From 55c500c1a8d68472703082e4fa07be3f5b6ffdc3 Mon Sep 17 00:00:00 2001 From: xuans Date: Sun, 4 Oct 2026 13:23:08 +0800 Subject: [PATCH] =?UTF-8?q?=E6=94=B6=E5=8F=A3=E8=B6=85=E7=BA=A7=E7=AE=A1?= =?UTF-8?q?=E7=90=86=E5=91=98=E9=87=8D=E7=BD=AE=E5=AE=89=E5=85=A8=E8=BE=B9?= =?UTF-8?q?=E7=95=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 阻断公网重置入口并同步初始化与 CLI 提示，保留本机运维重置路径的后续验证。 --- backend/internal/cli/root.go | 4 ++-- backend/internal/httpapi/review_test.go | 2 +- backend/internal/httpapi/setup.go | 6 ++---- backend/internal/httpapi/setup_test.go | 5 +---- 4 files changed, 6 insertions(+), 11 deletions(-) diff --git a/backend/internal/cli/root.go b/backend/internal/cli/root.go index c11d5c4..37e964e 100644 --- a/backend/internal/cli/root.go +++ b/backend/internal/cli/root.go @@ -233,7 +233,7 @@ func newInitCommandWithDependencies(firewallManager firewall.Manager, issue init fmt.Fprintln(cmd.OutOrStdout(), "当前使用 ACME 测试环境，证书不受浏览器信任，不能作为正式生产证书。") } fmt.Fprintf(cmd.OutOrStdout(), "本机防火墙：%s\n", firewallResult.Message) - fmt.Fprintf(cmd.OutOrStdout(), "请确认云安全组已放行主服务端口 %d。Scert-admin 默认关闭；需要重置密码时启动后访问：%s\n", cfg.Server.Port, cfg.ResetURL()) + fmt.Fprintf(cmd.OutOrStdout(), "请确认云安全组已放行主服务端口 %d。超级管理员密码重置不开放公网入口，请由运维人员在部署主机本机受保护终端处理。\n", cfg.Server.Port) return nil }} command.Flags().StringVar(&adminUsername, "admin-username", "", "超级管理员用户名") @@ -672,7 +672,7 @@ func newStatusCommand() *cobra.Command { } func commandStatus(cfg config.Config) map[string]any { - return map[string]any{"service": "scert", "version": buildinfo.Version, "config_version": cfg.Version, "setup_ready": cfg.SetupReady, "https_mode": cfg.Server.HTTPSMode, "database_driver": cfg.Database.Driver, "server_port": cfg.Server.Port, "reset_url": cfg.ResetURL(), "web_enabled": cfg.Web.Enabled, "web_hostname": cfg.Web.Hostname, "web_public_ip": cfg.Web.PublicIP, "dns_verification_state": cfg.DNS.VerificationState} + return map[string]any{"service": "scert", "version": buildinfo.Version, "config_version": cfg.Version, "setup_ready": cfg.SetupReady, "https_mode": cfg.Server.HTTPSMode, "database_driver": cfg.Database.Driver, "server_port": cfg.Server.Port, "web_enabled": cfg.Web.Enabled, "web_hostname": cfg.Web.Hostname, "web_public_ip": cfg.Web.PublicIP, "dns_verification_state": cfg.DNS.VerificationState} } func newServeCommand() *cobra.Command { diff --git a/backend/internal/httpapi/review_test.go b/backend/internal/httpapi/review_test.go index dffd590..c83a3d5 100644 --- a/backend/internal/httpapi/review_test.go +++ b/backend/internal/httpapi/review_test.go @@ -99,7 +99,7 @@ func TestPublicStatusDoesNotExposeInternalConfiguration(t *testing.T) { if err := json.Unmarshal(response.Body.Bytes(), &payload); err != nil { t.Fatalf("解析公开状态响应失败：%v", err) } - for _, key := range []string{"database_driver", "https_mode", "reset_url"} { + for _, key := range []string{"database_driver", "https_mode"} { if _, exists := payload[key]; exists { t.Fatalf("公开状态接口不应返回内部字段 %s：%s", key, response.Body.String()) } diff --git a/backend/internal/httpapi/setup.go b/backend/internal/httpapi/setup.go index efe4926..1791c0c 100644 --- a/backend/internal/httpapi/setup.go +++ b/backend/internal/httpapi/setup.go @@ -121,7 +121,6 @@ func (s *Server) setupStatus(c *gin.Context) { "phase": phase, "blockers": blockers, "server_port": cfg.Server.Port, - "reset_url": cfg.ResetURL(), "https_mode": cfg.Server.HTTPSMode, "proxy_https_port": cfg.Server.ProxyHTTPSPort, "web_enabled": cfg.Web.Enabled, @@ -521,12 +520,11 @@ func (s *Server) applySetup(c *gin.Context) { c.JSON(http.StatusOK, gin.H{ "initialized": true, "message": fmt.Sprintf( - "初始化配置已保存，DNS API 已完成在线验证且凭据已加密保存。%s。请确认云安全组已放行主服务端口 %d；Scert-admin 默认关闭，启动后通过 %s 使用临时重置入口。管理后台证书申请成功。", - firewallResult.Message, updated.Server.Port, updated.ResetURL(), + "初始化配置已保存，DNS API 已完成在线验证且凭据已加密保存。%s。请确认云安全组已放行主服务端口 %d；超级管理员密码重置不开放公网入口，请由运维人员在部署主机本机受保护终端处理。管理后台证书申请成功。", + firewallResult.Message, updated.Server.Port, ), "status": gin.H{ "server_port": updated.Server.Port, - "reset_url": updated.ResetURL(), "web_enabled": updated.Web.Enabled, "https_mode": updated.Server.HTTPSMode, "firewall": firewallResult, diff --git a/backend/internal/httpapi/setup_test.go b/backend/internal/httpapi/setup_test.go index 122cdc9..da24965 100644 --- a/backend/internal/httpapi/setup_test.go +++ b/backend/internal/httpapi/setup_test.go @@ -202,7 +202,7 @@ func TestSetupStatusHidesConfigurationAfterInitialization(t *testing.T) { if payload["initialized"] != true { t.Fatalf("初始化状态不正确：%s", response.Body.String()) } - for _, key := range []string{"server_port", "reset_url", "https_mode", "web_hostname", "web_public_ip", "certificate_root", "dns_provider", "dns_verification_state"} { + for _, key := range []string{"server_port", "https_mode", "web_hostname", "web_public_ip", "certificate_root", "dns_provider", "dns_verification_state"} { if _, exists := payload[key]; exists { t.Fatalf("初始化完成后不应公开内部字段 %s：%s", key, response.Body.String()) } @@ -358,9 +358,6 @@ func TestSetupApplyPersistsConfigurationWithoutPlainPassword(t *testing.T) { if !strings.Contains(response.Body.String(), `"firewall"`) || !strings.Contains(response.Body.String(), `"created":true`) { t.Fatalf("初始化响应应返回本机防火墙结果：%s", response.Body.String()) } - if !strings.Contains(response.Body.String(), `"reset_url":"https://scert.example.test:8443/reset"`) { - t.Fatalf("初始化响应应返回根据 Web 地址生成的密码重置路径：%s", response.Body.String()) - } data, err := os.ReadFile(configPath) if err != nil {