Documentation
¶
Index ¶
- Constants
- Variables
- func CheckWebSocketOrigin(r *http.Request) bool
- func ClientOperation(c *gin.Context, clientUUID string) func(context.Context, func() error) error
- func ControlBodyLimit() gin.HandlerFunc
- func EnableWebSocketCompression(upgrader *websocket.Upgrader)
- func GetClients(c *gin.Context)
- func GetPrincipal(c *gin.Context) *rpc.Principal
- func GetRole(c *gin.Context) string
- func IdentifyPrincipal(c *gin.Context) *rpc.Principal
- func IdentityMiddleware() gin.HandlerFunc
- func IsWebSocketUpgrade(c *gin.Context) bool
- func PrivateSiteMiddleware() gin.HandlerFunc
- func RequireRole(allowedRoles ...string) gin.HandlerFunc
- func RequireSensitive2FA() gin.HandlerFunc
- func Respond(c *gin.Context, httpStatus int, status string, message string, ...)
- func RespondError(c *gin.Context, httpStatus int, message string)
- func RespondSuccess(c *gin.Context, data interface{})
- func RespondSuccessMessage(c *gin.Context, message string, data interface{})
- func SetPrincipal(c *gin.Context, p *rpc.Principal)
- func UpgradeSafeConn(c *gin.Context, options ...WebSocketUpgradeOption) (*connection.SafeConn, error)
- func UpgradeWebSocket(c *gin.Context, options ...WebSocketUpgradeOption) (*websocket.Conn, error)
- func VerifySensitive2FA(c *gin.Context) error
- func VerifySensitive2FACore(userUUID, code string) error
- type Response
- type WebSocketUpgradeOption
Constants ¶
const ( RoleAdmin = "admin" RoleClient = "client" RoleGuest = "guest" )
const MaxAgentControlBody int64 = 8 << 20
MaxAgentControlBody bounds the Agent v2 control channel. That channel is not only reports: it also carries filesystem metadata, and a directory listing for a large directory is legitimately bigger than a browser control body. At 1 MiB the panel answered 413, the Agent treated the 4xx as final, and the operator saw a file-operation timeout instead of the directory. The bound stays finite so a buggy or compromised Agent still cannot stream an unbounded body into memory; reports keep the tighter MaxControlBody (see UploadV2RPC).
const MaxControlBody int64 = 1 << 20
MaxControlBody bounds browser JSON control messages. They are small and must be bounded before decoding.
Variables ¶
var ErrClientCredentialRetired = errors.New("client credential is no longer valid")
Functions ¶
func CheckWebSocketOrigin ¶
func ClientOperation ¶ added in v1.7.0
ClientOperation captures body credentials before consumption. Its short side effects share the retirement gate, so validation cannot race commit + reset.
func ControlBodyLimit ¶ added in v0.1.13
func ControlBodyLimit() gin.HandlerFunc
ControlBodyLimit leaves authenticated binary transfers to their own streaming limits. JSON control messages are small and must be bounded before decoding.
func GetClients ¶
func GetPrincipal ¶
GetPrincipal 读取已识别的主体;若中间件未运行则返回 nil。
func IdentifyPrincipal ¶
IdentifyPrincipal 识别当前请求的调用主体。不写入任何状态,可安全多次调用。 识别优先级与历史 IdentityMiddleware 一致:API Key > Session > Client Token > 匿名。
func IdentityMiddleware ¶
func IdentityMiddleware() gin.HandlerFunc
IdentityMiddleware 统一身份识别中间件，在路由栈最外层运行。 负责识别当前请求者身份（Admin / Client / Guest），并写入 Context。 身份识别统一委托给 IdentifyPrincipal;同时保留旧的 c.Set 键(role/uuid/ api_key/session/client_uuid)以兼容现有 handler 与中间件。
func IsWebSocketUpgrade ¶
func PrivateSiteMiddleware ¶
func PrivateSiteMiddleware() gin.HandlerFunc
PrivateSiteMiddleware 私有站点访问控制。 依赖 IdentityMiddleware 已设置的 role，对未认证的访客在私有站点模式下进行拦截。
func RequireRole ¶
func RequireRole(allowedRoles ...string) gin.HandlerFunc
RequireRole 声明式权限校验中间件，仅允许指定角色通过。
func RequireSensitive2FA ¶
func RequireSensitive2FA() gin.HandlerFunc
func RespondError ¶
RespondError sends an error response with message.
func RespondSuccess ¶
RespondSuccess sends a success response with data.
func RespondSuccessMessage ¶
RespondSuccessMessage sends a success response with message and data.
func SetPrincipal ¶
SetPrincipal 将已识别的主体写入 gin.Context,供下游(RPC 边界等)复用。
func UpgradeSafeConn ¶
func UpgradeSafeConn(c *gin.Context, options ...WebSocketUpgradeOption) (*connection.SafeConn, error)
UpgradeSafeConn upgrades the request to a WebSocket and attaches the process-wide plugin frame interceptor (when one is wired). A plugin wsConnect hook may deny the connection: the peer receives a policy-violation close frame and the caller gets an error.
func UpgradeWebSocket ¶
func VerifySensitive2FA ¶
VerifySensitive2FA gin 适配层:从 gin.Context 提取参数后委托核心校验。
func VerifySensitive2FACore ¶
VerifySensitive2FACore 传输无关的 2FA 校验核心。 Session-only core. A key must instead hold the exact sensitive method's grant.
Source Files
Directories