i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-10-08 18:37:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: support api key ip restriction rules

Browse Source
This commit is contained in:
fawney19
2026-05-20 16:11:49 +08:00
parent b6bdc08267
commit f76bbaab52
55 changed files with 698 additions and 551 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/aether-gateway/src/handlers/admin/users/api_keys/helpers.rs
+1 -1
View File
@@ -44,7 +44,7 @@ pub(super) fn build_admin_user_api_key_detail_payload(
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"allowed_ips": record.allowed_ips,
"ip_rules": record.ip_rules,
"feature_settings": record.feature_settings,
"expires_at": format_optional_unix_secs_iso8601(record.expires_at_unix_secs),
"last_used_at": format_optional_unix_secs_iso8601(record.last_used_at_unix_secs),
apps/aether-gateway/src/handlers/admin/users/api_keys/responses/create.rs
+5 -5
View File
@@ -1,7 +1,7 @@
use super::super::super::{
build_admin_users_bad_request_response, build_admin_users_data_unavailable_response,
build_admin_users_read_only_response, normalize_admin_feature_settings,
normalize_admin_user_allowed_ips, AdminCreateUserApiKeyRequest,
normalize_admin_user_ip_rules, AdminCreateUserApiKeyRequest,
};
use super::super::helpers::{
attach_audit_response, default_admin_user_api_key_name, format_optional_unix_secs_iso8601,
@@ -71,7 +71,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
{
return Ok((
http::StatusCode::BAD_REQUEST,
Json(json!({ "detail": "当前仅支持 name、rate_limit、concurrent_limit、allowed_providers、allowed_ips 字段" })),
Json(json!({ "detail": "当前仅支持 name、rate_limit、concurrent_limit、allowed_providers、ip_rules 字段" })),
)
.into_response());
}
@@ -107,7 +107,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
.into_response());
}
};
let allowed_ips = match normalize_admin_user_allowed_ips(payload.allowed_ips) {
let ip_rules = match normalize_admin_user_ip_rules(payload.ip_rules) {
Ok(value) => value,
Err(detail) => {
return Ok((
@@ -156,7 +156,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
allowed_providers: None,
allowed_api_formats: None,
allowed_models: None,
allowed_ips,
ip_rules,
rate_limit,
concurrent_limit,
force_capabilities: None,
@@ -207,7 +207,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
"key_display": masked_user_api_key_display(state, created.key_encrypted.as_deref()),
"rate_limit": created.rate_limit,
"concurrent_limit": created.concurrent_limit,
"allowed_ips": created.allowed_ips,
"ip_rules": created.ip_rules,
"expires_at": format_optional_unix_secs_iso8601(created.expires_at_unix_secs),
"last_used_at": format_optional_unix_secs_iso8601(created.last_used_at_unix_secs),
"created_at": format_optional_unix_secs_iso8601(created.created_at_unix_secs),
apps/aether-gateway/src/handlers/admin/users/api_keys/responses/update.rs
+4 -5
View File
@@ -1,7 +1,6 @@
use super::super::super::{
build_admin_users_bad_request_response, build_admin_users_read_only_response,
normalize_admin_feature_settings, normalize_admin_user_allowed_ips,
AdminUpdateUserApiKeyRequest,
normalize_admin_feature_settings, normalize_admin_user_ip_rules, AdminUpdateUserApiKeyRequest,
};
use super::super::helpers::{
attach_audit_response, build_admin_user_api_key_detail_payload,
@@ -95,8 +94,8 @@ pub(crate) async fn build_admin_update_user_api_key_response(
.into_response());
}
};
let allowed_ips = match payload.allowed_ips {
Some(value) => match normalize_admin_user_allowed_ips(value) {
let ip_rules = match payload.ip_rules {
Some(value) => match normalize_admin_user_ip_rules(value) {
Ok(value) => Some(value),
Err(detail) => {
return Ok((
@@ -116,7 +115,7 @@ pub(crate) async fn build_admin_update_user_api_key_response(
name,
rate_limit: payload.rate_limit,
concurrent_limit,
allowed_ips,
ip_rules,
})
.await?
else {
apps/aether-gateway/src/handlers/admin/users/mod.rs
+1 -1
View File
@@ -56,7 +56,7 @@ use self::shared::{
};
pub(crate) use self::shared::{
normalize_admin_list_policy_mode, normalize_admin_rate_limit_policy_mode,
normalize_admin_user_allowed_ips, normalize_admin_user_api_formats,
normalize_admin_user_api_formats, normalize_admin_user_ip_rules,
normalize_admin_user_string_list,
};
pub(crate) use crate::handlers::shared::normalize_feature_settings as normalize_admin_feature_settings;
apps/aether-gateway/src/handlers/admin/users/shared.rs
+21 -57
View File
@@ -1,6 +1,6 @@
use super::ADMIN_USERS_DATA_UNAVAILABLE_DETAIL;
use crate::handlers::admin::shared::AdminTypedObjectPatch;
use crate::handlers::shared::deserialize_optional_string_list_patch;
use crate::handlers::shared::{deserialize_optional_string_list_patch, normalize_ip_rules};
use axum::{
body::Body,
http,
@@ -20,8 +20,8 @@ pub(super) struct AdminCreateUserApiKeyRequest {
pub(super) allowed_api_formats: Option<Vec<String>>,
#[serde(default)]
pub(super) allowed_models: Option<Vec<String>>,
#[serde(default)]
pub(super) allowed_ips: Option<Vec<String>>,
#[serde(default, alias = "allowed_ips")]
pub(super) ip_rules: Option<Vec<String>>,
#[serde(default)]
pub(super) rate_limit: Option<i32>,
#[serde(default)]
@@ -52,8 +52,12 @@ pub(super) struct AdminUpdateUserApiKeyRequest {
pub(super) concurrent_limit: Option<i32>,
#[serde(default)]
pub(super) feature_settings: Option<Option<Value>>,
#[serde(default, deserialize_with = "deserialize_optional_string_list_patch")]
pub(super) allowed_ips: Option<Option<Vec<String>>>,
#[serde(
default,
alias = "allowed_ips",
deserialize_with = "deserialize_optional_string_list_patch"
)]
pub(super) ip_rules: Option<Option<Vec<String>>>,
}
#[derive(Debug, serde::Deserialize)]
@@ -285,50 +289,10 @@ pub(crate) fn normalize_admin_user_api_formats(
Ok(Some(normalized))
}
pub(crate) fn normalize_admin_user_allowed_ips(
pub(crate) fn normalize_admin_user_ip_rules(
value: Option<Vec<String>>,
) -> Result<Option<Vec<String>>, String> {
let Some(values) = value else {
return Ok(None);
};
if values.is_empty() {
return Err("IP 白名单不能为空列表，如需取消限制请不提供此字段".to_string());
}
let mut normalized = Vec::with_capacity(values.len());
for (index, raw) in values.into_iter().enumerate() {
let trimmed = raw.trim();
if trimmed.is_empty() {
return Err(format!("IP 白名单第 {} 项为空", index + 1));
}
if !validate_admin_user_ip_or_cidr(trimmed) {
return Err(format!("无效的 IP 地址或 CIDR: {raw}"));
}
normalized.push(trimmed.to_string());
}
Ok(Some(normalized))
}
fn validate_admin_user_ip_or_cidr(value: &str) -> bool {
let value = value.trim();
if value.is_empty() {
return false;
}
if value.parse::<std::net::IpAddr>().is_ok() {
return true;
}
let Some((host, prefix)) = value.split_once('/') else {
return false;
};
let Ok(ip) = host.trim().parse::<std::net::IpAddr>() else {
return false;
};
let Ok(prefix) = prefix.trim().parse::<u8>() else {
return false;
};
match ip {
std::net::IpAddr::V4(_) => prefix <= 32,
std::net::IpAddr::V6(_) => prefix <= 128,
}
normalize_ip_rules(value)
}
pub(crate) fn normalize_admin_list_policy_mode(value: &str) -> Result<String, String> {
@@ -429,25 +393,25 @@ mod tests {
}
#[test]
fn admin_update_api_key_distinguishes_missing_null_and_present_allowed_ips() {
fn admin_update_api_key_distinguishes_missing_null_and_present_ip_rules() {
let missing = serde_json::from_value::<AdminUpdateUserApiKeyRequest>(json!({
"name": "unchanged-whitelist",
"name": "unchanged-ip-rules",
}))
.expect("missing allowed_ips should deserialize");
assert_eq!(missing.allowed_ips, None);
.expect("missing ip_rules should deserialize");
assert_eq!(missing.ip_rules, None);
let cleared = serde_json::from_value::<AdminUpdateUserApiKeyRequest>(json!({
"allowed_ips": null,
"ip_rules": null,
}))
.expect("null allowed_ips should deserialize");
assert_eq!(cleared.allowed_ips, Some(None));
.expect("null ip_rules should deserialize");
assert_eq!(cleared.ip_rules, Some(None));
let updated = serde_json::from_value::<AdminUpdateUserApiKeyRequest>(json!({
"allowed_ips": ["203.0.113.10", "10.0.0.0/24"],
"ip_rules": ["203.0.113.10", "10.0.0.0/24"],
}))
.expect("present allowed_ips should deserialize");
.expect("present ip_rules should deserialize");
assert_eq!(
updated.allowed_ips,
updated.ip_rules,
Some(Some(vec![
"203.0.113.10".to_string(),
"10.0.0.0/24".to_string(),