admin/TaskPool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add secret feature

Browse Source
This commit is contained in:
engigu
2026-03-27 14:51:29 +08:00
parent 06589e87c4
commit cc3316c4b8
19 changed files with 447 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/services/config_service.go
+4
View File
@@ -45,6 +45,7 @@ var Config *AppConfig
func getEnvStr(key string, target *string) {
if v := os.Getenv(key); v != "" {
*target = v
_ = os.Unsetenv(key)
}
}
@@ -54,6 +55,7 @@ func getEnvBool(key string, target *bool) {
if b, err := strconv.ParseBool(v); err == nil {
*target = b
}
_ = os.Unsetenv(key)
}
}
@@ -63,6 +65,7 @@ func getEnvInt(key string, target *int) {
if n, err := strconv.Atoi(v); err == nil {
*target = n
}
_ = os.Unsetenv(key)
}
}
@@ -130,6 +133,7 @@ func LoadConfig(path string) (*AppConfig, error) {
if v := os.Getenv("BH_DEMO_MODE"); v == "true" || v == "1" {
constant.DemoMode = true
logger.Info("[Config] 演示模式已启用")
_ = os.Unsetenv("BH_DEMO_MODE")
}
// 输出配置信息（隐藏敏感信息）
internal/services/env_service.go
+108 -6
View File
@@ -3,6 +3,7 @@ package services
import (
"strings"
"github.com/engigu/baihu-panel/internal/constant"
"github.com/engigu/baihu-panel/internal/database"
"github.com/engigu/baihu-panel/internal/models"
"github.com/engigu/baihu-panel/internal/utils"
@@ -16,12 +17,19 @@ func NewEnvService() *EnvService {
return &EnvService{}
}
func (es *EnvService) CreateEnvVar(name, value, remark string, hidden, enabled bool, userID string) *models.EnvironmentVariable {
func (es *EnvService) CreateEnvVar(name, value, remark, envType string, hidden, enabled bool, userID string) *models.EnvironmentVariable {
if envType == constant.EnvTypeSecret {
if encValue, err := utils.Encrypt(value); err == nil {
value = encValue
}
}
env := &models.EnvironmentVariable{
ID: utils.GenerateID(),
Name: name,
Value: models.BigText(value),
Remark: remark,
Type: envType,
Hidden: hidden,
Enabled: enabled,
UserID: userID,
@@ -44,7 +52,7 @@ func (es *EnvService) GetFormattedEnvVarsByUserID(userID string) []string {
return es.formatEnvVars(envs)
}
func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, page, pageSize int) ([]models.EnvironmentVariable, int64) {
func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, envType string, page, pageSize int) ([]models.EnvironmentVariable, int64) {
var envs []models.EnvironmentVariable
var total int64
@@ -52,6 +60,9 @@ func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, page,
if name != "" {
query = query.Where("name LIKE ?", "%"+name+"%")
}
if envType != "" {
query = query.Where("type = ?", envType)
}
query.Count(&total)
query.Order("id DESC").Offset((page - 1) * pageSize).Limit(pageSize).Find(&envs)
@@ -67,16 +78,27 @@ func (es *EnvService) GetEnvVarByID(id string) *models.EnvironmentVariable {
return &env
}
func (es *EnvService) UpdateEnvVar(id string, name, value, remark string, hidden, enabled bool) *models.EnvironmentVariable {
func (es *EnvService) UpdateEnvVar(id string, name, value, remark, envType string, hidden, enabled bool) *models.EnvironmentVariable {
var env models.EnvironmentVariable
res := database.DB.Where("id = ?", id).Limit(1).Find(&env)
if res.Error != nil || res.RowsAffected == 0 {
return nil
}
if envType == constant.EnvTypeSecret && value != "********" && value != "" {
if encValue, err := utils.Encrypt(value); err == nil {
value = encValue
}
} else if envType == constant.EnvTypeSecret && (value == "********" || value == "") {
// Keep the original encrypted value
value = string(env.Value)
}
updates := map[string]interface{}{
"name": name,
"value": models.BigText(value),
"remark": remark,
"type": envType,
"hidden": hidden,
"enabled": enabled,
}
@@ -146,7 +168,25 @@ func (es *EnvService) GetEnvVarsByIDs(envIDs string) []string {
return es.formatEnvVars(envs)
}
// GetAllEnvVars 获取系统中所有的环境变量，并按 NAME=VALUE 格式返回（支持重名合并）
// GetEnvVarsAndSecretsByIDs 根据逗号分隔的ID字符串获取环境变量列表和安全机密值列表
func (es *EnvService) GetEnvVarsAndSecretsByIDs(envIDs string) ([]string, []string) {
if envIDs == "" {
return nil, nil
}
ids := splitEnvIDs(envIDs)
var envs []models.EnvironmentVariable
for _, id := range ids {
env := es.GetEnvVarByID(id)
if env != nil {
envs = append(envs, *env)
}
}
return es.formatEnvVarsAndSecrets(envs)
}
// GetAllEnvVars获取系统中所有的环境变量，并按 NAME=VALUE 格式返回
func (es *EnvService) GetAllEnvVars() []string {
var envs []models.EnvironmentVariable
if err := database.DB.Find(&envs).Error; err != nil {
@@ -155,7 +195,16 @@ func (es *EnvService) GetAllEnvVars() []string {
return es.formatEnvVars(envs)
}
// formatEnvVars 将环境变量列表格式化为 NAME=VALUE 数组，并处理重名合并
// GetAllEnvVarsAndSecrets 获取系统中所有的环境变量和安全机密值列表
func (es *EnvService) GetAllEnvVarsAndSecrets() ([]string, []string) {
var envs []models.EnvironmentVariable
if err := database.DB.Find(&envs).Error; err != nil {
return nil, nil
}
return es.formatEnvVarsAndSecrets(envs)
}
// formatEnvVars 将环境变量列表格式化为 NAME=VALUE 数组，并处理重名合并 (过滤掉所有的 Secret)
func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string {
if len(envs) == 0 {
return nil
@@ -169,6 +218,11 @@ func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string
nameToIndex := make(map[string]int)
for _, env := range envs {
// 非调度器入口，直接当做没有（跳过 Secret）
if env.Type == constant.EnvTypeSecret {
continue
}
value := string(env.Value)
if !env.Enabled {
value = ""
@@ -185,13 +239,61 @@ func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string
}
}
var result []string
for _, item := range mergedList {
val := strings.Join(item.values, "&")
result = append(result, item.name+"="+val)
}
return result
}
// formatEnvVarsAndSecrets 将环境变量列表格式化为 NAME=VALUE 数组，并提取明文安全机密列表
func (es *EnvService) formatEnvVarsAndSecrets(envs []models.EnvironmentVariable) ([]string, []string) {
if len(envs) == 0 {
return nil, nil
}
type mergedEnv struct {
name string
values []string
}
var mergedList []mergedEnv
var secrets []string
nameToIndex := make(map[string]int)
for _, env := range envs {
value := string(env.Value)
if env.Type == constant.EnvTypeSecret {
if decValue, err := utils.Decrypt(value); err == nil {
value = decValue
if env.Enabled && value != "" {
secrets = append(secrets, value)
}
}
}
if !env.Enabled {
value = ""
}
if idx, ok := nameToIndex[env.Name]; ok {
mergedList[idx].values = append(mergedList[idx].values, value)
} else {
nameToIndex[env.Name] = len(mergedList)
mergedList = append(mergedList, mergedEnv{
name: env.Name,
values: []string{value},
})
}
}
var result []string
for _, item := range mergedList {
// 多个值使用 & 拼接
val := strings.Join(item.values, "&")
result = append(result, item.name+"="+val)
}
return result
return result, secrets
}
// splitEnvIDs 解析逗号分隔的ID字符串
internal/services/tasks/executor_service.go
+14 -10
View File
@@ -38,6 +38,8 @@ type SettingsService interface {
type EnvService interface {
GetEnvVarsByIDs(ids string) []string
GetAllEnvVars() []string
GetEnvVarsAndSecretsByIDs(ids string) ([]string, []string)
GetAllEnvVarsAndSecrets() ([]string, []string)
}
type ExecutorService struct {
@@ -143,7 +145,7 @@ func (h *ServerSchedulerHandler) OnTaskExecuting(req *executor.ExecutionRequest)
req.Metadata.GoID = goid
// 3. 创建 TinyLog 实时日志收集器
tl, err := NewTinyLog(taskLog.ID)
tl, err := NewTinyLog(taskLog.ID, req.Secrets)
if err != nil {
h.es.RemoveRunningGo(task.ID, goid) // 回滚运行状态
return nil, nil, fmt.Errorf("创建日志收集器失败: %v", err)
@@ -374,13 +376,14 @@ func (es *ExecutorService) HandleTaskRetry(task *models.Task, req *executor.Exec
return nil
}
newEnvs := es.loadEnvVars(latestTask.ID, string(latestTask.Envs))
newEnvs, newSecrets := es.loadEnvVars(latestTask.ID, string(latestTask.Envs))
return &executor.ExecutionRequest{
TaskID: req.TaskID,
Name: latestTask.Name,
Command: string(latestTask.Command),
WorkDir: latestTask.WorkDir,
Envs: newEnvs,
Secrets: newSecrets,
Timeout: latestTask.Timeout,
Languages: []map[string]string(latestTask.Languages),
UseMise: latestTask.UseMise(),
@@ -507,7 +510,7 @@ func (es *ExecutorService) AddCronTask(task *models.Task) error {
return nil
}
// 在加入调度器前，预先加载好环境信息
task.RuntimeEnvs = es.loadEnvVars(task.ID, string(task.Envs))
task.RuntimeEnvs, _ = es.loadEnvVars(task.ID, string(task.Envs))
return es.cronManager.AddTask(task)
}
@@ -588,7 +591,7 @@ func (es *ExecutorService) ExecuteTask(taskID string, extraEnvs []string) *execu
}
}
envs := es.loadEnvVars(task.ID, string(task.Envs))
envs, secrets := es.loadEnvVars(task.ID, string(task.Envs))
if len(extraEnvs) > 0 {
envs = append(envs, extraEnvs...)
}
@@ -599,6 +602,7 @@ func (es *ExecutorService) ExecuteTask(taskID string, extraEnvs []string) *execu
Command: string(task.Command),
WorkDir: task.WorkDir,
Envs: envs,
Secrets: secrets,
Timeout: task.Timeout,
Languages: []map[string]string(task.Languages),
UseMise: task.UseMise(),
@@ -1001,8 +1005,8 @@ func (es *ExecutorService) BuildRepoCommand(task *models.Task) (string, string)
return buildRepoCommandEnvPrefix()+cmdStr, filepath.Dir(exePath)
}
// loadEnvVars 加载环境变量，支持全局注入及重名合并
func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
// loadEnvVars 加载环境变量和掩码信息，支持全局注入及重名合并
func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) ([]string, []string) {
// 1. 检查是否开启了注入全部环境变量
if taskID != "" && es.taskService != nil {
task := es.taskService.GetTaskByID(taskID)
@@ -1011,7 +1015,7 @@ func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
if err := json.Unmarshal([]byte(task.Config), &config); err == nil {
if config.AllEnvs {
if es.envService != nil {
return es.envService.GetAllEnvVars()
return es.envService.GetAllEnvVarsAndSecrets()
}
}
}
@@ -1020,14 +1024,14 @@ func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
// 2. 否则按 ID 列表进行加载（支持合并逻辑在 envService 中处理）
if envIDs == "" {
return nil
return nil, nil
}
if es.envService != nil {
return es.envService.GetEnvVarsByIDs(envIDs)
return es.envService.GetEnvVarsAndSecretsByIDs(envIDs)
}
return nil
return nil, nil
}
func (es *ExecutorService) ResolvePath(path string) string {
internal/services/tasks/tiny_log.go
+7 -5
View File
@@ -56,11 +56,12 @@ type TinyLog struct {
writer *bufio.Writer
subscribers []chan []byte
remainder []byte // Leftover bytes from previous write (partial multi-byte characters)
masks []string // Secrets to mask
closed bool
}
// NewTinyLog 创建一个新的 TinyLog 实例（基于临时文件存储）并注册它
func NewTinyLog(logID string) (*TinyLog, error) {
// NewTinyLog 创建一个新的 TinyLog 实例（基于临时文件存储）并注册它，支持将配置的 masks 替换为 ********
func NewTinyLog(logID string, masks []string) (*TinyLog, error) {
f, err := os.CreateTemp("", "task_log_*.log")
if err != nil {
return nil, err
@@ -72,6 +73,7 @@ func NewTinyLog(logID string) (*TinyLog, error) {
path: f.Name(),
writer: bufio.NewWriter(f),
subscribers: make([]chan []byte, 0),
masks: masks,
}
globalTinyLogManager.Register(tl)
return tl, nil
@@ -115,8 +117,8 @@ func (l *TinyLog) Write(p []byte) (n int, err error) {
return originalInputLen, nil
}
// 3. 仅将完整的部分转换为 UTF-8
text := utils.ToUTF8(payload[:lastSafe])
// 3. 仅将完整的部分转换为 UTF-8，并调用封装的函数进行脱敏处理
text := utils.MaskSecrets(utils.ToUTF8(payload[:lastSafe]), l.masks)
data := []byte(text)
// 4. 写入文件缓冲区
@@ -179,7 +181,7 @@ func (l *TinyLog) Close() error {
// 处理剩余的字节
if len(l.remainder) > 0 {
text := utils.ToUTF8(l.remainder)
text := utils.MaskSecrets(utils.ToUTF8(l.remainder), l.masks)
data := []byte(text)
_, _ = l.writer.Write(data)