优化结构

2026-08-20 21:46:52 +08:00
parent 23bc29ce0f
commit 63dbb4cfbc
78 changed files with 767 additions and 1082 deletions
@@ -0,0 +1,348 @@
+package initialize
+
+import (
+	"context"
+	"encoding/json"
+
+	"kra/internal/conf"
+	"kra/internal/utils/configutil"
+
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+type configurationEnvelope struct {
+	Data  json.RawMessage `json:"data"`
+	Admin json.RawMessage `json:"admin"`
+	Email *struct {
+		To          string `json:"to"`
+		From        string `json:"from"`
+		Host        string `json:"host"`
+		Secret      string `json:"secret"`
+		Nickname    string `json:"nickname"`
+		Port        int32  `json:"port"`
+		IsSSL       bool   `json:"is-ssl"`
+		IsLoginAuth bool   `json:"is-loginauth"`
+	} `json:"email"`
+}
+
+func (r *Repo) ConfigurationJSON() (json.RawMessage, error) {
+	dataConfig, adminConfig := r.backend.RuntimeValues()
+	admin := map[string]any{"routerPrefix": ""}
+	email := map[string]any{}
+	if adminConfig != nil {
+		admin["routerPrefix"] = adminConfig.RouterPrefix
+		if adminConfig.System != nil {
+			admin["system"] = map[string]any{
+				"useRedis":           adminConfig.System.UseRedis,
+				"useMultipoint":      adminConfig.System.UseMultipoint,
+				"useStrictAuth":      adminConfig.System.UseStrictAuth,
+				"disableAutoMigrate": adminConfig.System.DisableAutoMigrate,
+				"useMongo":           adminConfig.System.UseMongo,
+				"addr":               adminConfig.System.Addr,
+				"iplimitCount":       adminConfig.System.IplimitCount,
+				"iplimitTime":        adminConfig.System.IplimitTime,
+			}
+		}
+		if adminConfig.Jwt != nil {
+			admin["jwt"] = map[string]any{"signingKey": "******", "expiresTime": durationString(adminConfig.Jwt.ExpiresTime), "bufferTime": durationString(adminConfig.Jwt.BufferTime), "issuer": adminConfig.Jwt.Issuer}
+		}
+		if adminConfig.Captcha != nil {
+			admin["captcha"] = map[string]any{"keyLong": adminConfig.Captcha.KeyLong, "imgWidth": adminConfig.Captcha.ImgWidth, "imgHeight": adminConfig.Captcha.ImgHeight, "storeExpiration": durationString(adminConfig.Captcha.StoreExpiration)}
+		}
+		if adminConfig.Local != nil {
+			admin["local"] = map[string]any{"storePath": adminConfig.Local.StorePath, "pathPrefix": adminConfig.Local.PathPrefix}
+		}
+		if adminConfig.Media != nil {
+			chunkDir := adminConfig.Media.ChunkDir
+			if chunkDir == "" {
+				chunkDir = "uploads/chunks"
+			}
+			admin["media"] = map[string]any{"sessionTtl": adminConfig.Media.SessionTtl, "maxFileSize": adminConfig.Media.MaxFileSize, "chunkDir": chunkDir}
+		}
+		if adminConfig.Email != nil {
+			secret := ""
+			if adminConfig.Email.Secret != "" {
+				secret = "******"
+			}
+			email = map[string]any{"to": adminConfig.Email.To, "from": adminConfig.Email.From, "host": adminConfig.Email.Host, "secret": secret, "nickname": adminConfig.Email.Nickname, "port": adminConfig.Email.Port, "is-ssl": adminConfig.Email.IsSsl, "is-loginauth": adminConfig.Email.IsLoginAuth}
+		}
+		if adminConfig.Storage != nil {
+			storage := proto.Clone(adminConfig.Storage).(*conf.AdminBackend_Storage)
+			maskStorageSecrets(storage)
+			admin["storage"] = storage
+		}
+		disks := make([]map[string]any, 0, len(adminConfig.DiskList))
+		for _, disk := range adminConfig.DiskList {
+			if disk != nil {
+				disks = append(disks, map[string]any{"mount_point": disk.MountPoint})
+			}
+		}
+		admin["disk_list"] = disks
+		if adminConfig.Zap != nil {
+			admin["zap"] = adminConfig.Zap
+		}
+		if adminConfig.Cors != nil {
+			admin["cors"] = adminConfig.Cors
+		}
+		if adminConfig.App != nil {
+			admin["app"] = adminConfig.App
+		}
+	}
+	// Never mask secrets on the live runtime object. ConfigurationJSON is a
+	// read-only operation; mutating dataConfig here would replace the actual
+	// database/Redis/Mongo credentials with "******" and make the next reload
+	// fail. Work on a clone, just as we already do for adminConfig.
+	safeData := cloneDataConfig(dataConfig)
+	maskDataSecrets(safeData)
+	safeAdmin := cloneAdminConfig(adminConfig)
+	if safeAdmin != nil {
+		if safeAdmin.Jwt != nil {
+			safeAdmin.Jwt.SigningKey = "******"
+		}
+		if safeAdmin.Email != nil && safeAdmin.Email.Secret != "" {
+			safeAdmin.Email.Secret = "******"
+		}
+		maskStorageSecrets(safeAdmin.Storage)
+	}
+	dataMap := map[string]any{}
+	if safeData != nil {
+		raw, err := protojson.MarshalOptions{UseProtoNames: true}.Marshal(safeData)
+		if err != nil {
+			return nil, err
+		}
+		if err = json.Unmarshal(raw, &dataMap); err != nil {
+			return nil, err
+		}
+	}
+	config := compatibleConfiguration(safeData, safeAdmin)
+	config["admin"], config["email"], config["data"] = admin, email, dataMap
+	return json.Marshal(map[string]any{"config": config})
+}
+
+func (r *Repo) SaveConfigurationJSON(ctx context.Context, raw json.RawMessage) error {
+	currentData, currentAdmin := r.backend.RuntimeValues()
+	if currentAdmin == nil {
+		return nil
+	}
+	nextData := cloneDataConfig(currentData)
+	nextAdmin := proto.Clone(currentAdmin).(*conf.AdminBackend)
+	if err := applyCompatibleConfiguration(raw, nextData, nextAdmin); err != nil {
+		return err
+	}
+	var value configurationEnvelope
+	if err := json.Unmarshal(raw, &value); err != nil {
+		return err
+	}
+	options := protojson.UnmarshalOptions{DiscardUnknown: true}
+	if len(value.Data) > 0 && string(value.Data) != "null" {
+		if err := configutil.MergeProtoJSON(nextData, value.Data, options); err != nil {
+			return err
+		}
+	}
+	if len(value.Admin) > 0 && string(value.Admin) != "null" {
+		if err := configutil.MergeProtoJSON(nextAdmin, value.Admin, options); err != nil {
+			return err
+		}
+	}
+	preserveDataSecrets(nextData, currentData)
+	preserveAdminSecrets(nextAdmin, currentAdmin)
+	if value.Email != nil {
+		if nextAdmin.Email == nil {
+			nextAdmin.Email = &conf.AdminBackend_Email{}
+		}
+		nextAdmin.Email.To, nextAdmin.Email.From, nextAdmin.Email.Host = value.Email.To, value.Email.From, value.Email.Host
+		nextAdmin.Email.Nickname, nextAdmin.Email.Port = value.Email.Nickname, value.Email.Port
+		nextAdmin.Email.IsSsl, nextAdmin.Email.IsLoginAuth = value.Email.IsSSL, value.Email.IsLoginAuth
+		if value.Email.Secret != "" && value.Email.Secret != "******" {
+			nextAdmin.Email.Secret = value.Email.Secret
+		}
+	}
+	if err := r.backend.RefreshDatabaseSources(nextData); err != nil {
+		return err
+	}
+	nextAdmin.ConfigPath = currentAdmin.ConfigPath
+	dataRaw, err := protojson.MarshalOptions{UseProtoNames: true}.Marshal(nextData)
+	if err != nil {
+		return err
+	}
+	adminRaw, err := protojson.MarshalOptions{UseProtoNames: true}.Marshal(nextAdmin)
+	if err != nil {
+		return err
+	}
+	return r.PersistRuntimeConfig(ctx, dataRaw, adminRaw)
+}
+
+func (r *Repo) DiskMountPoints() []string {
+	config := r.backend.RuntimeAdmin()
+	if config == nil {
+		return nil
+	}
+	points := make([]string, 0, len(config.DiskList))
+	for _, item := range config.DiskList {
+		if item != nil && item.MountPoint != "" {
+			points = append(points, item.MountPoint)
+		}
+	}
+	return points
+}
+
+func cloneDataConfig(value *conf.Data) *conf.Data {
+	if value == nil {
+		return &conf.Data{}
+	}
+	return proto.Clone(value).(*conf.Data)
+}
+
+func cloneAdminConfig(value *conf.AdminBackend) *conf.AdminBackend {
+	if value == nil {
+		return &conf.AdminBackend{}
+	}
+	return proto.Clone(value).(*conf.AdminBackend)
+}
+
+func durationString(value *durationpb.Duration) string {
+	if value == nil {
+		return "0s"
+	}
+	return value.AsDuration().String()
+}
+
+func maskDataSecrets(value *conf.Data) {
+	if value == nil {
+		return
+	}
+	if value.Database != nil {
+		value.Database.Password = "******"
+		// Source may contain an embedded password (for example a MySQL DSN).
+		// The management response must never expose it. Structured database
+		// fields are retained and refreshDatabaseSources rebuilds Source when
+		// the configuration is saved.
+		value.Database.Source = ""
+	}
+	if value.Redis != nil {
+		value.Redis.Password = "******"
+	}
+	if value.Mongo != nil {
+		value.Mongo.Password = "******"
+	}
+	for _, item := range value.DatabaseList {
+		if item != nil {
+			item.Password = "******"
+			item.Source = ""
+		}
+	}
+	for _, item := range value.RedisList {
+		if item != nil {
+			item.Password = "******"
+		}
+	}
+}
+
+func preserveDataSecrets(next, current *conf.Data) {
+	if next == nil || current == nil {
+		return
+	}
+	if next.Database != nil && current.Database != nil && maskedSecret(next.Database.Password) {
+		next.Database.Password = current.Database.Password
+	}
+	if next.Database != nil && current.Database != nil && next.Database.Source == "" {
+		next.Database.Source = current.Database.Source
+	}
+	if next.Redis != nil && current.Redis != nil && maskedSecret(next.Redis.Password) {
+		next.Redis.Password = current.Redis.Password
+	}
+	if next.Mongo != nil && current.Mongo != nil && maskedSecret(next.Mongo.Password) {
+		next.Mongo.Password = current.Mongo.Password
+	}
+	currentDatabases := make(map[string]*conf.Data_Database, len(current.DatabaseList))
+	for _, item := range current.DatabaseList {
+		if item != nil && item.AliasName != "" {
+			currentDatabases[item.AliasName] = item
+		}
+	}
+	for i, item := range next.DatabaseList {
+		var previous *conf.Data_Database
+		if item != nil && item.AliasName != "" {
+			previous = currentDatabases[item.AliasName]
+		}
+		if previous == nil && i < len(current.DatabaseList) {
+			previous = current.DatabaseList[i]
+		}
+		if item != nil && previous != nil {
+			if maskedSecret(item.Password) {
+				item.Password = previous.Password
+			}
+			if item.Source == "" {
+				item.Source = previous.Source
+			}
+		}
+	}
+	currentRedis := make(map[string]*conf.Data_Redis, len(current.RedisList))
+	for _, item := range current.RedisList {
+		if item != nil && item.Name != "" {
+			currentRedis[item.Name] = item
+		}
+	}
+	for i, item := range next.RedisList {
+		var previous *conf.Data_Redis
+		if item != nil && item.Name != "" {
+			previous = currentRedis[item.Name]
+		}
+		if previous == nil && i < len(current.RedisList) {
+			previous = current.RedisList[i]
+		}
+		if item != nil && previous != nil && maskedSecret(item.Password) {
+			item.Password = previous.Password
+		}
+	}
+}
+
+func preserveAdminSecrets(next, current *conf.AdminBackend) {
+	if next.Jwt != nil && current.Jwt != nil && maskedSecret(next.Jwt.SigningKey) {
+		next.Jwt.SigningKey = current.Jwt.SigningKey
+	}
+	if next.Email != nil && current.Email != nil && maskedSecret(next.Email.Secret) {
+		next.Email.Secret = current.Email.Secret
+	}
+	preserveStorageSecrets(next.Storage, current.Storage)
+}
+
+func maskedSecret(value string) bool { return value == "" || value == "******" }
+
+func objectStores(storage *conf.AdminBackend_Storage) []*conf.AdminBackend_ObjectStore {
+	if storage == nil {
+		return nil
+	}
+	return []*conf.AdminBackend_ObjectStore{storage.AliyunOss, storage.HuaweiObs, storage.TencentCos, storage.AwsS3, storage.CloudflareR2, storage.Minio}
+}
+
+func maskStorageSecrets(storage *conf.AdminBackend_Storage) {
+	if storage == nil {
+		return
+	}
+	if storage.Qiniu != nil && storage.Qiniu.SecretKey != "" {
+		storage.Qiniu.SecretKey = "******"
+	}
+	for _, item := range objectStores(storage) {
+		if item != nil && item.SecretKey != "" {
+			item.SecretKey = "******"
+		}
+	}
+}
+
+func preserveStorageSecrets(next, current *conf.AdminBackend_Storage) {
+	if next == nil || current == nil {
+		return
+	}
+	if next.Qiniu != nil && current.Qiniu != nil && maskedSecret(next.Qiniu.SecretKey) {
+		next.Qiniu.SecretKey = current.Qiniu.SecretKey
+	}
+	nextItems, currentItems := objectStores(next), objectStores(current)
+	for i := range nextItems {
+		if nextItems[i] != nil && currentItems[i] != nil && maskedSecret(nextItems[i].SecretKey) {
+			nextItems[i].SecretKey = currentItems[i].SecretKey
+		}
+	}
+}