diff --git a/admin-server/gateway.go b/admin-server/gateway.go index 99a638a..faa2b45 100644 --- a/admin-server/gateway.go +++ b/admin-server/gateway.go @@ -257,8 +257,6 @@ func writeRouteServer(b *strings.Builder, cfg *GatewayConfig, r Route) error { writeErrorPages(b, routeKind(r) == "portal") if routeKind(r) == "portal" { - // 静态门户页也要给出确定性探测结论(免认证,避免 302 到登录页) - b.WriteString(" location = /.navi-ping { auth_request off; access_log off; return 204; }\n") b.WriteString(" index index.html;\n location / { try_files $uri $uri/ /404.html; }\n}\n\n") return nil } @@ -267,19 +265,6 @@ func writeRouteServer(b *strings.Builder, cfg *GatewayConfig, r Route) error { r.Upstream = "http://127.0.0.1:3005" r.RequireLogin = false } - // 可达性探测路径:Dashy 用 no-cors 探测条目 URL,若命中统一登录的 302 跳转 - // (跳到另一个域)浏览器会直接报错,检查就永远停在"进行中"(表现为全黄)。 - // 这里给每条路由生成一个免认证的固定路径,并且**反代到真实上游**: - // 上游正常则 2xx(绿),上游挂了则 5xx(红),语义正确。 - b.WriteString(" location = /.navi-ping {\n auth_request off;\n access_log off;\n") - if routeKind(r) == "portal" { - b.WriteString(" return 204;\n }\n") - } else { - fmt.Fprintf(b, " proxy_pass %s/;\n", strings.TrimRight(strings.TrimSpace(r.Upstream), "/")) - b.WriteString(" proxy_set_header Host $host;\n") - b.WriteString(" proxy_connect_timeout 4s;\n proxy_read_timeout 4s;\n") - b.WriteString(" proxy_redirect off;\n }\n") - } if r.RequireLogin { if strings.TrimSpace(cfg.AuthURL) == "" || strings.TrimSpace(cfg.LoginURL) == "" { return fmt.Errorf("%s: 需要认证但未配置认证/登录地址", host) diff --git a/admin-server/gateway_nav.go b/admin-server/gateway_nav.go index 3805290..9a7cbbb 100644 --- a/admin-server/gateway_nav.go +++ b/admin-server/gateway_nav.go @@ -104,9 +104,7 @@ func syncGatewayNavigation(gw *GatewayConfig) error { if icon == "" { icon = "fas fa-globe" } - statusOn := true item := NavItem{ - StatusCheck: &statusOn, Title: strings.TrimSpace(r.NavName), Description: strings.TrimSpace(r.NavDescription), Icon: icon, @@ -115,9 +113,6 @@ func syncGatewayNavigation(gw *GatewayConfig) error { gatewayManagedKey: true, gatewayHostKey: strings.ToLower(strings.TrimSpace(r.Host)), gatewayAutoIconKey: r.NavAutoIcon, - // 可达性检查指向网关生成的免认证路径:避免命中登录 302 导致 - // no-cors 探测报错、状态永远"进行中"(用户反馈的"全黄")。 - "statusCheckUrl": "https://" + strings.TrimSpace(r.Host) + "/.navi-ping", }, } dashy.Sections[idx].Items = append(dashy.Sections[idx].Items, item) diff --git a/admin-server/gateway_test.go b/admin-server/gateway_test.go index 60de65d..bda8d70 100644 --- a/admin-server/gateway_test.go +++ b/admin-server/gateway_test.go @@ -358,29 +358,3 @@ func TestRenderGatewayConfErrorPagesSkipAuth(t *testing.T) { } } } - -// 每条路由都要有免认证探测路径,且必须反代到真实上游(否则无法反映服务健康)。 -func TestRenderGatewayConfPingPath(t *testing.T) { - out, err := RenderGatewayConf(&GatewayConfig{ListenPort: 8081, AuthURL: "http://x/_auth", - LoginURL: "https://l/login", - Routes: []Route{ - {Host: "a.com", Upstream: "http://10.0.0.1:3000", RequireLogin: true}, - {Host: "p.com", Kind: "portal"}, - }}) - if err != nil { - t.Fatalf("渲染失败: %v", err) - } - if !contains(out, "location = /.navi-ping {") { - t.Fatalf("缺少探测路径:\n%s", out) - } - if !contains(out, "auth_request off;") { - t.Fatalf("探测路径必须免认证") - } - // 普通路由的探测要打在真实上游上(挂了要能红) - if !contains(out, "proxy_pass http://10.0.0.1:3000/;") { - t.Fatalf("探测未反代到上游:\n%s", out) - } - if !contains(out, "return 204;") { - t.Fatalf("portal 类型应直接 204") - } -}