feat: 集成 chongming-license 机器码授权门禁(打包可选、授权版不可关)
三处收口,未授权插件不加载、不暴露端点、不可管理:
- core/licensing:授权管理器单例 + 构建期烘焙决策(chongming/_build_flags.py,
随代码编译、部署侧不可改);开发/测试默认放行,CHONGMING_LICENSE_MODE 可临时开
- lifespan_setup:_scan_plugins(盘扫)与 _discover_plugins(授权收口)分离,
未授权插件连同 TOML 路由/MQTT 主题/副本数一起从启动流程消失(契约校验因此
不会硬失败),启动打印授权横幅
- route_registry.set_denied_types:未授权类型经 Zenoh 推来的描述符一律忽略
(否则把 load_mode 改成 external 即可绕过)
- worker_admin:扩缩容/重启/读改配置对未授权插件一律 403,实例盘点附 licensed 标注
- routes/licensing:/license/{info,reload,file}(仅超管),导入先验签后原子落盘,
坏文件不覆盖现有授权;导入不即时加载插件,如实告知需重启
打包可选:不加 --license 出"非授权版"(不校验、插件照常加载);授权版强制校验
且公钥随代码内置(现场换 config.toml 公钥自签也无效)。未烘焙的旧打包产物沿用
"打包即强制"的旧语义;烘焙标记只在产物内生效,不影响源码运行。
补依赖 greenlet(chongming-auth→database 的 sqlalchemy asyncio import 期即要求)
与 python-multipart(上传端点注册路由即要求);新增 test/test_license_gate.py
(52 项:门禁/契约存活/描述符拦截/管理接口/上传安全/烘焙三态,自造夹具直接运行)。
This commit is contained in:
+8
-5
@@ -4,7 +4,7 @@ requires = ["hatchling"]
|
||||
|
||||
[project]
|
||||
name = "chongming-gateway"
|
||||
version = "0.1.0"
|
||||
version = "0.1.1"
|
||||
description = "chongming 网关:FastAPI + Zenoh 的配置驱动微服务网关(插件路由动态挂载、Worker 服务发现与负载均衡)"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.12"
|
||||
@@ -15,9 +15,10 @@ dependencies = [
|
||||
"chongming-config",
|
||||
"chongming-jwt",
|
||||
"chongming-worker",
|
||||
"chongming-license",
|
||||
# Web / 服务器
|
||||
"fastapi",
|
||||
"granian[reload,uvloop]>=2.8.4",
|
||||
"granian[reload,uvloop]",
|
||||
"gunicorn",
|
||||
"httptools",
|
||||
"starlette",
|
||||
@@ -26,9 +27,13 @@ dependencies = [
|
||||
# 运行时
|
||||
"amqtt",
|
||||
"eclipse-zenoh",
|
||||
# chongming-auth → chongming-database 的 sqlalchemy[asyncio] 在 import 期即要求
|
||||
"greenlet",
|
||||
"orjson",
|
||||
"pwdlib",
|
||||
"pydantic",
|
||||
# /license/file 上传端点(File/UploadFile)在注册路由时即要求
|
||||
"python-multipart",
|
||||
"sqlite-vfs",
|
||||
]
|
||||
|
||||
@@ -47,6 +52,4 @@ url = "http://124.71.68.6:3000/api/packages/chongming/pypi/simple/"
|
||||
url = "https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple"
|
||||
|
||||
[dependency-groups]
|
||||
dev = [
|
||||
"twine>=7.0.0",
|
||||
]
|
||||
dev = ["twine>=7.0.0"]
|
||||
|
||||
Reference in New Issue
Block a user