94 lines
8.6 KiB
C#
94 lines
8.6 KiB
C#
using System.Text.Json;
|
|
using System.Text.Json.Nodes;
|
|
using IM.Admin.Api;
|
|
using IM.Admin.Data;
|
|
using IM.InitCommon.Management;
|
|
using MailKit.Security;
|
|
using MimeKit;
|
|
using Microsoft.EntityFrameworkCore;
|
|
|
|
namespace IM.Admin.Services;
|
|
public sealed class InfrastructureService(AdminDb db, SettingsService settings, InternalClient client, IConfiguration config, IHostEnvironment environment)
|
|
{
|
|
public async Task Draft(string id, SettingInput input, HttpContext c)
|
|
{
|
|
ApiSupport.Reason(input.Reason); Validate(id, input.Value);
|
|
var row = await db.Settings.SingleOrDefaultAsync(x => x.Id == id);
|
|
if ((row?.Version ?? 0) != input.Version) throw new ApiError(409, "配置版本已变化，请刷新");
|
|
if (row is null) { row = new SystemSetting { Id = id }; db.Settings.Add(row); }
|
|
row.Draft = input.Value.ToJsonString(); row.TestedVersion = null; row.Version++; row.UpdatedAt = DateTime.UtcNow;
|
|
var prior = settings.Unprotect(row.DraftSecret ?? row.Secret);
|
|
var secret = string.IsNullOrWhiteSpace(input.Secret) ? prior : id == "storage" ? MergeSecrets(prior, input.Secret) : input.Secret;
|
|
row.DraftSecret = settings.Protect(secret);
|
|
db.Audit(c, "保存基础设施草稿", id, "", "草稿已更新；凭据" + (string.IsNullOrEmpty(input.Secret) ? "保持" : "已更换"), input.Reason); await db.SaveChangesAsync();
|
|
}
|
|
static string MergeSecrets(string previous, string next)
|
|
{
|
|
var old = JsonNode.Parse(string.IsNullOrEmpty(previous) ? "{}" : previous)!.AsObject(); var update = JsonNode.Parse(next)!.AsObject();
|
|
foreach (var p in update) { var entry = old[p.Key]?.AsObject() ?? new JsonObject(); foreach (var value in p.Value!.AsObject()) if (!string.IsNullOrWhiteSpace(value.Value?.GetValue<string>())) entry[value.Key] = value.Value!.DeepClone(); old[p.Key] = entry.DeepClone(); }
|
|
return old.ToJsonString();
|
|
}
|
|
public async Task Test(string id, InfraTest input, HttpContext c)
|
|
{
|
|
var row = await Row(id, input.Version); var value = JsonNode.Parse(row.Draft!)!.AsObject();
|
|
Validate(id, value);
|
|
if (id == "smtp") {
|
|
using var smtp = await Connect(value, settings.Unprotect(row.DraftSecret));
|
|
if (!System.Net.Mail.MailAddress.TryCreate(input.Recipient, out _)) throw new ApiError(400, "请填写有效测试收件人");
|
|
await SendMessage(smtp, value, input.Recipient!, "IM SMTP 连接测试", "这是一封由后台管理员主动发起的连接测试邮件。");
|
|
} else await client.Send<JsonElement>("file", "/internal/management/storage/test", new InfrastructureEnvelope(row.Version, value, settings.Unprotect(row.DraftSecret)));
|
|
row.TestedVersion = row.Version; db.Audit(c, "测试基础设施连接", id, "", "测试成功", "管理员主动执行连通性测试"); await db.SaveChangesAsync();
|
|
}
|
|
public async Task Activate(string id, SettingInput input, HttpContext c)
|
|
{
|
|
ApiSupport.Reason(input.Reason); var row = await Row(id, input.Version);
|
|
if (row.TestedVersion != row.Version) throw new ApiError(409, "请先测试当前草稿的连接");
|
|
if (id == "storage") await client.Send<JsonElement>("file", "/internal/management/storage/validate", new InfrastructureEnvelope(row.Version, JsonNode.Parse(row.Draft!)!.AsObject(), settings.Unprotect(row.DraftSecret)));
|
|
var before = row.Value; row.Value = row.Draft!; row.Secret = row.DraftSecret!; row.Draft = null; row.DraftSecret = null; row.Version++; row.UpdatedAt = DateTime.UtcNow;
|
|
db.Audit(c, "启用基础设施配置", id, before, row.Value, input.Reason); await db.SaveChangesAsync();
|
|
}
|
|
async Task<SystemSetting> Row(string id, long version)
|
|
{
|
|
if (id is not "smtp" and not "storage") throw new ApiError(404, "分组不存在");
|
|
var row = await db.Settings.SingleOrDefaultAsync(x => x.Id == id) ?? throw new ApiError(404, "请先保存草稿");
|
|
if (row.Draft is null || row.Version != version) throw new ApiError(409, "草稿不存在或版本已变化"); return row;
|
|
}
|
|
void Validate(string id, JsonObject value)
|
|
{
|
|
if (id == "smtp") {
|
|
var allowed = new[] { "host", "port", "username", "from", "tls", "enabled" };
|
|
if (value.Any(x => !allowed.Contains(x.Key))) throw new ApiError(400, "不支持的邮件字段");
|
|
ValidateHost(value["host"]?.GetValue<string>() ?? "", config);
|
|
if (value["port"]?.GetValue<int>() is not (>= 1 and <= 65535) || value["tls"]?.GetValue<string>() is not ("starttls" or "ssl") || !System.Net.Mail.MailAddress.TryCreate(value["from"]?.GetValue<string>(), out _)) throw new ApiError(400, "邮件端口、TLS 或发件人无效");
|
|
} else if (id == "storage") {
|
|
if (value["providers"] is not JsonObject providers || providers.Count == 0 || value["defaultProviderCode"] is null || !providers.ContainsKey(value["defaultProviderCode"]!.GetValue<string>())) throw new ApiError(400, "请配置有效的默认存储提供商");
|
|
var allowed = new[] { "providerCode", "providerType", "enabled", "bucket", "publicBucket", "region", "endpoint", "publicBaseUrl", "localRootPath", "localUploadApiBaseUrl", "uploadUrlExpiresIn", "downloadUrlExpiresIn", "maxObjectSizeBytes", "minPartSizeBytes", "defaultPartSizeBytes", "maxPartCount" };
|
|
if (value.Any(x => x.Key != "providers" && x.Key != "defaultProviderCode")) throw new ApiError(400, "未知存储字段");
|
|
foreach (var (code, node) in providers) {
|
|
var p = node!.AsObject(); if (p.Any(x => !allowed.Contains(x.Key)) || p["providerCode"]?.GetValue<string>() != code) throw new ApiError(400, "存储字段不正确，凭据需独立提交");
|
|
var type = p["providerType"]?.GetValue<int>(); if (type is not 1 and not 2 and not 5) throw new ApiError(400, "仅支持本地或 S3 兼容存储");
|
|
if (type != 1) { if (!Uri.TryCreate(p["endpoint"]?.GetValue<string>(), UriKind.Absolute, out var uri) || uri.Scheme is not ("https" or "http") || !string.IsNullOrEmpty(uri.UserInfo)) throw new ApiError(400, "存储端点无效"); ValidateHost(uri.Host, config); }
|
|
}
|
|
} else throw new ApiError(404, "分组不存在");
|
|
}
|
|
public static void ValidateHost(string host, IConfiguration config)
|
|
{
|
|
var allowed = config.GetSection("Management:AllowedInfrastructureHosts").Get<string[]>() ?? [];
|
|
if (string.IsNullOrWhiteSpace(host) || !allowed.Contains(host, StringComparer.OrdinalIgnoreCase)) throw new ApiError(400, "该目标不在部署允许列表中");
|
|
}
|
|
async Task<MailKit.Net.Smtp.SmtpClient> Connect(JsonObject value, string secret)
|
|
{
|
|
Validate("smtp", value); var smtp = new MailKit.Net.Smtp.SmtpClient { Timeout = 10000 };
|
|
if (environment.IsDevelopment() && config["Management:DevelopmentSmtpCertificateSha256"] is { Length: > 0 } pin)
|
|
smtp.ServerCertificateValidationCallback = (_, certificate, _, errors) => errors == System.Net.Security.SslPolicyErrors.None || certificate is not null && string.Equals(certificate.GetCertHashString(System.Security.Cryptography.HashAlgorithmName.SHA256), pin, StringComparison.OrdinalIgnoreCase);
|
|
try { await smtp.ConnectAsync(value["host"]!.GetValue<string>(), value["port"]!.GetValue<int>(), value["tls"]!.GetValue<string>() == "ssl" ? SecureSocketOptions.SslOnConnect : SecureSocketOptions.StartTls);
|
|
if (!string.IsNullOrWhiteSpace(value["username"]?.GetValue<string>())) await smtp.AuthenticateAsync(value["username"]!.GetValue<string>(), secret);
|
|
return smtp;
|
|
} catch { smtp.Dispose(); throw new ApiError(503, "邮件连接失败，请检查允许列表、TLS 和凭据"); }
|
|
}
|
|
static async Task SendMessage(MailKit.Net.Smtp.SmtpClient smtp, JsonObject v, string recipient, string title, string text)
|
|
{ var msg = new MimeMessage(); msg.From.Add(MailboxAddress.Parse(v["from"]!.GetValue<string>())); msg.To.Add(MailboxAddress.Parse(recipient)); msg.Subject = title; msg.Body = new TextPart("plain") { Text = text }; await smtp.SendAsync(msg); await smtp.DisconnectAsync(true); }
|
|
public async Task<bool> MailEnabled() { var row = await db.Settings.AsNoTracking().SingleOrDefaultAsync(x => x.Id == "smtp"); return row is not null && JsonNode.Parse(row.Value)?["enabled"]?.GetValue<bool>() == true; }
|
|
public async Task Send(string recipient, string title, string text) { var row = await db.Settings.AsNoTracking().SingleAsync(x => x.Id == "smtp"); var value = JsonNode.Parse(row.Value)!.AsObject(); using var smtp = await Connect(value, settings.Unprotect(row.Secret)); await SendMessage(smtp, value, recipient, title, text); }
|
|
}
|