qiaoqichao/mini-openclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 增加演示身份下拉并保留令牌权限边界

Browse Source
This commit is contained in:
NathanAlex7
2026-09-14 13:18:15 +08:00
parent c556172a1d
commit 5f0b1f9409
15 changed files with 68 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/api/risk_agent_access.py
+17 -3
View File
@@ -6,16 +6,29 @@ from urllib.parse import urlsplit
from fastapi import HTTPException, Request
ROLES = ("admin", "reviewer", "manager")
DEFAULT_DEMO_PROJECTS = "DEMO-A,DEMO-B,DEMO-C,LAB-001,XB-2026-001"
def authorize(request: Request):
configured = os.getenv("XINGBANG_AUTH_USERS", "")
if not configured:
demo_role = request.headers.get("x-xingbang-demo-role", "").strip()
if demo_role:
forwarded_host = request.headers.get("x-xingbang-client-host", request.headers.get("host", ""))
hostname = urlsplit("//"+forwarded_host).hostname
local_preview = not configured and os.getenv("XINGBANG_REQUIRE_AUTH") != "1" and request.client and request.client.host in ("127.0.0.1", "::1", "testclient") and hostname in ("localhost", "127.0.0.1", "::1", "testserver")
if not (os.getenv("XINGBANG_DEMO_ROLE_LOGIN") == "1" or local_preview) or demo_role not in ROLES:
raise HTTPException(401, "演示身份未启用或身份无效")
projects = [item.strip() for item in os.getenv("XINGBANG_DEMO_PROJECTS", DEFAULT_DEMO_PROJECTS).split(",") if item.strip()]
user = {"id": f"demo-{demo_role}", "role": demo_role, "projects": projects, "preview": False, "demo": True}
elif not configured:
forwarded_host = request.headers.get("x-xingbang-client-host", request.headers.get("host", ""))
hostname = urlsplit("//"+forwarded_host).hostname
if os.getenv("XINGBANG_REQUIRE_AUTH") == "1" or not request.client or request.client.host not in ("127.0.0.1", "::1", "testclient"):
raise HTTPException(401, "请配置服务器身份认证后访问")
if hostname not in ("localhost", "127.0.0.1", "::1", "testserver"):
raise HTTPException(401, "本机预览仅接受回环地址；远程访问必须配置身份认证")
user = {"id": "local-preview", "role": "admin", "projects": ["*"], "preview": True}
user = {"id": "local-preview", "role": "admin", "projects": ["*"], "preview": True, "demo": True}
else:
try:
accounts = json.loads(configured)
@@ -23,10 +36,11 @@ def authorize(request: Request):
raise HTTPException(503, "身份配置无效")
supplied = request.headers.get("authorization", "").removeprefix("Bearer ")
user = next((dict(u) for u in accounts if isinstance(u.get("token"), str) and hmac.compare_digest(u["token"], supplied)), None)
if not user or user.get("role") not in ("admin", "reviewer", "manager"):
if not user or user.get("role") not in ROLES:
raise HTTPException(401, "访问令牌无效")
user.pop("token", None)
user["preview"] = False
user["demo"] = False
request.state.identity = user
path = request.url.path.split("/risk-agent/", 1)[-1]
if user["role"] == "manager":