superidou
9501751792
三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
>4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)
32 lines
1.8 KiB
SQL
32 lines
1.8 KiB
SQL
-- M9 P3: agent node registry and heartbeat metadata.
|
|
-- Node tokens are stored as SHA-256 digests and are only returned at create /
|
|
-- rotation time. Heartbeat payloads are bounded metadata, not task content.
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway.agent_nodes (
|
|
id uuid PRIMARY KEY,
|
|
code text NOT NULL UNIQUE CHECK (length(code) BETWEEN 1 AND 128),
|
|
name text NOT NULL CHECK (length(name) BETWEEN 1 AND 128),
|
|
description text NOT NULL DEFAULT '' CHECK (length(description) <= 4000),
|
|
endpoint text NOT NULL DEFAULT '' CHECK (length(endpoint) <= 512),
|
|
node_type text NOT NULL DEFAULT 'worker' CHECK (node_type IN ('worker', 'gateway', 'executor')),
|
|
pool_type text NOT NULL DEFAULT 'private' CHECK (pool_type IN ('public', 'private')),
|
|
pool_code text NOT NULL DEFAULT 'default' CHECK (length(pool_code) BETWEEN 1 AND 64),
|
|
enabled boolean NOT NULL DEFAULT true,
|
|
token_prefix text NOT NULL CHECK (length(token_prefix) BETWEEN 4 AND 32),
|
|
token_hash bytea NOT NULL CHECK (octet_length(token_hash) = 32),
|
|
version text NOT NULL DEFAULT '' CHECK (length(version) <= 128),
|
|
capabilities jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(capabilities) = 'object'),
|
|
metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),
|
|
last_heartbeat_at timestamptz,
|
|
last_heartbeat_ip inet,
|
|
last_error text NOT NULL DEFAULT '' CHECK (length(last_error) <= 4000),
|
|
created_by uuid REFERENCES gateway.admin_accounts(id),
|
|
created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS agent_nodes_pool_idx
|
|
ON gateway.agent_nodes (pool_type, pool_code, enabled, updated_at DESC);
|
|
CREATE INDEX IF NOT EXISTS agent_nodes_heartbeat_idx
|
|
ON gateway.agent_nodes (last_heartbeat_at DESC NULLS LAST, enabled);
|