struct {
|
|
UserID uint64 `json:"user_id"`
|
|
IsAdmin bool `json:"is_admin"`
|
|
TokenID uint64 `json:"token_id"`
|
|
TokenName string `json:"token_name"`
|
|
Scopes []string `json:"scopes"`
|
|
ServerIDs []uint64 `json:"server_ids,omitempty"`
|
|
}
|
|
|
|
func init() {
|
|
registerMCPTool(&mcpTool{
|
|
Name: "meta.whoami",
|
|
Description: "Return the identity, scopes and accessible server IDs of the current API token.",
|
|
InputSchema: map[string]any{
|
|
"type": "object",
|
|
"properties": map[string]any{},
|
|
},
|
|
RequiredScope: "",
|
|
Handler: handleMetaWhoami,
|
|
})
|
|
}
|
|
|
|
func handleMetaWhoami(c *gin.Context, _ json.RawMessage) (any, error) {
|
|
tok := APITokenFromContext(c)
|
|
if tok == nil {
|
|
return nil, errNoToken
|
|
}
|
|
user, _ := c.MustGet(model.CtxKeyAuthorizedUser).(*model.User)
|
|
return whoamiResult{
|
|
UserID: user.ID,
|
|
IsAdmin: user.Role.IsAdmin(),
|
|
TokenID: tok.ID,
|
|
TokenName: tok.Name,
|
|
Scopes: tok.Scopes(),
|
|
ServerIDs: tok.ServerIDs(),
|
|
}, nil
|
|
}
|