Autumn-27
dfc9d2fa2e
新增独立于命令拦截(intercept_rules)的资产拦截功能，仅提供规则的 存储与管理；具体匹配/拦截逻辑另行实现。 - db: 新增 asset_intercept_rules 表(schema.sql，幂等)与 CRUD 层 (db/asset_intercept.go)；kind 支持全等/模糊的 域名·IP·URL 及 CIDR - db: 首启动 seed 内置模糊拦截政府(.gov/.gov.cn)与教育(.edu/.edu.cn) 网站，settings 标记位门控，可禁用/删除且重启不复活 - server: /api/asset-intercept/rules 的 list/create/update/delete/toggle； cidr、exact_ip 做格式校验 - web: 新增「资产拦截」页(/system/intercept/assets)与侧边栏入口、 api 与类型定义
78 lines
2.8 KiB
Go
78 lines
2.8 KiB
Go
package db
|
|
|
|
import "time"
|
|
|
|
// AssetInterceptRule is one row of asset_intercept_rules — a global asset
|
|
// blocklist entry. Unlike intercept_rules (which matches tool name / input),
|
|
// these match the *target asset*: an exact/fuzzy domain·ip·url, or a CIDR range.
|
|
// This layer only stores rules; the matching/enforcement logic lives elsewhere.
|
|
type AssetInterceptRule struct {
|
|
ID int64 `json:"id"`
|
|
Enabled bool `json:"enabled"`
|
|
Kind string `json:"kind"` // exact_domain|exact_ip|exact_url|fuzzy_domain|fuzzy_ip|fuzzy_url|cidr
|
|
Pattern string `json:"pattern"`
|
|
Note string `json:"note"`
|
|
Builtin bool `json:"builtin"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
const assetInterceptRuleCols = `id, enabled, kind, pattern, note, builtin, created_at, updated_at`
|
|
|
|
func scanAssetInterceptRule(row interface{ Scan(...any) error }) (AssetInterceptRule, error) {
|
|
var r AssetInterceptRule
|
|
err := row.Scan(&r.ID, &r.Enabled, &r.Kind, &r.Pattern, &r.Note, &r.Builtin, &r.CreatedAt, &r.UpdatedAt)
|
|
return r, err
|
|
}
|
|
|
|
// ListAssetInterceptRules returns all rules, built-ins first then newest first.
|
|
func (d *DB) ListAssetInterceptRules() ([]AssetInterceptRule, error) {
|
|
rows, err := d.Query(`SELECT ` + assetInterceptRuleCols + ` FROM asset_intercept_rules ORDER BY builtin DESC, id DESC`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []AssetInterceptRule
|
|
for rows.Next() {
|
|
r, err := scanAssetInterceptRule(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, r)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// CreateAssetInterceptRule inserts a new user rule (builtin is always false here).
|
|
func (d *DB) CreateAssetInterceptRule(kind, pattern, note string, enabled bool) (AssetInterceptRule, error) {
|
|
row := d.QueryRow(`
|
|
INSERT INTO asset_intercept_rules(enabled, kind, pattern, note, builtin)
|
|
VALUES ($1, $2, $3, $4, false)
|
|
RETURNING `+assetInterceptRuleCols,
|
|
enabled, kind, pattern, note)
|
|
return scanAssetInterceptRule(row)
|
|
}
|
|
|
|
// UpdateAssetInterceptRule replaces the editable fields of an existing rule.
|
|
func (d *DB) UpdateAssetInterceptRule(id int64, kind, pattern, note string, enabled bool) (AssetInterceptRule, error) {
|
|
row := d.QueryRow(`
|
|
UPDATE asset_intercept_rules
|
|
SET enabled=$2, kind=$3, pattern=$4, note=$5
|
|
WHERE id=$1
|
|
RETURNING `+assetInterceptRuleCols,
|
|
id, enabled, kind, pattern, note)
|
|
return scanAssetInterceptRule(row)
|
|
}
|
|
|
|
// DeleteAssetInterceptRule removes a rule (built-in rules are deletable too).
|
|
func (d *DB) DeleteAssetInterceptRule(id int64) error {
|
|
_, err := d.Exec(`DELETE FROM asset_intercept_rules WHERE id=$1`, id)
|
|
return err
|
|
}
|
|
|
|
// ToggleAssetInterceptRule flips the enabled state of a rule.
|
|
func (d *DB) ToggleAssetInterceptRule(id int64, enabled bool) error {
|
|
_, err := d.Exec(`UPDATE asset_intercept_rules SET enabled=$2 WHERE id=$1`, id, enabled)
|
|
return err
|
|
}
|