Your Name
9890cfc488
- AdminUser model: multi-admin accounts with bcrypt hashing (admin_users table) - Three roles: superadmin / admin / viewer with granular permission bits - auth.py: login migrated from env-var single admin to DB-backed accounts; seed_initial_admin() auto-creates first superadmin from SM_ADMIN_PASSWORD - Web UI: /system/admins page (add/edit role/toggle/reset pwd/delete) + change-my-password; sidebar entry; permission-guarded routes - REST API: /api/admins CRUD with protection checks - Protections: cannot delete/disable self; keep >=1 enabled superadmin; disabled accounts fail permission checks immediately - README: document roles, permission bits, API
488 lines
18 KiB
Python
488 lines
18 KiB
Python
"""Web 管理面板路由。"""
|
|
from flask import Blueprint, render_template, request, redirect, url_for, flash, current_app
|
|
from auth import login_required, permission_required
|
|
from database import db
|
|
from models import Instance, User
|
|
from services import stats_service, backup_service
|
|
|
|
bp = Blueprint("web", __name__)
|
|
|
|
|
|
# ── 通用模板上下文 ─────────────────────────────────────────────
|
|
@bp.app_context_processor
|
|
def inject_nav():
|
|
from flask import session as flask_session
|
|
p = request.path
|
|
if p == "/" or p.startswith("/dashboard"):
|
|
page_name = "仪表盘"
|
|
elif p.startswith("/instances"):
|
|
page_name = "代理实例"
|
|
elif p.startswith("/users"):
|
|
page_name = "用户管理"
|
|
elif p == "/stats":
|
|
page_name = "流量统计"
|
|
elif p.startswith("/stats/connections"):
|
|
page_name = "活跃连接"
|
|
elif p.startswith("/logs"):
|
|
page_name = "审计日志"
|
|
elif p.startswith("/system/admins"):
|
|
page_name = "管理员账户"
|
|
elif p.startswith("/system"):
|
|
page_name = "系统管理"
|
|
else:
|
|
page_name = ""
|
|
return {
|
|
"nav": {
|
|
"dashboard": p == "/" or p.startswith("/dashboard"),
|
|
"instances": p.startswith("/instances"),
|
|
"users": p.startswith("/users"),
|
|
"stats": p.startswith("/stats"),
|
|
"logs": p.startswith("/logs"),
|
|
"system": p.startswith("/system") and not p.startswith("/system/admins"),
|
|
"admins": p.startswith("/system/admins"),
|
|
},
|
|
"page_name": page_name,
|
|
"logged_in": flask_session.get("logged_in", False),
|
|
}
|
|
|
|
|
|
# ── 仪表盘 ─────────────────────────────────────────────────────
|
|
@bp.route("/")
|
|
@bp.route("/dashboard")
|
|
@login_required
|
|
def index():
|
|
summary = stats_service.get_dashboard_summary()
|
|
return render_template("dashboard.html", s=summary)
|
|
|
|
|
|
# ── 实例管理 ───────────────────────────────────────────────────
|
|
@bp.route("/instances")
|
|
@login_required
|
|
def instances():
|
|
inst_list = current_app.instance_manager.get_status()
|
|
return render_template("instances.html", instances=inst_list)
|
|
|
|
|
|
@bp.route("/instances/<int:iid>/start", methods=["POST"])
|
|
@login_required
|
|
def start_instance(iid):
|
|
try:
|
|
current_app.instance_manager.start_instance(iid)
|
|
flash("实例已启动", "success")
|
|
except OSError as e:
|
|
flash(f"启动失败（端口可能被占用）: {e}", "danger")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
@bp.route("/instances/<int:iid>/stop", methods=["POST"])
|
|
@login_required
|
|
def stop_instance(iid):
|
|
current_app.instance_manager.stop_instance(iid)
|
|
flash("实例已停止", "warning")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
@bp.route("/instances/<int:iid>/restart", methods=["POST"])
|
|
@login_required
|
|
def restart_instance(iid):
|
|
try:
|
|
current_app.instance_manager.restart_instance(iid)
|
|
flash("实例已重启", "info")
|
|
except OSError as e:
|
|
flash(f"重启失败（端口可能被占用）: {e}", "danger")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
@bp.route("/instances/add", methods=["POST"])
|
|
@login_required
|
|
def add_instance():
|
|
name = request.form.get("name", "").strip()
|
|
if not name:
|
|
flash("名称不能为空", "danger")
|
|
return redirect(url_for("web.instances"))
|
|
if db.session.query(Instance).filter_by(name=name).first():
|
|
flash("名称已存在", "danger")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
inst = Instance(
|
|
name=name,
|
|
listen_host=request.form.get("listen_host", "0.0.0.0"),
|
|
listen_port=int(request.form.get("listen_port", 1080)),
|
|
timeout=int(request.form.get("timeout", 30)),
|
|
auth_method=request.form.get("auth_method", "none"),
|
|
bandwidth_down=float(request.form.get("bandwidth_down", 0)),
|
|
bandwidth_up=float(request.form.get("bandwidth_up", 0)),
|
|
max_concurrent=int(request.form.get("max_concurrent", 10)),
|
|
notes=request.form.get("notes", ""),
|
|
)
|
|
db.session.add(inst)
|
|
db.session.commit()
|
|
|
|
if request.form.get("start") == "on":
|
|
current_app.instance_manager.start_instance(inst.id)
|
|
|
|
flash(f"实例 {name} 已创建", "success")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
@bp.route("/instances/<int:iid>/edit", methods=["POST"])
|
|
@login_required
|
|
def edit_instance(iid):
|
|
inst = db.session.query(Instance).get(iid)
|
|
if not inst:
|
|
return "实例不存在", 404
|
|
data = request.form
|
|
inst.listen_host = data.get("listen_host", inst.listen_host)
|
|
inst.listen_port = int(data.get("listen_port", inst.listen_port))
|
|
inst.timeout = int(data.get("timeout", inst.timeout))
|
|
inst.auth_method = data.get("auth_method", inst.auth_method)
|
|
inst.bandwidth_down = float(data.get("bandwidth_down", inst.bandwidth_down))
|
|
inst.bandwidth_up = float(data.get("bandwidth_up", inst.bandwidth_up))
|
|
inst.max_concurrent = int(data.get("max_concurrent", inst.max_concurrent))
|
|
inst.notes = data.get("notes", inst.notes)
|
|
db.session.commit()
|
|
|
|
if inst.running:
|
|
try:
|
|
current_app.instance_manager.restart_instance(iid)
|
|
except OSError as e:
|
|
flash(f"重启失败（端口可能被占用）: {e}", "warning")
|
|
|
|
flash("配置已更新", "success")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
@bp.route("/instances/<int:iid>/delete", methods=["POST"])
|
|
@login_required
|
|
def delete_instance(iid):
|
|
inst = db.session.query(Instance).get(iid)
|
|
if not inst:
|
|
return "实例不存在", 404
|
|
current_app.instance_manager.stop_instance(iid)
|
|
db.session.delete(inst)
|
|
db.session.commit()
|
|
flash("实例已删除", "warning")
|
|
return redirect(url_for("web.instances"))
|
|
|
|
|
|
# ── 用户管理 ───────────────────────────────────────────────────
|
|
@bp.route("/users")
|
|
@login_required
|
|
def users():
|
|
page = int(request.args.get("page", 1))
|
|
search = request.args.get("search", "")
|
|
data = current_app.user_service.list_users(page=page, search=search)
|
|
return render_template("users.html", **data, search=search)
|
|
|
|
|
|
@bp.route("/users/add", methods=["POST"])
|
|
@login_required
|
|
def add_user():
|
|
data = request.form
|
|
result = current_app.user_service.create_user(
|
|
username=data.get("username", "").strip(),
|
|
password=data.get("password", ""),
|
|
bandwidth_down=float(data.get("bandwidth_down", 0)),
|
|
bandwidth_up=float(data.get("bandwidth_up", 0)),
|
|
max_concurrent=int(data.get("max_concurrent", 10)),
|
|
total_traffic_mb=float(data.get("total_traffic_mb", 0)),
|
|
monthly_traffic_mb=float(data.get("monthly_traffic_mb", 0)),
|
|
ip_whitelist=data.get("ip_whitelist", ""),
|
|
ip_blacklist=data.get("ip_blacklist", ""),
|
|
expire_at=data.get("expire_at"),
|
|
)
|
|
if "error" in result:
|
|
flash(result["error"], "danger")
|
|
else:
|
|
flash("用户已创建", "success")
|
|
return redirect(url_for("web.users"))
|
|
|
|
|
|
@bp.route("/users/<int:uid>/edit", methods=["POST"])
|
|
@login_required
|
|
def edit_user(uid):
|
|
data = request.form
|
|
kwargs = {
|
|
"password": data.get("password", ""),
|
|
"bandwidth_down": float(data.get("bandwidth_down", 0)),
|
|
"bandwidth_up": float(data.get("bandwidth_up", 0)),
|
|
"max_concurrent": int(data.get("max_concurrent", 10)),
|
|
"total_traffic_mb": float(data.get("total_traffic_mb", 0)),
|
|
"monthly_traffic_mb": float(data.get("monthly_traffic_mb", 0)),
|
|
"ip_whitelist": data.get("ip_whitelist", ""),
|
|
"ip_blacklist": data.get("ip_blacklist", ""),
|
|
"expire_at": data.get("expire_at"),
|
|
}
|
|
result = current_app.user_service.update_user(uid, **kwargs)
|
|
if "error" in result:
|
|
flash(result["error"], "danger")
|
|
else:
|
|
flash("用户已更新", "success")
|
|
return redirect(url_for("web.users"))
|
|
|
|
|
|
@bp.route("/users/<int:uid>/delete", methods=["POST"])
|
|
@login_required
|
|
def delete_user(uid):
|
|
result = current_app.user_service.delete_user(uid)
|
|
if "error" in result:
|
|
flash(result["error"], "danger")
|
|
else:
|
|
flash("用户已删除", "warning")
|
|
return redirect(url_for("web.users"))
|
|
|
|
|
|
@bp.route("/users/<int:uid>/toggle", methods=["POST"])
|
|
@login_required
|
|
def toggle_user(uid):
|
|
# 支持两种调用方式:
|
|
# 1) 隐藏字段 enabled=on/off (web form)
|
|
# 2) 不带字段时切换当前状态 (传统行为, 防止表单无字段导致总是禁用)
|
|
if "enabled" in request.form:
|
|
enabled = request.form.get("enabled") in ("on", "true", "1", "yes")
|
|
else:
|
|
from models import User
|
|
from database import db
|
|
u = db.session.query(User).get(uid)
|
|
if not u:
|
|
flash("用户不存在", "danger")
|
|
return redirect(url_for("web.users"))
|
|
enabled = not u.enabled
|
|
result = current_app.user_service.toggle_user(uid, enabled)
|
|
flash("已" + ("启用" if enabled else "禁用") + "该用户", "success")
|
|
return redirect(url_for("web.users"))
|
|
|
|
|
|
@bp.route("/users/<int:uid>/ban", methods=["POST"])
|
|
@login_required
|
|
def ban_user(uid):
|
|
# 同 toggle_user 的两种调用方式
|
|
if "ban" in request.form:
|
|
banned = request.form.get("ban") in ("on", "true", "1", "yes")
|
|
else:
|
|
from models import User
|
|
from database import db
|
|
u = db.session.query(User).get(uid)
|
|
if not u:
|
|
flash("用户不存在", "danger")
|
|
return redirect(url_for("web.users"))
|
|
banned = not u.banned
|
|
result = current_app.user_service.ban_user(uid, banned)
|
|
flash("已" + ("封禁" if banned else "解封") + "该用户", "success")
|
|
return redirect(url_for("web.users"))
|
|
|
|
|
|
# ── 统计 ───────────────────────────────────────────────────────
|
|
@bp.route("/stats")
|
|
@login_required
|
|
def stats():
|
|
return render_template("stats.html",
|
|
trend=stats_service.get_traffic_trend(30),
|
|
users=stats_service.get_user_stats(),
|
|
instances=stats_service.get_instance_stats())
|
|
|
|
|
|
# ── 活跃连接 ───────────────────────────────────────────────────
|
|
@bp.route("/stats/connections")
|
|
@login_required
|
|
def connections():
|
|
return render_template("connections.html",
|
|
conns=stats_service.get_active_connections())
|
|
|
|
|
|
# ── 审计日志 ───────────────────────────────────────────────────
|
|
@bp.route("/logs")
|
|
@login_required
|
|
def logs():
|
|
page = int(request.args.get("page", 1))
|
|
data = current_app.user_service.query_logs(
|
|
page=page,
|
|
event=request.args.get("event", ""),
|
|
user=request.args.get("user", ""),
|
|
src_ip=request.args.get("src_ip", ""),
|
|
)
|
|
return render_template("logs.html", **data,
|
|
event_filter=request.args.get("event", ""),
|
|
user_filter=request.args.get("user", ""),
|
|
ip_filter=request.args.get("src_ip", ""))
|
|
|
|
|
|
# ── 系统管理 ───────────────────────────────────────────────────
|
|
@bp.route("/system")
|
|
@login_required
|
|
@permission_required("system:read")
|
|
def system():
|
|
import platform, time
|
|
from auth import current_admin
|
|
backups = backup_service.list_backups()
|
|
admin = current_admin()
|
|
return render_template("system.html", backups=backups,
|
|
sys_version=platform.python_version(),
|
|
sys_platform=platform.platform(),
|
|
sys_hostname=platform.node(),
|
|
uptime=time.strftime("%Y-%m-%d %H:%M:%S", time.localtime()),
|
|
current_admin=admin)
|
|
|
|
|
|
@bp.route("/system/backup", methods=["POST"])
|
|
@login_required
|
|
@permission_required("system:write")
|
|
def create_backup():
|
|
backup_service.create_backup()
|
|
flash("备份已完成", "success")
|
|
return redirect(url_for("web.system"))
|
|
|
|
|
|
@bp.route("/system/restore/<int:bid>", methods=["POST"])
|
|
@login_required
|
|
@permission_required("system:write")
|
|
def restore_backup(bid):
|
|
result = backup_service.restore_backup(bid)
|
|
if "error" in result:
|
|
flash(result["error"], "danger")
|
|
else:
|
|
flash("恢复完成，请刷新页面", "success")
|
|
return redirect(url_for("web.system"))
|
|
|
|
|
|
# ── 管理员账户管理 ────────────────────────────────────────────────
|
|
@bp.route("/system/admins")
|
|
@login_required
|
|
@permission_required("admins:read")
|
|
def admins():
|
|
from models import AdminUser
|
|
from auth import current_admin
|
|
admin_list = AdminUser.query.order_by(AdminUser.id.asc()).all()
|
|
return render_template("admins.html", admins=admin_list,
|
|
current_admin=current_admin())
|
|
|
|
|
|
@bp.route("/system/admins/add", methods=["POST"])
|
|
@login_required
|
|
@permission_required("admins:write")
|
|
def add_admin():
|
|
from models import AdminUser
|
|
username = request.form.get("username", "").strip()
|
|
password = request.form.get("password", "")
|
|
role = request.form.get("role", "viewer")
|
|
if not username or not password:
|
|
flash("用户名和密码不能为空", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
if role not in AdminUser.ROLE_LABELS:
|
|
role = "viewer"
|
|
if AdminUser.query.filter_by(username=username).first():
|
|
flash("用户名已存在", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
if len(password) < 4:
|
|
flash("密码至少 4 位", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
admin = AdminUser()
|
|
admin.username = username
|
|
admin.role = role
|
|
admin.enabled = True
|
|
admin.set_password(password)
|
|
db.session.add(admin)
|
|
db.session.commit()
|
|
flash(f"已创建管理员 {username}", "success")
|
|
return redirect(url_for("web.admins"))
|
|
|
|
|
|
@bp.route("/system/admins/<int:aid>/toggle", methods=["POST"])
|
|
@login_required
|
|
@permission_required("admins:write")
|
|
def toggle_admin(aid):
|
|
from models import AdminUser
|
|
from auth import current_admin
|
|
admin = AdminUser.query.get_or_404(aid)
|
|
# 不能禁用自己
|
|
curr = current_admin()
|
|
if curr and curr.id == admin.id:
|
|
flash("不能禁用当前登录账户", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
admin.enabled = not admin.enabled
|
|
db.session.commit()
|
|
flash(f"{'已启用' if admin.enabled else '已禁用'} {admin.username}", "info")
|
|
return redirect(url_for("web.admins"))
|
|
|
|
|
|
@bp.route("/system/admins/<int:aid>/role", methods=["POST"])
|
|
@login_required
|
|
@permission_required("admins:write")
|
|
def change_admin_role(aid):
|
|
from models import AdminUser
|
|
admin = AdminUser.query.get_or_404(aid)
|
|
role = request.form.get("role", "viewer")
|
|
if role not in AdminUser.ROLE_LABELS:
|
|
flash("无效的角色", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
admin.role = role
|
|
db.session.commit()
|
|
flash(f"{admin.username} 角色已更新为 {admin.role_label}", "success")
|
|
return redirect(url_for("web.admins"))
|
|
|
|
|
|
@bp.route("/system/admins/<int:aid>/password", methods=["POST"])
|
|
@login_required
|
|
@permission_required("admins:write")
|
|
def reset_admin_password(aid):
|
|
from models import AdminUser
|
|
password = request.form.get("password", "")
|
|
if not password or len(password) < 4:
|
|
flash("密码至少 4 位", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
admin = AdminUser.query.get_or_404(aid)
|
|
admin.set_password(password)
|
|
db.session.commit()
|
|
flash(f"{admin.username} 密码已重置", "success")
|
|
return redirect(url_for("web.admins"))
|
|
|
|
|
|
@bp.route("/system/admins/<int:aid>/delete", methods=["POST"])
|
|
@login_required
|
|
@permission_required("admins:write")
|
|
def delete_admin(aid):
|
|
from models import AdminUser
|
|
from auth import current_admin
|
|
admin = AdminUser.query.get_or_404(aid)
|
|
curr = current_admin()
|
|
if curr and curr.id == admin.id:
|
|
flash("不能删除当前登录账户", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
# 至少保留一个 superadmin
|
|
if admin.role == "superadmin":
|
|
super_count = AdminUser.query.filter_by(role="superadmin", enabled=True).count()
|
|
if super_count <= 1:
|
|
flash("至少需要保留一个启用的超级管理员", "danger")
|
|
return redirect(url_for("web.admins"))
|
|
db.session.delete(admin)
|
|
db.session.commit()
|
|
flash(f"已删除管理员 {admin.username}", "warning")
|
|
return redirect(url_for("web.admins"))
|
|
|
|
|
|
@bp.route("/system/change-password", methods=["POST"])
|
|
@login_required
|
|
def change_my_password():
|
|
"""当前登录用户修改自己的密码。"""
|
|
from models import AdminUser
|
|
from auth import current_admin
|
|
old_pwd = request.form.get("old_password", "")
|
|
new_pwd = request.form.get("new_password", "")
|
|
confirm_pwd = request.form.get("confirm_password", "")
|
|
admin = current_admin()
|
|
if not admin:
|
|
return redirect(url_for("auth.logout"))
|
|
if not admin.check_password(old_pwd):
|
|
flash("原密码错误", "danger")
|
|
return redirect(url_for("web.system"))
|
|
if not new_pwd or len(new_pwd) < 4:
|
|
flash("新密码至少 4 位", "danger")
|
|
return redirect(url_for("web.system"))
|
|
if new_pwd != confirm_pwd:
|
|
flash("两次输入的新密码不一致", "danger")
|
|
return redirect(url_for("web.system"))
|
|
admin.set_password(new_pwd)
|
|
db.session.commit()
|
|
flash("密码修改成功", "success")
|
|
return redirect(url_for("web.system"))
|