kevin
129c6c7a96
- 新增 validatePassword 校验函数（6-72 字节，bcrypt 硬上限），统一应用于 ChangePassword/CreateUser/UpdateUser，超长密码返回清晰提示而非迷惑性的"密码加密失败" - 新增 BodyLimit 中间件（http.MaxBytesReader），对所有 /api JSON 端点限制 1 MiB 请求体，防止内存耗尽型 DoS；/ws 走连接劫持不受影响
69 lines
2.0 KiB
Go
69 lines
2.0 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"lmvpn/internal/handler"
|
|
"lmvpn/internal/middleware"
|
|
"lmvpn/internal/vpn"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func Setup(r *gin.Engine) {
|
|
r.GET("/ws", vpn.HandleWS)
|
|
|
|
bodyLimit := middleware.BodyLimit(1 << 20) // 1 MiB
|
|
|
|
r.POST("/api/login", bodyLimit, middleware.LoginRateLimit(), handler.Login)
|
|
r.GET("/api/version", handler.GetVersion)
|
|
|
|
auth := r.Group("/api")
|
|
auth.Use(middleware.AuthMiddleware(), bodyLimit)
|
|
{
|
|
auth.GET("/me", handler.Me)
|
|
auth.PUT("/me/password", handler.ChangePassword)
|
|
auth.GET("/me/sessions", handler.ListMySessions)
|
|
auth.DELETE("/me/sessions/:sessionId", handler.RevokeMySession)
|
|
}
|
|
|
|
admin := r.Group("/api/admin")
|
|
admin.Use(middleware.AuthMiddleware(), middleware.AdminMiddleware(), bodyLimit)
|
|
{
|
|
admin.GET("/stats", handler.GetAdminStats)
|
|
admin.GET("/users/count", handler.GetUserCount)
|
|
admin.GET("/users", handler.ListUsers)
|
|
admin.POST("/users", handler.CreateUser)
|
|
admin.PUT("/users/:id", handler.UpdateUser)
|
|
admin.DELETE("/users/:id", handler.DeleteUser)
|
|
admin.DELETE("/users/:id/sessions", handler.AdminRevokeUserSessions)
|
|
|
|
admin.GET("/vpn/settings", handler.GetVpnSettings)
|
|
admin.PUT("/vpn/settings", handler.UpdateVpnSettings)
|
|
admin.GET("/vpn/status", handler.GetVpnStatus)
|
|
admin.GET("/vpn/diag", handler.GetVpnDiag)
|
|
admin.GET("/vpn/reservations", handler.ListVpnReservations)
|
|
admin.POST("/vpn/reservations", handler.CreateVpnReservation)
|
|
admin.DELETE("/vpn/reservations/:id", handler.DeleteVpnReservation)
|
|
}
|
|
|
|
distDir := http.Dir("./dist")
|
|
fs := http.FileServer(distDir)
|
|
r.NoRoute(func(c *gin.Context) {
|
|
path := c.Request.URL.Path
|
|
if strings.HasPrefix(path, "/api") || strings.HasPrefix(path, "/ws") {
|
|
c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
|
|
return
|
|
}
|
|
f, err := distDir.Open(path)
|
|
if err != nil {
|
|
c.Header("Content-Type", "text/html")
|
|
c.File("./dist/index.html")
|
|
return
|
|
}
|
|
f.Close()
|
|
fs.ServeHTTP(c.Writer, c.Request)
|
|
})
|
|
}
|