xuans/Scert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

收紧手动续期权限

Browse Source 
手动批量续期入口仅允许超级管理员访问，并新增非超级管理员不得触发续期工作流的回归测试。
This commit is contained in:
xuans 2026-09-29 21:52:36 +08:00
parent 4a61a675e0
commit 2ecd7bb251
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/internal/httpapi/server.go
View File

@ -226,7 +226,7 @@ func (s *Server) registerRoutes() {
adminAPI.GET("/dns/accounts", s.listDNSAccounts)
adminAPI.POST("/dns/test", s.dnsOperation, s.testAdminDNS)
adminAPI.POST("/dns/aliyun/check", s.dnsOperation, s.checkAliyunDNSDomain)
adminAPI.POST("/renewal/run", s.longOperation(certificateTaskTimeout), s.runRenewalNow)
adminAPI.POST("/renewal/run", s.requireSuperAdmin, s.longOperation(certificateTaskTimeout), s.runRenewalNow)
domainAPI.POST("/domains/:id/certificate/import", s.longOperation(certificateTaskTimeout), s.importCertificateFiles)
domainAPI.POST("/domains/:id/certificate/validate", s.longOperation(certificateTaskTimeout), s.validateCertificate)
domainAPI.POST("/domains/:id/deploy", s.longOperation(certificateTaskTimeout), s.deployCertificateCurrent)

23
backend/internal/httpapi/settings_api_test.go
View File

@ -397,6 +397,29 @@ func TestRenewalAPIHidesWorkflowErrors(t *testing.T) {
t.Fatalf("renewal API did not include the safe error message: %s", body)
}
}
func TestRenewalAPIRequiresSuperAdmin(t *testing.T) {
cfg := config.Default(t.TempDir())
cfg.SetupReady = true
runCalls := 0
server := New(Dependencies{
Config: cfg,
RunRenewal: func(context.Context) (certificate.RenewalReport, error) {
runCalls++
return certificate.RenewalReport{}, nil
},
})
cookie := httpUserSessionCookie(server, "renewal-admin", repository.UserRoleAdmin)
request := httptest.NewRequest(http.MethodPost, "/api/v1/renewal/run", nil)
request.AddCookie(cookie)
response := httptest.NewRecorder()
server.Handler().ServeHTTP(response, request)
if response.Code != http.StatusForbidden {
t.Fatalf("non-super-admin renewal request returned %d: %s", response.Code, response.Body.String())
}
if runCalls != 0 {
t.Fatalf("renewal runner was called for a non-super-admin: %d", runCalls)
}
}
func loginForSettingsTest(t *testing.T, server *Server) *http.Cookie {
t.Helper()
request := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(`{"identifier":"admin","password":"Password123"}`))