Autumn-27
d5359e1f04
在 agent 下发意图(add_intent)与插入资产(insert_assets)两处接入资产闸门；
并新增任务级规则(拦截 block + 允许 allow 白名单)，创建任务时录入、任务详情
总览里可编辑。
- 匹配/执行(db/asset_intercept_match.go)：MatchAssetInterceptRules 纯匹配
(exact/fuzzy 的 域名·IP·URL + CIDR，URL host 会拆出归类)；EvaluateAssetGate
「先拦截后允许」闸门——命中拦截即禁止；未命中但存在启用的允许规则且都不命中→
不允许测试；无启用允许规则则不启用白名单。附单元测试。
- 执行点：add_intent 命中即不下发意图；insert_assets 命中即跳过 Upsert 及
AddAutoScope 副作用。均合并 全局∪任务级 规则。
- 任务级规则：表 task_intercept_rules(task_id FK CASCADE + action block/allow，
幂等 ALTER 补旧库)；db/task_intercept.go 提供 List/Split/CRUD/事务插入；
创建任务随 intercept_rules 提交；CRUD 路由 /api/tasks/{id}/intercept-rules。
- 前端：新建任务抽屉多行录入(拦截/允许 + 类型，用 NativeSelect 避免 Sheet 内
下拉 portal 导致误关抽屉)；任务详情总览新增规则管理卡片(增删改+启用开关)。
81 lines
3.1 KiB
Go
81 lines
3.1 KiB
Go
package db
|
|
|
|
import "time"
|
|
|
|
// AssetInterceptRule is one row of asset_intercept_rules — a global asset
|
|
// blocklist entry. Unlike intercept_rules (which matches tool name / input),
|
|
// these match the *target asset*: an exact/fuzzy domain·ip·url, or a CIDR range.
|
|
// This layer only stores rules; the matching/enforcement logic lives elsewhere.
|
|
type AssetInterceptRule struct {
|
|
ID int64 `json:"id"`
|
|
Enabled bool `json:"enabled"`
|
|
Kind string `json:"kind"` // exact_domain|exact_ip|exact_url|fuzzy_domain|fuzzy_ip|fuzzy_url|cidr
|
|
Pattern string `json:"pattern"`
|
|
Note string `json:"note"`
|
|
Builtin bool `json:"builtin"`
|
|
// Action 仅用于任务级规则：'block'=拦截 'allow'=允许(白名单)。
|
|
// 全局规则(asset_intercept_rules)不带此列，恒为空，视为拦截。
|
|
Action string `json:"action,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
const assetInterceptRuleCols = `id, enabled, kind, pattern, note, builtin, created_at, updated_at`
|
|
|
|
func scanAssetInterceptRule(row interface{ Scan(...any) error }) (AssetInterceptRule, error) {
|
|
var r AssetInterceptRule
|
|
err := row.Scan(&r.ID, &r.Enabled, &r.Kind, &r.Pattern, &r.Note, &r.Builtin, &r.CreatedAt, &r.UpdatedAt)
|
|
return r, err
|
|
}
|
|
|
|
// ListAssetInterceptRules returns all rules, built-ins first then newest first.
|
|
func (d *DB) ListAssetInterceptRules() ([]AssetInterceptRule, error) {
|
|
rows, err := d.Query(`SELECT ` + assetInterceptRuleCols + ` FROM asset_intercept_rules ORDER BY builtin DESC, id DESC`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []AssetInterceptRule
|
|
for rows.Next() {
|
|
r, err := scanAssetInterceptRule(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, r)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// CreateAssetInterceptRule inserts a new user rule (builtin is always false here).
|
|
func (d *DB) CreateAssetInterceptRule(kind, pattern, note string, enabled bool) (AssetInterceptRule, error) {
|
|
row := d.QueryRow(`
|
|
INSERT INTO asset_intercept_rules(enabled, kind, pattern, note, builtin)
|
|
VALUES ($1, $2, $3, $4, false)
|
|
RETURNING `+assetInterceptRuleCols,
|
|
enabled, kind, pattern, note)
|
|
return scanAssetInterceptRule(row)
|
|
}
|
|
|
|
// UpdateAssetInterceptRule replaces the editable fields of an existing rule.
|
|
func (d *DB) UpdateAssetInterceptRule(id int64, kind, pattern, note string, enabled bool) (AssetInterceptRule, error) {
|
|
row := d.QueryRow(`
|
|
UPDATE asset_intercept_rules
|
|
SET enabled=$2, kind=$3, pattern=$4, note=$5
|
|
WHERE id=$1
|
|
RETURNING `+assetInterceptRuleCols,
|
|
id, enabled, kind, pattern, note)
|
|
return scanAssetInterceptRule(row)
|
|
}
|
|
|
|
// DeleteAssetInterceptRule removes a rule (built-in rules are deletable too).
|
|
func (d *DB) DeleteAssetInterceptRule(id int64) error {
|
|
_, err := d.Exec(`DELETE FROM asset_intercept_rules WHERE id=$1`, id)
|
|
return err
|
|
}
|
|
|
|
// ToggleAssetInterceptRule flips the enabled state of a rule.
|
|
func (d *DB) ToggleAssetInterceptRule(id int64, enabled bool) error {
|
|
_, err := d.Exec(`UPDATE asset_intercept_rules SET enabled=$2 WHERE id=$1`, id, enabled)
|
|
return err
|
|
}
|