feat(backend): support federation-based remote node diagnosis

Route diagnosis for shared remote nodes through federation runtime APIs so tunnel and forward diagnostics work across panels, and add contract coverage for single-panel and dual-panel scenarios.

go-backend/internal/http/client/federation.go

@@ -69,6 +69,13 @@ type RuntimeReleaseRoleRequest struct {
 	ResourceKey   string `json:"resourceKey"`
 }
 
+type RuntimeDiagnoseRequest struct {
+	IP      string `json:"ip"`
+	Port    int    `json:"port"`
+	Count   int    `json:"count"`
+	Timeout int    `json:"timeout"`
+}
+
 func NewFederationClient() *FederationClient {
 	return &FederationClient{
 		client: &http.Client{
@@ -274,3 +281,46 @@ func (c *FederationClient) ReleaseRole(url, token, localDomain string, reqData R
 
 	return nil
 }
+
+func (c *FederationClient) Diagnose(url, token, localDomain string, reqData RuntimeDiagnoseRequest) (map[string]interface{}, error) {
+	url = strings.TrimSuffix(url, "/")
+	bodyBytes, _ := json.Marshal(reqData)
+	req, err := http.NewRequest("POST", url+"/api/v1/federation/runtime/diagnose", strings.NewReader(string(bodyBytes)))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	if localDomain != "" {
+		req.Header.Set("X-Panel-Domain", localDomain)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
+	}
+
+	var res struct {
+		Code int                    `json:"code"`
+		Msg  string                 `json:"msg"`
+		Data map[string]interface{} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return nil, err
+	}
+	if res.Code != 0 {
+		return nil, fmt.Errorf("remote api error: %s", res.Msg)
+	}
+
+	if res.Data == nil {
+		return nil, fmt.Errorf("remote api error: empty diagnosis payload")
+	}
+
+	return res.Data, nil
+}

go-backend/internal/http/handler/control_plane.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"go-backend/internal/http/client"
 	"go-backend/internal/ws"
 )
 
@@ -791,7 +792,15 @@ func (h *Handler) appendPathDiagnosis(results *[]map[string]interface{}, nodeCac
 	}
 	item["nodeName"] = fromNode.Name
 
-	pingData, pingErr := h.tcpPingViaNode(fromNodeID, targetIP, targetPort)
+	var (
+		pingData map[string]interface{}
+		pingErr  error
+	)
+	if fromNode.IsRemote == 1 {
+		pingData, pingErr = h.tcpPingViaRemoteNode(fromNode, targetIP, targetPort)
+	} else {
+		pingData, pingErr = h.tcpPingViaNode(fromNodeID, targetIP, targetPort)
+	}
 	if pingErr != nil {
 		item["success"] = false
 		item["message"] = pingErr.Error()
@@ -931,6 +940,25 @@ func (h *Handler) tcpPingViaNode(nodeID int64, ip string, port int) (map[string]
 	return res.Data, nil
 }
 
+func (h *Handler) tcpPingViaRemoteNode(node *nodeRecord, ip string, port int) (map[string]interface{}, error) {
+	if node == nil {
+		return nil, errors.New("节点不存在")
+	}
+	remoteURL := strings.TrimSpace(node.RemoteURL)
+	remoteToken := strings.TrimSpace(node.RemoteToken)
+	if remoteURL == "" || remoteToken == "" {
+		return nil, errors.New("远程节点缺少共享配置")
+	}
+
+	fc := client.NewFederationClient()
+	return fc.Diagnose(remoteURL, remoteToken, h.federationLocalDomain(), client.RuntimeDiagnoseRequest{
+		IP:      strings.TrimSpace(ip),
+		Port:    port,
+		Count:   4,
+		Timeout: 5000,
+	})
+}
+
 func splitRemoteTargets(remoteAddr string) []string {
 	parts := strings.Split(remoteAddr, ",")
 	out := make([]string, 0, len(parts))

go-backend/internal/http/handler/federation.go

@@ -65,6 +65,13 @@ type federationRuntimeReleaseRoleRequest struct {
 	ResourceKey   string `json:"resourceKey"`
 }
 
+type federationRuntimeDiagnoseRequest struct {
+	IP      string `json:"ip"`
+	Port    int    `json:"port"`
+	Count   int    `json:"count"`
+	Timeout int    `json:"timeout"`
+}
+
 func (h *Handler) federationShareList(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("Invalid method"))
@@ -731,6 +738,55 @@ func (h *Handler) federationRuntimeReleaseRole(w http.ResponseWriter, r *http.Re
 	response.WriteJSON(w, response.OKEmpty())
 }
 
+func (h *Handler) federationRuntimeDiagnose(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	token := extractBearerToken(r)
+	share, err := h.repo.GetPeerShareByToken(token)
+	if err != nil || share == nil {
+		response.WriteJSON(w, response.Err(401, "Unauthorized"))
+		return
+	}
+
+	var req federationRuntimeDiagnoseRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+
+	req.IP = strings.TrimSpace(req.IP)
+	if req.IP == "" || req.Port <= 0 || req.Port > 65535 {
+		response.WriteJSON(w, response.ErrDefault("Invalid target"))
+		return
+	}
+	if req.Count <= 0 {
+		req.Count = 4
+	}
+	if req.Timeout <= 0 {
+		req.Timeout = 5000
+	}
+
+	res, err := h.sendNodeCommand(share.NodeID, "TcpPing", map[string]interface{}{
+		"ip":      req.IP,
+		"port":    req.Port,
+		"count":   req.Count,
+		"timeout": req.Timeout,
+	}, false, false)
+	if err != nil {
+		response.WriteJSON(w, response.ErrDefault(err.Error()))
+		return
+	}
+	if res.Data == nil {
+		response.WriteJSON(w, response.ErrDefault("Node did not return diagnosis data"))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(res.Data))
+}
+
 func (h *Handler) pickPeerSharePort(share *sqlite.PeerShare, requestedPort int) (int, error) {
 	if share == nil {
 		return 0, fmt.Errorf("share not found")

go-backend/internal/http/handler/handler.go

@@ -161,6 +161,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/federation/runtime/reserve-port", h.authPeer(h.federationRuntimeReservePort))
 	mux.HandleFunc("/api/v1/federation/runtime/apply-role", h.authPeer(h.federationRuntimeApplyRole))
 	mux.HandleFunc("/api/v1/federation/runtime/release-role", h.authPeer(h.federationRuntimeReleaseRole))
+	mux.HandleFunc("/api/v1/federation/runtime/diagnose", h.authPeer(h.federationRuntimeDiagnose))
 	mux.HandleFunc("/api/v1/federation/node/import", h.nodeImport)
 
 	mux.HandleFunc("/flow/test", h.flowTest)

go-backend/internal/http/middleware/auth.go

@@ -91,6 +91,8 @@ func shouldSkip(path string) bool {
 		return true
 	case path == "/api/v1/federation/runtime/release-role":
 		return true
+	case path == "/api/v1/federation/runtime/diagnose":
+		return true
 	default:
 		return false
 	}