i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-12 22:20:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): harden gateway boundaries and usage policies

Browse Source 
Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change.

Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.
This commit is contained in:
elky
2026-09-04 03:45:52 +08:00
parent ddcbeb3ae9
commit 579f2c7cc1
1019 changed files with 190437 additions and 26080 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/aether-data/runtime/schema/generated/mysql/baseline/001_identity.sql
+2
View File
@@ -12,6 +12,7 @@ CREATE TABLE IF NOT EXISTS users (
`email_verified` TINYINT(1) NOT NULL DEFAULT 0,
`is_active` TINYINT(1) NOT NULL DEFAULT 1,
`is_deleted` TINYINT(1) NOT NULL DEFAULT 0,
`security_version` BIGINT NOT NULL DEFAULT 0,
`allowed_models` JSON,
`allowed_models_mode` VARCHAR(32) NOT NULL DEFAULT 'unrestricted',
`allowed_providers` JSON,
@@ -193,6 +194,7 @@ CREATE TABLE IF NOT EXISTS user_preferences (
CREATE TABLE IF NOT EXISTS user_sessions (
`id` VARCHAR(64) NOT NULL,
`user_id` VARCHAR(64) NOT NULL,
`security_version` BIGINT NOT NULL DEFAULT 0,
`client_device_id` VARCHAR(128) NOT NULL,
`device_label` VARCHAR(120),
`device_type` VARCHAR(20) NOT NULL DEFAULT 'unknown',
crates/aether-data/runtime/schema/generated/mysql/baseline/003_auth_config.sql
+3 -1
View File
@@ -45,6 +45,7 @@ CREATE TABLE IF NOT EXISTS oauth_providers (
CREATE TABLE IF NOT EXISTS ldap_configs (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`singleton_key` INT NOT NULL DEFAULT 1,
`server_url` VARCHAR(255) NOT NULL,
`bind_dn` LONGTEXT NOT NULL,
`bind_password_encrypted` LONGTEXT,
@@ -59,7 +60,8 @@ CREATE TABLE IF NOT EXISTS ldap_configs (
`connect_timeout` INT NOT NULL DEFAULT 10,
`created_at` BIGINT NOT NULL,
`updated_at` BIGINT NOT NULL,
PRIMARY KEY (`id`)
PRIMARY KEY (`id`),
UNIQUE KEY ldap_configs_singleton_key_key (`singleton_key`)
);
CREATE TABLE IF NOT EXISTS user_oauth_links (
crates/aether-data/runtime/schema/generated/mysql/baseline/004_proxy_nodes.sql
+4 -2
View File
@@ -3,6 +3,7 @@
CREATE TABLE IF NOT EXISTS proxy_nodes (
`id` VARCHAR(64) NOT NULL,
`tunnel_generation` VARCHAR(64) NOT NULL,
`name` VARCHAR(255) NOT NULL,
`ip` VARCHAR(512) NOT NULL,
`port` INT NOT NULL,
@@ -17,7 +18,7 @@ CREATE TABLE IF NOT EXISTS proxy_nodes (
`is_manual` TINYINT(1) NOT NULL DEFAULT 0,
`proxy_url` VARCHAR(500),
`proxy_username` VARCHAR(255),
`proxy_password` VARCHAR(500),
`proxy_password` TEXT,
`created_at` BIGINT NOT NULL,
`updated_at` BIGINT NOT NULL,
`remote_config` JSON,
@@ -31,7 +32,8 @@ CREATE TABLE IF NOT EXISTS proxy_nodes (
`dns_failures` BIGINT NOT NULL DEFAULT 0,
`stream_errors` BIGINT NOT NULL DEFAULT 0,
`proxy_metadata` JSON,
PRIMARY KEY (`id`)
PRIMARY KEY (`id`),
UNIQUE KEY uq_proxy_node_ip_port (`ip`, `port`)
);
CREATE TABLE IF NOT EXISTS proxy_node_events (
crates/aether-data/runtime/schema/generated/mysql/baseline/005_wallet_billing.sql
+2 -5
View File
@@ -87,7 +87,7 @@ CREATE TABLE IF NOT EXISTS payment_orders (
`product_snapshot` JSON,
`fulfillment_status` VARCHAR(64) NOT NULL DEFAULT 'pending',
`fulfillment_error` LONGTEXT,
`gateway_order_id` VARCHAR(128),
`gateway_order_id` VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_bin,
`gateway_response` JSON,
`status` VARCHAR(64) NOT NULL DEFAULT 'pending',
`created_at` BIGINT NOT NULL,
@@ -100,6 +100,7 @@ CREATE TABLE IF NOT EXISTS payment_orders (
KEY idx_payment_orders_user_created (`user_id`, `created_at`),
KEY idx_payment_orders_status (`status`),
KEY idx_payment_orders_gateway_order_id (`gateway_order_id`),
UNIQUE KEY uq_payment_orders_payment_method_gateway_order_id (`payment_method`, `gateway_order_id`),
KEY idx_payment_orders_kind_status (`order_kind`, `status`),
KEY idx_payment_orders_product (`product_id`)
);
@@ -130,8 +131,6 @@ CREATE TABLE IF NOT EXISTS user_referrals (
KEY idx_user_referrals_inviter (`inviter_user_id`, `created_at`),
KEY idx_user_referrals_created (`created_at`),
KEY idx_user_referrals_invite_code (`invite_code_snapshot`),
CONSTRAINT user_referrals_inviter_user_id_fkey FOREIGN KEY (`inviter_user_id`) REFERENCES users (`id`) ON DELETE CASCADE,
CONSTRAINT user_referrals_invitee_user_id_fkey FOREIGN KEY (`invitee_user_id`) REFERENCES users (`id`) ON DELETE CASCADE,
CONSTRAINT user_referrals_first_paid_order_fkey FOREIGN KEY (`first_paid_order_id`) REFERENCES payment_orders (`id`) ON DELETE SET NULL
);
@@ -161,8 +160,6 @@ CREATE TABLE IF NOT EXISTS referral_rewards (
KEY idx_referral_rewards_created (`created_at`),
KEY idx_referral_rewards_source_order (`source_order_id`),
CONSTRAINT referral_rewards_referral_id_fkey FOREIGN KEY (`referral_id`) REFERENCES user_referrals (`id`) ON DELETE CASCADE,
CONSTRAINT referral_rewards_inviter_user_id_fkey FOREIGN KEY (`inviter_user_id`) REFERENCES users (`id`) ON DELETE CASCADE,
CONSTRAINT referral_rewards_invitee_user_id_fkey FOREIGN KEY (`invitee_user_id`) REFERENCES users (`id`) ON DELETE CASCADE,
CONSTRAINT referral_rewards_source_order_fkey FOREIGN KEY (`source_order_id`) REFERENCES payment_orders (`id`) ON DELETE SET NULL
);
crates/aether-data/runtime/schema/generated/mysql/baseline/006_usage.sql
+37
View File
@@ -173,6 +173,7 @@ CREATE TABLE IF NOT EXISTS usage_counter_deltas (
`request_id` VARCHAR(128) NOT NULL,
`kind` VARCHAR(64) NOT NULL,
`target_id` TEXT NOT NULL,
`target_tunnel_generation` VARCHAR(64),
`request_count_delta` BIGINT NOT NULL DEFAULT 0,
`total_requests_delta` BIGINT NOT NULL DEFAULT 0,
`success_count_delta` BIGINT NOT NULL DEFAULT 0,
@@ -243,3 +244,39 @@ CREATE TABLE IF NOT EXISTS usage_settlement_snapshots (
KEY ix_usage_settlement_snapshots_pricing_source (`billing_pricing_source`)
);
CREATE TABLE IF NOT EXISTS usage_cost_reservations (
`request_id` VARCHAR(128) NOT NULL,
`subject_id` VARCHAR(128) NOT NULL,
`reservation_token` VARCHAR(128) NOT NULL,
`admitted_at` BIGINT NOT NULL,
`reserved_cost_units` BIGINT NOT NULL,
`actual_cost_units` BIGINT,
`state` VARCHAR(20) NOT NULL,
`reservation_expires_at` BIGINT NOT NULL,
`retain_until` BIGINT NOT NULL,
`finalized_at` BIGINT,
`created_at` BIGINT NOT NULL,
`updated_at` BIGINT NOT NULL,
PRIMARY KEY (`reservation_token`),
KEY usage_cost_reservations_request_id_idx (`request_id`),
KEY usage_cost_reservations_subject_admitted_at_idx (`subject_id`, `admitted_at`),
KEY usage_cost_reservations_reservation_expires_at_idx (`reservation_expires_at`),
KEY usage_cost_reservations_retain_until_token_idx (`retain_until`, `reservation_token`),
CONSTRAINT usage_cost_reservations_subject_id_fkey FOREIGN KEY (`subject_id`) REFERENCES users (`id`) ON DELETE CASCADE
);
CREATE TABLE IF NOT EXISTS usage_request_admissions (
`request_id` VARCHAR(128) NOT NULL,
`subject_id` VARCHAR(128) NOT NULL,
`event_token` VARCHAR(128) NOT NULL,
`admitted_at` BIGINT NOT NULL,
`retain_until` BIGINT NOT NULL,
`state` VARCHAR(20) NOT NULL,
`released_at` BIGINT,
`created_at` BIGINT NOT NULL,
PRIMARY KEY (`event_token`),
KEY usage_request_admissions_subject_admitted_at_idx (`subject_id`, `admitted_at`),
KEY usage_request_admissions_retain_until_token_idx (`retain_until`, `event_token`),
CONSTRAINT usage_request_admissions_subject_id_fkey FOREIGN KEY (`subject_id`) REFERENCES users (`id`) ON DELETE CASCADE
);