feat(cloudflare): 应用配置支持程序安装与默认 Token 并发布 v1.6.3

2026-09-28 16:59:30 +08:00
parent 0d7af99a78
commit 5e995dee28
17 changed files with 363 additions and 37 deletions
@@ -165,6 +165,30 @@ func (h *CloudflareHandler) BinaryInfo(w http.ResponseWriter, r *http.Request) {
 	})
 }

+func (h *CloudflareHandler) AppSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := h.svc.AppSettings(r.Context())
+	if err != nil {
+		writeError(r, w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, settings)
+}
+
+func (h *CloudflareHandler) SaveAppSettings(w http.ResponseWriter, r *http.Request) {
+	var input cloudflared.AppSettingsInput
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&input); err != nil {
+		writeError(r, w, http.StatusBadRequest, "请求格式无效")
+		return
+	}
+	input.Network = normalizeCloudflareNetwork(input.Network)
+	settings, err := h.svc.SaveAppSettings(r.Context(), input)
+	if err != nil {
+		writeError(r, w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, settings)
+}
+
 func (h *CloudflareHandler) DownloadBinary(w http.ResponseWriter, r *http.Request) {
 	var request struct {
 		Mirror string `json:"mirror"`
@@ -206,6 +206,8 @@ func newRouterWithSpecs(deps Deps) (http.Handler, []routeSpec) {
 		protect("GET /api/cloudflare/tunnels/{id}/config", cf.Config)
 		protect("GET /api/cloudflare/binary", cf.BinaryInfo)
 		protect("POST /api/cloudflare/binary/download", cf.DownloadBinary)
+		protect("GET /api/cloudflare/settings", cf.AppSettings)
+		protect("PUT /api/cloudflare/settings", cf.SaveAppSettings)
 		protect("GET /api/cloudflare/ingress-candidates", cf.IngressCandidates)
 	}

@@ -70,6 +70,21 @@ type CreateInput struct {
 	AutoStart     bool            `json:"auto_start"`
 }

+// AppSettings 是模块级配置；默认 token 只回显掩码，不返回明文。
+type AppSettings struct {
+	DefaultTokenConfigured bool            `json:"default_token_configured"`
+	DefaultTokenMasked     string          `json:"default_token_masked"`
+	Mirror                 string          `json:"mirror"`
+	Network                NetworkSettings `json:"network"`
+}
+
+// AppSettingsInput 是保存应用配置的入参；Token 留空表示保留原值。
+type AppSettingsInput struct {
+	Token   string          `json:"token"`
+	Mirror  string          `json:"mirror"`
+	Network NetworkSettings `json:"network"`
+}
+
 // RuntimeStatus 是隧道运行状态与指标快照。
 type RuntimeStatus struct {
 	Running         bool    `json:"running"`
@@ -72,7 +72,12 @@ func (s *Service) Create(ctx context.Context, in CreateInput) (Tunnel, error) {
 	if err := validateInput(in); err != nil {
 		return Tunnel{}, err
 	}
-	accountTag, tunnelID, tunnelSecret, err := DecodeToken(in.Token)
+	in.Network = s.applyDefaultNetwork(ctx, in.Network)
+	token, err := s.resolveToken(ctx, in.Token)
+	if err != nil {
+		return Tunnel{}, err
+	}
+	accountTag, tunnelID, tunnelSecret, err := DecodeToken(token)
 	if err != nil {
 		return Tunnel{}, err
 	}
@@ -95,7 +100,7 @@ func (s *Service) Create(ctx context.Context, in CreateInput) (Tunnel, error) {
 	if err := fsutil.WriteFileAtomic(configPath, []byte(configContent), 0o640); err != nil {
 		return Tunnel{}, err
 	}
-	encrypted, err := s.secretBox.Encrypt(in.Token)
+	encrypted, err := s.secretBox.Encrypt(token)
 	if err != nil {
 		return Tunnel{}, err
 	}
@@ -109,6 +114,7 @@ func (s *Service) Update(ctx context.Context, id int64, in CreateInput) (Tunnel,
 		return Tunnel{}, err
 	}
 	_ = s.manager.Stop(id)
+	in.Network = s.applyDefaultNetwork(ctx, in.Network)
 	accountTag, tunnelID := current.AccountTag, current.TunnelID
 	encrypted := current.CredentialsEnc
 	if token := strings.TrimSpace(in.Token); token != "" {
@@ -191,6 +197,85 @@ func (s *Service) RuntimeStatus(ctx context.Context, id int64) (RuntimeStatus, e
 	return s.manager.Status(id), nil
 }

+// AppSettings 返回模块级配置；默认 token 只回显掩码。
+func (s *Service) AppSettings(ctx context.Context) (AppSettings, error) {
+	row, err := s.store.GetSettingsRaw(ctx)
+	if err != nil {
+		return AppSettings{}, err
+	}
+	out := AppSettings{Mirror: row.Mirror, Network: row.Network}
+	if row.TokenEnc != "" {
+		out.DefaultTokenConfigured = true
+		if plain, err := s.secretBox.Decrypt(row.TokenEnc); err == nil {
+			out.DefaultTokenMasked = MaskSecret(plain)
+		}
+	}
+	return out, nil
+}
+
+// SaveAppSettings 保存默认 token、下载镜像与默认网络设置；Token 留空表示保留原值。
+func (s *Service) SaveAppSettings(ctx context.Context, in AppSettingsInput) (AppSettings, error) {
+	row, err := s.store.GetSettingsRaw(ctx)
+	if err != nil {
+		return AppSettings{}, err
+	}
+	tokenEnc := row.TokenEnc
+	if token := strings.TrimSpace(in.Token); token != "" {
+		if _, _, _, err := DecodeToken(token); err != nil {
+			return AppSettings{}, err
+		}
+		tokenEnc, err = s.secretBox.Encrypt(token)
+		if err != nil {
+			return AppSettings{}, err
+		}
+	}
+	mirror := strings.TrimSpace(in.Mirror)
+	if mirror == "" {
+		mirror = row.Mirror
+	}
+	if mirror == "" {
+		mirror = "official"
+	}
+	network := in.Network
+	if strings.TrimSpace(network.TransportProtocol) == "" {
+		network = row.Network
+	}
+	if err := s.store.SaveSettings(ctx, tokenEnc, mirror, network); err != nil {
+		return AppSettings{}, err
+	}
+	return s.AppSettings(ctx)
+}
+
+func (s *Service) applyDefaultNetwork(ctx context.Context, network NetworkSettings) NetworkSettings {
+	if strings.TrimSpace(network.TransportProtocol) != "" {
+		return network
+	}
+	row, err := s.store.GetSettingsRaw(ctx)
+	if err != nil {
+		return DefaultNetworkSettings()
+	}
+	return row.Network
+}
+
+func (s *Service) resolveToken(ctx context.Context, input string) (string, error) {
+	token := strings.TrimSpace(input)
+	if token != "" {
+		return token, nil
+	}
+	row, err := s.store.GetSettingsRaw(ctx)
+	if err != nil {
+		return "", err
+	}
+	if row.TokenEnc == "" {
+		return "", fmt.Errorf("请填写 token，或先在「应用配置」中保存默认 token")
+	}
+	plain, err := s.secretBox.Decrypt(row.TokenEnc)
+	if err != nil {
+		return "", fmt.Errorf("默认 token 解密失败: %w", err)
+	}
+	return plain, nil
+}
+
 // attachConfig 从 config.yml 回填域名与回源 service，供编辑弹窗使用。
 func (s *Service) attachConfig(item *Tunnel) {
 	data, err := os.ReadFile(item.ConfigPath)
@@ -298,8 +383,5 @@ func validateInput(in CreateInput) error {
 	default:
 		return fmt.Errorf("暂不支持该模式，当前仅支持 token-local / token-remote")
 	}
-	if strings.TrimSpace(in.Token) == "" {
-		return fmt.Errorf("token 不能为空")
-	}
 	return nil
 }
@@ -0,0 +1,52 @@
+package cloudflared
+
+import (
+	"context"
+	"encoding/base64"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"testing"
+
+	"github.com/fonu/fonu/internal/config"
+	"github.com/fonu/fonu/internal/db"
+	"github.com/fonu/fonu/internal/secret"
+)
+
+func TestAppSettingsDefaultToken(t *testing.T) {
+	dir := t.TempDir()
+	conn, err := db.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if err := db.Migrate(context.Background(), conn, filepath.Join("..", "..", "migrations")); err != nil {
+		t.Fatal(err)
+	}
+	box, err := secret.NewBox("cloudflared-settings-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	svc := NewService(config.Config{DataDir: dir}, NewStore(conn), box, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+	token := base64.StdEncoding.EncodeToString([]byte(`{"a":"acc-1","t":"tun-1","s":"sec-1"}`))
+
+	settings, err := svc.SaveAppSettings(context.Background(), AppSettingsInput{
+		Token: token, Mirror: "gh-proxy-org", Network: DefaultNetworkSettings(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !settings.DefaultTokenConfigured || settings.DefaultTokenMasked == "" {
+		t.Fatalf("默认 token 应标记为已配置并返回掩码：%#v", settings)
+	}
+
+	tunnel, err := svc.Create(context.Background(), CreateInput{
+		Name: "demo", Mode: ModeTokenLocal, Hostnames: []string{"a.example.com"}, Network: DefaultNetworkSettings(),
+	})
+	if err != nil {
+		t.Fatalf("应能使用默认 token 创建隧道: %v", err)
+	}
+	if tunnel.TunnelID != "tun-1" || tunnel.AccountTag != "acc-1" {
+		t.Fatalf("默认 token 解析结果不符：%#v", tunnel)
+	}
+}
@@ -95,6 +95,40 @@ func (s *Store) SetRuntime(ctx context.Context, id int64, status, lastError stri
 	return err
 }

+// settingsRow 是应用配置的原始行；TokenEnc 只在 Service 内部解密，不直接回给前端。
+type settingsRow struct {
+	TokenEnc string
+	Mirror   string
+	Network  NetworkSettings
+}
+
+func (s *Store) GetSettingsRaw(ctx context.Context) (settingsRow, error) {
+	var tokenEnc, mirror, networkJSON string
+	err := s.db.QueryRowContext(ctx, `
+		SELECT COALESCE(default_token_enc, ''), COALESCE(mirror, 'official'), COALESCE(network_json, '{}')
+		FROM cf_settings WHERE id = 1
+	`).Scan(&tokenEnc, &mirror, &networkJSON)
+	if errors.Is(err, sql.ErrNoRows) {
+		return settingsRow{Mirror: "official", Network: DefaultNetworkSettings()}, nil
+	}
+	if err != nil {
+		return settingsRow{}, err
+	}
+	row := settingsRow{TokenEnc: tokenEnc, Mirror: mirror, Network: DefaultNetworkSettings()}
+	_ = json.Unmarshal([]byte(networkJSON), &row.Network)
+	return row, nil
+}
+
+func (s *Store) SaveSettings(ctx context.Context, tokenEnc, mirror string, network NetworkSettings) error {
+	networkJSON, _ := json.Marshal(network)
+	_, err := s.db.ExecContext(ctx, `
+		UPDATE cf_settings
+		SET default_token_enc = ?, mirror = ?, network_json = ?, updated_at = datetime('now')
+		WHERE id = 1
+	`, tokenEnc, mirror, string(networkJSON))
+	return err
+}
+
 func scanTunnel(row interface{ Scan(dest ...any) error }) (Tunnel, error) {
 	var item Tunnel
 	var networkJSON, created, updated string