feat(admin): 예전/최신 어드민 통합 — 실데이터 복원 + 인증 아키텍처 정리
예전 배포본(HEAD)의 상세 기능을 새 아키텍처(인증=.NET 백엔드, 데이터=Supabase) 위에 실데이터로 복원. 예전 HEAD는 서명 쿠키를 거부하고 위조 쿠키는 통과시키는 인증 결함이 있었고, 삭제된 페이지 다수는 백엔드 호출 0인 하드코딩 목업이었음. 인증/세션 - 로그인 이메일 전용화(username 폐지), 에러 키별 안내 메시지 - ADMIN_COOKIE_SECURE 옵션: TLS 없는 LAN HTTP 배포에서 Secure 쿠키 유실로 로그인이 유지되지 않던 문제 해결 (login/logout route, admin-session, compose, .env.example) - Supabase 미설정 시 우아한 저하: isSupabaseAdminConfigured + UnavailableAdminPanel 기능 복원 (실데이터) - Release Hub: Forgejo API 실데이터(다운로드 수/SHA-256 체크섬/릴리스 이력) - Ad Monetization: 데스크톱 미디에이션 10개 어댑터 로스터(fail-closed) + ad_reward_claims 통계 - License Issuer: 서버사이드 Ed25519 서명(/api/admin/license, super_admin 전용), 개인키는 ADMIN_LICENSE_PRIVATE_KEY env로만, 발급 감사를 .NET AdminAuditEntries에 기록 - Service Models: STT 7종/LLM 5종 프리셋 드롭다운 + 자동채움 - 대시보드 ARR/MRR KPI: Supabase 구독 실집계(티어 월단가 기반) - 사용자 상세 티어별 기능 배지(pro_plus 조건부) .NET - SuperAdminOnly 정책 추가, /api/admin/license-audit 엔드포인트, LicenseAuditDto
This commit is contained in:
Yun Chan
parent
a9c9a1ca6e
commit
5a34f66981
66 changed files with 4471 additions and 3501 deletions
|
|
@ -2,9 +2,11 @@ using System.Text;
|
|||
using D3ROVoice.Api.Data;
|
||||
using D3ROVoice.Api.Services;
|
||||
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
||||
using Microsoft.AspNetCore.Identity;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
using Microsoft.OpenApi;
|
||||
using System.Threading.RateLimiting;
|
||||
|
||||
var builder = WebApplication.CreateBuilder(args);
|
||||
var serverStartTime = DateTime.UtcNow;
|
||||
|
|
@ -13,6 +15,19 @@ var serverStartTime = DateTime.UtcNow;
|
|||
builder.Services.AddControllers();
|
||||
builder.Services.AddHttpClient();
|
||||
builder.Services.AddEndpointsApiExplorer();
|
||||
builder.Services.AddRateLimiter(options =>
|
||||
{
|
||||
options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
|
||||
options.AddPolicy("auth", context => RateLimitPartition.GetFixedWindowLimiter(
|
||||
context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
|
||||
_ => new FixedWindowRateLimiterOptions
|
||||
{
|
||||
PermitLimit = 10,
|
||||
Window = TimeSpan.FromMinutes(1),
|
||||
QueueLimit = 0,
|
||||
AutoReplenishment = true
|
||||
}));
|
||||
});
|
||||
|
||||
builder.Services.AddSwaggerGen(c =>
|
||||
{
|
||||
|
|
@ -45,11 +60,24 @@ builder.Services.AddDbContext<AppDbContext>(options =>
|
|||
builder.Services.AddScoped<IAuthService, AuthService>();
|
||||
builder.Services.AddScoped<ILlmProxyService, LlmProxyService>();
|
||||
builder.Services.AddScoped<ISttProxyService, SttProxyService>();
|
||||
builder.Services.AddScoped<IAdminOperationService, AdminOperationService>();
|
||||
|
||||
// JWT Authentication Configuration
|
||||
var secretKey = builder.Configuration["Jwt:SecretKey"]
|
||||
?? builder.Configuration["JWT_SECRET"]
|
||||
?? "D3ROVoice_Super_Secure_Secret_Key_2026_Key!";
|
||||
var secretKey = builder.Configuration["JWT_SECRET"];
|
||||
if (string.IsNullOrWhiteSpace(secretKey) || Encoding.UTF8.GetByteCount(secretKey) < 32)
|
||||
{
|
||||
throw new InvalidOperationException("JWT_SECRET must contain at least 32 non-whitespace bytes.");
|
||||
}
|
||||
var jwtIssuer = builder.Configuration["JWT_ISSUER"];
|
||||
if (string.IsNullOrWhiteSpace(jwtIssuer))
|
||||
{
|
||||
throw new InvalidOperationException("JWT_ISSUER is required.");
|
||||
}
|
||||
var jwtAudience = builder.Configuration["JWT_AUDIENCE"];
|
||||
if (string.IsNullOrWhiteSpace(jwtAudience))
|
||||
{
|
||||
throw new InvalidOperationException("JWT_AUDIENCE is required.");
|
||||
}
|
||||
var keyBytes = Encoding.UTF8.GetBytes(secretKey);
|
||||
|
||||
builder.Services.AddAuthentication(options =>
|
||||
|
|
@ -59,25 +87,103 @@ builder.Services.AddAuthentication(options =>
|
|||
})
|
||||
.AddJwtBearer(options =>
|
||||
{
|
||||
options.RequireHttpsMetadata = false;
|
||||
options.RequireHttpsMetadata = !builder.Environment.IsDevelopment();
|
||||
options.SaveToken = true;
|
||||
options.TokenValidationParameters = new TokenValidationParameters
|
||||
{
|
||||
ValidateIssuerSigningKey = true,
|
||||
IssuerSigningKey = new SymmetricSecurityKey(keyBytes),
|
||||
ValidateIssuer = false,
|
||||
ValidateAudience = false,
|
||||
ValidateIssuer = true,
|
||||
ValidIssuer = jwtIssuer,
|
||||
ValidateAudience = true,
|
||||
ValidAudience = jwtAudience,
|
||||
RequireExpirationTime = true,
|
||||
ValidateLifetime = true,
|
||||
ClockSkew = TimeSpan.Zero
|
||||
};
|
||||
});
|
||||
|
||||
static string NormalizeAdminRole(string value) =>
|
||||
value.Replace("_", string.Empty, StringComparison.Ordinal)
|
||||
.Replace("-", string.Empty, StringComparison.Ordinal)
|
||||
.Trim()
|
||||
.ToLowerInvariant();
|
||||
|
||||
builder.Services.AddAuthorization(options =>
|
||||
{
|
||||
options.AddPolicy("ManagerOrAbove", policy =>
|
||||
policy.RequireAuthenticatedUser().RequireAssertion(context =>
|
||||
context.User.Claims
|
||||
.Where(claim => claim.Type == System.Security.Claims.ClaimTypes.Role || claim.Type == "role")
|
||||
.Select(claim => NormalizeAdminRole(claim.Value))
|
||||
.Any(role => role is "manager" or "admin" or "superadmin")));
|
||||
options.AddPolicy("AdminOrAbove", policy =>
|
||||
policy.RequireAuthenticatedUser().RequireAssertion(context =>
|
||||
context.User.Claims
|
||||
.Where(claim => claim.Type == System.Security.Claims.ClaimTypes.Role || claim.Type == "role")
|
||||
.Select(claim => NormalizeAdminRole(claim.Value))
|
||||
.Any(role => role is "admin" or "superadmin")));
|
||||
options.AddPolicy("SuperAdminOnly", policy =>
|
||||
policy.RequireAuthenticatedUser().RequireAssertion(context =>
|
||||
context.User.Claims
|
||||
.Where(claim => claim.Type == System.Security.Claims.ClaimTypes.Role || claim.Type == "role")
|
||||
.Select(claim => NormalizeAdminRole(claim.Value))
|
||||
.Any(role => role is "superadmin")));
|
||||
});
|
||||
|
||||
var corsOriginsRaw = builder.Configuration["Cors:AllowedOrigins"]
|
||||
?? builder.Configuration["CORS_ALLOWED_ORIGINS"];
|
||||
if (string.IsNullOrWhiteSpace(corsOriginsRaw))
|
||||
{
|
||||
if (!builder.Environment.IsDevelopment())
|
||||
{
|
||||
throw new InvalidOperationException("CORS_ALLOWED_ORIGINS is required outside Development.");
|
||||
}
|
||||
|
||||
corsOriginsRaw = "http://localhost:3000,http://localhost:3001,http://localhost:5173";
|
||||
}
|
||||
|
||||
var corsOrigins = corsOriginsRaw
|
||||
.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
|
||||
.Select(origin => origin.TrimEnd('/'))
|
||||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||||
.ToArray();
|
||||
if (corsOrigins.Length == 0 || corsOrigins.Any(origin =>
|
||||
!Uri.TryCreate(origin, UriKind.Absolute, out var uri)
|
||||
|| (uri.Scheme != Uri.UriSchemeHttps && uri.Scheme != Uri.UriSchemeHttp)
|
||||
|| !string.IsNullOrEmpty(uri.UserInfo)
|
||||
|| !string.IsNullOrEmpty(uri.Query)
|
||||
|| !string.IsNullOrEmpty(uri.Fragment)
|
||||
|| uri.AbsolutePath != "/"))
|
||||
{
|
||||
throw new InvalidOperationException("CORS_ALLOWED_ORIGINS must be a comma-separated list of HTTP(S) origins without paths or wildcards.");
|
||||
}
|
||||
|
||||
var allowedHosts = builder.Configuration["ALLOWED_HOSTS"];
|
||||
if (string.IsNullOrWhiteSpace(allowedHosts))
|
||||
{
|
||||
if (!builder.Environment.IsDevelopment())
|
||||
{
|
||||
throw new InvalidOperationException("ALLOWED_HOSTS is required outside Development.");
|
||||
}
|
||||
|
||||
allowedHosts = "localhost;127.0.0.1";
|
||||
}
|
||||
if (allowedHosts.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
|
||||
.Any(host => host == "*" || host.Contains('/') || host.Contains('\\')))
|
||||
{
|
||||
throw new InvalidOperationException("ALLOWED_HOSTS must contain explicit semicolon-separated host names without wildcards or paths.");
|
||||
}
|
||||
builder.Configuration["AllowedHosts"] = allowedHosts;
|
||||
|
||||
builder.Services.AddCors(options =>
|
||||
{
|
||||
options.AddPolicy("AllowAll", policy =>
|
||||
options.AddPolicy("ConfiguredOrigins", policy =>
|
||||
{
|
||||
policy.AllowAnyOrigin()
|
||||
policy.WithOrigins(corsOrigins)
|
||||
.AllowAnyMethod()
|
||||
.AllowAnyHeader();
|
||||
.AllowAnyHeader()
|
||||
.SetPreflightMaxAge(TimeSpan.FromHours(1));
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -88,6 +194,75 @@ using (var scope = app.Services.CreateScope())
|
|||
{
|
||||
var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
|
||||
db.Database.EnsureCreated();
|
||||
db.Database.ExecuteSqlRaw("""
|
||||
CREATE TABLE IF NOT EXISTS "AdminOperationRequests" (
|
||||
"Id" INTEGER NOT NULL CONSTRAINT "PK_AdminOperationRequests" PRIMARY KEY AUTOINCREMENT,
|
||||
"ActorEmail" TEXT NOT NULL,
|
||||
"IdempotencyKey" TEXT NOT NULL,
|
||||
"Operation" TEXT NOT NULL,
|
||||
"RequestHash" TEXT NOT NULL,
|
||||
"ResponseJson" TEXT NOT NULL,
|
||||
"CreatedAt" TEXT NOT NULL
|
||||
);
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS "IX_AdminOperationRequests_ActorEmail_IdempotencyKey"
|
||||
ON "AdminOperationRequests" ("ActorEmail", "IdempotencyKey");
|
||||
CREATE TABLE IF NOT EXISTS "AdminAuditEntries" (
|
||||
"Id" INTEGER NOT NULL CONSTRAINT "PK_AdminAuditEntries" PRIMARY KEY AUTOINCREMENT,
|
||||
"ActorEmail" TEXT NOT NULL,
|
||||
"Action" TEXT NOT NULL,
|
||||
"TargetType" TEXT NOT NULL,
|
||||
"TargetId" TEXT NOT NULL,
|
||||
"BeforeJson" TEXT NULL,
|
||||
"AfterJson" TEXT NULL,
|
||||
"Memo" TEXT NOT NULL,
|
||||
"IdempotencyKey" TEXT NOT NULL,
|
||||
"CreatedAt" TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS "IX_AdminAuditEntries_CreatedAt"
|
||||
ON "AdminAuditEntries" ("CreatedAt");
|
||||
""");
|
||||
|
||||
// The former repository-wide SHA-256 password scheme and seeded admin
|
||||
// credentials are compromised by design. Disable those rows so they can
|
||||
// never authenticate; an operator provisions the administrator either via
|
||||
// the one-time bootstrap token or the ADMIN_EMAIL/ADMIN_PASSWORD env pair
|
||||
// below (auto-created only when no active administrator exists).
|
||||
var legacyPasswordUsers = db.Users
|
||||
.Where(user => !user.PasswordHash.StartsWith("AQAAAA"))
|
||||
.ToList();
|
||||
if (legacyPasswordUsers.Count > 0)
|
||||
{
|
||||
foreach (var legacyUser in legacyPasswordUsers)
|
||||
{
|
||||
legacyUser.IsActive = false;
|
||||
legacyUser.Role = "LegacyDisabled";
|
||||
}
|
||||
db.SaveChanges();
|
||||
}
|
||||
|
||||
// .env 기반 관리자 프로비저닝: 활성 관리자가 없을 때만 ADMIN_EMAIL/ADMIN_PASSWORD
|
||||
// 로 SuperAdmin을 자동 생성한다(멱등 — 이미 있으면 건드리지 않는다).
|
||||
var envAdminEmail = builder.Configuration["ADMIN_EMAIL"]?.Trim().ToLowerInvariant() ?? string.Empty;
|
||||
var envAdminPassword = builder.Configuration["ADMIN_PASSWORD"] ?? string.Empty;
|
||||
if (
|
||||
envAdminEmail.Length >= 3
|
||||
&& envAdminEmail.Contains('@')
|
||||
&& envAdminPassword.Length >= 8
|
||||
&& !db.Users.Any(u => u.IsActive)
|
||||
)
|
||||
{
|
||||
var envAdmin = new User
|
||||
{
|
||||
Email = envAdminEmail,
|
||||
Role = "SuperAdmin",
|
||||
CreatedAt = DateTime.UtcNow,
|
||||
IsActive = true,
|
||||
};
|
||||
envAdmin.PasswordHash = new PasswordHasher<User>().HashPassword(envAdmin, envAdminPassword);
|
||||
db.Users.Add(envAdmin);
|
||||
db.SaveChanges();
|
||||
Console.WriteLine($"Provisioned SuperAdmin from ADMIN_EMAIL env: {envAdminEmail}");
|
||||
}
|
||||
|
||||
// Default Model Endpoints if empty
|
||||
if (!db.ModelEndpoints.Any())
|
||||
|
|
@ -205,47 +380,78 @@ using (var scope = app.Services.CreateScope())
|
|||
db.SaveChanges();
|
||||
}
|
||||
|
||||
// Default Admin User seed & update password to Test1234!
|
||||
var adminUser = db.Users.FirstOrDefault(u => u.Email == "admin" || u.Email == "admin@d3ro.voice");
|
||||
var passwordHash = AuthService.HashPassword("Test1234!");
|
||||
if (adminUser == null)
|
||||
{
|
||||
db.Users.AddRange(
|
||||
new User
|
||||
{
|
||||
Email = "admin",
|
||||
PasswordHash = passwordHash,
|
||||
Role = "SuperAdmin",
|
||||
CreatedAt = DateTime.UtcNow,
|
||||
IsActive = true
|
||||
},
|
||||
new User
|
||||
{
|
||||
Email = "admin@d3ro.voice",
|
||||
PasswordHash = passwordHash,
|
||||
Role = "SuperAdmin",
|
||||
CreatedAt = DateTime.UtcNow,
|
||||
IsActive = true
|
||||
}
|
||||
);
|
||||
db.SaveChanges();
|
||||
}
|
||||
else
|
||||
{
|
||||
adminUser.PasswordHash = passwordHash;
|
||||
adminUser.Role = "SuperAdmin";
|
||||
adminUser.IsActive = true;
|
||||
db.SaveChanges();
|
||||
}
|
||||
// Administrative accounts are never seeded with repository credentials.
|
||||
// Provisioning is performed through the authenticated one-time bootstrap flow.
|
||||
}
|
||||
|
||||
app.UseSwagger();
|
||||
app.UseSwaggerUI();
|
||||
if (app.Environment.IsDevelopment())
|
||||
{
|
||||
app.UseSwagger();
|
||||
app.UseSwaggerUI();
|
||||
}
|
||||
|
||||
app.UseCors("AllowAll");
|
||||
app.UseCors("ConfiguredOrigins");
|
||||
app.Use(async (context, next) =>
|
||||
{
|
||||
var isInvitePage =
|
||||
context.Request.Path.StartsWithSegments("/accept-invite")
|
||||
|| context.Request.Path.Equals("/accept-invite.html");
|
||||
|
||||
if (isInvitePage)
|
||||
{
|
||||
context.Response.OnStarting(() =>
|
||||
{
|
||||
// The invite token lives in the query string. Do not cache the page and
|
||||
// prevent CDN HTML transforms (including analytics script injection).
|
||||
context.Response.Headers["Cache-Control"] = "no-store, no-transform";
|
||||
context.Response.Headers["Content-Security-Policy"] =
|
||||
"default-src 'self'; base-uri 'none'; connect-src 'none'; font-src 'self'; " +
|
||||
"form-action 'none'; frame-ancestors 'none'; img-src 'self' data:; " +
|
||||
"object-src 'none'; script-src 'self'; style-src 'self'";
|
||||
context.Response.Headers["Permissions-Policy"] =
|
||||
"camera=(), microphone=(), geolocation=(), payment=(), usb=()";
|
||||
context.Response.Headers["Referrer-Policy"] = "no-referrer";
|
||||
context.Response.Headers["X-Content-Type-Options"] = "nosniff";
|
||||
context.Response.Headers["X-Frame-Options"] = "DENY";
|
||||
return Task.CompletedTask;
|
||||
});
|
||||
}
|
||||
|
||||
if (context.Request.Path.Equals("/accept-invite"))
|
||||
{
|
||||
context.Response.StatusCode = StatusCodes.Status308PermanentRedirect;
|
||||
context.Response.Headers.Location = $"/accept-invite/{context.Request.QueryString}";
|
||||
return;
|
||||
}
|
||||
|
||||
await next();
|
||||
});
|
||||
app.UseDefaultFiles();
|
||||
// Historical mobile binaries remain in the checkout for forensics only. They
|
||||
// are not official releases and must never be reachable through StaticFiles.
|
||||
app.Use(async (context, next) =>
|
||||
{
|
||||
var requestPath = context.Request.Path.Value ?? string.Empty;
|
||||
var fileName = Path.GetFileName(requestPath);
|
||||
var legacyMarketingAsset = requestPath.Equals("/assets/index-D7M5UQvT.js", StringComparison.OrdinalIgnoreCase)
|
||||
|| requestPath.Equals("/assets/index-JlYFxlAJ.js", StringComparison.OrdinalIgnoreCase);
|
||||
var mobileReleasePath = requestPath.StartsWith("/releases/", StringComparison.OrdinalIgnoreCase)
|
||||
&& (fileName.EndsWith(".apk", StringComparison.OrdinalIgnoreCase)
|
||||
|| fileName.EndsWith(".aab", StringComparison.OrdinalIgnoreCase)
|
||||
|| (fileName.EndsWith(".zip", StringComparison.OrdinalIgnoreCase)
|
||||
&& (fileName.Contains("android", StringComparison.OrdinalIgnoreCase)
|
||||
|| fileName.Contains("signed", StringComparison.OrdinalIgnoreCase))));
|
||||
if (mobileReleasePath || legacyMarketingAsset)
|
||||
{
|
||||
context.Response.StatusCode = StatusCodes.Status404NotFound;
|
||||
return;
|
||||
}
|
||||
await next();
|
||||
});
|
||||
|
||||
app.UseStaticFiles();
|
||||
|
||||
app.UseRateLimiter();
|
||||
app.UseAuthentication();
|
||||
app.UseAuthorization();
|
||||
|
||||
|
|
@ -272,7 +478,10 @@ app.MapGet("/api/health", () => Results.Ok(new
|
|||
|
||||
app.MapControllers();
|
||||
|
||||
app.MapFallbackToFile("/accept-invite", "accept-invite.html");
|
||||
// Fallback to Admin BackOffice UI index.html
|
||||
app.MapFallbackToFile("/admin/{*path}", "admin/index.html");
|
||||
|
||||
app.Run();
|
||||
|
||||
public partial class Program { }
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue