From 05b1441d693d31e0489fa068553dda98fb15905f Mon Sep 17 00:00:00 2001 From: smail Date: Sun, 20 Sep 2026 08:05:28 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=9D=E5=AD=98=E6=8F=92=E4=BB=B6=E7=8B=AC?= =?UTF-8?q?=E7=AB=8B=E5=AF=86=E9=92=A5=E6=8E=A5=E5=8F=A3=E6=8E=A5=E7=BB=AD?= =?UTF-8?q?=E6=B5=8B=E8=AF=95=E5=89=8D=E5=9F=BA=E7=BA=BF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/controllers/plugin_secret.go | 70 +++++++++++++++++++ backend/listen/http_server/api_v1_compat.go | 3 + .../ConfigEditor/ConfigEditor.vue | 16 ++++- .../ConfigSettings/ConfigSettings.js | 52 ++++++++++++-- 4 files changed, 132 insertions(+), 9 deletions(-) create mode 100644 backend/controllers/plugin_secret.go diff --git a/backend/controllers/plugin_secret.go b/backend/controllers/plugin_secret.go new file mode 100644 index 0000000..c95d80c --- /dev/null +++ b/backend/controllers/plugin_secret.go @@ -0,0 +1,70 @@ +package controllers + +import ( + "errors" + "net/http" + "strings" + + "git.pcux.cn/xuans/Smail/config" + "git.pcux.cn/xuans/Smail/dto/response" + "git.pcux.cn/xuans/Smail/hooks" + "git.pcux.cn/xuans/Smail/services/access" + pluginservice "git.pcux.cn/xuans/Smail/services/plugin" + appcontext "git.pcux.cn/xuans/Smail/utils/context" +) + +// PluginSecret 只维护数据库中的插件密钥，不写入文件配置或候选载荷。 +func PluginSecret(ctx *appcontext.Context, w http.ResponseWriter, req *http.Request) { + w.Header().Set("Cache-Control", "no-store") + if req.Method != http.MethodGet && req.Method != http.MethodPut { + w.Header().Set("Allow", "GET, PUT") + http.Error(w, "请求方法不支持", http.StatusMethodNotAllowed) + return + } + capability := access.CapabilityPluginReadGlobal + if req.Method == http.MethodPut { + capability = access.CapabilityPluginWriteGlobal + } + if ctx == nil || ctx.UserID <= 0 { + writeConfigAccessError(w, &access.Denial{Code: access.CodeAccessDenied}) + return + } + if err := authorizeCapability(ctx, capability, "", false); err != nil { + writeConfigAccessError(w, err) + return + } + pluginID := strings.TrimPrefix(req.URL.Path, "/api/v1/plugin/secrets/") + field := map[string]string{"telegram_push": "botToken", "wechat_push": "appSecret"}[pluginID] + if field == "" { + http.NotFound(w, req) + return + } + service := hooks.PluginConfigService() + if service == nil { + response.NewErrorResponse(response.ServerError, "插件配置服务不可用", "").FPrint(w) + return + } + var status pluginservice.SecretStatus + var err error + if req.Method == http.MethodGet { + status, err = service.GetSecretStatus(pluginID, field) + } else { + var input struct { + Change config.SecretChange `json:"change"` + Version uint64 `json:"version"` + } + if !decodePluginJSONBody(w, req, &input) { + return + } + status, err = service.ChangeSecret(pluginID, field, input.Change, input.Version) + } + if err != nil { + if errors.Is(err, pluginservice.ErrPluginSettingConflict) { + writeConfigError(w, config.ErrGenerationConflict) + } else { + response.NewErrorResponse(response.ParamsError, "插件密钥操作失败，请检查输入后重试", "").FPrint(w) + } + return + } + response.NewSuccessResponse(status).FPrint(w) +} diff --git a/backend/listen/http_server/api_v1_compat.go b/backend/listen/http_server/api_v1_compat.go index 08f7f8b..f4e3270 100644 --- a/backend/listen/http_server/api_v1_compat.go +++ b/backend/listen/http_server/api_v1_compat.go @@ -148,6 +148,9 @@ func registerV1TOTPRoute(mux *http.ServeMux) { } func registerV1PluginRoutes(mux *http.ServeMux) { + for _, id := range []string{"telegram_push", "wechat_push"} { + mux.HandleFunc("/api/v1/plugin/secrets/"+id, limitBody(16<<10, contextIterceptor(controllers.PluginSecret))) + } getUserSettings := contextIterceptor(controllers.GetTelegramUserSettings) updateUserSettings := limitBody(16<<10, contextIterceptor(controllers.UpdateTelegramUserSettings)) mux.HandleFunc("/api/v1/plugin/settings/telegram_push/user", func(w http.ResponseWriter, r *http.Request) { diff --git a/frontend/src/views/components/ConfigSettings/ConfigEditor/ConfigEditor.vue b/frontend/src/views/components/ConfigSettings/ConfigEditor/ConfigEditor.vue index 1c754e7..b07e02c 100644 --- a/frontend/src/views/components/ConfigSettings/ConfigEditor/ConfigEditor.vue +++ b/frontend/src/views/components/ConfigSettings/ConfigEditor/ConfigEditor.vue @@ -76,11 +76,18 @@ type="password" show-password clearable - :disabled="!canWrite || sectionLoading || busy || !!sectionError || !!pendingCandidate" + :disabled="!canWrite || sectionLoading || busy || !!sectionError || !!pendingCandidate || (pluginSecretPage && !pluginSecretStatus)" :placeholder="secretField.placeholder" autocomplete="new-password" @update:model-value="updateSecret" /> + + 保存密钥 +
@@ -102,7 +109,7 @@ {{ continuingSave ? '继续保存' : '保存配置' }} @@ -154,11 +161,14 @@ const { saveError, secretField, secretValue, + pluginSecretPage, + pluginSecretStatus, + savePluginSecret, pendingCandidate, pendingScopeHint, managePending, validationResult, - hasChanges, + hasConfigChanges, canWrite, refreshPage, saveAndApply diff --git a/frontend/src/views/components/ConfigSettings/ConfigSettings.js b/frontend/src/views/components/ConfigSettings/ConfigSettings.js index 9315caa..eeb909c 100644 --- a/frontend/src/views/components/ConfigSettings/ConfigSettings.js +++ b/frontend/src/views/components/ConfigSettings/ConfigSettings.js @@ -62,6 +62,8 @@ export function usePage(pageKey = 'base') { const sectionError = ref('') const saveError = ref('') const secretValue = ref('') + const pluginSecretStatus = ref(null) + const pluginSecretPage = computed(() => ['telegram_push', 'wechat_push'].includes(selectedSection.value)) const confirmed = ref(false) const savedGeneration = ref(0) const pendingCandidate = ref(null) @@ -147,6 +149,7 @@ export function usePage(pageKey = 'base') { }) const restartPreview = ref(null) const hasChanges = computed(() => editorText.value !== loadedText.value || !!secretValue.value || !!savedGeneration.value) + const hasConfigChanges = computed(() => editorText.value !== loadedText.value || (!pluginSecretPage.value && !!secretValue.value) || !!savedGeneration.value) const canWrite = computed(() => globalStatus.hasCapability(apiSection() === 'plugins' ? 'plugin.write_global' : 'config.write_global')) const canRollback = computed(() => globalStatus.hasCapability('config.rollback')) @@ -161,10 +164,10 @@ export function usePage(pageKey = 'base') { const pluginSecrets = { telegram_push: 'Telegram Bot Token', wechat_push: '微信 Secret' } const label = pluginSecrets[selectedSection.value] if (label && formConfig.value.plugins?.[selectedSection.value]) { - const configured = readFormConfig(loadedText.value).plugins?.[selectedSection.value]?.secretStatus?.configured + const configured = pluginSecretStatus.value?.configured return { label, - description: `${configured ? '已设置' : '未设置'}。保存后加密存储，不回显；留空保持原值。`, + description: `${configured ? '已设置' : '未设置'}。加密存储，不回显；保存后下次启动插件时生效。`, placeholder: `输入新的 ${label}（可选）` } } @@ -191,6 +194,7 @@ export function usePage(pageKey = 'base') { } const updateSecret = value => { if (saveFlow.value || !canEdit() || !secretField.value || secretValue.value === value) return + if (pluginSecretPage.value && !pluginSecretStatus.value) return secretValue.value = value saveError.value = '' invalidateCandidate() @@ -293,6 +297,7 @@ export function usePage(pageKey = 'base') { editorText.value = '' loadedText.value = '' secretValue.value = '' + pluginSecretStatus.value = null confirmed.value = false validationResult.value = null savedGeneration.value = 0 @@ -308,6 +313,16 @@ export function usePage(pageKey = 'base') { } editorText.value = JSON.stringify(publicConfig, null, 2) loadedText.value = editorText.value + if (pluginSecretPage.value) { + const secretResponse = await http.get(`/api/v1/plugin/secrets/${selectedSection.value}`) + if (requestId !== sectionRequestId || disposed) return false + notifyResponseError(secretResponse, '插件密钥状态读取失败') + const secretStatus = secretResponse.data + if (typeof secretStatus?.configured !== 'boolean' || !Number.isSafeInteger(secretStatus.version) || secretStatus.version < 0) { + throw new Error('插件密钥状态不完整，请刷新后重试') + } + pluginSecretStatus.value = secretStatus + } if (section === 'base') { const database = publicConfig.database || {} Object.assign(databaseConfig, { type: database.type || '', name: database.name || '', localRef: database.localRef || '' }) @@ -536,9 +551,6 @@ export function usePage(pageKey = 'base') { if (value && selectedSection.value === 'base' && secretField.value) { secretChanges['database.password'] = { operation: 'replace', value: { plaintext: value } } } - if (value && ['telegram_push', 'wechat_push'].includes(selectedSection.value) && secretField.value) { - secretChanges[`plugins.${selectedSection.value}.secret`] = { operation: 'replace', value: { plaintext: value } } - } const relayPassword = formConfig.value?.relay?.password if (relayPassword && selectedSection.value === 'mail') { secretChanges['relay.password'] = { operation: 'replace', value: { plaintext: relayPassword } } @@ -664,6 +676,10 @@ export function usePage(pageKey = 'base') { const saveAndApply = async () => { if (saveFlow.value || !canOperate()) return false + if (pluginSecretPage.value && secretValue.value) { + ElMessage.warning('请先保存密钥，再保存运行配置') + return false + } saveFlow.value = pendingCandidate.value ? 'resume' : 'save' try { if (pendingCandidate.value) { @@ -682,6 +698,30 @@ export function usePage(pageKey = 'base') { return saveAndApply() } + const savePluginSecret = async () => { + if (!canEdit() || !pluginSecretPage.value || !pluginSecretStatus.value || !secretValue.value) return false + working.value = 'plugin-secret' + saveError.value = '' + try { + const request = { version: pluginSecretStatus.value.version, change: { operation: 'replace', value: { plaintext: secretValue.value } } } + const response = await requestWithRecentAuthentication(() => http.put(`/api/v1/plugin/secrets/${selectedSection.value}`, request)) + notifyResponseError(response, '插件密钥保存失败') + if (disposed) return false + secretValue.value = '' + pluginSecretStatus.value = response.data + ElMessage.success('密钥已保存，下次启动插件时生效') + return true + } catch (error) { + if (!disposed && !isRecentAuthenticationCancelled(error)) { + saveError.value = error.message || '插件密钥保存失败' + ElMessage.error(saveError.value) + } + return false + } finally { + working.value = '' + } + } + const previewRollback = async () => { if (!canRollback.value || working.value || !rollbackGeneration.value) return working.value = 'preview' @@ -762,7 +802,7 @@ export function usePage(pageKey = 'base') { saveFlow, busy, showPendingRecovery, continuingSave, loading, availabilityError, working, status, stateLabel, stateTagType, sectionOptions: sections, selectedSection, currentSection, sectionLoading, editorText, formConfig, formErrors, updateField, updateSecret, - sectionError, saveError, sensitiveHint, secretField, secretValue, + sectionError, saveError, sensitiveHint, secretField, secretValue, pluginSecretPage, pluginSecretStatus, savePluginSecret, hasConfigChanges, confirmed, savedGeneration, pendingCandidate, managePending, validationResult, canWrite, canRollback, backupsLoading, backupsError, backups, rollbackGeneration, rollbackConfirmed, rollbackPreview, loadAll, loadSection, validateConfig, saveConfig, applyConfig, saveAndApply, continuePending,