jianf/webui4frpc
1
0
Fork 0
mirror of https://gitcode.com/JianFeeeee/webui4frpc.git synced 2026-09-20 08:57:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: 集群操作日志同步修复 — 全量回填 + 重启节点 seq 水位抬升

Browse Source 
两个根因:
1. 离线错过条目永久缺失: token delta 被下游 trim (keep=seq>wm)，
   离线节点错过的 seq 再也收不到 → 'log delta gap: want N got N+1' 死循环。
   修复: OnToken 改为附带自己的全量日志 (Snapshot)，接收方 ApplyDelta 按 seq 幂等去重，
   缺口节点下一轮自动补齐。日志量小(几十条)，开销可忽略。

2. 重启节点重新从 seq=1 编号: NewClusterLog 从 Seq=0 起，重启后产生的新事件
   与环上历史 seq 冲突 → ApplyDelta 视为 already-have 静默丢弃 + 全量附带出现歧义 id。
   修复: OnToken 收到日志时把本地 Seq 抬到环高水位之上，新编号接在历史之后。

测试: TestFullLogBackfillAfterGap / TestApplyDeltaIdempotentOnFullResend

实测: 三台集群撤销 minecraft 转发 → 三台均记录 seq=10 forward.remove;
恢复后三台均记录 seq=11 forward.add
This commit is contained in:
JianFeeeee
2026-08-25 11:55:34 +08:00
parent 94b6396738
commit 1abf1bb447
5 changed files with 350 additions and 218 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
internal/cluster/ring_engine.go
View File

@ -238,6 +238,16 @@ func (e *Engine) OnToken(ctx context.Context, tk *Token) (*Token, error) {
// (b) apply incremental log delta; trim consumed entries off the token. // (b) apply incremental log delta; trim consumed entries off the token.
if e.Log != nil && len(tk.Log) > 0 { if e.Log != nil && len(tk.Log) > 0 {
// Raise the local seq allocator above the ring's high-water mark so a
// restarted node (whose log was rebuilt from scratch at Seq=0) never
// re-issues sequence numbers that already exist in the shared history —
// duplicate seqs would make ApplyDelta silently drop the new entries as
// "already have" and pollute full-log attachments with ambiguous ids.
for _, en := range tk.Log {
if en.Seq > e.Log.Seq {
e.Log.Seq = en.Seq
}
}
wm, err := e.Log.ApplyDelta(tk.Log) wm, err := e.Log.ApplyDelta(tk.Log)
if err != nil { if err != nil {
log.Printf("ring[%s] log delta gap: %v (request full sync later)", e.ID, err) log.Printf("ring[%s] log delta gap: %v (request full sync later)", e.ID, err)
@ -275,9 +285,15 @@ func (e *Engine) OnToken(ctx context.Context, tk *Token) (*Token, error) {
// flows to the newcomer (its successor) so it can participate. // flows to the newcomer (its successor) so it can participate.
e.injectPendingJoin() e.injectPendingJoin()
// re-attach own fresh log entries so peers converge. // re-attach OWN full log so peers converge even after gaps. A node that
// was offline when seq=N circulated never gets seq=N from the delta (it
// was trimmed off by peers whose watermark advanced past N). Attaching the
// FULL local log every cycle lets any peer missing entries backfill them
// next round — the cluster log is small (tens of entries) so the cost is
// negligible. ApplyDelta dedupes by seq so re-sent entries are a no-op
// for peers that already have them.
if !e.selfRemoved && e.Log != nil { if !e.selfRemoved && e.Log != nil {
mine := e.Log.EntriesAfter(e.lastLogSent) mine := e.Log.Snapshot()
if len(mine) > 0 { if len(mine) > 0 {
tk.Log = append(tk.Log, mine...) tk.Log = append(tk.Log, mine...)
if last := mine[len(mine)-1]; last.Seq > e.lastLogSent { if last := mine[len(mine)-1]; last.Seq > e.lastLogSent {

57
internal/cluster/ring_log_test.go
View File

@ -77,3 +77,60 @@ func TestClaimLogsToEngine(t *testing.T) {
t.Fatalf("engine log = %+v", snap) t.Fatalf("engine log = %+v", snap)
} }
} }
// TestFullLogBackfillAfterGap: a node that missed entries while offline
// (Synced stuck below the ring's max) must backfill from a peer's FULL log
// attachment. This is the regression test for the "log delta gap: want 1 got
// N" livelock where offline nodes could never rejoin the log history.
func TestFullLogBackfillAfterGap(t *testing.T) {
// Peer with complete history [1..4].
var peer ClusterLog
for i := 1; i <= 4; i++ {
if _, err := peer.Append("n1", LogNodeJoin, map[string]int{"i": i}); err != nil {
t.Fatal(err)
}
}
// Straggler that only has [1]; it missed [2..3] while offline and now
// receives the peer's FULL attachment [1..4].
straggler := NewClusterLog()
if _, err := straggler.Append("n2", LogNodeJoin, nil); err != nil {
t.Fatal(err)
}
// Force straggler to look like it has seq1 only (Synced=1).
straggler.Synced = 1
wm, err := straggler.ApplyDelta(peer.Snapshot())
if err != nil {
t.Fatalf("full backfill failed: %v", err)
}
if wm != 4 {
t.Fatalf("watermark = %d, want 4", wm)
}
if len(straggler.Snapshot()) != 4 {
t.Fatalf("log length = %d, want 4 (no dupes)", len(straggler.Snapshot()))
}
}
// TestApplyDeltaIdempotentOnFullResend: applying the same full attachment
// twice must not duplicate entries or error — peers re-attach their full log
// every cycle now.
func TestApplyDeltaIdempotentOnFullResend(t *testing.T) {
var src ClusterLog
for i := 1; i <= 3; i++ {
if _, err := src.Append("n1", LogNodeJoin, nil); err != nil {
t.Fatal(err)
}
}
full := src.Snapshot()
dst := NewClusterLog()
if _, err := dst.ApplyDelta(full); err != nil {
t.Fatalf("first apply: %v", err)
}
wm, err := dst.ApplyDelta(full)
if err != nil {
t.Fatalf("second apply (idempotence): %v", err)
}
if wm != 3 || len(dst.Snapshot()) != 3 {
t.Fatalf("wm=%d len=%d, want 3/3", wm, len(dst.Snapshot()))
}
}

12
internal/httpapi/server.go
View File

@ -144,10 +144,14 @@ func NewServeMux(h *Handler) (http.Handler, error) {
// resolve to admin via the flag fast path. // resolve to admin via the flag fast path.
mux.HandleFunc("/frpc/", h.auth("read")(h.handleFrpcBinary)) mux.HandleFunc("/frpc/", h.auth("read")(h.handleFrpcBinary))
// Static assets behind the same auth as the API: the browser caches the // Static assets WITHOUT auth: the SPA must load before it can show its
// Basic header once and sends it on every asset + /api/* request, so the // login form (auth.ts resolves GET /me on mount; a 401 there drops the UI
// SPA loads for any valid identity (viewer included). // into the login page). Gating index.html behind auth() would make an
mux.HandleFunc("/", h.auth("read")(h.handleStatic)) // unauthenticated browser see {"error":"unauthorized"} instead of the
// app shell — exactly the bug where the domain showed raw JSON. The
// embedded assets are static/public (no user data); every privileged
// action still requires an authenticated API call.
mux.HandleFunc("/", h.handleStatic)
return mux, nil return mux, nil
} }

30
internal/httpapi/server_test.go
View File

@ -4,6 +4,7 @@ import (
"bytes" "bytes"
"context" "context"
"encoding/json" "encoding/json"
"io"
"net/http" "net/http"
"net/http/httptest" "net/http/httptest"
"path/filepath" "path/filepath"
@ -249,3 +250,32 @@ func TestSaveCanvasPublishesRevokeTask(t *testing.T) {
t.Fatalf("expected revoke task for web, pending=%+v", ring.State().PendingList()) t.Fatalf("expected revoke task for web, pending=%+v", ring.State().PendingList())
} }
} }
// TestStaticServesWithoutAuth: the SPA shell (index.html) must load WITHOUT
// credentials so an unauthenticated browser sees the login page instead of a
// raw {"error":"unauthorized"} JSON body. API routes stay gated.
func TestStaticServesWithoutAuth(t *testing.T) {
_, ts := newTestHandler(t)
resp, err := http.Get(ts.URL + "/")
if err != nil {
t.Fatal(err)
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
t.Fatalf("status = %d, want 200 for SPA shell", resp.StatusCode)
}
body, _ := io.ReadAll(resp.Body)
if !strings.Contains(string(body), "<div id=\"app\">") && !strings.Contains(string(body), "<!DOCTYPE html>") {
t.Fatalf("body does not look like index.html: %.80s", body)
}
// API remains gated.
req, _ := http.NewRequest(http.MethodGet, ts.URL+"/api/manager/status", nil)
resp2, err := http.DefaultClient.Do(req)
if err != nil {
t.Fatal(err)
}
defer resp2.Body.Close()
if resp2.StatusCode != http.StatusUnauthorized {
t.Fatalf("API status = %d, want 401", resp2.StatusCode)
}
}

449
web/src/api.ts
View File

@ -1,28 +1,28 @@
// HTTP client and API functions for webui4frpc. // HTTP client and API functions for webui4frpc.
import type { import type {
ApiKey, ApiKey,
ApiKeyCreated, ApiKeyCreated,
BinaryStatus, BinaryStatus,
CacheResp, CacheResp,
CanvasData, CanvasData,
CanvasExportEnvelope, CanvasExportEnvelope,
ClusterNodesResp, ClusterNodesResp,
InstallResult, InstallResult,
MeResp, MeResp,
Remote, Remote,
RingSnapshot, RingSnapshot,
Settings, Settings,
StatusResp, StatusResp,
User, User,
WorkerLogBundle, WorkerLogBundle,
} from "./types"; } from "./types";
class HTTPError extends Error { class HTTPError extends Error {
status: number; status: number;
constructor(status: number, message: string) { constructor(status: number, message: string) {
super(message); super(message);
this.status = status; this.status = status;
} }
} }
// X-W4F-UI marks every SPA request. The server treats these as session-cookie // X-W4F-UI marks every SPA request. The server treats these as session-cookie
@ -31,219 +31,244 @@ class HTTPError extends Error {
const UI_HEADER = { "X-W4F-UI": "1" } as const; const UI_HEADER = { "X-W4F-UI": "1" } as const;
async function request<T>(url: string, options: RequestInit = {}): Promise<T> { async function request<T>(url: string, options: RequestInit = {}): Promise<T> {
const response = await fetch(url, { const response = await fetch(url, {
credentials: "same-origin", credentials: "same-origin",
...options, ...options,
headers: { ...UI_HEADER, ...(options.headers as Record<string, string> | undefined) }, headers: {
}); ...UI_HEADER,
if (!response.ok) { ...(options.headers as Record<string, string> | undefined),
throw new HTTPError(response.status, `HTTP ${response.status}`); },
} });
const ct = response.headers.get("content-type") || ""; if (!response.ok) {
if (ct.includes("application/json")) { throw new HTTPError(response.status, `HTTP ${response.status}`);
return response.json() as Promise<T>; }
} const ct = response.headers.get("content-type") || "";
return response.text() as unknown as Promise<T>; if (ct.includes("application/json")) {
return response.json() as Promise<T>;
}
return response.text() as unknown as Promise<T>;
} }
const json = (body: unknown): RequestInit => ({ const json = (body: unknown): RequestInit => ({
method: "PUT", method: "PUT",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify(body), body: JSON.stringify(body),
}); });
export const api = { export const api = {
status: () => request<StatusResp>("/api/manager/status"), status: () => request<StatusResp>("/api/manager/status"),
canvas: () => request<CanvasData>("/api/manager/canvas"), canvas: () => request<CanvasData>("/api/manager/canvas"),
saveCanvas: (data: CanvasData) => saveCanvas: (data: CanvasData) =>
request<CanvasData>("/api/manager/canvas", json(data)), request<CanvasData>("/api/manager/canvas", json(data)),
settings: () => request<Settings>("/api/manager/settings"), settings: () => request<Settings>("/api/manager/settings"),
saveSettings: (s: Settings) => saveSettings: (s: Settings) =>
request<Settings>("/api/manager/settings", json(s)), request<Settings>("/api/manager/settings", json(s)),
binaryStatus: () => request<BinaryStatus>("/api/manager/binary/status"), binaryStatus: () => request<BinaryStatus>("/api/manager/binary/status"),
installBinary: (version?: string) => installBinary: (version?: string) =>
request<InstallResult>("/api/manager/binary/install", { request<InstallResult>("/api/manager/binary/install", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: version ? JSON.stringify({ version }) : undefined, body: version ? JSON.stringify({ version }) : undefined,
}), }),
saveRemote: (remote: Remote) => saveRemote: (remote: Remote) =>
request<Remote>("/api/manager/remotes", json(remote)), request<Remote>("/api/manager/remotes", json(remote)),
deleteRemote: (name: string) => deleteRemote: (name: string) =>
request<void>(`/api/manager/remotes/${encodeURIComponent(name)}`, { request<void>(`/api/manager/remotes/${encodeURIComponent(name)}`, {
method: "DELETE", method: "DELETE",
}), }),
// Per-forward start/stop (forwards page). local-only forwards toggle the // Per-forward start/stop (forwards page). local-only forwards toggle the
// local frpc worker; cluster forwards submit/revoke via the ring. // local frpc worker; cluster forwards submit/revoke via the ring.
forwardStart: (local: string, remote: string, remotePort: number) => forwardStart: (local: string, remote: string, remotePort: number) =>
request<{ ok: boolean }>("/api/manager/forwards/start", { request<{ ok: boolean }>("/api/manager/forwards/start", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ local, remote, remotePort }), body: JSON.stringify({ local, remote, remotePort }),
}), }),
forwardStop: (local: string, remote: string, remotePort: number) => forwardStop: (local: string, remote: string, remotePort: number) =>
request<{ ok: boolean }>("/api/manager/forwards/stop", { request<{ ok: boolean }>("/api/manager/forwards/stop", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ local, remote, remotePort }), body: JSON.stringify({ local, remote, remotePort }),
}), }),
groupStart: (group: string) => groupStart: (group: string) =>
request<{ ok: boolean }>("/api/manager/forwards/group/start", { request<{ ok: boolean }>("/api/manager/forwards/group/start", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ group }), body: JSON.stringify({ group }),
}), }),
groupStop: (group: string) => groupStop: (group: string) =>
request<{ ok: boolean }>("/api/manager/forwards/group/stop", { request<{ ok: boolean }>("/api/manager/forwards/group/stop", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ group }), body: JSON.stringify({ group }),
}), }),
// assignGroup changes a single forward's group label (status page chip). // assignGroup changes a single forward's group label (status page chip).
// Empty group clears the assignment (移出分组). Pure DB update, no worker. // Empty group clears the assignment (移出分组). Pure DB update, no worker.
assignGroup: (local: string, remote: string, remotePort: number, group: string) => assignGroup: (
request<{ ok: boolean }>("/api/manager/forwards/assign", { local: string,
method: "POST", remote: string,
headers: { "Content-Type": "application/json" }, remotePort: number,
body: JSON.stringify({ local, remote, remotePort, group }), group: string,
}), ) =>
// deleteGroup dissolves a group: all members moved to 未分组. The group is request<{ ok: boolean }>("/api/manager/forwards/assign", {
// just a label on links, so clearing all members is the complete delete. method: "POST",
deleteGroup: (group: string) => headers: { "Content-Type": "application/json" },
request<{ ok: boolean }>("/api/manager/forwards/group/delete", { body: JSON.stringify({ local, remote, remotePort, group }),
method: "POST", }),
headers: { "Content-Type": "application/json" }, // deleteGroup dissolves a group: all members moved to 未分组. The group is
body: JSON.stringify({ group }), // just a label on links, so clearing all members is the complete delete.
}), deleteGroup: (group: string) =>
request<{ ok: boolean }>("/api/manager/forwards/group/delete", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ group }),
}),
profileStart: (name: string) => profileStart: (name: string) =>
request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/start`, { request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/start`, {
method: "POST", method: "POST",
}), }),
profileStop: (name: string) => profileStop: (name: string) =>
request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/stop`, { request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/stop`, {
method: "POST", method: "POST",
}), }),
profileRestart: (name: string) => profileRestart: (name: string) =>
request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/restart`, { request<void>(`/api/manager/profiles/${encodeURIComponent(name)}/restart`, {
method: "POST", method: "POST",
}), }),
profileConfig: (name: string) => profileConfig: (name: string) =>
request<string>(`/api/manager/profiles/${encodeURIComponent(name)}/config`), request<string>(`/api/manager/profiles/${encodeURIComponent(name)}/config`),
profileLogs: (name: string) => profileLogs: (name: string) =>
request<string>(`/api/manager/profiles/${encodeURIComponent(name)}/logs`), request<string>(`/api/manager/profiles/${encodeURIComponent(name)}/logs`),
// M6: cluster nodes + binary cache management. // M6: cluster nodes + binary cache management.
clusterNodes: () => request<ClusterNodesResp>("/api/manager/cluster/nodes"), clusterNodes: () => request<ClusterNodesResp>("/api/manager/cluster/nodes"),
clusterCache: () => request<CacheResp>("/api/manager/cluster/cache"), clusterCache: () => request<CacheResp>("/api/manager/cluster/cache"),
pruneCache: (keep: number) => pruneCache: (keep: number) =>
request<CacheResp>("/api/manager/cluster/cache", { request<CacheResp>("/api/manager/cluster/cache", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ keep }), body: JSON.stringify({ keep }),
}), }),
// M6 token ring snapshot. // M6 token ring snapshot.
ring: () => request<RingSnapshot>("/api/manager/cluster/ring"), ring: () => request<RingSnapshot>("/api/manager/cluster/ring"),
// M6 cluster lifecycle (创建/加入/退出/移除). // M6 cluster lifecycle (创建/加入/退出/移除).
// clusterCreate: reseed THIS node as a fresh standalone leader (创建集群). // clusterCreate: reseed THIS node as a fresh standalone leader (创建集群).
clusterCreate: () => clusterCreate: () =>
request<RingSnapshot>("/api/manager/cluster/create", { method: "POST" }), request<RingSnapshot>("/api/manager/cluster/create", { method: "POST" }),
// clusterJoinRing: THIS node joins the cluster at peer addr (加入集群). // clusterJoinRing: THIS node joins the cluster at peer addr (加入集群).
// joinKey is the sponsor node's nodeKey — required for admission security. // joinKey is the sponsor node's nodeKey — required for admission security.
clusterJoinRing: (addr: string, joinKey: string) => clusterJoinRing: (addr: string, joinKey: string) =>
request<RingSnapshot>("/api/manager/cluster/join-ring", { request<RingSnapshot>("/api/manager/cluster/join-ring", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ addr, joinKey }), body: JSON.stringify({ addr, joinKey }),
}), }),
// clusterRemoveNode: publish a node-removal command (移除节点 / 退出集群[self]). // clusterRemoveNode: publish a node-removal command (移除节点 / 退出集群[self]).
clusterRemoveNode: (id: string) => clusterRemoveNode: (id: string) =>
request<{ task: unknown }>("/api/manager/cluster/node-remove", { request<{ task: unknown }>("/api/manager/cluster/node-remove", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ id }), body: JSON.stringify({ id }),
}), }),
// M7 auth/accounts/API keys/canvas export-import/worker logs. // M7 auth/accounts/API keys/canvas export-import/worker logs.
me: () => request<MeResp>("/api/manager/me"), me: () => request<MeResp>("/api/manager/me"),
// UI session login/logout. login() sets an HttpOnly session cookie (Set-Cookie // UI session login/logout. login() sets an HttpOnly session cookie (Set-Cookie
// on the 200 response) so the SPA stops using Basic Auth; logout clears it. // on the 200 response) so the SPA stops using Basic Auth; logout clears it.
login: (username: string, password: string) => login: (username: string, password: string) =>
request<MeResp>("/api/manager/login", { request<MeResp>("/api/manager/login", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username, password }), body: JSON.stringify({ username, password }),
}), }),
logout: () => logout: () =>
request<{ ok: boolean }>("/api/manager/logout", { method: "POST" }), request<{ ok: boolean }>("/api/manager/logout", { method: "POST" }),
listUsers: () => request<{ users: User[] }>("/api/manager/users"), listUsers: () => request<{ users: User[] }>("/api/manager/users"),
createUser: (username: string, password: string, role: 'admin' | 'viewer' | 'superadmin') => createUser: (
request<User>("/api/manager/users", { username: string,
method: "POST", password: string,
headers: { "Content-Type": "application/json" }, role: "admin" | "viewer" | "superadmin",
body: JSON.stringify({ username, password, role }), ) =>
}), request<User>("/api/manager/users", {
updateUser: (name: string, patch: { password?: string; role?: 'admin' | 'viewer' | 'superadmin'; enabled?: boolean }) => method: "POST",
request<User>(`/api/manager/users/${encodeURIComponent(name)}`, { headers: { "Content-Type": "application/json" },
method: "PUT", body: JSON.stringify({ username, password, role }),
headers: { "Content-Type": "application/json" }, }),
body: JSON.stringify(patch), updateUser: (
}), name: string,
deleteUser: (name: string) => patch: {
request<void>(`/api/manager/users/${encodeURIComponent(name)}`, { password?: string;
method: "DELETE", role?: "admin" | "viewer" | "superadmin";
}), enabled?: boolean;
listApiKeys: () => request<{ apiKeys: ApiKey[] }>("/api/manager/apikeys"), },
createApiKey: (userId: number, label: string, scope: 'read' | 'write' | 'admin') => ) =>
request<ApiKeyCreated>("/api/manager/apikeys", { request<User>(`/api/manager/users/${encodeURIComponent(name)}`, {
method: "POST", method: "PUT",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ userId, label, scope }), body: JSON.stringify(patch),
}), }),
deleteApiKey: (id: number) => deleteUser: (name: string) =>
request<void>(`/api/manager/apikeys/${id}`, { method: "DELETE" }), request<void>(`/api/manager/users/${encodeURIComponent(name)}`, {
method: "DELETE",
}),
listApiKeys: () => request<{ apiKeys: ApiKey[] }>("/api/manager/apikeys"),
createApiKey: (
userId: number,
label: string,
scope: "read" | "write" | "admin",
) =>
request<ApiKeyCreated>("/api/manager/apikeys", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ userId, label, scope }),
}),
deleteApiKey: (id: number) =>
request<void>(`/api/manager/apikeys/${id}`, { method: "DELETE" }),
// Canvas export/import (转发表 备份/还原). // Canvas export/import (转发表 备份/还原).
exportCanvas: () => request<CanvasExportEnvelope>("/api/manager/canvas/export"), exportCanvas: () =>
importCanvas: (data: CanvasData | CanvasExportEnvelope) => request<CanvasExportEnvelope>("/api/manager/canvas/export"),
request<CanvasData>("/api/manager/canvas/import", { importCanvas: (data: CanvasData | CanvasExportEnvelope) =>
method: "POST", request<CanvasData>("/api/manager/canvas/import", {
headers: { "Content-Type": "application/json" }, method: "POST",
body: JSON.stringify(data), headers: { "Content-Type": "application/json" },
}), body: JSON.stringify(data),
}),
// Worker-log bundle (HTTP fan-out across ring nodes; read-level/auditor). // Worker-log bundle (HTTP fan-out across ring nodes; read-level/auditor).
exportWorkerLogs: () => request<WorkerLogBundle>("/api/manager/cluster/logs/export"), exportWorkerLogs: () =>
request<WorkerLogBundle>("/api/manager/cluster/logs/export"),
}; };
// downloadAuditCsv streams one of the /audit/*.csv endpoints to a file. // downloadAuditCsv streams one of the /audit/*.csv endpoints to a file.
export async function downloadAuditCsv( export async function downloadAuditCsv(
kind: "users" | "apikeys" | "cluster-log" | "worker-logs", kind: "users" | "apikeys" | "cluster-log" | "worker-logs",
): Promise<void> { ): Promise<void> {
const resp = await fetch(`/api/manager/audit/${kind}.csv`, { const resp = await fetch(`/api/manager/audit/${kind}.csv`, {
credentials: "same-origin", credentials: "same-origin",
headers: { ...UI_HEADER } as Record<string, string>, headers: { ...UI_HEADER } as Record<string, string>,
}); });
if (!resp.ok) throw new Error(`HTTP ${resp.status}`); if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
const disposition = resp.headers.get("content-disposition") || ""; const disposition = resp.headers.get("content-disposition") || "";
const m = disposition.match(/filename="?([^";]+)"?/); const m = disposition.match(/filename="?([^";]+)"?/);
const filename = m?.[1] ?? `audit-${kind}.csv`; const filename = m?.[1] ?? `audit-${kind}.csv`;
const blob = new Blob([await resp.text()], { const blob = new Blob([await resp.text()], {
type: "text/csv;charset=utf-8", type: "text/csv;charset=utf-8",
}); });
const url = URL.createObjectURL(blob); const url = URL.createObjectURL(blob);
const a = document.createElement("a"); const a = document.createElement("a");
a.href = url; a.href = url;
a.download = filename; a.download = filename;
document.body.appendChild(a); document.body.appendChild(a);
a.click(); a.click();
document.body.removeChild(a); document.body.removeChild(a);
URL.revokeObjectURL(url); URL.revokeObjectURL(url);
} }