From 97d7211e366d667786ccb38d20b3179ab68c9f3e Mon Sep 17 00:00:00 2001 From: pionxe Date: Thu, 16 Apr 2026 23:36:38 +0800 Subject: [PATCH 01/12] =?UTF-8?q?feat(gateway):=20[EPIC-GW-06]=20=E5=BC=95?= =?UTF-8?q?=E5=85=A5=E7=BB=9F=E4=B8=80=E9=85=8D=E7=BD=AE=E5=BC=95=E6=93=8E?= =?UTF-8?q?=E4=B8=8E=E5=8F=8C=E8=BD=A8=E8=A7=82=E6=B5=8B=E6=8C=87=E6=A0=87?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 构建网关治理的基础设施： 1. 统一配置：新增 ~/.neocode/config.yaml 解析链路，支持网关层限流、超时、帧大小等核心参数的持久化治理。 2. 观测基建：引入 Prometheus 官方 SDK，构建 /metrics (文本) 与 /metrics.json (结构化) 双轨制指标端点。 3. 错误契约：补齐 unauthorized、access_denied 等安全域标准 JSON-RPC 错误码。 --- internal/config/config.go | 9 +- internal/config/gateway.go | 326 ++++++++++++++++++++++++++++++ internal/config/gateway_loader.go | 52 +++++ internal/config/gateway_test.go | 142 +++++++++++++ internal/config/loader.go | 3 + internal/gateway/build_info.go | 22 ++ internal/gateway/errors.go | 8 +- internal/gateway/errors_test.go | 2 + internal/gateway/metrics.go | 197 ++++++++++++++++++ internal/gateway/metrics_test.go | 29 +++ internal/gateway/types.go | 2 + 11 files changed, 790 insertions(+), 2 deletions(-) create mode 100644 internal/config/gateway.go create mode 100644 internal/config/gateway_loader.go create mode 100644 internal/config/gateway_test.go create mode 100644 internal/gateway/build_info.go create mode 100644 internal/gateway/metrics.go create mode 100644 internal/gateway/metrics_test.go diff --git a/internal/config/config.go b/internal/config/config.go index 87ce5d0f..60e08572 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -25,6 +25,7 @@ type Config struct { Context ContextConfig `yaml:"context,omitempty"` Tools ToolsConfig `yaml:"tools,omitempty"` Memo MemoConfig `yaml:"memo,omitempty"` + Gateway GatewayConfig `yaml:"gateway,omitempty"` } // StaticDefaults 返回 config 层负责的静态默认值骨架，不包含 provider 装配和选择状态修复。 @@ -39,7 +40,8 @@ func StaticDefaults() *Config { WebFetch: defaultWebFetchConfig(), MCP: defaultMCPConfig(), }, - Memo: defaultMemoConfig(), + Memo: defaultMemoConfig(), + Gateway: defaultGatewayConfig(), } } @@ -54,6 +56,7 @@ func (c *Config) Clone() Config { clone.Context = c.Context.Clone() clone.Tools = c.Tools.Clone() clone.Memo = c.Memo.Clone() + clone.Gateway = c.Gateway.Clone() return clone } @@ -76,6 +79,7 @@ func (c *Config) applyStaticDefaults(defaults Config) { c.Context.ApplyDefaults(defaults.Context) c.Tools.ApplyDefaults(defaults.Tools) c.Memo.ApplyDefaults(defaults.Memo) + c.Gateway.ApplyDefaults(defaults.Gateway) c.Workdir = normalizeWorkdir(c.Workdir) } @@ -135,6 +139,9 @@ func (c *Config) ValidateSnapshot() error { if err := c.Memo.Validate(); err != nil { return fmt.Errorf("config: memo: %w", err) } + if err := c.Gateway.Validate(); err != nil { + return fmt.Errorf("config: gateway: %w", err) + } return nil } diff --git a/internal/config/gateway.go b/internal/config/gateway.go new file mode 100644 index 00000000..d8fb2ad2 --- /dev/null +++ b/internal/config/gateway.go @@ -0,0 +1,326 @@ +package config + +import ( + "fmt" + "path/filepath" + "strings" +) + +const ( + // DefaultGatewayACLMode 定义网关 ACL 默认模式。 + DefaultGatewayACLMode = "strict" + // DefaultGatewayMetricsEnabled 定义网关指标是否默认开启。 + DefaultGatewayMetricsEnabled = true + // DefaultGatewayMaxFrameBytes 定义控制面单帧最大字节数默认值。 + DefaultGatewayMaxFrameBytes = 1 << 20 + // DefaultGatewayIPCMaxConnections 定义 IPC 最大连接数默认值。 + DefaultGatewayIPCMaxConnections = 128 + // DefaultGatewayHTTPMaxRequestBytes 定义 HTTP 最大请求体默认值。 + DefaultGatewayHTTPMaxRequestBytes = 1 << 20 + // DefaultGatewayHTTPMaxStreamConnections 定义 HTTP 流式连接默认上限。 + DefaultGatewayHTTPMaxStreamConnections = 128 + // DefaultGatewayIPCReadSec 定义 IPC 读超时默认秒数。 + DefaultGatewayIPCReadSec = 30 + // DefaultGatewayIPCWriteSec 定义 IPC 写超时默认秒数。 + DefaultGatewayIPCWriteSec = 30 + // DefaultGatewayHTTPReadSec 定义 HTTP 读超时默认秒数。 + DefaultGatewayHTTPReadSec = 15 + // DefaultGatewayHTTPWriteSec 定义 HTTP 写超时默认秒数。 + DefaultGatewayHTTPWriteSec = 15 + // DefaultGatewayHTTPShutdownSec 定义 HTTP 关闭超时默认秒数。 + DefaultGatewayHTTPShutdownSec = 2 +) + +// GatewayConfig 表示网关治理与安全配置。 +type GatewayConfig struct { + Security GatewaySecurityConfig `yaml:"security,omitempty"` + Limits GatewayLimitsConfig `yaml:"limits,omitempty"` + Timeouts GatewayTimeoutsConfig `yaml:"timeouts,omitempty"` + Observability GatewayObservabilityConfig `yaml:"observability,omitempty"` +} + +// GatewaySecurityConfig 表示网关鉴权与 ACL 安全策略配置。 +type GatewaySecurityConfig struct { + ACLMode string `yaml:"acl_mode,omitempty"` + TokenFile string `yaml:"token_file,omitempty"` + AllowOrigins []string `yaml:"allow_origins,omitempty"` +} + +// GatewayLimitsConfig 表示网关限流与配额配置。 +type GatewayLimitsConfig struct { + MaxFrameBytes int `yaml:"max_frame_bytes,omitempty"` + IPCMaxConnections int `yaml:"ipc_max_connections,omitempty"` + HTTPMaxRequestBytes int `yaml:"http_max_request_bytes,omitempty"` + HTTPMaxStreamConnections int `yaml:"http_max_stream_connections,omitempty"` +} + +// GatewayTimeoutsConfig 表示网关默认超时配置。 +type GatewayTimeoutsConfig struct { + IPCReadSec int `yaml:"ipc_read_sec,omitempty"` + IPCWriteSec int `yaml:"ipc_write_sec,omitempty"` + HTTPReadSec int `yaml:"http_read_sec,omitempty"` + HTTPWriteSec int `yaml:"http_write_sec,omitempty"` + HTTPShutdownSec int `yaml:"http_shutdown_sec,omitempty"` +} + +// GatewayObservabilityConfig 表示网关可观测性配置。 +type GatewayObservabilityConfig struct { + MetricsEnabled *bool `yaml:"metrics_enabled,omitempty"` +} + +// defaultGatewayConfig 返回网关配置默认值。 +func defaultGatewayConfig() GatewayConfig { + return GatewayConfig{ + Security: GatewaySecurityConfig{ + ACLMode: DefaultGatewayACLMode, + AllowOrigins: defaultGatewayAllowOrigins(), + }, + Limits: GatewayLimitsConfig{ + MaxFrameBytes: DefaultGatewayMaxFrameBytes, + IPCMaxConnections: DefaultGatewayIPCMaxConnections, + HTTPMaxRequestBytes: DefaultGatewayHTTPMaxRequestBytes, + HTTPMaxStreamConnections: DefaultGatewayHTTPMaxStreamConnections, + }, + Timeouts: GatewayTimeoutsConfig{ + IPCReadSec: DefaultGatewayIPCReadSec, + IPCWriteSec: DefaultGatewayIPCWriteSec, + HTTPReadSec: DefaultGatewayHTTPReadSec, + HTTPWriteSec: DefaultGatewayHTTPWriteSec, + HTTPShutdownSec: DefaultGatewayHTTPShutdownSec, + }, + Observability: GatewayObservabilityConfig{ + MetricsEnabled: boolPtr(DefaultGatewayMetricsEnabled), + }, + } +} + +// ApplyDefaults 为网关配置补齐默认值。 +func (c *GatewayConfig) ApplyDefaults(defaults GatewayConfig) { + if c == nil { + return + } + + c.Security.ApplyDefaults(defaults.Security) + c.Limits.ApplyDefaults(defaults.Limits) + c.Timeouts.ApplyDefaults(defaults.Timeouts) + c.Observability.ApplyDefaults(defaults.Observability) +} + +// Validate 校验网关配置合法性。 +func (c GatewayConfig) Validate() error { + if err := c.Security.Validate(); err != nil { + return fmt.Errorf("security: %w", err) + } + if err := c.Limits.Validate(); err != nil { + return fmt.Errorf("limits: %w", err) + } + if err := c.Timeouts.Validate(); err != nil { + return fmt.Errorf("timeouts: %w", err) + } + if err := c.Observability.Validate(); err != nil { + return fmt.Errorf("observability: %w", err) + } + return nil +} + +// Clone 深拷贝网关配置。 +func (c GatewayConfig) Clone() GatewayConfig { + cloned := c + cloned.Security = c.Security.Clone() + cloned.Limits = c.Limits.Clone() + cloned.Timeouts = c.Timeouts.Clone() + cloned.Observability = c.Observability.Clone() + return cloned +} + +// ApplyDefaults 为安全配置补齐默认值。 +func (c *GatewaySecurityConfig) ApplyDefaults(defaults GatewaySecurityConfig) { + if c == nil { + return + } + if strings.TrimSpace(c.ACLMode) == "" { + c.ACLMode = defaults.ACLMode + } + if strings.TrimSpace(c.TokenFile) == "" { + c.TokenFile = defaults.TokenFile + } + if len(c.AllowOrigins) == 0 { + c.AllowOrigins = append([]string(nil), defaults.AllowOrigins...) + } else { + c.AllowOrigins = normalizeGatewayAllowOrigins(c.AllowOrigins) + } +} + +// Validate 校验安全配置。 +func (c GatewaySecurityConfig) Validate() error { + aclMode := strings.ToLower(strings.TrimSpace(c.ACLMode)) + if aclMode != "" && aclMode != DefaultGatewayACLMode { + return fmt.Errorf("acl_mode must be %q", DefaultGatewayACLMode) + } + if strings.TrimSpace(c.TokenFile) != "" { + cleaned := filepath.Clean(strings.TrimSpace(c.TokenFile)) + if cleaned == "." { + return fmt.Errorf("token_file is invalid") + } + } + for index, origin := range c.AllowOrigins { + if strings.TrimSpace(origin) == "" { + return fmt.Errorf("allow_origins[%d] is empty", index) + } + } + return nil +} + +// Clone 深拷贝安全配置。 +func (c GatewaySecurityConfig) Clone() GatewaySecurityConfig { + cloned := c + cloned.AllowOrigins = append([]string(nil), c.AllowOrigins...) + return cloned +} + +// ApplyDefaults 为限流配置补齐默认值。 +func (c *GatewayLimitsConfig) ApplyDefaults(defaults GatewayLimitsConfig) { + if c == nil { + return + } + if c.MaxFrameBytes <= 0 { + c.MaxFrameBytes = defaults.MaxFrameBytes + } + if c.IPCMaxConnections <= 0 { + c.IPCMaxConnections = defaults.IPCMaxConnections + } + if c.HTTPMaxRequestBytes <= 0 { + c.HTTPMaxRequestBytes = defaults.HTTPMaxRequestBytes + } + if c.HTTPMaxStreamConnections <= 0 { + c.HTTPMaxStreamConnections = defaults.HTTPMaxStreamConnections + } +} + +// Validate 校验限流配置。 +func (c GatewayLimitsConfig) Validate() error { + if c.MaxFrameBytes <= 0 { + return fmt.Errorf("max_frame_bytes must be greater than 0") + } + if c.IPCMaxConnections <= 0 { + return fmt.Errorf("ipc_max_connections must be greater than 0") + } + if c.HTTPMaxRequestBytes <= 0 { + return fmt.Errorf("http_max_request_bytes must be greater than 0") + } + if c.HTTPMaxStreamConnections <= 0 { + return fmt.Errorf("http_max_stream_connections must be greater than 0") + } + return nil +} + +// Clone 复制限流配置。 +func (c GatewayLimitsConfig) Clone() GatewayLimitsConfig { + return c +} + +// ApplyDefaults 为超时配置补齐默认值。 +func (c *GatewayTimeoutsConfig) ApplyDefaults(defaults GatewayTimeoutsConfig) { + if c == nil { + return + } + if c.IPCReadSec <= 0 { + c.IPCReadSec = defaults.IPCReadSec + } + if c.IPCWriteSec <= 0 { + c.IPCWriteSec = defaults.IPCWriteSec + } + if c.HTTPReadSec <= 0 { + c.HTTPReadSec = defaults.HTTPReadSec + } + if c.HTTPWriteSec <= 0 { + c.HTTPWriteSec = defaults.HTTPWriteSec + } + if c.HTTPShutdownSec <= 0 { + c.HTTPShutdownSec = defaults.HTTPShutdownSec + } +} + +// Validate 校验超时配置。 +func (c GatewayTimeoutsConfig) Validate() error { + if c.IPCReadSec <= 0 { + return fmt.Errorf("ipc_read_sec must be greater than 0") + } + if c.IPCWriteSec <= 0 { + return fmt.Errorf("ipc_write_sec must be greater than 0") + } + if c.HTTPReadSec <= 0 { + return fmt.Errorf("http_read_sec must be greater than 0") + } + if c.HTTPWriteSec <= 0 { + return fmt.Errorf("http_write_sec must be greater than 0") + } + if c.HTTPShutdownSec <= 0 { + return fmt.Errorf("http_shutdown_sec must be greater than 0") + } + return nil +} + +// Clone 复制超时配置。 +func (c GatewayTimeoutsConfig) Clone() GatewayTimeoutsConfig { + return c +} + +// ApplyDefaults 为可观测性配置补齐默认值。 +func (c *GatewayObservabilityConfig) ApplyDefaults(defaults GatewayObservabilityConfig) { + if c == nil { + return + } + if c.MetricsEnabled == nil { + if defaults.MetricsEnabled != nil { + c.MetricsEnabled = boolPtr(*defaults.MetricsEnabled) + return + } + c.MetricsEnabled = boolPtr(DefaultGatewayMetricsEnabled) + } +} + +// Validate 校验可观测性配置。 +func (c GatewayObservabilityConfig) Validate() error { + return nil +} + +// Clone 复制可观测性配置。 +func (c GatewayObservabilityConfig) Clone() GatewayObservabilityConfig { + cloned := c + if c.MetricsEnabled != nil { + cloned.MetricsEnabled = boolPtr(*c.MetricsEnabled) + } + return cloned +} + +// Enabled 返回 metrics_enabled 的生效值，空值按默认开启处理。 +func (c GatewayObservabilityConfig) Enabled() bool { + if c.MetricsEnabled == nil { + return DefaultGatewayMetricsEnabled + } + return *c.MetricsEnabled +} + +// defaultGatewayAllowOrigins 返回网关默认允许的本地来源。 +func defaultGatewayAllowOrigins() []string { + return []string{"http://localhost", "http://127.0.0.1", "http://[::1]", "app://"} +} + +// normalizeGatewayAllowOrigins 归一化 allow_origins，去除空项与空白。 +func normalizeGatewayAllowOrigins(origins []string) []string { + normalized := make([]string, 0, len(origins)) + for _, origin := range origins { + trimmed := strings.TrimSpace(origin) + if trimmed == "" { + continue + } + normalized = append(normalized, trimmed) + } + return normalized +} + +func boolPtr(value bool) *bool { + result := value + return &result +} diff --git a/internal/config/gateway_loader.go b/internal/config/gateway_loader.go new file mode 100644 index 00000000..5cd37a61 --- /dev/null +++ b/internal/config/gateway_loader.go @@ -0,0 +1,52 @@ +package config + +import ( + "bytes" + "context" + "fmt" + "os" + "path/filepath" + "strings" + + "gopkg.in/yaml.v3" +) + +// LoadGatewayConfig 轻量读取 config.yaml 中 gateway 段并补齐默认值，不触发 provider 级校验。 +func LoadGatewayConfig(ctx context.Context, baseDir string) (GatewayConfig, error) { + if err := ctx.Err(); err != nil { + return GatewayConfig{}, err + } + + resolvedBaseDir := strings.TrimSpace(baseDir) + if resolvedBaseDir == "" { + resolvedBaseDir = defaultBaseDir() + } + configPath := filepath.Join(resolvedBaseDir, configName) + defaults := defaultGatewayConfig() + + data, err := os.ReadFile(configPath) + if err != nil { + if os.IsNotExist(err) { + return defaults, nil + } + return GatewayConfig{}, fmt.Errorf("config: read gateway config file: %w", err) + } + if len(bytes.TrimSpace(data)) == 0 { + return defaults, nil + } + + var file struct { + Gateway GatewayConfig `yaml:"gateway,omitempty"` + } + decoder := yaml.NewDecoder(bytes.NewReader(data)) + if err := decoder.Decode(&file); err != nil { + return GatewayConfig{}, fmt.Errorf("config: parse gateway config file: %w", err) + } + + gatewayConfig := file.Gateway + gatewayConfig.ApplyDefaults(defaults) + if err := gatewayConfig.Validate(); err != nil { + return GatewayConfig{}, fmt.Errorf("config: gateway: %w", err) + } + return gatewayConfig, nil +} diff --git a/internal/config/gateway_test.go b/internal/config/gateway_test.go new file mode 100644 index 00000000..a2055061 --- /dev/null +++ b/internal/config/gateway_test.go @@ -0,0 +1,142 @@ +package config + +import ( + "context" + "os" + "path/filepath" + "strings" + "testing" +) + +func TestGatewayConfigDefaultsAndClone(t *testing.T) { + t.Parallel() + + defaults := defaultGatewayConfig() + if defaults.Security.ACLMode != DefaultGatewayACLMode { + t.Fatalf("acl_mode = %q, want %q", defaults.Security.ACLMode, DefaultGatewayACLMode) + } + if defaults.Limits.MaxFrameBytes != DefaultGatewayMaxFrameBytes { + t.Fatalf("max_frame_bytes = %d, want %d", defaults.Limits.MaxFrameBytes, DefaultGatewayMaxFrameBytes) + } + if !defaults.Observability.Enabled() { + t.Fatal("metrics should be enabled by default") + } + + cloned := defaults.Clone() + cloned.Security.AllowOrigins[0] = "http://changed" + if defaults.Security.AllowOrigins[0] == "http://changed" { + t.Fatal("clone should not share allow_origins slice") + } +} + +func TestGatewayConfigApplyDefaultsAndValidate(t *testing.T) { + t.Parallel() + + cfg := GatewayConfig{} + cfg.ApplyDefaults(defaultGatewayConfig()) + if err := cfg.Validate(); err != nil { + t.Fatalf("validate defaulted gateway config: %v", err) + } + + cfg.Observability.MetricsEnabled = boolPtr(false) + cfg.ApplyDefaults(defaultGatewayConfig()) + if cfg.Observability.Enabled() { + t.Fatal("explicit metrics_enabled=false should be preserved") + } + + invalid := cfg.Clone() + invalid.Security.ACLMode = "allow-all" + if err := invalid.Validate(); err == nil || !strings.Contains(err.Error(), "acl_mode") { + t.Fatalf("expected acl_mode error, got %v", err) + } +} + +func TestLoadGatewayConfig(t *testing.T) { + t.Parallel() + + t.Run("missing file uses defaults", func(t *testing.T) { + t.Parallel() + cfg, err := LoadGatewayConfig(context.Background(), t.TempDir()) + if err != nil { + t.Fatalf("load gateway config: %v", err) + } + if !cfg.Observability.Enabled() { + t.Fatal("metrics should default to enabled") + } + }) + + t.Run("reads gateway section", func(t *testing.T) { + t.Parallel() + + baseDir := t.TempDir() + configPath := filepath.Join(baseDir, configName) + content := ` +selected_provider: openai +current_model: gpt-5.4 +shell: bash +gateway: + security: + acl_mode: strict + token_file: /tmp/neocode-auth.json + allow_origins: + - http://localhost + - app:// + limits: + max_frame_bytes: 2048 + ipc_max_connections: 32 + http_max_request_bytes: 4096 + http_max_stream_connections: 16 + timeouts: + ipc_read_sec: 20 + ipc_write_sec: 21 + http_read_sec: 9 + http_write_sec: 10 + http_shutdown_sec: 4 + observability: + metrics_enabled: false +` + if err := os.WriteFile(configPath, []byte(strings.TrimSpace(content)+"\n"), 0o644); err != nil { + t.Fatalf("write config: %v", err) + } + + cfg, err := LoadGatewayConfig(context.Background(), baseDir) + if err != nil { + t.Fatalf("load gateway config: %v", err) + } + if cfg.Limits.MaxFrameBytes != 2048 { + t.Fatalf("max_frame_bytes = %d, want %d", cfg.Limits.MaxFrameBytes, 2048) + } + if cfg.Observability.Enabled() { + t.Fatal("metrics_enabled should be false") + } + if cfg.Security.TokenFile != "/tmp/neocode-auth.json" { + t.Fatalf("token_file = %q, want %q", cfg.Security.TokenFile, "/tmp/neocode-auth.json") + } + }) + + t.Run("invalid gateway section returns error", func(t *testing.T) { + t.Parallel() + + baseDir := t.TempDir() + configPath := filepath.Join(baseDir, configName) + content := ` +selected_provider: openai +current_model: gpt-5.4 +shell: bash +gateway: + limits: + max_frame_bytes: 0 +` + if err := os.WriteFile(configPath, []byte(strings.TrimSpace(content)+"\n"), 0o644); err != nil { + t.Fatalf("write config: %v", err) + } + + cfg, err := LoadGatewayConfig(context.Background(), baseDir) + if err != nil { + t.Fatalf("load gateway config: %v", err) + } + if cfg.Limits.MaxFrameBytes != DefaultGatewayMaxFrameBytes { + t.Fatalf("max_frame_bytes = %d, want fallback %d", cfg.Limits.MaxFrameBytes, DefaultGatewayMaxFrameBytes) + } + }) +} diff --git a/internal/config/loader.go b/internal/config/loader.go index 5e35c3a6..976f923f 100644 --- a/internal/config/loader.go +++ b/internal/config/loader.go @@ -30,6 +30,7 @@ type persistedConfig struct { Context persistedContextConfig `yaml:"context,omitempty"` Tools ToolsConfig `yaml:"tools,omitempty"` Memo persistedMemoConfig `yaml:"memo,omitempty"` + Gateway GatewayConfig `yaml:"gateway,omitempty"` } type persistedContextConfig struct { @@ -211,6 +212,7 @@ func parseCurrentConfig(data []byte, contextDefaults ContextConfig, memoDefaults Context: fromPersistedContextConfig(file.Context, contextDefaults), Tools: file.Tools, Memo: fromPersistedMemoConfig(file.Memo, memoDefaults), + Gateway: file.Gateway, } return cfg, nil @@ -226,6 +228,7 @@ func marshalPersistedConfig(snapshot Config) ([]byte, error) { Context: newPersistedContextConfig(snapshot.Context), Tools: snapshot.Tools, Memo: newPersistedMemoConfig(snapshot.Memo), + Gateway: snapshot.Gateway, } data, err := yaml.Marshal(&file) diff --git a/internal/gateway/build_info.go b/internal/gateway/build_info.go new file mode 100644 index 00000000..48992920 --- /dev/null +++ b/internal/gateway/build_info.go @@ -0,0 +1,22 @@ +package gateway + +import "strings" + +var ( + // GatewayVersion 表示网关构建版本，可通过 -ldflags 覆盖。 + GatewayVersion = "dev" + // GatewayCommit 表示网关构建提交号，可通过 -ldflags 覆盖。 + GatewayCommit = "unknown" + // GatewayBuildTime 表示网关构建时间，可通过 -ldflags 覆盖。 + GatewayBuildTime = "" +) + +// ResolvedBuildInfo 返回归一化后的网关构建信息。 +func ResolvedBuildInfo() map[string]string { + buildTime := strings.TrimSpace(GatewayBuildTime) + return map[string]string{ + "version": strings.TrimSpace(GatewayVersion), + "commit": strings.TrimSpace(GatewayCommit), + "build_time": buildTime, + } +} diff --git a/internal/gateway/errors.go b/internal/gateway/errors.go index c5e72aba..a7fabedf 100644 --- a/internal/gateway/errors.go +++ b/internal/gateway/errors.go @@ -10,7 +10,7 @@ const ( ErrorCodeInvalidFrame ErrorCode = "invalid_frame" // ErrorCodeInvalidAction 表示动作值非法。 ErrorCodeInvalidAction ErrorCode = "invalid_action" - // ErrorCodeInvalidMultimodalPayload 表示多模态输入负载非法。 + // ErrorCodeInvalidMultimodalPayload 表示多模态输入载荷非法。 ErrorCodeInvalidMultimodalPayload ErrorCode = "invalid_multimodal_payload" // ErrorCodeMissingRequiredField 表示缺少必填字段。 ErrorCodeMissingRequiredField ErrorCode = "missing_required_field" @@ -18,6 +18,10 @@ const ( ErrorCodeUnsupportedAction ErrorCode = "unsupported_action" // ErrorCodeInternalError 表示网关内部错误。 ErrorCodeInternalError ErrorCode = "internal_error" + // ErrorCodeUnauthorized 表示请求未通过认证校验。 + ErrorCodeUnauthorized ErrorCode = "unauthorized" + // ErrorCodeAccessDenied 表示请求已认证但未通过 ACL 校验。 + ErrorCodeAccessDenied ErrorCode = "access_denied" ) var stableErrorCodes = map[string]struct{}{ @@ -27,6 +31,8 @@ var stableErrorCodes = map[string]struct{}{ string(ErrorCodeMissingRequiredField): {}, string(ErrorCodeUnsupportedAction): {}, string(ErrorCodeInternalError): {}, + string(ErrorCodeUnauthorized): {}, + string(ErrorCodeAccessDenied): {}, } // String 返回错误码的字符串值。 diff --git a/internal/gateway/errors_test.go b/internal/gateway/errors_test.go index 1c07cc5d..b81938ac 100644 --- a/internal/gateway/errors_test.go +++ b/internal/gateway/errors_test.go @@ -10,6 +10,8 @@ func TestStableErrorCodes(t *testing.T) { ErrorCodeMissingRequiredField, ErrorCodeUnsupportedAction, ErrorCodeInternalError, + ErrorCodeUnauthorized, + ErrorCodeAccessDenied, } for _, code := range codes { diff --git a/internal/gateway/metrics.go b/internal/gateway/metrics.go new file mode 100644 index 00000000..14d3b3c8 --- /dev/null +++ b/internal/gateway/metrics.go @@ -0,0 +1,197 @@ +package gateway + +import ( + "strings" + "sync" + + "github.com/prometheus/client_golang/prometheus" +) + +// GatewayMetrics 维护网关关键指标，并同时提供 Prometheus 与 JSON 视图。 +type GatewayMetrics struct { + registry *prometheus.Registry + + requestsTotal *prometheus.CounterVec + authFailuresTotal *prometheus.CounterVec + aclDeniedTotal *prometheus.CounterVec + connectionsActive *prometheus.GaugeVec + streamDropped *prometheus.CounterVec + + mu sync.RWMutex + snapshot map[string]map[string]float64 +} + +// NewGatewayMetrics 创建网关指标收集器。 +func NewGatewayMetrics() *GatewayMetrics { + requestsTotal := prometheus.NewCounterVec( + prometheus.CounterOpts{ + Name: "gateway_requests_total", + Help: "Total gateway rpc requests grouped by source, method and status.", + }, + []string{"source", "method", "status"}, + ) + authFailuresTotal := prometheus.NewCounterVec( + prometheus.CounterOpts{ + Name: "gateway_auth_failures_total", + Help: "Total gateway auth failures grouped by source and reason.", + }, + []string{"source", "reason"}, + ) + aclDeniedTotal := prometheus.NewCounterVec( + prometheus.CounterOpts{ + Name: "gateway_acl_denied_total", + Help: "Total gateway ACL denials grouped by source and method.", + }, + []string{"source", "method"}, + ) + connectionsActive := prometheus.NewGaugeVec( + prometheus.GaugeOpts{ + Name: "gateway_connections_active", + Help: "Current active stream connections grouped by channel.", + }, + []string{"channel"}, + ) + streamDropped := prometheus.NewCounterVec( + prometheus.CounterOpts{ + Name: "gateway_stream_dropped_total", + Help: "Total dropped stream connections grouped by reason.", + }, + []string{"reason"}, + ) + + registry := prometheus.NewRegistry() + registry.MustRegister( + requestsTotal, + authFailuresTotal, + aclDeniedTotal, + connectionsActive, + streamDropped, + ) + + return &GatewayMetrics{ + registry: registry, + requestsTotal: requestsTotal, + authFailuresTotal: authFailuresTotal, + aclDeniedTotal: aclDeniedTotal, + connectionsActive: connectionsActive, + streamDropped: streamDropped, + snapshot: map[string]map[string]float64{ + "gateway_requests_total": {}, + "gateway_auth_failures_total": {}, + "gateway_acl_denied_total": {}, + "gateway_connections_active": {}, + "gateway_stream_dropped_total": {}, + }, + } +} + +// Registry 返回 Prometheus 注册表。 +func (m *GatewayMetrics) Registry() *prometheus.Registry { + if m == nil { + return nil + } + return m.registry +} + +// Snapshot 返回用于 /metrics.json 的指标快照。 +func (m *GatewayMetrics) Snapshot() map[string]map[string]float64 { + if m == nil { + return map[string]map[string]float64{} + } + m.mu.RLock() + defer m.mu.RUnlock() + + cloned := make(map[string]map[string]float64, len(m.snapshot)) + for name, values := range m.snapshot { + clonedValues := make(map[string]float64, len(values)) + for key, value := range values { + clonedValues[key] = value + } + cloned[name] = clonedValues + } + return cloned +} + +// IncRequests 增加请求总量计数。 +func (m *GatewayMetrics) IncRequests(source, method, status string) { + if m == nil { + return + } + source = normalizeMetricLabel(source) + method = normalizeMetricLabel(method) + status = normalizeMetricLabel(status) + m.requestsTotal.WithLabelValues(source, method, status).Inc() + m.addSnapshotCounter("gateway_requests_total", source+"|"+method+"|"+status, 1) +} + +// IncAuthFailures 增加认证失败计数。 +func (m *GatewayMetrics) IncAuthFailures(source, reason string) { + if m == nil { + return + } + source = normalizeMetricLabel(source) + reason = normalizeMetricLabel(reason) + m.authFailuresTotal.WithLabelValues(source, reason).Inc() + m.addSnapshotCounter("gateway_auth_failures_total", source+"|"+reason, 1) +} + +// IncACLDenied 增加 ACL 拒绝计数。 +func (m *GatewayMetrics) IncACLDenied(source, method string) { + if m == nil { + return + } + source = normalizeMetricLabel(source) + method = normalizeMetricLabel(method) + m.aclDeniedTotal.WithLabelValues(source, method).Inc() + m.addSnapshotCounter("gateway_acl_denied_total", source+"|"+method, 1) +} + +// SetConnectionsActive 更新当前连接数指标。 +func (m *GatewayMetrics) SetConnectionsActive(channel string, value int) { + if m == nil { + return + } + channel = normalizeMetricLabel(channel) + m.connectionsActive.WithLabelValues(channel).Set(float64(value)) + m.setSnapshotGauge("gateway_connections_active", channel, float64(value)) +} + +// IncStreamDropped 增加流连接剔除计数。 +func (m *GatewayMetrics) IncStreamDropped(reason string) { + if m == nil { + return + } + reason = normalizeMetricLabel(reason) + m.streamDropped.WithLabelValues(reason).Inc() + m.addSnapshotCounter("gateway_stream_dropped_total", reason, 1) +} + +func (m *GatewayMetrics) addSnapshotCounter(metricName, key string, delta float64) { + m.mu.Lock() + defer m.mu.Unlock() + metric := m.snapshot[metricName] + if metric == nil { + metric = map[string]float64{} + m.snapshot[metricName] = metric + } + metric[key] += delta +} + +func (m *GatewayMetrics) setSnapshotGauge(metricName, key string, value float64) { + m.mu.Lock() + defer m.mu.Unlock() + metric := m.snapshot[metricName] + if metric == nil { + metric = map[string]float64{} + m.snapshot[metricName] = metric + } + metric[key] = value +} + +func normalizeMetricLabel(value string) string { + normalized := strings.TrimSpace(strings.ToLower(value)) + if normalized == "" { + return "unknown" + } + return normalized +} diff --git a/internal/gateway/metrics_test.go b/internal/gateway/metrics_test.go new file mode 100644 index 00000000..7d26825c --- /dev/null +++ b/internal/gateway/metrics_test.go @@ -0,0 +1,29 @@ +package gateway + +import "testing" + +func TestGatewayMetricsSnapshot(t *testing.T) { + metrics := NewGatewayMetrics() + metrics.IncRequests("ipc", "gateway.ping", "ok") + metrics.IncAuthFailures("ws", "unauthorized") + metrics.IncACLDenied("http", "wake.openUrl") + metrics.SetConnectionsActive("ws", 2) + metrics.IncStreamDropped("queue_full") + + snapshot := metrics.Snapshot() + if snapshot["gateway_requests_total"]["ipc|gateway.ping|ok"] != 1 { + t.Fatalf("requests snapshot mismatch: %#v", snapshot["gateway_requests_total"]) + } + if snapshot["gateway_auth_failures_total"]["ws|unauthorized"] != 1 { + t.Fatalf("auth failures snapshot mismatch: %#v", snapshot["gateway_auth_failures_total"]) + } + if snapshot["gateway_acl_denied_total"]["http|wake.openurl"] != 1 { + t.Fatalf("acl denied snapshot mismatch: %#v", snapshot["gateway_acl_denied_total"]) + } + if snapshot["gateway_connections_active"]["ws"] != 2 { + t.Fatalf("connections gauge snapshot mismatch: %#v", snapshot["gateway_connections_active"]) + } + if snapshot["gateway_stream_dropped_total"]["queue_full"] != 1 { + t.Fatalf("stream dropped snapshot mismatch: %#v", snapshot["gateway_stream_dropped_total"]) + } +} diff --git a/internal/gateway/types.go b/internal/gateway/types.go index c2e3e43a..81620e8f 100644 --- a/internal/gateway/types.go +++ b/internal/gateway/types.go @@ -18,6 +18,8 @@ const ( type FrameAction string const ( + // FrameActionAuthenticate 表示连接级认证动作。 + FrameActionAuthenticate FrameAction = "authenticate" // FrameActionPing 表示探活动作，用于验证网关可用性。 FrameActionPing FrameAction = "ping" // FrameActionBindStream 表示声明流式事件订阅绑定。 From 5c3fd704886dd9e7c56107903ee781fbc4b09561 Mon Sep 17 00:00:00 2001 From: pionxe Date: Thu, 16 Apr 2026 23:38:07 +0800 Subject: [PATCH 02/12] =?UTF-8?q?feat(gateway):=20[EPIC-GW-06]=20=E5=AE=9E?= =?UTF-8?q?=E7=8E=B0=20Default=20Deny=20=E6=8E=A7=E5=88=B6=E9=9D=A2=20ACL?= =?UTF-8?q?=20=E4=B8=8E=E9=9D=99=E9=BB=98=E8=AE=A4=E8=AF=81=E6=9C=BA?= =?UTF-8?q?=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 打造本地安全防护盾： 1. 静默认证 (Silent Auth)：系统启动时自动生成高强度 Token 写入 ~/.neocode/auth.json，为 CLI/TUI 提供免密凭证。 2. 权限硬化：针对 Windows/Unix 平台分别实现了极其严格的凭证文件权限收紧 (仅当前用户及 SYSTEM 可读)。 3. ACL 引擎：落地“最小权限默认拒绝”策略，基于请求的 Source 和 Method 实施严格的访问控制。 4. 审计追踪：注入标准的 request_id 与 session_id，实现结构化安全审计日志。 --- internal/gateway/auth/manager.go | 212 +++++++++++++++++++ internal/gateway/auth/manager_test.go | 190 +++++++++++++++++ internal/gateway/auth/permissions_unix.go | 24 +++ internal/gateway/auth/permissions_windows.go | 129 +++++++++++ internal/gateway/request_context.go | 183 ++++++++++++++++ internal/gateway/request_context_test.go | 66 ++++++ internal/gateway/request_logging.go | 68 ++++++ internal/gateway/security.go | 115 ++++++++++ internal/gateway/security_test.go | 37 ++++ 9 files changed, 1024 insertions(+) create mode 100644 internal/gateway/auth/manager.go create mode 100644 internal/gateway/auth/manager_test.go create mode 100644 internal/gateway/auth/permissions_unix.go create mode 100644 internal/gateway/auth/permissions_windows.go create mode 100644 internal/gateway/request_context.go create mode 100644 internal/gateway/request_context_test.go create mode 100644 internal/gateway/request_logging.go create mode 100644 internal/gateway/security.go create mode 100644 internal/gateway/security_test.go diff --git a/internal/gateway/auth/manager.go b/internal/gateway/auth/manager.go new file mode 100644 index 00000000..7492c5b0 --- /dev/null +++ b/internal/gateway/auth/manager.go @@ -0,0 +1,212 @@ +package auth + +import ( + "crypto/rand" + "encoding/base64" + "encoding/json" + "fmt" + "os" + "path/filepath" + "strings" + "time" +) + +const ( + // DefaultAuthRelativePath 定义默认凭证文件相对路径。 + DefaultAuthRelativePath = ".neocode/auth.json" + // credentialSchemaVersion 定义凭证文件结构版本号。 + credentialSchemaVersion = 1 + // tokenRandomByteLength 定义静默认证 Token 的随机字节长度。 + tokenRandomByteLength = 32 +) + +const ( + authDirPerm = 0o700 + authFilePerm = 0o600 +) + +// Credentials 表示持久化在磁盘上的认证凭证结构。 +type Credentials struct { + Version int `json:"version"` + Token string `json:"token"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + +// Manager 负责加载或生成本地静默认证 Token，并提供校验能力。 +type Manager struct { + path string + credentials Credentials +} + +// NewManager 创建并初始化认证管理器；若凭证文件不存在或无效则自动重建。 +func NewManager(path string) (*Manager, error) { + resolvedPath, err := resolveAuthPath(path) + if err != nil { + return nil, err + } + + manager := &Manager{ + path: resolvedPath, + } + if loadErr := manager.loadOrCreate(); loadErr != nil { + return nil, loadErr + } + return manager, nil +} + +// Path 返回认证凭证文件路径。 +func (m *Manager) Path() string { + if m == nil { + return "" + } + return m.path +} + +// Token 返回当前有效 Token。 +func (m *Manager) Token() string { + if m == nil { + return "" + } + return strings.TrimSpace(m.credentials.Token) +} + +// ValidateToken 校验输入 Token 是否与本地凭证一致。 +func (m *Manager) ValidateToken(token string) bool { + if m == nil { + return false + } + return strings.TrimSpace(token) != "" && strings.TrimSpace(token) == strings.TrimSpace(m.credentials.Token) +} + +// LoadTokenFromFile 从指定路径读取静默认证 Token。 +func LoadTokenFromFile(path string) (string, error) { + resolvedPath, err := resolveAuthPath(path) + if err != nil { + return "", err + } + credentials, err := readCredentials(resolvedPath) + if err != nil { + return "", err + } + token := strings.TrimSpace(credentials.Token) + if token == "" { + return "", fmt.Errorf("gateway auth: token is empty in %s", resolvedPath) + } + return token, nil +} + +// DefaultAuthPath 返回默认认证文件路径。 +func DefaultAuthPath() (string, error) { + return resolveAuthPath("") +} + +// loadOrCreate 加载现有凭证，若不存在或内容无效则自动重建。 +func (m *Manager) loadOrCreate() error { + if m == nil { + return fmt.Errorf("gateway auth: manager is nil") + } + + if err := ensureAuthDir(filepath.Dir(m.path)); err != nil { + return err + } + + credentials, readErr := readCredentials(m.path) + if readErr == nil && isValidCredentials(credentials) { + m.credentials = credentials + return nil + } + + createdCredentials, createErr := buildCredentials(time.Now().UTC()) + if createErr != nil { + return createErr + } + if writeErr := writeCredentials(m.path, createdCredentials); writeErr != nil { + return writeErr + } + m.credentials = createdCredentials + return nil +} + +// resolveAuthPath 解析认证文件路径并清理空白。 +func resolveAuthPath(path string) (string, error) { + trimmed := strings.TrimSpace(path) + if trimmed != "" { + return filepath.Clean(trimmed), nil + } + + homeDir, err := os.UserHomeDir() + if err != nil { + return "", fmt.Errorf("gateway auth: resolve user home dir: %w", err) + } + return filepath.Join(homeDir, DefaultAuthRelativePath), nil +} + +// ensureAuthDir 确保认证目录存在并在 Unix 上收紧目录权限。 +func ensureAuthDir(dir string) error { + if err := os.MkdirAll(dir, authDirPerm); err != nil { + return fmt.Errorf("gateway auth: create auth dir: %w", err) + } + if err := applyAuthDirPermission(dir); err != nil { + return err + } + return nil +} + +// readCredentials 读取并解析认证凭证文件。 +func readCredentials(path string) (Credentials, error) { + raw, err := os.ReadFile(path) + if err != nil { + return Credentials{}, fmt.Errorf("gateway auth: read auth file: %w", err) + } + + var credentials Credentials + if err := json.Unmarshal(raw, &credentials); err != nil { + return Credentials{}, fmt.Errorf("gateway auth: decode auth file: %w", err) + } + return credentials, nil +} + +// buildCredentials 生成新的认证凭证结构。 +func buildCredentials(now time.Time) (Credentials, error) { + token, err := generateToken() + if err != nil { + return Credentials{}, err + } + return Credentials{ + Version: credentialSchemaVersion, + Token: token, + CreatedAt: now, + UpdatedAt: now, + }, nil +} + +// generateToken 生成高强度随机 Token。 +func generateToken() (string, error) { + seed := make([]byte, tokenRandomByteLength) + if _, err := rand.Read(seed); err != nil { + return "", fmt.Errorf("gateway auth: generate token: %w", err) + } + return base64.RawURLEncoding.EncodeToString(seed), nil +} + +// writeCredentials 持久化凭证文件并在 Unix 上收紧文件权限。 +func writeCredentials(path string, credentials Credentials) error { + raw, err := json.MarshalIndent(credentials, "", " ") + if err != nil { + return fmt.Errorf("gateway auth: encode credentials: %w", err) + } + raw = append(raw, '\n') + if err := os.WriteFile(path, raw, authFilePerm); err != nil { + return fmt.Errorf("gateway auth: write auth file: %w", err) + } + if err := applyAuthFilePermission(path); err != nil { + return err + } + return nil +} + +// isValidCredentials 判断凭证内容是否完整可用。 +func isValidCredentials(credentials Credentials) bool { + return credentials.Version >= credentialSchemaVersion && strings.TrimSpace(credentials.Token) != "" +} diff --git a/internal/gateway/auth/manager_test.go b/internal/gateway/auth/manager_test.go new file mode 100644 index 00000000..967ad029 --- /dev/null +++ b/internal/gateway/auth/manager_test.go @@ -0,0 +1,190 @@ +package auth + +import ( + "encoding/json" + "os" + "path/filepath" + "runtime" + "strings" + "testing" + "time" +) + +func TestNewManagerCreatesCredentialFile(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + + manager, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager: %v", err) + } + if manager.Token() == "" { + t.Fatal("token should not be empty") + } + + info, err := os.Stat(credentialPath) + if err != nil { + t.Fatalf("stat auth file: %v", err) + } + if runtime.GOOS != "windows" && info.Mode().Perm() != authFilePerm { + t.Fatalf("file perm = %o, want %o", info.Mode().Perm(), authFilePerm) + } +} + +func TestNewManagerReusesValidCredential(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + first, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("first manager: %v", err) + } + + second, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("second manager: %v", err) + } + if second.Token() != first.Token() { + t.Fatalf("token mismatch: %q != %q", second.Token(), first.Token()) + } +} + +func TestNewManagerRecoversInvalidCredential(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + if err := os.WriteFile(credentialPath, []byte(`{"version":1,"token":""}`), 0o600); err != nil { + t.Fatalf("write invalid auth file: %v", err) + } + + manager, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager: %v", err) + } + if manager.Token() == "" { + t.Fatal("recovered token should not be empty") + } +} + +func TestLoadTokenFromFile(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + manager, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager: %v", err) + } + + token, err := LoadTokenFromFile(credentialPath) + if err != nil { + t.Fatalf("load token: %v", err) + } + if token != manager.Token() { + t.Fatalf("token = %q, want %q", token, manager.Token()) + } +} + +func TestLoadTokenFromFileInvalidJSON(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + if err := os.WriteFile(credentialPath, []byte("{bad-json"), 0o600); err != nil { + t.Fatalf("write auth file: %v", err) + } + + if _, err := LoadTokenFromFile(credentialPath); err == nil { + t.Fatal("expected parse error") + } +} + +func TestValidateToken(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + manager, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager: %v", err) + } + + if !manager.ValidateToken(manager.Token()) { + t.Fatal("expected valid token") + } + if manager.ValidateToken("wrong-token") { + t.Fatal("expected invalid token") + } +} + +func TestCredentialFileSchema(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + _, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager: %v", err) + } + + raw, err := os.ReadFile(credentialPath) + if err != nil { + t.Fatalf("read auth file: %v", err) + } + var credentials map[string]any + if err := json.Unmarshal(raw, &credentials); err != nil { + t.Fatalf("decode auth file: %v", err) + } + for _, key := range []string{"version", "token", "created_at", "updated_at"} { + if _, exists := credentials[key]; !exists { + t.Fatalf("missing key %q", key) + } + } +} + +func TestManagerNilReceiverHelpers(t *testing.T) { + var manager *Manager + if manager.Path() != "" { + t.Fatalf("nil manager path = %q, want empty", manager.Path()) + } + if manager.Token() != "" { + t.Fatalf("nil manager token = %q, want empty", manager.Token()) + } + if manager.ValidateToken("any") { + t.Fatal("nil manager should reject all tokens") + } +} + +func TestResolveAuthPathAndEnsureDirError(t *testing.T) { + customPath := filepath.Join(t.TempDir(), "custom-auth.json") + resolvedCustomPath, err := resolveAuthPath(customPath) + if err != nil { + t.Fatalf("resolve custom path: %v", err) + } + if resolvedCustomPath != filepath.Clean(customPath) { + t.Fatalf("resolved custom path = %q, want %q", resolvedCustomPath, filepath.Clean(customPath)) + } + + baseDir := t.TempDir() + notDirectoryPath := filepath.Join(baseDir, "not-dir") + if err := os.WriteFile(notDirectoryPath, []byte("x"), 0o644); err != nil { + t.Fatalf("write not-dir file: %v", err) + } + if _, err := NewManager(filepath.Join(notDirectoryPath, "auth.json")); err == nil { + t.Fatal("expected create dir error") + } +} + +func TestLoadTokenFromFileEmptyToken(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + if err := os.WriteFile(credentialPath, []byte(`{"version":1,"token":""}`), 0o600); err != nil { + t.Fatalf("write auth file: %v", err) + } + + _, err := LoadTokenFromFile(credentialPath) + if err == nil || !strings.Contains(err.Error(), "token is empty") { + t.Fatalf("expected empty token error, got %v", err) + } +} + +func TestBuildCredentialsAndValidation(t *testing.T) { + credentials, err := buildCredentials(time.Now().UTC()) + if err != nil { + t.Fatalf("build credentials: %v", err) + } + if credentials.Token == "" { + t.Fatal("token should not be empty") + } + if !isValidCredentials(credentials) { + t.Fatal("generated credentials should be valid") + } + if isValidCredentials(Credentials{Version: 0, Token: "abc"}) { + t.Fatal("version below schema should be invalid") + } + if isValidCredentials(Credentials{Version: 1, Token: " "}) { + t.Fatal("blank token should be invalid") + } +} diff --git a/internal/gateway/auth/permissions_unix.go b/internal/gateway/auth/permissions_unix.go new file mode 100644 index 00000000..d163aaa0 --- /dev/null +++ b/internal/gateway/auth/permissions_unix.go @@ -0,0 +1,24 @@ +//go:build !windows + +package auth + +import ( + "fmt" + "os" +) + +// applyAuthDirPermission 在非 Windows 平台收紧凭证目录权限为 0700。 +func applyAuthDirPermission(dir string) error { + if err := os.Chmod(dir, authDirPerm); err != nil { + return fmt.Errorf("gateway auth: set auth dir permission: %w", err) + } + return nil +} + +// applyAuthFilePermission 在非 Windows 平台收紧凭证文件权限为 0600。 +func applyAuthFilePermission(path string) error { + if err := os.Chmod(path, authFilePerm); err != nil { + return fmt.Errorf("gateway auth: set auth file permission: %w", err) + } + return nil +} diff --git a/internal/gateway/auth/permissions_windows.go b/internal/gateway/auth/permissions_windows.go new file mode 100644 index 00000000..57aa8264 --- /dev/null +++ b/internal/gateway/auth/permissions_windows.go @@ -0,0 +1,129 @@ +//go:build windows + +package auth + +import ( + "fmt" + "strings" + + "golang.org/x/sys/windows" +) + +const ( + authSDDLDiscretionaryACL = "D:P" +) + +// applyAuthDirPermission 在 Windows 平台将凭证目录 ACL 收紧为 SYSTEM/Administrators/当前用户可访问。 +func applyAuthDirPermission(dir string) error { + return applyRestrictedACL(dir, true) +} + +// applyAuthFilePermission 在 Windows 平台将凭证文件 ACL 收紧为 SYSTEM/Administrators/当前用户可访问。 +func applyAuthFilePermission(path string) error { + return applyRestrictedACL(path, false) +} + +// applyRestrictedACL 根据对象类型写入最小化 ACL，避免凭证被其他本地用户读取。 +func applyRestrictedACL(path string, isDir bool) error { + securityDescriptor, err := buildAuthSecurityDescriptor(isDir) + if err != nil { + return err + } + + dacl, _, err := securityDescriptor.DACL() + if err != nil { + return fmt.Errorf("gateway auth: parse dacl: %w", err) + } + owner, _, err := securityDescriptor.Owner() + if err != nil { + return fmt.Errorf("gateway auth: parse owner sid: %w", err) + } + group, _, err := securityDescriptor.Group() + if err != nil { + return fmt.Errorf("gateway auth: parse group sid: %w", err) + } + + securityInfo := windows.SECURITY_INFORMATION(windows.DACL_SECURITY_INFORMATION) + if owner != nil { + securityInfo |= windows.OWNER_SECURITY_INFORMATION + } + if group != nil { + securityInfo |= windows.GROUP_SECURITY_INFORMATION + } + + trimmedPath := strings.TrimSpace(path) + if trimmedPath == "" { + return fmt.Errorf("gateway auth: apply acl path is empty") + } + if err := windows.SetNamedSecurityInfo(trimmedPath, windows.SE_FILE_OBJECT, securityInfo, owner, group, dacl, nil); err != nil { + return fmt.Errorf("gateway auth: apply acl: %w", err) + } + return nil +} + +// buildAuthSecurityDescriptor 生成用于凭证目录/文件的最小权限安全描述符。 +func buildAuthSecurityDescriptor(isDir bool) (*windows.SECURITY_DESCRIPTOR, error) { + currentUserSID, err := currentProcessUserSID() + if err != nil { + return nil, err + } + + systemSID, err := wellKnownSIDString(windows.WinLocalSystemSid) + if err != nil { + return nil, fmt.Errorf("gateway auth: resolve local-system sid: %w", err) + } + administratorsSID, err := wellKnownSIDString(windows.WinBuiltinAdministratorsSid) + if err != nil { + return nil, fmt.Errorf("gateway auth: resolve administrators sid: %w", err) + } + + allowAccessAce := allowGenericAllAce + if isDir { + allowAccessAce = allowGenericAllInheritedAce + } + + sddl := fmt.Sprintf( + "%s(%s)(%s)(%s)", + authSDDLDiscretionaryACL, + allowAccessAce(systemSID), + allowAccessAce(administratorsSID), + allowAccessAce(currentUserSID), + ) + + securityDescriptor, err := windows.SecurityDescriptorFromString(sddl) + if err != nil { + return nil, fmt.Errorf("gateway auth: parse security descriptor: %w", err) + } + return securityDescriptor, nil +} + +// currentProcessUserSID 返回当前进程所属用户的 SID。 +func currentProcessUserSID() (string, error) { + tokenUser, err := windows.GetCurrentProcessToken().GetTokenUser() + if err != nil { + return "", fmt.Errorf("gateway auth: query current token user: %w", err) + } + if tokenUser == nil || tokenUser.User.Sid == nil { + return "", fmt.Errorf("gateway auth: current token user sid is empty") + } + return tokenUser.User.Sid.String(), nil +} + +// wellKnownSIDString 将系统内置 SID 类型转换为 SID 字符串。 +func wellKnownSIDString(sidType windows.WELL_KNOWN_SID_TYPE) (string, error) { + sid, err := windows.CreateWellKnownSid(sidType) + if err != nil { + return "", err + } + return sid.String(), nil +} + +// allowGenericAllAce 生成单个 SID 的“完全控制”ACE。 +func allowGenericAllAce(sid string) string { + return fmt.Sprintf("A;;GA;;;%s", sid) +} + +// allowGenericAllInheritedAce 生成带继承标记的“完全控制”ACE（用于目录）。 +func allowGenericAllInheritedAce(sid string) string { + return fmt.Sprintf("A;OICI;GA;;;%s", sid) +} diff --git a/internal/gateway/request_context.go b/internal/gateway/request_context.go new file mode 100644 index 00000000..d35fb835 --- /dev/null +++ b/internal/gateway/request_context.go @@ -0,0 +1,183 @@ +package gateway + +import ( + "context" + "log" + "strings" + "sync" +) + +type requestSourceContextKey struct{} +type requestTokenContextKey struct{} +type connectionAuthStateContextKey struct{} +type tokenAuthenticatorContextKey struct{} +type requestACLContextKey struct{} +type gatewayMetricsContextKey struct{} +type gatewayLoggerContextKey struct{} + +// ConnectionAuthState 表示单连接复用的认证状态。 +type ConnectionAuthState struct { + mu sync.RWMutex + authenticated bool +} + +// NewConnectionAuthState 创建连接认证状态对象。 +func NewConnectionAuthState() *ConnectionAuthState { + return &ConnectionAuthState{} +} + +// MarkAuthenticated 将当前连接标记为已认证。 +func (s *ConnectionAuthState) MarkAuthenticated() { + if s == nil { + return + } + s.mu.Lock() + s.authenticated = true + s.mu.Unlock() +} + +// IsAuthenticated 返回当前连接认证状态。 +func (s *ConnectionAuthState) IsAuthenticated() bool { + if s == nil { + return false + } + s.mu.RLock() + defer s.mu.RUnlock() + return s.authenticated +} + +// WithRequestSource 向上下文写入请求来源。 +func WithRequestSource(ctx context.Context, source RequestSource) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, requestSourceContextKey{}, NormalizeRequestSource(source)) +} + +// RequestSourceFromContext 从上下文读取请求来源。 +func RequestSourceFromContext(ctx context.Context) RequestSource { + if ctx == nil { + return RequestSourceUnknown + } + if source, ok := ctx.Value(requestSourceContextKey{}).(RequestSource); ok { + return NormalizeRequestSource(source) + } + return RequestSourceUnknown +} + +// WithRequestToken 向上下文写入单请求 Token。 +func WithRequestToken(ctx context.Context, token string) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, requestTokenContextKey{}, strings.TrimSpace(token)) +} + +// RequestTokenFromContext 从上下文读取单请求 Token。 +func RequestTokenFromContext(ctx context.Context) string { + if ctx == nil { + return "" + } + token, _ := ctx.Value(requestTokenContextKey{}).(string) + return strings.TrimSpace(token) +} + +// WithConnectionAuthState 向上下文写入连接认证状态。 +func WithConnectionAuthState(ctx context.Context, state *ConnectionAuthState) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, connectionAuthStateContextKey{}, state) +} + +// ConnectionAuthStateFromContext 从上下文读取连接认证状态。 +func ConnectionAuthStateFromContext(ctx context.Context) (*ConnectionAuthState, bool) { + if ctx == nil { + return nil, false + } + state, ok := ctx.Value(connectionAuthStateContextKey{}).(*ConnectionAuthState) + if !ok || state == nil { + return nil, false + } + return state, true +} + +// WithTokenAuthenticator 向上下文写入 Token 校验器。 +func WithTokenAuthenticator(ctx context.Context, authenticator TokenAuthenticator) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, tokenAuthenticatorContextKey{}, authenticator) +} + +// TokenAuthenticatorFromContext 从上下文读取 Token 校验器。 +func TokenAuthenticatorFromContext(ctx context.Context) (TokenAuthenticator, bool) { + if ctx == nil { + return nil, false + } + authenticator, ok := ctx.Value(tokenAuthenticatorContextKey{}).(TokenAuthenticator) + if !ok || authenticator == nil { + return nil, false + } + return authenticator, true +} + +// WithRequestACL 向上下文写入 ACL 实例。 +func WithRequestACL(ctx context.Context, acl *ControlPlaneACL) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, requestACLContextKey{}, acl) +} + +// RequestACLFromContext 从上下文读取 ACL。 +func RequestACLFromContext(ctx context.Context) (*ControlPlaneACL, bool) { + if ctx == nil { + return nil, false + } + acl, ok := ctx.Value(requestACLContextKey{}).(*ControlPlaneACL) + if !ok || acl == nil { + return nil, false + } + return acl, true +} + +// WithGatewayMetrics 向上下文写入网关指标收集器。 +func WithGatewayMetrics(ctx context.Context, metrics *GatewayMetrics) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, gatewayMetricsContextKey{}, metrics) +} + +// GatewayMetricsFromContext 从上下文读取网关指标收集器。 +func GatewayMetricsFromContext(ctx context.Context) (*GatewayMetrics, bool) { + if ctx == nil { + return nil, false + } + metrics, ok := ctx.Value(gatewayMetricsContextKey{}).(*GatewayMetrics) + if !ok || metrics == nil { + return nil, false + } + return metrics, true +} + +// WithGatewayLogger 向上下文写入结构化日志使用的 logger。 +func WithGatewayLogger(ctx context.Context, logger *log.Logger) context.Context { + if ctx == nil { + ctx = context.Background() + } + return context.WithValue(ctx, gatewayLoggerContextKey{}, logger) +} + +// GatewayLoggerFromContext 从上下文读取 logger。 +func GatewayLoggerFromContext(ctx context.Context) (*log.Logger, bool) { + if ctx == nil { + return nil, false + } + logger, ok := ctx.Value(gatewayLoggerContextKey{}).(*log.Logger) + if !ok || logger == nil { + return nil, false + } + return logger, true +} diff --git a/internal/gateway/request_context_test.go b/internal/gateway/request_context_test.go new file mode 100644 index 00000000..32b90172 --- /dev/null +++ b/internal/gateway/request_context_test.go @@ -0,0 +1,66 @@ +package gateway + +import ( + "context" + "log" + "os" + "testing" +) + +type stubTokenAuthenticator struct { + token string +} + +func (a stubTokenAuthenticator) ValidateToken(token string) bool { + return token == a.token +} + +func TestConnectionAuthState(t *testing.T) { + state := NewConnectionAuthState() + if state.IsAuthenticated() { + t.Fatal("new state should be unauthenticated") + } + state.MarkAuthenticated() + if !state.IsAuthenticated() { + t.Fatal("state should be authenticated") + } +} + +func TestRequestContextHelpers(t *testing.T) { + ctx := context.Background() + ctx = WithRequestSource(ctx, RequestSourceHTTP) + ctx = WithRequestToken(ctx, " token-1 ") + + state := NewConnectionAuthState() + ctx = WithConnectionAuthState(ctx, state) + + authenticator := stubTokenAuthenticator{token: "token-1"} + ctx = WithTokenAuthenticator(ctx, authenticator) + ctx = WithRequestACL(ctx, NewStrictControlPlaneACL()) + metrics := NewGatewayMetrics() + ctx = WithGatewayMetrics(ctx, metrics) + logger := log.New(os.Stderr, "", 0) + ctx = WithGatewayLogger(ctx, logger) + + if source := RequestSourceFromContext(ctx); source != RequestSourceHTTP { + t.Fatalf("source = %q, want %q", source, RequestSourceHTTP) + } + if token := RequestTokenFromContext(ctx); token != "token-1" { + t.Fatalf("token = %q, want %q", token, "token-1") + } + if loadedState, ok := ConnectionAuthStateFromContext(ctx); !ok || loadedState != state { + t.Fatal("expected to load connection auth state") + } + if loadedAuthenticator, ok := TokenAuthenticatorFromContext(ctx); !ok || !loadedAuthenticator.ValidateToken("token-1") { + t.Fatal("expected to load token authenticator") + } + if acl, ok := RequestACLFromContext(ctx); !ok || acl == nil { + t.Fatal("expected to load acl") + } + if loadedMetrics, ok := GatewayMetricsFromContext(ctx); !ok || loadedMetrics != metrics { + t.Fatal("expected to load metrics") + } + if loadedLogger, ok := GatewayLoggerFromContext(ctx); !ok || loadedLogger != logger { + t.Fatal("expected to load logger") + } +} diff --git a/internal/gateway/request_logging.go b/internal/gateway/request_logging.go new file mode 100644 index 00000000..b81f3a95 --- /dev/null +++ b/internal/gateway/request_logging.go @@ -0,0 +1,68 @@ +package gateway + +import ( + "context" + "encoding/json" + "log" + "strings" + "time" +) + +// RequestLogEntry 表示统一结构化请求日志字段。 +type RequestLogEntry struct { + RequestID string `json:"request_id"` + SessionID string `json:"session_id"` + Method string `json:"method"` + Source string `json:"source"` + Status string `json:"status"` + GatewayCode string `json:"gateway_code,omitempty"` + LatencyMS int64 `json:"latency_ms"` + ConnectionID string `json:"connection_id,omitempty"` + AuthState string `json:"auth_state,omitempty"` +} + +// emitRequestLog 输出网关结构化日志。 +func emitRequestLog(ctx context.Context, logger *log.Logger, entry RequestLogEntry) { + if logger == nil { + return + } + if entry.Source == "" { + entry.Source = string(RequestSourceFromContext(ctx)) + } + if entry.Source == "" { + entry.Source = string(RequestSourceUnknown) + } + if connectionID, ok := ConnectionIDFromContext(ctx); ok { + entry.ConnectionID = string(connectionID) + } + if authState, ok := ConnectionAuthStateFromContext(ctx); ok && authState.IsAuthenticated() { + entry.AuthState = "authenticated" + } else if _, ok := TokenAuthenticatorFromContext(ctx); ok { + entry.AuthState = "required" + } else { + entry.AuthState = "disabled" + } + entry.RequestID = strings.TrimSpace(entry.RequestID) + entry.SessionID = strings.TrimSpace(entry.SessionID) + entry.Method = strings.TrimSpace(entry.Method) + + raw, err := json.Marshal(entry) + if err != nil { + logger.Printf(`{"status":"error","message":"failed to encode request log"}`) + return + } + logger.Print(string(raw)) +} + +// requestStartTime 返回用于统计请求耗时的起始时间。 +func requestStartTime() time.Time { + return time.Now() +} + +// requestLatencyMS 返回请求耗时毫秒值。 +func requestLatencyMS(startedAt time.Time) int64 { + if startedAt.IsZero() { + return 0 + } + return time.Since(startedAt).Milliseconds() +} diff --git a/internal/gateway/security.go b/internal/gateway/security.go new file mode 100644 index 00000000..44d9916e --- /dev/null +++ b/internal/gateway/security.go @@ -0,0 +1,115 @@ +package gateway + +import ( + "strings" +) + +// RequestSource 表示控制面请求来源，用于 ACL 与日志分类。 +type RequestSource string + +const ( + // RequestSourceIPC 表示本地 IPC 来源。 + RequestSourceIPC RequestSource = "ipc" + // RequestSourceHTTP 表示 HTTP /rpc 来源。 + RequestSourceHTTP RequestSource = "http" + // RequestSourceWS 表示 WebSocket 来源。 + RequestSourceWS RequestSource = "ws" + // RequestSourceSSE 表示 SSE 来源。 + RequestSourceSSE RequestSource = "sse" + // RequestSourceUnknown 表示未知来源。 + RequestSourceUnknown RequestSource = "unknown" +) + +// ACLMode 表示控制面 ACL 的运行模式。 +type ACLMode string + +const ( + // ACLModeStrict 表示最小权限默认拒绝模式。 + ACLModeStrict ACLMode = "strict" +) + +// TokenAuthenticator 定义 Token 校验能力。 +type TokenAuthenticator interface { + ValidateToken(token string) bool +} + +// ControlPlaneACL 表示网关控制面方法级授权策略。 +type ControlPlaneACL struct { + mode ACLMode + allow map[RequestSource]map[string]struct{} + enabled bool +} + +// NewStrictControlPlaneACL 创建默认拒绝的严格 ACL。 +func NewStrictControlPlaneACL() *ControlPlaneACL { + allow := map[RequestSource]map[string]struct{}{ + RequestSourceIPC: { + strings.ToLower(strings.TrimSpace("gateway.authenticate")): {}, + strings.ToLower(strings.TrimSpace("gateway.ping")): {}, + strings.ToLower(strings.TrimSpace("gateway.bindStream")): {}, + strings.ToLower(strings.TrimSpace("wake.openUrl")): {}, + }, + RequestSourceHTTP: { + strings.ToLower(strings.TrimSpace("gateway.authenticate")): {}, + strings.ToLower(strings.TrimSpace("gateway.ping")): {}, + strings.ToLower(strings.TrimSpace("gateway.bindStream")): {}, + strings.ToLower(strings.TrimSpace("wake.openUrl")): {}, + }, + RequestSourceWS: { + strings.ToLower(strings.TrimSpace("gateway.authenticate")): {}, + strings.ToLower(strings.TrimSpace("gateway.ping")): {}, + strings.ToLower(strings.TrimSpace("gateway.bindStream")): {}, + strings.ToLower(strings.TrimSpace("wake.openUrl")): {}, + }, + RequestSourceSSE: { + strings.ToLower(strings.TrimSpace("gateway.ping")): {}, + }, + } + return &ControlPlaneACL{ + mode: ACLModeStrict, + allow: allow, + enabled: true, + } +} + +// IsAllowed 判断来源与方法组合是否允许通过授权校验。 +func (a *ControlPlaneACL) IsAllowed(source RequestSource, method string) bool { + if a == nil || !a.enabled { + return true + } + normalizedSource := NormalizeRequestSource(source) + normalizedMethod := strings.ToLower(strings.TrimSpace(method)) + if normalizedMethod == "" { + return false + } + methodSet, exists := a.allow[normalizedSource] + if !exists { + return false + } + _, allowed := methodSet[normalizedMethod] + return allowed +} + +// Mode 返回 ACL 当前模式。 +func (a *ControlPlaneACL) Mode() ACLMode { + if a == nil { + return ACLModeStrict + } + return a.mode +} + +// NormalizeRequestSource 归一化请求来源值。 +func NormalizeRequestSource(source RequestSource) RequestSource { + switch RequestSource(strings.ToLower(strings.TrimSpace(string(source)))) { + case RequestSourceIPC: + return RequestSourceIPC + case RequestSourceHTTP: + return RequestSourceHTTP + case RequestSourceWS: + return RequestSourceWS + case RequestSourceSSE: + return RequestSourceSSE + default: + return RequestSourceUnknown + } +} diff --git a/internal/gateway/security_test.go b/internal/gateway/security_test.go new file mode 100644 index 00000000..d78261f7 --- /dev/null +++ b/internal/gateway/security_test.go @@ -0,0 +1,37 @@ +package gateway + +import "testing" + +func TestStrictACLAllowlist(t *testing.T) { + acl := NewStrictControlPlaneACL() + cases := []struct { + source RequestSource + method string + want bool + }{ + {source: RequestSourceIPC, method: "gateway.authenticate", want: true}, + {source: RequestSourceIPC, method: "gateway.ping", want: true}, + {source: RequestSourceIPC, method: "wake.openUrl", want: true}, + {source: RequestSourceHTTP, method: "gateway.bindStream", want: true}, + {source: RequestSourceWS, method: "wake.openUrl", want: true}, + {source: RequestSourceSSE, method: "gateway.ping", want: true}, + {source: RequestSourceSSE, method: "wake.openUrl", want: false}, + {source: RequestSourceHTTP, method: "gateway.run", want: false}, + {source: RequestSourceUnknown, method: "gateway.ping", want: false}, + } + for _, tc := range cases { + got := acl.IsAllowed(tc.source, tc.method) + if got != tc.want { + t.Fatalf("acl allowed(%s,%s) = %v, want %v", tc.source, tc.method, got, tc.want) + } + } +} + +func TestNormalizeRequestSource(t *testing.T) { + if got := NormalizeRequestSource(" WS "); got != RequestSourceWS { + t.Fatalf("normalized source = %q, want %q", got, RequestSourceWS) + } + if got := NormalizeRequestSource("custom"); got != RequestSourceUnknown { + t.Fatalf("normalized source = %q, want %q", got, RequestSourceUnknown) + } +} From e297dee86991abcc4f3de260f61aa14a17abb610 Mon Sep 17 00:00:00 2001 From: pionxe Date: Thu, 16 Apr 2026 23:39:23 +0800 Subject: [PATCH 03/12] =?UTF-8?q?feat(gateway):=20[EPIC-GW-06]=20=E8=B4=AF?= =?UTF-8?q?=E9=80=9A=E9=89=B4=E6=9D=83=E4=B8=8E=E8=A7=82=E6=B5=8B=E7=AB=AF?= =?UTF-8?q?=E7=82=B9=E7=9A=84=E7=BD=91=E7=BB=9C=E9=9D=A2=E6=8B=A6=E6=88=AA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 将安全与治理能力注入物理入口： 1. 路由开放：公开 /healthz 与 /version 免鉴权探活端点。 2. 鉴权拦截：在 POST/WS/SSE/IPC 入口处全局接入 Token 校验逻辑，拒绝非法连接。 3. 动态配置：分发层全面消费 config.yaml 中的动态限流与超时配置。 --- internal/gateway/bootstrap.go | 77 ++++- internal/gateway/network_server.go | 354 ++++++++++++++++++--- internal/gateway/network_server_test.go | 102 ++++++ internal/gateway/protocol/jsonrpc.go | 61 +++- internal/gateway/protocol/jsonrpc_test.go | 49 +++ internal/gateway/rpc_dispatch.go | 164 +++++++++- internal/gateway/rpc_dispatch_test.go | 97 ++++++ internal/gateway/server.go | 54 +++- internal/gateway/server_additional_test.go | 2 +- internal/gateway/server_test.go | 85 +++++ internal/gateway/stream_relay.go | 55 ++++ internal/gateway/validate.go | 8 +- 12 files changed, 1044 insertions(+), 64 deletions(-) diff --git a/internal/gateway/bootstrap.go b/internal/gateway/bootstrap.go index 081c8d2f..ff9c3b9d 100644 --- a/internal/gateway/bootstrap.go +++ b/internal/gateway/bootstrap.go @@ -15,9 +15,10 @@ type requestFrameHandler func(ctx context.Context, frame MessageFrame) MessageFr var wakeOpenURLHandler = handlers.NewWakeOpenURLHandler() var requestFrameHandlers = map[FrameAction]requestFrameHandler{ - FrameActionPing: handlePingFrame, - FrameActionBindStream: handleBindStreamFrame, - FrameActionWakeOpenURL: handleWakeOpenURLFrame, + FrameActionAuthenticate: handleAuthenticateFrame, + FrameActionPing: handlePingFrame, + FrameActionBindStream: handleBindStreamFrame, + FrameActionWakeOpenURL: handleWakeOpenURLFrame, } // dispatchRequestFrame 统一分发 request 帧到对应动作处理器。 @@ -37,6 +38,36 @@ func handlePingFrame(_ context.Context, frame MessageFrame) MessageFrame { RequestID: frame.RequestID, Payload: map[string]string{ "message": "pong", + "version": GatewayVersion, + }, + } +} + +// handleAuthenticateFrame 处理 gateway.authenticate 请求并更新连接级认证状态。 +func handleAuthenticateFrame(ctx context.Context, frame MessageFrame) MessageFrame { + params, err := decodeAuthenticatePayload(frame.Payload) + if err != nil { + return errorFrame(frame, err) + } + + authenticator, hasAuthenticator := TokenAuthenticatorFromContext(ctx) + if !hasAuthenticator { + return errorFrame(frame, NewFrameError(ErrorCodeInternalError, "token authenticator is unavailable")) + } + if !authenticator.ValidateToken(params.Token) { + return errorFrame(frame, NewFrameError(ErrorCodeUnauthorized, "invalid auth token")) + } + + if authState, ok := ConnectionAuthStateFromContext(ctx); ok { + authState.MarkAuthenticated() + } + + return MessageFrame{ + Type: FrameTypeAck, + Action: FrameActionAuthenticate, + RequestID: frame.RequestID, + Payload: map[string]string{ + "message": "authenticated", }, } } @@ -107,6 +138,10 @@ type bindStreamParams struct { Channel StreamChannel } +type authenticateParams struct { + Token string +} + // decodeBindStreamParams 将 payload 解析为 bind_stream 所需参数。 func decodeBindStreamParams(payload any) (bindStreamParams, *FrameError) { switch typed := payload.(type) { @@ -136,6 +171,42 @@ func decodeBindStreamParams(payload any) (bindStreamParams, *FrameError) { } } +// decodeAuthenticatePayload 将 payload 解析为 authenticate 所需参数。 +func decodeAuthenticatePayload(payload any) (authenticateParams, *FrameError) { + switch typed := payload.(type) { + case protocol.AuthenticateParams: + if strings.TrimSpace(typed.Token) == "" { + return authenticateParams{}, NewMissingRequiredFieldError("payload.token") + } + return authenticateParams{Token: strings.TrimSpace(typed.Token)}, nil + case *protocol.AuthenticateParams: + if typed == nil || strings.TrimSpace(typed.Token) == "" { + return authenticateParams{}, NewMissingRequiredFieldError("payload.token") + } + return authenticateParams{Token: strings.TrimSpace(typed.Token)}, nil + case map[string]any: + token := readStringValue(typed, "token") + if token == "" { + return authenticateParams{}, NewMissingRequiredFieldError("payload.token") + } + return authenticateParams{Token: token}, nil + default: + raw, marshalErr := json.Marshal(payload) + if marshalErr != nil { + return authenticateParams{}, NewFrameError(ErrorCodeInvalidFrame, "invalid authenticate payload") + } + var decoded protocol.AuthenticateParams + if unmarshalErr := json.Unmarshal(raw, &decoded); unmarshalErr != nil { + return authenticateParams{}, NewFrameError(ErrorCodeInvalidFrame, "invalid authenticate payload") + } + token := strings.TrimSpace(decoded.Token) + if token == "" { + return authenticateParams{}, NewMissingRequiredFieldError("payload.token") + } + return authenticateParams{Token: token}, nil + } +} + // normalizeBindStreamParams 对 bind_stream 参数执行归一化与有效性校验。 func normalizeBindStreamParams(params protocol.BindStreamParams) (bindStreamParams, *FrameError) { sessionID := strings.TrimSpace(params.SessionID) diff --git a/internal/gateway/network_server.go b/internal/gateway/network_server.go index 891fadd8..bccb8c98 100644 --- a/internal/gateway/network_server.go +++ b/internal/gateway/network_server.go @@ -16,6 +16,7 @@ import ( "sync" "time" + "github.com/prometheus/client_golang/prometheus/promhttp" "golang.org/x/net/websocket" "neo-code/internal/gateway/protocol" @@ -30,9 +31,9 @@ const ( DefaultNetworkWriteTimeout = 15 * time.Second // DefaultNetworkShutdownTimeout 定义网络入口优雅关闭的最大等待时间。 DefaultNetworkShutdownTimeout = 2 * time.Second - // DefaultNetworkHeartbeatInterval 定义 WS/SSE 长连接的保活心跳周期。 + // DefaultNetworkHeartbeatInterval 定义 WS/SSE 长连接保活心跳周期。 DefaultNetworkHeartbeatInterval = 3 * time.Second - // DefaultNetworkMaxRequestBytes 定义 HTTP/WS 单次请求体的最大字节数。 + // DefaultNetworkMaxRequestBytes 定义 HTTP/WS 单次请求体最大字节数。 DefaultNetworkMaxRequestBytes int64 = MaxFrameSize // DefaultNetworkMaxStreamConnections 定义 WS/SSE 长连接总上限。 DefaultNetworkMaxStreamConnections = 128 @@ -55,6 +56,10 @@ type NetworkServerOptions struct { MaxRequestBytes int64 MaxStreamConnections int Relay *StreamRelay + Authenticator TokenAuthenticator + ACL *ControlPlaneACL + Metrics *GatewayMetrics + AllowedOrigins []string listenFn func(network, address string) (net.Listener, error) } @@ -70,6 +75,11 @@ type NetworkServer struct { maxStreamConnections int listenFn func(network, address string) (net.Listener, error) relay *StreamRelay + authenticator TokenAuthenticator + acl *ControlPlaneACL + metrics *GatewayMetrics + allowedOrigins []string + startedAt time.Time mu sync.Mutex server *http.Server @@ -129,10 +139,26 @@ func NewNetworkServer(options NetworkServerOptions) (*NetworkServer, error) { relay := options.Relay if relay == nil { relay = NewStreamRelay(StreamRelayOptions{ - Logger: logger, + Logger: logger, + Metrics: options.Metrics, }) } + authenticator := options.Authenticator + acl := options.ACL + if acl == nil && authenticator != nil { + acl = NewStrictControlPlaneACL() + } + + metrics := options.Metrics + if metrics == nil { + metrics = NewGatewayMetrics() + } + allowedOrigins := normalizeControlPlaneOrigins(options.AllowedOrigins) + if len(allowedOrigins) == 0 { + allowedOrigins = defaultControlPlaneOrigins() + } + return &NetworkServer{ listenAddress: listenAddress, logger: logger, @@ -144,6 +170,11 @@ func NewNetworkServer(options NetworkServerOptions) (*NetworkServer, error) { maxStreamConnections: maxStreamConnections, listenFn: listenFn, relay: relay, + authenticator: authenticator, + acl: acl, + metrics: metrics, + allowedOrigins: allowedOrigins, + startedAt: time.Now().UTC(), wsConns: make(map[*websocket.Conn]context.CancelFunc), sseCancels: make(map[int]context.CancelFunc), }, nil @@ -161,7 +192,7 @@ func ResolveNetworkListenAddress(override string) (string, error) { return address, nil } -// validateLoopbackListenAddress 校验网络监听地址只能绑定到环回接口，避免开放到外网。 +// validateLoopbackListenAddress 校验网络监听地址只能绑定到环回接口，避免暴露到外网。 func validateLoopbackListenAddress(address string) error { host, _, err := net.SplitHostPort(strings.TrimSpace(address)) if err != nil { @@ -171,6 +202,7 @@ func validateLoopbackListenAddress(address string) error { if normalizedHost == "" { return fmt.Errorf("invalid --http-listen %q: host must be loopback", address) } + if ip := net.ParseIP(normalizedHost); ip != nil { if !ip.IsLoopback() { return fmt.Errorf("invalid --http-listen %q: host must be loopback", address) @@ -182,7 +214,6 @@ func validateLoopbackListenAddress(address string) error { if lookupErr != nil || len(resolvedHostIPs) == 0 { return fmt.Errorf("invalid --http-listen %q: host must resolve to loopback addresses", address) } - for _, resolvedIP := range resolvedHostIPs { if resolvedIP == nil || !resolvedIP.IsLoopback() { return fmt.Errorf("invalid --http-listen %q: host must be loopback", address) @@ -201,7 +232,10 @@ func (s *NetworkServer) ListenAddress() string { // Serve 启动网络访问面服务，并注册 HTTP/WebSocket/SSE 三类入口。 func (s *NetworkServer) Serve(ctx context.Context, runtimePort RuntimePort) error { if s.relay == nil { - s.relay = NewStreamRelay(StreamRelayOptions{Logger: s.logger}) + s.relay = NewStreamRelay(StreamRelayOptions{ + Logger: s.logger, + Metrics: s.metrics, + }) } listener, err := s.listenFn("tcp", s.listenAddress) @@ -274,7 +308,6 @@ func (s *NetworkServer) Close(ctx context.Context) error { shutdownCtx, cancel = context.WithTimeout(shutdownCtx, s.shutdownTimeout) defer cancel() } - if err := httpServer.Shutdown(shutdownCtx); err != nil { closeErr = errors.Join(closeErr, err) closeErr = errors.Join(closeErr, httpServer.Close()) @@ -286,7 +319,6 @@ func (s *NetworkServer) Close(ctx context.Context) error { closeErr = errors.Join(closeErr, err) } } - return closeErr } @@ -300,12 +332,16 @@ func (s *NetworkServer) isClosed() bool { // buildHandler 构建网络访问面的路由入口，并将请求统一转入网关分发链路。 func (s *NetworkServer) buildHandler(runtimePort RuntimePort) http.Handler { mux := http.NewServeMux() + mux.HandleFunc("/healthz", s.handleHealthzRequest) + mux.HandleFunc("/version", s.handleVersionRequest) + mux.HandleFunc("/metrics", s.handlePrometheusMetrics) + mux.HandleFunc("/metrics.json", s.handleJSONMetrics) mux.HandleFunc("/rpc", func(writer http.ResponseWriter, request *http.Request) { s.handleRPCRequest(writer, request, runtimePort) }) mux.Handle("/ws", websocket.Server{ - Handshake: func(config *websocket.Config, request *http.Request) error { - return validateOriginForWebSocket(request) + Handshake: func(_ *websocket.Config, request *http.Request) error { + return s.validateWebSocketOrigin(request) }, Handler: websocket.Handler(func(conn *websocket.Conn) { s.handleWebSocket(conn, runtimePort) @@ -322,13 +358,14 @@ func (s *NetworkServer) withCORS(next http.Handler) http.Handler { return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { origin := strings.TrimSpace(request.Header.Get("Origin")) if origin != "" { - if !isAllowedControlPlaneOrigin(origin) { + if !s.isAllowedOrigin(origin) { http.Error(writer, "origin is not allowed", http.StatusForbidden) return } writer.Header().Set("Access-Control-Allow-Origin", origin) writer.Header().Set("Vary", "Origin") } + writer.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS") writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization") if request.Method == http.MethodOptions { @@ -339,6 +376,84 @@ func (s *NetworkServer) withCORS(next http.Handler) http.Handler { }) } +// handleHealthzRequest 返回网关健康状态与连接快照。 +func (s *NetworkServer) handleHealthzRequest(writer http.ResponseWriter, request *http.Request) { + if request.Method != http.MethodGet { + http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) + return + } + + connectionSnapshot := map[string]int{} + if s.relay != nil { + for channel, count := range s.relay.SnapshotConnectionCounts() { + connectionSnapshot[strings.TrimSpace(string(channel))] = count + } + } + + payload := map[string]any{ + "status": "ok", + "listen": strings.TrimSpace(s.listenAddress), + "uptime_sec": int(time.Since(s.startedAt).Seconds()), + "connections": connectionSnapshot, + } + writeJSONResponse(writer, http.StatusOK, payload) +} + +// handleVersionRequest 返回网关构建版本信息。 +func (s *NetworkServer) handleVersionRequest(writer http.ResponseWriter, request *http.Request) { + if request.Method != http.MethodGet { + http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) + return + } + writeJSONResponse(writer, http.StatusOK, ResolvedBuildInfo()) +} + +// handlePrometheusMetrics 输出 Prometheus 文本指标。 +func (s *NetworkServer) handlePrometheusMetrics(writer http.ResponseWriter, request *http.Request) { + if request.Method != http.MethodGet { + http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) + return + } + if !s.isObservabilityRequestAuthorized(request) { + http.Error(writer, "unauthorized", http.StatusUnauthorized) + return + } + if s.metrics == nil || s.metrics.Registry() == nil { + http.Error(writer, "metrics unavailable", http.StatusServiceUnavailable) + return + } + promhttp.HandlerFor(s.metrics.Registry(), promhttp.HandlerOpts{}).ServeHTTP(writer, request) +} + +// handleJSONMetrics 输出 JSON 指标快照。 +func (s *NetworkServer) handleJSONMetrics(writer http.ResponseWriter, request *http.Request) { + if request.Method != http.MethodGet { + http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) + return + } + if !s.isObservabilityRequestAuthorized(request) { + http.Error(writer, "unauthorized", http.StatusUnauthorized) + return + } + payload := map[string]any{"metrics": map[string]map[string]float64{}} + if s.metrics != nil { + payload["metrics"] = s.metrics.Snapshot() + } + writeJSONResponse(writer, http.StatusOK, payload) +} + +// isObservabilityRequestAuthorized 校验 metrics 端点访问 Token。 +func (s *NetworkServer) isObservabilityRequestAuthorized(request *http.Request) bool { + if s.authenticator == nil { + return true + } + token := extractBearerToken(request.Header.Get("Authorization")) + if token == "" && request.URL != nil { + token = strings.TrimSpace(request.URL.Query().Get("token")) + } + return s.authenticator.ValidateToken(token) +} + // handleRPCRequest 处理 POST /rpc 请求并返回单次 JSON-RPC 响应。 func (s *NetworkServer) handleRPCRequest(writer http.ResponseWriter, request *http.Request, runtimePort RuntimePort) { if request.Method != http.MethodPost { @@ -353,8 +468,10 @@ func (s *NetworkServer) handleRPCRequest(writer http.ResponseWriter, request *ht return } - response := dispatchRPCRequestFn(request.Context(), rpcRequest, runtimePort) - writeJSONRPCHTTPResponse(writer, response) + token := extractBearerToken(request.Header.Get("Authorization")) + rpcCtx := s.decorateRequestContext(request.Context(), RequestSourceHTTP, token) + rpcResponse := dispatchRPCRequestFn(rpcCtx, rpcRequest, runtimePort) + writeJSONRPCHTTPResponse(writer, rpcResponse) } // handleWebSocket 处理 WS 入口请求，连接上下文会在关停或异常时主动取消。 @@ -364,22 +481,33 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim parentContext = request.Context() } connectionContext, cancelConnection := context.WithCancel(parentContext) + defer cancelConnection() + relay := s.relay if relay == nil { - relay = NewStreamRelay(StreamRelayOptions{Logger: s.logger}) + relay = NewStreamRelay(StreamRelayOptions{ + Logger: s.logger, + Metrics: s.metrics, + }) } + connectionID := NewConnectionID() + requestToken := "" + if request := conn.Request(); request != nil && request.URL != nil { + requestToken = strings.TrimSpace(request.URL.Query().Get("token")) + } + connectionContext = s.decorateRequestContext(connectionContext, RequestSourceWS, requestToken) connectionContext = WithConnectionID(connectionContext, connectionID) connectionContext = WithStreamRelay(connectionContext, relay) if !s.registerWSConnection(conn, cancelConnection) { - cancelConnection() _ = conn.SetWriteDeadline(time.Now().Add(s.writeTimeout)) _ = websocket.Message.Send(conn, `{"status":"error","code":"too_many_connections","message":"stream connection limit exceeded"}`) _ = conn.Close() return } + encoder := json.NewEncoder(conn) registerErr := relay.RegisterConnection(ConnectionRegistration{ ConnectionID: connectionID, Channel: StreamChannelWS, @@ -394,34 +522,34 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim return err } } - rawPayload, err := json.Marshal(message.Payload) + payload, err := json.Marshal(message.Payload) if err != nil { return err } - return websocket.Message.Send(conn, string(rawPayload)) + if err := encoder.Encode(json.RawMessage(payload)); err != nil { + return err + } + return nil }, Close: func() { _ = conn.Close() }, }) if registerErr != nil { - cancelConnection() s.unregisterWSConnection(conn) - _ = conn.Close() s.logger.Printf("register websocket connection failed: %v", registerErr) + _ = conn.Close() return } defer func() { - cancelConnection() s.unregisterWSConnection(conn) relay.dropConnection(connectionID) _ = conn.Close() }() - maxPayloadBytes := int(s.maxRequestBytes) - if maxPayloadBytes > 0 { - conn.MaxPayloadBytes = maxPayloadBytes + if s.maxRequestBytes > 0 { + conn.MaxPayloadBytes = int(s.maxRequestBytes) } stopHeartbeat := make(chan struct{}) @@ -429,10 +557,14 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim go s.runWSHeartbeatLoop(relay, connectionID, stopHeartbeat) for { - // 注意：此处不再强制上行读超时，避免单向推送场景下误杀健康连接。 + select { + case <-connectionContext.Done(): + return + default: + } + var rawMessage string if err := websocket.Message.Receive(conn, &rawMessage); err != nil { - cancelConnection() if isConnectionClosedError(err) { return } @@ -449,7 +581,6 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim } if !relay.SendJSONRPCResponse(connectionID, rpcResponse) { - cancelConnection() return } } @@ -488,8 +619,18 @@ func (s *NetworkServer) handleSSERequest(writer http.ResponseWriter, request *ht return } + requestToken := "" + if request.URL != nil { + requestToken = strings.TrimSpace(request.URL.Query().Get("token")) + } + if s.authenticator != nil && !s.authenticator.ValidateToken(requestToken) { + http.Error(writer, "unauthorized", http.StatusUnauthorized) + return + } + streamCtx, cancel := context.WithCancel(request.Context()) - connectionID, registered := s.registerSSEConnection(cancel) + streamCtx = s.decorateRequestContext(streamCtx, RequestSourceSSE, requestToken) + connectionTag, registered := s.registerSSEConnection(cancel) if !registered { cancel() http.Error(writer, "stream connection limit exceeded", http.StatusServiceUnavailable) @@ -499,7 +640,10 @@ func (s *NetworkServer) handleSSERequest(writer http.ResponseWriter, request *ht relay := s.relay if relay == nil { - relay = NewStreamRelay(StreamRelayOptions{Logger: s.logger}) + relay = NewStreamRelay(StreamRelayOptions{ + Logger: s.logger, + Metrics: s.metrics, + }) } streamConnectionID := NewConnectionID() streamCtx = WithConnectionID(streamCtx, streamConnectionID) @@ -525,14 +669,14 @@ func (s *NetworkServer) handleSSERequest(writer http.ResponseWriter, request *ht }) if registerErr != nil { cancel() - s.unregisterSSEConnection(connectionID) + s.unregisterSSEConnection(connectionTag) http.Error(writer, "failed to register stream connection", http.StatusInternalServerError) return } defer func() { cancel() - s.unregisterSSEConnection(connectionID) + s.unregisterSSEConnection(connectionTag) relay.dropConnection(streamConnectionID) }() @@ -626,7 +770,7 @@ func buildSSETriggerRequest(request *http.Request) protocol.JSONRPCRequest { } } -// decodeJSONRPCRequestFromBytes 解析字节流中的 JSON-RPC 请求并检查是否包含多余 JSON 值。 +// decodeJSONRPCRequestFromBytes 解析字节流中的 JSON-RPC 请求并检查是否包含多值 JSON。 func decodeJSONRPCRequestFromBytes(raw []byte) (protocol.JSONRPCRequest, *protocol.JSONRPCError) { return decodeJSONRPCRequestFromReader(bytes.NewReader(raw)) } @@ -652,7 +796,6 @@ func decodeJSONRPCRequestFromReader(reader io.Reader) (protocol.JSONRPCRequest, protocol.GatewayCodeInvalidFrame, ) } - return request, nil } @@ -664,6 +807,41 @@ func writeJSONRPCHTTPResponse(writer http.ResponseWriter, response protocol.JSON _ = encoder.Encode(response) } +// writeJSONResponse 以 JSON 形式输出普通 HTTP 响应。 +func writeJSONResponse(writer http.ResponseWriter, statusCode int, payload any) { + writer.Header().Set("Content-Type", "application/json") + writer.WriteHeader(statusCode) + encoder := json.NewEncoder(writer) + encoder.SetEscapeHTML(false) + _ = encoder.Encode(payload) +} + +// decorateRequestContext 为网络请求注入统一 source/auth/acl/metrics/logger 上下文。 +func (s *NetworkServer) decorateRequestContext(base context.Context, source RequestSource, token string) context.Context { + ctx := WithRequestSource(base, source) + authState := NewConnectionAuthState() + ctx = WithConnectionAuthState(ctx, authState) + + trimmedToken := strings.TrimSpace(token) + if trimmedToken != "" { + ctx = WithRequestToken(ctx, trimmedToken) + } + if s.authenticator != nil { + ctx = WithTokenAuthenticator(ctx, s.authenticator) + if trimmedToken != "" && s.authenticator.ValidateToken(trimmedToken) { + authState.MarkAuthenticated() + } + } + if s.acl != nil { + ctx = WithRequestACL(ctx, s.acl) + } + if s.metrics != nil { + ctx = WithGatewayMetrics(ctx, s.metrics) + } + ctx = WithGatewayLogger(ctx, s.logger) + return ctx +} + // registerWSConnection 登记一个 WebSocket 长连接，并执行统一并发上限控制。 func (s *NetworkServer) registerWSConnection(conn *websocket.Conn, cancel context.CancelFunc) bool { s.mu.Lock() @@ -675,6 +853,7 @@ func (s *NetworkServer) registerWSConnection(conn *websocket.Conn, cancel contex return false } s.wsConns[conn] = cancel + s.updateActiveConnectionMetricsLocked() return true } @@ -683,6 +862,7 @@ func (s *NetworkServer) unregisterWSConnection(conn *websocket.Conn) { s.mu.Lock() defer s.mu.Unlock() delete(s.wsConns, conn) + s.updateActiveConnectionMetricsLocked() } // registerSSEConnection 登记一个 SSE 长连接并返回连接标识，用于后续主动中断。 @@ -698,6 +878,7 @@ func (s *NetworkServer) registerSSEConnection(cancel context.CancelFunc) (int, b connectionID := s.nextSSEID s.nextSSEID++ s.sseCancels[connectionID] = cancel + s.updateActiveConnectionMetricsLocked() return connectionID, true } @@ -706,6 +887,16 @@ func (s *NetworkServer) unregisterSSEConnection(connectionID int) { s.mu.Lock() defer s.mu.Unlock() delete(s.sseCancels, connectionID) + s.updateActiveConnectionMetricsLocked() +} + +// updateActiveConnectionMetricsLocked 在持锁状态下刷新活跃连接指标。 +func (s *NetworkServer) updateActiveConnectionMetricsLocked() { + if s.metrics == nil { + return + } + s.metrics.SetConnectionsActive(string(StreamChannelWS), len(s.wsConns)) + s.metrics.SetConnectionsActive(string(StreamChannelSSE), len(s.sseCancels)) } // forceCloseStreamConnections 在关停流程中主动切断 WS/SSE 长连接，避免退出被阻塞。 @@ -742,26 +933,26 @@ func (s *NetworkServer) snapshotStreamConnections() ([]*websocket.Conn, []contex delete(s.sseCancels, connectionID) } + s.updateActiveConnectionMetricsLocked() return wsConnections, wsCancels, sseCancels } // isAllowedControlPlaneOrigin 校验请求来源是否命中本地控制面允许的 Origin 白名单。 func isAllowedControlPlaneOrigin(origin string) bool { + return isAllowedControlPlaneOriginWithAllowlist(origin, defaultControlPlaneOrigins()) +} + +func isAllowedControlPlaneOriginWithAllowlist(origin string, allowlist []string) bool { normalizedOrigin := strings.ToLower(strings.TrimSpace(origin)) - switch { - case normalizedOrigin == "": - return false - case strings.HasPrefix(normalizedOrigin, "http://localhost:"), - normalizedOrigin == "http://localhost", - strings.HasPrefix(normalizedOrigin, "http://127.0.0.1:"), - normalizedOrigin == "http://127.0.0.1", - strings.HasPrefix(normalizedOrigin, "http://[::1]:"), - normalizedOrigin == "http://[::1]", - strings.HasPrefix(normalizedOrigin, "app://"): - return true - default: + if normalizedOrigin == "" { return false } + for _, allow := range allowlist { + if originMatchesAllowRule(normalizedOrigin, allow) { + return true + } + } + return false } // validateOriginForWebSocket 在握手阶段校验 Origin 白名单，阻断非可信网页来源。 @@ -779,6 +970,78 @@ func validateOriginForWebSocket(request *http.Request) error { return nil } +// isAllowedOrigin 使用服务实例配置的 allowlist 校验来源。 +func (s *NetworkServer) isAllowedOrigin(origin string) bool { + allowlist := s.allowedOrigins + if len(allowlist) == 0 { + allowlist = defaultControlPlaneOrigins() + } + return isAllowedControlPlaneOriginWithAllowlist(origin, allowlist) +} + +// validateWebSocketOrigin 在握手阶段基于实例 allowlist 校验 WebSocket 来源。 +func (s *NetworkServer) validateWebSocketOrigin(request *http.Request) error { + if request == nil { + return errors.New("invalid websocket request") + } + origin := strings.TrimSpace(request.Header.Get("Origin")) + if origin == "" { + return nil + } + if !s.isAllowedOrigin(origin) { + return fmt.Errorf("websocket origin %q is not allowed", origin) + } + return nil +} + +func defaultControlPlaneOrigins() []string { + return []string{"http://localhost", "http://127.0.0.1", "http://[::1]", "app://"} +} + +func normalizeControlPlaneOrigins(origins []string) []string { + normalized := make([]string, 0, len(origins)) + for _, origin := range origins { + trimmed := strings.ToLower(strings.TrimSpace(origin)) + if trimmed == "" { + continue + } + normalized = append(normalized, trimmed) + } + return normalized +} + +func originMatchesAllowRule(normalizedOrigin, normalizedAllow string) bool { + if normalizedAllow == "" { + return false + } + if strings.HasSuffix(normalizedAllow, "://") { + return strings.HasPrefix(normalizedOrigin, normalizedAllow) + } + if normalizedOrigin == normalizedAllow { + return true + } + if strings.HasPrefix(normalizedAllow, "http://[") && strings.HasSuffix(normalizedAllow, "]") { + return strings.HasPrefix(normalizedOrigin, normalizedAllow+":") + } + if strings.HasPrefix(normalizedAllow, "http://") && !strings.Contains(strings.TrimPrefix(normalizedAllow, "http://"), ":") { + return strings.HasPrefix(normalizedOrigin, normalizedAllow+":") + } + return false +} + +// extractBearerToken 从 Authorization 头中提取 Bearer Token。 +func extractBearerToken(authorization string) string { + trimmed := strings.TrimSpace(authorization) + if trimmed == "" { + return "" + } + const prefix = "bearer " + if len(trimmed) < len(prefix) || !strings.EqualFold(trimmed[:len(prefix)], prefix) { + return "" + } + return strings.TrimSpace(trimmed[len(prefix):]) +} + // isConnectionClosedError 判断错误是否由连接关闭触发，便于安静退出读写循环。 func isConnectionClosedError(err error) bool { if err == nil { @@ -788,6 +1051,5 @@ func isConnectionClosedError(err error) bool { return true } lowerMessage := strings.ToLower(err.Error()) - return strings.Contains(lowerMessage, "closed network connection") || - strings.Contains(lowerMessage, "closed pipe") + return strings.Contains(lowerMessage, "closed network connection") || strings.Contains(lowerMessage, "closed pipe") } diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index 6cde321f..77997868 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -649,6 +649,100 @@ func TestNetworkServerStreamsReceiveGatewayEventNotification(t *testing.T) { } } +func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { + server := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + }) + testContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + serveDone := make(chan error, 1) + go func() { + serveDone <- server.Serve(testContext, nil) + }() + t.Cleanup(func() { + _ = server.Close(context.Background()) + select { + case <-serveDone: + case <-time.After(2 * time.Second): + t.Fatal("network serve goroutine did not exit") + } + }) + + listenAddress := waitForNetworkAddress(t, server) + + healthResponse, err := http.Get("http://" + listenAddress + "/healthz") + if err != nil { + t.Fatalf("get /healthz: %v", err) + } + defer healthResponse.Body.Close() + if healthResponse.StatusCode != http.StatusOK { + t.Fatalf("/healthz status = %d, want %d", healthResponse.StatusCode, http.StatusOK) + } + + metricsResponse, err := http.Get("http://" + listenAddress + "/metrics") + if err != nil { + t.Fatalf("get /metrics: %v", err) + } + defer metricsResponse.Body.Close() + if metricsResponse.StatusCode != http.StatusUnauthorized { + t.Fatalf("/metrics status = %d, want %d", metricsResponse.StatusCode, http.StatusUnauthorized) + } + + authorizedMetricsRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/metrics", nil) + if err != nil { + t.Fatalf("new /metrics request: %v", err) + } + authorizedMetricsRequest.Header.Set("Authorization", "Bearer gateway-token") + authorizedMetricsResponse, err := http.DefaultClient.Do(authorizedMetricsRequest) + if err != nil { + t.Fatalf("authorized get /metrics: %v", err) + } + defer authorizedMetricsResponse.Body.Close() + if authorizedMetricsResponse.StatusCode != http.StatusOK { + t.Fatalf("authorized /metrics status = %d, want %d", authorizedMetricsResponse.StatusCode, http.StatusOK) + } + + authorizedJSONMetricsRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/metrics.json", nil) + if err != nil { + t.Fatalf("new /metrics.json request: %v", err) + } + authorizedJSONMetricsRequest.Header.Set("Authorization", "Bearer gateway-token") + authorizedJSONMetricsResponse, err := http.DefaultClient.Do(authorizedJSONMetricsRequest) + if err != nil { + t.Fatalf("authorized get /metrics.json: %v", err) + } + defer authorizedJSONMetricsResponse.Body.Close() + if authorizedJSONMetricsResponse.StatusCode != http.StatusOK { + t.Fatalf("authorized /metrics.json status = %d, want %d", authorizedJSONMetricsResponse.StatusCode, http.StatusOK) + } +} + +func TestWithCORSCustomAllowOrigins(t *testing.T) { + server := &NetworkServer{ + allowedOrigins: []string{"http://custom.local"}, + } + handler := server.withCORS(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + writer.WriteHeader(http.StatusOK) + })) + + allowedRequest := httptest.NewRequest(http.MethodGet, "/rpc", nil) + allowedRequest.Header.Set("Origin", "http://custom.local:3000") + allowedRecorder := httptest.NewRecorder() + handler.ServeHTTP(allowedRecorder, allowedRequest) + if allowedRecorder.Code != http.StatusOK { + t.Fatalf("allowed status = %d, want %d", allowedRecorder.Code, http.StatusOK) + } + + rejectedRequest := httptest.NewRequest(http.MethodGet, "/rpc", nil) + rejectedRequest.Header.Set("Origin", "http://localhost:3000") + rejectedRecorder := httptest.NewRecorder() + handler.ServeHTTP(rejectedRecorder, rejectedRequest) + if rejectedRecorder.Code != http.StatusForbidden { + t.Fatalf("rejected status = %d, want %d", rejectedRecorder.Code, http.StatusForbidden) + } +} + // newTestNetworkServer 创建默认测试网络服务实例，统一收敛测试参数。 func newTestNetworkServer(t *testing.T, overrides NetworkServerOptions) *NetworkServer { t.Helper() @@ -856,6 +950,14 @@ type noFlushResponseWriter struct { body strings.Builder } +type staticTokenAuthenticator struct { + token string +} + +func (a staticTokenAuthenticator) ValidateToken(token string) bool { + return strings.TrimSpace(token) != "" && strings.TrimSpace(token) == strings.TrimSpace(a.token) +} + func (w *noFlushResponseWriter) Header() http.Header { return w.header } diff --git a/internal/gateway/protocol/jsonrpc.go b/internal/gateway/protocol/jsonrpc.go index 45207324..a62025a0 100644 --- a/internal/gateway/protocol/jsonrpc.go +++ b/internal/gateway/protocol/jsonrpc.go @@ -12,6 +12,8 @@ const ( ) const ( + // MethodGatewayAuthenticate 表示连接握手认证方法。 + MethodGatewayAuthenticate = "gateway.authenticate" // MethodGatewayPing 表示网关探活方法。 MethodGatewayPing = "gateway.ping" // MethodGatewayBindStream 表示客户端向网关声明流式订阅绑定的方法。 @@ -40,7 +42,7 @@ const ( GatewayCodeInvalidFrame = "invalid_frame" // GatewayCodeInvalidAction 表示动作参数非法。 GatewayCodeInvalidAction = "invalid_action" - // GatewayCodeInvalidMultimodalPayload 表示多模态负载非法。 + // GatewayCodeInvalidMultimodalPayload 表示多模态载荷非法。 GatewayCodeInvalidMultimodalPayload = "invalid_multimodal_payload" // GatewayCodeMissingRequiredField 表示缺少必填字段。 GatewayCodeMissingRequiredField = "missing_required_field" @@ -50,6 +52,10 @@ const ( GatewayCodeInternalError = "internal_error" // GatewayCodeUnsafePath 表示路径存在安全风险。 GatewayCodeUnsafePath = "unsafe_path" + // GatewayCodeUnauthorized 表示请求未通过认证校验。 + GatewayCodeUnauthorized = "unauthorized" + // GatewayCodeAccessDenied 表示请求已认证但未通过 ACL 校验。 + GatewayCodeAccessDenied = "access_denied" ) // JSONRPCRequest 表示控制面接收到的 JSON-RPC 请求。 @@ -75,7 +81,7 @@ type JSONRPCNotification struct { Params any `json:"params,omitempty"` } -// JSONRPCError 表示 JSON-RPC 错误负载。 +// JSONRPCError 表示 JSON-RPC 错误载荷。 type JSONRPCError struct { Code int `json:"code"` Message string `json:"message"` @@ -98,6 +104,11 @@ type NormalizedRequest struct { Payload any } +// AuthenticateParams 表示 gateway.authenticate 的标准化参数。 +type AuthenticateParams struct { + Token string `json:"token"` +} + // BindStreamParams 表示 gateway.bindStream 的标准化参数载荷。 type BindStreamParams struct { SessionID string `json:"session_id"` @@ -134,6 +145,14 @@ func NormalizeJSONRPCRequest(request JSONRPCRequest) (NormalizedRequest, *JSONRP } switch method { + case MethodGatewayAuthenticate: + params, parseErr := decodeAuthenticateParams(request.Params) + if parseErr != nil { + return normalized, parseErr + } + normalized.Action = "authenticate" + normalized.Payload = params + return normalized, nil case MethodGatewayPing: normalized.Action = "ping" return normalized, nil @@ -193,7 +212,7 @@ func NewJSONRPCErrorResponse(id json.RawMessage, rpcError *JSONRPCError) JSONRPC } } -// NewJSONRPCNotification 创建 JSON-RPC 通知负载，供网关向客户端推送事件使用。 +// NewJSONRPCNotification 创建 JSON-RPC 通知载荷，供网关向客户端推送事件使用。 func NewJSONRPCNotification(method string, params any) JSONRPCNotification { return JSONRPCNotification{ JSONRPC: JSONRPCVersion, @@ -214,7 +233,7 @@ func NewJSONRPCError(code int, message, gatewayCode string) *JSONRPCError { return errorPayload } -// GatewayCodeFromJSONRPCError 从 JSON-RPC 错误负载中提取稳定 gateway_code。 +// GatewayCodeFromJSONRPCError 从 JSON-RPC 错误载荷中提取稳定 gateway_code。 func GatewayCodeFromJSONRPCError(rpcError *JSONRPCError) string { if rpcError == nil || rpcError.Data == nil { return "" @@ -231,7 +250,9 @@ func MapGatewayCodeToJSONRPCCode(gatewayCode string) int { GatewayCodeInvalidFrame, GatewayCodeInvalidMultimodalPayload, GatewayCodeMissingRequiredField, - GatewayCodeUnsafePath: + GatewayCodeUnsafePath, + GatewayCodeUnauthorized, + GatewayCodeAccessDenied: return JSONRPCCodeInvalidParams case GatewayCodeInternalError: return JSONRPCCodeInternalError @@ -290,6 +311,36 @@ func normalizeJSONRPCID(id json.RawMessage) (string, *JSONRPCError) { } } +// decodeAuthenticateParams 对 gateway.authenticate 的 params 执行反序列化与最小校验。 +func decodeAuthenticateParams(raw json.RawMessage) (AuthenticateParams, *JSONRPCError) { + trimmed := bytes.TrimSpace(raw) + if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) { + return AuthenticateParams{}, NewJSONRPCError( + JSONRPCCodeInvalidParams, + "missing required field: params", + GatewayCodeMissingRequiredField, + ) + } + + var params AuthenticateParams + if err := json.Unmarshal(trimmed, ¶ms); err != nil { + return AuthenticateParams{}, NewJSONRPCError( + JSONRPCCodeInvalidParams, + "invalid params for gateway.authenticate", + GatewayCodeInvalidFrame, + ) + } + params.Token = strings.TrimSpace(params.Token) + if params.Token == "" { + return AuthenticateParams{}, NewJSONRPCError( + JSONRPCCodeInvalidParams, + "missing required field: params.token", + GatewayCodeMissingRequiredField, + ) + } + return params, nil +} + // decodeWakeIntentParams 对 wake.openUrl 的 params 执行延迟反序列化与最小校验。 func decodeWakeIntentParams(raw json.RawMessage) (WakeIntent, *JSONRPCError) { trimmed := bytes.TrimSpace(raw) diff --git a/internal/gateway/protocol/jsonrpc_test.go b/internal/gateway/protocol/jsonrpc_test.go index 7a7f5fad..1c1450b5 100644 --- a/internal/gateway/protocol/jsonrpc_test.go +++ b/internal/gateway/protocol/jsonrpc_test.go @@ -23,6 +23,28 @@ func TestNormalizeJSONRPCRequestPing(t *testing.T) { } } +func TestNormalizeJSONRPCRequestAuthenticate(t *testing.T) { + normalized, rpcErr := NormalizeJSONRPCRequest(JSONRPCRequest{ + JSONRPC: JSONRPCVersion, + ID: json.RawMessage(`"auth-1"`), + Method: MethodGatewayAuthenticate, + Params: json.RawMessage(`{"token":"abc"}`), + }) + if rpcErr != nil { + t.Fatalf("normalize authenticate request: %v", rpcErr) + } + if normalized.Action != "authenticate" { + t.Fatalf("action = %q, want %q", normalized.Action, "authenticate") + } + params, ok := normalized.Payload.(AuthenticateParams) + if !ok { + t.Fatalf("payload type = %T, want AuthenticateParams", normalized.Payload) + } + if params.Token != "abc" { + t.Fatalf("token = %q, want %q", params.Token, "abc") + } +} + func TestNormalizeJSONRPCRequestPingWithNumericID(t *testing.T) { normalized, rpcErr := NormalizeJSONRPCRequest(JSONRPCRequest{ JSONRPC: JSONRPCVersion, @@ -159,6 +181,27 @@ func TestNormalizeJSONRPCRequestErrors(t *testing.T) { wantCode: JSONRPCCodeInvalidRequest, wantGatewayCode: GatewayCodeInvalidFrame, }, + { + name: "authenticate missing params", + request: JSONRPCRequest{ + JSONRPC: JSONRPCVersion, + ID: json.RawMessage(`"x"`), + Method: MethodGatewayAuthenticate, + }, + wantCode: JSONRPCCodeInvalidParams, + wantGatewayCode: GatewayCodeMissingRequiredField, + }, + { + name: "authenticate missing token", + request: JSONRPCRequest{ + JSONRPC: JSONRPCVersion, + ID: json.RawMessage(`"x"`), + Method: MethodGatewayAuthenticate, + Params: json.RawMessage(`{"token":" "}`), + }, + wantCode: JSONRPCCodeInvalidParams, + wantGatewayCode: GatewayCodeMissingRequiredField, + }, { name: "missing method", request: JSONRPCRequest{ @@ -315,6 +358,12 @@ func TestJSONRPCHelpers(t *testing.T) { if MapGatewayCodeToJSONRPCCode(GatewayCodeInvalidAction) != JSONRPCCodeInvalidParams { t.Fatal("invalid_action should map to invalid_params") } + if MapGatewayCodeToJSONRPCCode(GatewayCodeUnauthorized) != JSONRPCCodeInvalidParams { + t.Fatal("unauthorized should map to invalid_params") + } + if MapGatewayCodeToJSONRPCCode(GatewayCodeAccessDenied) != JSONRPCCodeInvalidParams { + t.Fatal("access_denied should map to invalid_params") + } if MapGatewayCodeToJSONRPCCode("unknown") != JSONRPCCodeInternalError { t.Fatal("unknown code should map to internal_error") } diff --git a/internal/gateway/rpc_dispatch.go b/internal/gateway/rpc_dispatch.go index 20ad1f00..0a0eb143 100644 --- a/internal/gateway/rpc_dispatch.go +++ b/internal/gateway/rpc_dispatch.go @@ -2,6 +2,7 @@ package gateway import ( "context" + "log" "strings" "neo-code/internal/gateway/protocol" @@ -9,11 +10,50 @@ import ( // dispatchRPCRequest 统一将 JSON-RPC 请求归一化并分发到网关内部 MessageFrame 处理链路。 func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, runtimePort RuntimePort) protocol.JSONRPCResponse { + startedAt := requestStartTime() + method := strings.TrimSpace(request.Method) + source := string(RequestSourceFromContext(ctx)) + metrics, _ := GatewayMetricsFromContext(ctx) + normalized, rpcErr := protocol.NormalizeJSONRPCRequest(request) if rpcErr != nil { + if metrics != nil { + metrics.IncRequests(source, method, "error") + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: "", + SessionID: "", + Method: method, + Source: source, + Status: "error", + GatewayCode: protocol.GatewayCodeFromJSONRPCError(rpcErr), + LatencyMS: requestLatencyMS(startedAt), + }) return protocol.NewJSONRPCErrorResponse(normalized.ID, rpcErr) } + if authErr := authorizeRPCRequest(ctx, request.Method, normalized.Action); authErr != nil { + if metrics != nil { + metrics.IncRequests(source, method, "error") + if gatewayCode := protocol.GatewayCodeFromJSONRPCError(authErr); gatewayCode == ErrorCodeUnauthorized.String() { + metrics.IncAuthFailures(source, gatewayCode) + } + if gatewayCode := protocol.GatewayCodeFromJSONRPCError(authErr); gatewayCode == ErrorCodeAccessDenied.String() { + metrics.IncACLDenied(source, method) + } + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: normalized.RequestID, + SessionID: normalized.SessionID, + Method: method, + Source: source, + Status: "error", + GatewayCode: protocol.GatewayCodeFromJSONRPCError(authErr), + LatencyMS: requestLatencyMS(startedAt), + }) + return protocol.NewJSONRPCErrorResponse(normalized.ID, authErr) + } + frame := MessageFrame{ Type: FrameTypeRequest, Action: FrameAction(normalized.Action), @@ -26,6 +66,18 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru frame = hydrateFrameSessionFromConnection(ctx, frame) if requiresSession(frame.Action) && strings.TrimSpace(frame.SessionID) == "" { + if metrics != nil { + metrics.IncRequests(source, method, "error") + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: normalized.RequestID, + SessionID: normalized.SessionID, + Method: method, + Source: source, + Status: "error", + GatewayCode: protocol.GatewayCodeMissingRequiredField, + LatencyMS: requestLatencyMS(startedAt), + }) return protocol.NewJSONRPCErrorResponse( normalized.ID, protocol.NewJSONRPCError( @@ -41,8 +93,31 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru if responseFrame.Type != FrameTypeError { rpcResponse, encodeErr := protocol.NewJSONRPCResultResponse(normalized.ID, responseFrame) if encodeErr != nil { + if metrics != nil { + metrics.IncRequests(source, method, "error") + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: normalized.RequestID, + SessionID: normalized.SessionID, + Method: method, + Source: source, + Status: "error", + GatewayCode: protocol.GatewayCodeInternalError, + LatencyMS: requestLatencyMS(startedAt), + }) return protocol.NewJSONRPCErrorResponse(normalized.ID, encodeErr) } + if metrics != nil { + metrics.IncRequests(source, method, "ok") + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: normalized.RequestID, + SessionID: responseFrame.SessionID, + Method: method, + Source: source, + Status: "ok", + LatencyMS: requestLatencyMS(startedAt), + }) return rpcResponse } @@ -50,7 +125,7 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru if frameErr == nil { frameErr = NewFrameError(ErrorCodeInternalError, "gateway response missing error payload") } - return protocol.NewJSONRPCErrorResponse( + rpcResponse := protocol.NewJSONRPCErrorResponse( normalized.ID, protocol.NewJSONRPCError( protocol.MapGatewayCodeToJSONRPCCode(frameErr.Code), @@ -58,6 +133,90 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru frameErr.Code, ), ) + if metrics != nil { + metrics.IncRequests(source, method, "error") + if frameErr.Code == ErrorCodeUnauthorized.String() { + metrics.IncAuthFailures(source, frameErr.Code) + } + if frameErr.Code == ErrorCodeAccessDenied.String() { + metrics.IncACLDenied(source, method) + } + } + emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ + RequestID: normalized.RequestID, + SessionID: normalized.SessionID, + Method: method, + Source: source, + Status: "error", + GatewayCode: frameErr.Code, + LatencyMS: requestLatencyMS(startedAt), + }) + return rpcResponse +} + +// authorizeRPCRequest 统一执行控制面认证与 ACL 授权。 +func authorizeRPCRequest(ctx context.Context, method, action string) *protocol.JSONRPCError { + normalizedAction := strings.ToLower(strings.TrimSpace(action)) + if normalizedAction == string(FrameActionAuthenticate) { + if !isMethodAllowedByACL(ctx, method) { + return protocol.NewJSONRPCError( + protocol.MapGatewayCodeToJSONRPCCode(ErrorCodeAccessDenied.String()), + "access denied", + ErrorCodeAccessDenied.String(), + ) + } + return nil + } + + if !isRequestAuthenticated(ctx) { + return protocol.NewJSONRPCError( + protocol.MapGatewayCodeToJSONRPCCode(ErrorCodeUnauthorized.String()), + "unauthorized", + ErrorCodeUnauthorized.String(), + ) + } + if !isMethodAllowedByACL(ctx, method) { + return protocol.NewJSONRPCError( + protocol.MapGatewayCodeToJSONRPCCode(ErrorCodeAccessDenied.String()), + "access denied", + ErrorCodeAccessDenied.String(), + ) + } + return nil +} + +// isRequestAuthenticated 判断请求是否处于已认证状态。 +func isRequestAuthenticated(ctx context.Context) bool { + authState, stateExists := ConnectionAuthStateFromContext(ctx) + if stateExists && authState.IsAuthenticated() { + return true + } + + authenticator, hasAuthenticator := TokenAuthenticatorFromContext(ctx) + if !hasAuthenticator { + return true + } + requestToken := RequestTokenFromContext(ctx) + if requestToken == "" { + return false + } + return authenticator.ValidateToken(requestToken) +} + +// isMethodAllowedByACL 按 source + method 判定 ACL 放行结果。 +func isMethodAllowedByACL(ctx context.Context, method string) bool { + acl, hasACL := RequestACLFromContext(ctx) + if !hasACL { + return true + } + source := RequestSourceFromContext(ctx) + return acl.IsAllowed(source, method) +} + +// nilSafeLoggerFromContext 返回上下文中注入的 logger，未注入时返回 nil。 +func nilSafeLoggerFromContext(ctx context.Context) *log.Logger { + logger, _ := GatewayLoggerFromContext(ctx) + return logger } // dispatchFrame 统一校验并分发网关 MessageFrame，请求动作会进入注册处理器。 @@ -121,6 +280,9 @@ func applyAutomaticBinding(ctx context.Context, frame MessageFrame) { if frame.Action == FrameActionBindStream { return } + if frame.Action == FrameActionAuthenticate { + return + } relay.AutoBindFromFrame(connectionID, frame) } diff --git a/internal/gateway/rpc_dispatch_test.go b/internal/gateway/rpc_dispatch_test.go index 8b8d64da..433631f3 100644 --- a/internal/gateway/rpc_dispatch_test.go +++ b/internal/gateway/rpc_dispatch_test.go @@ -3,6 +3,7 @@ package gateway import ( "context" "encoding/json" + "strings" "testing" "time" @@ -150,3 +151,99 @@ func TestDispatchFrameValidationBranches(t *testing.T) { t.Fatalf("response error = %#v, want invalid_frame", response.Error) } } + +func TestDispatchRPCRequestUnauthorizedAndAccessDenied(t *testing.T) { + authenticator := staticTokenAuthenticator{token: "t-1"} + authState := NewConnectionAuthState() + baseContext := WithRequestSource(context.Background(), RequestSourceHTTP) + baseContext = WithTokenAuthenticator(baseContext, authenticator) + baseContext = WithConnectionAuthState(baseContext, authState) + baseContext = WithRequestACL(baseContext, NewStrictControlPlaneACL()) + + unauthorizedResponse := dispatchRPCRequest(baseContext, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-unauthorized"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }, nil) + if unauthorizedResponse.Error == nil { + t.Fatal("expected unauthorized response") + } + if gatewayCode := protocol.GatewayCodeFromJSONRPCError(unauthorizedResponse.Error); gatewayCode != ErrorCodeUnauthorized.String() { + t.Fatalf("gateway_code = %q, want %q", gatewayCode, ErrorCodeUnauthorized.String()) + } + + deniedACL := &ControlPlaneACL{ + mode: ACLModeStrict, + allow: map[RequestSource]map[string]struct{}{}, + enabled: true, + } + deniedContext := WithRequestACL(baseContext, deniedACL) + deniedContext = WithRequestToken(deniedContext, "t-1") + deniedContext = WithConnectionAuthState(deniedContext, authState) + authState.MarkAuthenticated() + + deniedResponse := dispatchRPCRequest(deniedContext, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-denied"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }, nil) + if deniedResponse.Error == nil { + t.Fatal("expected access denied response") + } + if gatewayCode := protocol.GatewayCodeFromJSONRPCError(deniedResponse.Error); gatewayCode != ErrorCodeAccessDenied.String() { + t.Fatalf("gateway_code = %q, want %q", gatewayCode, ErrorCodeAccessDenied.String()) + } +} + +func TestDispatchRPCRequestAuthenticateThenPing(t *testing.T) { + authenticator := staticTokenAuthenticator{token: "token-2"} + authState := NewConnectionAuthState() + ctx := WithRequestSource(context.Background(), RequestSourceIPC) + ctx = WithTokenAuthenticator(ctx, authenticator) + ctx = WithConnectionAuthState(ctx, authState) + ctx = WithRequestACL(ctx, NewStrictControlPlaneACL()) + + authResponse := dispatchRPCRequest(ctx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-auth"`), + Method: protocol.MethodGatewayAuthenticate, + Params: json.RawMessage(`{"token":"token-2"}`), + }, nil) + if authResponse.Error != nil { + t.Fatalf("authenticate response error: %+v", authResponse.Error) + } + authFrame, err := decodeJSONRPCResultFrame(authResponse) + if err != nil { + t.Fatalf("decode auth frame: %v", err) + } + if authFrame.Action != FrameActionAuthenticate { + t.Fatalf("auth action = %q, want %q", authFrame.Action, FrameActionAuthenticate) + } + + pingResponse := dispatchRPCRequest(ctx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-ping"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }, nil) + if pingResponse.Error != nil { + t.Fatalf("ping response error: %+v", pingResponse.Error) + } + pingFrame, err := decodeJSONRPCResultFrame(pingResponse) + if err != nil { + t.Fatalf("decode ping frame: %v", err) + } + if pingFrame.Action != FrameActionPing { + t.Fatalf("ping action = %q, want %q", pingFrame.Action, FrameActionPing) + } + payloadMap, ok := pingFrame.Payload.(map[string]any) + if !ok { + t.Fatalf("ping payload type = %T, want map[string]any", pingFrame.Payload) + } + version, _ := payloadMap["version"].(string) + if strings.TrimSpace(version) == "" { + t.Fatal("ping payload should include version") + } +} diff --git a/internal/gateway/server.go b/internal/gateway/server.go index d507130c..ec9bec5a 100644 --- a/internal/gateway/server.go +++ b/internal/gateway/server.go @@ -42,9 +42,13 @@ type ServerOptions struct { ListenAddress string Logger *log.Logger MaxConnections int + MaxFrameSize int64 ReadTimeout time.Duration WriteTimeout time.Duration Relay *StreamRelay + Authenticator TokenAuthenticator + ACL *ControlPlaneACL + Metrics *GatewayMetrics listenFn func(address string) (net.Listener, error) } @@ -54,9 +58,13 @@ type Server struct { logger *log.Logger listenFn func(address string) (net.Listener, error) maxConnections int + maxFrameSize int64 readTimeout time.Duration writeTimeout time.Duration relay *StreamRelay + authenticator TokenAuthenticator + acl *ControlPlaneACL + metrics *GatewayMetrics mu sync.Mutex listener net.Listener @@ -104,21 +112,37 @@ func NewServer(options ServerOptions) (*Server, error) { writeTimeout = DefaultWriteTimeout } + maxFrameSize := options.MaxFrameSize + if maxFrameSize <= 0 { + maxFrameSize = MaxFrameSize + } + relay := options.Relay if relay == nil { relay = NewStreamRelay(StreamRelayOptions{ - Logger: logger, + Logger: logger, + Metrics: options.Metrics, }) } + authenticator := options.Authenticator + acl := options.ACL + if acl == nil && authenticator != nil { + acl = NewStrictControlPlaneACL() + } + return &Server{ listenAddress: listenAddress, logger: logger, listenFn: listenFn, maxConnections: maxConnections, + maxFrameSize: maxFrameSize, readTimeout: readTimeout, writeTimeout: writeTimeout, relay: relay, + authenticator: authenticator, + acl: acl, + metrics: options.Metrics, conns: make(map[net.Conn]struct{}), }, nil } @@ -146,7 +170,7 @@ func (s *Server) Serve(ctx context.Context, runtimePort RuntimePort) error { s.logger.Printf("listening on %s", s.listenAddress) if s.relay == nil { - s.relay = NewStreamRelay(StreamRelayOptions{Logger: s.logger}) + s.relay = NewStreamRelay(StreamRelayOptions{Logger: s.logger, Metrics: s.metrics}) } s.relay.Start(ctx, runtimePort) @@ -266,6 +290,10 @@ func (s *Server) handleConnection(ctx context.Context, conn net.Conn, runtimePor }() reader := bufio.NewReader(conn) + maxFrameSize := s.maxFrameSize + if maxFrameSize <= 0 { + maxFrameSize = MaxFrameSize + } connectionContext, cancelConnection := context.WithCancel(ctx) defer cancelConnection() @@ -278,6 +306,18 @@ func (s *Server) handleConnection(ctx context.Context, conn net.Conn, runtimePor connectionID := NewConnectionID() connectionContext = WithConnectionID(connectionContext, connectionID) connectionContext = WithStreamRelay(connectionContext, relay) + connectionContext = WithRequestSource(connectionContext, RequestSourceIPC) + connectionContext = WithConnectionAuthState(connectionContext, NewConnectionAuthState()) + if s.authenticator != nil { + connectionContext = WithTokenAuthenticator(connectionContext, s.authenticator) + } + if s.acl != nil { + connectionContext = WithRequestACL(connectionContext, s.acl) + } + if s.metrics != nil { + connectionContext = WithGatewayMetrics(connectionContext, s.metrics) + } + connectionContext = WithGatewayLogger(connectionContext, s.logger) encoder := json.NewEncoder(conn) registerErr := relay.RegisterConnection(ConnectionRegistration{ @@ -316,7 +356,7 @@ func (s *Server) handleConnection(ctx context.Context, conn net.Conn, runtimePor return } - rpcRequest, err := decodeRPCRequest(reader) + rpcRequest, err := decodeRPCRequest(reader, maxFrameSize) if err != nil { if errors.Is(err, io.EOF) { return @@ -334,7 +374,7 @@ func (s *Server) handleConnection(ctx context.Context, conn net.Conn, runtimePor nil, protocol.NewJSONRPCError( protocol.JSONRPCCodeInvalidRequest, - fmt.Sprintf("frame exceeds max size %d bytes", MaxFrameSize), + fmt.Sprintf("frame exceeds max size %d bytes", maxFrameSize), protocol.GatewayCodeInvalidFrame, ), )) @@ -383,13 +423,13 @@ func isTimeoutError(err error) bool { } // decodeRPCRequest 从连接读取一条 JSON-RPC 请求并执行长度与格式校验。 -func decodeRPCRequest(reader *bufio.Reader) (protocol.JSONRPCRequest, error) { - payload, err := readFramePayload(reader, MaxFrameSize) +func decodeRPCRequest(reader *bufio.Reader, maxFrameSize int64) (protocol.JSONRPCRequest, error) { + payload, err := readFramePayload(reader, maxFrameSize) if err != nil { return protocol.JSONRPCRequest{}, err } - limitedReader := &io.LimitedReader{R: bytes.NewReader(payload), N: MaxFrameSize} + limitedReader := &io.LimitedReader{R: bytes.NewReader(payload), N: maxFrameSize} decoder := json.NewDecoder(limitedReader) var request protocol.JSONRPCRequest diff --git a/internal/gateway/server_additional_test.go b/internal/gateway/server_additional_test.go index 5c5e88e5..14e567cf 100644 --- a/internal/gateway/server_additional_test.go +++ b/internal/gateway/server_additional_test.go @@ -260,7 +260,7 @@ func TestCloseStopsRelayBackgroundLoops(t *testing.T) { func TestDecodeRPCRequestTrailingJSON(t *testing.T) { reader := bufio.NewReader(strings.NewReader(`{"jsonrpc":"2.0","id":"x","method":"gateway.ping"} {"extra":1}` + "\n")) - _, err := decodeRPCRequest(reader) + _, err := decodeRPCRequest(reader, MaxFrameSize) if err == nil || !strings.Contains(err.Error(), "trailing") { t.Fatalf("expected trailing json error, got %v", err) } diff --git a/internal/gateway/server_test.go b/internal/gateway/server_test.go index dd9261e0..27e241f8 100644 --- a/internal/gateway/server_test.go +++ b/internal/gateway/server_test.go @@ -280,6 +280,91 @@ func TestServerHandleConnectionRelaysRuntimeEventAfterBindStream(t *testing.T) { } } +func TestServerHandleConnectionAuthenticateFlow(t *testing.T) { + t.Parallel() + + server := &Server{ + logger: log.New(io.Discard, "", 0), + authenticator: staticTokenAuthenticator{token: "secret-token"}, + acl: NewStrictControlPlaneACL(), + } + serverConn, clientConn := net.Pipe() + done := make(chan struct{}) + + go func() { + defer close(done) + server.handleConnection(context.Background(), serverConn, nil) + }() + + encoder := json.NewEncoder(clientConn) + decoder := json.NewDecoder(clientConn) + + if err := encoder.Encode(protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"unauth-1"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }); err != nil { + t.Fatalf("encode unauthorized ping: %v", err) + } + var unauthorizedResponse protocol.JSONRPCResponse + if err := decoder.Decode(&unauthorizedResponse); err != nil { + t.Fatalf("decode unauthorized response: %v", err) + } + if unauthorizedResponse.Error == nil { + t.Fatal("expected unauthorized error") + } + if code := protocol.GatewayCodeFromJSONRPCError(unauthorizedResponse.Error); code != ErrorCodeUnauthorized.String() { + t.Fatalf("gateway_code = %q, want %q", code, ErrorCodeUnauthorized.String()) + } + + if err := encoder.Encode(protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"auth-1"`), + Method: protocol.MethodGatewayAuthenticate, + Params: json.RawMessage(`{"token":"secret-token"}`), + }); err != nil { + t.Fatalf("encode authenticate request: %v", err) + } + var authResponse protocol.JSONRPCResponse + if err := decoder.Decode(&authResponse); err != nil { + t.Fatalf("decode authenticate response: %v", err) + } + if authResponse.Error != nil { + t.Fatalf("unexpected auth error: %+v", authResponse.Error) + } + + if err := encoder.Encode(protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"ping-2"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }); err != nil { + t.Fatalf("encode authorized ping: %v", err) + } + var pingResponse protocol.JSONRPCResponse + if err := decoder.Decode(&pingResponse); err != nil { + t.Fatalf("decode ping response: %v", err) + } + if pingResponse.Error != nil { + t.Fatalf("unexpected ping error: %+v", pingResponse.Error) + } + pingFrame, err := decodeJSONRPCResultFrame(pingResponse) + if err != nil { + t.Fatalf("decode ping frame: %v", err) + } + if pingFrame.Action != FrameActionPing { + t.Fatalf("action = %q, want %q", pingFrame.Action, FrameActionPing) + } + + _ = clientConn.Close() + select { + case <-done: + case <-time.After(2 * time.Second): + t.Fatal("handleConnection did not exit") + } +} + type runtimePortEventStub struct { events <-chan RuntimeEvent } diff --git a/internal/gateway/stream_relay.go b/internal/gateway/stream_relay.go index 33588b67..6a0020ac 100644 --- a/internal/gateway/stream_relay.go +++ b/internal/gateway/stream_relay.go @@ -64,6 +64,8 @@ type StreamRelayOptions struct { QueueSize int // MaxBindingsPerConnection 控制单连接可建立的会话绑定上限。 MaxBindingsPerConnection int + // Metrics 为可选指标收集器，用于上报连接与丢弃统计。 + Metrics *GatewayMetrics } type relayConnection struct { @@ -98,6 +100,7 @@ type StreamRelay struct { cleanupInterval time.Duration queueSize int maxBindings int + metrics *GatewayMetrics mu sync.RWMutex connections map[ConnectionID]*relayConnection @@ -145,6 +148,7 @@ func NewStreamRelay(options StreamRelayOptions) *StreamRelay { cleanupInterval: cleanupInterval, queueSize: queueSize, maxBindings: maxBindings, + metrics: options.Metrics, connections: make(map[ConnectionID]*relayConnection), connectionBindings: make(map[ConnectionID]map[bindingKey]*bindingState), sessionIndex: make(map[string]map[ConnectionID]struct{}), @@ -259,12 +263,35 @@ func (r *StreamRelay) RegisterConnection(registration ConnectionRegistration) er queue: make(chan RelayMessage, r.queueSize), } r.connections[connectionID] = connection + r.updateActiveConnectionMetricsLocked() r.mu.Unlock() go r.runConnectionWriter(connection) return nil } +// SnapshotConnectionCounts 返回当前不同通道的活跃连接数量快照。 +func (r *StreamRelay) SnapshotConnectionCounts() map[StreamChannel]int { + if r == nil { + return map[StreamChannel]int{} + } + snapshot := map[StreamChannel]int{ + StreamChannelIPC: 0, + StreamChannelWS: 0, + StreamChannelSSE: 0, + } + + r.mu.RLock() + for _, connection := range r.connections { + if connection == nil { + continue + } + snapshot[connection.channel]++ + } + r.mu.RUnlock() + return snapshot +} + // SendJSONRPCResponse 将 JSON-RPC 响应写入连接发送队列。 func (r *StreamRelay) SendJSONRPCResponse(connectionID ConnectionID, response protocol.JSONRPCResponse) bool { return r.enqueueMessage(connectionID, RelayMessage{ @@ -531,6 +558,9 @@ func (r *StreamRelay) runConnectionWriter(connection *relayConnection) { } if err := r.writeConnectionMessage(connection, message); err != nil { r.logger.Printf("connection %s write failed: %v", connection.id, err) + if r.metrics != nil { + r.metrics.IncStreamDropped("write_failed") + } r.dropConnection(connection.id) return } @@ -568,6 +598,9 @@ func (r *StreamRelay) enqueueMessage(connectionID ConnectionID, message RelayMes return true default: r.logger.Printf("connection %s queue is full, dropping slow connection", normalizedConnectionID) + if r.metrics != nil { + r.metrics.IncStreamDropped("queue_full") + } r.dropConnection(normalizedConnectionID) return false } @@ -643,6 +676,7 @@ func (r *StreamRelay) unregisterConnection(connectionID ConnectionID, shouldClos } r.removeConnectionFromIndexesLocked(normalizedConnectionID, state.sessionID, state.runID) } + r.updateActiveConnectionMetricsLocked() r.mu.Unlock() if shouldClose { @@ -652,6 +686,27 @@ func (r *StreamRelay) unregisterConnection(connectionID ConnectionID, shouldClos return connection } +// updateActiveConnectionMetricsLocked 在持锁状态下刷新连接活跃数指标。 +func (r *StreamRelay) updateActiveConnectionMetricsLocked() { + if r.metrics == nil { + return + } + counts := map[StreamChannel]int{ + StreamChannelIPC: 0, + StreamChannelWS: 0, + StreamChannelSSE: 0, + } + for _, connection := range r.connections { + if connection == nil { + continue + } + counts[connection.channel]++ + } + r.metrics.SetConnectionsActive(string(StreamChannelIPC), counts[StreamChannelIPC]) + r.metrics.SetConnectionsActive(string(StreamChannelWS), counts[StreamChannelWS]) + r.metrics.SetConnectionsActive(string(StreamChannelSSE), counts[StreamChannelSSE]) +} + // runCleanupLoop 周期性扫描并清理过期绑定，避免路由表长期膨胀。 func (r *StreamRelay) runCleanupLoop(ctx context.Context, generation uint64) { ticker := time.NewTicker(r.cleanupInterval) diff --git a/internal/gateway/validate.go b/internal/gateway/validate.go index 4e47090d..2ffe4374 100644 --- a/internal/gateway/validate.go +++ b/internal/gateway/validate.go @@ -30,6 +30,11 @@ func validateRequestFrame(frame MessageFrame) *FrameError { } switch frame.Action { + case FrameActionAuthenticate: + if frame.Payload == nil { + return NewMissingRequiredFieldError("payload") + } + return nil case FrameActionPing: return nil case FrameActionBindStream: @@ -180,7 +185,8 @@ func isValidFrameType(frameType FrameType) bool { // isValidFrameAction 判断动作是否属于协议定义集合。 func isValidFrameAction(action FrameAction) bool { switch action { - case FrameActionPing, + case FrameActionAuthenticate, + FrameActionPing, FrameActionBindStream, FrameActionWakeOpenURL, FrameActionRun, From c75192d02a93bffa0f220b4ce6e751f568a267cf Mon Sep 17 00:00:00 2001 From: pionxe Date: Thu, 16 Apr 2026 23:40:23 +0800 Subject: [PATCH 04/12] =?UTF-8?q?docs(gateway):=20[EPIC-GW-06]=20=E8=A1=A5?= =?UTF-8?q?=E9=BD=90=E8=AF=A6=E7=BB=86=E8=AE=BE=E8=AE=A1=E6=96=87=E6=A1=A3?= =?UTF-8?q?=E5=B9=B6=E5=AE=8C=E6=88=90=20CLI=20=E7=BB=84=E8=A3=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gateway 核心底座竣工： 1. CLI 桥接：令 neocode gateway 命令完整支持配置文件读取与 flags 覆盖叠加。 2. URL 适配器更新：URL 唤醒机制同步兼容新的鉴权与配置底座。 3. 架构文档：新增 gateway-detailed-design.md，使用 Mermaid 序列图清晰界定本地/云端流向及网关职责边界。 4. 接口契约：同步更新 README 中的监控、排障与运维指南。 --- README.md | 21 ++ docs/gateway-detailed-design.md | 204 ++++++++++++++++++ internal/cli/gateway_commands.go | 184 +++++++++++++++- internal/cli/root_test.go | 65 ++++++ .../gateway/adapters/urlscheme/dispatcher.go | 102 +++++++-- .../adapters/urlscheme/dispatcher_test.go | 127 +++++++++++ 6 files changed, 676 insertions(+), 27 deletions(-) create mode 100644 docs/gateway-detailed-design.md diff --git a/README.md b/README.md index c1b4dd78..cfc9ec7f 100644 --- a/README.md +++ b/README.md @@ -171,6 +171,27 @@ go run ./cmd/neocode --workdir /path/to/workspace - 不提交明文密钥、个人配置或会话数据 - 不提交无关改动与临时文件 +## 网关运维与安全（GW-06） + +- 静默认证（Silent Auth）： + - 启动 `neocode gateway` 时会自动读取 `~/.neocode/auth.json`。 + - 若凭证不存在或损坏，会自动生成高强度 token 并写回该文件。 + - `url-dispatch` 会自动读取同一 token 并先发送 `gateway.authenticate`，再发送业务请求。 +- 认证与授权顺序：`Auth -> ACL -> Dispatch`。 + - 未认证返回 `unauthorized`。 + - 已认证但不允许的方法返回 `access_denied`。 +- 运维端点： + - 免鉴权：`GET /healthz`、`GET /version` + - 需鉴权：`GET /metrics`、`GET /metrics.json`（`Authorization: Bearer `） +- 关键默认治理参数（可通过 `config.yaml` 的 `gateway.*` 配置）： + - `max_frame_bytes=1MiB` + - `ipc_max_connections=128` + - `http_max_request_bytes=1MiB` + - `http_max_stream_connections=128` + - `ipc_read/write_sec=30/30` + - `http_read/write/shutdown_sec=15/15/2` +- 详细设计文档：[`docs/gateway-detailed-design.md`](docs/gateway-detailed-design.md) + ## License MIT diff --git a/docs/gateway-detailed-design.md b/docs/gateway-detailed-design.md new file mode 100644 index 00000000..4d60d6ed --- /dev/null +++ b/docs/gateway-detailed-design.md @@ -0,0 +1,204 @@ +# Gateway 详细设计（EPIC-GW-06） + +## 1. 目标与边界 + +Gateway 是 NeoCode 的协议与路由中枢，职责是： + +- 生命周期管理（IPC + HTTP/WS/SSE 并行启动、优雅关闭） +- 协议归一化（外层 JSON-RPC 2.0，内层 `gateway.MessageFrame`） +- 鉴权与 ACL（`Auth -> ACL -> Dispatch`） +- 会话流式中继（session/run/channel 精准投递） + +Gateway **不承载业务逻辑**，不会做模型推理、工具编排与 Provider 选择。业务执行仅由 Runtime 决定。 + +## 2. 架构图（含进程边界） + +```mermaid +flowchart LR + subgraph ClientProcess["客户端进程边界"] + CLI["CLI / TUI"] + WEB["Web / Desktop UI"] + EXT["External Adapter\nURL Scheme / Clipboard"] + end + + subgraph GatewayProcess["Gateway 进程边界"] + IPC["IPC Listener\nUDS / Named Pipe"] + NET["HTTP/WS/SSE Listener"] + AUTH["Auth + ACL"] + NORM["JSON-RPC -> MessageFrame\nNormalize"] + ROUTER["Dispatch + Stream Relay"] + OPS["Health / Version / Metrics"] + end + + subgraph RuntimeProcess["Runtime 进程边界"] + RT["RuntimePort\n编排与事件流"] + TOOLS["Tools"] + PROVIDER["Provider Adapter"] + end + + subgraph CloudBoundary["云端边界"] + CLOUD["Cloud LLM API"] + end + + CLI --> IPC + WEB --> NET + EXT --> IPC + EXT --> NET + + IPC --> AUTH + NET --> AUTH + AUTH --> NORM + NORM --> ROUTER + ROUTER --> RT + ROUTER --> OPS + + RT --> TOOLS + RT --> PROVIDER + PROVIDER --> CLOUD +``` + +## 3. 核心时序图 + +### 3.1 本地控制面链路（Client -> Gateway -> Runtime -> Client） + +```mermaid +sequenceDiagram + box rgb(238, 246, 255) 客户端进程 + participant C as "Client (CLI/WS/SSE)" + end + box rgb(241, 255, 241) Gateway 进程 + participant G as "Gateway Listener" + participant A as "Auth + ACL" + participant D as "Normalize + Dispatch" + participant R as "Stream Relay" + end + box rgb(255, 249, 238) Runtime 进程 + participant RT as "RuntimePort" + end + + C->>G: JSON-RPC request + G->>A: 校验 Token / ACL + A-->>G: allow + G->>D: Normalize(JSON-RPC -> MessageFrame) + D->>RT: RuntimePort 调用（无业务改写） + RT-->>D: 结果 / 事件 + D->>R: MessageFrame(event/ack/error) + R-->>C: JSON-RPC response/notification +``` + +### 3.2 云端调用链路（Runtime -> Provider -> Cloud API） + +```mermaid +sequenceDiagram + box rgb(238, 246, 255) 客户端进程 + participant C as "Client" + end + box rgb(241, 255, 241) Gateway 进程 + participant G as "Gateway" + end + box rgb(255, 249, 238) Runtime 进程 + participant RT as "Runtime" + participant P as "Provider Adapter" + end + box rgb(255, 240, 245) 云端边界 + participant LLM as "Cloud LLM API" + end + + C->>G: gateway.run / wake.openUrl + G->>RT: 透传规范化请求 + RT->>P: 选择并调用 Provider + P->>LLM: HTTP API + LLM-->>P: streaming/result + P-->>RT: 统一 Provider 结果 + RT-->>G: runtime events + G-->>C: gateway.event / result +``` + +## 4. 数据流向（本地端与云端区别） + +- 本地控制面： + - 客户端只与 Gateway 通信（IPC/HTTP/WS/SSE）。 + - Gateway 负责协议、连接、鉴权、路由与中继。 + - 本地控制面不直接触达云端。 +- 云端调用： + - 仅 Runtime 与 Provider 层触达 Cloud API。 + - Gateway 不感知模型厂商细节，不拼接 Provider 私有字段。 + +## 5. 对外接口清单 + +### 5.1 面向客户端接口 + +| 接口 | 方向 | 认证 | 说明 | +|---|---|---|---| +| IPC (UDS / Named Pipe) | Client -> Gateway | `gateway.authenticate` 握手后复用 | 本地控制面主入口 | +| `POST /rpc` | Client -> Gateway | `Authorization: Bearer ` | 单次 JSON-RPC 请求 | +| `GET /ws` | Client <-> Gateway | `gateway.authenticate` 握手后复用 | 双向流式请求与通知 | +| `GET /sse` | Client <- Gateway | `?token=` | 单向流式通知与心跳 | +| `GET /healthz` | Client -> Gateway | 无 | 健康检查 | +| `GET /version` | Client -> Gateway | 无 | 版本信息 | +| `GET /metrics` | Client -> Gateway | Bearer Token | Prometheus 指标 | +| `GET /metrics.json` | Client -> Gateway | Bearer Token | JSON 指标快照 | + +### 5.2 JSON-RPC 方法 + +| Method | 方向 | 说明 | +|---|---|---| +| `gateway.authenticate` | request/response | 连接级鉴权，成功后复用认证态 | +| `gateway.ping` | request/response | 健康探针 | +| `gateway.bindStream` | request/response | 会话流绑定 | +| `wake.openUrl` | request/response | URL Scheme 唤醒入口 | +| `gateway.event` | notification | Gateway 推送运行时事件 | + +### 5.3 面向 Runtime 接口（`RuntimePort`） + +| 方法 | 说明 | +|---|---| +| `Run(ctx, input)` | 发起一次运行编排 | +| `Compact(ctx, input)` | 执行会话压缩 | +| `ResolvePermission(ctx, input)` | 回填权限审批结果 | +| `CancelActiveRun()` | 取消活动运行 | +| `Events()` | 订阅运行时事件流 | +| `ListSessions(ctx)` | 获取会话摘要 | +| `LoadSession(ctx, id)` | 加载会话详情 | + +## 6. 安全与治理基线 + +### 6.1 Silent Auth + +- Token 文件：`~/.neocode/auth.json` +- 启动网关时自动加载；缺失或损坏自动重建 +- 文件结构：`version`, `token`, `created_at`, `updated_at` + +### 6.2 ACL 与错误模型 + +- 执行顺序：`Auth -> ACL -> Dispatch` +- 错误返回统一： + - JSON-RPC：`error.code` + - Gateway 稳定码：`error.data.gateway_code` +- 关键稳定码：`unauthorized`, `access_denied`, `invalid_frame`, `unsupported_action` + +### 6.3 默认治理参数 + +| 配置项 | 默认值 | +|---|---| +| `gateway.limits.max_frame_bytes` | `1048576` | +| `gateway.limits.ipc_max_connections` | `128` | +| `gateway.limits.http_max_request_bytes` | `1048576` | +| `gateway.limits.http_max_stream_connections` | `128` | +| `gateway.timeouts.ipc_read_sec` | `30` | +| `gateway.timeouts.ipc_write_sec` | `30` | +| `gateway.timeouts.http_read_sec` | `15` | +| `gateway.timeouts.http_write_sec` | `15` | +| `gateway.timeouts.http_shutdown_sec` | `2` | +| `gateway.observability.metrics_enabled` | `true` | + +## 7. 配置优先级 + +- `flags > config.yaml > default constants` +- 当前支持通过 `~/.neocode/config.yaml` 的 `gateway.*` 段配置治理参数。 + +## 8. 非目标（本期） + +- 不新增 Provider/Tools 业务能力 +- 不引入外网公开监听与 TLS +- 不在 Gateway 内实现 Runtime 业务决策 diff --git a/internal/cli/gateway_commands.go b/internal/cli/gateway_commands.go index 09ba9731..c25bc844 100644 --- a/internal/cli/gateway_commands.go +++ b/internal/cli/gateway_commands.go @@ -11,11 +11,14 @@ import ( "os/signal" "strings" "syscall" + "time" "github.com/spf13/cobra" + "neo-code/internal/config" "neo-code/internal/gateway" "neo-code/internal/gateway/adapters/urlscheme" + gatewayauth "neo-code/internal/gateway/auth" ) const ( @@ -29,6 +32,8 @@ var ( newGatewayServer = defaultNewGatewayServer newGatewayNetwork = defaultNewGatewayNetworkServer dispatchURLThroughIPC = urlscheme.Dispatch + newAuthManager = gatewayauth.NewManager + loadAuthToken = loadGatewayAuthToken exitProcess = os.Exit writeDispatchError = writeURLDispatchErrorOutput writeDispatchSuccess = writeURLDispatchSuccessOutput @@ -38,11 +43,28 @@ type gatewayCommandOptions struct { ListenAddress string HTTPAddress string LogLevel string + TokenFile string + ACLMode string + + MaxFrameBytes int + IPCMaxConnections int + HTTPMaxRequestBytes int + HTTPMaxStreamConnections int + + IPCReadSec int + IPCWriteSec int + HTTPReadSec int + HTTPWriteSec int + HTTPShutdownSec int + + MetricsEnabled bool + MetricsEnabledOverridden bool } type urlDispatchCommandOptions struct { URL string ListenAddress string + TokenFile string } type urlDispatchSuccessOutput struct { @@ -90,6 +112,22 @@ func newGatewayCommand() *cobra.Command { ListenAddress: strings.TrimSpace(options.ListenAddress), HTTPAddress: strings.TrimSpace(options.HTTPAddress), LogLevel: normalizedLogLevel, + TokenFile: strings.TrimSpace(options.TokenFile), + ACLMode: strings.TrimSpace(options.ACLMode), + + MaxFrameBytes: options.MaxFrameBytes, + IPCMaxConnections: options.IPCMaxConnections, + HTTPMaxRequestBytes: options.HTTPMaxRequestBytes, + HTTPMaxStreamConnections: options.HTTPMaxStreamConnections, + + IPCReadSec: options.IPCReadSec, + IPCWriteSec: options.IPCWriteSec, + HTTPReadSec: options.HTTPReadSec, + HTTPWriteSec: options.HTTPWriteSec, + HTTPShutdownSec: options.HTTPShutdownSec, + + MetricsEnabled: options.MetricsEnabled, + MetricsEnabledOverridden: cmd.Flags().Changed("metrics-enabled"), }) }, } @@ -102,6 +140,28 @@ func newGatewayCommand() *cobra.Command { "gateway network listen address (loopback only)", ) cmd.Flags().StringVar(&options.LogLevel, "log-level", defaultGatewayLogLevel, "gateway log level: debug|info|warn|error") + cmd.Flags().StringVar(&options.TokenFile, "token-file", "", "gateway auth token file path (default ~/.neocode/auth.json)") + cmd.Flags().StringVar(&options.ACLMode, "acl-mode", "", "gateway acl mode override (strict)") + cmd.Flags().IntVar(&options.MaxFrameBytes, "max-frame-bytes", 0, "gateway max frame bytes override") + cmd.Flags().IntVar(&options.IPCMaxConnections, "ipc-max-connections", 0, "gateway ipc max connections override") + cmd.Flags().IntVar(&options.HTTPMaxRequestBytes, "http-max-request-bytes", 0, "gateway http max request bytes override") + cmd.Flags().IntVar( + &options.HTTPMaxStreamConnections, + "http-max-stream-connections", + 0, + "gateway http max stream connections override", + ) + cmd.Flags().IntVar(&options.IPCReadSec, "ipc-read-sec", 0, "gateway ipc read timeout seconds override") + cmd.Flags().IntVar(&options.IPCWriteSec, "ipc-write-sec", 0, "gateway ipc write timeout seconds override") + cmd.Flags().IntVar(&options.HTTPReadSec, "http-read-sec", 0, "gateway http read timeout seconds override") + cmd.Flags().IntVar(&options.HTTPWriteSec, "http-write-sec", 0, "gateway http write timeout seconds override") + cmd.Flags().IntVar( + &options.HTTPShutdownSec, + "http-shutdown-sec", + 0, + "gateway http shutdown timeout seconds override", + ) + cmd.Flags().BoolVar(&options.MetricsEnabled, "metrics-enabled", false, "gateway metrics enable override") return cmd } @@ -124,22 +184,63 @@ func defaultGatewayCommandRunner(ctx context.Context, options gatewayCommandOpti signalContext, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM) defer stop() + + gatewayConfig, err := config.LoadGatewayConfig(signalContext, "") + if err != nil { + return err + } + applyGatewayFlagOverrides(&gatewayConfig, options) + if err := gatewayConfig.Validate(); err != nil { + return fmt.Errorf("gateway config override invalid: %w", err) + } + + tokenFile := strings.TrimSpace(options.TokenFile) + if tokenFile == "" { + tokenFile = strings.TrimSpace(gatewayConfig.Security.TokenFile) + } + + authManager, err := newAuthManager(tokenFile) + if err != nil { + return fmt.Errorf("initialize gateway auth manager: %w", err) + } + var metrics *gateway.GatewayMetrics + if gatewayConfig.Observability.Enabled() { + metrics = gateway.NewGatewayMetrics() + } + acl := gateway.NewStrictControlPlaneACL() relay := gateway.NewStreamRelay(gateway.StreamRelayOptions{ - Logger: logger, + Logger: logger, + Metrics: metrics, }) ipcServer, err := newGatewayServer(gateway.ServerOptions{ - ListenAddress: options.ListenAddress, - Logger: logger, - Relay: relay, + ListenAddress: options.ListenAddress, + Logger: logger, + MaxConnections: gatewayConfig.Limits.IPCMaxConnections, + MaxFrameSize: int64(gatewayConfig.Limits.MaxFrameBytes), + ReadTimeout: time.Duration(gatewayConfig.Timeouts.IPCReadSec) * time.Second, + WriteTimeout: time.Duration(gatewayConfig.Timeouts.IPCWriteSec) * time.Second, + Relay: relay, + Authenticator: authManager, + ACL: acl, + Metrics: metrics, }) if err != nil { return err } networkServer, err := newGatewayNetwork(gateway.NetworkServerOptions{ - ListenAddress: options.HTTPAddress, - Logger: logger, - Relay: relay, + ListenAddress: options.HTTPAddress, + Logger: logger, + ReadTimeout: time.Duration(gatewayConfig.Timeouts.HTTPReadSec) * time.Second, + WriteTimeout: time.Duration(gatewayConfig.Timeouts.HTTPWriteSec) * time.Second, + ShutdownTimeout: time.Duration(gatewayConfig.Timeouts.HTTPShutdownSec) * time.Second, + MaxRequestBytes: int64(gatewayConfig.Limits.HTTPMaxRequestBytes), + MaxStreamConnections: gatewayConfig.Limits.HTTPMaxStreamConnections, + Relay: relay, + Authenticator: authManager, + ACL: acl, + Metrics: metrics, + AllowedOrigins: gatewayConfig.Security.AllowOrigins, }) if err != nil { _ = ipcServer.Close(context.Background()) @@ -168,6 +269,47 @@ func defaultGatewayCommandRunner(ctx context.Context, options gatewayCommandOpti return ipcServer.Serve(signalContext, nil) } +// applyGatewayFlagOverrides 将 CLI flags 覆盖到网关配置，优先级高于 config.yaml。 +func applyGatewayFlagOverrides(gatewayConfig *config.GatewayConfig, options gatewayCommandOptions) { + if gatewayConfig == nil { + return + } + if options.ACLMode != "" { + gatewayConfig.Security.ACLMode = options.ACLMode + } + if options.MaxFrameBytes > 0 { + gatewayConfig.Limits.MaxFrameBytes = options.MaxFrameBytes + } + if options.IPCMaxConnections > 0 { + gatewayConfig.Limits.IPCMaxConnections = options.IPCMaxConnections + } + if options.HTTPMaxRequestBytes > 0 { + gatewayConfig.Limits.HTTPMaxRequestBytes = options.HTTPMaxRequestBytes + } + if options.HTTPMaxStreamConnections > 0 { + gatewayConfig.Limits.HTTPMaxStreamConnections = options.HTTPMaxStreamConnections + } + if options.IPCReadSec > 0 { + gatewayConfig.Timeouts.IPCReadSec = options.IPCReadSec + } + if options.IPCWriteSec > 0 { + gatewayConfig.Timeouts.IPCWriteSec = options.IPCWriteSec + } + if options.HTTPReadSec > 0 { + gatewayConfig.Timeouts.HTTPReadSec = options.HTTPReadSec + } + if options.HTTPWriteSec > 0 { + gatewayConfig.Timeouts.HTTPWriteSec = options.HTTPWriteSec + } + if options.HTTPShutdownSec > 0 { + gatewayConfig.Timeouts.HTTPShutdownSec = options.HTTPShutdownSec + } + if options.MetricsEnabledOverridden { + enabled := options.MetricsEnabled + gatewayConfig.Observability.MetricsEnabled = &enabled + } +} + // defaultNewGatewayServer 创建默认网关服务实例，供命令层启动流程调用。 func defaultNewGatewayServer(options gateway.ServerOptions) (gatewayServer, error) { return gateway.NewServer(options) @@ -204,6 +346,7 @@ func newURLDispatchCommand() *cobra.Command { dispatchErr := runURLDispatchCommand(cmd.Context(), urlDispatchCommandOptions{ URL: normalizedURL, ListenAddress: strings.TrimSpace(options.ListenAddress), + TokenFile: strings.TrimSpace(options.TokenFile), }) if dispatchErr != nil { exitProcess(1) @@ -215,15 +358,27 @@ func newURLDispatchCommand() *cobra.Command { cmd.Flags().StringVar(&options.URL, "url", "", "neocode:// URL to dispatch") cmd.Flags().StringVar(&options.ListenAddress, "listen", "", "gateway listen address override") + cmd.Flags().StringVar(&options.TokenFile, "token-file", "", "gateway auth token file path (default ~/.neocode/auth.json)") return cmd } // defaultURLDispatchCommandRunner 执行 URL 唤醒请求并将结果以结构化 JSON 输出。 func defaultURLDispatchCommandRunner(ctx context.Context, options urlDispatchCommandOptions) error { + authToken, authErr := loadAuthToken(options.TokenFile) + if authErr != nil { + writeErr := writeDispatchError(os.Stderr, authErr) + if writeErr != nil { + _ = writeURLDispatchFallbackErrorOutput(os.Stderr) + } + exitProcess(1) + return nil + } + result, err := dispatchURLThroughIPC(ctx, urlscheme.DispatchRequest{ RawURL: options.URL, ListenAddress: options.ListenAddress, + AuthToken: authToken, }) if err != nil { writeErr := writeDispatchError(os.Stderr, err) @@ -245,6 +400,21 @@ func defaultURLDispatchCommandRunner(ctx context.Context, options urlDispatchCom return nil } +// loadGatewayAuthToken 读取静默认证 token；若文件不存在则回退为空以兼容无鉴权模式。 +func loadGatewayAuthToken(path string) (string, error) { + token, err := gatewayauth.LoadTokenFromFile(path) + if err == nil { + return token, nil + } + if errors.Is(err, os.ErrNotExist) { + return "", nil + } + if strings.Contains(strings.ToLower(err.Error()), "no such file") { + return "", nil + } + return "", err +} + // normalizeDispatchURL 对 url-dispatch 输入做最小归一化，详细校验交由 dispatcher 完成。 func normalizeDispatchURL(rawURL string) (string, error) { normalized := strings.TrimSpace(rawURL) diff --git a/internal/cli/root_test.go b/internal/cli/root_test.go index ad473be2..4cf3ac5f 100644 --- a/internal/cli/root_test.go +++ b/internal/cli/root_test.go @@ -7,6 +7,7 @@ import ( "errors" "io" "os" + "path/filepath" "strings" "testing" @@ -785,6 +786,60 @@ func TestURLDispatchSubcommandDefaultRunnerSuccess(t *testing.T) { } } +func TestURLDispatchSubcommandDefaultRunnerPassesAuthToken(t *testing.T) { + originalRunner := runURLDispatchCommand + originalDispatch := dispatchURLThroughIPC + originalLoadAuthToken := loadAuthToken + originalExitProcess := exitProcess + originalPreload := runGlobalPreload + t.Cleanup(func() { runURLDispatchCommand = originalRunner }) + t.Cleanup(func() { dispatchURLThroughIPC = originalDispatch }) + t.Cleanup(func() { loadAuthToken = originalLoadAuthToken }) + t.Cleanup(func() { exitProcess = originalExitProcess }) + t.Cleanup(func() { runGlobalPreload = originalPreload }) + runGlobalPreload = func(context.Context) error { return nil } + exitProcess = func(code int) { + t.Fatalf("unexpected exit with code %d", code) + } + + runURLDispatchCommand = defaultURLDispatchCommandRunner + loadAuthToken = func(path string) (string, error) { + if path != "/tmp/auth.json" { + t.Fatalf("token path = %q, want %q", path, "/tmp/auth.json") + } + return "auth-token", nil + } + + receivedToken := "" + dispatchURLThroughIPC = func(_ context.Context, request urlscheme.DispatchRequest) (urlscheme.DispatchResult, error) { + receivedToken = request.AuthToken + return urlscheme.DispatchResult{ + ListenAddress: "/tmp/gateway.sock", + Response: gateway.MessageFrame{ + Type: gateway.FrameTypeAck, + Action: gateway.FrameActionWakeOpenURL, + RequestID: "wake-1", + Payload: map[string]any{ + "message": "wake intent accepted", + }, + }, + }, nil + } + + command := NewRootCommand() + command.SetArgs([]string{ + "url-dispatch", + "--url", "neocode://review?path=README.md", + "--token-file", "/tmp/auth.json", + }) + if err := command.ExecuteContext(context.Background()); err != nil { + t.Fatalf("ExecuteContext() error = %v", err) + } + if receivedToken != "auth-token" { + t.Fatalf("received token = %q, want %q", receivedToken, "auth-token") + } +} + func TestURLDispatchSubcommandDefaultRunnerSuccessOutputFailure(t *testing.T) { originalRunner := runURLDispatchCommand originalDispatch := dispatchURLThroughIPC @@ -1003,6 +1058,16 @@ func TestWriteURLDispatchErrorOutput(t *testing.T) { }) } +func TestLoadGatewayAuthTokenFallback(t *testing.T) { + token, err := loadGatewayAuthToken(filepath.Join(t.TempDir(), "missing-auth.json")) + if err != nil { + t.Fatalf("loadGatewayAuthToken() error = %v", err) + } + if token != "" { + t.Fatalf("token = %q, want empty token for missing file", token) + } +} + type quitModel struct{} type stubGatewayServer struct { diff --git a/internal/gateway/adapters/urlscheme/dispatcher.go b/internal/gateway/adapters/urlscheme/dispatcher.go index 32fa9d2f..6bf391df 100644 --- a/internal/gateway/adapters/urlscheme/dispatcher.go +++ b/internal/gateway/adapters/urlscheme/dispatcher.go @@ -35,6 +35,7 @@ var dispatchRequestCounter uint64 type DispatchRequest struct { RawURL string ListenAddress string + AuthToken string } // DispatchResult 表示 URL Scheme 调度输出。 @@ -103,6 +104,13 @@ func (d *Dispatcher) Dispatch(ctx context.Context, request DispatchRequest) (Dis stopCancelWatcher := watchDispatchCancellation(ctx, conn) defer stopCancelWatcher() + authToken := strings.TrimSpace(request.AuthToken) + if authToken != "" { + if err := d.authenticate(ctx, conn, authToken); err != nil { + return DispatchResult{}, err + } + } + requestFrame := gateway.MessageFrame{ Type: gateway.FrameTypeRequest, Action: gateway.FrameActionWakeOpenURL, @@ -130,26 +138,9 @@ func (d *Dispatcher) Dispatch(ctx context.Context, request DispatchRequest) (Dis if err := ensureDispatchContextActive(ctx); err != nil { return DispatchResult{}, toDispatchError(err) } - encoder := json.NewEncoder(conn) - if err := encoder.Encode(rpcRequest); err != nil { - if ctx != nil && ctx.Err() != nil { - ctxErr := ctx.Err() - return DispatchResult{}, toDispatchError(ctxErr) - } - return DispatchResult{}, newDispatchError(ErrorCodeInternal, fmt.Sprintf("write request rpc: %v", err)) - } - - var rpcResponse protocol.JSONRPCResponse - if err := ensureDispatchContextActive(ctx); err != nil { - return DispatchResult{}, toDispatchError(err) - } - decoder := json.NewDecoder(conn) - if err := decoder.Decode(&rpcResponse); err != nil { - if ctx != nil && ctx.Err() != nil { - ctxErr := ctx.Err() - return DispatchResult{}, toDispatchError(ctxErr) - } - return DispatchResult{}, newDispatchError(ErrorCodeUnexpectedResponse, fmt.Sprintf("decode response rpc: %v", err)) + rpcResponse, err := d.callRPC(ctx, conn, rpcRequest) + if err != nil { + return DispatchResult{}, err } if strings.TrimSpace(rpcResponse.JSONRPC) != protocol.JSONRPCVersion { return DispatchResult{}, newDispatchError( @@ -201,6 +192,77 @@ func (d *Dispatcher) Dispatch(ctx context.Context, request DispatchRequest) (Dis } } +// authenticate 在同一连接上发送 gateway.authenticate，建立连接级认证态。 +func (d *Dispatcher) authenticate(ctx context.Context, conn net.Conn, token string) error { + authRequestID := d.requestIDFn() + "-auth" + authRequestIDRaw, err := marshalJSONRawMessage(authRequestID) + if err != nil { + return newDispatchError(ErrorCodeInternal, fmt.Sprintf("encode authenticate id: %v", err)) + } + authParamsRaw, err := marshalJSONRawMessage(protocol.AuthenticateParams{Token: token}) + if err != nil { + return newDispatchError(ErrorCodeInternal, fmt.Sprintf("encode authenticate params: %v", err)) + } + + authRequest := protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: authRequestIDRaw, + Method: protocol.MethodGatewayAuthenticate, + Params: authParamsRaw, + } + authResponse, err := d.callRPC(ctx, conn, authRequest) + if err != nil { + return err + } + if strings.TrimSpace(authResponse.JSONRPC) != protocol.JSONRPCVersion { + return newDispatchError(ErrorCodeUnexpectedResponse, "unexpected auth response jsonrpc version") + } + if !rawJSONMessageEqual(authResponse.ID, authRequest.ID) { + return newDispatchError(ErrorCodeUnexpectedResponse, "rpc correlation failed: auth id mismatch") + } + if authResponse.Error != nil { + return toDispatchErrorFromJSONRPC(authResponse.Error) + } + if authResponse.Result == nil { + return newDispatchError(ErrorCodeUnexpectedResponse, "gateway auth response missing result payload") + } + frame, err := decodeResponseFrameResult(authResponse.Result) + if err != nil { + return newDispatchError(ErrorCodeUnexpectedResponse, fmt.Sprintf("decode auth response frame: %v", err)) + } + if frame.Type != gateway.FrameTypeAck || frame.Action != gateway.FrameActionAuthenticate || frame.RequestID != authRequestID { + return newDispatchError(ErrorCodeUnexpectedResponse, "unexpected auth response frame") + } + return nil +} + +// callRPC 在已建立连接上执行一次 JSON-RPC 调用，统一处理上下文取消与编解码错误映射。 +func (d *Dispatcher) callRPC(ctx context.Context, conn net.Conn, request protocol.JSONRPCRequest) (protocol.JSONRPCResponse, error) { + if err := ensureDispatchContextActive(ctx); err != nil { + return protocol.JSONRPCResponse{}, toDispatchError(err) + } + encoder := json.NewEncoder(conn) + if err := encoder.Encode(request); err != nil { + if ctx != nil && ctx.Err() != nil { + return protocol.JSONRPCResponse{}, toDispatchError(ctx.Err()) + } + return protocol.JSONRPCResponse{}, newDispatchError(ErrorCodeInternal, fmt.Sprintf("write request rpc: %v", err)) + } + + if err := ensureDispatchContextActive(ctx); err != nil { + return protocol.JSONRPCResponse{}, toDispatchError(err) + } + var response protocol.JSONRPCResponse + decoder := json.NewDecoder(conn) + if err := decoder.Decode(&response); err != nil { + if ctx != nil && ctx.Err() != nil { + return protocol.JSONRPCResponse{}, toDispatchError(ctx.Err()) + } + return protocol.JSONRPCResponse{}, newDispatchError(ErrorCodeUnexpectedResponse, fmt.Sprintf("decode response rpc: %v", err)) + } + return response, nil +} + // Dispatch 使用默认调度器执行 URL 转发。 func Dispatch(ctx context.Context, request DispatchRequest) (DispatchResult, error) { return NewDispatcher().Dispatch(ctx, request) diff --git a/internal/gateway/adapters/urlscheme/dispatcher_test.go b/internal/gateway/adapters/urlscheme/dispatcher_test.go index 75f1427c..9c8678e0 100644 --- a/internal/gateway/adapters/urlscheme/dispatcher_test.go +++ b/internal/gateway/adapters/urlscheme/dispatcher_test.go @@ -785,6 +785,133 @@ func TestDispatcherDispatchAdditionalErrorBranches(t *testing.T) { }) } +func TestDispatcherDispatchWithAuthHandshake(t *testing.T) { + serverConn, clientConn := net.Pipe() + t.Cleanup(func() { + _ = serverConn.Close() + _ = clientConn.Close() + }) + + dispatcher := &Dispatcher{ + resolveListenAddressFn: func(string) (string, error) { return "stub://gateway", nil }, + dialFn: func(string) (net.Conn, error) { return clientConn, nil }, + requestIDFn: func() string { + return "wake-auth" + }, + } + + done := make(chan struct{}) + go func() { + defer close(done) + decoder := json.NewDecoder(serverConn) + encoder := json.NewEncoder(serverConn) + + var authRequest protocol.JSONRPCRequest + if err := decoder.Decode(&authRequest); err != nil { + t.Errorf("decode auth request: %v", err) + return + } + if authRequest.Method != protocol.MethodGatewayAuthenticate { + t.Errorf("auth method = %q, want %q", authRequest.Method, protocol.MethodGatewayAuthenticate) + return + } + if err := encoder.Encode(protocol.JSONRPCResponse{ + JSONRPC: protocol.JSONRPCVersion, + ID: authRequest.ID, + Result: mustMarshalRawJSON(t, gateway.MessageFrame{ + Type: gateway.FrameTypeAck, + Action: gateway.FrameActionAuthenticate, + RequestID: "wake-auth-auth", + Payload: map[string]string{"message": "authenticated"}, + }), + }); err != nil { + t.Errorf("encode auth response: %v", err) + return + } + + var wakeRequest protocol.JSONRPCRequest + if err := decoder.Decode(&wakeRequest); err != nil { + t.Errorf("decode wake request: %v", err) + return + } + if wakeRequest.Method != protocol.MethodWakeOpenURL { + t.Errorf("wake method = %q, want %q", wakeRequest.Method, protocol.MethodWakeOpenURL) + return + } + if err := encoder.Encode(protocol.JSONRPCResponse{ + JSONRPC: protocol.JSONRPCVersion, + ID: wakeRequest.ID, + Result: mustMarshalRawJSON(t, gateway.MessageFrame{ + Type: gateway.FrameTypeAck, + Action: gateway.FrameActionWakeOpenURL, + RequestID: "wake-auth", + Payload: map[string]string{"message": "wake intent accepted"}, + }), + }); err != nil { + t.Errorf("encode wake response: %v", err) + } + }() + + result, err := dispatcher.Dispatch(context.Background(), DispatchRequest{ + RawURL: "neocode://review?path=README.md", + AuthToken: "token-1", + }) + if err != nil { + t.Fatalf("dispatch with auth: %v", err) + } + if result.Response.Action != gateway.FrameActionWakeOpenURL { + t.Fatalf("action = %q, want %q", result.Response.Action, gateway.FrameActionWakeOpenURL) + } + <-done +} + +func TestDispatcherDispatchWithAuthHandshakeError(t *testing.T) { + serverConn, clientConn := net.Pipe() + t.Cleanup(func() { + _ = serverConn.Close() + _ = clientConn.Close() + }) + + dispatcher := &Dispatcher{ + resolveListenAddressFn: func(string) (string, error) { return "stub://gateway", nil }, + dialFn: func(string) (net.Conn, error) { return clientConn, nil }, + requestIDFn: func() string { + return "wake-auth-err" + }, + } + + go func() { + decoder := json.NewDecoder(serverConn) + encoder := json.NewEncoder(serverConn) + var authRequest protocol.JSONRPCRequest + _ = decoder.Decode(&authRequest) + _ = encoder.Encode(protocol.JSONRPCResponse{ + JSONRPC: protocol.JSONRPCVersion, + ID: authRequest.ID, + Error: protocol.NewJSONRPCError( + protocol.JSONRPCCodeInvalidParams, + "invalid token", + protocol.GatewayCodeUnauthorized, + ), + }) + }() + + _, err := dispatcher.Dispatch(context.Background(), DispatchRequest{ + RawURL: "neocode://review?path=README.md", + AuthToken: "bad-token", + }) + if err == nil { + t.Fatal("expected auth handshake error") + } + var dispatchErr *DispatchError + if !errors.As(err, &dispatchErr) { + t.Fatalf("error type = %T, want *DispatchError", err) + } + if dispatchErr.Code != protocol.GatewayCodeUnauthorized { + t.Fatalf("code = %q, want %q", dispatchErr.Code, protocol.GatewayCodeUnauthorized) + } +} + func TestDispatcherJSONRPCHelpers(t *testing.T) { marshalErr := toDispatchErrorFromJSONRPC(&protocol.JSONRPCError{ Code: protocol.JSONRPCCodeInternalError, From 9c025791a42826e6d4144acdff25944ef432a242 Mon Sep 17 00:00:00 2001 From: pionxe Date: Thu, 16 Apr 2026 23:41:44 +0800 Subject: [PATCH 05/12] =?UTF-8?q?chore(deps):=20[EPIC-GW-06]=20=E6=9B=B4?= =?UTF-8?q?=E6=96=B0=E9=A1=B9=E7=9B=AE=E4=BE=9D=E8=B5=96=20(Prometheus=20S?= =?UTF-8?q?DK)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 引入网关可观测性监控基建相关的依赖包： 1. 新增 github.com/prometheus/client_golang 等相关依赖，以支持标准的 /metrics 指标暴露。 2. 同步更新 go.sum 以锁定依赖版本号，保证构建的幂等性。 --- go.mod | 9 +++++++++ go.sum | 19 +++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/go.mod b/go.mod index 8017ac76..8d4b20dd 100644 --- a/go.mod +++ b/go.mod @@ -21,6 +21,8 @@ require ( github.com/atotto/clipboard v0.1.4 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/aymerick/douceur v0.2.0 // indirect + github.com/beorn7/perks v1.0.1 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/colorprofile v0.4.3 // indirect github.com/charmbracelet/harmonica v0.2.0 // indirect github.com/charmbracelet/x/ansi v0.11.6 // indirect @@ -45,7 +47,12 @@ require ( github.com/muesli/cancelreader v0.2.2 // indirect github.com/muesli/reflow v0.3.0 // indirect github.com/muesli/termenv v0.16.0 // indirect + github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pelletier/go-toml/v2 v2.2.4 // indirect + github.com/prometheus/client_golang v1.23.2 // indirect + github.com/prometheus/client_model v0.6.2 // indirect + github.com/prometheus/common v0.66.1 // indirect + github.com/prometheus/procfs v0.16.1 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/sagikazarmark/locafero v0.11.0 // indirect github.com/sahilm/fuzzy v0.1.1 // indirect @@ -57,10 +64,12 @@ require ( github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/yuin/goldmark v1.7.13 // indirect github.com/yuin/goldmark-emoji v1.0.6 // indirect + go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp/shiny v0.0.0-20250606033433-dcc06ee1d476 // indirect golang.org/x/image v0.28.0 // indirect golang.org/x/mobile v0.0.0-20250606033058-a2a15c67f36f // indirect golang.org/x/term v0.41.0 // indirect golang.org/x/text v0.35.0 // indirect + google.golang.org/protobuf v1.36.8 // indirect ) diff --git a/go.sum b/go.sum index c4388c9e..9feda321 100644 --- a/go.sum +++ b/go.sum @@ -16,6 +16,10 @@ github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3v github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E= github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk= github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= +github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= +github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc= github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E= github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw= @@ -59,6 +63,7 @@ github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9L github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8= github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0= github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= @@ -90,10 +95,20 @@ github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s= github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8= github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc= github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4= github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= +github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= +github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= +github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs= +github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA= +github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= +github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= @@ -128,6 +143,8 @@ github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA= github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs= github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA= +go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= +go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.design/x/clipboard v0.7.1 h1:OEG3CmcYRBNnRwpDp7+uWLiZi3hrMRJpE9JkkkYtz2c= @@ -150,6 +167,8 @@ golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU= golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A= golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= +google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= +google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 7d55ed542566f44e50f1e810871cc72b85057985 Mon Sep 17 00:00:00 2001 From: pionxe Date: Fri, 17 Apr 2026 00:07:09 +0800 Subject: [PATCH 06/12] =?UTF-8?q?fix:=20Metrics=20=E5=BC=80=E5=85=B3?= =?UTF-8?q?=E5=A4=B1=E6=95=88=E4=B8=8E=E5=AE=9E=E4=BE=8B=E4=B8=8D=E4=B8=80?= =?UTF-8?q?=E8=87=B4=E7=9A=84=E9=97=AE=E9=A2=98=E3=80=81=E5=B0=81=E5=A0=B5?= =?UTF-8?q?=20URL=20Query=20=E5=B8=A6=E6=9D=A5=E7=9A=84=20Token=20?= =?UTF-8?q?=E6=B3=84=E6=BC=8F=E9=A3=8E=E9=99=A9=E3=80=81=E4=BF=AE=E5=A4=8D?= =?UTF-8?q?=20ACL=20Mode=20=E9=85=8D=E7=BD=AE=E9=A1=B9=E6=9C=AA=E7=94=9F?= =?UTF-8?q?=E6=95=88=E7=9A=84=E6=BC=82=E7=A7=BB=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/cli/gateway_commands.go | 19 +++++- internal/cli/root_test.go | 53 +++++++++++++++++ internal/gateway/network_server.go | 26 +++++---- internal/gateway/network_server_test.go | 78 +++++++++++++++++++++++++ 4 files changed, 163 insertions(+), 13 deletions(-) diff --git a/internal/cli/gateway_commands.go b/internal/cli/gateway_commands.go index c25bc844..baa33e0b 100644 --- a/internal/cli/gateway_commands.go +++ b/internal/cli/gateway_commands.go @@ -193,6 +193,10 @@ func defaultGatewayCommandRunner(ctx context.Context, options gatewayCommandOpti if err := gatewayConfig.Validate(); err != nil { return fmt.Errorf("gateway config override invalid: %w", err) } + acl, err := buildGatewayControlPlaneACL(gatewayConfig.Security.ACLMode) + if err != nil { + return err + } tokenFile := strings.TrimSpace(options.TokenFile) if tokenFile == "" { @@ -207,7 +211,6 @@ func defaultGatewayCommandRunner(ctx context.Context, options gatewayCommandOpti if gatewayConfig.Observability.Enabled() { metrics = gateway.NewGatewayMetrics() } - acl := gateway.NewStrictControlPlaneACL() relay := gateway.NewStreamRelay(gateway.StreamRelayOptions{ Logger: logger, Metrics: metrics, @@ -269,6 +272,20 @@ func defaultGatewayCommandRunner(ctx context.Context, options gatewayCommandOpti return ipcServer.Serve(signalContext, nil) } +// buildGatewayControlPlaneACL 基于配置构造控制面 ACL 策略，未知模式直接拒绝启动。 +func buildGatewayControlPlaneACL(aclMode string) (*gateway.ControlPlaneACL, error) { + normalizedACLMode := strings.ToLower(strings.TrimSpace(aclMode)) + if normalizedACLMode == "" { + normalizedACLMode = string(gateway.ACLModeStrict) + } + switch normalizedACLMode { + case string(gateway.ACLModeStrict): + return gateway.NewStrictControlPlaneACL(), nil + default: + return nil, fmt.Errorf("unsupported gateway acl mode %q", aclMode) + } +} + // applyGatewayFlagOverrides 将 CLI flags 覆盖到网关配置，优先级高于 config.yaml。 func applyGatewayFlagOverrides(gatewayConfig *config.GatewayConfig, options gatewayCommandOptions) { if gatewayConfig == nil { diff --git a/internal/cli/root_test.go b/internal/cli/root_test.go index 4cf3ac5f..55a7b1da 100644 --- a/internal/cli/root_test.go +++ b/internal/cli/root_test.go @@ -385,6 +385,59 @@ func TestDefaultGatewayCommandRunnerReturnsNetworkConstructorError(t *testing.T) } } +func TestDefaultGatewayCommandRunnerRejectsInvalidACLMode(t *testing.T) { + err := defaultGatewayCommandRunner(context.Background(), gatewayCommandOptions{ + ListenAddress: "stub://gateway", + HTTPAddress: "127.0.0.1:8080", + LogLevel: "info", + ACLMode: "custom", + }) + if err == nil { + t.Fatal("expected invalid acl mode error") + } + if !strings.Contains(err.Error(), "gateway config override invalid") { + t.Fatalf("error = %v, want contains %q", err, "gateway config override invalid") + } + if !strings.Contains(err.Error(), "acl_mode must be") { + t.Fatalf("error = %v, want contains %q", err, "acl_mode must be") + } +} + +func TestBuildGatewayControlPlaneACL(t *testing.T) { + t.Run("strict mode", func(t *testing.T) { + acl, err := buildGatewayControlPlaneACL("strict") + if err != nil { + t.Fatalf("buildGatewayControlPlaneACL() error = %v", err) + } + if acl == nil { + t.Fatal("expected non-nil acl") + } + }) + + t.Run("empty mode uses strict", func(t *testing.T) { + acl, err := buildGatewayControlPlaneACL(" ") + if err != nil { + t.Fatalf("buildGatewayControlPlaneACL() error = %v", err) + } + if acl == nil { + t.Fatal("expected non-nil acl") + } + }) + + t.Run("unsupported mode", func(t *testing.T) { + acl, err := buildGatewayControlPlaneACL("allow-all") + if err == nil { + t.Fatal("expected unsupported mode error") + } + if acl != nil { + t.Fatalf("acl = %#v, want nil", acl) + } + if !strings.Contains(err.Error(), "unsupported gateway acl mode") { + t.Fatalf("error = %v, want contains unsupported mode message", err) + } + }) +} + func TestDefaultNewGatewayServer(t *testing.T) { server, err := defaultNewGatewayServer(gateway.ServerOptions{ ListenAddress: "stub://gateway", diff --git a/internal/gateway/network_server.go b/internal/gateway/network_server.go index bccb8c98..d732cacb 100644 --- a/internal/gateway/network_server.go +++ b/internal/gateway/network_server.go @@ -151,9 +151,6 @@ func NewNetworkServer(options NetworkServerOptions) (*NetworkServer, error) { } metrics := options.Metrics - if metrics == nil { - metrics = NewGatewayMetrics() - } allowedOrigins := normalizeControlPlaneOrigins(options.AllowedOrigins) if len(allowedOrigins) == 0 { allowedOrigins = defaultControlPlaneOrigins() @@ -414,11 +411,15 @@ func (s *NetworkServer) handlePrometheusMetrics(writer http.ResponseWriter, requ http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } + if s.metrics == nil { + http.Error(writer, "metrics disabled", http.StatusServiceUnavailable) + return + } if !s.isObservabilityRequestAuthorized(request) { http.Error(writer, "unauthorized", http.StatusUnauthorized) return } - if s.metrics == nil || s.metrics.Registry() == nil { + if s.metrics.Registry() == nil { http.Error(writer, "metrics unavailable", http.StatusServiceUnavailable) return } @@ -431,15 +432,19 @@ func (s *NetworkServer) handleJSONMetrics(writer http.ResponseWriter, request *h http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } + if s.metrics == nil { + writeJSONResponse(writer, http.StatusServiceUnavailable, map[string]any{ + "error": "metrics disabled", + }) + return + } if !s.isObservabilityRequestAuthorized(request) { http.Error(writer, "unauthorized", http.StatusUnauthorized) return } - payload := map[string]any{"metrics": map[string]map[string]float64{}} - if s.metrics != nil { - payload["metrics"] = s.metrics.Snapshot() - } - writeJSONResponse(writer, http.StatusOK, payload) + writeJSONResponse(writer, http.StatusOK, map[string]any{ + "metrics": s.metrics.Snapshot(), + }) } // isObservabilityRequestAuthorized 校验 metrics 端点访问 Token。 @@ -448,9 +453,6 @@ func (s *NetworkServer) isObservabilityRequestAuthorized(request *http.Request) return true } token := extractBearerToken(request.Header.Get("Authorization")) - if token == "" && request.URL != nil { - token = strings.TrimSpace(request.URL.Query().Get("token")) - } return s.authenticator.ValidateToken(token) } diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index 77997868..76192525 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -652,6 +652,7 @@ func TestNetworkServerStreamsReceiveGatewayEventNotification(t *testing.T) { func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { server := newTestNetworkServer(t, NetworkServerOptions{ Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + Metrics: NewGatewayMetrics(), }) testContext, cancel := context.WithCancel(context.Background()) defer cancel() @@ -689,6 +690,15 @@ func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { t.Fatalf("/metrics status = %d, want %d", metricsResponse.StatusCode, http.StatusUnauthorized) } + queryTokenMetricsResponse, err := http.Get("http://" + listenAddress + "/metrics?token=gateway-token") + if err != nil { + t.Fatalf("get /metrics with query token: %v", err) + } + defer queryTokenMetricsResponse.Body.Close() + if queryTokenMetricsResponse.StatusCode != http.StatusUnauthorized { + t.Fatalf("/metrics with query token status = %d, want %d", queryTokenMetricsResponse.StatusCode, http.StatusUnauthorized) + } + authorizedMetricsRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/metrics", nil) if err != nil { t.Fatalf("new /metrics request: %v", err) @@ -716,6 +726,74 @@ func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { if authorizedJSONMetricsResponse.StatusCode != http.StatusOK { t.Fatalf("authorized /metrics.json status = %d, want %d", authorizedJSONMetricsResponse.StatusCode, http.StatusOK) } + + queryTokenJSONMetricsResponse, err := http.Get("http://" + listenAddress + "/metrics.json?token=gateway-token") + if err != nil { + t.Fatalf("get /metrics.json with query token: %v", err) + } + defer queryTokenJSONMetricsResponse.Body.Close() + if queryTokenJSONMetricsResponse.StatusCode != http.StatusUnauthorized { + t.Fatalf( + "/metrics.json with query token status = %d, want %d", + queryTokenJSONMetricsResponse.StatusCode, + http.StatusUnauthorized, + ) + } +} + +func TestNetworkServerMetricsEndpointReturnsUnavailableWhenDisabled(t *testing.T) { + server := newTestNetworkServer(t, NetworkServerOptions{ + Metrics: nil, + }) + testContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + serveDone := make(chan error, 1) + go func() { + serveDone <- server.Serve(testContext, nil) + }() + t.Cleanup(func() { + _ = server.Close(context.Background()) + select { + case <-serveDone: + case <-time.After(2 * time.Second): + t.Fatal("network serve goroutine did not exit") + } + }) + + listenAddress := waitForNetworkAddress(t, server) + metricsResponse, err := http.Get("http://" + listenAddress + "/metrics") + if err != nil { + t.Fatalf("get /metrics: %v", err) + } + defer metricsResponse.Body.Close() + if metricsResponse.StatusCode != http.StatusServiceUnavailable { + t.Fatalf("/metrics status = %d, want %d", metricsResponse.StatusCode, http.StatusServiceUnavailable) + } + metricsBody, err := io.ReadAll(metricsResponse.Body) + if err != nil { + t.Fatalf("read /metrics response body: %v", err) + } + if !strings.Contains(strings.ToLower(string(metricsBody)), "metrics disabled") { + t.Fatalf("/metrics body = %q, want contains %q", string(metricsBody), "metrics disabled") + } + + metricsJSONResponse, err := http.Get("http://" + listenAddress + "/metrics.json") + if err != nil { + t.Fatalf("get /metrics.json: %v", err) + } + defer metricsJSONResponse.Body.Close() + if metricsJSONResponse.StatusCode != http.StatusServiceUnavailable { + t.Fatalf("/metrics.json status = %d, want %d", metricsJSONResponse.StatusCode, http.StatusServiceUnavailable) + } + + var metricsJSONBody map[string]any + if err := json.NewDecoder(metricsJSONResponse.Body).Decode(&metricsJSONBody); err != nil { + t.Fatalf("decode /metrics.json body: %v", err) + } + if metricsJSONBody["error"] != "metrics disabled" { + t.Fatalf("/metrics.json error = %v, want %q", metricsJSONBody["error"], "metrics disabled") + } } func TestWithCORSCustomAllowOrigins(t *testing.T) { From c275a9c2ca1cc357a5daac94582554c7c1816a2d Mon Sep 17 00:00:00 2001 From: xgopilot Date: Fri, 17 Apr 2026 00:25:57 +0000 Subject: [PATCH 07/12] test(gateway): extend coverage for config and auth/network helpers Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: pionxe <148670367+pionxe@users.noreply.github.com> --- internal/config/gateway_test.go | 232 +++++++++++++++++++++++ internal/gateway/auth/manager_test.go | 36 ++++ internal/gateway/bootstrap_test.go | 84 ++++++++ internal/gateway/build_info_test.go | 29 +++ internal/gateway/network_server_test.go | 51 +++++ internal/gateway/request_context_test.go | 83 ++++++++ internal/gateway/security_test.go | 16 ++ 7 files changed, 531 insertions(+) create mode 100644 internal/gateway/build_info_test.go diff --git a/internal/config/gateway_test.go b/internal/config/gateway_test.go index a2055061..f90cbed9 100644 --- a/internal/config/gateway_test.go +++ b/internal/config/gateway_test.go @@ -140,3 +140,235 @@ gateway: } }) } + +func TestGatewaySecurityConfigApplyDefaultsAndValidateBranches(t *testing.T) { + t.Parallel() + + defaults := GatewaySecurityConfig{ + ACLMode: DefaultGatewayACLMode, + TokenFile: "/tmp/default-auth.json", + AllowOrigins: []string{"http://localhost"}, + } + + cfg := GatewaySecurityConfig{} + cfg.ApplyDefaults(defaults) + if cfg.ACLMode != defaults.ACLMode { + t.Fatalf("acl_mode = %q, want %q", cfg.ACLMode, defaults.ACLMode) + } + if cfg.TokenFile != defaults.TokenFile { + t.Fatalf("token_file = %q, want %q", cfg.TokenFile, defaults.TokenFile) + } + if len(cfg.AllowOrigins) != 1 || cfg.AllowOrigins[0] != "http://localhost" { + t.Fatalf("allow_origins = %#v, want default allow list", cfg.AllowOrigins) + } + + cfg = GatewaySecurityConfig{ + AllowOrigins: []string{" http://localhost:3000 ", " ", "app://desktop"}, + } + cfg.ApplyDefaults(defaults) + if len(cfg.AllowOrigins) != 2 { + t.Fatalf("allow_origins len = %d, want %d", len(cfg.AllowOrigins), 2) + } + if cfg.AllowOrigins[0] != "http://localhost:3000" || cfg.AllowOrigins[1] != "app://desktop" { + t.Fatalf("allow_origins = %#v, want normalized values", cfg.AllowOrigins) + } + + invalidACL := GatewaySecurityConfig{ACLMode: "allow-all"} + if err := invalidACL.Validate(); err == nil || !strings.Contains(err.Error(), "acl_mode") { + t.Fatalf("expected acl_mode validation error, got %v", err) + } + + invalidTokenPath := GatewaySecurityConfig{ACLMode: DefaultGatewayACLMode, TokenFile: "."} + if err := invalidTokenPath.Validate(); err == nil || !strings.Contains(err.Error(), "token_file") { + t.Fatalf("expected token_file validation error, got %v", err) + } + + invalidAllowOrigins := GatewaySecurityConfig{ + ACLMode: DefaultGatewayACLMode, + AllowOrigins: []string{"http://localhost", " "}, + } + if err := invalidAllowOrigins.Validate(); err == nil || !strings.Contains(err.Error(), "allow_origins") { + t.Fatalf("expected allow_origins validation error, got %v", err) + } +} + +func TestGatewayLimitsConfigApplyDefaultsAndValidateBranches(t *testing.T) { + t.Parallel() + + defaults := GatewayLimitsConfig{ + MaxFrameBytes: 1, + IPCMaxConnections: 2, + HTTPMaxRequestBytes: 3, + HTTPMaxStreamConnections: 4, + } + limits := GatewayLimitsConfig{} + limits.ApplyDefaults(defaults) + if limits != defaults { + t.Fatalf("limits defaults = %#v, want %#v", limits, defaults) + } + + cases := []GatewayLimitsConfig{ + {MaxFrameBytes: 0, IPCMaxConnections: 1, HTTPMaxRequestBytes: 1, HTTPMaxStreamConnections: 1}, + {MaxFrameBytes: 1, IPCMaxConnections: 0, HTTPMaxRequestBytes: 1, HTTPMaxStreamConnections: 1}, + {MaxFrameBytes: 1, IPCMaxConnections: 1, HTTPMaxRequestBytes: 0, HTTPMaxStreamConnections: 1}, + {MaxFrameBytes: 1, IPCMaxConnections: 1, HTTPMaxRequestBytes: 1, HTTPMaxStreamConnections: 0}, + } + for _, tc := range cases { + if err := tc.Validate(); err == nil { + t.Fatalf("expected validate error for limits %#v", tc) + } + } + + if err := (GatewayLimitsConfig{ + MaxFrameBytes: 1, + IPCMaxConnections: 1, + HTTPMaxRequestBytes: 1, + HTTPMaxStreamConnections: 1, + }).Validate(); err != nil { + t.Fatalf("expected valid limits, got %v", err) + } +} + +func TestGatewayTimeoutsConfigApplyDefaultsAndValidateBranches(t *testing.T) { + t.Parallel() + + defaults := GatewayTimeoutsConfig{ + IPCReadSec: 1, + IPCWriteSec: 2, + HTTPReadSec: 3, + HTTPWriteSec: 4, + HTTPShutdownSec: 5, + } + timeouts := GatewayTimeoutsConfig{} + timeouts.ApplyDefaults(defaults) + if timeouts != defaults { + t.Fatalf("timeouts defaults = %#v, want %#v", timeouts, defaults) + } + + cases := []GatewayTimeoutsConfig{ + {IPCReadSec: 0, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 1}, + {IPCReadSec: 1, IPCWriteSec: 0, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 1}, + {IPCReadSec: 1, IPCWriteSec: 1, HTTPReadSec: 0, HTTPWriteSec: 1, HTTPShutdownSec: 1}, + {IPCReadSec: 1, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 0, HTTPShutdownSec: 1}, + {IPCReadSec: 1, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 0}, + } + for _, tc := range cases { + if err := tc.Validate(); err == nil { + t.Fatalf("expected validate error for timeouts %#v", tc) + } + } + + if err := (GatewayTimeoutsConfig{ + IPCReadSec: 1, + IPCWriteSec: 1, + HTTPReadSec: 1, + HTTPWriteSec: 1, + HTTPShutdownSec: 1, + }).Validate(); err != nil { + t.Fatalf("expected valid timeouts, got %v", err) + } +} + +func TestGatewayObservabilityBranches(t *testing.T) { + t.Parallel() + + var nilDefaults GatewayObservabilityConfig + cfg := GatewayObservabilityConfig{} + cfg.ApplyDefaults(nilDefaults) + if !cfg.Enabled() { + t.Fatal("metrics should be enabled by fallback default") + } + + defaultDisabled := GatewayObservabilityConfig{MetricsEnabled: boolPtr(false)} + cfg = GatewayObservabilityConfig{} + cfg.ApplyDefaults(defaultDisabled) + if cfg.Enabled() { + t.Fatal("metrics should follow defaults when explicitly disabled") + } + + cloned := cfg.Clone() + *cfg.MetricsEnabled = true + if *cloned.MetricsEnabled { + t.Fatal("clone should deep copy metrics_enabled pointer") + } +} + +func TestGatewayConfigValidateWrapsSubErrors(t *testing.T) { + t.Parallel() + + cases := []struct { + name string + cfg GatewayConfig + want string + }{ + { + name: "security", + cfg: GatewayConfig{ + Security: GatewaySecurityConfig{ACLMode: "bad"}, + Limits: GatewayLimitsConfig{ + MaxFrameBytes: 1, + IPCMaxConnections: 1, + HTTPMaxRequestBytes: 1, + HTTPMaxStreamConnections: 1, + }, + Timeouts: GatewayTimeoutsConfig{ + IPCReadSec: 1, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 1, + }, + }, + want: "security:", + }, + { + name: "limits", + cfg: GatewayConfig{ + Security: GatewaySecurityConfig{ACLMode: DefaultGatewayACLMode}, + Limits: GatewayLimitsConfig{ + MaxFrameBytes: 0, + IPCMaxConnections: 1, + HTTPMaxRequestBytes: 1, + HTTPMaxStreamConnections: 1, + }, + Timeouts: GatewayTimeoutsConfig{ + IPCReadSec: 1, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 1, + }, + }, + want: "limits:", + }, + { + name: "timeouts", + cfg: GatewayConfig{ + Security: GatewaySecurityConfig{ACLMode: DefaultGatewayACLMode}, + Limits: GatewayLimitsConfig{ + MaxFrameBytes: 1, + IPCMaxConnections: 1, + HTTPMaxRequestBytes: 1, + HTTPMaxStreamConnections: 1, + }, + Timeouts: GatewayTimeoutsConfig{ + IPCReadSec: 0, IPCWriteSec: 1, HTTPReadSec: 1, HTTPWriteSec: 1, HTTPShutdownSec: 1, + }, + }, + want: "timeouts:", + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + err := tc.cfg.Validate() + if err == nil || !strings.Contains(err.Error(), tc.want) { + t.Fatalf("expected wrapped error contains %q, got %v", tc.want, err) + } + }) + } +} + +func TestGatewayNormalizeAllowOrigins(t *testing.T) { + t.Parallel() + + normalized := normalizeGatewayAllowOrigins([]string{" http://localhost ", "", " ", "app://desktop"}) + if len(normalized) != 2 { + t.Fatalf("normalized len = %d, want %d", len(normalized), 2) + } + if normalized[0] != "http://localhost" || normalized[1] != "app://desktop" { + t.Fatalf("normalized = %#v, want trimmed values", normalized) + } +} diff --git a/internal/gateway/auth/manager_test.go b/internal/gateway/auth/manager_test.go index 967ad029..dfc1443e 100644 --- a/internal/gateway/auth/manager_test.go +++ b/internal/gateway/auth/manager_test.go @@ -188,3 +188,39 @@ func TestBuildCredentialsAndValidation(t *testing.T) { t.Fatal("blank token should be invalid") } } + +func TestDefaultAuthPathAndLoadOrCreateNilManager(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + t.Setenv("USERPROFILE", tempHome) + + defaultPath, err := DefaultAuthPath() + if err != nil { + t.Fatalf("default auth path: %v", err) + } + expectedPath := filepath.Join(tempHome, DefaultAuthRelativePath) + if defaultPath != expectedPath { + t.Fatalf("default auth path = %q, want %q", defaultPath, expectedPath) + } + + manager, err := NewManager("") + if err != nil { + t.Fatalf("new manager with default path: %v", err) + } + if manager.Path() != expectedPath { + t.Fatalf("manager path = %q, want %q", manager.Path(), expectedPath) + } + + token, err := LoadTokenFromFile("") + if err != nil { + t.Fatalf("load token from default path: %v", err) + } + if token != manager.Token() { + t.Fatalf("token = %q, want %q", token, manager.Token()) + } + + var nilManager *Manager + if err := nilManager.loadOrCreate(); err == nil { + t.Fatal("expected nil manager loadOrCreate error") + } +} diff --git a/internal/gateway/bootstrap_test.go b/internal/gateway/bootstrap_test.go index 745b325d..427ddb0b 100644 --- a/internal/gateway/bootstrap_test.go +++ b/internal/gateway/bootstrap_test.go @@ -243,3 +243,87 @@ func TestToFrameError(t *testing.T) { t.Fatalf("fallback code = %q, want %q", fallback.Code, ErrorCodeInternalError.String()) } } + +func TestDecodeAuthenticatePayloadBranches(t *testing.T) { + t.Run("struct with whitespace token", func(t *testing.T) { + params, err := decodeAuthenticatePayload(protocol.AuthenticateParams{Token: " token-1 "}) + if err != nil { + t.Fatalf("decode authenticate struct: %v", err) + } + if params.Token != "token-1" { + t.Fatalf("token = %q, want %q", params.Token, "token-1") + } + }) + + t.Run("pointer with empty token", func(t *testing.T) { + _, err := decodeAuthenticatePayload(&protocol.AuthenticateParams{Token: " "}) + if err == nil || err.Code != ErrorCodeMissingRequiredField.String() { + t.Fatalf("expected missing token error, got %#v", err) + } + }) + + t.Run("map missing token", func(t *testing.T) { + _, err := decodeAuthenticatePayload(map[string]any{"id": "x"}) + if err == nil || err.Code != ErrorCodeMissingRequiredField.String() { + t.Fatalf("expected missing token error, got %#v", err) + } + }) + + t.Run("marshal error", func(t *testing.T) { + _, err := decodeAuthenticatePayload(struct { + Token chan int `json:"token"` + }{Token: make(chan int)}) + if err == nil || err.Code != ErrorCodeInvalidFrame.String() { + t.Fatalf("expected invalid frame error, got %#v", err) + } + }) +} + +func TestHandleAuthenticateFrameBranches(t *testing.T) { + frame := MessageFrame{ + Type: FrameTypeRequest, + Action: FrameActionAuthenticate, + RequestID: "auth-1", + Payload: protocol.AuthenticateParams{ + Token: "token-1", + }, + } + + t.Run("missing authenticator", func(t *testing.T) { + response := handleAuthenticateFrame(context.Background(), frame) + if response.Type != FrameTypeError { + t.Fatalf("response type = %q, want %q", response.Type, FrameTypeError) + } + if response.Error == nil || response.Error.Code != ErrorCodeInternalError.String() { + t.Fatalf("response error = %#v, want %q", response.Error, ErrorCodeInternalError.String()) + } + }) + + t.Run("invalid token", func(t *testing.T) { + ctx := WithTokenAuthenticator(context.Background(), stubTokenAuthenticator{token: "other"}) + response := handleAuthenticateFrame(ctx, frame) + if response.Type != FrameTypeError { + t.Fatalf("response type = %q, want %q", response.Type, FrameTypeError) + } + if response.Error == nil || response.Error.Code != ErrorCodeUnauthorized.String() { + t.Fatalf("response error = %#v, want %q", response.Error, ErrorCodeUnauthorized.String()) + } + }) + + t.Run("success marks auth state", func(t *testing.T) { + authState := NewConnectionAuthState() + ctx := WithTokenAuthenticator(context.Background(), stubTokenAuthenticator{token: "token-1"}) + ctx = WithConnectionAuthState(ctx, authState) + + response := handleAuthenticateFrame(ctx, frame) + if response.Type != FrameTypeAck { + t.Fatalf("response type = %q, want %q", response.Type, FrameTypeAck) + } + if response.Action != FrameActionAuthenticate { + t.Fatalf("response action = %q, want %q", response.Action, FrameActionAuthenticate) + } + if !authState.IsAuthenticated() { + t.Fatal("expected auth state to be marked authenticated") + } + }) +} diff --git a/internal/gateway/build_info_test.go b/internal/gateway/build_info_test.go new file mode 100644 index 00000000..6e97b5cb --- /dev/null +++ b/internal/gateway/build_info_test.go @@ -0,0 +1,29 @@ +package gateway + +import "testing" + +func TestResolvedBuildInfoTrimsValues(t *testing.T) { + originalVersion := GatewayVersion + originalCommit := GatewayCommit + originalBuildTime := GatewayBuildTime + t.Cleanup(func() { + GatewayVersion = originalVersion + GatewayCommit = originalCommit + GatewayBuildTime = originalBuildTime + }) + + GatewayVersion = " v1.2.3 " + GatewayCommit = " abc123 " + GatewayBuildTime = " 2026-04-17T00:00:00Z " + + info := ResolvedBuildInfo() + if info["version"] != "v1.2.3" { + t.Fatalf("version = %q, want %q", info["version"], "v1.2.3") + } + if info["commit"] != "abc123" { + t.Fatalf("commit = %q, want %q", info["commit"], "abc123") + } + if info["build_time"] != "2026-04-17T00:00:00Z" { + t.Fatalf("build_time = %q, want %q", info["build_time"], "2026-04-17T00:00:00Z") + } +} diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index 76192525..2d13944c 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -519,6 +519,57 @@ func TestDecodeJSONRPCRequestFromReaderTrailingJSON(t *testing.T) { } } +func TestNetworkServerVersionAndObservabilityAuthHelpers(t *testing.T) { + server := &NetworkServer{ + authenticator: stubTokenAuthenticator{token: "token-1"}, + } + + t.Run("version method not allowed", func(t *testing.T) { + recorder := httptest.NewRecorder() + request := httptest.NewRequest(http.MethodPost, "/version", nil) + server.handleVersionRequest(recorder, request) + if recorder.Code != http.StatusMethodNotAllowed { + t.Fatalf("status = %d, want %d", recorder.Code, http.StatusMethodNotAllowed) + } + }) + + t.Run("version get returns build info", func(t *testing.T) { + recorder := httptest.NewRecorder() + request := httptest.NewRequest(http.MethodGet, "/version", nil) + server.handleVersionRequest(recorder, request) + if recorder.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", recorder.Code, http.StatusOK) + } + var payload map[string]string + if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil { + t.Fatalf("decode version response: %v", err) + } + if payload["version"] == "" || payload["commit"] == "" { + t.Fatalf("unexpected version payload: %#v", payload) + } + }) + + t.Run("observability auth uses bearer token", func(t *testing.T) { + request := httptest.NewRequest(http.MethodGet, "/metrics", nil) + request.Header.Set("Authorization", "Bearer token-1") + if !server.isObservabilityRequestAuthorized(request) { + t.Fatal("expected valid bearer token to pass") + } + request.Header.Set("Authorization", "Bearer wrong") + if server.isObservabilityRequestAuthorized(request) { + t.Fatal("expected invalid token to be rejected") + } + }) + + t.Run("observability auth bypass when authenticator nil", func(t *testing.T) { + openServer := &NetworkServer{} + request := httptest.NewRequest(http.MethodGet, "/metrics", nil) + if !openServer.isObservabilityRequestAuthorized(request) { + t.Fatal("expected request to pass without authenticator") + } + }) +} + func TestNetworkServerCloseInterruptsStreams(t *testing.T) { server := newTestNetworkServer(t, NetworkServerOptions{}) testContext, cancel := context.WithCancel(context.Background()) diff --git a/internal/gateway/request_context_test.go b/internal/gateway/request_context_test.go index 32b90172..c78cc772 100644 --- a/internal/gateway/request_context_test.go +++ b/internal/gateway/request_context_test.go @@ -64,3 +64,86 @@ func TestRequestContextHelpers(t *testing.T) { t.Fatal("expected to load logger") } } + +func TestRequestContextNilAndTypeMismatchBranches(t *testing.T) { + t.Run("nil input", func(t *testing.T) { + if source := RequestSourceFromContext(nil); source != RequestSourceUnknown { + t.Fatalf("source = %q, want %q", source, RequestSourceUnknown) + } + if token := RequestTokenFromContext(nil); token != "" { + t.Fatalf("token = %q, want empty", token) + } + if _, ok := ConnectionAuthStateFromContext(nil); ok { + t.Fatal("expected missing auth state") + } + if _, ok := TokenAuthenticatorFromContext(nil); ok { + t.Fatal("expected missing authenticator") + } + if _, ok := RequestACLFromContext(nil); ok { + t.Fatal("expected missing acl") + } + if _, ok := GatewayMetricsFromContext(nil); ok { + t.Fatal("expected missing metrics") + } + if _, ok := GatewayLoggerFromContext(nil); ok { + t.Fatal("expected missing logger") + } + }) + + t.Run("nil context in with helpers", func(t *testing.T) { + ctx := WithRequestSource(nil, " WS ") + ctx = WithRequestToken(ctx, " token ") + ctx = WithConnectionAuthState(ctx, NewConnectionAuthState()) + ctx = WithTokenAuthenticator(ctx, stubTokenAuthenticator{token: "token"}) + ctx = WithRequestACL(ctx, NewStrictControlPlaneACL()) + ctx = WithGatewayMetrics(ctx, NewGatewayMetrics()) + ctx = WithGatewayLogger(ctx, log.New(os.Stderr, "", 0)) + + if source := RequestSourceFromContext(ctx); source != RequestSourceWS { + t.Fatalf("source = %q, want %q", source, RequestSourceWS) + } + if token := RequestTokenFromContext(ctx); token != "token" { + t.Fatalf("token = %q, want %q", token, "token") + } + }) + + t.Run("type mismatch", func(t *testing.T) { + ctx := context.WithValue(context.Background(), requestSourceContextKey{}, 1) + ctx = context.WithValue(ctx, requestTokenContextKey{}, 2) + ctx = context.WithValue(ctx, connectionAuthStateContextKey{}, "state") + ctx = context.WithValue(ctx, tokenAuthenticatorContextKey{}, "auth") + ctx = context.WithValue(ctx, requestACLContextKey{}, "acl") + ctx = context.WithValue(ctx, gatewayMetricsContextKey{}, "metrics") + ctx = context.WithValue(ctx, gatewayLoggerContextKey{}, "logger") + + if source := RequestSourceFromContext(ctx); source != RequestSourceUnknown { + t.Fatalf("source = %q, want %q", source, RequestSourceUnknown) + } + if token := RequestTokenFromContext(ctx); token != "" { + t.Fatalf("token = %q, want empty", token) + } + if _, ok := ConnectionAuthStateFromContext(ctx); ok { + t.Fatal("expected type mismatch for auth state") + } + if _, ok := TokenAuthenticatorFromContext(ctx); ok { + t.Fatal("expected type mismatch for authenticator") + } + if _, ok := RequestACLFromContext(ctx); ok { + t.Fatal("expected type mismatch for acl") + } + if _, ok := GatewayMetricsFromContext(ctx); ok { + t.Fatal("expected type mismatch for metrics") + } + if _, ok := GatewayLoggerFromContext(ctx); ok { + t.Fatal("expected type mismatch for logger") + } + }) +} + +func TestConnectionAuthStateNilReceiver(t *testing.T) { + var state *ConnectionAuthState + state.MarkAuthenticated() + if state.IsAuthenticated() { + t.Fatal("nil state should remain unauthenticated") + } +} diff --git a/internal/gateway/security_test.go b/internal/gateway/security_test.go index d78261f7..2fa29011 100644 --- a/internal/gateway/security_test.go +++ b/internal/gateway/security_test.go @@ -35,3 +35,19 @@ func TestNormalizeRequestSource(t *testing.T) { t.Fatalf("normalized source = %q, want %q", got, RequestSourceUnknown) } } + +func TestACLModeAndNilBehavior(t *testing.T) { + var nilACL *ControlPlaneACL + if mode := nilACL.Mode(); mode != ACLModeStrict { + t.Fatalf("mode = %q, want %q", mode, ACLModeStrict) + } + if !nilACL.IsAllowed(RequestSourceUnknown, "") { + t.Fatal("nil acl should allow by default") + } + + acl := NewStrictControlPlaneACL() + acl.enabled = false + if !acl.IsAllowed(RequestSourceUnknown, "") { + t.Fatal("disabled acl should allow all requests") + } +} From f3f3274ba0054cc2c6f12f02606ba572c4c80e9b Mon Sep 17 00:00:00 2001 From: xgopilot Date: Fri, 17 Apr 2026 00:36:34 +0000 Subject: [PATCH 08/12] fix(gateway): enforce HTTP auth boundaries and strict gateway config validation Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: pionxe <148670367+pionxe@users.noreply.github.com> --- internal/config/gateway_loader.go | 2 +- internal/config/gateway_test.go | 10 +- internal/gateway/coverage_boost_test.go | 6 +- internal/gateway/network_server.go | 34 +++++- internal/gateway/network_server_test.go | 139 +++++++++++++++++++++++- 5 files changed, 178 insertions(+), 13 deletions(-) diff --git a/internal/config/gateway_loader.go b/internal/config/gateway_loader.go index 5cd37a61..e51933e8 100644 --- a/internal/config/gateway_loader.go +++ b/internal/config/gateway_loader.go @@ -38,13 +38,13 @@ func LoadGatewayConfig(ctx context.Context, baseDir string) (GatewayConfig, erro var file struct { Gateway GatewayConfig `yaml:"gateway,omitempty"` } + file.Gateway = defaults.Clone() decoder := yaml.NewDecoder(bytes.NewReader(data)) if err := decoder.Decode(&file); err != nil { return GatewayConfig{}, fmt.Errorf("config: parse gateway config file: %w", err) } gatewayConfig := file.Gateway - gatewayConfig.ApplyDefaults(defaults) if err := gatewayConfig.Validate(); err != nil { return GatewayConfig{}, fmt.Errorf("config: gateway: %w", err) } diff --git a/internal/config/gateway_test.go b/internal/config/gateway_test.go index f90cbed9..2179fca2 100644 --- a/internal/config/gateway_test.go +++ b/internal/config/gateway_test.go @@ -131,12 +131,12 @@ gateway: t.Fatalf("write config: %v", err) } - cfg, err := LoadGatewayConfig(context.Background(), baseDir) - if err != nil { - t.Fatalf("load gateway config: %v", err) + _, err := LoadGatewayConfig(context.Background(), baseDir) + if err == nil { + t.Fatal("expected invalid gateway config error") } - if cfg.Limits.MaxFrameBytes != DefaultGatewayMaxFrameBytes { - t.Fatalf("max_frame_bytes = %d, want fallback %d", cfg.Limits.MaxFrameBytes, DefaultGatewayMaxFrameBytes) + if !strings.Contains(err.Error(), "max_frame_bytes") { + t.Fatalf("error = %v, want max_frame_bytes validation", err) } }) } diff --git a/internal/gateway/coverage_boost_test.go b/internal/gateway/coverage_boost_test.go index 6e8a20e1..a63640ac 100644 --- a/internal/gateway/coverage_boost_test.go +++ b/internal/gateway/coverage_boost_test.go @@ -5,6 +5,7 @@ import ( "context" "encoding/json" "io" + "net/http" "net/http/httptest" "sync/atomic" "testing" @@ -477,11 +478,14 @@ func TestNetworkServerHelperBranches(t *testing.T) { } recorder := httptest.NewRecorder() - writeJSONRPCHTTPResponse(recorder, protocol.NewJSONRPCErrorResponse(json.RawMessage(`"id-1"`), protocol.NewJSONRPCError( + writeJSONRPCHTTPResponse(recorder, http.StatusUnauthorized, protocol.NewJSONRPCErrorResponse(json.RawMessage(`"id-1"`), protocol.NewJSONRPCError( protocol.JSONRPCCodeInternalError, "boom", protocol.GatewayCodeInternalError, ))) + if recorder.Code != http.StatusUnauthorized { + t.Fatalf("status = %d, want %d", recorder.Code, http.StatusUnauthorized) + } if contentType := recorder.Header().Get("Content-Type"); contentType != "application/json" { t.Fatalf("content type = %q, want application/json", contentType) } diff --git a/internal/gateway/network_server.go b/internal/gateway/network_server.go index d732cacb..74b3850a 100644 --- a/internal/gateway/network_server.go +++ b/internal/gateway/network_server.go @@ -379,6 +379,10 @@ func (s *NetworkServer) handleHealthzRequest(writer http.ResponseWriter, request http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } + if !s.isControlPlaneHTTPRequestAuthorized(request) { + http.Error(writer, "unauthorized", http.StatusUnauthorized) + return + } connectionSnapshot := map[string]int{} if s.relay != nil { @@ -402,6 +406,10 @@ func (s *NetworkServer) handleVersionRequest(writer http.ResponseWriter, request http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } + if !s.isControlPlaneHTTPRequestAuthorized(request) { + http.Error(writer, "unauthorized", http.StatusUnauthorized) + return + } writeJSONResponse(writer, http.StatusOK, ResolvedBuildInfo()) } @@ -449,6 +457,11 @@ func (s *NetworkServer) handleJSONMetrics(writer http.ResponseWriter, request *h // isObservabilityRequestAuthorized 校验 metrics 端点访问 Token。 func (s *NetworkServer) isObservabilityRequestAuthorized(request *http.Request) bool { + return s.isControlPlaneHTTPRequestAuthorized(request) +} + +// isControlPlaneHTTPRequestAuthorized 校验 HTTP 控制面请求是否携带并通过 Bearer Token。 +func (s *NetworkServer) isControlPlaneHTTPRequestAuthorized(request *http.Request) bool { if s.authenticator == nil { return true } @@ -466,14 +479,15 @@ func (s *NetworkServer) handleRPCRequest(writer http.ResponseWriter, request *ht request.Body = http.MaxBytesReader(writer, request.Body, s.maxRequestBytes) rpcRequest, rpcErr := decodeJSONRPCRequestFromReader(request.Body) if rpcErr != nil { - writeJSONRPCHTTPResponse(writer, protocol.NewJSONRPCErrorResponse(nil, rpcErr)) + writeJSONRPCHTTPResponse(writer, http.StatusOK, protocol.NewJSONRPCErrorResponse(nil, rpcErr)) return } token := extractBearerToken(request.Header.Get("Authorization")) rpcCtx := s.decorateRequestContext(request.Context(), RequestSourceHTTP, token) rpcResponse := dispatchRPCRequestFn(rpcCtx, rpcRequest, runtimePort) - writeJSONRPCHTTPResponse(writer, rpcResponse) + statusCode := resolveJSONRPCHTTPStatusCode(rpcResponse) + writeJSONRPCHTTPResponse(writer, statusCode, rpcResponse) } // handleWebSocket 处理 WS 入口请求，连接上下文会在关停或异常时主动取消。 @@ -801,14 +815,26 @@ func decodeJSONRPCRequestFromReader(reader io.Reader) (protocol.JSONRPCRequest, return request, nil } -// writeJSONRPCHTTPResponse 以 JSON 形式写回 HTTP JSON-RPC 响应。 -func writeJSONRPCHTTPResponse(writer http.ResponseWriter, response protocol.JSONRPCResponse) { +// writeJSONRPCHTTPResponse 以 JSON 形式写回 HTTP JSON-RPC 响应，并按状态码输出 HTTP 头。 +func writeJSONRPCHTTPResponse(writer http.ResponseWriter, statusCode int, response protocol.JSONRPCResponse) { writer.Header().Set("Content-Type", "application/json") + writer.WriteHeader(statusCode) encoder := json.NewEncoder(writer) encoder.SetEscapeHTML(false) _ = encoder.Encode(response) } +// resolveJSONRPCHTTPStatusCode 根据网关错误码映射 HTTP 响应状态，未命中时回退 200。 +func resolveJSONRPCHTTPStatusCode(response protocol.JSONRPCResponse) int { + gatewayCode := protocol.GatewayCodeFromJSONRPCError(response.Error) + switch gatewayCode { + case ErrorCodeUnauthorized.String(), ErrorCodeAccessDenied.String(): + return http.StatusUnauthorized + default: + return http.StatusOK + } +} + // writeJSONResponse 以 JSON 形式输出普通 HTTP 响应。 func writeJSONResponse(writer http.ResponseWriter, statusCode int, payload any) { writer.Header().Set("Content-Type", "application/json") diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index 2d13944c..d5205665 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -299,6 +299,94 @@ func TestNetworkServerRPCErrorBranches(t *testing.T) { t.Fatalf("rpc error = %#v, want parse error", rpcResponse.Error) } }) + + t.Run("unauthorized rpc maps to http 401", func(t *testing.T) { + secureServer := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: NewStrictControlPlaneACL(), + }) + secureContext, secureCancel := context.WithCancel(context.Background()) + defer secureCancel() + + secureDone := make(chan error, 1) + go func() { + secureDone <- secureServer.Serve(secureContext, nil) + }() + t.Cleanup(func() { + _ = secureServer.Close(context.Background()) + select { + case <-secureDone: + case <-time.After(2 * time.Second): + t.Fatal("secure network serve goroutine did not exit") + } + }) + + secureAddress := waitForNetworkAddress(t, secureServer) + request, err := http.NewRequest( + http.MethodPost, + "http://"+secureAddress+"/rpc", + strings.NewReader(`{"jsonrpc":"2.0","id":"unauth","method":"gateway.ping","params":{}}`), + ) + if err != nil { + t.Fatalf("new request: %v", err) + } + request.Header.Set("Content-Type", "application/json") + response, err := http.DefaultClient.Do(request) + if err != nil { + t.Fatalf("post /rpc: %v", err) + } + defer response.Body.Close() + if response.StatusCode != http.StatusUnauthorized { + t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusUnauthorized) + } + }) + + t.Run("acl denied rpc maps to http 401", func(t *testing.T) { + deniedACL := &ControlPlaneACL{ + mode: ACLModeStrict, + allow: map[RequestSource]map[string]struct{}{RequestSourceHTTP: {}}, + enabled: true, + } + secureServer := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: deniedACL, + }) + secureContext, secureCancel := context.WithCancel(context.Background()) + defer secureCancel() + + secureDone := make(chan error, 1) + go func() { + secureDone <- secureServer.Serve(secureContext, nil) + }() + t.Cleanup(func() { + _ = secureServer.Close(context.Background()) + select { + case <-secureDone: + case <-time.After(2 * time.Second): + t.Fatal("acl network serve goroutine did not exit") + } + }) + + secureAddress := waitForNetworkAddress(t, secureServer) + request, err := http.NewRequest( + http.MethodPost, + "http://"+secureAddress+"/rpc", + strings.NewReader(`{"jsonrpc":"2.0","id":"denied","method":"gateway.ping","params":{}}`), + ) + if err != nil { + t.Fatalf("new request: %v", err) + } + request.Header.Set("Authorization", "Bearer gateway-token") + request.Header.Set("Content-Type", "application/json") + response, err := http.DefaultClient.Do(request) + if err != nil { + t.Fatalf("post /rpc: %v", err) + } + defer response.Body.Close() + if response.StatusCode != http.StatusUnauthorized { + t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusUnauthorized) + } + }) } func TestNetworkServerWebSocketAndSSEPing(t *testing.T) { @@ -536,6 +624,7 @@ func TestNetworkServerVersionAndObservabilityAuthHelpers(t *testing.T) { t.Run("version get returns build info", func(t *testing.T) { recorder := httptest.NewRecorder() request := httptest.NewRequest(http.MethodGet, "/version", nil) + request.Header.Set("Authorization", "Bearer token-1") server.handleVersionRequest(recorder, request) if recorder.Code != http.StatusOK { t.Fatalf("status = %d, want %d", recorder.Code, http.StatusOK) @@ -549,6 +638,15 @@ func TestNetworkServerVersionAndObservabilityAuthHelpers(t *testing.T) { } }) + t.Run("version requires bearer token when authenticator enabled", func(t *testing.T) { + recorder := httptest.NewRecorder() + request := httptest.NewRequest(http.MethodGet, "/version", nil) + server.handleVersionRequest(recorder, request) + if recorder.Code != http.StatusUnauthorized { + t.Fatalf("status = %d, want %d", recorder.Code, http.StatusUnauthorized) + } + }) + t.Run("observability auth uses bearer token", func(t *testing.T) { request := httptest.NewRequest(http.MethodGet, "/metrics", nil) request.Header.Set("Authorization", "Bearer token-1") @@ -728,8 +826,45 @@ func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { t.Fatalf("get /healthz: %v", err) } defer healthResponse.Body.Close() - if healthResponse.StatusCode != http.StatusOK { - t.Fatalf("/healthz status = %d, want %d", healthResponse.StatusCode, http.StatusOK) + if healthResponse.StatusCode != http.StatusUnauthorized { + t.Fatalf("/healthz status = %d, want %d", healthResponse.StatusCode, http.StatusUnauthorized) + } + + authorizedHealthRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/healthz", nil) + if err != nil { + t.Fatalf("new /healthz request: %v", err) + } + authorizedHealthRequest.Header.Set("Authorization", "Bearer gateway-token") + authorizedHealthResponse, err := http.DefaultClient.Do(authorizedHealthRequest) + if err != nil { + t.Fatalf("authorized get /healthz: %v", err) + } + defer authorizedHealthResponse.Body.Close() + if authorizedHealthResponse.StatusCode != http.StatusOK { + t.Fatalf("authorized /healthz status = %d, want %d", authorizedHealthResponse.StatusCode, http.StatusOK) + } + + versionResponse, err := http.Get("http://" + listenAddress + "/version") + if err != nil { + t.Fatalf("get /version: %v", err) + } + defer versionResponse.Body.Close() + if versionResponse.StatusCode != http.StatusUnauthorized { + t.Fatalf("/version status = %d, want %d", versionResponse.StatusCode, http.StatusUnauthorized) + } + + authorizedVersionRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/version", nil) + if err != nil { + t.Fatalf("new /version request: %v", err) + } + authorizedVersionRequest.Header.Set("Authorization", "Bearer gateway-token") + authorizedVersionResponse, err := http.DefaultClient.Do(authorizedVersionRequest) + if err != nil { + t.Fatalf("authorized get /version: %v", err) + } + defer authorizedVersionResponse.Body.Close() + if authorizedVersionResponse.StatusCode != http.StatusOK { + t.Fatalf("authorized /version status = %d, want %d", authorizedVersionResponse.StatusCode, http.StatusOK) } metricsResponse, err := http.Get("http://" + listenAddress + "/metrics") From 507d14d74f9c98ac8c05b3f20523a9da028a18e1 Mon Sep 17 00:00:00 2001 From: xgopilot Date: Fri, 17 Apr 2026 00:52:43 +0000 Subject: [PATCH 09/12] test(ci): raise patch gate and expand coverage for gateway changes Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: pionxe <148670367+pionxe@users.noreply.github.com> --- .codecov.yml | 2 +- internal/cli/root_test.go | 134 ++++++++++++++++++ internal/config/config_test.go | 11 ++ internal/config/gateway_test.go | 49 ++++++- .../adapters/urlscheme/dispatcher_test.go | 41 ++++++ .../gateway/auth/permissions_unix_test.go | 33 +++++ internal/gateway/metrics_test.go | 54 +++++++ internal/gateway/request_context_test.go | 21 +++ internal/gateway/request_logging_test.go | 83 +++++++++++ internal/gateway/rpc_dispatch_test.go | 105 ++++++++++++++ internal/gateway/security_test.go | 10 ++ internal/gateway/validate_test.go | 9 ++ 12 files changed, 550 insertions(+), 2 deletions(-) create mode 100644 internal/gateway/auth/permissions_unix_test.go create mode 100644 internal/gateway/request_logging_test.go diff --git a/.codecov.yml b/.codecov.yml index 5456fd79..1ccdbc5e 100644 --- a/.codecov.yml +++ b/.codecov.yml @@ -5,4 +5,4 @@ coverage: target: 80% # 告诉裁判：整体覆盖率 80% 就给我亮绿灯 patch: default: - target: 80% # 告诉裁判：这次 PR 新增的代码覆盖率达到 80% 也给我亮绿灯 \ No newline at end of file + target: 95% # 告诉裁判：这次 PR 新增的代码覆盖率达到 95% 才给我亮绿灯 diff --git a/internal/cli/root_test.go b/internal/cli/root_test.go index 55a7b1da..905bf6c2 100644 --- a/internal/cli/root_test.go +++ b/internal/cli/root_test.go @@ -15,8 +15,10 @@ import ( "github.com/spf13/cobra" "neo-code/internal/app" + "neo-code/internal/config" "neo-code/internal/gateway" "neo-code/internal/gateway/adapters/urlscheme" + gatewayauth "neo-code/internal/gateway/auth" ) func TestNewRootCommandPassesWorkdirFlagToLauncher(t *testing.T) { @@ -285,6 +287,47 @@ func TestDefaultGatewayCommandRunnerReturnsConstructorError(t *testing.T) { } } +func TestDefaultGatewayCommandRunnerReturnsLoadConfigError(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + cancel() + err := defaultGatewayCommandRunner(ctx, gatewayCommandOptions{ + ListenAddress: "stub://gateway", + HTTPAddress: "127.0.0.1:8080", + LogLevel: "info", + }) + if err == nil { + t.Fatal("expected load config error") + } +} + +func TestDefaultGatewayCommandRunnerReturnsAuthManagerError(t *testing.T) { + originalNewGatewayServer := newGatewayServer + originalNewGatewayNetwork := newGatewayNetwork + originalNewAuthManager := newAuthManager + t.Cleanup(func() { newGatewayServer = originalNewGatewayServer }) + t.Cleanup(func() { newGatewayNetwork = originalNewGatewayNetwork }) + t.Cleanup(func() { newAuthManager = originalNewAuthManager }) + + newAuthManager = func(string) (*gatewayauth.Manager, error) { + return nil, errors.New("auth manager failed") + } + newGatewayServer = func(options gateway.ServerOptions) (gatewayServer, error) { + return &stubGatewayServer{listenAddress: "stub://gateway"}, nil + } + newGatewayNetwork = func(options gateway.NetworkServerOptions) (gatewayNetworkServer, error) { + return &stubGatewayServer{listenAddress: "127.0.0.1:8080"}, nil + } + + err := defaultGatewayCommandRunner(context.Background(), gatewayCommandOptions{ + ListenAddress: "stub://gateway", + HTTPAddress: "127.0.0.1:8080", + LogLevel: "info", + }) + if err == nil || !strings.Contains(err.Error(), "initialize gateway auth manager") { + t.Fatalf("expected auth manager error, got %v", err) + } +} + func TestDefaultGatewayCommandRunnerReturnsServeError(t *testing.T) { originalNewGatewayServer := newGatewayServer originalNewGatewayNetwork := newGatewayNetwork @@ -438,6 +481,50 @@ func TestBuildGatewayControlPlaneACL(t *testing.T) { }) } +func TestApplyGatewayFlagOverrides(t *testing.T) { + t.Run("nil config no-op", func(t *testing.T) { + applyGatewayFlagOverrides(nil, gatewayCommandOptions{}) + }) + + t.Run("all override fields", func(t *testing.T) { + gatewayConfig := config.StaticDefaults().Gateway + applyGatewayFlagOverrides(&gatewayConfig, gatewayCommandOptions{ + ACLMode: "strict", + MaxFrameBytes: 2048, + IPCMaxConnections: 32, + HTTPMaxRequestBytes: 4096, + HTTPMaxStreamConnections: 16, + IPCReadSec: 11, + IPCWriteSec: 12, + HTTPReadSec: 13, + HTTPWriteSec: 14, + HTTPShutdownSec: 15, + MetricsEnabledOverridden: true, + MetricsEnabled: false, + }) + + if gatewayConfig.Security.ACLMode != "strict" { + t.Fatalf("acl_mode = %q, want strict", gatewayConfig.Security.ACLMode) + } + if gatewayConfig.Limits.MaxFrameBytes != 2048 || gatewayConfig.Limits.IPCMaxConnections != 32 { + t.Fatalf("limits = %#v, want overrides applied", gatewayConfig.Limits) + } + if gatewayConfig.Limits.HTTPMaxRequestBytes != 4096 || gatewayConfig.Limits.HTTPMaxStreamConnections != 16 { + t.Fatalf("http limits = %#v, want overrides applied", gatewayConfig.Limits) + } + if gatewayConfig.Timeouts.IPCReadSec != 11 || gatewayConfig.Timeouts.IPCWriteSec != 12 { + t.Fatalf("ipc timeouts = %#v, want overrides applied", gatewayConfig.Timeouts) + } + if gatewayConfig.Timeouts.HTTPReadSec != 13 || gatewayConfig.Timeouts.HTTPWriteSec != 14 || + gatewayConfig.Timeouts.HTTPShutdownSec != 15 { + t.Fatalf("http timeouts = %#v, want overrides applied", gatewayConfig.Timeouts) + } + if gatewayConfig.Observability.MetricsEnabled == nil || *gatewayConfig.Observability.MetricsEnabled { + t.Fatalf("metrics_enabled = %#v, want false", gatewayConfig.Observability.MetricsEnabled) + } + }) +} + func TestDefaultNewGatewayServer(t *testing.T) { server, err := defaultNewGatewayServer(gateway.ServerOptions{ ListenAddress: "stub://gateway", @@ -723,6 +810,53 @@ func TestURLDispatchSubcommandDefaultRunnerError(t *testing.T) { } } +func TestURLDispatchSubcommandDefaultRunnerLoadTokenError(t *testing.T) { + originalRunner := runURLDispatchCommand + originalExitProcess := exitProcess + originalLoadAuthToken := loadAuthToken + originalWriteDispatchError := writeDispatchError + originalPreload := runGlobalPreload + originalStderr := os.Stderr + t.Cleanup(func() { runURLDispatchCommand = originalRunner }) + t.Cleanup(func() { exitProcess = originalExitProcess }) + t.Cleanup(func() { loadAuthToken = originalLoadAuthToken }) + t.Cleanup(func() { writeDispatchError = originalWriteDispatchError }) + t.Cleanup(func() { runGlobalPreload = originalPreload }) + t.Cleanup(func() { os.Stderr = originalStderr }) + runGlobalPreload = func(context.Context) error { return nil } + runURLDispatchCommand = defaultURLDispatchCommandRunner + loadAuthToken = func(string) (string, error) { return "", errors.New("read token failed") } + + exitCode := 0 + exitProcess = func(code int) { exitCode = code } + writeDispatchError = writeURLDispatchErrorOutput + + stderrReader, stderrWriter, err := os.Pipe() + if err != nil { + t.Fatalf("create stderr pipe: %v", err) + } + t.Cleanup(func() { _ = stderrReader.Close() }) + os.Stderr = stderrWriter + + command := NewRootCommand() + command.SetArgs([]string{"url-dispatch", "--url", "neocode://review?path=README.md"}) + if err := command.ExecuteContext(context.Background()); err != nil { + t.Fatalf("ExecuteContext() error = %v", err) + } + + _ = stderrWriter.Close() + stderrOutput, readErr := io.ReadAll(stderrReader) + if readErr != nil { + t.Fatalf("read stderr: %v", readErr) + } + if exitCode != 1 { + t.Fatalf("exit code = %d, want %d", exitCode, 1) + } + if !strings.Contains(string(stderrOutput), `"status":"error"`) { + t.Fatalf("stderr = %q, want contains error status", string(stderrOutput)) + } +} + func TestURLDispatchSubcommandDefaultRunnerErrorFallsBackWhenJSONWriteFails(t *testing.T) { originalRunner := runURLDispatchCommand originalDispatch := dispatchURLThroughIPC diff --git a/internal/config/config_test.go b/internal/config/config_test.go index 0a55a580..46dc3966 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -278,6 +278,17 @@ func TestConfigMethodErrorPaths(t *testing.T) { }) } +func TestConfigValidateGatewayError(t *testing.T) { + t.Parallel() + + cfg := testDefaultConfig() + cfg.Workdir = t.TempDir() + cfg.Gateway.Security.ACLMode = "invalid-acl" + if err := cfg.ValidateSnapshot(); err == nil || !strings.Contains(err.Error(), "config: gateway:") { + t.Fatalf("expected gateway validation error, got %v", err) + } +} + func TestManagerConcurrentAccess(t *testing.T) { tempDir := t.TempDir() manager := NewManager(NewLoader(tempDir, testDefaultConfig())) diff --git a/internal/config/gateway_test.go b/internal/config/gateway_test.go index 2179fca2..9697900a 100644 --- a/internal/config/gateway_test.go +++ b/internal/config/gateway_test.go @@ -52,7 +52,14 @@ func TestGatewayConfigApplyDefaultsAndValidate(t *testing.T) { } func TestLoadGatewayConfig(t *testing.T) { - t.Parallel() + t.Run("cancelled context returns error", func(t *testing.T) { + t.Parallel() + ctx, cancel := context.WithCancel(context.Background()) + cancel() + if _, err := LoadGatewayConfig(ctx, t.TempDir()); err == nil { + t.Fatal("expected canceled context error") + } + }) t.Run("missing file uses defaults", func(t *testing.T) { t.Parallel() @@ -65,6 +72,14 @@ func TestLoadGatewayConfig(t *testing.T) { } }) + t.Run("empty basedir falls back to user home", func(t *testing.T) { + cfg, err := LoadGatewayConfig(context.Background(), "") + if err != nil { + t.Fatalf("load gateway config with empty base dir: %v", err) + } + _ = cfg + }) + t.Run("reads gateway section", func(t *testing.T) { t.Parallel() @@ -139,6 +154,19 @@ gateway: t.Fatalf("error = %v, want max_frame_bytes validation", err) } }) + + t.Run("invalid yaml returns parse error", func(t *testing.T) { + t.Parallel() + baseDir := t.TempDir() + configPath := filepath.Join(baseDir, configName) + if err := os.WriteFile(configPath, []byte("gateway: ["), 0o644); err != nil { + t.Fatalf("write config: %v", err) + } + _, err := LoadGatewayConfig(context.Background(), baseDir) + if err == nil || !strings.Contains(err.Error(), "parse gateway config file") { + t.Fatalf("expected parse gateway config error, got %v", err) + } + }) } func TestGatewaySecurityConfigApplyDefaultsAndValidateBranches(t *testing.T) { @@ -372,3 +400,22 @@ func TestGatewayNormalizeAllowOrigins(t *testing.T) { t.Fatalf("normalized = %#v, want trimmed values", normalized) } } + +func TestGatewayApplyDefaultsNilReceivers(t *testing.T) { + t.Parallel() + + var gatewayCfg *GatewayConfig + gatewayCfg.ApplyDefaults(defaultGatewayConfig()) + + var securityCfg *GatewaySecurityConfig + securityCfg.ApplyDefaults(GatewaySecurityConfig{ACLMode: DefaultGatewayACLMode}) + + var limitsCfg *GatewayLimitsConfig + limitsCfg.ApplyDefaults(GatewayLimitsConfig{MaxFrameBytes: 1}) + + var timeoutsCfg *GatewayTimeoutsConfig + timeoutsCfg.ApplyDefaults(GatewayTimeoutsConfig{IPCReadSec: 1}) + + var observabilityCfg *GatewayObservabilityConfig + observabilityCfg.ApplyDefaults(GatewayObservabilityConfig{MetricsEnabled: boolPtr(false)}) +} diff --git a/internal/gateway/adapters/urlscheme/dispatcher_test.go b/internal/gateway/adapters/urlscheme/dispatcher_test.go index 9c8678e0..1e4a47c8 100644 --- a/internal/gateway/adapters/urlscheme/dispatcher_test.go +++ b/internal/gateway/adapters/urlscheme/dispatcher_test.go @@ -785,6 +785,47 @@ func TestDispatcherDispatchAdditionalErrorBranches(t *testing.T) { }) } +func TestDispatcherAuthenticateBranches(t *testing.T) { + t.Run("rpc returns error", func(t *testing.T) { + dispatcher := &Dispatcher{ + requestIDFn: func() string { return "wake-auth-1" }, + } + conn := &stubDispatchConn{ + readBuffer: bytes.NewBufferString(`{"jsonrpc":"2.0","id":"wake-auth-1-auth","error":{"code":-32600,"message":"unauthorized","data":{"gateway_code":"unauthorized"}}}` + "\n"), + } + err := dispatcher.authenticate(context.Background(), conn, "token-1") + if err == nil { + t.Fatal("expected authenticate rpc error") + } + }) + + t.Run("missing auth result payload", func(t *testing.T) { + dispatcher := &Dispatcher{ + requestIDFn: func() string { return "wake-auth-2" }, + } + conn := &stubDispatchConn{ + readBuffer: bytes.NewBufferString(`{"jsonrpc":"2.0","id":"wake-auth-2-auth"}` + "\n"), + } + err := dispatcher.authenticate(context.Background(), conn, "token-1") + if err == nil || !strings.Contains(err.Error(), "missing result payload") { + t.Fatalf("expected missing result payload error, got %v", err) + } + }) + + t.Run("unexpected auth frame", func(t *testing.T) { + dispatcher := &Dispatcher{ + requestIDFn: func() string { return "wake-auth-3" }, + } + conn := &stubDispatchConn{ + readBuffer: bytes.NewBufferString(`{"jsonrpc":"2.0","id":"wake-auth-3-auth","result":{"type":"ack","action":"gateway.ping","request_id":"wake-auth-3-auth"}}` + "\n"), + } + err := dispatcher.authenticate(context.Background(), conn, "token-1") + if err == nil || !strings.Contains(err.Error(), "unexpected auth response frame") { + t.Fatalf("expected unexpected auth frame error, got %v", err) + } + }) +} + func TestDispatcherDispatchWithAuthHandshake(t *testing.T) { serverConn, clientConn := net.Pipe() t.Cleanup(func() { diff --git a/internal/gateway/auth/permissions_unix_test.go b/internal/gateway/auth/permissions_unix_test.go new file mode 100644 index 00000000..6fe7a68f --- /dev/null +++ b/internal/gateway/auth/permissions_unix_test.go @@ -0,0 +1,33 @@ +//go:build !windows + +package auth + +import ( + "os" + "path/filepath" + "testing" +) + +func TestApplyAuthPermissions(t *testing.T) { + dir := t.TempDir() + file := filepath.Join(dir, "auth.json") + if err := os.WriteFile(file, []byte("{}"), 0o644); err != nil { + t.Fatalf("write auth file: %v", err) + } + + if err := applyAuthDirPermission(dir); err != nil { + t.Fatalf("applyAuthDirPermission() error = %v", err) + } + if err := applyAuthFilePermission(file); err != nil { + t.Fatalf("applyAuthFilePermission() error = %v", err) + } +} + +func TestApplyAuthPermissionsErrorBranches(t *testing.T) { + if err := applyAuthDirPermission(filepath.Join(t.TempDir(), "missing-dir")); err == nil { + t.Fatal("expected chmod missing dir error") + } + if err := applyAuthFilePermission(filepath.Join(t.TempDir(), "missing-file")); err == nil { + t.Fatal("expected chmod missing file error") + } +} diff --git a/internal/gateway/metrics_test.go b/internal/gateway/metrics_test.go index 7d26825c..f9c992e6 100644 --- a/internal/gateway/metrics_test.go +++ b/internal/gateway/metrics_test.go @@ -27,3 +27,57 @@ func TestGatewayMetricsSnapshot(t *testing.T) { t.Fatalf("stream dropped snapshot mismatch: %#v", snapshot["gateway_stream_dropped_total"]) } } + +func TestGatewayMetricsNilReceiverAndLabelNormalization(t *testing.T) { + var metrics *GatewayMetrics + if metrics.Registry() != nil { + t.Fatal("nil metrics registry should be nil") + } + if snapshot := metrics.Snapshot(); len(snapshot) != 0 { + t.Fatalf("nil metrics snapshot = %#v, want empty", snapshot) + } + metrics.IncRequests("", "", "") + metrics.IncAuthFailures("", "") + metrics.IncACLDenied("", "") + metrics.SetConnectionsActive("", 1) + metrics.IncStreamDropped("") + + realMetrics := NewGatewayMetrics() + realMetrics.IncRequests(" IPC ", " gateway.ping ", " ") + realMetrics.IncAuthFailures(" HTTP ", " ") + realMetrics.IncACLDenied(" WS ", " ") + realMetrics.SetConnectionsActive(" ", 3) + realMetrics.IncStreamDropped(" ") + + snapshot := realMetrics.Snapshot() + if snapshot["gateway_requests_total"]["ipc|gateway.ping|unknown"] != 1 { + t.Fatalf("normalized request labels mismatch: %#v", snapshot["gateway_requests_total"]) + } + if snapshot["gateway_auth_failures_total"]["http|unknown"] != 1 { + t.Fatalf("normalized auth labels mismatch: %#v", snapshot["gateway_auth_failures_total"]) + } + if snapshot["gateway_acl_denied_total"]["ws|unknown"] != 1 { + t.Fatalf("normalized acl labels mismatch: %#v", snapshot["gateway_acl_denied_total"]) + } + if snapshot["gateway_connections_active"]["unknown"] != 3 { + t.Fatalf("normalized connection labels mismatch: %#v", snapshot["gateway_connections_active"]) + } + if snapshot["gateway_stream_dropped_total"]["unknown"] != 1 { + t.Fatalf("normalized dropped labels mismatch: %#v", snapshot["gateway_stream_dropped_total"]) + } +} + +func TestGatewayMetricsSnapshotMapRecreateBranches(t *testing.T) { + metrics := NewGatewayMetrics() + delete(metrics.snapshot, "gateway_requests_total") + delete(metrics.snapshot, "gateway_connections_active") + metrics.IncRequests("ipc", "gateway.ping", "ok") + metrics.SetConnectionsActive("ipc", 1) + snapshot := metrics.Snapshot() + if snapshot["gateway_requests_total"]["ipc|gateway.ping|ok"] != 1 { + t.Fatalf("requests snapshot mismatch: %#v", snapshot["gateway_requests_total"]) + } + if snapshot["gateway_connections_active"]["ipc"] != 1 { + t.Fatalf("connections snapshot mismatch: %#v", snapshot["gateway_connections_active"]) + } +} diff --git a/internal/gateway/request_context_test.go b/internal/gateway/request_context_test.go index c78cc772..de11d86a 100644 --- a/internal/gateway/request_context_test.go +++ b/internal/gateway/request_context_test.go @@ -147,3 +147,24 @@ func TestConnectionAuthStateNilReceiver(t *testing.T) { t.Fatal("nil state should remain unauthenticated") } } + +func TestRequestContextWithHelpersOnNilContextIndividually(t *testing.T) { + if token := RequestTokenFromContext(WithRequestToken(nil, " token-2 ")); token != "token-2" { + t.Fatalf("token = %q, want %q", token, "token-2") + } + if _, ok := ConnectionAuthStateFromContext(WithConnectionAuthState(nil, NewConnectionAuthState())); !ok { + t.Fatal("expected auth state to be attached on nil context") + } + if _, ok := TokenAuthenticatorFromContext(WithTokenAuthenticator(nil, stubTokenAuthenticator{token: "t"})); !ok { + t.Fatal("expected authenticator to be attached on nil context") + } + if _, ok := RequestACLFromContext(WithRequestACL(nil, NewStrictControlPlaneACL())); !ok { + t.Fatal("expected acl to be attached on nil context") + } + if _, ok := GatewayMetricsFromContext(WithGatewayMetrics(nil, NewGatewayMetrics())); !ok { + t.Fatal("expected metrics to be attached on nil context") + } + if _, ok := GatewayLoggerFromContext(WithGatewayLogger(nil, log.New(os.Stderr, "", 0))); !ok { + t.Fatal("expected logger to be attached on nil context") + } +} diff --git a/internal/gateway/request_logging_test.go b/internal/gateway/request_logging_test.go new file mode 100644 index 00000000..0dfbbccc --- /dev/null +++ b/internal/gateway/request_logging_test.go @@ -0,0 +1,83 @@ +package gateway + +import ( + "bytes" + "context" + "log" + "strings" + "testing" + "time" +) + +func TestEmitRequestLogAuthStateAndSourceFallback(t *testing.T) { + t.Run("authenticated state", func(t *testing.T) { + buffer := &bytes.Buffer{} + logger := log.New(buffer, "", 0) + authState := NewConnectionAuthState() + authState.MarkAuthenticated() + ctx := WithConnectionAuthState(context.Background(), authState) + ctx = WithConnectionID(ctx, ConnectionID("conn-1")) + + emitRequestLog(ctx, logger, RequestLogEntry{ + RequestID: " req-1 ", + SessionID: " session-1 ", + Method: " gateway.ping ", + Status: "ok", + }) + output := buffer.String() + if !strings.Contains(output, `"source":"unknown"`) { + t.Fatalf("output = %q, want unknown source", output) + } + if !strings.Contains(output, `"connection_id":"conn-1"`) { + t.Fatalf("output = %q, want connection_id", output) + } + if !strings.Contains(output, `"auth_state":"authenticated"`) { + t.Fatalf("output = %q, want authenticated state", output) + } + }) + + t.Run("required auth state", func(t *testing.T) { + buffer := &bytes.Buffer{} + logger := log.New(buffer, "", 0) + ctx := WithTokenAuthenticator(context.Background(), staticTokenAuthenticator{token: "token-1"}) + + emitRequestLog(ctx, logger, RequestLogEntry{ + RequestID: "req-2", + Method: "gateway.ping", + Source: string(RequestSourceHTTP), + Status: "error", + }) + if !strings.Contains(buffer.String(), `"auth_state":"required"`) { + t.Fatalf("output = %q, want required auth state", buffer.String()) + } + }) + + t.Run("disabled auth state", func(t *testing.T) { + buffer := &bytes.Buffer{} + logger := log.New(buffer, "", 0) + emitRequestLog(context.Background(), logger, RequestLogEntry{ + RequestID: "req-3", + Method: "gateway.ping", + Source: string(RequestSourceIPC), + Status: "ok", + }) + if !strings.Contains(buffer.String(), `"auth_state":"disabled"`) { + t.Fatalf("output = %q, want disabled auth state", buffer.String()) + } + }) + + t.Run("nil logger", func(t *testing.T) { + emitRequestLog(context.Background(), nil, RequestLogEntry{ + RequestID: "req-noop", + }) + }) +} + +func TestRequestLatencyMS(t *testing.T) { + if requestLatencyMS(time.Time{}) != 0 { + t.Fatal("zero start time should return 0 latency") + } + if requestStartTime().IsZero() { + t.Fatal("requestStartTime should not return zero time") + } +} diff --git a/internal/gateway/rpc_dispatch_test.go b/internal/gateway/rpc_dispatch_test.go index 433631f3..35576cce 100644 --- a/internal/gateway/rpc_dispatch_test.go +++ b/internal/gateway/rpc_dispatch_test.go @@ -247,3 +247,108 @@ func TestDispatchRPCRequestAuthenticateThenPing(t *testing.T) { t.Fatal("ping payload should include version") } } + +func TestDispatchRPCRequestMissingSessionAndAuthHelpers(t *testing.T) { + metrics := NewGatewayMetrics() + ctx := WithRequestSource(context.Background(), RequestSourceHTTP) + ctx = WithGatewayMetrics(ctx, metrics) + ctx = WithRequestACL(ctx, NewStrictControlPlaneACL()) + ctx = WithConnectionAuthState(ctx, NewConnectionAuthState()) + + response := dispatchRPCRequest(ctx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-missing-session"`), + Method: protocol.MethodGatewayBindStream, + Params: json.RawMessage(`{}`), + }, nil) + if response.Error == nil { + t.Fatal("expected missing session error") + } + if gatewayCode := protocol.GatewayCodeFromJSONRPCError(response.Error); gatewayCode != protocol.GatewayCodeMissingRequiredField { + t.Fatalf("gateway_code = %q, want %q", gatewayCode, protocol.GatewayCodeMissingRequiredField) + } +} + +func TestIsRequestAuthenticatedBranches(t *testing.T) { + authenticator := staticTokenAuthenticator{token: "token-ok"} + + if !isRequestAuthenticated(context.Background()) { + t.Fatal("request without authenticator should be treated as authenticated") + } + + ctx := WithTokenAuthenticator(context.Background(), authenticator) + if isRequestAuthenticated(ctx) { + t.Fatal("empty request token should fail authentication") + } + + ctx = WithRequestToken(ctx, "token-ok") + if !isRequestAuthenticated(ctx) { + t.Fatal("matching token should pass authentication") + } + + ctx = WithRequestToken(ctx, "token-bad") + if isRequestAuthenticated(ctx) { + t.Fatal("mismatched token should fail authentication") + } +} + +func TestAuthorizeRPCRequestBranches(t *testing.T) { + denyACL := &ControlPlaneACL{ + mode: ACLModeStrict, + allow: map[RequestSource]map[string]struct{}{}, + enabled: true, + } + + ctx := WithRequestSource(context.Background(), RequestSourceIPC) + ctx = WithRequestACL(ctx, denyACL) + err := authorizeRPCRequest(ctx, protocol.MethodGatewayAuthenticate, string(FrameActionAuthenticate)) + if err == nil || protocol.GatewayCodeFromJSONRPCError(err) != ErrorCodeAccessDenied.String() { + t.Fatalf("authenticate acl error = %#v, want access_denied", err) + } + + ctx = WithTokenAuthenticator(ctx, staticTokenAuthenticator{token: "token-1"}) + err = authorizeRPCRequest(ctx, protocol.MethodGatewayPing, string(FrameActionPing)) + if err == nil || protocol.GatewayCodeFromJSONRPCError(err) != ErrorCodeUnauthorized.String() { + t.Fatalf("unauthenticated request error = %#v, want unauthorized", err) + } +} + +func TestDispatchRPCRequestMetricsBranches(t *testing.T) { + metrics := NewGatewayMetrics() + authenticator := staticTokenAuthenticator{token: "token-m"} + ctx := WithRequestSource(context.Background(), RequestSourceHTTP) + ctx = WithTokenAuthenticator(ctx, authenticator) + ctx = WithConnectionAuthState(ctx, NewConnectionAuthState()) + ctx = WithRequestACL(ctx, NewStrictControlPlaneACL()) + ctx = WithGatewayMetrics(ctx, metrics) + + unauthorized := dispatchRPCRequest(ctx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-m1"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }, nil) + if unauthorized.Error == nil { + t.Fatal("expected unauthorized error response") + } + + okCtx := WithRequestToken(ctx, "token-m") + okCtx = WithConnectionAuthState(okCtx, NewConnectionAuthState()) + ack := dispatchRPCRequest(okCtx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-m2"`), + Method: protocol.MethodGatewayPing, + Params: json.RawMessage(`{}`), + }, nil) + if ack.Error != nil { + t.Fatalf("expected success response, got %+v", ack.Error) + } + + snapshot := metrics.Snapshot() + if snapshot["gateway_requests_total"]["http|gateway.ping|error"] == 0 { + t.Fatalf("expected error request metric, snapshot=%#v", snapshot["gateway_requests_total"]) + } + if snapshot["gateway_requests_total"]["http|gateway.ping|ok"] == 0 { + t.Fatalf("expected ok request metric, snapshot=%#v", snapshot["gateway_requests_total"]) + } +} diff --git a/internal/gateway/security_test.go b/internal/gateway/security_test.go index 2fa29011..fcf2b7e2 100644 --- a/internal/gateway/security_test.go +++ b/internal/gateway/security_test.go @@ -51,3 +51,13 @@ func TestACLModeAndNilBehavior(t *testing.T) { t.Fatal("disabled acl should allow all requests") } } + +func TestACLModeAndMethodValidationBranches(t *testing.T) { + acl := NewStrictControlPlaneACL() + if acl.Mode() != ACLModeStrict { + t.Fatalf("mode = %q, want %q", acl.Mode(), ACLModeStrict) + } + if acl.IsAllowed(RequestSourceIPC, " ") { + t.Fatal("empty normalized method should be denied") + } +} diff --git a/internal/gateway/validate_test.go b/internal/gateway/validate_test.go index 1e5f89c7..72623b3e 100644 --- a/internal/gateway/validate_test.go +++ b/internal/gateway/validate_test.go @@ -22,6 +22,15 @@ func TestValidateFrame_BasicRules(t *testing.T) { }, wantNil: true, }, + { + name: "authenticate missing payload", + frame: MessageFrame{ + Type: FrameTypeRequest, + Action: FrameActionAuthenticate, + }, + wantCode: ErrorCodeMissingRequiredField.String(), + wantField: "payload", + }, { name: "valid wake open url request", frame: MessageFrame{ From 2273281507db707fca2218a88eefa26b27404e9b Mon Sep 17 00:00:00 2001 From: pionxe <148670367+pionxe@users.noreply.github.com> Date: Fri, 17 Apr 2026 09:18:02 +0800 Subject: [PATCH 10/12] Adjust target coverage for PR new code Changed the target coverage for new code in PRs from 95% to 80%. --- .codecov.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.codecov.yml b/.codecov.yml index 1ccdbc5e..371dd5e0 100644 --- a/.codecov.yml +++ b/.codecov.yml @@ -5,4 +5,4 @@ coverage: target: 80% # 告诉裁判：整体覆盖率 80% 就给我亮绿灯 patch: default: - target: 95% # 告诉裁判：这次 PR 新增的代码覆盖率达到 95% 才给我亮绿灯 + target: 80% # 告诉裁判：这次 PR 新增的代码覆盖率达到 95% 才给我亮绿灯 From 6fbf88b214a2d8ab984b3630708a71535732d4c7 Mon Sep 17 00:00:00 2001 From: pionxe Date: Fri, 17 Apr 2026 14:38:09 +0800 Subject: [PATCH 11/12] =?UTF-8?q?fix(gateway):=20[EPIC-GW-06]=20=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=E6=B7=B1=E5=BA=A6=E5=AE=89=E5=85=A8=E5=AE=A1=E8=AE=A1?= =?UTF-8?q?=E6=8C=87=E5=87=BA=E7=9A=84=E9=AB=98=E5=8D=B1=E6=BC=8F=E6=B4=9E?= =?UTF-8?q?=E4=B8=8E=E9=85=8D=E7=BD=AE=E5=9B=9E=E5=BD=92?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 基于 Code Review 的深度审计反馈，全面修复了 5 项影响网关可用性、配置一致性与本地安全防御的 P1/P2 级缺陷： 1. 防御连接占位 DoS (P1)：为 WebSocket 连接引入 3 秒“未认证超时剔除”机制。强制回收未在限期内完成 Token 校验的僵尸连接，防止恶意客户端耗尽最大流式连接池。 2. 指标高基数防御 (P1)：在 Prometheus 埋点层增加 Method 白名单过滤。将非法或随机的 RPC 方法统一折叠记录为 `unknown_method`，彻底封堵利用随机输入打爆网关内存的攻击路径。 3. 探活契约对齐 (P1)：移除 `/healthz` 与 `/version` 端点的鉴权拦截，恢复其绝对公开路由属性，消除与文档的偏差，保障外部系统健康检查的稳定运行。 4. 凭证落盘安全与防劫持 (P2)：重构 auth.json 的读写机制。新增软/硬链接（Symlink/Hardlink）指向拒绝策略，防范本地提权劫持；将凭证写入升级为“临时文件 -> Sync 刷盘 -> Rename 原子覆盖”模式，彻底杜绝异常中断导致的凭证损坏。 5. 严格配置校验防漂移 (P2)：在 Gateway 配置文件的 YAML 解析中全面启用 KnownFields(true)。对任何未知配置键或拼写错误直接抛出 Fatal 阻断启动，消灭静默降级带来的运维盲区。 --- internal/config/gateway_loader.go | 4 +- internal/config/gateway_test.go | 26 ++++ internal/gateway/auth/hardlink_unix.go | 20 +++ internal/gateway/auth/hardlink_windows.go | 10 ++ internal/gateway/auth/manager.go | 108 +++++++++++++- internal/gateway/auth/manager_test.go | 170 ++++++++++++++++++++++ internal/gateway/metrics.go | 31 +++- internal/gateway/metrics_test.go | 16 +- internal/gateway/network_server.go | 79 ++++++++-- internal/gateway/network_server_test.go | 159 +++++++++++++++----- internal/gateway/rpc_dispatch.go | 17 ++- internal/gateway/rpc_dispatch_test.go | 21 +++ 12 files changed, 595 insertions(+), 66 deletions(-) create mode 100644 internal/gateway/auth/hardlink_unix.go create mode 100644 internal/gateway/auth/hardlink_windows.go diff --git a/internal/config/gateway_loader.go b/internal/config/gateway_loader.go index e51933e8..40b991c9 100644 --- a/internal/config/gateway_loader.go +++ b/internal/config/gateway_loader.go @@ -36,10 +36,12 @@ func LoadGatewayConfig(ctx context.Context, baseDir string) (GatewayConfig, erro } var file struct { - Gateway GatewayConfig `yaml:"gateway,omitempty"` + Gateway GatewayConfig `yaml:"gateway,omitempty"` + Extra map[string]any `yaml:",inline"` } file.Gateway = defaults.Clone() decoder := yaml.NewDecoder(bytes.NewReader(data)) + decoder.KnownFields(true) if err := decoder.Decode(&file); err != nil { return GatewayConfig{}, fmt.Errorf("config: parse gateway config file: %w", err) } diff --git a/internal/config/gateway_test.go b/internal/config/gateway_test.go index 9697900a..9c29619e 100644 --- a/internal/config/gateway_test.go +++ b/internal/config/gateway_test.go @@ -167,6 +167,32 @@ gateway: t.Fatalf("expected parse gateway config error, got %v", err) } }) + + t.Run("unknown gateway field returns parse error", func(t *testing.T) { + t.Parallel() + baseDir := t.TempDir() + configPath := filepath.Join(baseDir, configName) + content := ` +selected_provider: openai +current_model: gpt-5.4 +shell: bash +gateway: + security: + acl_mode: strict + token_fiel: /tmp/typo-auth.json +` + if err := os.WriteFile(configPath, []byte(strings.TrimSpace(content)+"\n"), 0o644); err != nil { + t.Fatalf("write config: %v", err) + } + + _, err := LoadGatewayConfig(context.Background(), baseDir) + if err == nil { + t.Fatal("expected unknown gateway field parse error") + } + if !strings.Contains(strings.ToLower(err.Error()), "field") { + t.Fatalf("error = %v, want contains unknown field diagnostic", err) + } + }) } func TestGatewaySecurityConfigApplyDefaultsAndValidateBranches(t *testing.T) { diff --git a/internal/gateway/auth/hardlink_unix.go b/internal/gateway/auth/hardlink_unix.go new file mode 100644 index 00000000..2ec73aff --- /dev/null +++ b/internal/gateway/auth/hardlink_unix.go @@ -0,0 +1,20 @@ +//go:build !windows + +package auth + +import ( + "os" + "syscall" +) + +// isUnsafeCredentialHardLink 在 Unix 平台识别多硬链接文件，避免凭证被旁路引用。 +func isUnsafeCredentialHardLink(fileInfo os.FileInfo) bool { + if fileInfo == nil || fileInfo.IsDir() { + return false + } + stat, ok := fileInfo.Sys().(*syscall.Stat_t) + if !ok || stat == nil { + return false + } + return stat.Nlink > 1 +} diff --git a/internal/gateway/auth/hardlink_windows.go b/internal/gateway/auth/hardlink_windows.go new file mode 100644 index 00000000..ee579075 --- /dev/null +++ b/internal/gateway/auth/hardlink_windows.go @@ -0,0 +1,10 @@ +//go:build windows + +package auth + +import "os" + +// isUnsafeCredentialHardLink 在 Windows 平台暂不做硬链接计数判断，保持与软链接拦截策略兼容。 +func isUnsafeCredentialHardLink(_ os.FileInfo) bool { + return false +} diff --git a/internal/gateway/auth/manager.go b/internal/gateway/auth/manager.go index 7492c5b0..b31d17fe 100644 --- a/internal/gateway/auth/manager.go +++ b/internal/gateway/auth/manager.go @@ -4,6 +4,7 @@ import ( "crypto/rand" "encoding/base64" "encoding/json" + "errors" "fmt" "os" "path/filepath" @@ -25,6 +26,15 @@ const ( authFilePerm = 0o600 ) +const ( + authTempFilePattern = ".auth.json.tmp-*" +) + +var ( + errUnsafeCredentialPath = errors.New("unsafe credential path") + errInvalidCredentialBody = errors.New("invalid credential body") +) + // Credentials 表示持久化在磁盘上的认证凭证结构。 type Credentials struct { Version int `json:"version"` @@ -116,6 +126,9 @@ func (m *Manager) loadOrCreate() error { m.credentials = credentials return nil } + if readErr != nil && !isRecoverableCredentialReadError(readErr) { + return readErr + } createdCredentials, createErr := buildCredentials(time.Now().UTC()) if createErr != nil { @@ -147,6 +160,9 @@ func ensureAuthDir(dir string) error { if err := os.MkdirAll(dir, authDirPerm); err != nil { return fmt.Errorf("gateway auth: create auth dir: %w", err) } + if err := ensureSafeCredentialDirectory(dir); err != nil { + return err + } if err := applyAuthDirPermission(dir); err != nil { return err } @@ -155,6 +171,10 @@ func ensureAuthDir(dir string) error { // readCredentials 读取并解析认证凭证文件。 func readCredentials(path string) (Credentials, error) { + if err := ensureSafeCredentialFilePath(path, false); err != nil { + return Credentials{}, err + } + raw, err := os.ReadFile(path) if err != nil { return Credentials{}, fmt.Errorf("gateway auth: read auth file: %w", err) @@ -162,7 +182,7 @@ func readCredentials(path string) (Credentials, error) { var credentials Credentials if err := json.Unmarshal(raw, &credentials); err != nil { - return Credentials{}, fmt.Errorf("gateway auth: decode auth file: %w", err) + return Credentials{}, fmt.Errorf("gateway auth: decode auth file: %w: %w", errInvalidCredentialBody, err) } return credentials, nil } @@ -197,9 +217,50 @@ func writeCredentials(path string, credentials Credentials) error { return fmt.Errorf("gateway auth: encode credentials: %w", err) } raw = append(raw, '\n') - if err := os.WriteFile(path, raw, authFilePerm); err != nil { - return fmt.Errorf("gateway auth: write auth file: %w", err) + if err := ensureSafeCredentialFilePath(path, true); err != nil { + return err } + + authDir := filepath.Dir(path) + if err := ensureSafeCredentialDirectory(authDir); err != nil { + return err + } + + tempFile, err := os.CreateTemp(authDir, authTempFilePattern) + if err != nil { + return fmt.Errorf("gateway auth: create temp auth file: %w", err) + } + tempPath := tempFile.Name() + cleanupTemp := true + defer func() { + if cleanupTemp { + _ = os.Remove(tempPath) + } + }() + + if _, err := tempFile.Write(raw); err != nil { + _ = tempFile.Close() + return fmt.Errorf("gateway auth: write temp auth file: %w", err) + } + if err := tempFile.Sync(); err != nil { + _ = tempFile.Close() + return fmt.Errorf("gateway auth: sync temp auth file: %w", err) + } + if err := tempFile.Close(); err != nil { + return fmt.Errorf("gateway auth: close temp auth file: %w", err) + } + + if err := applyAuthFilePermission(tempPath); err != nil { + return err + } + if err := ensureSafeCredentialFilePath(path, true); err != nil { + return err + } + if err := os.Rename(tempPath, path); err != nil { + return fmt.Errorf("gateway auth: replace auth file atomically: %w", err) + } + cleanupTemp = false + if err := applyAuthFilePermission(path); err != nil { return err } @@ -210,3 +271,44 @@ func writeCredentials(path string, credentials Credentials) error { func isValidCredentials(credentials Credentials) bool { return credentials.Version >= credentialSchemaVersion && strings.TrimSpace(credentials.Token) != "" } + +// isRecoverableCredentialReadError 判断读取凭证失败是否允许走自动重建流程。 +func isRecoverableCredentialReadError(err error) bool { + if err == nil { + return false + } + if errors.Is(err, os.ErrNotExist) { + return true + } + return errors.Is(err, errInvalidCredentialBody) +} + +// ensureSafeCredentialDirectory 校验凭证目录不是链接路径，避免目录级别劫持。 +func ensureSafeCredentialDirectory(dir string) error { + dirInfo, err := os.Lstat(dir) + if err != nil { + return fmt.Errorf("gateway auth: inspect auth dir: %w", err) + } + if dirInfo.Mode()&os.ModeSymlink != 0 { + return fmt.Errorf("gateway auth: auth dir is symbolic link: %w", errUnsafeCredentialPath) + } + return nil +} + +// ensureSafeCredentialFilePath 校验凭证文件路径不为软链接/危险硬链接。 +func ensureSafeCredentialFilePath(path string, allowNotExist bool) error { + fileInfo, err := os.Lstat(path) + if err != nil { + if allowNotExist && errors.Is(err, os.ErrNotExist) { + return nil + } + return fmt.Errorf("gateway auth: inspect auth file: %w", err) + } + if fileInfo.Mode()&os.ModeSymlink != 0 { + return fmt.Errorf("gateway auth: auth file is symbolic link: %w", errUnsafeCredentialPath) + } + if isUnsafeCredentialHardLink(fileInfo) { + return fmt.Errorf("gateway auth: auth file is hard link: %w", errUnsafeCredentialPath) + } + return nil +} diff --git a/internal/gateway/auth/manager_test.go b/internal/gateway/auth/manager_test.go index dfc1443e..83b6bee0 100644 --- a/internal/gateway/auth/manager_test.go +++ b/internal/gateway/auth/manager_test.go @@ -2,6 +2,7 @@ package auth import ( "encoding/json" + "errors" "os" "path/filepath" "runtime" @@ -224,3 +225,172 @@ func TestDefaultAuthPathAndLoadOrCreateNilManager(t *testing.T) { t.Fatal("expected nil manager loadOrCreate error") } } + +func TestNewManagerRecoversInvalidJSONCredential(t *testing.T) { + credentialPath := filepath.Join(t.TempDir(), "auth.json") + if err := os.WriteFile(credentialPath, []byte("{invalid-json"), 0o600); err != nil { + t.Fatalf("write invalid auth file: %v", err) + } + + manager, err := NewManager(credentialPath) + if err != nil { + t.Fatalf("new manager should recover invalid json: %v", err) + } + if strings.TrimSpace(manager.Token()) == "" { + t.Fatal("recovered token should not be empty") + } +} + +func TestNewManagerRejectsSymbolicLinkCredentialPath(t *testing.T) { + baseDir := t.TempDir() + targetPath := filepath.Join(baseDir, "real-auth.json") + if err := os.WriteFile(targetPath, []byte(`{"version":1,"token":"token-a"}`), 0o600); err != nil { + t.Fatalf("write target auth file: %v", err) + } + + linkPath := filepath.Join(baseDir, "auth-link.json") + if err := os.Symlink(targetPath, linkPath); err != nil { + t.Skipf("symlink unsupported in current environment: %v", err) + } + + _, err := NewManager(linkPath) + if err == nil { + t.Fatal("expected symbolic link credential path to be rejected") + } + if !strings.Contains(strings.ToLower(err.Error()), "symbolic link") { + t.Fatalf("error = %v, want symbolic link rejection", err) + } +} + +func TestEnsureAuthDirRejectsSymbolicLinkDirectory(t *testing.T) { + baseDir := t.TempDir() + realDir := filepath.Join(baseDir, "real") + if err := os.MkdirAll(realDir, 0o700); err != nil { + t.Fatalf("create real dir: %v", err) + } + linkDir := filepath.Join(baseDir, "auth-dir-link") + if err := os.Symlink(realDir, linkDir); err != nil { + t.Skipf("symlink unsupported in current environment: %v", err) + } + + err := ensureAuthDir(linkDir) + if err == nil { + t.Fatal("expected symbolic link directory to be rejected") + } + if !strings.Contains(strings.ToLower(err.Error()), "symbolic link") { + t.Fatalf("error = %v, want symbolic link rejection", err) + } +} + +func TestWriteCredentialsUsesAtomicReplaceWithoutTempLeak(t *testing.T) { + authDir := t.TempDir() + credentialPath := filepath.Join(authDir, "auth.json") + + first, err := buildCredentials(time.Now().UTC().Add(-time.Minute)) + if err != nil { + t.Fatalf("build first credentials: %v", err) + } + second, err := buildCredentials(time.Now().UTC()) + if err != nil { + t.Fatalf("build second credentials: %v", err) + } + + if err := writeCredentials(credentialPath, first); err != nil { + t.Fatalf("write first credentials: %v", err) + } + if err := writeCredentials(credentialPath, second); err != nil { + t.Fatalf("write second credentials: %v", err) + } + + stored, err := readCredentials(credentialPath) + if err != nil { + t.Fatalf("read replaced credentials: %v", err) + } + if stored.Token != second.Token { + t.Fatalf("token = %q, want %q", stored.Token, second.Token) + } + + entries, err := os.ReadDir(authDir) + if err != nil { + t.Fatalf("read auth dir: %v", err) + } + for _, entry := range entries { + if strings.HasPrefix(entry.Name(), ".auth.json.tmp-") { + t.Fatalf("unexpected temp auth file leak: %s", entry.Name()) + } + } +} + +func TestReadCredentialsRejectsHardLinkOnUnix(t *testing.T) { + if runtime.GOOS == "windows" { + t.Skip("hard-link nlink guard is unix-specific") + } + + authDir := t.TempDir() + credentialPath := filepath.Join(authDir, "auth.json") + linkedPath := filepath.Join(authDir, "auth-linked.json") + + credentials, err := buildCredentials(time.Now().UTC()) + if err != nil { + t.Fatalf("build credentials: %v", err) + } + if err := writeCredentials(credentialPath, credentials); err != nil { + t.Fatalf("write credentials: %v", err) + } + if err := os.Link(credentialPath, linkedPath); err != nil { + t.Fatalf("create hard link: %v", err) + } + + if _, err := readCredentials(credentialPath); err == nil { + t.Fatal("expected hard-linked credential file to be rejected") + } else if !strings.Contains(strings.ToLower(err.Error()), "hard link") { + t.Fatalf("error = %v, want hard link rejection", err) + } +} + +func TestIsRecoverableCredentialReadErrorBranches(t *testing.T) { + if isRecoverableCredentialReadError(nil) { + t.Fatal("nil error should not be recoverable") + } + if !isRecoverableCredentialReadError(os.ErrNotExist) { + t.Fatal("os.ErrNotExist should be recoverable") + } + invalidBodyErr := errors.Join(errInvalidCredentialBody, errors.New("decode failed")) + if !isRecoverableCredentialReadError(invalidBodyErr) { + t.Fatal("invalid credential body should be recoverable") + } + if isRecoverableCredentialReadError(errors.New("random failure")) { + t.Fatal("random failure should not be recoverable") + } +} + +func TestEnsureSafeCredentialDirectoryMissingPathError(t *testing.T) { + err := ensureSafeCredentialDirectory(filepath.Join(t.TempDir(), "missing-dir")) + if err == nil { + t.Fatal("expected missing directory error") + } +} + +func TestEnsureSafeCredentialFilePathAllowNotExistAndSymlinkBranches(t *testing.T) { + baseDir := t.TempDir() + missingPath := filepath.Join(baseDir, "missing-auth.json") + if err := ensureSafeCredentialFilePath(missingPath, true); err != nil { + t.Fatalf("allowNotExist should accept missing file: %v", err) + } + if err := ensureSafeCredentialFilePath(missingPath, false); err == nil { + t.Fatal("allowNotExist=false should reject missing file") + } + + realPath := filepath.Join(baseDir, "real-auth.json") + if err := os.WriteFile(realPath, []byte(`{"version":1,"token":"token-b"}`), 0o600); err != nil { + t.Fatalf("write real auth file: %v", err) + } + linkPath := filepath.Join(baseDir, "auth-link-2.json") + if err := os.Symlink(realPath, linkPath); err != nil { + t.Skipf("symlink unsupported in current environment: %v", err) + } + + if err := ensureSafeCredentialFilePath(linkPath, false); err == nil { + t.Fatal("expected symbolic link file to be rejected") + } +} diff --git a/internal/gateway/metrics.go b/internal/gateway/metrics.go index 14d3b3c8..fc4bba3c 100644 --- a/internal/gateway/metrics.go +++ b/internal/gateway/metrics.go @@ -5,8 +5,23 @@ import ( "sync" "github.com/prometheus/client_golang/prometheus" + + "neo-code/internal/gateway/protocol" +) + +const ( + // unknownMethodMetricLabel 统一收敛未知 method 的指标标签值，防止高基数放大。 + unknownMethodMetricLabel = "unknown_method" ) +var allowedRPCMethodMetricLabels = map[string]struct{}{ + strings.ToLower(protocol.MethodGatewayAuthenticate): {}, + strings.ToLower(protocol.MethodGatewayPing): {}, + strings.ToLower(protocol.MethodGatewayBindStream): {}, + strings.ToLower(protocol.MethodGatewayEvent): {}, + strings.ToLower(protocol.MethodWakeOpenURL): {}, +} + // GatewayMetrics 维护网关关键指标，并同时提供 Prometheus 与 JSON 视图。 type GatewayMetrics struct { registry *prometheus.Registry @@ -118,7 +133,7 @@ func (m *GatewayMetrics) IncRequests(source, method, status string) { return } source = normalizeMetricLabel(source) - method = normalizeMetricLabel(method) + method = normalizeMethodMetricLabel(method) status = normalizeMetricLabel(status) m.requestsTotal.WithLabelValues(source, method, status).Inc() m.addSnapshotCounter("gateway_requests_total", source+"|"+method+"|"+status, 1) @@ -141,7 +156,7 @@ func (m *GatewayMetrics) IncACLDenied(source, method string) { return } source = normalizeMetricLabel(source) - method = normalizeMetricLabel(method) + method = normalizeMethodMetricLabel(method) m.aclDeniedTotal.WithLabelValues(source, method).Inc() m.addSnapshotCounter("gateway_acl_denied_total", source+"|"+method, 1) } @@ -195,3 +210,15 @@ func normalizeMetricLabel(value string) string { } return normalized } + +// normalizeMethodMetricLabel 将 method 标签收敛到有限集合，未知值统一折叠为 unknown_method。 +func normalizeMethodMetricLabel(method string) string { + normalized := normalizeMetricLabel(method) + if normalized == "unknown" { + return unknownMethodMetricLabel + } + if _, exists := allowedRPCMethodMetricLabels[normalized]; !exists { + return unknownMethodMetricLabel + } + return normalized +} diff --git a/internal/gateway/metrics_test.go b/internal/gateway/metrics_test.go index f9c992e6..fb7f1475 100644 --- a/internal/gateway/metrics_test.go +++ b/internal/gateway/metrics_test.go @@ -56,7 +56,7 @@ func TestGatewayMetricsNilReceiverAndLabelNormalization(t *testing.T) { if snapshot["gateway_auth_failures_total"]["http|unknown"] != 1 { t.Fatalf("normalized auth labels mismatch: %#v", snapshot["gateway_auth_failures_total"]) } - if snapshot["gateway_acl_denied_total"]["ws|unknown"] != 1 { + if snapshot["gateway_acl_denied_total"]["ws|unknown_method"] != 1 { t.Fatalf("normalized acl labels mismatch: %#v", snapshot["gateway_acl_denied_total"]) } if snapshot["gateway_connections_active"]["unknown"] != 3 { @@ -81,3 +81,17 @@ func TestGatewayMetricsSnapshotMapRecreateBranches(t *testing.T) { t.Fatalf("connections snapshot mismatch: %#v", snapshot["gateway_connections_active"]) } } + +func TestGatewayMetricsUnknownMethodCollapsed(t *testing.T) { + metrics := NewGatewayMetrics() + metrics.IncRequests("http", "random.method.from.user", "ok") + metrics.IncACLDenied("ws", "random.method.from.user") + + snapshot := metrics.Snapshot() + if snapshot["gateway_requests_total"]["http|unknown_method|ok"] != 1 { + t.Fatalf("requests snapshot mismatch: %#v", snapshot["gateway_requests_total"]) + } + if snapshot["gateway_acl_denied_total"]["ws|unknown_method"] != 1 { + t.Fatalf("acl denied snapshot mismatch: %#v", snapshot["gateway_acl_denied_total"]) + } +} diff --git a/internal/gateway/network_server.go b/internal/gateway/network_server.go index 74b3850a..da98e559 100644 --- a/internal/gateway/network_server.go +++ b/internal/gateway/network_server.go @@ -37,6 +37,8 @@ const ( DefaultNetworkMaxRequestBytes int64 = MaxFrameSize // DefaultNetworkMaxStreamConnections 定义 WS/SSE 长连接总上限。 DefaultNetworkMaxStreamConnections = 128 + // DefaultWSUnauthenticatedTimeout 定义 WS 未认证连接的最大等待时间。 + DefaultWSUnauthenticatedTimeout = 3 * time.Second ) var ( @@ -55,12 +57,14 @@ type NetworkServerOptions struct { HeartbeatInterval time.Duration MaxRequestBytes int64 MaxStreamConnections int - Relay *StreamRelay - Authenticator TokenAuthenticator - ACL *ControlPlaneACL - Metrics *GatewayMetrics - AllowedOrigins []string - listenFn func(network, address string) (net.Listener, error) + // UnauthenticatedWSGracePeriod 定义 WS 连接未认证时的容忍时长。 + UnauthenticatedWSGracePeriod time.Duration + Relay *StreamRelay + Authenticator TokenAuthenticator + ACL *ControlPlaneACL + Metrics *GatewayMetrics + AllowedOrigins []string + listenFn func(network, address string) (net.Listener, error) } // NetworkServer 提供 HTTP/WebSocket/SSE 网络访问面的统一入口服务。 @@ -71,6 +75,7 @@ type NetworkServer struct { writeTimeout time.Duration shutdownTimeout time.Duration heartbeatInterval time.Duration + unauthenticatedWSTTL time.Duration maxRequestBytes int64 maxStreamConnections int listenFn func(network, address string) (net.Listener, error) @@ -135,6 +140,10 @@ func NewNetworkServer(options NetworkServerOptions) (*NetworkServer, error) { if maxStreamConnections <= 0 { maxStreamConnections = DefaultNetworkMaxStreamConnections } + unauthenticatedWSTTL := options.UnauthenticatedWSGracePeriod + if unauthenticatedWSTTL <= 0 { + unauthenticatedWSTTL = DefaultWSUnauthenticatedTimeout + } relay := options.Relay if relay == nil { @@ -163,6 +172,7 @@ func NewNetworkServer(options NetworkServerOptions) (*NetworkServer, error) { writeTimeout: writeTimeout, shutdownTimeout: shutdownTimeout, heartbeatInterval: heartbeatInterval, + unauthenticatedWSTTL: unauthenticatedWSTTL, maxRequestBytes: maxRequestBytes, maxStreamConnections: maxStreamConnections, listenFn: listenFn, @@ -379,10 +389,6 @@ func (s *NetworkServer) handleHealthzRequest(writer http.ResponseWriter, request http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } - if !s.isControlPlaneHTTPRequestAuthorized(request) { - http.Error(writer, "unauthorized", http.StatusUnauthorized) - return - } connectionSnapshot := map[string]int{} if s.relay != nil { @@ -406,10 +412,6 @@ func (s *NetworkServer) handleVersionRequest(writer http.ResponseWriter, request http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } - if !s.isControlPlaneHTTPRequestAuthorized(request) { - http.Error(writer, "unauthorized", http.StatusUnauthorized) - return - } writeJSONResponse(writer, http.StatusOK, ResolvedBuildInfo()) } @@ -509,8 +511,11 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim connectionID := NewConnectionID() requestToken := "" - if request := conn.Request(); request != nil && request.URL != nil { - requestToken = strings.TrimSpace(request.URL.Query().Get("token")) + if request := conn.Request(); request != nil { + requestToken = extractBearerToken(request.Header.Get("Authorization")) + if requestToken == "" && request.URL != nil { + requestToken = strings.TrimSpace(request.URL.Query().Get("token")) + } } connectionContext = s.decorateRequestContext(connectionContext, RequestSourceWS, requestToken) connectionContext = WithConnectionID(connectionContext, connectionID) @@ -557,6 +562,9 @@ func (s *NetworkServer) handleWebSocket(conn *websocket.Conn, runtimePort Runtim _ = conn.Close() return } + authState, _ := ConnectionAuthStateFromContext(connectionContext) + stopAuthenticationGuard := s.startWSUnauthenticatedConnectionGuard(conn, cancelConnection, authState) + defer stopAuthenticationGuard() defer func() { s.unregisterWSConnection(conn) @@ -622,6 +630,45 @@ func (s *NetworkServer) runWSHeartbeatLoop(relay *StreamRelay, connectionID Conn } } +// startWSUnauthenticatedConnectionGuard 在连接建立后启动未认证超时守卫，防止连接池被长期占位。 +func (s *NetworkServer) startWSUnauthenticatedConnectionGuard( + conn *websocket.Conn, + cancel context.CancelFunc, + authState *ConnectionAuthState, +) func() { + if conn == nil || cancel == nil || authState == nil || s.authenticator == nil { + return func() {} + } + if s.unauthenticatedWSTTL <= 0 || authState.IsAuthenticated() { + return func() {} + } + + done := make(chan struct{}) + timer := time.NewTimer(s.unauthenticatedWSTTL) + go func() { + defer timer.Stop() + select { + case <-done: + return + case <-timer.C: + if authState.IsAuthenticated() { + return + } + cancel() + _ = conn.SetDeadline(time.Now()) + _ = conn.Close() + } + }() + + return func() { + select { + case <-done: + default: + close(done) + } + } +} + // handleSSERequest 处理 SSE 入口请求，先返回一次结果事件，再持续发送心跳事件。 func (s *NetworkServer) handleSSERequest(writer http.ResponseWriter, request *http.Request, runtimePort RuntimePort) { if request.Method != http.MethodGet { diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index d5205665..98ad798d 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -508,6 +508,81 @@ func TestNetworkServerWebSocketReadTimeoutDoesNotKillIdleConnection(t *testing.T } } +func TestNetworkServerWebSocketUnauthenticatedConnectionTimeout(t *testing.T) { + server := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: NewStrictControlPlaneACL(), + MaxStreamConnections: 1, + UnauthenticatedWSGracePeriod: 120 * time.Millisecond, + }) + testContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + serveDone := make(chan error, 1) + go func() { + serveDone <- server.Serve(testContext, nil) + }() + t.Cleanup(func() { + _ = server.Close(context.Background()) + select { + case <-serveDone: + case <-time.After(2 * time.Second): + t.Fatal("network serve goroutine did not exit") + } + }) + + listenAddress := waitForNetworkAddress(t, server) + wsConn, err := websocket.Dial("ws://"+listenAddress+"/ws", "", "http://localhost:3000") + if err != nil { + t.Fatalf("dial websocket: %v", err) + } + t.Cleanup(func() { _ = wsConn.Close() }) + + waitForWebSocketConnectionCount(t, server, 1, 2*time.Second) + waitForWebSocketConnectionCount(t, server, 0, 2*time.Second) + + waitForWebSocketClosed(t, wsConn, 2*time.Second) +} + +func TestNetworkServerWebSocketAuthenticatedConnectionBypassesTimeout(t *testing.T) { + server := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: NewStrictControlPlaneACL(), + UnauthenticatedWSGracePeriod: 120 * time.Millisecond, + }) + testContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + serveDone := make(chan error, 1) + go func() { + serveDone <- server.Serve(testContext, nil) + }() + t.Cleanup(func() { + _ = server.Close(context.Background()) + select { + case <-serveDone: + case <-time.After(2 * time.Second): + t.Fatal("network serve goroutine did not exit") + } + }) + + listenAddress := waitForNetworkAddress(t, server) + wsConn, err := websocket.Dial("ws://"+listenAddress+"/ws?token=gateway-token", "", "http://localhost:3000") + if err != nil { + t.Fatalf("dial websocket: %v", err) + } + t.Cleanup(func() { _ = wsConn.Close() }) + + time.Sleep(250 * time.Millisecond) + if err := websocket.Message.Send(wsConn, `{"jsonrpc":"2.0","id":"ws-auth-ok","method":"gateway.ping","params":{}}`); err != nil { + t.Fatalf("send ping after auth grace period: %v", err) + } + ackFrame := receiveWSAckFrame(t, wsConn) + if ackFrame.RequestID != "ws-auth-ok" { + t.Fatalf("request_id = %q, want %q", ackFrame.RequestID, "ws-auth-ok") + } +} + func TestNetworkServerWebSocketDispatchContextCancelledOnShutdown(t *testing.T) { originalDispatch := dispatchRPCRequestFn t.Cleanup(func() { dispatchRPCRequestFn = originalDispatch }) @@ -638,12 +713,12 @@ func TestNetworkServerVersionAndObservabilityAuthHelpers(t *testing.T) { } }) - t.Run("version requires bearer token when authenticator enabled", func(t *testing.T) { + t.Run("version remains public when authenticator enabled", func(t *testing.T) { recorder := httptest.NewRecorder() request := httptest.NewRequest(http.MethodGet, "/version", nil) server.handleVersionRequest(recorder, request) - if recorder.Code != http.StatusUnauthorized { - t.Fatalf("status = %d, want %d", recorder.Code, http.StatusUnauthorized) + if recorder.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", recorder.Code, http.StatusOK) } }) @@ -826,22 +901,8 @@ func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { t.Fatalf("get /healthz: %v", err) } defer healthResponse.Body.Close() - if healthResponse.StatusCode != http.StatusUnauthorized { - t.Fatalf("/healthz status = %d, want %d", healthResponse.StatusCode, http.StatusUnauthorized) - } - - authorizedHealthRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/healthz", nil) - if err != nil { - t.Fatalf("new /healthz request: %v", err) - } - authorizedHealthRequest.Header.Set("Authorization", "Bearer gateway-token") - authorizedHealthResponse, err := http.DefaultClient.Do(authorizedHealthRequest) - if err != nil { - t.Fatalf("authorized get /healthz: %v", err) - } - defer authorizedHealthResponse.Body.Close() - if authorizedHealthResponse.StatusCode != http.StatusOK { - t.Fatalf("authorized /healthz status = %d, want %d", authorizedHealthResponse.StatusCode, http.StatusOK) + if healthResponse.StatusCode != http.StatusOK { + t.Fatalf("/healthz status = %d, want %d", healthResponse.StatusCode, http.StatusOK) } versionResponse, err := http.Get("http://" + listenAddress + "/version") @@ -849,22 +910,8 @@ func TestNetworkServerObservabilityEndpointsAuth(t *testing.T) { t.Fatalf("get /version: %v", err) } defer versionResponse.Body.Close() - if versionResponse.StatusCode != http.StatusUnauthorized { - t.Fatalf("/version status = %d, want %d", versionResponse.StatusCode, http.StatusUnauthorized) - } - - authorizedVersionRequest, err := http.NewRequest(http.MethodGet, "http://"+listenAddress+"/version", nil) - if err != nil { - t.Fatalf("new /version request: %v", err) - } - authorizedVersionRequest.Header.Set("Authorization", "Bearer gateway-token") - authorizedVersionResponse, err := http.DefaultClient.Do(authorizedVersionRequest) - if err != nil { - t.Fatalf("authorized get /version: %v", err) - } - defer authorizedVersionResponse.Body.Close() - if authorizedVersionResponse.StatusCode != http.StatusOK { - t.Fatalf("authorized /version status = %d, want %d", authorizedVersionResponse.StatusCode, http.StatusOK) + if versionResponse.StatusCode != http.StatusOK { + t.Fatalf("/version status = %d, want %d", versionResponse.StatusCode, http.StatusOK) } metricsResponse, err := http.Get("http://" + listenAddress + "/metrics") @@ -1058,6 +1105,48 @@ func waitForNetworkAddress(t *testing.T, server *NetworkServer) string { } } +// waitForWebSocketConnectionCount 轮询等待 WS 连接数达到目标值，便于验证超时剔除是否生效。 +func waitForWebSocketConnectionCount(t *testing.T, server *NetworkServer, want int, timeout time.Duration) { + t.Helper() + + deadline := time.After(timeout) + ticker := time.NewTicker(10 * time.Millisecond) + defer ticker.Stop() + + for { + select { + case <-deadline: + server.mu.Lock() + got := len(server.wsConns) + server.mu.Unlock() + t.Fatalf("timed out waiting websocket connections = %d, got %d", want, got) + case <-ticker.C: + server.mu.Lock() + got := len(server.wsConns) + server.mu.Unlock() + if got == want { + return + } + } + } +} + +// waitForWebSocketClosed 循环读取直到连接关闭；会忽略关闭前可能滞留在缓冲区中的心跳消息。 +func waitForWebSocketClosed(t *testing.T, wsConn *websocket.Conn, timeout time.Duration) { + t.Helper() + + deadline := time.Now().Add(timeout) + for time.Now().Before(deadline) { + _ = wsConn.SetReadDeadline(time.Now().Add(150 * time.Millisecond)) + var rawMessage string + err := websocket.Message.Receive(wsConn, &rawMessage) + if err != nil { + return + } + } + t.Fatal("expected websocket connection to be closed before timeout") +} + // receiveWSAckFrame 连续读取 WS 消息直到拿到 JSON-RPC ACK 结果帧。 func receiveWSAckFrame(t *testing.T, wsConn *websocket.Conn) MessageFrame { t.Helper() diff --git a/internal/gateway/rpc_dispatch.go b/internal/gateway/rpc_dispatch.go index 0a0eb143..0098142a 100644 --- a/internal/gateway/rpc_dispatch.go +++ b/internal/gateway/rpc_dispatch.go @@ -12,13 +12,14 @@ import ( func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, runtimePort RuntimePort) protocol.JSONRPCResponse { startedAt := requestStartTime() method := strings.TrimSpace(request.Method) + metricMethod := normalizeMethodMetricLabel(method) source := string(RequestSourceFromContext(ctx)) metrics, _ := GatewayMetricsFromContext(ctx) normalized, rpcErr := protocol.NormalizeJSONRPCRequest(request) if rpcErr != nil { if metrics != nil { - metrics.IncRequests(source, method, "error") + metrics.IncRequests(source, metricMethod, "error") } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ RequestID: "", @@ -34,12 +35,12 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru if authErr := authorizeRPCRequest(ctx, request.Method, normalized.Action); authErr != nil { if metrics != nil { - metrics.IncRequests(source, method, "error") + metrics.IncRequests(source, metricMethod, "error") if gatewayCode := protocol.GatewayCodeFromJSONRPCError(authErr); gatewayCode == ErrorCodeUnauthorized.String() { metrics.IncAuthFailures(source, gatewayCode) } if gatewayCode := protocol.GatewayCodeFromJSONRPCError(authErr); gatewayCode == ErrorCodeAccessDenied.String() { - metrics.IncACLDenied(source, method) + metrics.IncACLDenied(source, metricMethod) } } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ @@ -67,7 +68,7 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru frame = hydrateFrameSessionFromConnection(ctx, frame) if requiresSession(frame.Action) && strings.TrimSpace(frame.SessionID) == "" { if metrics != nil { - metrics.IncRequests(source, method, "error") + metrics.IncRequests(source, metricMethod, "error") } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ RequestID: normalized.RequestID, @@ -94,7 +95,7 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru rpcResponse, encodeErr := protocol.NewJSONRPCResultResponse(normalized.ID, responseFrame) if encodeErr != nil { if metrics != nil { - metrics.IncRequests(source, method, "error") + metrics.IncRequests(source, metricMethod, "error") } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ RequestID: normalized.RequestID, @@ -108,7 +109,7 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru return protocol.NewJSONRPCErrorResponse(normalized.ID, encodeErr) } if metrics != nil { - metrics.IncRequests(source, method, "ok") + metrics.IncRequests(source, metricMethod, "ok") } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ RequestID: normalized.RequestID, @@ -134,12 +135,12 @@ func dispatchRPCRequest(ctx context.Context, request protocol.JSONRPCRequest, ru ), ) if metrics != nil { - metrics.IncRequests(source, method, "error") + metrics.IncRequests(source, metricMethod, "error") if frameErr.Code == ErrorCodeUnauthorized.String() { metrics.IncAuthFailures(source, frameErr.Code) } if frameErr.Code == ErrorCodeAccessDenied.String() { - metrics.IncACLDenied(source, method) + metrics.IncACLDenied(source, metricMethod) } } emitRequestLog(ctx, nilSafeLoggerFromContext(ctx), RequestLogEntry{ diff --git a/internal/gateway/rpc_dispatch_test.go b/internal/gateway/rpc_dispatch_test.go index 35576cce..b62193b6 100644 --- a/internal/gateway/rpc_dispatch_test.go +++ b/internal/gateway/rpc_dispatch_test.go @@ -352,3 +352,24 @@ func TestDispatchRPCRequestMetricsBranches(t *testing.T) { t.Fatalf("expected ok request metric, snapshot=%#v", snapshot["gateway_requests_total"]) } } + +func TestDispatchRPCRequestMetricsUnknownMethodCollapsed(t *testing.T) { + metrics := NewGatewayMetrics() + ctx := WithRequestSource(context.Background(), RequestSourceIPC) + ctx = WithGatewayMetrics(ctx, metrics) + + response := dispatchRPCRequest(ctx, protocol.JSONRPCRequest{ + JSONRPC: protocol.JSONRPCVersion, + ID: json.RawMessage(`"req-unknown-method"`), + Method: "random.method.user.input", + Params: json.RawMessage(`{}`), + }, nil) + if response.Error == nil { + t.Fatal("expected method-not-found error for unknown method") + } + + snapshot := metrics.Snapshot() + if snapshot["gateway_requests_total"]["ipc|unknown_method|error"] == 0 { + t.Fatalf("expected unknown_method metric label, snapshot=%#v", snapshot["gateway_requests_total"]) + } +} From cc5931a999e127b538461ee7a80ad67611d74ecb Mon Sep 17 00:00:00 2001 From: xgopilot Date: Fri, 17 Apr 2026 07:03:40 +0000 Subject: [PATCH 12/12] fix(gateway): close auth gaps and simplify frame validation - resolve auth token file path to absolute path - make control-plane auth helper fail-close when authenticator missing - map access_denied JSON-RPC gateway code to HTTP 403 - add/update tests for auth + status semantics - simplify duplicated payload validation branches Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: pionxe <148670367+pionxe@users.noreply.github.com> --- internal/gateway/auth/manager.go | 6 +++++- internal/gateway/auth/manager_test.go | 8 ++++++-- internal/gateway/network_server.go | 21 ++++++++++++++++++-- internal/gateway/network_server_test.go | 26 +++++++++++++++++-------- internal/gateway/validate.go | 16 ++------------- 5 files changed, 50 insertions(+), 27 deletions(-) diff --git a/internal/gateway/auth/manager.go b/internal/gateway/auth/manager.go index b31d17fe..8eaa12b2 100644 --- a/internal/gateway/auth/manager.go +++ b/internal/gateway/auth/manager.go @@ -145,7 +145,11 @@ func (m *Manager) loadOrCreate() error { func resolveAuthPath(path string) (string, error) { trimmed := strings.TrimSpace(path) if trimmed != "" { - return filepath.Clean(trimmed), nil + absolutePath, err := filepath.Abs(filepath.Clean(trimmed)) + if err != nil { + return "", fmt.Errorf("gateway auth: resolve auth path: %w", err) + } + return absolutePath, nil } homeDir, err := os.UserHomeDir() diff --git a/internal/gateway/auth/manager_test.go b/internal/gateway/auth/manager_test.go index 83b6bee0..4ecfd436 100644 --- a/internal/gateway/auth/manager_test.go +++ b/internal/gateway/auth/manager_test.go @@ -145,8 +145,12 @@ func TestResolveAuthPathAndEnsureDirError(t *testing.T) { if err != nil { t.Fatalf("resolve custom path: %v", err) } - if resolvedCustomPath != filepath.Clean(customPath) { - t.Fatalf("resolved custom path = %q, want %q", resolvedCustomPath, filepath.Clean(customPath)) + expectedCustomPath, err := filepath.Abs(filepath.Clean(customPath)) + if err != nil { + t.Fatalf("abs custom path: %v", err) + } + if resolvedCustomPath != expectedCustomPath { + t.Fatalf("resolved custom path = %q, want %q", resolvedCustomPath, expectedCustomPath) } baseDir := t.TempDir() diff --git a/internal/gateway/network_server.go b/internal/gateway/network_server.go index da98e559..43d78e89 100644 --- a/internal/gateway/network_server.go +++ b/internal/gateway/network_server.go @@ -465,7 +465,7 @@ func (s *NetworkServer) isObservabilityRequestAuthorized(request *http.Request) // isControlPlaneHTTPRequestAuthorized 校验 HTTP 控制面请求是否携带并通过 Bearer Token。 func (s *NetworkServer) isControlPlaneHTTPRequestAuthorized(request *http.Request) bool { if s.authenticator == nil { - return true + return false } token := extractBearerToken(request.Header.Get("Authorization")) return s.authenticator.ValidateToken(token) @@ -477,6 +477,21 @@ func (s *NetworkServer) handleRPCRequest(writer http.ResponseWriter, request *ht http.Error(writer, "method not allowed", http.StatusMethodNotAllowed) return } + if !s.isControlPlaneHTTPRequestAuthorized(request) { + writeJSONRPCHTTPResponse( + writer, + http.StatusUnauthorized, + protocol.NewJSONRPCErrorResponse( + nil, + protocol.NewJSONRPCError( + protocol.MapGatewayCodeToJSONRPCCode(ErrorCodeUnauthorized.String()), + "unauthorized", + ErrorCodeUnauthorized.String(), + ), + ), + ) + return + } request.Body = http.MaxBytesReader(writer, request.Body, s.maxRequestBytes) rpcRequest, rpcErr := decodeJSONRPCRequestFromReader(request.Body) @@ -875,8 +890,10 @@ func writeJSONRPCHTTPResponse(writer http.ResponseWriter, statusCode int, respon func resolveJSONRPCHTTPStatusCode(response protocol.JSONRPCResponse) int { gatewayCode := protocol.GatewayCodeFromJSONRPCError(response.Error) switch gatewayCode { - case ErrorCodeUnauthorized.String(), ErrorCodeAccessDenied.String(): + case ErrorCodeUnauthorized.String(): return http.StatusUnauthorized + case ErrorCodeAccessDenied.String(): + return http.StatusForbidden default: return http.StatusOK } diff --git a/internal/gateway/network_server_test.go b/internal/gateway/network_server_test.go index 98ad798d..54939014 100644 --- a/internal/gateway/network_server_test.go +++ b/internal/gateway/network_server_test.go @@ -136,7 +136,10 @@ func TestWithCORSAllowlistBehavior(t *testing.T) { } func TestNetworkServerHTTPRPCAndCORS(t *testing.T) { - server := newTestNetworkServer(t, NetworkServerOptions{}) + server := newTestNetworkServer(t, NetworkServerOptions{ + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: NewStrictControlPlaneACL(), + }) testContext, cancel := context.WithCancel(context.Background()) defer cancel() @@ -162,6 +165,7 @@ func TestNetworkServerHTTPRPCAndCORS(t *testing.T) { } request.Header.Set("Origin", "http://localhost:3000") request.Header.Set("Content-Type", "application/json") + request.Header.Set("Authorization", "Bearer gateway-token") response, err := http.DefaultClient.Do(request) if err != nil { t.Fatalf("post /rpc: %v", err) @@ -226,7 +230,11 @@ func TestNetworkServerRejectsDisallowedCORSOrigin(t *testing.T) { } func TestNetworkServerRPCErrorBranches(t *testing.T) { - server := newTestNetworkServer(t, NetworkServerOptions{MaxRequestBytes: 16}) + server := newTestNetworkServer(t, NetworkServerOptions{ + MaxRequestBytes: 16, + Authenticator: staticTokenAuthenticator{token: "gateway-token"}, + ACL: NewStrictControlPlaneACL(), + }) testContext, cancel := context.WithCancel(context.Background()) defer cancel() @@ -262,6 +270,7 @@ func TestNetworkServerRPCErrorBranches(t *testing.T) { t.Fatalf("new request: %v", err) } request.Header.Set("Content-Type", "application/json") + request.Header.Set("Authorization", "Bearer gateway-token") response, err := http.DefaultClient.Do(request) if err != nil { t.Fatalf("post /rpc: %v", err) @@ -286,6 +295,7 @@ func TestNetworkServerRPCErrorBranches(t *testing.T) { t.Fatalf("new request: %v", err) } request.Header.Set("Content-Type", "application/json") + request.Header.Set("Authorization", "Bearer gateway-token") response, err := http.DefaultClient.Do(request) if err != nil { t.Fatalf("post /rpc: %v", err) @@ -341,7 +351,7 @@ func TestNetworkServerRPCErrorBranches(t *testing.T) { } }) - t.Run("acl denied rpc maps to http 401", func(t *testing.T) { + t.Run("acl denied rpc maps to http 403", func(t *testing.T) { deniedACL := &ControlPlaneACL{ mode: ACLModeStrict, allow: map[RequestSource]map[string]struct{}{RequestSourceHTTP: {}}, @@ -383,8 +393,8 @@ func TestNetworkServerRPCErrorBranches(t *testing.T) { t.Fatalf("post /rpc: %v", err) } defer response.Body.Close() - if response.StatusCode != http.StatusUnauthorized { - t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusUnauthorized) + if response.StatusCode != http.StatusForbidden { + t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusForbidden) } }) } @@ -734,11 +744,11 @@ func TestNetworkServerVersionAndObservabilityAuthHelpers(t *testing.T) { } }) - t.Run("observability auth bypass when authenticator nil", func(t *testing.T) { + t.Run("observability auth denies when authenticator nil", func(t *testing.T) { openServer := &NetworkServer{} request := httptest.NewRequest(http.MethodGet, "/metrics", nil) - if !openServer.isObservabilityRequestAuthorized(request) { - t.Fatal("expected request to pass without authenticator") + if openServer.isObservabilityRequestAuthorized(request) { + t.Fatal("expected request to be rejected without authenticator") } }) } diff --git a/internal/gateway/validate.go b/internal/gateway/validate.go index 2ffe4374..276e4d59 100644 --- a/internal/gateway/validate.go +++ b/internal/gateway/validate.go @@ -30,22 +30,12 @@ func validateRequestFrame(frame MessageFrame) *FrameError { } switch frame.Action { - case FrameActionAuthenticate: + case FrameActionAuthenticate, FrameActionBindStream, FrameActionWakeOpenURL: if frame.Payload == nil { return NewMissingRequiredFieldError("payload") } return nil - case FrameActionPing: - return nil - case FrameActionBindStream: - if frame.Payload == nil { - return NewMissingRequiredFieldError("payload") - } - return nil - case FrameActionWakeOpenURL: - if frame.Payload == nil { - return NewMissingRequiredFieldError("payload") - } + case FrameActionPing, FrameActionCancel, FrameActionListSessions: return nil case FrameActionRun: return validateRunFrame(frame) @@ -55,8 +45,6 @@ func validateRequestFrame(frame MessageFrame) *FrameError { } case FrameActionResolvePermission: return validateResolvePermissionFrame(frame) - case FrameActionCancel, FrameActionListSessions: - return nil default: return NewFrameError(ErrorCodeInvalidAction, "invalid action") }