Documentation
¶
Index ¶
- Constants
- func AdminAPIToken() gin.HandlerFunc
- func AdminAuth() gin.HandlerFunc
- func AppTokenAuth() gin.HandlerFunc
- func AuditLog() gin.HandlerFunc
- func CORS() gin.HandlerFunc
- func JWTAuth() gin.HandlerFunc
- func Logger() gin.HandlerFunc
- func NodeAPIKeyAuth() gin.HandlerFunc
- func NodeAPIKeyHeaderAuth() gin.HandlerFunc
- func NodeAuth() gin.HandlerFunc
- func NodeSecureLogger() gin.HandlerFunc
- func RecordAuditItems(c *gin.Context, items []AuditItem)
- func Recovery() gin.HandlerFunc
- func RequestID() gin.HandlerFunc
- func SecurityHeaders() gin.HandlerFunc
- func SignatureAuth() gin.HandlerFunc
- type AuditItem
- type RateLimiter
- type RateLimiterOption
Constants ¶
const ( // SignatureHeader 签名头 SignatureHeader = "X-Signature" // TimestampHeader 时间戳头 TimestampHeader = "X-Timestamp" // NonceHeader 随机数头 (防重放) NonceHeader = "X-Nonce" // MaxTimeDiff 最大时间差 (秒) MaxTimeDiff = 300 // 5分钟 )
const AuditActionKey = "audit_action"
AuditActionKey is the gin context key under which a handler names the action of its audit row ("bulk_ban"), instead of the one the method and path give.
Variables ¶
This section is empty.
Functions ¶
func AdminAPIToken ¶ added in v4.2.0
func AdminAPIToken() gin.HandlerFunc
AdminAPIToken authenticates "Authorization: Bearer anixadm_..." on the administrator APIs, in front of JWTAuth (docs/reference/admin-api-tokens.md).
- Only the Authorization header carries a token. A value that looks like one in the URL is refused, never used: URLs reach logs and proxies.
- Any other request goes on to JWTAuth unchanged. JWTAuth skips the JWT check for a request this middleware authenticated, and only for it: the marker is set on the server side, and user routes, which have no AdminAPIToken, refuse a token like any other string that is no JWT.
- The owner's rights are read from the database on every request, so a banned, demoted or deleted administrator's tokens stop at once.
- The token's scope is enforced here: a read token makes GET and HEAD requests only, and never the reads that answer a secret in clear. Managing tokens needs a signed-in session, whatever the scope.
- Refusals count against the client address (apiTokenFailureLimit) and are audited, at most once a minute per token.
func AuditLog ¶
func AuditLog() gin.HandlerFunc
AuditLog returns a gin middleware that records all admin API operations to both structured slog output and the v2_audit_log database table. It applies to requests whose path starts with /api/v2/admin/, /api/v3/ or /api/v4/forward/, and to the user writes in auditedUserWrites.
func NodeAPIKeyHeaderAuth ¶
func NodeAPIKeyHeaderAuth() gin.HandlerFunc
NodeAPIKeyHeaderAuth is the package-download authentication boundary. API keys in URLs leak through logs, browser history and proxy caches, so this variant accepts only X-API-Key while preserving legacy query fallback on the older node APIs.
func NodeAuth ¶
func NodeAuth() gin.HandlerFunc
NodeAuth enforces node-scoped auth via required `node_id + X-API-Key`.
func NodeSecureLogger ¶
func NodeSecureLogger() gin.HandlerFunc
NodeSecureLogger 节点专用安全日志 记录节点通信详情，用于审计和问题排查
func RecordAuditItems ¶ added in v4.2.0
RecordAuditItems writes an audit row for each item, as the audit log would have written it had the item been requested alone: the item's method and path (so module and action follow the same rules), with the acting administrator, address, user agent and request id of c, which ties the rows to the request that did them. A bulk request is audited as a whole by the middleware; this keeps each target findable by its own path. It is synchronous, a single batch insert, and best effort like the middleware's row: an error is logged, not returned.
func RequestID ¶
func RequestID() gin.HandlerFunc
RequestID propagates or creates a request identifier for tracing.
func SecurityHeaders ¶
func SecurityHeaders() gin.HandlerFunc
SecurityHeaders applies a conservative set of production-safe response headers.
func SignatureAuth ¶
func SignatureAuth() gin.HandlerFunc
SignatureAuth 请求签名验证中间件 签名算法: HMAC-SHA256(timestamp + method + path + body, secret) 需要配合 NodeAPIKeyAuth 使用，依赖 context 中的 node 信息
Types ¶
type AuditItem ¶ added in v4.2.0
type AuditItem struct {
Method string
Path string
// Status is the HTTP status the single-item request would have had.
Status int
// Error is why it failed; empty when it did not.
Error string
}
AuditItem is one of the things a single request did: the single-item request it stands for.
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
RateLimiter is a thread-safe per-IP rate limiter using token buckets.
func NewRateLimiter ¶
func NewRateLimiter(rate, burst float64, opts ...RateLimiterOption) *RateLimiter
NewRateLimiter creates a new RateLimiter with the given rate and burst.
- rate: sustained requests per second
- burst: maximum burst size (initial tokens)
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware() gin.HandlerFunc
Middleware returns a gin.HandlerFunc that enforces rate limiting per client IP.
func (*RateLimiter) MiddlewareForContextKey ¶
func (rl *RateLimiter) MiddlewareForContextKey(contextKey string) gin.HandlerFunc
MiddlewareForContextKey enforces independent buckets for an authenticated identity stored in Gin context, such as a node_id.
func (*RateLimiter) StartCleanup ¶
func (rl *RateLimiter) StartCleanup(interval time.Duration)
StartCleanup starts a periodic cleanup goroutine. It should be called once at application startup.
type RateLimiterOption ¶
type RateLimiterOption func(*RateLimiter)
RateLimiterOption configures optional behaviour on a RateLimiter.
func WithExemptPaths ¶
func WithExemptPaths(paths []string) RateLimiterOption
WithExemptPaths sets URL path prefixes that bypass rate limiting.
func WithTTL ¶
func WithTTL(ttl time.Duration) RateLimiterOption
WithTTL sets the expiry duration for unused buckets.
func WithTestModeBypass ¶
func WithTestModeBypass(enabled bool) RateLimiterOption
WithTestModeBypass controls whether gin.TestMode bypasses this limiter. Existing API limiters keep the historical bypass; security-sensitive node downloads can exercise the exact limiter in integration tests.
Source Files