|
|
@@ -4,13 +4,23 @@
|
|
|
package logic
|
|
|
|
|
|
import (
|
|
|
+ "bytes"
|
|
|
"context"
|
|
|
+ "encoding/json"
|
|
|
+ "fmt"
|
|
|
+ "io"
|
|
|
+ "net/http"
|
|
|
+ "net/url"
|
|
|
+ "path"
|
|
|
+ "strings"
|
|
|
|
|
|
+ "udeServer/internal/apierr"
|
|
|
"udeServer/internal/model"
|
|
|
"udeServer/internal/svc"
|
|
|
"udeServer/internal/types"
|
|
|
|
|
|
"github.com/zeromicro/go-zero/core/logx"
|
|
|
+ "github.com/zeromicro/go-zero/core/stores/sqlx"
|
|
|
)
|
|
|
|
|
|
type UpdateServiceLogic struct {
|
|
|
@@ -31,22 +41,87 @@ func (l *UpdateServiceLogic) UpdateService(req *types.UpdateServiceReq) (*types.
|
|
|
if err := checkId(req.Id); err != nil {
|
|
|
return nil, err
|
|
|
}
|
|
|
- if _, err := findService(l.ctx, l.svcCtx.ServiceModel, req.Id); err != nil {
|
|
|
+ // 查旧实体:换密钥校验需要旧的 mount_status/key_iden;
|
|
|
+ // 目录联动需要旧目录清单(算差集,决定哪些目录要去外挂程序卸载)
|
|
|
+ svc, err := findService(l.ctx, l.svcCtx.ServiceModel, req.Id)
|
|
|
+ if err != nil {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+
|
|
|
+ // B 方案硬校验:挂载中的服务禁止更换密钥。
|
|
|
+ // 原因:FUSE 实际挂载仍用【旧密钥】解密,库里 keyIden 换成新的会形成"记新挂旧"的
|
|
|
+ // 脏状态,后续任何按库里 keyIden 进行的重挂/刷库都会用错密钥 → 旧密文读成乱码。
|
|
|
+ // 正规路径:卸载 → 用旧密钥解密存量 → 新密钥重加密(刷库) → 新密钥重新挂载。
|
|
|
+ if svc.MountStatus.String == "mounted" && req.KeyIden != svc.KeyIden.String {
|
|
|
+ return nil, apierr.BadRequest("服务正在挂载中,禁止更换密钥;请先卸载后再操作")
|
|
|
+ }
|
|
|
+
|
|
|
+ // 旧目录清单:联动卸载的依据(哪些目录被移除了,才需要去外挂程序卸载)
|
|
|
+ oldDirs, err := l.svcCtx.DirectoryModel.FindDirsByServiceId(l.ctx, req.Id)
|
|
|
+ if err != nil {
|
|
|
+ l.Errorf("query old directories of service %d failed: %v", req.Id, err)
|
|
|
return nil, err
|
|
|
}
|
|
|
|
|
|
- data := &model.TService{
|
|
|
- Id: req.Id,
|
|
|
- Name: nullString(req.Name),
|
|
|
- Ip: nullString(req.Ip),
|
|
|
- Port: nullString(req.Port),
|
|
|
- Iden: nullString(req.Iden),
|
|
|
- KeyIden: nullString(req.KeyIden),
|
|
|
- KeyAlgo: nullString(req.KeyAlgo),
|
|
|
- Status: nullString(req.Status),
|
|
|
+ // 新目录清单规范化:trim 去空白 + path.Clean(发给 Linux 外挂必须保持 / 分隔符) + 去重
|
|
|
+ newDirs := make([]string, 0, len(req.Directories))
|
|
|
+ for _, dir := range req.Directories {
|
|
|
+ dir = strings.TrimSpace(dir)
|
|
|
+ if dir == "" {
|
|
|
+ continue
|
|
|
+ }
|
|
|
+ newDirs = append(newDirs, path.Clean(dir))
|
|
|
}
|
|
|
- if err := l.svcCtx.ServiceModel.Update(l.ctx, data); err != nil {
|
|
|
- l.Errorf("update service %d failed: %v", req.Id, err)
|
|
|
+ newDirs = dedupStrings(newDirs)
|
|
|
+
|
|
|
+ // 挂载联动(事务前软处理):只有带 directories 字段的请求(编辑弹窗)才触发;
|
|
|
+ // changeStatus 状态开关等不传 directories 的调用方完全不受影响,状态保持原值。
|
|
|
+ // 联动失败绝不阻塞保存,失败信息聚合成 mountWarning 由前端弹黄色警告。
|
|
|
+ mountWarning := ""
|
|
|
+ mountStatus := svc.MountStatus.String // 无联动动作时,Update 原样写回旧值
|
|
|
+ if req.Directories != nil {
|
|
|
+ mountWarning, mountStatus = l.applyMountChanges(svc, oldDirs, newDirs, req)
|
|
|
+ }
|
|
|
+
|
|
|
+ // 事务:更新服务 + 目录全删全插(与新增服务同款后端收口模式,任一步失败整体回滚)
|
|
|
+ err = l.svcCtx.DB.Transact(func(session sqlx.Session) error {
|
|
|
+ svcModel := l.svcCtx.ServiceModel.WithSession(session)
|
|
|
+ dirModel := l.svcCtx.DirectoryModel.WithSession(session)
|
|
|
+
|
|
|
+ data := &model.TService{
|
|
|
+ Id: req.Id,
|
|
|
+ Name: nullString(req.Name),
|
|
|
+ Ip: nullString(req.Ip),
|
|
|
+ Port: req.Port, // 端口 int 类型,int64 直传(0=未配置)
|
|
|
+ Iden: nullString(req.Iden),
|
|
|
+ KeyIden: nullString(req.KeyIden),
|
|
|
+ KeyAlgo: nullString(req.KeyAlgo),
|
|
|
+ Status: nullString(req.Status),
|
|
|
+ MountStatus: nullString(mountStatus), // 联动算出的新状态(没联动就是旧值)
|
|
|
+ Brush: req.Brush, // 一键刷库配置:编辑只落库改配置,不追溯触发刷库(刷库编排仅在创建流程)
|
|
|
+ }
|
|
|
+ if err := svcModel.Update(l.ctx, data); err != nil {
|
|
|
+ return fmt.Errorf("update t_service %d: %w", req.Id, err)
|
|
|
+ }
|
|
|
+
|
|
|
+ // 目录三态:nil = 不动目录(状态开关等场景);空数组 = 清空;非空 = 全量重写
|
|
|
+ if req.Directories != nil {
|
|
|
+ if err := dirModel.DeleteByServiceId(l.ctx, req.Id); err != nil {
|
|
|
+ return fmt.Errorf("delete old directories of service %d: %w", req.Id, err)
|
|
|
+ }
|
|
|
+ for _, dir := range newDirs {
|
|
|
+ if _, err := dirModel.Insert(l.ctx, &model.TDirectory{
|
|
|
+ ServiceId: nullInt64(req.Id),
|
|
|
+ Directory: nullString(dir),
|
|
|
+ }); err != nil {
|
|
|
+ return fmt.Errorf("insert t_directory[%s]: %w", dir, err)
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return nil
|
|
|
+ })
|
|
|
+ if err != nil {
|
|
|
+ l.Errorf("update service tx failed: %v", err)
|
|
|
return nil, err
|
|
|
}
|
|
|
|
|
|
@@ -55,5 +130,182 @@ func (l *UpdateServiceLogic) UpdateService(req *types.UpdateServiceReq) (*types.
|
|
|
return nil, err
|
|
|
}
|
|
|
|
|
|
- return toServiceResp(updated), nil
|
|
|
+ resp := toServiceResp(updated)
|
|
|
+ if mountWarning != "" {
|
|
|
+ resp.MountWarning = mountWarning // 联动有失败时前端弹黄色警告
|
|
|
+ }
|
|
|
+ return resp, nil
|
|
|
+}
|
|
|
+
|
|
|
+// ======== 编辑联动挂载的辅助方法 ========
|
|
|
+
|
|
|
+// applyMountChanges 编辑保存时的挂载联动:对比新旧目录,该卸的卸、该挂的挂。
|
|
|
+// 联动在【事务之前】执行且全程软处理:任何失败只聚合成警告文案,绝不阻塞保存。
|
|
|
+// 幂等复用:新目录全量下发挂载,外挂的幂等决策表会自动跳过"已挂且同密钥"的目录,
|
|
|
+// 顺带把 failed 服务漏挂的目录也补挂上(自愈)。
|
|
|
+// 返回:warning(空串 = 联动全部成功), newStatus(联动后应写入库的 mount_status)。
|
|
|
+func (l *UpdateServiceLogic) applyMountChanges(svc *model.TService, oldDirs, newDirs []string, req *types.UpdateServiceReq) (string, string) {
|
|
|
+ // IP/端口变了 = 外挂换机器了:旧机器上的挂载全部要卸,新机器全量重挂
|
|
|
+ ipChanged := req.Ip != svc.Ip.String || req.Port != svc.Port // port 已是 int64,直接数值比较
|
|
|
+
|
|
|
+ // 该卸载的清单:换 IP → 全卸;没换 IP → 只卸"被移除"的目录(差集 old-new)
|
|
|
+ var toUnmount []string
|
|
|
+ if ipChanged {
|
|
|
+ toUnmount = oldDirs
|
|
|
+ } else {
|
|
|
+ toUnmount = diffStrings(oldDirs, newDirs)
|
|
|
+ }
|
|
|
+
|
|
|
+ var msgs []string
|
|
|
+ // 1. 先卸载:发往【旧】IP(挂载记录登记在旧机器的外挂程序进程里)
|
|
|
+ if len(toUnmount) > 0 {
|
|
|
+ oldIp, oldPort := svc.Ip.String, svc.Port // port 已是 int64
|
|
|
+ if oldIp == "" || oldPort == 0 {
|
|
|
+ msgs = append(msgs, "原外挂 IP/端口为空,无法联动卸载,旧目录可能仍处于挂载状态")
|
|
|
+ } else {
|
|
|
+ for _, dir := range toUnmount {
|
|
|
+ if w := l.fuseUnmountOne(oldIp, oldPort, dir); w != "" {
|
|
|
+ msgs = append(msgs, w)
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // 2. 再挂载:发往【新】IP,新目录全量下发(幂等表自动跳过已挂的)
|
|
|
+ if len(newDirs) > 0 {
|
|
|
+ if req.Ip == "" || req.Port == 0 {
|
|
|
+ msgs = append(msgs, "新外挂 IP/端口为空,无法联动挂载")
|
|
|
+ } else {
|
|
|
+ ikey, err := l.lookupIkey(req.KeyIden)
|
|
|
+ if err != nil {
|
|
|
+ msgs = append(msgs, fmt.Sprintf("联动挂载失败: %v", err))
|
|
|
+ } else {
|
|
|
+ for _, dir := range newDirs {
|
|
|
+ if w := l.fuseMountOne(req.Ip, req.Port, dir, ikey); w != "" {
|
|
|
+ msgs = append(msgs, w)
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // 3. mount_status 重算:
|
|
|
+ // 无动作(没卸也没挂,比如目录原样重存) → 保持原值;
|
|
|
+ // 有动作全成功 → 还有新目录 = mounted,清空了目录 = unmounted;
|
|
|
+ // 有动作任一失败 → failed(同时返回聚合警告,前端弹黄条)。
|
|
|
+ hasAction := len(toUnmount) > 0 || len(newDirs) > 0
|
|
|
+ if !hasAction {
|
|
|
+ return "", svc.MountStatus.String
|
|
|
+ }
|
|
|
+ if len(msgs) > 0 {
|
|
|
+ return "编辑已保存,但挂载联动存在失败: " + strings.Join(msgs, "; "), "failed"
|
|
|
+ }
|
|
|
+ if len(newDirs) > 0 {
|
|
|
+ return "", "mounted"
|
|
|
+ }
|
|
|
+ return "", "unmounted"
|
|
|
+}
|
|
|
+
|
|
|
+// fuseMountOne 通知外挂程序挂载单个目录。成功返回空串,失败返回警告文案。
|
|
|
+// 请求体与新增服务完全同款:{backing: 目录+"-cipher", mount: 目录, ikey: 密钥内容}
|
|
|
+func (l *UpdateServiceLogic) fuseMountOne(ip string, port int64, mount, ikey string) string {
|
|
|
+ // path.Clean(非 filepath!):路径要发给远程 Linux 外挂程序,必须保持 / 分隔符
|
|
|
+ dirLinuxPath := path.Clean(mount)
|
|
|
+ payload := map[string]interface{}{
|
|
|
+ "backing": dirLinuxPath + "-cipher", // 密文目录 = 保护目录 + "-cipher" 后缀
|
|
|
+ "mount": dirLinuxPath, // 挂载点 = 保护目录本身
|
|
|
+ "ikey": ikey,
|
|
|
+ }
|
|
|
+ body, err := json.Marshal(payload)
|
|
|
+ if err != nil {
|
|
|
+ return fmt.Sprintf("序列化挂载请求失败: %v", err)
|
|
|
+ }
|
|
|
+ baseURL := fmt.Sprintf("http://%s:%d/api/fuseMount", ip, port) // %d:port 是 int64
|
|
|
+ resp, err := fuseMountClient.Post(baseURL, "application/json", bytes.NewReader(body))
|
|
|
+ if err != nil {
|
|
|
+ return fmt.Sprintf("挂载目录 %s 失败(外挂程序未启动?): %v", dirLinuxPath, err)
|
|
|
+ }
|
|
|
+ if resp.StatusCode >= http.StatusBadRequest {
|
|
|
+ snippet, _ := io.ReadAll(io.LimitReader(resp.Body, 256)) // 带出外挂错误内容(前 256 字节)
|
|
|
+ resp.Body.Close()
|
|
|
+ return fmt.Sprintf("挂载目录 %s 失败,外挂程序返回 HTTP %d: %s", dirLinuxPath, resp.StatusCode, string(snippet))
|
|
|
+ }
|
|
|
+ _, _ = io.Copy(io.Discard, resp.Body) // 读入"黑洞"保证 TCP 连接复用 Keep-Alive
|
|
|
+ resp.Body.Close()
|
|
|
+ l.Infof("fuse mount ok: %s -> %s", dirLinuxPath, dirLinuxPath+"-cipher")
|
|
|
+ return ""
|
|
|
+}
|
|
|
+
|
|
|
+// fuseUnmountOne 通知外挂程序卸载单个挂载点。成功返回空串,失败返回警告文案。
|
|
|
+// 卸载接口幂等:挂载点不在外挂注册表中也返回成功,所以重存/多卸都零成本。
|
|
|
+func (l *UpdateServiceLogic) fuseUnmountOne(ip string, port int64, mount string) string {
|
|
|
+ cleanMount := path.Clean(mount) // 同上,发给 Linux 必须保持 / 分隔符
|
|
|
+ baseURL := fmt.Sprintf("http://%s:%d/api/fuseUnMount", ip, port) // %d:port 是 int64
|
|
|
+ reqURL, uerr := url.Parse(baseURL)
|
|
|
+ if uerr != nil {
|
|
|
+ return fmt.Sprintf("解析 URL 失败: %v", uerr)
|
|
|
+ }
|
|
|
+ q := reqURL.Query()
|
|
|
+ q.Set("mount", cleanMount) // q.Encode() 自动做 URL 编码(/ → %2F),外挂侧 Query().Get 自动解码还原
|
|
|
+ reqURL.RawQuery = q.Encode()
|
|
|
+ resp, err := fuseMountClient.Get(reqURL.String()) // 复用挂载逻辑的 HTTP 客户端(同包包级变量)
|
|
|
+ if err != nil {
|
|
|
+ return fmt.Sprintf("卸载目录 %s 失败(外挂程序未启动?): %v", cleanMount, err)
|
|
|
+ }
|
|
|
+ if resp.StatusCode >= http.StatusBadRequest {
|
|
|
+ snippet, _ := io.ReadAll(io.LimitReader(resp.Body, 256))
|
|
|
+ resp.Body.Close()
|
|
|
+ return fmt.Sprintf("卸载目录 %s 失败,外挂程序返回 HTTP %d: %s", cleanMount, resp.StatusCode, string(snippet))
|
|
|
+ }
|
|
|
+ _, _ = io.Copy(io.Discard, resp.Body)
|
|
|
+ resp.Body.Close()
|
|
|
+ l.Infof("fuse unmount ok: %s", cleanMount)
|
|
|
+ return ""
|
|
|
+}
|
|
|
+
|
|
|
+// lookupIkey 按密钥标识(keyIden)查密钥内容,下发挂载时作为 ikey 使用。
|
|
|
+// 独立成方法供编辑联动复用,不动 createservicelogic.go 的原有实现。
|
|
|
+func (l *UpdateServiceLogic) lookupIkey(keyIden string) (string, error) {
|
|
|
+ if keyIden == "" {
|
|
|
+ return "", fmt.Errorf("服务未配置密钥标识(keyIden),无法下发挂载")
|
|
|
+ }
|
|
|
+ key, err := l.svcCtx.KeyModel.FindOneByIden(l.ctx, keyIden)
|
|
|
+ if err != nil {
|
|
|
+ return "", fmt.Errorf("查询密钥(%s)失败: %w", keyIden, err)
|
|
|
+ }
|
|
|
+ ikey := key.Content.String
|
|
|
+ if ikey == "" {
|
|
|
+ return "", fmt.Errorf("密钥(%s)内容为空,无法下发挂载", keyIden)
|
|
|
+ }
|
|
|
+ return ikey, nil
|
|
|
+}
|
|
|
+
|
|
|
+// diffStrings 集合差集:返回"在 oldDirs 中但不在 newDirs 中"的元素(被移除的目录)。
|
|
|
+func diffStrings(oldDirs, newDirs []string) []string {
|
|
|
+ // map[string]bool 当集合用:value 只存 true/false,判断"存在性"是 O(1)
|
|
|
+ newSet := make(map[string]bool, len(newDirs))
|
|
|
+ for _, v := range newDirs {
|
|
|
+ newSet[v] = true
|
|
|
+ }
|
|
|
+ out := make([]string, 0, len(oldDirs))
|
|
|
+ for _, v := range oldDirs {
|
|
|
+ if !newSet[v] {
|
|
|
+ out = append(out, v)
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return out
|
|
|
+}
|
|
|
+
|
|
|
+// dedupStrings 保序去重:同一路径提交两次只落库/下发一次。
|
|
|
+func dedupStrings(in []string) []string {
|
|
|
+ seen := make(map[string]bool, len(in))
|
|
|
+ out := make([]string, 0, len(in))
|
|
|
+ for _, v := range in {
|
|
|
+ if seen[v] {
|
|
|
+ continue // 已见过,跳过
|
|
|
+ }
|
|
|
+ seen[v] = true
|
|
|
+ out = append(out, v)
|
|
|
+ }
|
|
|
+ return out
|
|
|
}
|
