mirror of
https://gh-proxy.org/https://github.com/klinsmaya/new-api.git
synced 2026-11-08 01:17:09 +08:00
CaIon
45c3fbe8ae
Require single-use operation proofs for passkey enrollment, two-factor setup, and channel key access. Add password and OAuth verification flows, enforce session-bound enrollment, and redact OAuth callback secrets from logs. Validation: affected Go packages pass; frontend typecheck, changed-file lint, and 111 tests pass. Security enrollment regressions pass on SQLite 3.50.4, MySQL 8.0.46, and PostgreSQL 16.15. Full frontend lint has pre-existing errors outside the changed files.
49 lines
1.1 KiB
Go
49 lines
1.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/QuantumNous/new-api/common"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
const RouteTagKey = "route_tag"
|
|
|
|
func RouteTag(tag string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
c.Set(RouteTagKey, tag)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
func SetUpLogger(server *gin.Engine) {
|
|
server.Use(redactTaskArtifactAccessQuery())
|
|
server.Use(gin.LoggerWithFormatter(func(param gin.LogFormatterParams) string {
|
|
var requestID string
|
|
if param.Keys != nil {
|
|
requestID, _ = param.Keys[common.RequestIdKey].(string)
|
|
}
|
|
tag, _ := param.Keys[RouteTagKey].(string)
|
|
if tag == "" {
|
|
tag = "web"
|
|
}
|
|
path := param.Path
|
|
// OAuth callbacks carry one-time codes and state in the query string.
|
|
// Redact the log value only; the handler still needs the original query.
|
|
if strings.HasPrefix(path, "/api/oauth/") || strings.HasPrefix(path, "/oauth/") {
|
|
path, _, _ = strings.Cut(path, "?")
|
|
}
|
|
return fmt.Sprintf("[GIN] %s | %s | %s | %3d | %13v | %15s | %7s %s\n",
|
|
param.TimeStamp.Format("2006/01/02 - 15:04:05"),
|
|
tag,
|
|
requestID,
|
|
param.StatusCode,
|
|
param.Latency,
|
|
param.ClientIP,
|
|
param.Method,
|
|
path,
|
|
)
|
|
}))
|
|
}
|