mirror of
https://github.com/tnb-labs/panel.git
synced 2026-09-21 05:11:14 +08:00
耗子andClaude Opus 4.8
443516a2cf
依赖注入：
- 移除 google/wire（含 wire.go/wire_gen.go 与全部 ProviderSet），
改用 samber/do v2 单注入器 + 双入口惰性构建
- 贡献模型替代命令式注册：路由 routes:、命令 commands:、
任务 jobs: 前缀经 internal/registry 收集与校验
- 构造函数统一 func NewXxx(i do.Injector) (T, error)
三层架构：
- 补全用例层：每个 biz.XxxRepo 配 XxxUsecase，
service/command/job 表现层只依赖用例，不再直接引用仓储
路由与文档：
- route/http.go 按域拆为声明式 Endpoint 贡献，
Endpoint 承载登录白名单与端点限流语义
- 调试模式下提供 OpenAPI 3.1 文档：/openapi.json 与 /docs（Scalar），
从 validate 标签生成
目录与依赖：
- internal/http/{middleware,request,rule} 拍平至 internal/*
- CLI 命令拆至 internal/command
- 日志轮转 timberjack 换为 libtnb/logrotate
- 升级 validator/cron/sessions/gormstore/sqlite/securecookie
- 数据库迁移保持 gormigrate 不变
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
252 lines
8.4 KiB
Go
252 lines
8.4 KiB
Go
package data
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log/slog"
|
|
"time"
|
|
|
|
"github.com/leonelquinteros/gotext"
|
|
"github.com/samber/do/v2"
|
|
"gorm.io/gorm"
|
|
"resty.dev/v3"
|
|
|
|
"github.com/acepanel/panel/v3/internal/biz"
|
|
"github.com/acepanel/panel/v3/internal/request"
|
|
"github.com/acepanel/panel/v3/pkg/acme"
|
|
"github.com/acepanel/panel/v3/pkg/cert"
|
|
)
|
|
|
|
type certAccountRepo struct {
|
|
t *gotext.Locale
|
|
db *gorm.DB
|
|
log *slog.Logger
|
|
user biz.UserRepo
|
|
}
|
|
|
|
func NewCertAccountRepo(i do.Injector) (biz.CertAccountRepo, error) {
|
|
return &certAccountRepo{
|
|
t: do.MustInvoke[*gotext.Locale](i),
|
|
db: do.MustInvoke[*gorm.DB](i),
|
|
log: do.MustInvoke[*slog.Logger](i),
|
|
user: do.MustInvoke[biz.UserRepo](i),
|
|
}, nil
|
|
}
|
|
|
|
func (r certAccountRepo) List(page, limit uint) ([]*biz.CertAccount, int64, error) {
|
|
accounts := make([]*biz.CertAccount, 0)
|
|
var total int64
|
|
err := r.db.Model(&biz.CertAccount{}).Order("id desc").Count(&total).Offset(int((page - 1) * limit)).Limit(int(limit)).Find(&accounts).Error
|
|
return accounts, total, err
|
|
}
|
|
|
|
func (r certAccountRepo) GetDefault(userID uint) (*biz.CertAccount, error) {
|
|
user, err := r.user.Get(userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
account := new(biz.CertAccount)
|
|
if err = r.db.Model(&biz.CertAccount{}).Where("ca = ?", "letsencrypt").Where("email = ?", user.Email).First(account).Error; err == nil {
|
|
return account, nil
|
|
}
|
|
|
|
req := &request.CertAccountCreate{
|
|
CA: "letsencrypt",
|
|
Email: user.Email,
|
|
KeyType: string(acme.KeyEC256),
|
|
}
|
|
|
|
return r.Create(context.Background(), req)
|
|
}
|
|
|
|
func (r certAccountRepo) Get(id uint) (*biz.CertAccount, error) {
|
|
account := new(biz.CertAccount)
|
|
err := r.db.Model(&biz.CertAccount{}).Where("id = ?", id).First(account).Error
|
|
return account, err
|
|
}
|
|
|
|
func (r certAccountRepo) Create(ctx context.Context, req *request.CertAccountCreate) (*biz.CertAccount, error) {
|
|
account := new(biz.CertAccount)
|
|
account.CA = req.CA
|
|
account.Email = req.Email
|
|
account.Kid = req.Kid
|
|
account.HmacEncoded = req.HmacEncoded
|
|
account.KeyType = req.KeyType
|
|
|
|
var err error
|
|
var client *acme.Client
|
|
switch account.CA {
|
|
case "googlecn":
|
|
eab, eabErr := r.getGoogleEAB()
|
|
if eabErr != nil {
|
|
return nil, eabErr
|
|
}
|
|
account.Kid = eab.KeyID
|
|
account.HmacEncoded = eab.MACKey
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAGoogleCN, eab, acme.KeyType(account.KeyType), r.log)
|
|
case "google":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAGoogle, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
case "letsencrypt":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CALetsEncrypt, nil, acme.KeyType(account.KeyType), r.log)
|
|
case "litessl":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CALiteSSL, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
case "zerossl":
|
|
eab, eabErr := r.getZeroSSLEAB(account.Email)
|
|
if eabErr != nil {
|
|
return nil, eabErr
|
|
}
|
|
account.Kid = eab.KeyID
|
|
account.HmacEncoded = eab.MACKey
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAZeroSSL, eab, acme.KeyType(account.KeyType), r.log)
|
|
case "sslcom":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CASSLcom, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
default:
|
|
return nil, errors.New(r.t.Get("unsupported CA"))
|
|
}
|
|
|
|
if err != nil {
|
|
return nil, errors.New(r.t.Get("failed to register account: %v", err))
|
|
}
|
|
|
|
privateKey, err := cert.EncodeKey(client.Account.PrivateKey)
|
|
if err != nil {
|
|
return nil, errors.New(r.t.Get("failed to get private key"))
|
|
}
|
|
account.PrivateKey = string(privateKey)
|
|
|
|
if err = r.db.Create(account).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// 记录日志
|
|
r.log.Info("cert account created", slog.String("type", biz.OperationTypeCert), slog.Uint64("operator_id", getOperatorID(ctx)), slog.Uint64("id", uint64(account.ID)), slog.String("ca", req.CA), slog.String("email", req.Email))
|
|
|
|
return account, nil
|
|
}
|
|
|
|
func (r certAccountRepo) Update(ctx context.Context, req *request.CertAccountUpdate) error {
|
|
account, err := r.Get(req.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
account.CA = req.CA
|
|
account.Email = req.Email
|
|
account.Kid = req.Kid
|
|
account.HmacEncoded = req.HmacEncoded
|
|
account.KeyType = req.KeyType
|
|
|
|
var client *acme.Client
|
|
switch account.CA {
|
|
case "googlecn":
|
|
eab, eabErr := r.getGoogleEAB()
|
|
if eabErr != nil {
|
|
return eabErr
|
|
}
|
|
account.Kid = eab.KeyID
|
|
account.HmacEncoded = eab.MACKey
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAGoogleCN, eab, acme.KeyType(account.KeyType), r.log)
|
|
case "google":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAGoogle, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
case "letsencrypt":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CALetsEncrypt, nil, acme.KeyType(account.KeyType), r.log)
|
|
case "litessl":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CALiteSSL, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
case "zerossl":
|
|
eab, eabErr := r.getZeroSSLEAB(account.Email)
|
|
if eabErr != nil {
|
|
return eabErr
|
|
}
|
|
account.Kid = eab.KeyID
|
|
account.HmacEncoded = eab.MACKey
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CAZeroSSL, eab, acme.KeyType(account.KeyType), r.log)
|
|
case "sslcom":
|
|
client, err = acme.NewRegisterAccount(context.Background(), account.Email, acme.CASSLcom, &acme.EAB{KeyID: account.Kid, MACKey: account.HmacEncoded}, acme.KeyType(account.KeyType), r.log)
|
|
default:
|
|
return errors.New(r.t.Get("unsupported CA"))
|
|
}
|
|
|
|
if err != nil {
|
|
return errors.New(r.t.Get("failed to register account: %v", err))
|
|
}
|
|
|
|
privateKey, err := cert.EncodeKey(client.Account.PrivateKey)
|
|
if err != nil {
|
|
return errors.New(r.t.Get("failed to get private key: %v", err))
|
|
}
|
|
account.PrivateKey = string(privateKey)
|
|
|
|
if err = r.db.Save(account).Error; err != nil {
|
|
return err
|
|
}
|
|
|
|
// 记录日志
|
|
r.log.Info("cert account updated", slog.String("type", biz.OperationTypeCert), slog.Uint64("operator_id", getOperatorID(ctx)), slog.Uint64("id", uint64(req.ID)), slog.String("ca", req.CA))
|
|
|
|
return nil
|
|
}
|
|
|
|
func (r certAccountRepo) Delete(ctx context.Context, id uint) error {
|
|
if err := r.db.Model(&biz.CertAccount{}).Where("id = ?", id).Delete(&biz.CertAccount{}).Error; err != nil {
|
|
return err
|
|
}
|
|
|
|
// 记录日志
|
|
r.log.Info("cert account deleted", slog.String("type", biz.OperationTypeCert), slog.Uint64("operator_id", getOperatorID(ctx)), slog.Uint64("id", uint64(id)))
|
|
|
|
return nil
|
|
}
|
|
|
|
// getGoogleEAB 获取 Google EAB
|
|
func (r certAccountRepo) getGoogleEAB() (*acme.EAB, error) {
|
|
type data struct {
|
|
Msg string `json:"msg"`
|
|
Data struct {
|
|
KeyId string `json:"key_id"`
|
|
MacKey string `json:"mac_key"`
|
|
} `json:"data"`
|
|
}
|
|
client := resty.New()
|
|
defer func(client *resty.Client) { _ = client.Close() }(client)
|
|
client.SetTimeout(5 * time.Second)
|
|
client.SetRetryCount(3)
|
|
|
|
resp, err := client.R().SetResult(&data{}).Get("https://gts.rat.dev/eab")
|
|
if err != nil || !resp.IsStatusSuccess() {
|
|
return &acme.EAB{}, errors.New(r.t.Get("failed to get Google EAB: %v", err))
|
|
}
|
|
eab := resp.Result().(*data)
|
|
if eab.Msg != "success" {
|
|
return &acme.EAB{}, errors.New(r.t.Get("failed to get Google EAB: %s", eab.Msg))
|
|
}
|
|
|
|
return &acme.EAB{KeyID: eab.Data.KeyId, MACKey: eab.Data.MacKey}, nil
|
|
}
|
|
|
|
// getZeroSSLEAB 获取 ZeroSSL EAB
|
|
func (r certAccountRepo) getZeroSSLEAB(email string) (*acme.EAB, error) {
|
|
type data struct {
|
|
Success bool `json:"success"`
|
|
EabKid string `json:"eab_kid"`
|
|
EabHmacKey string `json:"eab_hmac_key"`
|
|
}
|
|
client := resty.New()
|
|
defer func(client *resty.Client) { _ = client.Close() }(client)
|
|
client.SetTimeout(5 * time.Second)
|
|
client.SetRetryCount(3)
|
|
|
|
resp, err := client.R().SetFormData(map[string]string{
|
|
"email": email,
|
|
}).SetResult(&data{}).Post("https://api.zerossl.com/acme/eab-credentials-email")
|
|
if err != nil || !resp.IsStatusSuccess() {
|
|
return &acme.EAB{}, errors.New(r.t.Get("failed to get ZeroSSL EAB: %v", err))
|
|
}
|
|
eab := resp.Result().(*data)
|
|
if !eab.Success {
|
|
return &acme.EAB{}, errors.New(r.t.Get("failed to get ZeroSSL EAB"))
|
|
}
|
|
|
|
return &acme.EAB{KeyID: eab.EabKid, MACKey: eab.EabHmacKey}, nil
|
|
}
|