ci: 复用部署服务器缓存并支持 HTTPS 同源登录

internal/config/config.go

@@ -14,6 +14,7 @@ import (
 
 type Config struct {
 	PythonExecutable                                                           string
+	PublicOrigin                                                               string
 	Logging                                                                    logging.Options
 	Environment, HTTPAddr                                                      string
 	PGHost, PGPort, PGDatabase, PGUser, PGPassword, PGSSLMode, PGAdminDatabase string
@@ -62,6 +63,13 @@ func LoadEnvFile(path string) error {
 func Load() (Config, error) {
 	c := Config{Environment: env("APP_ENV", "local"), HTTPAddr: env("HTTP_ADDR", "127.0.0.1:8080"), PGHost: env("PGHOST", "192.168.100.127"), PGPort: env("PGPORT", "5432"), PGDatabase: env("PGDATABASE", "veyra"), PGUser: os.Getenv("PGUSER"), PGPassword: os.Getenv("PGPASSWORD"), PGSSLMode: env("PGSSLMODE", "disable"), PGAdminDatabase: env("PGADMIN_DATABASE", "postgres"), RedisAddr: env("REDIS_ADDR", "192.168.100.127:6379"), RedisUsername: os.Getenv("REDIS_USERNAME"), RedisPassword: os.Getenv("REDIS_PASSWORD")}
 	c.PythonExecutable = env("PYTHON_EXECUTABLE", "python3")
+	c.PublicOrigin = os.Getenv("PUBLIC_ORIGIN")
+	if c.PublicOrigin != "" {
+		origin, err := url.Parse(c.PublicOrigin)
+		if err != nil || (origin.Scheme != "http" && origin.Scheme != "https") || origin.Hostname() == "" || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" || origin.Opaque != "" || origin.Scheme+"://"+origin.Host != c.PublicOrigin {
+			return Config{}, fmt.Errorf("PUBLIC_ORIGIN must be an http or https origin without a path")
+		}
+	}
 	c.Logging = logging.Options{Directory: env("LOG_DIR", "logs"), Level: env("LOG_LEVEL", "info"), MaxSizeMB: 50, MaxBackups: 10, MaxAgeDays: 14}
 	for key, dest := range map[string]*int{"LOG_MAX_SIZE_MB": &c.Logging.MaxSizeMB, "LOG_MAX_BACKUPS": &c.Logging.MaxBackups, "LOG_MAX_AGE_DAYS": &c.Logging.MaxAgeDays} {
 		if value := os.Getenv(key); value != "" {

internal/config/config_test.go

@@ -23,3 +23,28 @@ func TestRejectInvalidRedisDB(t *testing.T) {
 		t.Fatal("negative database must be rejected")
 	}
 }
+
+func TestPublicOriginConfiguration(t *testing.T) {
+	for _, tc := range []struct {
+		origin string
+		valid  bool
+	}{
+		{"", true},
+		{"https://veyra.sundynix.cn", true},
+		{"http://localhost:8080", true},
+		{"https://veyra.sundynix.cn/", false},
+		{"https://veyra.sundynix.cn?", false},
+		{"https://veyra.sundynix.cn#", false},
+		{"https://user:password@veyra.sundynix.cn", false},
+		{"ftp://veyra.sundynix.cn", false},
+		{"https:///missing-host", false},
+	} {
+		t.Run(tc.origin, func(t *testing.T) {
+			t.Setenv("PUBLIC_ORIGIN", tc.origin)
+			_, err := Load()
+			if (err == nil) != tc.valid {
+				t.Fatalf("valid=%v error=%v", tc.valid, err)
+			}
+		})
+	}
+}