fix: permission checks for speedId and inPort + multi-node IP constraints (#261)

* feat: restrict user permissions and multi-node IP constraints

- Non-admin users cannot set speedId or inPort on forward create/update
- Multi-entrance tunnels disable custom listen IP for forwards
- Multi-exit tunnels disable custom connect IP
- Multi-node hop chains disable custom connect IP per hop
- Remove tunnel-first-IP fallback in forward ingress resolution
- Add contract tests for non-admin permission restrictions

Entire-Checkpoint: 133693290660

* fix: allow non-admin users to submit null speedId and zero inPort

- Backend: Check speedId is not nil before rejecting non-admin requests
- Backend: Only reject inPort if value > 0 for non-admin users
- Frontend: Only include speedId and inPort in payload for admin users
- Tests: Add contract tests for null speedId and zero inPort cases

go-backend/internal/http/handler/mutations.go

@@ -1154,13 +1154,16 @@ func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if roleID != 0 {
-		if _, ok := req["speedId"]; ok {
+		if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil {
 			response.WriteJSON(w, response.Err(-1, "普通用户无法设置限速规则"))
 			return
 		}
-		if _, ok := req["inPort"]; ok {
-			response.WriteJSON(w, response.Err(-1, "普通用户无法设置自定义端口"))
-			return
+		if inPortVal, ok := req["inPort"]; ok {
+			port := asInt(inPortVal, 0)
+			if port > 0 {
+				response.WriteJSON(w, response.Err(-1, "普通用户无法设置自定义端口"))
+				return
+			}
 		}
 	}
 	speedID := asAnyToInt64Ptr(req["speedId"])
@@ -1274,13 +1277,16 @@ func (h *Handler) forwardUpdate(w http.ResponseWriter, r *http.Request) {
 		strategy = forward.Strategy
 	}
 	if actorRole != 0 {
-		if _, ok := req["speedId"]; ok {
+		if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil {
 			response.WriteJSON(w, response.Err(-1, "普通用户无法修改限速规则"))
 			return
 		}
-		if _, ok := req["inPort"]; ok {
-			response.WriteJSON(w, response.Err(-1, "普通用户无法修改自定义端口"))
-			return
+		if inPortVal, ok := req["inPort"]; ok {
+			port := asInt(inPortVal, 0)
+			if port > 0 {
+				response.WriteJSON(w, response.Err(-1, "普通用户无法修改自定义端口"))
+				return
+			}
 		}
 	}
 	speedID := asAnyToInt64Ptr(req["speedId"])

go-backend/tests/contract/forward_contract_test.go

@@ -1097,4 +1097,45 @@ func TestNonAdminCannotSetSpeedIdOrPort(t *testing.T) {
 		router.ServeHTTP(res, req)
 		assertCode(t, res, 0)
 	})
+
+	t.Run("non-admin can create with speedId null and inPort 0", func(t *testing.T) {
+		createPayload := map[string]interface{}{
+			"name":       "perm-forward-null-values",
+			"tunnelId":   tunnelID,
+			"remoteAddr": "1.2.3.4:443",
+			"strategy":   "fifo",
+			"speedId":    nil,
+			"inPort":     0,
+		}
+		createBody, err := json.Marshal(createPayload)
+		if err != nil {
+			t.Fatalf("marshal create payload: %v", err)
+		}
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewReader(createBody))
+		req.Header.Set("Authorization", userToken)
+		req.Header.Set("Content-Type", "application/json")
+		res := httptest.NewRecorder()
+		router.ServeHTTP(res, req)
+		assertCode(t, res, 0)
+	})
+
+	t.Run("non-admin can update with speedId null", func(t *testing.T) {
+		updatePayload := map[string]interface{}{
+			"id":         forwardID,
+			"name":       "perm-forward-null-speed",
+			"tunnelId":   tunnelID,
+			"remoteAddr": "9.10.11.12:443",
+			"speedId":    nil,
+		}
+		updateBody, err := json.Marshal(updatePayload)
+		if err != nil {
+			t.Fatalf("marshal update payload: %v", err)
+		}
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/update", bytes.NewReader(updateBody))
+		req.Header.Set("Authorization", userToken)
+		req.Header.Set("Content-Type", "application/json")
+		res := httptest.NewRecorder()
+		router.ServeHTTP(res, req)
+		assertCode(t, res, 0)
+	})
 }