Update contact link from group to channel

docs/proxy-protocol-analysis.md

@@ -1,178 +0,0 @@
-# Proxy Protocol 传输分析报告
-
-**日期**: 2026-05-07  
-**测试环境**: 20.118.172.127 (Server 1) ↔ 108.181.90.137 (Server 2)
-
----
-
-## 1. 代码流程分析
-
-### 完整数据链路
-
-```
-前端 (proxyProtocol: 0|1|2)
-  → 后端 handler mutations.go:1936
-  → 数据库存储 forward.proxy_protocol (model.go:50)
-  → 控制面 buildForwardServiceConfigs (control_plane.go:1791-1796)
-  → handler metadata: {"proxyProtocol": 2}
-  → Agent metadata 解析 (metadata.go:42)
-  → handler.go:256 WrapClientConn()
-  → conn.go:14 HeaderProxyFromAddrs(byte(ppv), src, dst)
-  → conn.go:15 header.WriteTo(c)
-  → 目标服务器收到 PROXY protocol header
-```
-
-### 关键代码
-
-**写入 PROXY header** (`go-gost/x/internal/net/proxyproto/conn.go`):
-```go
-func WrapClientConn(ppv int, src, dst net.Addr, c net.Conn) net.Conn {
-    if ppv <= 0 {
-        return c
-    }
-    header := proxyproto.HeaderProxyFromrs(byte(ppv), src, dst)
-    header.WriteTo(c)
-    return c
-}
-```
-
-**Handler 调用** (`go-gost/x/handler/forward/local/handler.go:256`):
-```go
-cc = proxyproto.WrapClientConn(h.md.proxyProtocol, conn.RemoteAddr(), conn.LocalAddr(), cc)
-```
-
-- `src` = `conn.RemoteAddr()` → 客户端真实 IP ✅
-- `dst` = `conn.LocalAddr()` → agent 监听地址 ✅
-- `ppv` = 1 或 2 → 版本号正确 ✅
-
----
-
-## 2. 实际传输测试结果
-
-### 测试方法
-
-1. 在 Server 2 启动 Python TCP 监听器，解析 PROXY protocol header
-2. 在 Server 1 用当前代码编译 gost，配置 `proxyProtocol: 2` 转发到 Server 2
-3. 通过 `nc` 发送测试数据，验证 Server 2 是否收到正确的 PROXY header
-
-### 测试结果
-
-| 版本 | 状态 | 接收到的 Header |
-|------|------|----------------|
-| **PPv2** | ✅ 成功 | `PP2 family=1 alen=12 SRC=127.0.0.1:45410 DST=127.0.0.1:20001` |
-| **PPv1** | ✅ 成功 | `PROXY TCP4 127.0.0.1 127.0.0.1 43816 20001` |
-
-### 测试详情
-
-**PPv2 原始数据**:
-```
-Got 28 bytes
-PP2 family=1 alen=12
-SRC=127.0.0.1:45410 DST=127.0.0.1:20001
-```
-
-**PPv1 原始数据** (hex):
-```
-50524f58592054435034203132372e302e302e31203132372e302e302e312034333831362032303030310d0a
-```
-解码: `PROXY TCP4 127.0.0.1 127.0.0.1 43816 20001`
-
----
-
-## 3. 单元测试结果
-
-```
-go-gost/x/handler/forward/local/  → TestLocalForwardHandlerSendsProxyProtocolToTarget ✅
-go-backend/internal/http/handler/ → TestBuildForwardServiceConfigsSendsProxyProtocolToForwardHandler ✅
-go-backend/internal/store/repo/   → TestGetForwardRecordIncludesProxyProtocol ✅
-```
-
-全部通过 (3/3)。
-
----
-
-## 4. 发现的问题
-
-### 问题 1: `WriteTo` 错误未检查
-
-**位置**: `go-gost/x/internal/net/proxyproto/conn.go:15`
-
-```go
-header.WriteTo(c)  // 返回 (int64, error) 被忽略
-```
-
-**影响**: 如果写入失败（连接已断开、网络错误等），后续数据传输会在没有 PROXY header 的情况下继续，目标服务器可能解析出错。
-
-**建议**:
-```go
-if _, err := header.WriteTo(c); err != nil {
-    return c  // 或包装一个带错误的 conn
-}
-```
-
-**严重程度**: 低（实际场景中，写入失败后 `Transport` 也会很快失败）
-
----
-
-### 问题 2: 部署版本过旧
-
-**服务器状态**:
-
-| 服务器 | 组件 | 版本 | 状态 |
-|--------|------|------|------|
-| 20.118.172.127 | flux_agent | UPX 压缩，无法读取版本 | ✅ 运行中 |
-| 20.118.172.127 | paneld | `/app/paneld` | ✅ 运行中 |
-| 20.118.172.127 | /usr/local/bin/gost | v3.0.0 (go1.23.4) | 旧版，不支持 handler metadata 中的 proxyProtocol |
-| 108.181.90.137 | flux_agent | 8.8MB | ✅ 运行中 |
-
-**影响**: 旧版 gost 二进制不识别 handler metadata 中的 `proxyProtocol` 字段，PROXY protocol 功能在生产环境不可用。
-
-**验证**: 用旧版 gost 测试时，目标服务器收到的原始数据为空，无 PROXY header。
-
----
-
-### 问题 3: 数据库 Schema 缺失
-
-**位置**: 20.118.172.127 的 `/app/data/gost.db`
-
-**当前 forward 表 schema**:
-```sql
-CREATE TABLE `forward` (
-    `id` integer PRIMARY KEY AUTOINCREMENT,
-    `user_id` integer NOT NULL,
-    `user_name` varchar(100) NOT NULL,
-    `name` varchar(100) NOT NULL,
-    `tunnel_id` integer NOT NULL,
-    `remote_addr` text NOT NULL,
-    `strategy` varchar(100) NOT NULL DEFAULT "fifo",
-    `in_flow` integer NOT NULL DEFAULT 0,
-    `out_flow` integer NOT NULL DEFAULT 0,
-    `created_time` integer NOT NULL,
-    `updated_time` integer NOT NULL,
-    `status` integer NOT NULL,
-    `inx` integer NOT NULL DEFAULT 0,
-    `speed_id` integer
-);
-```
-
-**缺失字段**:
-- `proxy_protocol` — PROXY protocol 版本
-- `max_conn` — 最大连接数
-- `ip_max_conn` — 每 IP 最大连接数
-- `ip_speed_id` — 每 IP 限速 ID
-
-**影响**: 后端无法存储和读取 proxy_protocol 配置，前端设置不会生效。
-
----
-
-## 5. 结论
-
-| 维度 | 状态 | 说明 |
-|------|------|------|
-| **代码实现** | ✅ 正确 | 完整的写入链路，版本/地址正确 |
-| **单元测试** | ✅ 通过 | 3/3 测试覆盖 handler、repo、控制面 |
-| **实际传输 (新编译版)** | ✅ 成功 | PPv1 和 PPv2 均正确传输 |
-| **实际传输 (部署版)** | ❌ 不工作 | 旧版不支持 handler metadata 中的 proxyProtocol |
-| **数据库 Schema** | ❌ 缺字段 | 需要迁移添加 proxy_protocol 等列 |
-
-**总结**: 代码实现正确，PROXY protocol 传输逻辑无误。但生产服务器运行的是旧版本，需要升级 backend 和 agent 才能启用此功能。

docs/superpowers/specs/2026-05-04-panel-self-upgrade-design.md

@@ -1,295 +0,0 @@
-# 面板本体一键升级设计
-
-**日期**: 2026-05-04
-**状态**: 待审核
-**作者**: AI Assistant
-
-## 概述
-
-在 FLVX 管理面板中增加“面板升级”能力，使管理员可以在网页上检查 GitHub Release 并触发面板本体升级。目标是升级整套面板，而不是只升级转发节点或只替换后端二进制。
-
-本设计采用 Docker Compose 整套升级方案：后端容器通过受限的 Docker socket 能力更新宿主机部署目录中的 `docker-compose.yml` 和 `.env`，然后启动独立的升级 helper 容器，由 helper 拉取新版 backend/frontend 镜像并重新启动 `backend` 与 `frontend` 服务。
-
-## sub2api 参考结论
-
-sub2api 的一键升级不是在宿主机执行 `docker compose pull/up`。它的运行形态是单体 Go 服务：前端构建产物 embed 到后端二进制，容器内只运行 `/app/sub2api`。升级接口下载 GitHub Release 中匹配当前系统和架构的 `sub2api_<version>_<os>_<arch>.tar.gz` 以及 `checksums.txt`，校验后把当前 `os.Executable()` 指向的 `/app/sub2api` 改名为 `/app/sub2api.backup`，再把新二进制原子替换到原路径。重启接口延迟调用 `os.Exit(0)`，依赖 Docker Compose 的 `restart: unless-stopped` 拉起同一个容器。
-
-这种方式在 sub2api 的 Docker 部署中可行，是因为它的前后端在同一个二进制里。FLVX 当前是 `flux-panel-backend` 与 `vite-frontend` 两个容器，替换 `/app/paneld` 只能升级后端，不能升级前端页面。因此 FLVX 的“面板本体升级”需要更新 Compose 版本和两个镜像，而不是照搬二进制替换。
-
-## 目标
-
-1. 管理员可在面板上查看当前版本、最新版本、升级通道和升级能力状态。
-2. 管理员可一键升级整套面板 backend/frontend。
-3. 升级复用现有 GitHub Release 和 `FLUX_VERSION` 版本机制。
-4. 升级复用现有 GitHub 加速配置 `github_proxy_enabled` / `github_proxy_url`。
-5. 升级过程不接受任意命令、任意 URL 或任意 compose 路径。
-6. 环境不满足时清晰提示不可用原因，不静默失败。
-
-## 非目标
-
-1. 不实现 sub2api 式后端二进制替换作为本次主路径。
-2. 不支持从非本仓库 Release 下载升级资产。
-3. 不支持普通用户触发升级。
-4. 不支持在前端执行 shell 命令。
-5. 不修改 `install.sh` 或 `panel_install.sh` 的本地安装菜单逻辑；发布流程仍可能覆盖这些脚本。
-6. 不引入前端测试框架。
-
-## 影响范围
-
-### 后端
-
-- `go-backend/internal/http/handler/handler.go`
-- `go-backend/internal/http/handler/upgrade.go`
-- 新增 `go-backend/internal/http/handler/system_upgrade.go`
-- 新增 `go-backend/internal/http/handler/system_upgrade_test.go`
-- `go-backend/Dockerfile`
-
-### 部署模板
-
-- `docker-compose-v4.yml`
-- `docker-compose-v6.yml`
-
-### 前端
-
-- `vite-frontend/src/api/index.ts`
-- `vite-frontend/src/api/types.ts`
-- `vite-frontend/src/pages/config.tsx`
-
-## 运行前提
-
-升级能力仅在 Docker Compose 部署中可用，并要求后端容器具备以下条件：
-
-1. 容器内存在 Docker CLI，且支持 `docker compose version`。
-2. `/var/run/docker.sock` 挂载到后端容器。
-3. 宿主部署目录挂载到容器内固定路径，例如 `/opt/flvx-panel`。
-4. 环境变量 `PANEL_DEPLOY_DIR=/opt/flvx-panel`。
-5. 环境变量 `PANEL_BACKEND_CONTAINER=flux-panel-backend`，为空时默认使用 `flux-panel-backend`；值必须匹配容器名安全字符集 `[A-Za-z0-9_.-]+`。
-6. 部署目录内存在 `.env` 和 `docker-compose.yml`。
-
-如果任一条件不满足，检查接口返回 `capable=false` 和明确的 `reason`，升级按钮禁用。
-
-## 后端设计
-
-### API
-
-新增系统升级接口，路径使用 `/api/v1/system/*`，继续受现有 middleware 管控，仅管理员可访问。
-
-| 方法 | 路径 | 用途 |
-|------|------|------|
-| `POST` | `/api/v1/system/version` | 返回当前版本、升级通道、能力状态和可选最新版本 |
-| `POST` | `/api/v1/system/check-updates` | 强制查询 GitHub Release，返回最新版本和候选列表 |
-| `POST` | `/api/v1/system/upgrade` | 执行升级 |
-
-请求体：
-
-```json
-{
-  "channel": "stable",
-  "version": ""
-}
-```
-
-`channel` 使用现有节点升级的通道语义：`stable` 匹配纯数字版本，`dev` 匹配 `alpha` / `beta` / `rc`。`version` 为空时自动选择该通道最新 Release。
-
-`/api/v1/system/version` 返回：
-
-```json
-{
-  "currentVersion": "2.1.9-beta14",
-  "channel": "stable",
-  "latestVersion": "2.1.9",
-  "hasUpdate": true,
-  "capable": true,
-  "reason": "",
-  "deployDir": "/opt/flvx-panel",
-  "composeFile": "/opt/flvx-panel/docker-compose.yml",
-  "backendContainer": "flux-panel-backend"
-}
-```
-
-`/api/v1/system/upgrade` 成功返回：
-
-```json
-{
-  "version": "2.1.9",
-  "message": "升级 helper 已启动，面板服务将短暂重启",
-  "commands": [
-    "docker run -d --rm --volumes-from flux-panel-backend ...",
-    "docker compose pull backend frontend",
-    "docker compose up -d backend frontend"
-  ]
-}
-```
-
-返回的 `commands` 只用于 UI 展示固定步骤，不包含用户输入或 shell 拼接结果。
-
-### 版本来源
-
-当前版本优先从容器环境变量读取：
-
-1. `FLUX_VERSION`
-2. `VITE_APP_VERSION` 不在后端容器中可靠存在，不作为后端版本来源。
-3. 为空时返回 `dev`。
-
-发布流程已经在 `panel_install.sh` 写入 `.env` 的 `FLUX_VERSION`，Compose 模板需要把该变量传给 backend 容器，保证后端可感知当前版本。
-
-### Release 查询
-
-复用现有 `fetchGitHubReleases`、`resolveLatestReleaseByChannel`、`normalizeReleaseChannel`、`releaseChannelFromTag`、`releaseChannelLabel` 和 GitHub 加速配置能力。新增函数只负责筛选系统升级所需资产：
-
-- `docker-compose-v4.yml`
-- `docker-compose-v6.yml`
-
-是否下载 v4/v6 compose 文件通过当前部署目录中的 `docker-compose.yml` 判断：如果网络定义包含 `enable_ipv6: true`，选择 `docker-compose-v6.yml`；否则选择 `docker-compose-v4.yml`。
-
-### 升级执行器
-
-新增 `systemUpgradeExecutor`，职责明确分为可测试的小函数：
-
-1. `checkSystemUpgradeCapability()` 检查 Docker CLI、Docker socket、部署目录、`.env`、`docker-compose.yml`。
-2. `selectComposeAsset(currentCompose []byte) string` 选择 v4/v6 compose 资产。
-3. `updateEnvVersion(path, version string) error` 原子更新 `.env` 中的 `FLUX_VERSION`。
-4. `downloadCompose(version, assetName, dest string) error` 下载新版 compose 模板到临时文件。
-5. `currentBackendImage(containerName string) (string, error)` 获取当前 backend 容器镜像 ID。
-6. `startSystemUpgradeHelper(version string) error` 启动独立 helper 容器执行固定升级流程。
-
-升级流程：
-
-1. 获取全局升级锁，拒绝并发升级。
-2. 校验目标版本存在且不是 draft。
-3. 检查升级能力。
-4. 备份 `.env` 为 `.env.upgrade.bak`，备份 `docker-compose.yml` 为 `docker-compose.yml.upgrade.bak`。
-5. 下载目标版本的 compose 文件到部署目录临时文件。
-6. 原子替换 `docker-compose.yml`。
-7. 原子更新 `.env` 的 `FLUX_VERSION`。
-8. 通过 Docker socket 查询当前 backend 容器的镜像 ID。
-9. 使用当前 backend 镜像启动一个不属于 Compose 项目的临时 helper 容器。
-10. helper 通过 `--volumes-from flux-panel-backend` 继承部署目录挂载，并显式挂载 `/var/run/docker.sock`。
-11. helper 在 `PANEL_DEPLOY_DIR` 下执行 `docker compose pull backend frontend`。
-12. helper 等待 5 秒，让 SQLite WAL 等文件刷盘。
-13. helper 执行 `docker compose up -d backend frontend`，由 Compose 重建前端和后端。
-14. 后端接口在 helper 成功启动后立即返回；浏览器随后会经历短暂断线。
-
-PostgreSQL 模式不主动 pull 或重建 `postgres` 服务，避免无关数据库变动。新版 compose 文件仍保留 postgres 配置供后续手动迁移或重建使用。
-
-### 命令安全
-
-后端不暴露通用命令执行能力。后端只直接执行 Docker CLI 的固定参数，用于获取当前镜像和启动 helper：
-
-```go
-exec.CommandContext(ctx, "docker", "inspect", "-f", "{{.Image}}", backendContainer)
-exec.CommandContext(ctx, "docker", "run", "-d", "--rm", "--name", helperName,
-  "--volumes-from", backendContainer,
-  "-v", "/var/run/docker.sock:/var/run/docker.sock",
-  "-e", "PANEL_DEPLOY_DIR=/opt/flvx-panel",
-  "--entrypoint", "/bin/sh", imageID,
-  "-c", helperScript)
-```
-
-`helperScript` 由后端固定生成，不拼接用户输入：
-
-```sh
-cd "$PANEL_DEPLOY_DIR" && docker compose pull backend frontend && sleep 5 && docker compose up -d backend frontend
-```
-
-工作目录固定为 `PANEL_DEPLOY_DIR`。`PANEL_DEPLOY_DIR` 必须是绝对路径，且必须包含 `.env` 和 `docker-compose.yml`。接口输入只允许影响 `channel` 和已验证的 Release `version`。
-
-### 超时和错误处理
-
-1. Release 查询超时沿用现有 GitHub API 客户端超时。
-2. 下载 compose 文件使用 60 秒超时。
-3. 启动 helper 使用 30 秒超时，helper 内部命令不受原 HTTP 请求生命周期影响。
-4. 任一步失败时返回错误信息，并尽量保留 `.upgrade.bak` 供人工恢复。
-5. 如果 `.env` 更新后后续步骤失败，不自动回滚镜像或容器，避免误判导致更大破坏；错误信息提示备份文件位置。
-
-## 部署模板设计
-
-`docker-compose-v4.yml` 和 `docker-compose-v6.yml` 的 backend 服务增加：
-
-```yaml
-environment:
-  FLUX_VERSION: ${FLUX_VERSION:-dev}
-  PANEL_DEPLOY_DIR: /opt/flvx-panel
-  PANEL_BACKEND_CONTAINER: flux-panel-backend
-volumes:
-  - sqlite_data:/app/data
-  - /var/run/docker.sock:/var/run/docker.sock
-  - ./:/opt/flvx-panel
-```
-
-`go-backend/Dockerfile` 的 runtime 镜像通过多阶段构建从官方 `docker:27-cli` 镜像复制 Docker CLI 和 compose 插件到 Debian runtime 镜像，避免依赖 Debian apt 源中的 Docker 包可用性：
-
-```dockerfile
-FROM docker:27-cli AS dockercli
-FROM debian:bookworm-slim
-COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
-COPY --from=dockercli /usr/local/libexec/docker/cli-plugins/docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose
-```
-
-实现时保留现有 Go builder 和 `/app/paneld` 入口，仅增加 Docker CLI stage 和复制步骤。
-
-helper 容器使用当前 backend 容器的镜像 ID 启动，而不是额外依赖 `docker:cli` 镜像。这样不引入新的镜像仓库依赖，并保证 helper 内可用的 Docker CLI 与当前后端一致。
-
-## 前端设计
-
-在 `vite-frontend/src/pages/config.tsx` 的基本设置或数据库占用附近增加“面板升级”卡片，避免隐藏在节点页导致误解为“节点升级”。
-
-展示内容：
-
-1. 当前版本。
-2. 最新版本。
-3. 更新通道选择，复用现有 `stable` / `dev` 语义和 `UpdateReleaseChannel` 本地存储。
-4. 升级能力状态：可用、不可用原因、Docker socket 高权限提示。
-5. 操作按钮：检查更新、立即升级。
-
-交互：
-
-1. 页面加载时调用 `/system/version`。
-2. 点击“检查更新”调用 `/system/check-updates`。
-3. 点击“立即升级”前弹出确认框，明确提示服务会短暂中断，并提示 Docker socket 具备宿主高权限。
-4. 升级请求只等待 helper 启动，超时设置为 60 秒。
-5. 成功后 toast 显示“升级已触发，面板将在数十秒内重启”，并可提示用户稍后刷新。
-
-## 安全边界
-
-Docker socket 挂载等同于给后端容器宿主机级别控制能力。这是本设计的主要风险。缓解措施：
-
-1. 仅 `/api/v1/system/*` 管理员接口可触发。
-2. 不提供任意命令执行接口。
-3. 不允许用户传入下载 URL。
-4. 不允许用户传入 compose 路径。
-5. 只升级本仓库 GitHub Release，且跳过 draft。
-6. 前端明确展示 Docker socket 权限提示。
-
-## 测试策略
-
-### Go 单测
-
-新增 `system_upgrade_test.go` 覆盖：
-
-1. `selectComposeAsset` 对 v4/v6 compose 内容的判断。
-2. `.env` 中已有 `FLUX_VERSION` 时更新值。
-3. `.env` 中缺少 `FLUX_VERSION` 时追加值。
-4. 缺少部署目录、`.env`、`docker-compose.yml`、Docker socket 时返回不可用原因。
-5. helper 命令构造固定命令序列，不拼接用户输入。
-6. 并发升级锁会拒绝第二个升级请求。
-
-### 手动/集成验证
-
-1. `go-backend`: `go test ./...`
-2. `vite-frontend`: `pnpm run build`
-3. 本地容器验证：启动 Compose 后检查设置页升级卡片可显示能力状态。
-4. 在无 Docker socket 的开发环境验证按钮禁用并显示原因。
-
-## 回滚与恢复
-
-自动升级失败时不做自动容器回滚。后端会保留：
-
-1. `.env.upgrade.bak`
-2. `docker-compose.yml.upgrade.bak`
-
-人工恢复步骤由错误信息提示：进入部署目录，按需恢复备份文件，再执行 `docker compose up -d backend frontend`。
-
-## 决策记录
-
-本设计已确定采用 Docker socket 整套升级方案，不再保留二进制替换作为本次实现路径。Docker socket 的权限风险通过管理员限制、命令白名单和前端提示控制。

docs/superpowers/specs/2026-05-13-security-remediation-design.md

@@ -1,377 +0,0 @@
-# FLVX 安全问题修复设计
-
-**日期**: 2026-05-13
-**状态**: 待审核
-**作者**: AI Assistant
-
-## 概述
-
-针对 PR #502 提到的安全问题，对 FLVX 后端认证、配置访问控制、配置写入保护、备份导出和 JWT 失效模型做一次集中修复。目标是优先消除高风险漏洞，同时保留当前必须兼容的登录页品牌配置读取和验证码兼容行为。
-
-本设计采用“高危项一次收口，结构性问题只分析不重构”的策略：本轮修复 MD5 密码存储、未受控配置读取、敏感配置写入、备份配置泄露和 JWT 长期有效且改密后不失效的问题；不修改“无 Cloudflare secret 时允许当前 captcha 兼容行为”，也不重构 `autoMigrateAll()` 与 `migrateSchema()` 的双迁移入口。
-
-## 背景
-
-当前主线存在以下已确认问题：
-
-1. `login`、`open_api/sub_store`、用户改密、管理员创建用户和管理员修改用户密码仍然使用 `security.MD5(...)`。
-2. `/api/v1/config/get` 在 middleware 的 `shouldSkip()` 中被匿名放行，导致任意调用方可以读取绝大多数配置。
-3. `updateConfigs()` 与 `updateSingleConfig()` 使用了两套不同的限制逻辑，敏感配置键在单项写接口中未被保护。
-4. `ExportAll()` 和 `ExportPartial(types=["configs"])` 会直接导出所有配置，包含 `jwt_secret`、`license_key`、`cloudflare_secret_key`。
-5. JWT 当前有效期为 90 天，且 token 在用户改密、禁用、角色变化后仍可继续使用到过期。
-
-同时存在两个重要约束：
-
-1. 登录页和未登录态品牌展示依赖匿名读取 `app_name`、`app_logo`、`app_favicon`、`app_bg_image` 和 `cloudflare_site_key`。
-2. `tests/contract/migration_contract_test.go` 已把“无 Cloudflare secret 时允许当前 captcha 兼容行为”定义为既有契约，本轮不改变。
-
-## 目标
-
-1. 新增和更新后的用户密码不再以 MD5 存储。
-2. 历史 MD5 用户可在首次成功认证时自动迁移到强哈希。
-3. 匿名请求不能再读取任意配置，只能读取明确的公开配置白名单。
-4. 通用配置写接口不能覆盖敏感配置键。
-5. 备份导出默认不泄露敏感配置明文。
-6. 用户改密、禁用或角色变化后，旧 JWT 应立即失效。
-7. 不破坏现有登录页品牌展示和 captcha 兼容行为。
-
-## 非目标
-
-1. 不重构 `open_api/sub_store` 的整体认证模型；该接口仍使用现有用户名和密码查询参数语义。
-2. 不实现完整 refresh token、session 管理后台或 token 黑名单体系。
-3. 不改变“无 Cloudflare secret 时允许当前 captcha 兼容行为”。
-4. 不在本轮重构 `autoMigrateAll()` 与 `migrateSchema()` 的启动流程。
-5. 不引入前端测试框架。
-
-## 影响范围
-
-### 后端
-
-- `go-backend/internal/security/`
-- `go-backend/internal/auth/jwt.go`
-- `go-backend/internal/http/middleware/auth.go`
-- `go-backend/internal/http/handler/handler.go`
-- `go-backend/internal/http/handler/mutations.go`
-- `go-backend/internal/store/model/model.go`
-- `go-backend/internal/store/repo/repository.go`
-- `go-backend/internal/store/repo/repository_mutations.go`
-- `go-backend/tests/contract/`
-- `go-backend/internal/store/repo/*_test.go`
-
-### 前端
-
-- `vite-frontend/src/api/index.ts`
-- `vite-frontend/src/config/site.ts`
-- `vite-frontend/src/pages/index.tsx`
-- 任何在未登录态读取品牌配置的组件
-
-## 设计决策
-
-### 已确认决策
-
-1. 本轮采用安全优先策略，允许收紧危险默认行为。
-2. MD5 密码采用“登录成功时自动迁移”的兼容方案。
-3. captcha 在未配置 Cloudflare secret 时的兼容行为保持不变。
-4. JWT 采用“最小可撤销”方案，而不是完整 session 体系。
-5. 双重迁移系统只分析，不在本轮中修改。
-
-### 迁移系统分析结论
-
-`autoMigrateAll()` 与 `migrateSchema()` 当前职责并不相同：
-
-1. `autoMigrateAll()` 负责表和列结构补齐。
-2. `migrateSchema()` 负责基于 `schema_version` 的数据修正，以及 PostgreSQL ID 默认值修复等兼容迁移。
-3. 现有 `repository_migrate_test.go` 已明确覆盖这两部分逻辑，说明它们在现有代码库中是被依赖的互补结构，而不是已确认的重复安全漏洞。
-
-因此本轮仅记录该分析结论，不把双迁移入口纳入改动范围，避免把安全修复扩展为启动流程重构。
-
-## 详细设计
-
-### 1. 密码存储与认证迁移
-
-在 `internal/security/` 中新增统一密码能力，替代各处直接使用 `security.MD5(...)` 的做法。
-
-建议新增以下接口：
-
-```go
-func HashPassword(plain string) (string, error)
-func VerifyPassword(storedHash, plain string) (ok bool, legacy bool)
-func IsLegacyPasswordHash(storedHash string) bool
-```
-
-哈希算法使用 `bcrypt`：
-
-1. `user.pwd` 当前为 `varchar(100)`，足以容纳 bcrypt 哈希。
-2. 不需要修改密码列长度，改动最小。
-3. 对当前 Go 后端来说，bcrypt 是最稳妥的强哈希升级路径。
-
-所有密码入口统一改为走这套能力：
-
-1. `login`
-2. `openAPISubStore`
-3. `updatePassword`
-4. `userCreate`
-5. `userUpdate` 中的管理员改密路径
-
-认证迁移规则：
-
-1. 如果数据库中存的是 bcrypt，则按 bcrypt 校验。
-2. 如果数据库中存的是历史 MD5，则先按旧逻辑校验。
-3. 历史 MD5 校验成功后，立即把 `pwd` 改写为 bcrypt。
-4. 自动迁移不仅在网页登录时执行，也在 `open_api/sub_store` 成功鉴权时执行，避免只使用订阅接口的老用户永远停留在 MD5。
-
-默认管理员种子账号仍保留当前默认密码语义和 `requirePasswordChange` 行为，但种子哈希改为 bcrypt，不再在新建数据库中写入 MD5 值。
-
-### 2. JWT 最小可撤销方案
-
-本轮不引入 refresh token 和黑名单表，而是做一个可以立即生效的最小撤销闭环。
-
-#### 数据模型
-
-在 `user` 表新增字段：
-
-- `password_changed_at BIGINT NOT NULL DEFAULT 0`
-
-该字段专门表示密码最后一次变更时间，不能复用现有 `updated_time`，原因是 `updated_time` 还会被流量、状态或其他用户资料更新触发，复用后会让非密码更新错误地使 token 失效。
-
-#### token 签发与校验
-
-继续使用现有 `iat` 声明，但把有效期从 90 天收紧到 7 天。
-
-token 校验分两步：
-
-1. 先做现有签名和过期时间校验。
-2. 再读取用户最小认证状态，确认：
-   - 用户仍存在
-   - 用户状态未被禁用
-   - 当前 `role_id` 与 token 中一致
-   - `claims.iat` 不早于 `password_changed_at`
-
-为避免 middleware 每次都查询完整用户对象，Repository 新增专用读取方法，只返回 token 校验需要的最小字段，例如：
-
-```go
-type UserAuthState struct {
-    ID                int64
-    RoleID            int
-    Status            int
-    PasswordChangedAt int64
-}
-
-func (r *Repository) GetUserAuthState(userID int64) (*UserAuthState, error)
-```
-
-#### 失效语义
-
-以下场景下，旧 token 应立即失效：
-
-1. 用户修改密码
-2. 管理员修改用户密码
-3. 用户被禁用
-4. 用户角色发生变化
-
-这会带来一次明确的兼容收紧：升级完成后，部分历史 token 可能因为寿命策略或认证状态变化而失效，这是安全优先下的可接受行为。
-
-### 3. 配置读取访问控制
-
-为了避免继续让 `/api/v1/config/get` 承担“有时匿名、有时鉴权”的混合语义，本设计将公开配置读取拆成单独的 public 端点。
-
-#### 端点设计
-
-保留现有受保护端点：
-
-- `POST /api/v1/config/get`
-
-新增公开端点：
-
-- `POST /api/v1/public/config/get`
-
-middleware 仅对白名单 public 端点放行，不再放行 `/api/v1/config/get`。
-
-#### 公开白名单
-
-匿名仅允许读取以下配置：
-
-1. `app_name`
-2. `app_logo`
-3. `app_favicon`
-4. `app_bg_image`
-5. `cloudflare_site_key`
-
-理由：
-
-1. 登录页与未登录态品牌渲染依赖前四项。
-2. 登录页在 captcha 开启时需要读取 `cloudflare_site_key`。
-3. 其他配置不应暴露给匿名方。
-
-前端调整规则：
-
-1. 登录页和 `site.ts` 中的未登录态品牌配置读取改走 `/public/config/get`。
-2. 登录后页面仍使用现有 `/config/get` 或 `/config/list`。
-3. 已登录页面中的配置读取逻辑不变，只是恢复为真正受 JWT 保护。
-
-### 4. 配置写保护统一
-
-当前 `updateConfigs()` 与 `updateSingleConfig()` 各自维护不同限制逻辑，是本次越权写入漏洞的根源。本轮把配置访问规则统一收口为一套辅助函数。
-
-建议新增配置策略定义：
-
-```go
-type ConfigAccessPolicy struct {
-    PublicReadable bool
-    Sensitive      bool
-    CommercialOnly bool
-}
-```
-
-由统一函数返回某个 key 的策略，再由：
-
-1. `public config get`
-2. `config get`
-3. `config list`
-4. `updateConfigs()`
-5. `updateSingleConfig()`
-
-共同复用。
-
-敏感配置键至少包含：
-
-1. `jwt_secret`
-2. `license_key`
-3. `cloudflare_secret_key`
-
-这些键的写入规则：
-
-1. 不允许通过通用配置写接口改写。
-2. 不允许通过公开读取接口读取。
-3. 非管理员在配置列表接口中也不能获得。
-
-商业版白名单键继续沿用现有语义，例如：
-
-1. `app_name`
-2. `app_logo`
-3. `app_favicon`
-4. `hide_footer_brand`
-
-但其判断逻辑同样统一走同一套策略函数，避免再次出现单接口漏判。
-
-### 5. 备份导出与导入脱敏
-
-备份系统改为“默认安全导出”，而不是“完整明文镜像”。
-
-#### 导出
-
-`ExportAll()` 和 `ExportPartial(types=["configs"])` 在写入 `backup.Configs` 前都先经过统一过滤函数，移除敏感配置键。
-
-敏感配置键与配置写保护列表保持一致：
-
-1. `jwt_secret`
-2. `license_key`
-3. `cloudflare_secret_key`
-
-#### 导入
-
-导入配置时，即使旧备份中带有上述敏感键，也会在导入前被丢弃，不允许通过备份恢复路径覆盖在线安全配置。
-
-该设计的取舍如下：
-
-1. 保留大部分业务配置、节点、转发、用户数据的恢复能力。
-2. 不再把备份文件当作核心密钥分发载体。
-3. `UserBackup.Pwd` 仍然保留，以维持用户恢复语义；在本轮密码升级后，这些值将是 bcrypt 哈希，而不是 MD5。
-
-### 6. captcha 兼容行为
-
-`captcha_enabled`、`cloudflare_site_key`、`cloudflare_secret_key` 的现有兼容行为保持不变。
-
-明确保持以下现状：
-
-1. 当未完整配置 Cloudflare key 时，当前 contract test 约定的兼容路径继续存在。
-2. 本轮不把 captcha 兼容逻辑从“兼容旧行为”切换为“严格校验”。
-
-这样可以避免把一轮安全修复扩展成登录流程行为变更，同时与用户已确认的范围保持一致。
-
-## 错误处理与兼容行为
-
-### 错误处理
-
-保持现有 API envelope：`{code, msg, data, ts}`。
-
-建议的接口行为：
-
-1. `POST /api/v1/public/config/get` 请求非公开 key 时返回 `403`。
-2. 受保护配置端点未登录时返回 `401`。
-3. 登录、订阅接口、改密接口继续返回通用认证失败，不暴露“用户名存在但密码错误”等细节。
-4. token 因签名错误、过期、改密、禁用或角色变化失效时，统一返回现有 `401` 语义。
-5. 备份导入中出现敏感配置键时，接口整体仍允许成功导入其他数据，敏感键静默忽略。
-
-### 保留兼容
-
-1. 登录页和未登录态品牌展示继续可用。
-2. 未配置 Cloudflare secret 时的 captcha 兼容逻辑继续保留。
-3. 历史 MD5 用户仍可继续认证，并在成功后自动迁移。
-
-### 刻意收紧
-
-1. 匿名方不再可读取任意配置。
-2. 通用配置写接口不再能写入敏感键。
-3. 备份不再导出敏感配置明文。
-4. 改密、禁用和角色变化会立即使旧 token 失效。
-
-## 测试设计
-
-本轮以 Go 单测和 contract test 为主，覆盖以下场景。
-
-### 密码迁移
-
-1. 历史 MD5 用户在网页登录成功后，数据库中的 `pwd` 被升级为 bcrypt。
-2. 历史 MD5 用户在 `open_api/sub_store` 成功鉴权后，同样触发迁移。
-3. 新建用户后落库的是 bcrypt，而不是 MD5。
-4. 管理员修改用户密码和用户自助改密后，落库的是 bcrypt。
-
-### JWT 最小可撤销
-
-1. 正常 token 仍可访问受保护接口。
-2. 改密后旧 token 失效。
-3. 用户被禁用后旧 token 失效。
-4. 用户角色变化后旧 token 失效。
-5. 过期 token 失效。
-
-### 配置访问控制
-
-1. 匿名访问公开配置成功。
-2. 匿名访问非公开配置失败。
-3. 已登录页面需要的普通配置读取仍然可用。
-4. `updateSingleConfig()` 无法修改敏感键。
-5. `updateConfigs()` 同样无法修改敏感键。
-
-### 备份脱敏
-
-1. `ExportAll()` 不包含敏感配置。
-2. `ExportPartial(types=["configs"])` 不包含敏感配置。
-3. 导入带敏感键的备份时，这些键不会被写回数据库。
-4. 非敏感配置和其他业务数据仍可正常导入导出。
-
-### 迁移系统回归
-
-1. 现有 `repository_migrate_test.go` 保持通过。
-2. 本轮不对 `autoMigrateAll()` 与 `migrateSchema()` 的职责边界做行为性改动。
-
-## 验收标准
-
-1. 数据库中不再新增 MD5 密码。
-2. 历史 MD5 用户可在首次成功认证后自动升级到 bcrypt。
-3. 匿名调用方不能再读取非公开配置。
-4. `updateSingleConfig()` 和 `updateConfigs()` 都无法改写敏感配置键。
-5. 备份导出默认不包含 `jwt_secret`、`license_key`、`cloudflare_secret_key`。
-6. 改密、禁用和角色变化后，旧 JWT 立即失效。
-7. 登录页品牌展示和 captcha 兼容行为不被破坏。
-8. 现有迁移测试和本轮新增安全测试全部通过。
-
-## PR #502 处置
-
-PR #502 的价值在于指出了真实问题，但其实现方式只是把讽刺性注释写进生产代码，并未修复漏洞。因此该 PR 不应合并。
-
-执行阶段的处置方式：
-
-1. 关闭 PR #502。
-2. 在关闭说明中指出：问题成立，但修复将通过正式代码与测试提交完成，而不是通过向源文件加入讽刺性注释。
-3. 后续在新提交中按本设计逐项修复。

go-backend/internal/auth/jwt.go

@@ -12,13 +12,12 @@ import (
 
 const (
 	algorithm  = "HmacSHA256"
-	expireTime = 7 * 24 * time.Hour
+	expireTime = 90 * 24 * time.Hour
 )
 
 type Claims struct {
 	Sub    string `json:"sub"`
 	Iat    int64  `json:"iat"`
-	IatMs  int64  `json:"iat_ms"`
 	Exp    int64  `json:"exp"`
 	User   string `json:"user"`
 	Name   string `json:"name"`
@@ -31,15 +30,11 @@ type tokenHeader struct {
 }
 
 func GenerateToken(userID int64, username string, roleID int, secret string) (string, error) {
-	return GenerateTokenAt(userID, username, roleID, secret, time.Now())
-}
-
-func GenerateTokenAt(userID int64, username string, roleID int, secret string, now time.Time) (string, error) {
+	now := time.Now()
 	header := tokenHeader{Alg: algorithm, Typ: "JWT"}
 	claims := Claims{
 		Sub:    strconv.FormatInt(userID, 10),
 		Iat:    now.Unix(),
-		IatMs:  now.UnixMilli(),
 		Exp:    now.Add(expireTime).Unix(),
 		User:   username,
 		Name:   username,

go-backend/internal/auth/user_state.go

@@ -1,8 +0,0 @@
-package auth
-
-type UserAuthState struct {
-	ID                int64
-	RoleID            int
-	Status            int
-	PasswordChangedAt int64
-}

go-backend/internal/http/handler/config_access.go

@@ -1,44 +0,0 @@
-package handler
-
-import (
-	"net/http"
-	"strings"
-
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
-)
-
-func (h *Handler) getPublicConfigByName(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req nameRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
-		return
-	}
-
-	configName := strings.ToLower(strings.TrimSpace(req.Name))
-	if configName == "" {
-		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
-		return
-	}
-	if !repo.IsPublicConfigKey(configName) {
-		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
-		return
-	}
-
-	cfg, err := h.repo.GetConfigByName(configName)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if cfg == nil {
-		response.WriteJSON(w, response.ErrDefault("配置不存在"))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(cfg))
-}

go-backend/internal/http/handler/config_access_test.go

@@ -1,141 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/middleware"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
-)
-
-func TestPublicConfigGetAllowsBrandKeys(t *testing.T) {
-	router, r := setupConfigAccessTestRouter(t)
-	seedConfigValue(t, r, "app_name", "FLVX Brand")
-	seedConfigValue(t, r, "app_logo", "logo-data")
-	seedConfigValue(t, r, "app_favicon", "favicon-data")
-	seedConfigValue(t, r, "app_bg_image", "bg-data")
-	seedConfigValue(t, r, "cloudflare_site_key", "site-key")
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	assertHandlerCode(t, resp, 0)
-}
-
-func TestPublicConfigGetRejectsSensitiveKeys(t *testing.T) {
-	router, _ := setupConfigAccessTestRouter(t)
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"jwt_secret"}`))
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	assertHandlerCodeMsg(t, resp, 403, "禁止访问敏感配置")
-}
-
-func TestConfigGetNowRequiresAuth(t *testing.T) {
-	router, _ := setupConfigAccessTestRouter(t)
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	assertHandlerCodeMsg(t, resp, 401, "未登录或token已过期")
-}
-
-func TestConfigUpdateRejectsSensitiveKeys(t *testing.T) {
-	router, _ := setupConfigAccessTestRouter(t)
-	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/config/update", bytes.NewBufferString(`{"jwt_secret":"rotated-secret"}`))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", adminToken)
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	assertHandlerCodeMsg(t, resp, 403, "禁止访问敏感配置")
-}
-
-func TestConfigUpdateSingleRejectsSensitiveKeys(t *testing.T) {
-	router, _ := setupConfigAccessTestRouter(t)
-	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/config/update-single", bytes.NewBufferString(`{"name":"jwt_secret","value":"rotated-secret"}`))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", adminToken)
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	assertHandlerCodeMsg(t, resp, 403, "禁止访问敏感配置")
-}
-
-func setupConfigAccessTestRouter(t *testing.T) (http.Handler, *repo.Repository) {
-	t.Helper()
-	r, err := repo.Open(t.TempDir() + "/config-access.db")
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = r.Close()
-	})
-
-	h := New(r, "unit-test-secret")
-	mux := http.NewServeMux()
-	h.Register(mux)
-	wrapped := middleware.Recover(mux)
-	wrapped = middleware.JWT(middleware.AuthOptions{JWTSecret: "unit-test-secret", GetUserAuthState: h.GetUserAuthState})(wrapped)
-	wrapped = middleware.RequestLog(wrapped)
-	wrapped = middleware.CORS(wrapped)
-	return wrapped, r
-}
-
-func seedConfigValue(t *testing.T, r *repo.Repository, name, value string) {
-	t.Helper()
-	if err := r.DB().Exec(`INSERT INTO vite_config(name, value, time) VALUES(?, ?, 0) ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time`, name, value).Error; err != nil {
-		t.Fatalf("seed config %s: %v", name, err)
-	}
-}
-
-func mustGenerateConfigAccessToken(t *testing.T, userID int64, username string, roleID int) string {
-	t.Helper()
-	token, err := auth.GenerateToken(userID, username, roleID, "unit-test-secret")
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	return token
-}
-
-func assertHandlerCode(t *testing.T, rec *httptest.ResponseRecorder, expected int) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expected {
-		t.Fatalf("expected code %d, got %d", expected, out.Code)
-	}
-}
-
-func assertHandlerCodeMsg(t *testing.T, rec *httptest.ResponseRecorder, expectedCode int, expectedMsg string) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expectedCode || out.Msg != expectedMsg {
-		t.Fatalf("expected (%d,%q), got (%d,%q)", expectedCode, expectedMsg, out.Code, out.Msg)
-	}
-}

go-backend/internal/http/handler/handler.go

@@ -136,7 +136,6 @@ func New(repo *repo.Repository, jwtSecret string) *Handler {
 		}
 		h.metrics.RecordNodeMetric(nodeID, metricInfo)
 	})
-	h.wsServer.SetUserAuthStateLookup(h.GetUserAuthState)
 	return h
 }
 
@@ -144,10 +143,6 @@ func (h *Handler) WebSocketHandler() http.Handler {
 	return h.wsServer
 }
 
-func (h *Handler) GetUserAuthState(userID int64) (*auth.UserAuthState, error) {
-	return h.repo.GetUserAuthState(userID)
-}
-
 func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/user/login", h.login)
 	mux.HandleFunc("/api/v1/user/list", h.userList)
@@ -157,7 +152,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/user/reset", h.userResetFlow)
 	mux.HandleFunc("/api/v1/user/quota/reset", h.userQuotaReset)
 	mux.HandleFunc("/api/v1/user/groups", h.userGroups)
-	mux.HandleFunc("/api/v1/public/config/get", h.getPublicConfigByName)
 	mux.HandleFunc("/api/v1/config/get", h.getConfigByName)
 	mux.HandleFunc("/api/v1/config/list", h.getConfigs)
 	mux.HandleFunc("/api/v1/config/update", h.updateConfigs)
@@ -340,8 +334,7 @@ func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("账号或密码错误"))
 		return
 	}
-	passwordMatched, passwordWasLegacy := security.VerifyPassword(user.Pwd, req.Password)
-	if !passwordMatched {
+	if user.Pwd != security.MD5(req.Password) {
 		response.WriteJSON(w, response.ErrDefault("账号或密码错误"))
 		return
 	}
@@ -349,20 +342,8 @@ func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("账号被停用"))
 		return
 	}
-	issueAt := time.Now()
-	if passwordWasLegacy {
-		updatedAt := time.Now().UnixMilli()
-		hashedPassword, err := security.HashPassword(req.Password)
-		if err != nil {
-			log.Printf("legacy password rehash skipped user_id=%d path=login err=%v", user.ID, err)
-		} else if err := h.repo.UpdateUserPassword(user.ID, hashedPassword, updatedAt); err != nil {
-			log.Printf("legacy password rehash update skipped user_id=%d path=login err=%v", user.ID, err)
-		} else {
-			issueAt = time.UnixMilli(updatedAt + 1)
-		}
-	}
 
-	token, err := auth.GenerateTokenAt(user.ID, user.User, user.RoleID, h.jwtSecret, issueAt)
+	token, err := auth.GenerateToken(user.ID, user.User, user.RoleID, h.jwtSecret)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
@@ -576,27 +557,10 @@ func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	if user == nil {
+	if user == nil || user.Pwd != security.MD5(password) {
 		response.WriteJSON(w, response.ErrDefault("鉴权失败"))
 		return
 	}
-	passwordMatched, passwordWasLegacy := security.VerifyPassword(user.Pwd, password)
-	if !passwordMatched {
-		response.WriteJSON(w, response.ErrDefault("鉴权失败"))
-		return
-	}
-	if user.Status == 0 {
-		response.WriteJSON(w, response.ErrDefault("账号被停用"))
-		return
-	}
-	if passwordWasLegacy {
-		hashedPassword, err := security.HashPassword(password)
-		if err != nil {
-			log.Printf("legacy password rehash skipped user_id=%d path=sub_store err=%v", user.ID, err)
-		} else if err := h.repo.UpdateUserPassword(user.ID, hashedPassword, time.Now().UnixMilli()); err != nil {
-			log.Printf("legacy password rehash update skipped user_id=%d path=sub_store err=%v", user.ID, err)
-		}
-	}
 
 	const giga = int64(1024 * 1024 * 1024)
 	headerValue := ""
@@ -984,10 +948,6 @@ func (h *Handler) updateConfigs(w http.ResponseWriter, r *http.Request) {
 		if key == "" {
 			continue
 		}
-		if repo.IsSensitiveConfigKey(key) {
-			response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
-			return
-		}
 
 		if protectedKeys[key] && isCommercial != "true" {
 			response.WriteJSON(w, response.ErrDefault("需要商业版授权"))
@@ -1025,10 +985,6 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
 		return
 	}
-	if repo.IsSensitiveConfigKey(name) {
-		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
-		return
-	}
 
 	isCommercial, _ := h.repo.GetViteConfigValue("is_commercial")
 	if (name == "app_name" || name == "app_logo" || name == "app_favicon" || name == "hide_footer_brand") && isCommercial != "true" {
@@ -1299,8 +1255,7 @@ func (h *Handler) updatePassword(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	passwordMatched, _ := security.VerifyPassword(user.Pwd, req.CurrentPassword)
-	if !passwordMatched {
+	if user.Pwd != security.MD5(req.CurrentPassword) {
 		response.WriteJSON(w, response.ErrDefault("当前密码错误"))
 		return
 	}
@@ -1315,12 +1270,7 @@ func (h *Handler) updatePassword(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	hashedPassword, err := security.HashPassword(req.NewPassword)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if err := h.repo.UpdateUserNameAndPassword(userID, req.NewUsername, hashedPassword, time.Now().UnixMilli()); err != nil {
+	if err := h.repo.UpdateUserNameAndPassword(userID, req.NewUsername, security.MD5(req.NewPassword), time.Now().UnixMilli()); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}

go-backend/internal/http/handler/mutations.go

@@ -71,12 +71,7 @@ func (h *Handler) userCreate(w http.ResponseWriter, r *http.Request) {
 	now := time.Now().UnixMilli()
 	maxConn := asInt(req["maxConn"], 0)
 
-	hashedPassword, err := security.HashPassword(pwd)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	userID, err := h.repo.CreateUser(username, hashedPassword, roleID, expTime, flow, flowResetTime, num, status, maxConn, now)
+	userID, err := h.repo.CreateUser(username, security.MD5(pwd), roleID, expTime, flow, flowResetTime, num, status, maxConn, now)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
@@ -181,12 +176,7 @@ func (h *Handler) userUpdate(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	} else {
-		hashedPassword, err := security.HashPassword(pwd)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		if err := h.repo.UpdateUserWithPassword(id, username, hashedPassword, flow, num, expTime, flowResetTime, status, maxConn, now); err != nil {
+		if err := h.repo.UpdateUserWithPassword(id, username, security.MD5(pwd), flow, num, expTime, flowResetTime, status, maxConn, now); err != nil {
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}

go-backend/internal/http/handler/system_upgrade.go

@@ -180,41 +180,13 @@ func (e *systemUpgradeExecutor) selectComposeAsset(current []byte) string {
 }
 
 func (e *systemUpgradeExecutor) helperScript() string {
-	return `set -eu
-LOGFILE="$PANEL_DEPLOY_DIR/upgrade.log"
-log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOGFILE"; }
-
-cd "$PANEL_DEPLOY_DIR"
-echo "" > "$LOGFILE"
-log "开始面板升级"
-log "工作目录: $(pwd)"
-
-if [ ! -f docker-compose.yml ]; then
-  log "错误: docker-compose.yml 不存在"
-  exit 1
-fi
-if [ ! -f .env ]; then
-  log "错误: .env 不存在"
-  exit 1
-fi
-
-log "拉取新镜像..."
-if ! docker compose pull backend frontend 2>&1 | tee -a "$LOGFILE"; then
-  log "错误: 拉取镜像失败"
-  exit 1
-fi
-
-log "等待旧容器释放资源..."
-sleep 3
-
-log "重启服务（force-recreate）..."
-if ! docker compose up -d --force-recreate --remove-orphans backend frontend 2>&1 | tee -a "$LOGFILE"; then
-  log "错误: 重启服务失败"
-  exit 1
-fi
-
-log "升级完成"
-`
+	return strings.Join([]string{
+		"set -eu",
+		`cd "$PANEL_DEPLOY_DIR"`,
+		"docker compose pull backend frontend",
+		"sleep 5",
+		"docker compose up -d backend frontend",
+	}, "\n")
 }
 
 func (e *systemUpgradeExecutor) buildHelperRunArgs(imageID, helperName string) ([]string, error) {

go-backend/internal/http/middleware/auth.go

@@ -3,7 +3,6 @@ package middleware
 import (
 	"context"
 	"net/http"
-	"strconv"
 	"strings"
 
 	"go-backend/internal/auth"
@@ -15,8 +14,7 @@ type contextKey string
 const ClaimsContextKey contextKey = "claims"
 
 type AuthOptions struct {
-	JWTSecret        string
-	GetUserAuthState func(userID int64) (*auth.UserAuthState, error)
+	JWTSecret string
 }
 
 func JWT(opts AuthOptions) func(http.Handler) http.Handler {
@@ -44,19 +42,6 @@ func JWT(opts AuthOptions) func(http.Handler) http.Handler {
 				return
 			}
 
-			if opts.GetUserAuthState != nil {
-				userID, err := strconv.ParseInt(claims.Sub, 10, 64)
-				if err != nil {
-					response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
-					return
-				}
-				state, err := opts.GetUserAuthState(userID)
-				if err != nil || state == nil || state.Status != 1 || state.RoleID != claims.RoleID || claims.IatMs <= state.PasswordChangedAt {
-					response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
-					return
-				}
-			}
-
 			if requiresAdmin(r.URL.Path) && claims.RoleID != 0 {
 				response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
 				return
@@ -93,10 +78,8 @@ func shouldSkip(path string) bool {
 	case strings.HasPrefix(path, "/api/v1/captcha/"):
 		return true
 	case path == "/api/v1/config/get":
-		return false
-	case path == "/api/v1/user/login":
 		return true
-	case path == "/api/v1/public/config/get":
+	case path == "/api/v1/user/login":
 		return true
 	case path == "/api/v1/federation/connect":
 		return true

go-backend/internal/http/middleware/auth_test.go

@@ -1,243 +0,0 @@
-package middleware
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestJWTRejectsPasswordChangedToken(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 1, PasswordChangedAt: claims.IatMs + 1}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestJWTAcceptsCurrentUserState(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 1, PasswordChangedAt: claims.IatMs - 1}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertCode(t, res, 0)
-}
-
-func TestJWTRejectsDisabledUserToken(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 0, PasswordChangedAt: time.Now().Unix()}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestJWTRejectsPasswordChangedAtSameMillisecond(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 1, PasswordChangedAt: claims.IatMs}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestJWTRejectsRoleMismatch(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 1, Status: 1, PasswordChangedAt: 0}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestJWTRejectsMissingUserState(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return nil, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestJWTRejectsAuthStateLookupError(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return nil, errors.New("boom")
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertAuthDenied(t, res)
-}
-
-func TestShouldSkipDoesNotBypassConfigGet(t *testing.T) {
-	if shouldSkip("/api/v1/config/get") {
-		t.Fatal("expected /api/v1/config/get to require auth")
-	}
-}
-
-func TestShouldSkipBypassesPublicConfigGet(t *testing.T) {
-	if !shouldSkip("/api/v1/public/config/get") {
-		t.Fatal("expected /api/v1/public/config/get to remain public")
-	}
-}
-
-func TestJWTExpiresAfterSevenDays(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-	if got := claims.Exp - claims.Iat; got != int64(7*24*time.Hour/time.Second) {
-		t.Fatalf("expected 7 day token lifetime, got %d seconds", got)
-	}
-	if claims.IatMs <= 0 {
-		t.Fatalf("expected millisecond issuance time to be populated, got %d", claims.IatMs)
-	}
-}
-
-func assertCode(t *testing.T, rec *httptest.ResponseRecorder, expected int) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expected {
-		t.Fatalf("expected code %d, got %d", expected, out.Code)
-	}
-}
-
-func assertAuthDenied(t *testing.T, rec *httptest.ResponseRecorder) {
-	t.Helper()
-	assertCodeMsg(t, rec, 401, "无效的token或token已过期")
-}
-
-func assertCodeMsg(t *testing.T, rec *httptest.ResponseRecorder, expectedCode int, expectedMsg string) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expectedCode || out.Msg != expectedMsg {
-		t.Fatalf("expected (%d,%q), got (%d,%q)", expectedCode, expectedMsg, out.Code, out.Msg)
-	}
-}

go-backend/internal/http/router.go

@@ -13,7 +13,7 @@ func NewRouter(h *handler.Handler, jwtSecret string) http.Handler {
 	mux.Handle("/system-info", h.WebSocketHandler())
 
 	wrapped := middleware.Recover(mux)
-	wrapped = middleware.JWT(middleware.AuthOptions{JWTSecret: jwtSecret, GetUserAuthState: h.GetUserAuthState})(wrapped)
+	wrapped = middleware.JWT(middleware.AuthOptions{JWTSecret: jwtSecret})(wrapped)
 	wrapped = middleware.RequestLog(wrapped)
 	wrapped = middleware.CORS(wrapped)
 	return wrapped

go-backend/internal/security/password.go

@@ -1,39 +0,0 @@
-package security
-
-import (
-	"strings"
-
-	"golang.org/x/crypto/bcrypt"
-)
-
-func HashPassword(plain string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
-	if err != nil {
-		return "", err
-	}
-	return string(hash), nil
-}
-
-func VerifyPassword(storedHash, plain string) (bool, bool) {
-	if strings.HasPrefix(storedHash, "$2") {
-		return bcrypt.CompareHashAndPassword([]byte(storedHash), []byte(plain)) == nil, false
-	}
-	if MD5(plain) == storedHash {
-		return true, true
-	}
-	return false, false
-}
-
-func IsLegacyPasswordHash(storedHash string) bool {
-	storedHash = strings.TrimSpace(storedHash)
-	if len(storedHash) != 32 {
-		return false
-	}
-	for _, r := range storedHash {
-		if (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F') {
-			continue
-		}
-		return false
-	}
-	return true
-}

go-backend/internal/security/password_test.go

@@ -1,38 +0,0 @@
-package security
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestHashPasswordProducesBcrypt(t *testing.T) {
-	hash, err := HashPassword("admin_user")
-	if err != nil {
-		t.Fatalf("HashPassword() error = %v", err)
-	}
-	if len(hash) < 50 || !strings.HasPrefix(hash, "$2") {
-		t.Fatalf("expected bcrypt hash, got %q", hash)
-	}
-	if ok, legacy := VerifyPassword(hash, "admin_user"); !ok || legacy {
-		t.Fatalf("VerifyPassword() = (%v,%v), want (true,false)", ok, legacy)
-	}
-}
-
-func TestVerifyPasswordAcceptsLegacyMD5(t *testing.T) {
-	if ok, legacy := VerifyPassword("3c85cdebade1c51cf64ca9f3c09d182d", "admin_user"); !ok || !legacy {
-		t.Fatalf("VerifyPassword() = (%v,%v), want (true,true)", ok, legacy)
-	}
-}
-
-func TestIsLegacyPasswordHash(t *testing.T) {
-	if !IsLegacyPasswordHash("3c85cdebade1c51cf64ca9f3c09d182d") {
-		t.Fatal("expected 32-char hex MD5 hash to be legacy")
-	}
-	hash, err := HashPassword("admin_user")
-	if err != nil {
-		t.Fatalf("HashPassword() error = %v", err)
-	}
-	if IsLegacyPasswordHash(hash) {
-		t.Fatalf("expected bcrypt hash not to be legacy: %q", hash)
-	}
-}

go-backend/internal/store/model/model.go

@@ -10,21 +10,20 @@ import "database/sql"
 // User maps to the "user" table. PostgreSQL treats "user" as a reserved
 // word, so TableName() is required for correct quoting.
 type User struct {
-	ID                int64         `gorm:"primaryKey;autoIncrement"`
-	User              string        `gorm:"column:user;type:varchar(100);not null"`
-	Pwd               string        `gorm:"type:varchar(100);not null"`
-	RoleID            int           `gorm:"column:role_id;not null"`
-	ExpTime           int64         `gorm:"column:exp_time;not null"`
-	Flow              int64         `gorm:"not null"`
-	InFlow            int64         `gorm:"column:in_flow;not null;default:0"`
-	OutFlow           int64         `gorm:"column:out_flow;not null;default:0"`
-	FlowResetTime     int64         `gorm:"column:flow_reset_time;not null"`
-	Num               int           `gorm:"not null"`
-	CreatedTime       int64         `gorm:"column:created_time;not null"`
-	UpdatedTime       sql.NullInt64 `gorm:"column:updated_time"`
-	Status            int           `gorm:"not null"`
-	PasswordChangedAt int64         `gorm:"column:password_changed_at;not null;default:0"`
-	MaxConn           int           `gorm:"column:max_conn;not null;default:0"`
+	ID            int64         `gorm:"primaryKey;autoIncrement"`
+	User          string        `gorm:"column:user;type:varchar(100);not null"`
+	Pwd           string        `gorm:"type:varchar(100);not null"`
+	RoleID        int           `gorm:"column:role_id;not null"`
+	ExpTime       int64         `gorm:"column:exp_time;not null"`
+	Flow          int64         `gorm:"not null"`
+	InFlow        int64         `gorm:"column:in_flow;not null;default:0"`
+	OutFlow       int64         `gorm:"column:out_flow;not null;default:0"`
+	FlowResetTime int64         `gorm:"column:flow_reset_time;not null"`
+	Num           int           `gorm:"not null"`
+	CreatedTime   int64         `gorm:"column:created_time;not null"`
+	UpdatedTime   sql.NullInt64 `gorm:"column:updated_time"`
+	Status        int           `gorm:"not null"`
+	MaxConn       int           `gorm:"column:max_conn;not null;default:0"`
 }
 
 func (User) TableName() string { return "user" }

go-backend/internal/store/repo/config_policy.go

@@ -1,62 +0,0 @@
-package repo
-
-import "strings"
-
-type ConfigAccessPolicy string
-
-const (
-	ConfigAccessPublic    ConfigAccessPolicy = "public"
-	ConfigAccessSensitive ConfigAccessPolicy = "sensitive"
-)
-
-var publicConfigKeys = map[string]struct{}{
-	"app_name":            {},
-	"app_logo":            {},
-	"app_favicon":         {},
-	"app_bg_image":        {},
-	"cloudflare_site_key": {},
-}
-
-var sensitiveConfigKeys = map[string]struct{}{
-	"jwt_secret":            {},
-	"license_key":           {},
-	"cloudflare_secret_key": {},
-}
-
-func PolicyForConfig(name string) ConfigAccessPolicy {
-	if IsPublicConfigKey(name) {
-		return ConfigAccessPublic
-	}
-	if IsSensitiveConfigKey(name) {
-		return ConfigAccessSensitive
-	}
-	return ConfigAccessSensitive
-}
-
-func IsPublicConfigKey(name string) bool {
-	_, ok := publicConfigKeys[normalizeConfigKey(name)]
-	return ok
-}
-
-func IsSensitiveConfigKey(name string) bool {
-	_, ok := sensitiveConfigKeys[normalizeConfigKey(name)]
-	return ok
-}
-
-func FilterSensitiveConfigs(in map[string]string) map[string]string {
-	if len(in) == 0 {
-		return map[string]string{}
-	}
-	out := make(map[string]string, len(in))
-	for name, value := range in {
-		if IsSensitiveConfigKey(name) {
-			continue
-		}
-		out[name] = value
-	}
-	return out
-}
-
-func normalizeConfigKey(name string) string {
-	return strings.ToLower(strings.TrimSpace(name))
-}

go-backend/internal/store/repo/config_policy_test.go

@@ -1,69 +0,0 @@
-package repo
-
-import "testing"
-
-func TestConfigPolicy(t *testing.T) {
-	tests := []struct {
-		name string
-		key  string
-		want ConfigAccessPolicy
-	}{
-		{name: "app_name is public", key: "app_name", want: ConfigAccessPublic},
-		{name: "app_logo is public", key: "app_logo", want: ConfigAccessPublic},
-		{name: "app_favicon is public", key: "app_favicon", want: ConfigAccessPublic},
-		{name: "app_bg_image is public", key: "app_bg_image", want: ConfigAccessPublic},
-		{name: "cloudflare_site_key is public", key: "cloudflare_site_key", want: ConfigAccessPublic},
-		{name: "jwt_secret is sensitive", key: "jwt_secret", want: ConfigAccessSensitive},
-		{name: "license_key is sensitive", key: "license_key", want: ConfigAccessSensitive},
-		{name: "cloudflare_secret_key is sensitive", key: "cloudflare_secret_key", want: ConfigAccessSensitive},
-		{name: "trimmed public key is public", key: "  APP_NAME  ", want: ConfigAccessPublic},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := PolicyForConfig(tt.key); got != tt.want {
-				t.Fatalf("PolicyForConfig(%q) = %v, want %v", tt.key, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestConfigPolicyHelpers(t *testing.T) {
-	publicKeys := []string{"app_name", "app_logo", "app_favicon", "app_bg_image", "cloudflare_site_key"}
-	for _, key := range publicKeys {
-		if !IsPublicConfigKey(key) {
-			t.Fatalf("expected %q to be public", key)
-		}
-	}
-
-	sensitiveKeys := []string{"jwt_secret", "license_key", "cloudflare_secret_key"}
-	for _, key := range sensitiveKeys {
-		if !IsSensitiveConfigKey(key) {
-			t.Fatalf("expected %q to be sensitive", key)
-		}
-	}
-
-	input := map[string]string{
-		"app_name":              "FLVX",
-		"license_key":           "secret-license",
-		"cloudflare_secret_key": "secret-cloudflare",
-		"jwt_secret":            "secret-jwt",
-		"cloudflare_site_key":   "site-key",
-	}
-	filtered := FilterSensitiveConfigs(input)
-	if len(filtered) != 2 {
-		t.Fatalf("expected 2 public configs, got %d", len(filtered))
-	}
-	if filtered["app_name"] != "FLVX" || filtered["cloudflare_site_key"] != "site-key" {
-		t.Fatalf("unexpected filtered configs: %+v", filtered)
-	}
-	if _, ok := filtered["jwt_secret"]; ok {
-		t.Fatal("expected jwt_secret to be filtered out")
-	}
-	if _, ok := filtered["license_key"]; ok {
-		t.Fatal("expected license_key to be filtered out")
-	}
-	if _, ok := filtered["cloudflare_secret_key"]; ok {
-		t.Fatal("expected cloudflare_secret_key to be filtered out")
-	}
-}

go-backend/internal/store/repo/repository.go

@@ -1,9 +1,7 @@
 package repo
 
 import (
-	"crypto/rand"
 	"database/sql"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"log"
@@ -21,7 +19,6 @@ import (
 	"gorm.io/gorm/clause"
 	"gorm.io/gorm/logger"
 
-	"go-backend/internal/security"
 	"go-backend/internal/store/model"
 )
 
@@ -307,7 +304,6 @@ func autoMigrateAll(db *gorm.DB) error {
 	m := db.Migrator()
 	hasNode := m.HasTable(&model.Node{})
 	hasTunnel := m.HasTable(&model.Tunnel{})
-	hasForward := m.HasTable(&model.Forward{})
 
 	for _, item := range models {
 		if hasNode {
@@ -320,11 +316,6 @@ func autoMigrateAll(db *gorm.DB) error {
 				continue
 			}
 		}
-		if hasForward {
-			if _, ok := item.(*model.Forward); ok {
-				continue
-			}
-		}
 		if err := db.AutoMigrate(item); err != nil {
 			return err
 		}
@@ -405,7 +396,7 @@ func prepareSQLiteLegacyColumns(db *gorm.DB) error {
 	}
 
 	if m.HasTable(&model.Forward{}) {
-		for _, field := range []string{"MaxConn", "IPMaxConn", "IPSpeedID", "ProxyProtocol"} {
+		for _, field := range []string{"ProxyProtocol"} {
 			if m.HasColumn(&model.Forward{}, field) {
 				continue
 			}
@@ -419,23 +410,13 @@ func prepareSQLiteLegacyColumns(db *gorm.DB) error {
 }
 
 func seedData(db *gorm.DB) {
-	var adminCount int64
-	if err := db.Model(&model.User{}).Where("id = ?", 1).Count(&adminCount).Error; err == nil && adminCount == 0 {
-		adminPwd, err := security.HashPassword("admin_user")
-		if err != nil {
-			log.Printf("seed admin password hash failed: %v", err)
-		} else {
-			adminUser := model.User{
-				ID: 1, User: "admin_user", Pwd: adminPwd,
-				RoleID: 0, ExpTime: 2727251700000, Flow: 99999, InFlow: 0, OutFlow: 0,
-				FlowResetTime: 1, Num: 99999, CreatedTime: 1748914865000,
-				UpdatedTime:       sql.NullInt64{Int64: 1754011744252, Valid: true},
-				Status:            1,
-				PasswordChangedAt: 1748914865000,
-			}
-			db.Create(&adminUser)
-		}
+	adminUser := model.User{
+		ID: 1, User: "admin_user", Pwd: "3c85cdebade1c51cf64ca9f3c09d182d",
+		RoleID: 0, ExpTime: 2727251700000, Flow: 99999, InFlow: 0, OutFlow: 0,
+		FlowResetTime: 1, Num: 99999, CreatedTime: 1748914865000,
+		UpdatedTime: sql.NullInt64{Int64: 1754011744252, Valid: true}, Status: 1,
 	}
+	db.Where("id = ?", 1).FirstOrCreate(&adminUser)
 
 	appNameConfig := model.ViteConfig{ID: 1, Name: "app_name", Value: "flux", Time: 1755147963000}
 	db.Where("id = ?", 1).FirstOrCreate(&appNameConfig)
@@ -499,10 +480,9 @@ func (r *Repository) UpdateUserNameAndPassword(userID int64, username, passwordM
 		return errors.New("repository not initialized")
 	}
 	return r.db.Model(&model.User{}).Where("id = ?", userID).Updates(map[string]interface{}{
-		"user":                username,
-		"pwd":                 passwordMD5,
-		"password_changed_at": now,
-		"updated_time":        now,
+		"user":         username,
+		"pwd":          passwordMD5,
+		"updated_time": now,
 	}).Error
 }
 
@@ -1904,7 +1884,7 @@ func (r *Repository) ExportAll() (*model.BackupData, error) {
 	if err != nil {
 		return nil, fmt.Errorf("export configs failed: %w", err)
 	}
-	backup.Configs = FilterSensitiveConfigs(configs)
+	backup.Configs = configs
 
 	return backup, nil
 }
@@ -1984,7 +1964,7 @@ func (r *Repository) ExportPartial(types []string) (*model.BackupData, error) {
 		if err != nil {
 			return nil, fmt.Errorf("export configs failed: %w", err)
 		}
-		backup.Configs = FilterSensitiveConfigs(v)
+		backup.Configs = v
 	}
 	return backup, nil
 }
@@ -2366,31 +2346,26 @@ func (r *Repository) Import(backup *model.BackupData, types []string) (*model.Im
 func importUsers(tx *gorm.DB, users []model.UserBackup, now int64) (int, error) {
 	count := 0
 	for _, u := range users {
-		pwdHash, status, err := normalizeImportedUserPassword(u.Pwd, u.Status)
-		if err != nil {
-			return count, err
-		}
 		item := model.User{
-			ID:                u.ID,
-			User:              u.User,
-			Pwd:               pwdHash,
-			RoleID:            u.RoleID,
-			ExpTime:           u.ExpTime,
-			Flow:              u.Flow,
-			InFlow:            u.InFlow,
-			OutFlow:           u.OutFlow,
-			FlowResetTime:     u.FlowResetTime,
-			Num:               u.Num,
-			CreatedTime:       u.CreatedTime,
-			UpdatedTime:       sql.NullInt64{Int64: now, Valid: true},
-			Status:            status,
-			PasswordChangedAt: now,
+			ID:            u.ID,
+			User:          u.User,
+			Pwd:           u.Pwd,
+			RoleID:        u.RoleID,
+			ExpTime:       u.ExpTime,
+			Flow:          u.Flow,
+			InFlow:        u.InFlow,
+			OutFlow:       u.OutFlow,
+			FlowResetTime: u.FlowResetTime,
+			Num:           u.Num,
+			CreatedTime:   u.CreatedTime,
+			UpdatedTime:   sql.NullInt64{Int64: now, Valid: true},
+			Status:        u.Status,
 		}
-		err = tx.Clauses(clause.OnConflict{
+		err := tx.Clauses(clause.OnConflict{
 			Columns: []clause.Column{{Name: "id"}},
 			DoUpdates: clause.AssignmentColumns([]string{
 				"user", "pwd", "role_id", "exp_time", "flow", "in_flow", "out_flow",
-				"flow_reset_time", "num", "updated_time", "status", "password_changed_at",
+				"flow_reset_time", "num", "updated_time", "status",
 			}),
 		}).Create(&item).Error
 		if err != nil {
@@ -2434,33 +2409,6 @@ func importUsers(tx *gorm.DB, users []model.UserBackup, now int64) (int, error)
 	return count, nil
 }
 
-func normalizeImportedUserPassword(password string, status int) (string, int, error) {
-	password = strings.TrimSpace(password)
-	if strings.HasPrefix(password, "$2") {
-		return password, status, nil
-	}
-	if security.IsLegacyPasswordHash(password) || password == "" {
-		replacement, err := randomPasswordHash()
-		if err != nil {
-			return "", status, err
-		}
-		return replacement, 0, nil
-	}
-	hash, err := security.HashPassword(password)
-	if err != nil {
-		return "", status, err
-	}
-	return hash, status, nil
-}
-
-func randomPasswordHash() (string, error) {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return "", err
-	}
-	return security.HashPassword(hex.EncodeToString(buf))
-}
-
 func importNodes(tx *gorm.DB, nodes []model.NodeBackup, now int64) (int, error) {
 	count := 0
 	for _, n := range nodes {
@@ -2772,7 +2720,6 @@ func importPermissions(tx *gorm.DB, permissions []model.PermissionBackup, _ int6
 }
 
 func importConfigs(tx *gorm.DB, configs map[string]string, now int64) (int, error) {
-	configs = FilterSensitiveConfigs(configs)
 	count := 0
 	for name, value := range configs {
 		err := tx.Clauses(clause.OnConflict{

go-backend/internal/store/repo/repository_auth.go

@@ -1,29 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) GetUserAuthState(userID int64) (*auth.UserAuthState, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var user struct {
-		ID                int64 `gorm:"column:id"`
-		RoleID            int   `gorm:"column:role_id"`
-		Status            int   `gorm:"column:status"`
-		PasswordChangedAt int64 `gorm:"column:password_changed_at"`
-	}
-	if err := r.db.Model(&model.User{}).Select("id", "role_id", "status", "password_changed_at").Where("id = ?", userID).First(&user).Error; err != nil {
-		return nil, normalizeNotFoundErr(err)
-	}
-	return &auth.UserAuthState{
-		ID:                user.ID,
-		RoleID:            user.RoleID,
-		Status:            user.Status,
-		PasswordChangedAt: user.PasswordChangedAt,
-	}, nil
-}

go-backend/internal/store/repo/repository_auth_test.go

@@ -1,29 +0,0 @@
-package repo
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestGetUserAuthStateReturnsPasswordChangedAt(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "auth.db"))
-	if err != nil {
-		t.Fatalf("Open() error = %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	userID, err := r.CreateUser("admin_user", "pwd", 0, 2727251700000, 99999, 1, 99999, 1, 0, now)
-	if err != nil {
-		t.Fatalf("CreateUser() error = %v", err)
-	}
-
-	state, err := r.GetUserAuthState(userID)
-	if err != nil {
-		t.Fatalf("GetUserAuthState() error = %v", err)
-	}
-	if state == nil || state.PasswordChangedAt != now || state.Status != 1 || state.RoleID != 0 {
-		t.Fatalf("unexpected auth state: %+v", state)
-	}
-}

go-backend/internal/store/repo/repository_backup_test.go

@@ -4,33 +4,8 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
-
-	"go-backend/internal/security"
-	"go-backend/internal/store/model"
 )
 
-func TestSeedDataDefaultAdminUsesBcrypt(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "seed.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	admin, err := r.GetUserByUsername("admin_user")
-	if err != nil {
-		t.Fatalf("get admin user: %v", err)
-	}
-	if admin == nil {
-		t.Fatal("expected seeded admin user")
-	}
-	if security.IsLegacyPasswordHash(admin.Pwd) {
-		t.Fatalf("seeded admin password is legacy MD5: %q", admin.Pwd)
-	}
-	if ok, legacy := security.VerifyPassword(admin.Pwd, "admin_user"); !ok || legacy {
-		t.Fatalf("VerifyPassword() = (%v,%v), want (true,false)", ok, legacy)
-	}
-}
-
 func TestBackupRoundTripsTunnelProbeTarget(t *testing.T) {
 	source, err := Open(filepath.Join(t.TempDir(), "source.db"))
 	if err != nil {
@@ -82,157 +57,3 @@ func TestBackupRoundTripsTunnelProbeTarget(t *testing.T) {
 		t.Fatalf("unexpected imported probe target: %+v", items[0])
 	}
 }
-
-func TestExportAllOmitsSensitiveConfigs(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "export.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	seedConfig(t, r, "app_name", "FLVX")
-	seedConfig(t, r, "app_logo", "logo")
-	seedConfig(t, r, "app_favicon", "favicon")
-	seedConfig(t, r, "app_bg_image", "bg")
-	seedConfig(t, r, "cloudflare_site_key", "site-key")
-	seedConfig(t, r, "jwt_secret", "jwt-secret")
-	seedConfig(t, r, "license_key", "license-secret")
-	seedConfig(t, r, "cloudflare_secret_key", "cloudflare-secret")
-
-	for _, tc := range []struct {
-		name   string
-		export func() (*model.BackupData, error)
-	}{
-		{name: "ExportAll", export: r.ExportAll},
-		{name: "ExportPartial", export: func() (*model.BackupData, error) { return r.ExportPartial([]string{"configs"}) }},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			backup, err := tc.export()
-			if err != nil {
-				t.Fatalf("export backup: %v", err)
-			}
-			if backup.Configs["app_name"] != "FLVX" {
-				t.Fatalf("expected public config in export, got %+v", backup.Configs)
-			}
-			if backup.Configs["cloudflare_site_key"] != "site-key" {
-				t.Fatalf("expected public config in export, got %+v", backup.Configs)
-			}
-			for _, key := range []string{"jwt_secret", "license_key", "cloudflare_secret_key"} {
-				if _, ok := backup.Configs[key]; ok {
-					t.Fatalf("expected %s to be omitted from export, got %+v", key, backup.Configs)
-				}
-			}
-		})
-	}
-}
-
-func TestImportIgnoresSensitiveConfigs(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "import.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	seedConfig(t, r, "app_name", "before")
-	seedConfig(t, r, "jwt_secret", "jwt-before")
-	seedConfig(t, r, "license_key", "license-before")
-	seedConfig(t, r, "cloudflare_secret_key", "cloudflare-before")
-
-	backup := &model.BackupData{Configs: map[string]string{
-		"app_name":              "after",
-		"jwt_secret":            "jwt-after",
-		"license_key":           "license-after",
-		"cloudflare_secret_key": "cloudflare-after",
-	}}
-
-	result, err := r.Import(backup, []string{"configs"})
-	if err != nil {
-		t.Fatalf("import backup: %v", err)
-	}
-	if result.ConfigsImported != 1 {
-		t.Fatalf("expected one imported config, got %d", result.ConfigsImported)
-	}
-
-	assertConfigValue(t, r, "app_name", "after")
-	assertConfigValue(t, r, "jwt_secret", "jwt-before")
-	assertConfigValue(t, r, "license_key", "license-before")
-	assertConfigValue(t, r, "cloudflare_secret_key", "cloudflare-before")
-}
-
-func TestImportUsersDoesNotStoreLegacyMD5Passwords(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "legacy-user-import.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	backup := &model.BackupData{
-		Version: "1.0",
-		Users: []model.UserBackup{{
-			ID:            55,
-			User:          "legacy-import-user",
-			Pwd:           "3c85cdebade1c51cf64ca9f3c09d182d",
-			RoleID:        1,
-			ExpTime:       2727251700000,
-			Flow:          99999,
-			InFlow:        0,
-			OutFlow:       0,
-			FlowResetTime: 1,
-			Num:           99999,
-			CreatedTime:   now,
-			UpdatedTime:   now,
-			Status:        1,
-		}},
-	}
-
-	result, err := r.Import(backup, []string{"users"})
-	if err != nil {
-		t.Fatalf("Import() error = %v", err)
-	}
-	if result.UsersImported != 1 {
-		t.Fatalf("UsersImported = %d, want 1", result.UsersImported)
-	}
-
-	user, err := r.GetUserByUsername("legacy-import-user")
-	if err != nil {
-		t.Fatalf("get imported user: %v", err)
-	}
-	if user == nil {
-		t.Fatal("expected imported user")
-	}
-	if security.IsLegacyPasswordHash(user.Pwd) {
-		t.Fatalf("imported password remained legacy MD5: %q", user.Pwd)
-	}
-	if ok, _ := security.VerifyPassword(user.Pwd, "admin_user"); ok {
-		t.Fatal("legacy imported password should not remain usable")
-	}
-	if user.Status != 0 {
-		t.Fatalf("legacy imported user status = %d, want disabled status 0", user.Status)
-	}
-	if user.PasswordChangedAt <= 0 {
-		t.Fatalf("PasswordChangedAt = %d, want import revocation timestamp", user.PasswordChangedAt)
-	}
-}
-
-func seedConfig(t *testing.T, r *Repository, name, value string) {
-	t.Helper()
-	if err := r.DB().Exec(`
-		INSERT INTO vite_config(name, value, time)
-		VALUES(?, ?, ?)
-		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, name, value, time.Now().UnixMilli()).Error; err != nil {
-		t.Fatalf("seed config %s: %v", name, err)
-	}
-}
-
-func assertConfigValue(t *testing.T, r *Repository, name, want string) {
-	t.Helper()
-	cfg, err := r.GetConfigByName(name)
-	if err != nil {
-		t.Fatalf("get config %s: %v", name, err)
-	}
-	if cfg == nil || cfg.Value != want {
-		t.Fatalf("expected config %s=%q, got %+v", name, want, cfg)
-	}
-}

go-backend/internal/store/repo/repository_migrate_test.go

@@ -117,68 +117,6 @@ func TestOpenBackfillsSQLiteLegacyTunnelProbeTargetColumns(t *testing.T) {
 	}
 }
 
-func TestOpenBackfillsSQLiteLegacyForwardColumns(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "legacy-forward.db")
-	db, err := gorm.Open(gsqlite.Open(dbPath), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open legacy sqlite: %v", err)
-	}
-
-	if err := db.Exec(`
-		CREATE TABLE forward (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			user_id INTEGER NOT NULL,
-			user_name VARCHAR(100) NOT NULL,
-			name VARCHAR(100) NOT NULL,
-			tunnel_id INTEGER NOT NULL,
-			remote_addr TEXT NOT NULL,
-			strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
-			in_flow INTEGER NOT NULL DEFAULT 0,
-			out_flow INTEGER NOT NULL DEFAULT 0,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER NOT NULL,
-			status INTEGER NOT NULL,
-			inx INTEGER NOT NULL DEFAULT 0,
-			speed_id INTEGER
-		)
-	`).Error; err != nil {
-		t.Fatalf("create legacy forward table: %v", err)
-	}
-	if err := db.Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx, speed_id)
-		VALUES(1, 2, 'legacy-user', 'legacy-forward', 3, '127.0.0.1:9000', 'fifo', 0, 0, 1, 1, 1, 0, NULL)
-	`).Error; err != nil {
-		t.Fatalf("insert legacy forward: %v", err)
-	}
-	if sqlDB, _ := db.DB(); sqlDB != nil {
-		_ = sqlDB.Close()
-	}
-
-	r, err := Open(dbPath)
-	if err != nil {
-		t.Fatalf("open migrated sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	m := r.DB().Migrator()
-	for _, field := range []string{"MaxConn", "IPMaxConn", "IPSpeedID", "ProxyProtocol"} {
-		if !m.HasColumn(&model.Forward{}, field) {
-			t.Fatalf("expected forward.%s column to exist", field)
-		}
-	}
-
-	var maxConn, ipMaxConn, proxyProtocol int
-	var ipSpeedID sql.NullInt64
-	if err := r.DB().Raw(`SELECT max_conn, ip_max_conn, ip_speed_id, proxy_protocol FROM forward WHERE id = 1`).Row().Scan(&maxConn, &ipMaxConn, &ipSpeedID, &proxyProtocol); err != nil {
-		t.Fatalf("query forward defaults: %v", err)
-	}
-	if maxConn != 0 || ipMaxConn != 0 || ipSpeedID.Valid || proxyProtocol != 0 {
-		t.Fatalf("expected default forward columns 0/0/NULL/0, got max_conn=%d ip_max_conn=%d ip_speed_id=%+v proxy_protocol=%d", maxConn, ipMaxConn, ipSpeedID, proxyProtocol)
-	}
-}
-
 func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
 	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
 		Logger: logger.Default.LogMode(logger.Silent),

go-backend/internal/store/repo/repository_mutations.go

@@ -42,20 +42,19 @@ func (r *Repository) CreateUser(username, pwdHash string, roleID int, expTime, f
 		return 0, errors.New("repository not initialized")
 	}
 	user := model.User{
-		User:              username,
-		Pwd:               pwdHash,
-		RoleID:            roleID,
-		ExpTime:           expTime,
-		Flow:              flow,
-		InFlow:            0,
-		OutFlow:           0,
-		FlowResetTime:     flowResetTime,
-		Num:               num,
-		MaxConn:           maxConn,
-		CreatedTime:       now,
-		UpdatedTime:       sql.NullInt64{Int64: now, Valid: true},
-		Status:            status,
-		PasswordChangedAt: now,
+		User:          username,
+		Pwd:           pwdHash,
+		RoleID:        roleID,
+		ExpTime:       expTime,
+		Flow:          flow,
+		InFlow:        0,
+		OutFlow:       0,
+		FlowResetTime: flowResetTime,
+		Num:           num,
+		MaxConn:       maxConn,
+		CreatedTime:   now,
+		UpdatedTime:   sql.NullInt64{Int64: now, Valid: true},
+		Status:        status,
 	}
 	if err := r.db.Create(&user).Error; err != nil {
 		return 0, err
@@ -82,16 +81,15 @@ func (r *Repository) UpdateUserWithPassword(id int64, username, pwdHash string,
 	return r.db.Model(&model.User{}).
 		Where("id = ?", id).
 		Updates(map[string]interface{}{
-			"user":                username,
-			"pwd":                 pwdHash,
-			"flow":                flow,
-			"num":                 num,
-			"exp_time":            expTime,
-			"flow_reset_time":     flowResetTime,
-			"status":              status,
-			"max_conn":            maxConn,
-			"password_changed_at": now,
-			"updated_time":        sql.NullInt64{Int64: now, Valid: true},
+			"user":            username,
+			"pwd":             pwdHash,
+			"flow":            flow,
+			"num":             num,
+			"exp_time":        expTime,
+			"flow_reset_time": flowResetTime,
+			"status":          status,
+			"max_conn":        maxConn,
+			"updated_time":    sql.NullInt64{Int64: now, Valid: true},
 		}).Error
 }
 
@@ -113,19 +111,6 @@ func (r *Repository) UpdateUserWithoutPassword(id int64, username string, flow i
 		}).Error
 }
 
-func (r *Repository) UpdateUserPassword(userID int64, pwdHash string, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Model(&model.User{}).
-		Where("id = ?", userID).
-		Updates(map[string]interface{}{
-			"pwd":                 pwdHash,
-			"password_changed_at": now,
-			"updated_time":        sql.NullInt64{Int64: now, Valid: true},
-		}).Error
-}
-
 func (r *Repository) PropagateUserFlowToTunnels(userID int64, flow int64, num int, expTime, flowResetTime int64) {
 	if r == nil || r.db == nil {
 		return

go-backend/internal/ws/server.go

@@ -42,12 +42,6 @@ type nodeSession struct {
 	crypto *security.AESCrypto // 缓存的 AES 加密器，避免每条消息重建
 }
 
-type adminSession struct {
-	userID int64
-	claims auth.Claims
-	conn   *connWrap
-}
-
 type commandResponse struct {
 	Type      string          `json:"type"`
 	Success   bool            `json:"success"`
@@ -80,10 +74,9 @@ type Server struct {
 	upgrader     websocket.Upgrader
 	onNodeOnline func(nodeID int64)
 	onNodeMetric func(nodeID int64, info SystemInfo)
-	getUserAuthState func(userID int64) (*auth.UserAuthState, error)
 
 	mu      sync.RWMutex
-	admins  map[*adminSession]struct{}
+	admins  map[*connWrap]struct{}
 	nodes   map[int64]*nodeSession
 	byConn  map[*websocket.Conn]*nodeSession
 	pending map[string]pendingRequest
@@ -130,22 +123,13 @@ func NewServer(repo *repo.Repository, jwtSecret string) *Server {
 		upgrader: websocket.Upgrader{
 			CheckOrigin: func(r *http.Request) bool { return true },
 		},
-		admins:  make(map[*adminSession]struct{}),
+		admins:  make(map[*connWrap]struct{}),
 		nodes:   make(map[int64]*nodeSession),
 		byConn:  make(map[*websocket.Conn]*nodeSession),
 		pending: make(map[string]pendingRequest),
 	}
 }
 
-func (s *Server) SetUserAuthStateLookup(fn func(userID int64) (*auth.UserAuthState, error)) {
-	if s == nil {
-		return
-	}
-	s.mu.Lock()
-	s.getUserAuthState = fn
-	s.mu.Unlock()
-}
-
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	typeVal := query.Get("type")
@@ -162,32 +146,18 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if typeVal == "0" {
-		claims, ok := auth.ValidateToken(secret, s.jwtSecret)
-		if !ok {
+		if _, ok := auth.ValidateToken(secret, s.jwtSecret); !ok {
 			http.Error(w, "forbidden", http.StatusForbidden)
 			return
 		}
-		userID, err := strconv.ParseInt(claims.Sub, 10, 64)
-		if err != nil {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		if claims.RoleID != 0 {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		if !s.validateAdminSession(userID, claims) {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		s.handleAdmin(w, r, userID, claims)
+		s.handleAdmin(w, r)
 		return
 	}
 
 	http.Error(w, "bad request", http.StatusBadRequest)
 }
 
-func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request, userID int64, claims auth.Claims) {
+func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 	conn, err := s.upgrader.Upgrade(w, r, nil)
 	if err != nil {
 		return
@@ -198,19 +168,16 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request, userID int6
 		return conn.SetReadDeadline(time.Now().Add(wsPongWait))
 	})
 	done := make(chan struct{})
-	session := &adminSession{userID: userID, claims: claims, conn: cw}
-	go startKeepalive(cw, done, func() bool {
-		return s.validateAdminSession(session.userID, session.claims)
-	})
+	go startKeepalive(cw, done)
 
 	s.mu.Lock()
-	s.admins[session] = struct{}{}
+	s.admins[cw] = struct{}{}
 	s.mu.Unlock()
 
 	defer func() {
 		close(done)
 		s.mu.Lock()
-		delete(s.admins, session)
+		delete(s.admins, cw)
 		s.mu.Unlock()
 		_ = conn.Close()
 	}()
@@ -233,7 +200,7 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 		return conn.SetReadDeadline(time.Now().Add(wsPongWait))
 	})
 	done := make(chan struct{})
-	go startKeepalive(cw, done, nil)
+	go startKeepalive(cw, done)
 
 	version := r.URL.Query().Get("version")
 	httpVal := parseIntDefault(r.URL.Query().Get("http"), 0)
@@ -587,21 +554,18 @@ func (s *Server) broadcastTyped(nodeID int64, msgType string, data string) {
 
 func (s *Server) broadcastToAdmins(message string) {
 	s.mu.RLock()
-	admins := make([]*adminSession, 0, len(s.admins))
+	admins := make([]*connWrap, 0, len(s.admins))
 	for c := range s.admins {
 		admins = append(admins, c)
 	}
 	s.mu.RUnlock()
 
 	for _, c := range admins {
-		if c == nil || c.conn == nil || c.conn.conn == nil {
-			continue
-		}
-		c.conn.mu.Lock()
-		_ = c.conn.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
-		err := c.conn.conn.WriteMessage(websocket.TextMessage, []byte(message))
-		_ = c.conn.conn.SetWriteDeadline(time.Time{})
-		c.conn.mu.Unlock()
+		c.mu.Lock()
+		_ = c.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
+		err := c.conn.WriteMessage(websocket.TextMessage, []byte(message))
+		_ = c.conn.SetWriteDeadline(time.Time{})
+		c.mu.Unlock()
 		if err != nil {
 			log.Printf("websocket broadcast failed: %v", err)
 		}
@@ -638,24 +602,7 @@ func parseIntDefault(v string, fallback int) int {
 	return x
 }
 
-func (s *Server) validateAdminSession(userID int64, claims auth.Claims) bool {
-	if s == nil {
-		return false
-	}
-	if claims.Exp <= time.Now().Unix() {
-		return false
-	}
-	if s.getUserAuthState == nil {
-		return true
-	}
-	state, err := s.getUserAuthState(userID)
-	if err != nil || state == nil || state.Status != 1 || state.RoleID != claims.RoleID || claims.IatMs <= state.PasswordChangedAt {
-		return false
-	}
-	return true
-}
-
-func startKeepalive(cw *connWrap, done <-chan struct{}, validate func() bool) {
+func startKeepalive(cw *connWrap, done <-chan struct{}) {
 	if cw == nil || cw.conn == nil {
 		return
 	}
@@ -667,10 +614,6 @@ func startKeepalive(cw *connWrap, done <-chan struct{}, validate func() bool) {
 		case <-done:
 			return
 		case <-ticker.C:
-			if validate != nil && !validate() {
-				_ = cw.conn.Close()
-				return
-			}
 			cw.mu.Lock()
 			_ = cw.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
 			err := cw.conn.WriteMessage(websocket.PingMessage, nil)

go-backend/internal/ws/server_test.go

@@ -1,110 +0,0 @@
-package ws
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"testing"
-
-	"go-backend/internal/auth"
-)
-
-func TestServeHTTPRejectsDisabledAdminToken(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	server := NewServer(nil, secret)
-	server.SetUserAuthStateLookup(func(userID int64) (*auth.UserAuthState, error) {
-		return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 0, PasswordChangedAt: 0}, nil
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/system-info?type=0&secret="+url.QueryEscape(token), nil)
-	rec := httptest.NewRecorder()
-
-	server.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusForbidden {
-		t.Fatalf("expected forbidden for disabled admin token, got %d", rec.Code)
-	}
-}
-
-func TestServeHTTPRejectsNonAdminToken(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(2, "normal_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	server := NewServer(nil, secret)
-	server.SetUserAuthStateLookup(func(userID int64) (*auth.UserAuthState, error) {
-		return &auth.UserAuthState{ID: userID, RoleID: 1, Status: 1, PasswordChangedAt: 0}, nil
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/system-info?type=0&secret="+url.QueryEscape(token), nil)
-	rec := httptest.NewRecorder()
-
-	server.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusForbidden {
-		t.Fatalf("expected forbidden for non-admin token, got %d", rec.Code)
-	}
-}
-
-func TestValidateAdminSessionRejectsAuthStateChanges(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-
-	tests := []struct {
-		name  string
-		state *auth.UserAuthState
-	}{
-		{name: "disabled", state: &auth.UserAuthState{ID: 1, RoleID: 0, Status: 0, PasswordChangedAt: 0}},
-		{name: "role changed", state: &auth.UserAuthState{ID: 1, RoleID: 1, Status: 1, PasswordChangedAt: 0}},
-		{name: "password changed", state: &auth.UserAuthState{ID: 1, RoleID: 0, Status: 1, PasswordChangedAt: claims.IatMs + 1}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			server := NewServer(nil, secret)
-			server.SetUserAuthStateLookup(func(userID int64) (*auth.UserAuthState, error) {
-				return tt.state, nil
-			})
-
-			if ok := server.validateAdminSession(1, claims); ok {
-				t.Fatalf("expected session validation to fail for %s state", tt.name)
-			}
-		})
-	}
-}
-
-func TestValidateAdminSessionRejectsExpiredToken(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-	claims.Exp = 1
-
-	server := NewServer(nil, secret)
-	server.SetUserAuthStateLookup(func(userID int64) (*auth.UserAuthState, error) {
-		return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 1, PasswordChangedAt: 0}, nil
-	})
-
-	if ok := server.validateAdminSession(1, claims); ok {
-		t.Fatal("expected expired token to be rejected")
-	}
-}

go-backend/tests/contract/auth_contract_test.go

@@ -1,7 +1,6 @@
 package contract_test
 
 import (
-	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,7 +9,6 @@ import (
 	"go-backend/internal/auth"
 	"go-backend/internal/http/middleware"
 	"go-backend/internal/http/response"
-	"go-backend/internal/security"
 )
 
 func TestJWTMiddlewareContracts(t *testing.T) {
@@ -20,9 +18,7 @@ func TestJWTMiddlewareContracts(t *testing.T) {
 		response.WriteJSON(w, response.OK("pass"))
 	})
 
-	wrapped := middleware.JWT(middleware.AuthOptions{JWTSecret: secret, GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-		return &auth.UserAuthState{ID: userID, RoleID: 0, Status: 1, PasswordChangedAt: 0}, nil
-	}})(next)
+	wrapped := middleware.JWT(middleware.AuthOptions{JWTSecret: secret})(next)
 
 	t.Run("login path is excluded", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", nil)
@@ -63,9 +59,6 @@ func TestJWTMiddlewareContracts(t *testing.T) {
 		if err != nil {
 			t.Fatalf("generate token: %v", err)
 		}
-		wrapped := middleware.JWT(middleware.AuthOptions{JWTSecret: secret, GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 1, Status: 1, PasswordChangedAt: 0}, nil
-		}})(next)
 		req := httptest.NewRequest(http.MethodPost, "/api/v1/config/update", nil)
 		req.Header.Set("Authorization", token)
 		res := httptest.NewRecorder()
@@ -74,83 +67,6 @@ func TestJWTMiddlewareContracts(t *testing.T) {
 	})
 }
 
-func TestLoginTokenValidatesThroughRouter(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	seedLegacyUser(t, r, 9110, "router-login-user", "router-login-pass")
-
-	body := bytes.NewBufferString(`{"username":"router-login-user","password":"router-login-pass","captchaId":""}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-	router.ServeHTTP(resp, req)
-
-	var out response.R
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		t.Fatalf("decode login response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected login code 0, got %d (%s)", out.Code, out.Msg)
-	}
-	data, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected login data map, got %T", out.Data)
-	}
-	token, _ := data["token"].(string)
-	if token == "" {
-		t.Fatal("expected login token")
-	}
-
-	checkReq := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/tunnel", nil)
-	checkReq.Header.Set("Authorization", token)
-	checkResp := httptest.NewRecorder()
-	router.ServeHTTP(checkResp, checkReq)
-	assertCode(t, checkResp, 0)
-}
-
-func TestLegacyPasswordMigratesOnLogin(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	legacyChangedAt := seedLegacyUser(t, r, 9101, "legacy-login-user", "legacy-login-pass")
-
-	body := bytes.NewBufferString(`{"username":"legacy-login-user","password":"legacy-login-pass","captchaId":""}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCode(t, resp, 0)
-	assertUserPasswordIsBcrypt(t, r, "legacy-login-user", "legacy-login-pass")
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "legacy-login-user"); changedAt <= legacyChangedAt {
-		t.Fatalf("expected password_changed_at to advance on login migration, got %d <= %d", changedAt, legacyChangedAt)
-	}
-}
-
-func TestDisabledLegacyPasswordIsRejectedWithoutMigration(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	legacyChangedAt := seedLegacyUserWithStatus(t, r, 9105, "disabled-legacy-user", "disabled-legacy-pass", 0)
-
-	body := bytes.NewBufferString(`{"username":"disabled-legacy-user","password":"disabled-legacy-pass","captchaId":""}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCodeMsg(t, resp, -1, "账号被停用")
-
-	user, err := r.GetUserByUsername("disabled-legacy-user")
-	if err != nil {
-		t.Fatalf("get user: %v", err)
-	}
-	if user == nil {
-		t.Fatal("expected disabled user to exist")
-	}
-	if ok, migrated := security.VerifyPassword(user.Pwd, "disabled-legacy-pass"); !ok || !migrated {
-		t.Fatalf("expected disabled user to remain legacy MD5, got (%v,%v) with hash %q", ok, migrated, user.Pwd)
-	}
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "disabled-legacy-user"); changedAt != legacyChangedAt {
-		t.Fatalf("expected password_changed_at to remain unchanged, got %d want %d", changedAt, legacyChangedAt)
-	}
-}
-
 func assertCode(t *testing.T, rec *httptest.ResponseRecorder, expected int) {
 	t.Helper()
 	var out response.R

go-backend/tests/contract/migration_contract_test.go

@@ -17,7 +17,6 @@ import (
 	httpserver "go-backend/internal/http"
 	"go-backend/internal/http/handler"
 	"go-backend/internal/http/response"
-	"go-backend/internal/security"
 	"go-backend/internal/store/repo"
 
 	"gorm.io/gorm"
@@ -129,46 +128,6 @@ func TestCaptchaVerifyLoginContract(t *testing.T) {
 	})
 }
 
-func TestPublicConfigGetAndAuthConfigContract(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-
-	for name, value := range map[string]string{
-		"app_name":              "FLVX Public",
-		"app_logo":              "logo",
-		"app_favicon":           "favicon",
-		"app_bg_image":          "bg",
-		"cloudflare_site_key":   "site-key",
-		"cloudflare_secret_key": "secret-key",
-		"jwt_secret":            "jwt-secret",
-	} {
-		if err := r.DB().Exec(`
-			INSERT INTO vite_config(name, value, time)
-			VALUES(?, ?, ?)
-			ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-		`, name, value, time.Now().UnixMilli()).Error; err != nil {
-			t.Fatalf("seed config %s: %v", name, err)
-		}
-	}
-
-	publicReq := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
-	publicReq.Header.Set("Content-Type", "application/json")
-	publicResp := httptest.NewRecorder()
-	router.ServeHTTP(publicResp, publicReq)
-	assertCode(t, publicResp, 0)
-
-	secretReq := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"jwt_secret"}`))
-	secretReq.Header.Set("Content-Type", "application/json")
-	secretResp := httptest.NewRecorder()
-	router.ServeHTTP(secretResp, secretReq)
-	assertCodeMsg(t, secretResp, 403, "禁止访问敏感配置")
-
-	configReq := httptest.NewRequest(http.MethodPost, "/api/v1/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
-	configReq.Header.Set("Content-Type", "application/json")
-	configResp := httptest.NewRecorder()
-	router.ServeHTTP(configResp, configReq)
-	assertCodeMsg(t, configResp, 401, "未登录或token已过期")
-}
-
 func TestOpenAPISubStoreContracts(t *testing.T) {
 	router, r := setupContractRouter(t, "contract-jwt-secret")
 
@@ -250,122 +209,6 @@ func TestOpenAPISubStoreContracts(t *testing.T) {
 	})
 }
 
-func TestLegacyPasswordMigratesOnSubStore(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	legacyChangedAt := seedLegacyUser(t, r, 9102, "legacy-substore-user", "legacy-substore-pass")
-
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=legacy-substore-user&pwd=legacy-substore-pass", nil)
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		t.Fatalf("read body: %v", err)
-	}
-	expected := "upload=0; download=0; total=107373108658176; expire=2727251700"
-	if string(body) != expected {
-		t.Fatalf("expected body %q, got %q", expected, string(body))
-	}
-	assertUserPasswordIsBcrypt(t, r, "legacy-substore-user", "legacy-substore-pass")
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "legacy-substore-user"); changedAt <= legacyChangedAt {
-		t.Fatalf("expected password_changed_at to advance on sub-store migration, got %d <= %d", changedAt, legacyChangedAt)
-	}
-}
-
-func TestDisabledLegacyPasswordIsRejectedOnSubStoreWithoutMigration(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	legacyChangedAt := seedLegacyUserWithStatus(t, r, 9106, "disabled-substore-user", "disabled-substore-pass", 0)
-
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=disabled-substore-user&pwd=disabled-substore-pass", nil)
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCodeMsg(t, resp, -1, "账号被停用")
-
-	user, err := r.GetUserByUsername("disabled-substore-user")
-	if err != nil {
-		t.Fatalf("get user: %v", err)
-	}
-	if user == nil {
-		t.Fatal("expected disabled user to exist")
-	}
-	if ok, migrated := security.VerifyPassword(user.Pwd, "disabled-substore-pass"); !ok || !migrated {
-		t.Fatalf("expected disabled user to remain legacy MD5, got (%v,%v) with hash %q", ok, migrated, user.Pwd)
-	}
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "disabled-substore-user"); changedAt != legacyChangedAt {
-		t.Fatalf("expected password_changed_at to remain unchanged, got %d want %d", changedAt, legacyChangedAt)
-	}
-}
-
-func TestUserCreateStoresStrongHash(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	startedAt := time.Now().UnixMilli()
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, "contract-jwt-secret")
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	body := bytes.NewBufferString(`{"user":"created-user","pwd":"created-pass"}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/create", body)
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCode(t, resp, 0)
-	assertUserPasswordIsBcrypt(t, r, "created-user", "created-pass")
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "created-user"); changedAt < startedAt {
-		t.Fatalf("expected password_changed_at to be set on create, got %d < %d", changedAt, startedAt)
-	}
-}
-
-func TestUserUpdateStoresStrongHash(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	seedLegacyUser(t, r, 9103, "legacy-update-user", "legacy-update-pass")
-	startedAt := time.Now().UnixMilli()
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, "contract-jwt-secret")
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	body := bytes.NewBufferString(`{"id":9103,"user":"updated-user","pwd":"updated-pass","flow":99999,"num":99999,"expTime":2727251700000,"flowResetTime":1,"status":1,"maxConn":0}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/update", body)
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCode(t, resp, 0)
-	assertUserPasswordIsBcrypt(t, r, "updated-user", "updated-pass")
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "updated-user"); changedAt < startedAt {
-		t.Fatalf("expected password_changed_at to be updated on user update, got %d < %d", changedAt, startedAt)
-	}
-}
-
-func TestUpdatePasswordStoresStrongHash(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
-	seedLegacyUser(t, r, 9104, "legacy-self-user", "legacy-self-pass")
-	startedAt := time.Now().UnixMilli()
-	token, err := auth.GenerateToken(9104, "legacy-self-user", 1, "contract-jwt-secret")
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	body := bytes.NewBufferString(`{"newUsername":"self-updated-user","currentPassword":"legacy-self-pass","newPassword":"self-updated-pass","confirmPassword":"self-updated-pass"}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/updatePassword", body)
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	assertCode(t, resp, 0)
-	assertUserPasswordIsBcrypt(t, r, "self-updated-user", "self-updated-pass")
-	if changedAt := mustQueryPasswordChangedAtByUsername(t, r, "self-updated-user"); changedAt < startedAt {
-		t.Fatalf("expected password_changed_at to be updated on password change, got %d < %d", changedAt, startedAt)
-	}
-}
-
 func TestSpeedLimitTunnelsRouteRemoved(t *testing.T) {
 	secret := "contract-jwt-secret"
 	router, _ := setupContractRouter(t, secret)
@@ -389,7 +232,6 @@ func TestSpeedLimitTunnelsRouteRemoved(t *testing.T) {
 func TestBackupExportImportRestoreContracts(t *testing.T) {
 	secret := "contract-jwt-secret"
 	router, r := setupContractRouter(t, secret)
-	seedContractUser(t, r, 2, "normal_user", 1, 1)
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {
@@ -717,71 +559,6 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 	})
 }
 
-func TestBackupConfigFilteringContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	configs := map[string]string{
-		"app_name":              "contract-before",
-		"cloudflare_site_key":   "site-key-before",
-		"jwt_secret":            "jwt-before",
-		"license_key":           "license-before",
-		"cloudflare_secret_key": "cloudflare-before",
-	}
-	for name, value := range configs {
-		if err := r.DB().Exec(`
-			INSERT INTO vite_config(name, value, time)
-			VALUES(?, ?, ?)
-			ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-		`, name, value, time.Now().UnixMilli()).Error; err != nil {
-			t.Fatalf("seed config %s: %v", name, err)
-		}
-	}
-
-	payload := exportBackupPayload(t, router, "/api/v1/backup/export", adminToken)
-	for _, key := range []string{"jwt_secret", "license_key", "cloudflare_secret_key"} {
-		if _, ok := payload.Configs[key]; ok {
-			t.Fatalf("expected %s to be omitted from exported configs: %+v", key, payload.Configs)
-		}
-	}
-	if payload.Configs["app_name"] != "contract-before" {
-		t.Fatalf("expected public config to be exported, got %+v", payload.Configs)
-	}
-
-	payload.Configs["app_name"] = "contract-after"
-	payload.Configs["jwt_secret"] = "jwt-after"
-	payload.Configs["license_key"] = "license-after"
-	payload.Configs["cloudflare_secret_key"] = "cloudflare-after"
-	raw, err := json.Marshal(backupImportPayload{Types: []string{"configs"}, backupExportPayload: payload})
-	if err != nil {
-		t.Fatalf("marshal import payload: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/backup/import", bytes.NewReader(raw))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-
-	router.ServeHTTP(resp, req)
-	var out response.R
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		t.Fatalf("decode import response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected import code 0, got %d (%s)", out.Code, out.Msg)
-	}
-
-	assertConfigValue(t, r, "app_name", "contract-after")
-	assertConfigValue(t, r, "jwt_secret", "jwt-before")
-	assertConfigValue(t, r, "license_key", "license-before")
-	assertConfigValue(t, r, "cloudflare_secret_key", "cloudflare-before")
-}
-
 type backupExportPayload struct {
 	Version    string            `json:"version"`
 	ExportedAt int64             `json:"exportedAt"`
@@ -842,66 +619,6 @@ func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *repo.Re
 	return httpserver.NewRouter(h, jwtSecret), r
 }
 
-func assertConfigValue(t *testing.T, r *repo.Repository, name, want string) {
-	t.Helper()
-	cfg, err := r.GetConfigByName(name)
-	if err != nil {
-		t.Fatalf("get config %s: %v", name, err)
-	}
-	if cfg == nil || cfg.Value != want {
-		t.Fatalf("expected config %s=%q, got %+v", name, want, cfg)
-	}
-}
-
-func seedLegacyUser(t *testing.T, r *repo.Repository, id int64, username, password string) int64 {
-	return seedLegacyUserWithStatus(t, r, id, username, password, 1)
-}
-
-func seedContractUser(t *testing.T, r *repo.Repository, id int64, username string, roleID, status int) int64 {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	passwordChangedAt := now - 10_000
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, max_conn, created_time, updated_time, status, password_changed_at)
-		VALUES(?, ?, ?, ?, 2727251700000, 99999, 0, 0, 1, 99999, 0, ?, ?, ?, ?)
-	`, id, username, security.MD5("contract-pass"), roleID, now, now, status, passwordChangedAt).Error; err != nil {
-		t.Fatalf("seed contract user %s: %v", username, err)
-	}
-	return passwordChangedAt
-}
-
-func seedLegacyUserWithStatus(t *testing.T, r *repo.Repository, id int64, username, password string, status int) int64 {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	legacyChangedAt := now - 10_000
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, max_conn, created_time, updated_time, status, password_changed_at)
-		VALUES(?, ?, ?, 1, 2727251700000, 99999, 0, 0, 1, 99999, 0, ?, ?, ?, ?)
-	`, id, username, security.MD5(password), now, now, status, legacyChangedAt).Error; err != nil {
-		t.Fatalf("seed legacy user %s: %v", username, err)
-	}
-	return legacyChangedAt
-}
-
-func mustQueryPasswordChangedAtByUsername(t *testing.T, r *repo.Repository, username string) int64 {
-	t.Helper()
-	return mustQueryInt64(t, r, `SELECT password_changed_at FROM user WHERE user = ?`, username)
-}
-
-func assertUserPasswordIsBcrypt(t *testing.T, r *repo.Repository, username, password string) {
-	t.Helper()
-	user, err := r.GetUserByUsername(username)
-	if err != nil {
-		t.Fatalf("get user %s: %v", username, err)
-	}
-	if user == nil {
-		t.Fatalf("expected user %s to exist", username)
-	}
-	if ok, migrated := security.VerifyPassword(user.Pwd, password); !ok || migrated {
-		t.Fatalf("expected bcrypt password for %s, got %q", username, user.Pwd)
-	}
-}
-
 func TestOpenMigratesLegacyNodeDualStackColumns(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "legacy-2.0.7-beta.db")
 	legacyDB, err := sql.Open("sqlite", dbPath)

go-backend/tests/contract/monitoring_contract_test.go

@@ -16,7 +16,6 @@ import (
 func TestNodeMetricsEndpoints(t *testing.T) {
 	secret := "monitoring-jwt-secret"
 	router, repo := setupContractRouter(t, secret)
-	seedContractUser(t, repo, 2, "normal_user", 1, 1)
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {
@@ -1303,7 +1302,6 @@ func TestMonitoringAuthRequired(t *testing.T) {
 func TestMonitorAccessEndpoint(t *testing.T) {
 	secret := "monitoring-jwt-secret"
 	router, repo := setupContractRouter(t, secret)
-	seedContractUser(t, repo, 2, "normal_user", 1, 1)
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {
@@ -1359,7 +1357,6 @@ func TestMonitorAccessEndpoint(t *testing.T) {
 func TestMonitoringPermissionRequired(t *testing.T) {
 	secret := "monitoring-jwt-secret"
 	router, repo := setupContractRouter(t, secret)
-	seedContractUser(t, repo, 2, "normal_user", 1, 1)
 
 	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
 	if err != nil {

go-backend/tests/contract/storage_contract_test.go

@@ -12,8 +12,7 @@ import (
 
 func TestStorageSummaryRequiresAdminAndReturnsSize(t *testing.T) {
 	secret := "storage-contract-secret"
-	router, r := setupContractRouter(t, secret)
-	seedContractUser(t, r, 2, "normal_user", 1, 1)
+	router, _ := setupContractRouter(t, secret)
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {

go-gost/x/socket/websocket_reporter.go

@@ -158,9 +158,6 @@ type WebSocketReporter struct {
 	addr              string // 保存服务器地址
 	secret            string // 保存密钥
 	version           string // 保存版本号
-	http              int
-	tls               int
-	socks             int
 	preferredWSScheme string
 	conn              *websocket.Conn
 	curBackoff        time.Duration // 当前重连退避间隔
@@ -299,9 +296,9 @@ func (w *WebSocketReporter) connect() error {
 		Socks  int    `json:"socks"`
 	}
 
-	cfg := LocalConfig{Http: w.http, Tls: w.tls, Socks: w.socks}
+	var cfg LocalConfig
 	if b, err := os.ReadFile("config.json"); err == nil {
-		_ = json.Unmarshal(b, &cfg)
+		json.Unmarshal(b, &cfg)
 	}
 
 	candidates := buildWebSocketCandidates(w.addr, w.secret, w.version, cfg.Http, cfg.Tls, cfg.Socks, w.preferredWSScheme)
@@ -1372,7 +1369,7 @@ func (w *WebSocketReporter) handleUpgradeAgent(data interface{}) error {
 	// 执行重启脚本
 	// 使用 systemd-run 在独立的 transient unit 中运行重启脚本，
 	// 避免 systemctl stop 杀死 flux_agent cgroup 内所有进程（包括此脚本自身）导致 mv 未执行。
-	script := buildAgentRestartScript(tmpPath, binaryPath)
+	script := fmt.Sprintf("sleep 1 && systemctl stop flux_agent && mv %s %s && systemctl start flux_agent", tmpPath, binaryPath)
 	cmd := exec.Command("systemd-run", "--quiet", "/bin/sh", "-c", script)
 	if err := cmd.Start(); err != nil {
 		os.Remove(tmpPath)
@@ -1406,14 +1403,6 @@ func (w *WebSocketReporter) handleRollbackAgent(data interface{}) error {
 	return nil
 }
 
-func buildAgentRestartScript(tmpPath, binaryPath string) string {
-	return fmt.Sprintf(
-		"sleep 1 && systemctl stop flux_agent && legacy_service='' && for service_file in /etc/systemd/system/gost.service /lib/systemd/system/gost.service /usr/lib/systemd/system/gost.service; do if [ -f \"$service_file\" ] && grep -Fq \"WorkingDirectory=/etc/gost\" \"$service_file\" && (grep -Fq \"ExecStart=/etc/gost/gost\" \"$service_file\" || (grep -Fq \"ExecStart=/usr/local/bin/gost\" \"$service_file\" && [ -f /etc/gost/config.json ] && [ -f /etc/gost/gost.json ])); then legacy_service=\"$service_file\"; break; fi; done && if [ -n \"$legacy_service\" ]; then (systemctl stop gost 2>/dev/null || true) && (systemctl disable gost 2>/dev/null || true) && rm -f /usr/local/bin/gost /etc/gost/gost \"$legacy_service\" && (systemctl daemon-reload 2>/dev/null || true); fi && mv %s %s && systemctl start flux_agent",
-		tmpPath,
-		binaryPath,
-	)
-}
-
 // updateLocalConfigJSON 将 http/tls/socks 写入工作目录下的 config.json
 func updateLocalConfigJSON(httpVal int, tlsVal int, socksVal int) error {
 	path := "config.json"
@@ -1661,16 +1650,13 @@ func StartWebSocketReporterWithConfig(addr string, secret string, http int, tls
 	candidates := buildWebSocketCandidates(addr, secret, version, http, tls, socks, "")
 	fullURL := candidates[0]
 
-	fmt.Printf("🔗 WebSocket连接URL: %s\n", sanitizeWebSocketURL(fullURL))
+	fmt.Printf("🔗 WebSocket连接URL: %s\n", fullURL)
 
 	reporter := NewWebSocketReporter(fullURL, secret)
-	// 保存 addr, secret, version 和协议能力供重连时使用
+	// 保存 addr, secret, version 供重连时使用
 	reporter.addr = addr
 	reporter.secret = secret
 	reporter.version = version
-	reporter.http = http
-	reporter.tls = tls
-	reporter.socks = socks
 	reporter.Start()
 	return reporter
 }

go-gost/x/socket/websocket_reporter_test.go

@@ -1,45 +1,15 @@
 package socket
 
 import (
-	"bytes"
 	"errors"
 	"io"
 	"net/http"
-	"os"
-	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/gorilla/websocket"
 )
 
-func captureStdout(t *testing.T, fn func()) string {
-	t.Helper()
-
-	orig := os.Stdout
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatalf("create stdout pipe: %v", err)
-	}
-	os.Stdout = w
-	defer func() {
-		os.Stdout = orig
-		_ = w.Close()
-		_ = r.Close()
-	}()
-
-	fn()
-
-	_ = w.Close()
-
-	var buf bytes.Buffer
-	if _, err := io.Copy(&buf, r); err != nil {
-		t.Fatalf("read stdout: %v", err)
-	}
-	return buf.String()
-}
-
 func TestBuildWebSocketCandidatesSecureFirst(t *testing.T) {
 	candidates := buildWebSocketCandidates("panel.example.com:443", "abc", "2.0.2", 1, 0, 1, "")
 
@@ -163,103 +133,3 @@ func TestFormatWebSocketDialErrorIncludesHTTPStatus(t *testing.T) {
 		t.Fatalf("expected response body in message, got %s", msg)
 	}
 }
-
-func TestAgentUpgradeRestartScriptStopsLegacyGostService(t *testing.T) {
-	script := buildAgentRestartScript("/tmp/flux_agent.new", "/etc/flux_agent/flux_agent")
-
-	if !strings.Contains(script, "systemctl stop flux_agent") {
-		t.Fatalf("expected script to stop flux_agent, got %s", script)
-	}
-	if !strings.Contains(script, "mv /tmp/flux_agent.new /etc/flux_agent/flux_agent") {
-		t.Fatalf("expected script to replace the flux_agent binary, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl stop gost") {
-		t.Fatalf("expected script to stop the legacy gost service, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl disable gost") {
-		t.Fatalf("expected script to disable the legacy gost service, got %s", script)
-	}
-	if !strings.Contains(script, "rm -f /usr/local/bin/gost") {
-		t.Fatalf("expected script to remove the legacy gost binary, got %s", script)
-	}
-	if !strings.Contains(script, "WorkingDirectory=/etc/gost") {
-		t.Fatalf("expected script to scope cleanup to the legacy FLVX gost service definition, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl start flux_agent") {
-		t.Fatalf("expected script to restart flux_agent, got %s", script)
-	}
-	if strings.Contains(script, "systemctl stop flux_agent && systemctl stop gost 2>/dev/null || true") {
-		t.Fatalf("expected legacy gost cleanup fallback to be scoped, got %s", script)
-	}
-	if runtime.GOARCH == "" {
-		t.Fatalf("unexpected empty runtime arch")
-	}
-}
-
-func TestStartWebSocketReporterWithConfigPreservesProtocolDefaultsWithoutConfigFile(t *testing.T) {
-	origDial := wsDial
-	defer func() { wsDial = origDial }()
-
-	origWD, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("get working directory: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origWD)
-	})
-	if err := os.Chdir(t.TempDir()); err != nil {
-		t.Fatalf("change working directory: %v", err)
-	}
-
-	urls := make(chan string, 1)
-	wsDial = func(_ *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
-		select {
-		case urls <- rawURL:
-		default:
-		}
-		return nil, nil, errors.New("dial failed")
-	}
-
-	reporter := StartWebSocketReporterWithConfig("panel.example.com:443", "abc", 1, 0, 1, "2.0.2")
-	defer reporter.Stop()
-
-	select {
-	case rawURL := <-urls:
-		if !strings.Contains(rawURL, "http=1&tls=0&socks=1") {
-			t.Fatalf("expected reconnect URL to preserve startup protocol values, got %s", rawURL)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("timed out waiting for websocket dial")
-	}
-}
-
-func TestStartWebSocketReporterWithConfigLogsSanitizedURL(t *testing.T) {
-	origDial := wsDial
-	defer func() { wsDial = origDial }()
-
-	ready := make(chan struct{}, 1)
-	wsDial = func(_ *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
-		select {
-		case ready <- struct{}{}:
-		default:
-		}
-		return nil, nil, errors.New("dial failed")
-	}
-
-	output := captureStdout(t, func() {
-		reporter := StartWebSocketReporterWithConfig("panel.example.com:443", "abc123", 1, 0, 1, "2.0.2")
-		select {
-		case <-ready:
-		case <-time.After(2 * time.Second):
-			t.Fatal("timed out waiting for websocket dial")
-		}
-		reporter.Stop()
-	})
-
-	if strings.Contains(output, "secret=abc123") {
-		t.Fatalf("expected logged websocket URL to mask the node secret, got %s", output)
-	}
-	if !strings.Contains(output, "secret=%2A%2A%2A") {
-		t.Fatalf("expected logged websocket URL to include masked secret, got %s", output)
-	}
-}

install.sh

@@ -24,11 +24,6 @@ get_architecture() {
 
 # 安装目录
 INSTALL_DIR="/etc/flux_agent"
-LEGACY_GOST_BINARY="/usr/local/bin/gost"
-LEGACY_GOST_CONFIG_DIR="/etc/gost"
-LEGACY_GOST_SERVICE_FILE_ETC="/etc/systemd/system/gost.service"
-LEGACY_GOST_SERVICE_FILE_LIB="/lib/systemd/system/gost.service"
-LEGACY_GOST_SERVICE_FILE_USR_LIB="/usr/lib/systemd/system/gost.service"
 
 # 镜像加速配置（可由面板传入或交互式询问）
 PROXY_ENABLED="${PROXY_ENABLED:-}"
@@ -239,69 +234,6 @@ check_and_install_tcpkill() {
   return 0
 }
 
-json_escape() {
-  local value="$1"
-  value=${value//\\/\\\\}
-  value=${value//\"/\\\"}
-  value=${value//$'\n'/\\n}
-  value=${value//$'\r'/\\r}
-  value=${value//$'\t'/\\t}
-  printf '%s' "$value"
-}
-
-write_flux_agent_config() {
-  local path="$1"
-  printf '{\n  "addr": "%s",\n  "secret": "%s"\n}\n' \
-    "$(json_escape "$SERVER_ADDR")" \
-    "$(json_escape "$SECRET")" > "$path"
-}
-
-cleanup_legacy_gost_installation() {
-  local matched_service_files=()
-  local service_file=""
-  local removed_service_file="0"
-
-  for service_file in "$LEGACY_GOST_SERVICE_FILE_ETC" "$LEGACY_GOST_SERVICE_FILE_LIB" "$LEGACY_GOST_SERVICE_FILE_USR_LIB"; do
-    if [[ ! -f "$service_file" ]]; then
-      continue
-    fi
-    if ! grep -Fq "WorkingDirectory=$LEGACY_GOST_CONFIG_DIR" "$service_file"; then
-      continue
-    fi
-    if grep -Fq "ExecStart=$LEGACY_GOST_CONFIG_DIR/gost" "$service_file" || \
-      (grep -Fq "ExecStart=$LEGACY_GOST_BINARY" "$service_file" && [[ -f "$LEGACY_GOST_CONFIG_DIR/config.json" && -f "$LEGACY_GOST_CONFIG_DIR/gost.json" ]]); then
-      matched_service_files+=("$service_file")
-    fi
-  done
-
-  if [[ ${#matched_service_files[@]} -eq 0 ]]; then
-    return 0
-  fi
-
-  if systemctl list-units --full -all 2>/dev/null | grep -Fq "gost.service"; then
-    systemctl stop gost 2>/dev/null || true
-    systemctl disable gost 2>/dev/null || true
-  fi
-
-  for service_file in "${matched_service_files[@]}"; do
-    if [[ -f "$service_file" ]]; then
-      rm -f "$service_file"
-      removed_service_file="1"
-    fi
-  done
-
-  if [[ -f "$LEGACY_GOST_BINARY" ]]; then
-    rm -f "$LEGACY_GOST_BINARY"
-  fi
-  if [[ -f "$LEGACY_GOST_CONFIG_DIR/gost" ]]; then
-    rm -f "$LEGACY_GOST_CONFIG_DIR/gost"
-  fi
-
-  if [[ "$removed_service_file" == "1" ]]; then
-    systemctl daemon-reload 2>/dev/null || true
-  fi
-}
-
 
 # 获取用户输入的配置参数
 get_config_params() {
@@ -347,8 +279,6 @@ install_flux_agent() {
 
   mkdir -p "$INSTALL_DIR"
 
-  local tmp_binary="$INSTALL_DIR/flux_agent.new"
-
   # 停止并禁用已有服务
   if systemctl list-units --full -all | grep -Fq "flux_agent.service"; then
     echo "🔍 检测到已存在的flux_agent服务"
@@ -356,17 +286,16 @@ install_flux_agent() {
     systemctl disable flux_agent 2>/dev/null && echo "🚫 禁用自启"
   fi
 
+  # 删除旧文件
+  [[ -f "$INSTALL_DIR/flux_agent" ]] && echo "🧹 删除旧文件 flux_agent" && rm -f "$INSTALL_DIR/flux_agent"
+
   # 下载 flux_agent
   echo "⬇️ 下载 flux_agent 中..."
-  rm -f "$tmp_binary"
-  curl -L "$DOWNLOAD_URL" -o "$tmp_binary"
-  if [[ ! -f "$tmp_binary" || ! -s "$tmp_binary" ]]; then
-    rm -f "$tmp_binary"
+  curl -L "$DOWNLOAD_URL" -o "$INSTALL_DIR/flux_agent"
+  if [[ ! -f "$INSTALL_DIR/flux_agent" || ! -s "$INSTALL_DIR/flux_agent" ]]; then
     echo "❌ 下载失败，请检查网络或下载链接。"
     exit 1
   fi
-  cleanup_legacy_gost_installation
-  mv "$tmp_binary" "$INSTALL_DIR/flux_agent"
   chmod +x "$INSTALL_DIR/flux_agent"
   echo "✅ 下载完成"
 
@@ -376,7 +305,12 @@ install_flux_agent() {
   # 写入 config.json (安装时总是创建新的)
   CONFIG_FILE="$INSTALL_DIR/config.json"
   echo "📄 创建新配置: config.json"
-  write_flux_agent_config "$CONFIG_FILE"
+  cat > "$CONFIG_FILE" <<EOF
+{
+  "addr": "$SERVER_ADDR",
+  "secret": "$SECRET"
+}
+EOF
 
   # 写入 gost.json
   GOST_CONFIG="$INSTALL_DIR/gost.json"
@@ -446,13 +380,11 @@ update_flux_agent() {
   
   # 先下载新版本
   echo "⬇️ 下载最新版本..."
-  rm -f "$INSTALL_DIR/flux_agent.new"
   curl -L "$DOWNLOAD_URL" -o "$INSTALL_DIR/flux_agent.new"
   if [[ ! -f "$INSTALL_DIR/flux_agent.new" || ! -s "$INSTALL_DIR/flux_agent.new" ]]; then
     echo "❌ 下载失败。"
     return 1
   fi
-  cleanup_legacy_gost_installation
 
   # 停止服务
   if systemctl list-units --full -all | grep -Fq "flux_agent.service"; then

test-install-scripts-proxy.sh

@@ -98,7 +98,6 @@ EOF
   chmod +x "$INSTALL_DIR/flux_agent"
 
   local ask_called="0"
-  local cleanup_called="0"
 
   ask_proxy_config() {
     ask_called="1"
@@ -106,10 +105,6 @@ EOF
     DOWNLOAD_URL=""
   }
 
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-
   check_and_install_tcpkill() { :; }
 
   systemctl() {
@@ -138,7 +133,6 @@ EOF
   update_flux_agent >/dev/null
 
   assert_equals "1" "$ask_called" "update_flux_agent should ask for proxy config before downloading"
-  assert_equals "1" "$cleanup_called" "update_flux_agent should clean up legacy gost before restarting the agent"
   assert_equals "$(build_download_url)" "$DOWNLOAD_URL" "update_flux_agent should honor the prompted proxy choice"
 )
 
@@ -161,198 +155,6 @@ test_update_flux_agent_skips_proxy_prompt_when_not_installed() (
   assert_equals "0" "$ask_called" "update_flux_agent should not prompt for proxy config when the agent is missing"
 )
 
-test_install_flux_agent_preserves_legacy_gost_when_download_fails() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  cat > "$INSTALL_DIR/flux_agent" <<'EOF'
-#!/bin/bash
-echo "old version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent"
-  SERVER_ADDR="panel.example.com:443"
-  SECRET="secret"
-  DOWNLOAD_URL="https://example.com/gost"
-
-  local cleanup_called="0"
-  local rc="0"
-
-  ask_proxy_config() { :; }
-  ensure_download_url_initialized() { :; }
-  get_config_params() { :; }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-  systemctl() { return 0; }
-  curl() { return 0; }
-
-  ( install_flux_agent >/dev/null ) || rc="$?"
-
-  assert_equals "1" "$rc" "install_flux_agent should fail when the download artifact is missing"
-  assert_equals "0" "$cleanup_called" "install_flux_agent should preserve legacy gost when download fails"
-  [[ -f "$INSTALL_DIR/flux_agent" ]] || fail "install_flux_agent should keep the existing flux_agent binary when download fails"
-)
-
-test_update_flux_agent_preserves_legacy_gost_when_download_fails() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  cat > "$INSTALL_DIR/flux_agent" <<'EOF'
-#!/bin/bash
-echo "old version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent"
-  cat > "$INSTALL_DIR/flux_agent.new" <<'EOF'
-#!/bin/bash
-echo "stale version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent.new"
-
-  local cleanup_called="0"
-  local rc="0"
-
-  ask_proxy_config() {
-    PROXY_ENABLED="false"
-    DOWNLOAD_URL="https://example.com/gost"
-  }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-  systemctl() { return 0; }
-  curl() { return 0; }
-
-  update_flux_agent >/dev/null || rc="$?"
-
-  assert_equals "1" "$rc" "update_flux_agent should fail when the download artifact is missing"
-  assert_equals "0" "$cleanup_called" "update_flux_agent should preserve legacy gost when download fails"
-  [[ ! -f "$INSTALL_DIR/flux_agent.new" ]] || fail "update_flux_agent should remove stale download artifacts before retrying"
-)
-
-test_install_flux_agent_writes_json_safe_config() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  SERVER_ADDR='panel"addr'
-  SECRET='sec\ret"1'
-  DOWNLOAD_URL="https://example.com/gost"
-
-  ask_proxy_config() { :; }
-  ensure_download_url_initialized() { :; }
-  get_config_params() { :; }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() { :; }
-  systemctl() { return 0; }
-  curl() {
-    local output=""
-    while [[ $# -gt 0 ]]; do
-      if [[ "$1" == "-o" ]]; then
-        output="$2"
-        shift 2
-        continue
-      fi
-      shift
-    done
-
-    cat > "$output" <<'EOF'
-#!/bin/bash
-echo "new version"
-EOF
-    chmod +x "$output"
-  }
-
-  ( install_flux_agent >/dev/null 2>/dev/null ) || true
-
-  local actual
-  actual=$(<"$INSTALL_DIR/config.json")
-  local expected=$'{\n  "addr": "panel\\"addr",\n  "secret": "sec\\\\ret\\"1"\n}'
-
-  assert_equals "$expected" "$actual" "install_flux_agent should JSON-escape config values"
-)
-
-test_cleanup_legacy_gost_installation_removes_service_and_binary() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  LEGACY_GOST_BINARY=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_ETC=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_LIB=$(mktemp -u)
-  LEGACY_GOST_SERVICE_FILE_USR_LIB=$(mktemp -u)
-  LEGACY_GOST_CONFIG_DIR=$(mktemp -d)
-  cat > "$LEGACY_GOST_SERVICE_FILE_ETC" <<EOF
-[Unit]
-Description=Gost Proxy Service
-
-[Service]
-WorkingDirectory=$LEGACY_GOST_CONFIG_DIR
-ExecStart=$LEGACY_GOST_CONFIG_DIR/gost
-EOF
-  : > "$LEGACY_GOST_CONFIG_DIR/config.json"
-  : > "$LEGACY_GOST_CONFIG_DIR/gost.json"
-
-  local systemctl_calls=""
-
-  systemctl() {
-    systemctl_calls+=$'\n'"$*"
-    if [[ "$1" == "list-units" ]]; then
-      printf 'gost.service loaded active running\n'
-    fi
-    return 0
-  }
-
-  cleanup_legacy_gost_installation >/dev/null
-
-  if [[ -e "$LEGACY_GOST_BINARY" ]]; then
-    fail "cleanup_legacy_gost_installation should remove the legacy gost binary"
-  fi
-  if [[ -e "$LEGACY_GOST_SERVICE_FILE_ETC" ]]; then
-    fail "cleanup_legacy_gost_installation should remove the legacy gost service file"
-  fi
-  [[ "$systemctl_calls" == *"stop gost"* ]] || fail "cleanup_legacy_gost_installation should stop the legacy gost service"
-  [[ "$systemctl_calls" == *"disable gost"* ]] || fail "cleanup_legacy_gost_installation should disable the legacy gost service"
-  [[ "$systemctl_calls" == *"daemon-reload"* ]] || fail "cleanup_legacy_gost_installation should reload systemd after removing the legacy service"
-)
-
-test_cleanup_legacy_gost_installation_preserves_unrelated_gost() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  LEGACY_GOST_BINARY=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_ETC=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_LIB=$(mktemp -u)
-  LEGACY_GOST_SERVICE_FILE_USR_LIB=$(mktemp -u)
-  LEGACY_GOST_CONFIG_DIR=$(mktemp -d)
-  cat > "$LEGACY_GOST_SERVICE_FILE_ETC" <<'EOF'
-[Unit]
-Description=Unrelated Gost Service
-
-[Service]
-WorkingDirectory=/srv/custom-gost
-ExecStart=/usr/local/bin/gost -C /srv/custom-gost/gost.yaml
-EOF
-
-  local systemctl_calls=""
-
-  systemctl() {
-    systemctl_calls+=$'\n'"$*"
-    if [[ "$1" == "list-units" ]]; then
-      printf 'gost.service loaded active running\n'
-    fi
-    return 0
-  }
-
-  cleanup_legacy_gost_installation >/dev/null
-
-  [[ -e "$LEGACY_GOST_BINARY" ]] || fail "cleanup_legacy_gost_installation should preserve unrelated gost binaries"
-  [[ -e "$LEGACY_GOST_SERVICE_FILE_ETC" ]] || fail "cleanup_legacy_gost_installation should preserve unrelated gost service files"
-  [[ "$systemctl_calls" != *"stop gost"* ]] || fail "cleanup_legacy_gost_installation should not stop unrelated gost services"
-  [[ "$systemctl_calls" != *"disable gost"* ]] || fail "cleanup_legacy_gost_installation should not disable unrelated gost services"
-)
-
 test_install_script_accepts_proxy_url_env_without_prompt() (
   set -euo pipefail
   load_script_without_main "$ROOT_DIR/install.sh"
@@ -501,11 +303,6 @@ test_install_script_asks_for_proxy_config
 test_install_script_recomputes_download_url_after_prompt
 test_update_flux_agent_asks_for_proxy_config
 test_update_flux_agent_skips_proxy_prompt_when_not_installed
-test_install_flux_agent_preserves_legacy_gost_when_download_fails
-test_update_flux_agent_preserves_legacy_gost_when_download_fails
-test_install_flux_agent_writes_json_safe_config
-test_cleanup_legacy_gost_installation_removes_service_and_binary
-test_cleanup_legacy_gost_installation_preserves_unrelated_gost
 test_install_script_accepts_proxy_url_env_without_prompt
 test_panel_install_script_can_disable_proxy
 test_panel_install_script_recomputes_compose_urls_after_prompt

vite-frontend/Dockerfile

@@ -1,10 +1,10 @@
 # 多阶段构建 - 构建阶段
-FROM node:22-alpine AS builder
+FROM node:20.19.0 AS builder
 
 WORKDIR /app
 
 COPY package.json pnpm-lock.yaml* ./
-RUN corepack prepare pnpm@10 --activate && corepack enable pnpm && pnpm install --frozen-lockfile
+RUN corepack enable pnpm && pnpm install --frozen-lockfile
 
 COPY . .
 RUN pnpm run build

vite-frontend/src/api/index.ts

@@ -253,8 +253,6 @@ export const getConfigs = () =>
   Network.post<Record<string, string>>("/config/list");
 export const getConfigByName = (name: string) =>
   Network.post<{ name: string; value: string }>("/config/get", { name });
-export const getPublicConfigByName = (name: string) =>
-  Network.post<{ name: string; value: string }>("/public/config/get", { name });
 export const updateConfigs = (configMap: Record<string, string>) =>
   Network.post("/config/update", configMap);
 export const updateConfig = (name: string, value: string) =>

vite-frontend/src/api/types.ts

@@ -508,7 +508,8 @@ export interface SystemUpgradeVersionApiData {
   capability: SystemUpgradeCapabilityApiData;
 }
 
-export interface SystemUpgradeCheckApiData extends SystemUpgradeVersionApiData {
+export interface SystemUpgradeCheckApiData
+  extends SystemUpgradeVersionApiData {
   releases: SystemUpgradeReleaseApiItem[];
 }
 

vite-frontend/src/config/site.ts

@@ -1,5 +1,4 @@
-import { getConfigByName, getConfigs, getPublicConfigByName } from "@/api";
-import { isLoggedIn } from "@/utils/auth";
+import { getConfigByName, getConfigs } from "@/api";
 
 export type SiteConfig = typeof siteConfig;
 
@@ -9,73 +8,9 @@ const VERSION = import.meta.env.VITE_APP_VERSION || "dev";
 const APP_VERSION = "1.0.3";
 const DEFAULT_FAVICON = "/favicon.ico";
 const FAVICON_LINK_ID = "app-favicon";
-const PUBLIC_BRAND_CONFIG_KEYS = [
-  "app_name",
-  "app_logo",
-  "app_favicon",
-  "app_bg_image",
-] as const;
-const SENSITIVE_CONFIG_KEYS = new Set([
-  "jwt_secret",
-  "license_key",
-  "cloudflare_secret_key",
-]);
 const GITHUB_REPO =
   import.meta.env.VITE_GITHUB_REPO || "https://github.com/Sagit-chu/flux-panel";
 
-const shouldPersistConfigKey = (key: string) => {
-  return !SENSITIVE_CONFIG_KEYS.has(key.trim().toLowerCase());
-};
-
-const purgeSensitiveConfigCache = () => {
-  SENSITIVE_CONFIG_KEYS.forEach((key) => {
-    localStorage.removeItem(CACHE_PREFIX + key);
-  });
-};
-
-const readCachedConfigs = (keys: readonly string[]) => {
-  const cachedConfigs: Record<string, string> = {};
-  let hasCachedData = false;
-
-  keys.forEach((key) => {
-    const cachedValue = configCache.get(key);
-
-    if (cachedValue !== null) {
-      cachedConfigs[key] = cachedValue;
-      hasCachedData = true;
-    }
-  });
-
-  return { cachedConfigs, hasCachedData };
-};
-
-const fetchPublicBrandConfigs = async (): Promise<Record<string, string>> => {
-  const publicConfigMap: Record<string, string> = {};
-
-  await Promise.all(
-    PUBLIC_BRAND_CONFIG_KEYS.map(async (key) => {
-      try {
-        const response = await getPublicConfigByName(key);
-
-        if (
-          response.code === 0 &&
-          response.data &&
-          typeof response.data.value === "string"
-        ) {
-          const value = response.data.value;
-
-          publicConfigMap[key] = value;
-          configCache.set(key, value);
-        }
-      } catch {
-        // ignore single key fetch error
-      }
-    }),
-  );
-
-  return publicConfigMap;
-};
-
 const getInitialConfig = () => {
   if (typeof window === "undefined") {
     return {
@@ -91,8 +26,6 @@ const getInitialConfig = () => {
     };
   }
 
-  purgeSensitiveConfigCache();
-
   const cachedAppName = localStorage.getItem(CACHE_PREFIX + "app_name");
   const cachedAppLogo = localStorage.getItem(CACHE_PREFIX + "app_logo") || "";
   const cachedAppFavicon =
@@ -144,15 +77,7 @@ export const configCache = {
 
   // 设置缓存的配置
   set: (key: string, value: string): void => {
-    const normalizedKey = key.trim().toLowerCase();
-
-    if (!shouldPersistConfigKey(normalizedKey)) {
-      configCache.remove(normalizedKey);
-
-      return;
-    }
-
-    const cacheKey = CACHE_PREFIX + normalizedKey;
+    const cacheKey = CACHE_PREFIX + key;
 
     localStorage.setItem(cacheKey, value);
   },
@@ -194,9 +119,7 @@ export const getCachedConfig = async (key: string): Promise<string | null> => {
   ) {
     const value = response.data.value;
 
-    if (shouldPersistConfigKey(key)) {
-      configCache.set(key, value);
-    }
+    configCache.set(key, value);
 
     return value;
   }
@@ -206,19 +129,46 @@ export const getCachedConfig = async (key: string): Promise<string | null> => {
 
 // 获取所有配置（优先从缓存）
 export const getCachedConfigs = async (): Promise<Record<string, string>> => {
-  const { cachedConfigs, hasCachedData } = readCachedConfigs(
-    PUBLIC_BRAND_CONFIG_KEYS,
-  );
+  // 尝试从缓存获取所有配置
+  const configKeys = ["app_name", "app_logo", "app_favicon", "app_bg_image"];
+  const cachedConfigs: Record<string, string> = {};
+  let hasCachedData = false;
 
-  if (!isLoggedIn()) {
-    const publicConfigs = await fetchPublicBrandConfigs();
+  configKeys.forEach((key) => {
+    const cachedValue = configCache.get(key);
 
-    if (Object.keys(publicConfigs).length > 0) {
-      return { ...cachedConfigs, ...publicConfigs };
+    if (cachedValue !== null) {
+      cachedConfigs[key] = cachedValue;
+      hasCachedData = true;
     }
+  });
 
-    return cachedConfigs;
-  }
+  const fetchPublicConfigs = async (): Promise<Record<string, string>> => {
+    const publicConfigMap: Record<string, string> = {};
+
+    await Promise.all(
+      configKeys.map(async (key) => {
+        try {
+          const response = await getConfigByName(key);
+
+          if (
+            response.code === 0 &&
+            response.data &&
+            typeof response.data.value === "string"
+          ) {
+            const value = response.data.value;
+
+            publicConfigMap[key] = value;
+            configCache.set(key, value);
+          }
+        } catch {
+          // ignore single key fetch error
+        }
+      }),
+    );
+
+    return publicConfigMap;
+  };
 
   // 从API获取最新配置
   try {
@@ -227,19 +177,9 @@ export const getCachedConfigs = async (): Promise<Record<string, string>> => {
     if (response.code === 0 && response.data) {
       const configs = response.data;
 
-      // 仅将安全配置存入缓存，敏感项会从 localStorage 中移除
+      // 将所有配置存入缓存
       Object.entries(configs).forEach(([key, value]) => {
-        const normalizedKey = key.trim().toLowerCase();
-
-        if (SENSITIVE_CONFIG_KEYS.has(normalizedKey)) {
-          configCache.remove(normalizedKey);
-
-          return;
-        }
-
-        if (shouldPersistConfigKey(normalizedKey)) {
-          configCache.set(normalizedKey, value as string);
-        }
+        configCache.set(key, value as string);
       });
 
       return configs;
@@ -249,14 +189,14 @@ export const getCachedConfigs = async (): Promise<Record<string, string>> => {
       return cachedConfigs;
     }
 
-    return await fetchPublicBrandConfigs();
+    return await fetchPublicConfigs();
   } catch {
     // API失败时返回缓存的数据
     if (hasCachedData) {
       return cachedConfigs;
     }
 
-    return await fetchPublicBrandConfigs();
+    return await fetchPublicConfigs();
   }
 };
 
@@ -315,17 +255,7 @@ export const updateSiteConfig = async (configMap?: Record<string, string>) => {
   const resolvedConfigMap = configMap ?? (await getCachedConfigs());
 
   Object.entries(resolvedConfigMap).forEach(([key, value]) => {
-    const normalizedKey = key.trim().toLowerCase();
-
-    if (SENSITIVE_CONFIG_KEYS.has(normalizedKey)) {
-      configCache.remove(normalizedKey);
-
-      return;
-    }
-
-    if (shouldPersistConfigKey(normalizedKey)) {
-      configCache.set(normalizedKey, String(value));
-    }
+    configCache.set(key, String(value));
   });
 
   const hasAppName = Object.prototype.hasOwnProperty.call(

vite-frontend/src/pages/config.tsx

@@ -1,10 +1,3 @@
-import type {
-  SystemUpgradeCheckApiData,
-  SystemUpgradeRunApiData,
-  SystemUpgradeReleaseApiItem,
-  SystemUpgradeVersionApiData,
-} from "@/api/types";
-
 import { useState, useEffect, useRef } from "react";
 import { useNavigate } from "react-router-dom";
 import { AnimatePresence, motion } from "framer-motion";
@@ -39,6 +32,12 @@ import {
   runSystemUpgrade,
   type AnnouncementData,
 } from "@/api";
+import type {
+  SystemUpgradeCheckApiData,
+  SystemUpgradeRunApiData,
+  SystemUpgradeReleaseApiItem,
+  SystemUpgradeVersionApiData,
+} from "@/api/types";
 import { BackIcon, SettingsIcon } from "@/components/icons";
 import { ThemeSettings } from "@/components/theme-settings";
 import { isAdmin } from "@/utils/auth";
@@ -329,12 +328,6 @@ export default function ConfigPage() {
       systemUpgradeReleasesMatchChannel &&
       systemUpgradeReleases.length > 0,
   );
-  const canTriggerSystemUpgrade = Boolean(
-    !systemUpgradeLoading &&
-      !systemUpgradeChecking &&
-      !systemUpgradeExecuting &&
-      systemUpgradeInfo?.capability.capable !== false,
-  );
   const canOpenSystemUpgradeModal = Boolean(
     systemUpgradeInfo?.capability.capable &&
       systemUpgradeHasConfirmedUpdate &&
@@ -428,9 +421,7 @@ export default function ConfigPage() {
           hasUpdate:
             response.data.channel === channel ? response.data.hasUpdate : false,
           latestVersion:
-            response.data.channel === channel
-              ? response.data.latestVersion
-              : "",
+            response.data.channel === channel ? response.data.latestVersion : "",
         });
       } else {
         setSystemUpgradeInfo(null);
@@ -521,9 +512,7 @@ export default function ConfigPage() {
             : "未获取到可用版本",
         );
 
-        return Boolean(
-          data.capability.capable && data.hasUpdate && data.releases?.length,
-        );
+        return Boolean(data.capability.capable && data.hasUpdate && data.releases?.length);
       } else {
         setSystemUpgradeReleases([]);
         setSystemUpgradeCheckedChannel(null);
@@ -1579,8 +1568,7 @@ export default function ConfigPage() {
                   <div>
                     <p className="text-xs text-default-500">部署目录</p>
                     <p className="mt-1 break-all font-medium">
-                      {systemUpgradeInfo?.capability.deployDir ||
-                        "未获取到部署目录"}
+                      {systemUpgradeInfo?.capability.deployDir || "未获取到部署目录"}
                     </p>
                   </div>
                   <div>
@@ -1637,9 +1625,7 @@ export default function ConfigPage() {
                     size="md"
                     variant="bordered"
                     onSelectionChange={(keys) => {
-                      const selected = Array.from(keys)[0] as
-                        | string
-                        | undefined;
+                      const selected = Array.from(keys)[0] as string | undefined;
 
                       setSystemUpgradeSelectedVersion(selected || "");
                     }}
@@ -1662,15 +1648,17 @@ export default function ConfigPage() {
 
             <div className="flex flex-col gap-3 pt-1 sm:flex-row sm:justify-end">
               <Button
-                isLoading={systemUpgradeChecking}
                 variant="flat"
+                isLoading={systemUpgradeChecking}
                 onPress={handleCheckSystemUpgrade}
               >
                 检查更新
               </Button>
               <Button
                 color="primary"
-                isDisabled={!canTriggerSystemUpgrade}
+                isDisabled={
+                  !canOpenSystemUpgradeModal
+                }
                 isLoading={systemUpgradeExecuting}
                 onPress={handleOpenSystemUpgradeModal}
               >
@@ -1937,12 +1925,10 @@ export default function ConfigPage() {
               <ModalBody>
                 <div className="space-y-3 text-sm text-default-700 dark:text-default-300">
                   <p>
-                    升级过程需要访问 Docker
-                    Socket，并会在短时间内中断当前面板服务。
+                    升级过程需要访问 Docker Socket，并会在短时间内中断当前面板服务。
                   </p>
                   <p>
-                    请确认已经允许面板管理容器与宿主机 Docker
-                    交互，并且可以接受升级期间的临时不可用。
+                    请确认已经允许面板管理容器与宿主机 Docker 交互，并且可以接受升级期间的临时不可用。
                   </p>
                   <div className="space-y-2 rounded-lg border border-warning-200 bg-warning-50 px-4 py-3 text-warning-800 dark:border-warning-900/40 dark:bg-warning-950/30 dark:text-warning-200">
                     <p className="text-xs font-medium">升级前请确认</p>

vite-frontend/src/pages/index.tsx

@@ -10,7 +10,7 @@ import { Button } from "@/shadcn-bridge/heroui/button";
 import { siteConfig } from "@/config/site";
 import { VersionFooter } from "@/components/version-footer";
 import { BrandLogo } from "@/components/brand-logo";
-import { login, LoginData, checkCaptcha, getPublicConfigByName } from "@/api";
+import { login, LoginData, checkCaptcha, getConfigByName } from "@/api";
 import { writeLoginSession } from "@/utils/session";
 import { useWebViewMode } from "@/hooks/useWebViewMode";
 
@@ -128,7 +128,7 @@ export default function IndexPage() {
       if (checkResponse.data === 0) {
         await performLogin();
       } else {
-        const configResp = await getPublicConfigByName("cloudflare_site_key");
+        const configResp = await getConfigByName("cloudflare_site_key");
 
         if (configResp.code === 0 && configResp.data && configResp.data.value) {
           setSiteKey(configResp.data.value);

vite-frontend/src/pages/tunnel.tsx

@@ -204,7 +204,6 @@ const isObjectRecord = (value: unknown): value is Record<string, unknown> =>
 const toSafeString = (value: unknown): string => {
   if (typeof value === "string") return value;
   if (typeof value === "number" && Number.isFinite(value)) return String(value);
-
   return "";
 };
 
@@ -266,13 +265,11 @@ const normalizeBestExitState = (value: unknown): BestExitState | undefined => {
 
 const bestExitOwnerRoleText = (role?: string) => {
   if (role === "chain") return "中转";
-
   return "入口";
 };
 
 const bestExitDetailTitle = (state?: BestExitState) => {
   if (!state?.items?.length) return undefined;
-
   return state.items
     .map(
       (item) =>
@@ -3111,9 +3108,7 @@ export default function TunnelPage() {
                             }}
                           >
                             <SelectItem key="1">单向计算（仅上传）</SelectItem>
-                            <SelectItem key="2">
-                              双向计算（上传+下载）
-                            </SelectItem>
+                            <SelectItem key="2">双向计算（上传+下载）</SelectItem>
                           </Select>
 
                           <Input
@@ -3176,9 +3171,7 @@ export default function TunnelPage() {
                         )}
 
                         <div>
-                          <div className="text-sm font-medium">
-                            质量检测目标
-                          </div>
+                          <div className="text-sm font-medium">质量检测目标</div>
                           <p className="text-xs text-default-500 mt-0.5">
                             用于实时隧道质量检测、诊断目标和 best
                             最优出口评分，留空使用 www.bing.com:443

vite-frontend/src/shadcn-bridge/heroui/select.tsx

@@ -401,7 +401,6 @@ export function Select<T>({
         </div>
       ) : (
         <select
-          aria-label={label ? undefined : ariaLabel}
           className={cn(
             "w-full rounded-md border border-input bg-background px-3 py-2 text-foreground shadow-sm focus:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:[color-scheme:dark]",
             sizeClass(size),
@@ -410,6 +409,7 @@ export function Select<T>({
           )}
           disabled={isDisabled}
           id={generatedId}
+          aria-label={label ? undefined : ariaLabel}
           required={isRequired}
           value={singleValue}
           onChange={handleChange}