ci: 复用部署服务器缓存并支持 HTTPS 同源登录

internal/handler/identity.go

@@ -35,10 +35,13 @@ type IdentityOptions struct {
 	Limiter          LoginLimiter
 	DevelopmentLogin bool
 	SecureCookie     bool
+	PublicOrigin     string
 }
 
 const sessionCookie = "veyra_admin_session"
 
+type publicOriginContextKey struct{}
+
 func bindIdentity(r *gin.Engine, options IdentityOptions) {
 	r.SetTrustedProxies(nil)
 	adminAuth := func(c *gin.Context) { authenticate(c, options, "admin") }
@@ -210,6 +213,9 @@ func sameOrigin(r *http.Request) bool {
 	if err != nil || origin.Host == "" || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" {
 		return false
 	}
+	if expected, _ := r.Context().Value(publicOriginContextKey{}).(string); expected != "" {
+		return origin.Host == r.Host && origin.Scheme+"://"+origin.Host == expected
+	}
 	scheme := "http"
 	if r.TLS != nil {
 		scheme = "https"

internal/handler/identity_test.go

@@ -49,3 +49,35 @@ func TestDevelopmentLoginDisabledByDefault(t *testing.T) {
 		t.Fatal("development login open outside explicitly enabled environment")
 	}
 }
+
+func TestHTTPSPublicOriginBehindProxy(t *testing.T) {
+	auth, err := service.NewAuthService(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := func(context.Context) error { return nil }
+	for _, tc := range []struct {
+		name, publicOrigin, host, origin, forwardedProto string
+		status                                           int
+	}{
+		{"configured HTTPS", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 503},
+		{"no reliance on proxy header", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "", 503},
+		{"foreign origin", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://evil.example", "https", 403},
+		{"HTTP origin rejected", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "http://veyra.sundynix.cn", "https", 403},
+		{"wrong host", "https://veyra.sundynix.cn", "evil.example", "https://veyra.sundynix.cn", "https", 403},
+		{"spoofed proxy header", "", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 403},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true, PublicOrigin: tc.publicOrigin})
+			req := httptest.NewRequest(http.MethodPost, "http://"+tc.host+"/api/admin/v1/auth/login", strings.NewReader(`{"login_name":"admin","password":"test-password"}`))
+			req.Header.Set("Content-Type", "application/json")
+			req.Header.Set("Origin", tc.origin)
+			req.Header.Set("X-Forwarded-Proto", tc.forwardedProto)
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, req)
+			if rec.Code != tc.status {
+				t.Fatalf("got %d want %d", rec.Code, tc.status)
+			}
+		})
+	}
+}

internal/handler/router.go

@@ -21,6 +21,9 @@ func NewRouter(health *service.HealthService, logger *zap.Logger, identity Ident
 	r.Use(func(c *gin.Context) {
 		ctx, cancel := context.WithTimeout(c.Request.Context(), 5*time.Second)
 		defer cancel()
+		if identity.PublicOrigin != "" {
+			ctx = context.WithValue(ctx, publicOriginContextKey{}, identity.PublicOrigin)
+		}
 		c.Request = c.Request.WithContext(ctx)
 		requestID := uuid.NewString()
 		c.Header("X-Request-ID", requestID)