[功能] 支持为 HTTPS 启用多个证书，更新相关逻辑和测试

openflare_server/model/database_schema_version.go

@@ -4,7 +4,7 @@ import "time"
 
 const (
 	legacyDatabaseSchemaVersion  = 1
-	currentDatabaseSchemaVersion = 6
+	currentDatabaseSchemaVersion = 7
 	databaseSchemaVersionRowID   = 1
 )
 

openflare_server/model/main_test.go

@@ -60,6 +60,35 @@ func (legacyProxyRouteV5) TableName() string {
 	return "proxy_routes"
 }
 
+type legacyProxyRouteV6 struct {
+	ID                 uint   `gorm:"primaryKey"`
+	SiteName           string `gorm:"size:255;not null;default:''"`
+	Domain             string `gorm:"uniqueIndex;size:255;not null"`
+	Domains            string `gorm:"type:text;not null;default:'[]'"`
+	OriginID           *uint  `gorm:"index"`
+	OriginURL          string `gorm:"size:2048;not null"`
+	OriginHost         string `gorm:"size:255"`
+	Upstreams          string `gorm:"type:text;not null;default:'[]'"`
+	Enabled            bool   `gorm:"not null;default:true"`
+	EnableHTTPS        bool   `gorm:"column:enable_https;not null;default:false"`
+	CertID             *uint
+	RedirectHTTP       bool   `gorm:"not null;default:false"`
+	LimitConnPerServer int    `gorm:"not null;default:0"`
+	LimitConnPerIP     int    `gorm:"not null;default:0"`
+	LimitRate          string `gorm:"size:32;not null;default:''"`
+	CacheEnabled       bool   `gorm:"not null;default:false"`
+	CachePolicy        string `gorm:"size:32;not null;default:''"`
+	CacheRules         string `gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders      string `gorm:"type:text;not null;default:'[]'"`
+	Remark             string `gorm:"size:255"`
+	CreatedAt          time.Time
+	UpdatedAt          time.Time
+}
+
+func (legacyProxyRouteV6) TableName() string {
+	return "proxy_routes"
+}
+
 func openBareTestSQLiteDB(t *testing.T, name string) *gorm.DB {
 	t.Helper()
 
@@ -649,6 +678,82 @@ func TestEnsureDatabaseSchemaUpToDateAddsProxyRouteRateLimitFields(t *testing.T)
 	}
 }
 
+func TestEnsureDatabaseSchemaUpToDateAddsProxyRouteCertificateListFields(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-proxy-route-cert-ids.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	for _, item := range registeredModels() {
+		if _, ok := item.(*ProxyRoute); ok {
+			continue
+		}
+		if err := db.AutoMigrate(item); err != nil {
+			t.Fatalf("auto migrate supporting table: %v", err)
+		}
+	}
+	if err := db.AutoMigrate(&legacyProxyRouteV6{}); err != nil {
+		t.Fatalf("auto migrate legacy proxy_routes v6: %v", err)
+	}
+
+	now := time.Now().UTC()
+	certID := uint(9)
+	if err := db.Create(&legacyProxyRouteV6{
+		SiteName:           "secure-site",
+		Domain:             "secure.example.com",
+		Domains:            `["secure.example.com","www.secure.example.com"]`,
+		OriginURL:          "https://origin-secure.internal:8443",
+		Upstreams:          `["https://origin-secure.internal:8443"]`,
+		Enabled:            true,
+		EnableHTTPS:        true,
+		CertID:             &certID,
+		RedirectHTTP:       true,
+		LimitConnPerServer: 120,
+		LimitConnPerIP:     12,
+		LimitRate:          "512k",
+		CacheEnabled:       false,
+		CachePolicy:        "",
+		CacheRules:         `[]`,
+		CustomHeaders:      `[]`,
+		CreatedAt:          now,
+		UpdatedAt:          now,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy proxy route v6: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 6); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	var route ProxyRoute
+	if err := db.First(&route).Error; err != nil {
+		t.Fatalf("query migrated proxy route: %v", err)
+	}
+	if route.CertID == nil || *route.CertID != certID {
+		t.Fatalf("expected cert_id mirror to be preserved, got %+v", route.CertID)
+	}
+
+	var certIDs []uint
+	if err := json.Unmarshal([]byte(route.CertIDs), &certIDs); err != nil {
+		t.Fatalf("decode migrated cert_ids: %v", err)
+	}
+	if len(certIDs) != 1 || certIDs[0] != certID {
+		t.Fatalf("unexpected migrated cert_ids: %#v", certIDs)
+	}
+}
+
 func TestRunDatabaseSchemaMigrationDoesNotAdvanceVersionWhenValidationFails(t *testing.T) {
 	db := openBareTestSQLiteDB(t, "failed-validation.db")
 

openflare_server/model/migrations.go

@@ -330,6 +330,85 @@ func ensureProxyRouteSiteNameUniqueIndex(db *gorm.DB) error {
 	return db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_proxy_routes_site_name ON proxy_routes(site_name)`).Error
 }
 
+func decodeProxyRouteCertIDsForMigration(raw string, fallbackCertID *uint) ([]uint, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		if fallbackCertID == nil || *fallbackCertID == 0 {
+			return []uint{}, nil
+		}
+		return []uint{*fallbackCertID}, nil
+	}
+
+	var certIDs []uint
+	if err := json.Unmarshal([]byte(text), &certIDs); err != nil {
+		return nil, fmt.Errorf("decode proxy route cert_ids failed: %w", err)
+	}
+
+	normalized := make([]uint, 0, len(certIDs))
+	seen := make(map[uint]struct{}, len(certIDs))
+	for _, certID := range certIDs {
+		if certID == 0 {
+			continue
+		}
+		if _, ok := seen[certID]; ok {
+			continue
+		}
+		seen[certID] = struct{}{}
+		normalized = append(normalized, certID)
+	}
+	if len(normalized) == 0 && fallbackCertID != nil && *fallbackCertID != 0 {
+		return []uint{*fallbackCertID}, nil
+	}
+	return normalized, nil
+}
+
+func backfillProxyRouteCertificateFields(db *gorm.DB) error {
+	if db == nil {
+		return fmt.Errorf("database handle is nil")
+	}
+	if !db.Migrator().HasTable(&ProxyRoute{}) {
+		return nil
+	}
+	if !db.Migrator().HasColumn(&ProxyRoute{}, "cert_ids") {
+		return nil
+	}
+
+	var routes []ProxyRoute
+	if err := db.Order("id asc").Find(&routes).Error; err != nil {
+		return fmt.Errorf("list proxy routes for certificate field backfill failed: %w", err)
+	}
+	for _, route := range routes {
+		certIDs, err := decodeProxyRouteCertIDsForMigration(route.CertIDs, route.CertID)
+		if err != nil {
+			return fmt.Errorf("normalize proxy route %d cert_ids failed: %w", route.ID, err)
+		}
+		certIDsJSON, err := json.Marshal(certIDs)
+		if err != nil {
+			return fmt.Errorf("encode proxy route %d cert_ids failed: %w", route.ID, err)
+		}
+
+		var primaryCertID *uint
+		if len(certIDs) > 0 {
+			primaryCertID = &certIDs[0]
+		}
+
+		updates := make(map[string]any, 2)
+		if strings.TrimSpace(route.CertIDs) != string(certIDsJSON) {
+			updates["cert_ids"] = string(certIDsJSON)
+		}
+		if (route.CertID == nil) != (primaryCertID == nil) || (route.CertID != nil && primaryCertID != nil && *route.CertID != *primaryCertID) {
+			updates["cert_id"] = primaryCertID
+		}
+		if len(updates) == 0 {
+			continue
+		}
+		if err := db.Model(&ProxyRoute{}).Where("id = ?", route.ID).Updates(updates).Error; err != nil {
+			return fmt.Errorf("update proxy route %d certificate fields failed: %w", route.ID, err)
+		}
+	}
+	return nil
+}
+
 func validateDatabaseSchemaV5(db *gorm.DB, backend string) error {
 	if err := validateDatabaseSchemaV4(db, backend); err != nil {
 		return err
@@ -400,6 +479,42 @@ func validateDatabaseSchemaV6(db *gorm.DB, backend string) error {
 	return nil
 }
 
+func validateDatabaseSchemaV7(db *gorm.DB, backend string) error {
+	if err := validateDatabaseSchemaV6(db, backend); err != nil {
+		return err
+	}
+	if !db.Migrator().HasColumn(&ProxyRoute{}, "cert_ids") {
+		return fmt.Errorf("column proxy_routes.cert_ids is missing")
+	}
+
+	var routes []ProxyRoute
+	if err := db.Order("id asc").Find(&routes).Error; err != nil {
+		return fmt.Errorf("list proxy routes for certificate validation failed: %w", err)
+	}
+	for _, route := range routes {
+		certIDs, err := decodeProxyRouteCertIDsForMigration(route.CertIDs, route.CertID)
+		if err != nil {
+			return fmt.Errorf("proxy route %d cert_ids are invalid: %w", route.ID, err)
+		}
+		if route.EnableHTTPS && len(certIDs) == 0 {
+			return fmt.Errorf("proxy route %d has https enabled without cert_ids", route.ID)
+		}
+		if !route.EnableHTTPS && route.RedirectHTTP {
+			return fmt.Errorf("proxy route %d enables redirect_http without https", route.ID)
+		}
+		if len(certIDs) == 0 {
+			if route.CertID != nil {
+				return fmt.Errorf("proxy route %d primary cert_id mirror is invalid", route.ID)
+			}
+			continue
+		}
+		if route.CertID == nil || *route.CertID != certIDs[0] {
+			return fmt.Errorf("proxy route %d primary cert_id mirror is invalid", route.ID)
+		}
+	}
+	return nil
+}
+
 func renameLegacyObservabilityShardTables(db *gorm.DB) error {
 	for _, baseTable := range shardedObservabilityBaseTables() {
 		for _, table := range observabilityShardTables(baseTable) {
@@ -768,6 +883,24 @@ func migrateV6(db *gorm.DB, backend string) error {
 	return ensureProxyRouteSiteNameUniqueIndex(db)
 }
 
+// migrateV7 adds structured website-level certificate lists to proxy_routes
+// while keeping cert_id as the primary certificate compatibility mirror.
+func migrateV7(db *gorm.DB, backend string) error {
+	if err := applyCurrentSchema(db, backend); err != nil {
+		return err
+	}
+	if err := backfillOriginsFromProxyRoutes(db); err != nil {
+		return err
+	}
+	if err := backfillProxyRouteSiteFields(db); err != nil {
+		return err
+	}
+	if err := ensureProxyRouteSiteNameUniqueIndex(db); err != nil {
+		return err
+	}
+	return backfillProxyRouteCertificateFields(db)
+}
+
 func databaseSchemaMigrations() []databaseSchemaMigration {
 	return []databaseSchemaMigration{
 		{fromVersion: 1, toVersion: 2, migrate: migrateV2, validate: validateDatabaseSchemaV2},
@@ -775,6 +908,7 @@ func databaseSchemaMigrations() []databaseSchemaMigration {
 		{fromVersion: 3, toVersion: 4, migrate: migrateV4, validate: validateDatabaseSchemaV4},
 		{fromVersion: 4, toVersion: 5, migrate: migrateV5, validate: validateDatabaseSchemaV5},
 		{fromVersion: 5, toVersion: 6, migrate: migrateV6, validate: validateDatabaseSchemaV6},
+		{fromVersion: 6, toVersion: 7, migrate: migrateV7, validate: validateDatabaseSchemaV7},
 	}
 }
 
@@ -851,7 +985,10 @@ func initializeFreshDatabaseSchema(db *gorm.DB, backend string) error {
 	if err := ensureProxyRouteSiteNameUniqueIndex(db); err != nil {
 		return err
 	}
-	if err := validateDatabaseSchemaV6(db, backend); err != nil {
+	if err := backfillProxyRouteCertificateFields(db); err != nil {
+		return err
+	}
+	if err := validateDatabaseSchemaV7(db, backend); err != nil {
 		return err
 	}
 	return saveDatabaseSchemaVersion(db, currentDatabaseSchemaVersion)

openflare_server/model/proxy_route.go

@@ -14,6 +14,7 @@ type ProxyRoute struct {
 	Enabled            bool      `json:"enabled" gorm:"not null;default:true"`
 	EnableHTTPS        bool      `json:"enable_https" gorm:"column:enable_https;not null;default:false"`
 	CertID             *uint     `json:"cert_id"`
+	CertIDs            string    `json:"cert_ids" gorm:"type:text;not null;default:'[]'"`
 	RedirectHTTP       bool      `json:"redirect_http" gorm:"not null;default:false"`
 	LimitConnPerServer int       `json:"limit_conn_per_server" gorm:"not null;default:0"`
 	LimitConnPerIP     int       `json:"limit_conn_per_ip" gorm:"not null;default:0"`
@@ -64,6 +65,7 @@ func (route *ProxyRoute) Update() error {
 		"enabled":               route.Enabled,
 		"enable_https":          route.EnableHTTPS,
 		"cert_id":               route.CertID,
+		"cert_ids":              route.CertIDs,
 		"redirect_http":         route.RedirectHTTP,
 		"limit_conn_per_server": route.LimitConnPerServer,
 		"limit_conn_per_ip":     route.LimitConnPerIP,