mirror of
https://gitcode.com/JianFeeeee/ModelRouter.git
synced 2026-11-07 09:47:23 +00:00
feat(plugins): 可见性、state 分区、注册式 HTTP 端点 + 按密钥授权
插件页面不是自动公开的数据。billing 显示跨全部源的成本，quota 显示上游余额，
而这两者都不属于持有 user 密钥的人 —— 但 /api/ui-inject 不做任何角色过滤，
所以两者都发给了任何已认证的密钥。实测（不是推断）：club 这把 user 密钥拉到了
18672 字节的 billing state，里面是 16871 次请求 / $8.8616 / 21 个源名与各自
成本。
UIPage/UIElement 加 Audience，UIExtension 加 Visibility。语法刻意很小——"" 或
"all" 放行，"admin" 只给 admin，"admin,user" 列角色。**"*" 不是 all 的同义词**：
一个在配置文件里看起来受限、实际放行一切的东西，正是会静默失效的那种设置。
覆盖走 config.yaml 的 plugin_visibility，因为插件作者不知道本部署的策略，而运维
也不该为了改一行去编辑内置 .lua（下次升级就没了）。
过滤发生在 UIForRole 而非 HTTP 层：WebUI 启动载荷、Electron 外壳、测试都读同一
处，只在 HTTP 层过滤意味着其它消费者照旧全量泄漏。
角色可见性回答不了"哪一部分"。billing 里全局数字（total、by_source、by_model、
未定价告警）是部署数据，by_key / by_day_key 描述的是**一个**调用方。于是插件用
state_scope 声明哪些桶是全局的、哪些按调用方过滤，深度由插件给出（1 = {maskedKey:
桶}，2 = {day: {maskedKey: 桶}}）——两种形状都是 map，靠嗅探分不清"空桶"和"嵌套桶"。
不匹配的行**删除而不是置零**：置零会渲染成"你没花钱"，还会泄露"别人有这一行"。
billing 因此改为 visibility="all" + state_scope，而不是 admin-only —— 后者会让
split 失去意义，而前者不加 split 正是这次要堵的泄露。
有些东西值得从浏览器**外面**查（CI 判断上游余额是否为零、监控探针、盒子上的
另一个工具）。billing 从不需要（它只收 hook），quota 需要。为每个插件硬编码一条
路由意味着每次都要改网关，而把任意插件代码塞进主 mux 也不是路由表该做的事。
插件在 plugin.http 里声明 path/method/roles/keys，挂在 /api/plugins/http/ 下。
请求与响应都是普通 table 穿过 Go/Lua 边界。两条由 Go 侧而非信任插件来保证的性质：
status 与 method 走白名单（否则插件能选一个 3xx + Location 把调用者弹到它指定的
URL），Content-Length 与逐跳头被丢弃（否则插件能让网关的响应分帧错位）。
roles 太粗：无法表达"给 homeagent 开放、其他人不开"。keys 按**密钥名**授权而非密钥
值——密钥值会被轮换，规则写死在上面会静默失配；把凭据散进插件文件也是问题；而且
运维读的是名字。
**keys 非空时它是全部规则**，不是与 roles 的并集。写成并集的话，运维写两条允许名单
就会顺带放行所有 user 密钥，正好与意图相反。admin 永远放行，否则名单里一个拼写
错误会让唯一能诊断它的人也进不去。
写入前校验密钥名真实存在：一份写着错别字名字的名单会被存下、保存、在 WebUI 里
显示为"已配置"，然后拒绝每一个调用者——失败看起来像端点坏了，而不是名字错了。
readPluginUI / readPluginExports / readPluginHTTP 都在插件**注册期间**调用
luaToJSON，而它依赖 setupGlobals 才安装的 json 全局，于是静默返回空值。三处表现各
不同（页面字段为空、exports 看不见、端点数为 0），同一个原因。现在统一走
luaTableToGoValue。
readPluginHTTP 还额外踩了 golua 的 GetField 不做字符串→数字转换，用索引循环取数组
永远拿到 nil。
去掉角色过滤 → 3 条判据红（含"a user key can see the admin-only page"）；
去掉 page 级 audience → 1 条红。routes 层断言徽标齐全、方法与 path 校验、栈帧
归属、admin 豁免、{status=204} 合法、空表报错。
生产验证：admin 看到 14 个字段 / by_key 5 行 / total $8.86；user 看到 0 行。
Co-Authored-By: ModelRouter <noreply@modelrouter.dev>
(cherry picked from commit a6c6e6e5c7)
(cherry picked from commit 5eef5ad635)
This commit is contained in:
JianFeeeee
400
internal/lua/plugin_http_handler_test.go
Normal file
400
internal/lua/plugin_http_handler_test.go
Normal file
@ -0,0 +1,400 @@
|
||||
package lua
|
||||
|
||||
// Plugin-registered HTTP endpoints.
|
||||
//
|
||||
// Three properties have to hold, and none of them is visible from the plugin's
|
||||
// own point of view:
|
||||
//
|
||||
// 1. Auth and roles are enforced by the GATEWAY. A plugin that forgets to
|
||||
// declare roles gets admin-only, not open — the failure mode of "public by
|
||||
// omission" is an internet-scannable endpoint inside the gateway process.
|
||||
// 2. A handler error is a value, never a panic. The pcall guard is the same one
|
||||
// the hooks use, for the same reason.
|
||||
// 3. The plugin cannot steer the gateway's own response framing: a nonsense
|
||||
// status becomes a 500, and Content-Length / hop-by-hop headers are dropped.
|
||||
//
|
||||
// These tests drive the declaration layer and the response writer directly; the
|
||||
// router-level dispatch is covered in the gateway package.
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
)
|
||||
|
||||
const httpPlugin = `
|
||||
local P = {}
|
||||
P.name = "api"
|
||||
P.version = "1.0.0"
|
||||
P.exports = {}
|
||||
P.http = {
|
||||
{
|
||||
path = "health",
|
||||
handler = "health",
|
||||
roles = { "admin" },
|
||||
description = "liveness",
|
||||
},
|
||||
{
|
||||
path = "echo/:what",
|
||||
method = "POST",
|
||||
handler = "echo",
|
||||
roles = { "admin", "user" },
|
||||
},
|
||||
}
|
||||
function P.health(req)
|
||||
return { status = 200, json = { ok = true, role = req.role, key = req.key } }
|
||||
end
|
||||
function P.echo(req)
|
||||
return { status = 201, json = { what = req.params.what, body = req.body } }
|
||||
end
|
||||
return P
|
||||
`
|
||||
|
||||
func TestPluginRegistersHTTPHandlers(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
if err := ps.LoadSource("api", httpPlugin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
hs := ps.HTTPHandlers()
|
||||
if len(hs) != 2 {
|
||||
t.Fatalf("expected 2 registered endpoints, got %d: %+v", len(hs), hs)
|
||||
}
|
||||
for _, h := range hs {
|
||||
if h.Plugin != "api" {
|
||||
t.Errorf("handler %q has no owner; the dispatcher could not route it", h.Path)
|
||||
}
|
||||
if h.Method == "" {
|
||||
t.Errorf("handler %q has no method; the gateway would answer 405 forever", h.Path)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandlerRoleRules(t *testing.T) {
|
||||
// A handler with no roles and no public opt-out is ADMIN-ONLY. This is the
|
||||
// decision the whole feature turns on: "I forgot to declare roles" must not
|
||||
// mean "anyone on the internet".
|
||||
open := HTTPHandler{Path: "x", Handler: "h"}
|
||||
if open.allows("user", "") {
|
||||
t.Error("an undeclared handler must default to admin-only")
|
||||
}
|
||||
if !open.allows("admin", "") {
|
||||
t.Error("an undeclared handler must still serve admin")
|
||||
}
|
||||
// The explicit opt-out is how a plugin says "this one really is public".
|
||||
pub := HTTPHandler{Path: "x", Handler: "h", Public: true}
|
||||
if !pub.allows("user", "") || !pub.allows("", "") {
|
||||
t.Error("public=true must admit any role")
|
||||
}
|
||||
// Declared roles.
|
||||
scoped := HTTPHandler{Path: "x", Roles: []string{"admin", "user"}}
|
||||
if !scoped.allows("user", "homeagent") || !scoped.allows("admin", "admin") {
|
||||
t.Error("a listed role must be admitted")
|
||||
}
|
||||
if (HTTPHandler{Path: "x", Roles: []string{"admin"}}).allows("user", "homeagent") {
|
||||
t.Error("an unlisted role must be refused")
|
||||
}
|
||||
}
|
||||
|
||||
// Naming keys is how the operator grants one collaborator access without opening
|
||||
// the endpoint to every user key. Two properties matter and neither is obvious:
|
||||
// a named key wins even when the role rule would have refused it, and the named
|
||||
// list REPLACES the role rule rather than adding to it.
|
||||
func TestHandlerKeyRules(t *testing.T) {
|
||||
h := HTTPHandler{Path: "x", Roles: []string{"admin"}, Keys: []string{"homeagent"}}
|
||||
if !h.allows("user", "homeagent") {
|
||||
t.Error("a named key must be admitted even though its role is not listed")
|
||||
}
|
||||
// The replacement semantics: listing one key must NOT also admit every user
|
||||
// key through the role rule, which is what an OR would have done.
|
||||
if h.allows("user", "club") {
|
||||
t.Error("naming keys must replace the role rule, not add to it")
|
||||
}
|
||||
if h.allows("user", "") {
|
||||
t.Error("an unnamed key must not match a named-key allowlist")
|
||||
}
|
||||
// Admin is always admitted, so a typo in the list never locks the operator
|
||||
// out of the endpoint they are trying to tighten.
|
||||
if !h.allows("admin", "admin") {
|
||||
t.Error("admin must always reach an endpoint")
|
||||
}
|
||||
// Name matching is case-insensitive; a config written by hand varies.
|
||||
if !(HTTPHandler{Path: "x", Keys: []string{"HomeAgent"}}).allows("user", "homeagent") {
|
||||
t.Error("key names should match case-insensitively")
|
||||
}
|
||||
}
|
||||
|
||||
// The stored override replaces whatever the plugin declared — this is the admin
|
||||
// editing access without touching a .lua that an upgrade would overwrite.
|
||||
func TestEndpointAccessOverrideReplacesDeclaration(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
if err := ps.LoadSource("api", httpPlugin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// health is declared admin-only; widen it to one named key.
|
||||
if err := ps.SetEndpointAccess("api", "health", "@homeagent"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var found *HTTPHandler
|
||||
for _, h := range ps.HTTPHandlers() {
|
||||
if h.Path == "health" {
|
||||
hh := h
|
||||
found = &hh
|
||||
}
|
||||
}
|
||||
if found == nil {
|
||||
t.Fatal("health endpoint disappeared after an access override")
|
||||
}
|
||||
if len(found.Roles) != 0 {
|
||||
t.Errorf("the declared roles should be replaced, got %v", found.Roles)
|
||||
}
|
||||
if len(found.Keys) != 1 || found.Keys[0] != "homeagent" {
|
||||
t.Errorf("override keys = %v, want [homeagent]", found.Keys)
|
||||
}
|
||||
if !found.allows("user", "homeagent") || found.allows("user", "club") {
|
||||
t.Error("the override is not in force")
|
||||
}
|
||||
// Clearing restores the plugin's own declaration.
|
||||
if err := ps.SetEndpointAccess("api", "health", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, h := range ps.HTTPHandlers() {
|
||||
if h.Path == "health" {
|
||||
if len(h.Keys) != 0 {
|
||||
t.Errorf("clearing the override should restore the declaration, got %v", h.Keys)
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
t.Error("health endpoint vanished")
|
||||
}
|
||||
|
||||
func TestSetEndpointAccessRejectsUnknownTarget(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
if err := ps.LoadSource("api", httpPlugin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := ps.SetEndpointAccess("api", "nope", "@homeagent"); err == nil {
|
||||
t.Error("setting access on a path the plugin does not expose must fail loudly")
|
||||
}
|
||||
if err := ps.SetEndpointAccess("nosuchplugin", "health", "@homeagent"); err == nil {
|
||||
t.Error("setting access for an unknown plugin must fail loudly")
|
||||
}
|
||||
}
|
||||
|
||||
// A stored allowlist naming a key that does not exist refuses every caller while
|
||||
// looking perfectly configured. ValidateAccessSpec exists to catch that at write
|
||||
// time instead.
|
||||
func TestValidateAccessSpec(t *testing.T) {
|
||||
SetKeyNameLookup(func() []string { return []string{"homeagent", "club"} })
|
||||
t.Cleanup(func() { SetKeyNameLookup(nil) })
|
||||
|
||||
for _, ok := range []string{"admin", "user", "public", "@homeagent",
|
||||
"admin,@homeagent,@club", " admin , @club "} {
|
||||
if err := (&Plugins{}).ValidateAccessSpec(ok); err != nil {
|
||||
t.Errorf("spec %q should be accepted: %v", ok, err)
|
||||
}
|
||||
}
|
||||
for _, bad := range []string{"@nosuchkey", "superuser", "@", "admin,@typo_key"} {
|
||||
if err := (&Plugins{}).ValidateAccessSpec(bad); err == nil {
|
||||
t.Errorf("spec %q must be refused: it is neither a role nor a configured key", bad)
|
||||
}
|
||||
}
|
||||
if err := (&Plugins{}).ValidateAccessSpec(""); err != nil {
|
||||
t.Errorf("an empty spec clears the override and must be accepted: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandlerPathValidationRejectsEscapes(t *testing.T) {
|
||||
// ":name" with empty segments around it is legal — the trims below reduce it
|
||||
// to ":name". What must be refused is an empty PARAM NAME, which cannot be
|
||||
// captured into request.params.
|
||||
for _, bad := range []string{"", " ", "a/../b", "a//b", "wild*card", "q?x", "/:/"} {
|
||||
if err := validateHandlerPath(bad); err == nil {
|
||||
t.Errorf("path %q must be rejected: it can escape the mount or make the "+
|
||||
"route table ambiguous", bad)
|
||||
}
|
||||
}
|
||||
for _, ok := range []string{"health", "a/b", "echo/:what", "v1/things/:id", "/:name/"} {
|
||||
if err := validateHandlerPath(ok); err != nil {
|
||||
t.Errorf("path %q should be accepted: %v", ok, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandlerMethodValidation(t *testing.T) {
|
||||
if m, err := normalizeHandlerMethod(""); err != nil || m != http.MethodGet {
|
||||
t.Errorf("an empty method should default to GET, got %q %v", m, err)
|
||||
}
|
||||
if _, err := normalizeHandlerMethod("TRACE"); err == nil {
|
||||
t.Error("TRACE must be refused")
|
||||
}
|
||||
if m, err := normalizeHandlerMethod("post"); err != nil || m != http.MethodPost {
|
||||
t.Errorf("method should normalise to upper case, got %q %v", m, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInvokeHandlerReturnsStructuredData(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
if err := ps.LoadSource("api", httpPlugin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
resp, err := ps.InvokeHandler("api", "health", &HandlerRequest{
|
||||
Method: http.MethodGet, Path: "health", Role: "admin", Key: "sk-test",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("invoke: %v", err)
|
||||
}
|
||||
if resp.Status != 200 {
|
||||
t.Errorf("status = %d, want 200", resp.Status)
|
||||
}
|
||||
j, ok := resp.JSON.(map[string]interface{})
|
||||
if !ok {
|
||||
t.Fatalf("json = %T, want a table (the handler's nested value must survive)", resp.JSON)
|
||||
}
|
||||
if j["ok"] != true || j["role"] != "admin" {
|
||||
t.Errorf("handler data crossed wrong: %v", j)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInvokeHandlerParamsAndBodyReachLua(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
if err := ps.LoadSource("api", httpPlugin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
resp, err := ps.InvokeHandler("api", "echo", &HandlerRequest{
|
||||
Method: http.MethodPost, Path: "echo/thing",
|
||||
Params: map[string]string{"what": "thing"},
|
||||
Body: `{"n":1}`, Role: "user",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("invoke: %v", err)
|
||||
}
|
||||
j, _ := resp.JSON.(map[string]interface{})
|
||||
if resp.Status != 201 {
|
||||
t.Errorf("status = %d, want 201 (the handler chose it)", resp.Status)
|
||||
}
|
||||
if j["what"] != "thing" {
|
||||
t.Errorf("path param did not reach the handler: %v", j)
|
||||
}
|
||||
if j["body"] != `{"n":1}` {
|
||||
t.Errorf("body did not reach the handler: %v", j)
|
||||
}
|
||||
}
|
||||
|
||||
// A handler that raises must produce an error, never a process abort — the same
|
||||
// SIGSEGV class of bug the hook guard exists for.
|
||||
func TestInvokeHandlerErrorIsValueNotPanic(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
const boom = `
|
||||
local P = {}
|
||||
P.name = "boom"
|
||||
P.version = "1.0.0"
|
||||
P.exports = {}
|
||||
P.http = { { path = "blow", handler = "blow", roles = { "admin" } } }
|
||||
function P.blow(req)
|
||||
error("handler exploded")
|
||||
end
|
||||
return P
|
||||
`
|
||||
if err := ps.LoadSource("boom", boom); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := ps.InvokeHandler("boom", "blow", &HandlerRequest{Role: "admin"}); err == nil {
|
||||
t.Fatal("a raising handler must surface as an error")
|
||||
}
|
||||
}
|
||||
|
||||
// The plugin does not get to decide how the gateway frames its response.
|
||||
func TestHandlerResponseFramingIsKernelOwned(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
in *HandlerResponse
|
||||
want int
|
||||
}{
|
||||
{"status 0 becomes 200", &HandlerResponse{Status: 0, Body: "x"}, 200},
|
||||
{"status 9999 becomes 500", &HandlerResponse{Status: 9999, Body: "x"}, 500},
|
||||
{"status -1 becomes 500", &HandlerResponse{Status: -1, Body: "x"}, 500},
|
||||
{"explicit 404 is kept", &HandlerResponse{Status: 404, Body: "x"}, 404},
|
||||
}
|
||||
for _, c := range cases {
|
||||
w := httptest.NewRecorder()
|
||||
writeHTTPHandlerResponse(w, c.in)
|
||||
if w.Code != c.want {
|
||||
t.Errorf("%s: status = %d, want %d", c.name, w.Code, c.want)
|
||||
}
|
||||
}
|
||||
|
||||
// A handler must not be able to desync the gateway's own framing.
|
||||
w := httptest.NewRecorder()
|
||||
writeHTTPHandlerResponse(w, &HandlerResponse{
|
||||
Status: 200, Body: "hello",
|
||||
Headers: map[string]string{
|
||||
"Content-Length": "99999",
|
||||
"Connection": "close",
|
||||
"Transfer-Encoding": "chunked",
|
||||
"X-Custom": "kept",
|
||||
},
|
||||
})
|
||||
if got := w.Header().Get("Content-Length"); got != "" {
|
||||
t.Errorf("a plugin set Content-Length (%s); the body length is the kernel's", got)
|
||||
}
|
||||
if got := w.Header().Get("X-Custom"); got != "kept" {
|
||||
t.Errorf("a normal header should survive, got %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
// A malformed declaration must not take the whole plugin down.
|
||||
func TestBadHTTPRouteDoesNotBreakPluginLoad(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
ps := NewPlugins(NewVM(dir), dir)
|
||||
const mixed = `
|
||||
local P = {}
|
||||
P.name = "mixed"
|
||||
P.version = "1.0.0"
|
||||
P.exports = {}
|
||||
P.state = { seen = true }
|
||||
P.ui = { page = { page_id = "m", title = "M", mount = "<div/>" } }
|
||||
P.http = {
|
||||
{ path = "../escape", handler = "h", roles = { "admin" } },
|
||||
{ path = "fine", handler = "h", roles = { "admin" } },
|
||||
}
|
||||
function P.h(req) return { status = 200, body = "ok" } end
|
||||
return P
|
||||
`
|
||||
if err := ps.LoadSource("mixed", mixed); err != nil {
|
||||
t.Fatalf("a bad route must not fail the plugin load: %v", err)
|
||||
}
|
||||
// The good route survives; the bad one is simply absent.
|
||||
hs := ps.HTTPHandlers()
|
||||
if len(hs) != 1 || hs[0].Path != "fine" {
|
||||
t.Fatalf("expected only the valid route, got %+v", hs)
|
||||
}
|
||||
// And the plugin's own page/state still work.
|
||||
if ps.State("mixed") == nil {
|
||||
t.Error("the plugin's state was lost because of a bad route")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseHandlerResponseShapes(t *testing.T) {
|
||||
if _, err := parseHandlerResponse("just a string"); err == nil {
|
||||
t.Error("a non-table return must be an error, not an empty 200")
|
||||
}
|
||||
if _, err := parseHandlerResponse(map[string]interface{}{}); err == nil {
|
||||
t.Error("an empty table should say so rather than returning a blank 200")
|
||||
}
|
||||
r, err := parseHandlerResponse(map[string]interface{}{
|
||||
"status": float64(204), "headers": map[string]interface{}{"X-A": "b"},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if r.Status != 204 || r.Headers["X-A"] != "b" {
|
||||
t.Errorf("decoded %+v", r)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user