zhaowei.huang
20f98db6da
- YARP: map-edit/ai-config 全方法、reflection 写方法挂 PlatformScope， reflection/selection 单独放行（运营端 3D 高亮），堵住运营账号直达地图编辑/反射调用 - goto-site 探测改用不存在的 car/-1（消除健康检查真实派车风险）并加 60s 缓存 - Config PUT 按 scope 收紧：RCSMonitor 仅可写 ops 节；wizard 写操作与 simplelite/restart-for-update 限 PlatformScope；/api/health 去除虚假端口表 - 修复 wms 模块菜单裁剪失效（admin-config-location → admin-config-facility） - vrHost 默认 location.hostname:8223（新增 utils/vrender.ts），远程访问 3D 视口可用 - /status 页改接真实 /api/health* 诊断；uploadAsset 移除矛盾 multipart 头； mapsApi.merge 对齐 save 的 409 冲突处理；JWT 验签参数改启动期 DI 一次性配置 - 清理死代码：ProjectionController、DataTablePro、useClipboard、CadToolbarView、 AppShell 未用导入；lint 脚本替换为 typecheck；日志窗口 List 改 Queue
78 lines
2.6 KiB
C#
78 lines
2.6 KiB
C#
using System.Text.Json;
|
||
using Microsoft.AspNetCore.Authorization;
|
||
using Microsoft.AspNetCore.Mvc;
|
||
using MiGu.Server.Configs;
|
||
|
||
namespace MiGu.Server.Controllers;
|
||
|
||
// AR-4: 全 class 加 [Authorize] —— 替代会话21 点名的「ConfigController 无鉴权 PUT 任意 section」漏洞。
|
||
// GET (List/Get) 只要登录就放；PUT 按 scope 收紧：Platform 任意节，RCSMonitor 仅 ops 白名单。
|
||
[ApiController]
|
||
[Authorize]
|
||
[Route("api/config")]
|
||
public class ConfigController : ControllerBase
|
||
{
|
||
private readonly ConfigStore _store;
|
||
|
||
public ConfigController(ConfigStore store)
|
||
{
|
||
_store = store;
|
||
}
|
||
|
||
[HttpGet]
|
||
public IActionResult List()
|
||
{
|
||
var envs = _store.List().Select(e => new
|
||
{
|
||
section = e.Section,
|
||
version = e.Version,
|
||
updatedAt = e.UpdatedAt
|
||
});
|
||
return Ok(envs);
|
||
}
|
||
|
||
[HttpGet("{section}")]
|
||
public IActionResult Get(string section)
|
||
{
|
||
if (!ConfigStore.AllSections.Contains(section, StringComparer.OrdinalIgnoreCase))
|
||
return NotFound(new { message = $"未知 section: {section}" });
|
||
|
||
var env = _store.Get(section);
|
||
return Ok(new
|
||
{
|
||
section = env.Section,
|
||
version = env.Version,
|
||
updatedAt = env.UpdatedAt,
|
||
payload = env.Payload
|
||
});
|
||
}
|
||
|
||
/// <summary>RCSMonitor scope 允许写入的 section 白名单（地图监控动作备份等运营自有配置）。</summary>
|
||
private static readonly string[] MonitorWritableSections = { "ops" };
|
||
|
||
// Platform scope 可写任意 section；RCSMonitor 仅允许写 ops（保留运营端
|
||
// 「地图监控动作 ops.monitor 备份」既有功能），其余 section（routing/auth/system 等）一律 403。
|
||
[HttpPut("{section}")]
|
||
public IActionResult Put(string section, [FromBody] JsonElement payload)
|
||
{
|
||
if (!ConfigStore.AllSections.Contains(section, StringComparer.OrdinalIgnoreCase))
|
||
return NotFound(new { message = $"未知 section: {section}" });
|
||
|
||
var scope = User.FindFirst("scope")?.Value;
|
||
if (!string.Equals(scope, "Platform", StringComparison.OrdinalIgnoreCase)
|
||
&& !MonitorWritableSections.Contains(section, StringComparer.OrdinalIgnoreCase))
|
||
{
|
||
return StatusCode(403, new { message = $"当前账号无权修改配置节 {section}（需要 Platform 管理端权限）" });
|
||
}
|
||
|
||
var env = _store.Put(section, payload);
|
||
return Ok(new
|
||
{
|
||
section = env.Section,
|
||
version = env.Version,
|
||
updatedAt = env.UpdatedAt,
|
||
payload = env.Payload
|
||
});
|
||
}
|
||
}
|