fix(admin): 修复配置目录启动崩溃、登录失效与测试页鉴权

Close #159 #151 #152

Author: TheSmallHanCat

src/api/admin.py

@@ -3,7 +3,7 @@
 import importlib
 import json
 from datetime import datetime, timezone
-from fastapi import APIRouter, Depends, HTTPException, Header, Request
+from fastapi import APIRouter, Depends, HTTPException, Header, Request, Response
 from fastapi.responses import JSONResponse
 from pydantic import BaseModel
 from typing import Optional, List, Dict, Any
@@ -46,6 +46,7 @@
 
 # Store active admin session tokens (in production, use Redis or database)
 active_admin_tokens = set()
+ADMIN_SESSION_COOKIE_NAME = "admin_session"
 SUPPORTED_API_CAPTCHA_METHODS = {"yescaptcha", "capmonster", "ezcaptcha", "capsolver"}
 
 
@@ -688,24 +689,40 @@ class TokenRefreshConfigRequest(BaseModel):
 
 # ========== Auth Middleware ==========
 
-async def verify_admin_token(authorization: str = Header(None)):
+async def verify_admin_token(request: Request, authorization: str = Header(None)):
     """Verify admin session token (NOT API key)"""
-    if not authorization or not authorization.startswith("Bearer "):
-        raise HTTPException(status_code=401, detail="Missing authorization")
+    header_token = ""
+    if authorization and authorization.startswith("Bearer "):
+        header_token = authorization[7:].strip()
 
-    token = authorization[7:]
+    cookie_token = get_admin_token_from_cookie(request) or ""
 
-    # Check if token is in active session tokens
-    if token not in active_admin_tokens:
+    if header_token and header_token in active_admin_tokens:
+        return header_token
+
+    if cookie_token and cookie_token in active_admin_tokens:
+        return cookie_token
+
+    if header_token or cookie_token:
         raise HTTPException(status_code=401, detail="Invalid or expired admin token")
 
-    return token
+    raise HTTPException(status_code=401, detail="Missing authorization")
+
+
+def get_admin_token_from_cookie(request: Request) -> Optional[str]:
+    token = str(request.cookies.get(ADMIN_SESSION_COOKIE_NAME) or "").strip()
+    return token or None
+
+
+def is_admin_session_token_valid(token: Optional[str]) -> bool:
+    normalized = str(token or "").strip()
+    return bool(normalized) and normalized in active_admin_tokens
 
 
 # ========== Auth Endpoints ==========
 
 @router.post("/api/admin/login")
-async def admin_login(request: LoginRequest):
+async def admin_login(request: LoginRequest, response: Response):
     """Admin login - returns session token (NOT API key)"""
     admin_config = await db.get_admin_config()
 
@@ -718,6 +735,15 @@ async def admin_login(request: LoginRequest):
     # Store in active tokens
     active_admin_tokens.add(session_token)
 
+    response.set_cookie(
+        key=ADMIN_SESSION_COOKIE_NAME,
+        value=session_token,
+        httponly=True,
+        samesite="lax",
+        secure=False,
+        path="/",
+    )
+
     return {
         "success": True,
         "token": session_token,  # Session token (NOT API key)
@@ -726,9 +752,10 @@ async def admin_login(request: LoginRequest):
 
 
 @router.post("/api/admin/logout")
-async def admin_logout(token: str = Depends(verify_admin_token)):
+async def admin_logout(response: Response, token: str = Depends(verify_admin_token)):
     """Admin logout - invalidate session token"""
     active_admin_tokens.discard(token)
+    response.delete_cookie(ADMIN_SESSION_COOKIE_NAME, path="/")
     return {"success": True, "message": "退出登录成功"}
 
 
@@ -1419,15 +1446,15 @@ async def get_system_info(token: str = Depends(verify_admin_token)):
 # ========== Additional Routes for Frontend Compatibility ==========
 
 @router.post("/api/login")
-async def login(request: LoginRequest):
+async def login(request: LoginRequest, response: Response):
     """Login endpoint (alias for /api/admin/login)"""
-    return await admin_login(request)
+    return await admin_login(request, response)
 
 
 @router.post("/api/logout")
-async def logout(token: str = Depends(verify_admin_token)):
+async def logout(response: Response, token: str = Depends(verify_admin_token)):
     """Logout endpoint (alias for /api/admin/logout)"""
-    return await admin_logout(token)
+    return await admin_logout(response, token)
 
 
 @router.get("/health")

src/core/config.py

@@ -36,8 +36,23 @@ def _load_config(self) -> Dict[str, Any]:
         """Load configuration from setting.toml, falling back to the example file."""
         config_dir = Path(__file__).parent.parent.parent / "config"
         config_path = config_dir / "setting.toml"
-        if not config_path.exists():
-            config_path = config_dir / "setting_example.toml"
+        fallback_path = config_dir / "setting_example.toml"
+
+        if config_path.exists() and not config_path.is_file():
+            print(
+                f"[Config] 检测到 {config_path} 不是普通文件，"
+                f"将回退到 {fallback_path.name}。请检查 Docker 挂载或本地配置路径。"
+            )
+            config_path = fallback_path
+        elif not config_path.exists():
+            config_path = fallback_path
+
+        if not config_path.is_file():
+            raise FileNotFoundError(
+                f"配置文件不存在或不可读取: {config_path}. "
+                f"请确认 config 目录下存在可用的 setting.toml 或 setting_example.toml"
+            )
+
         with open(config_path, "rb") as f:
             return tomli.load(f)
 

src/main.py

@@ -4,8 +4,8 @@
 import sys
 import warnings
 
-from fastapi import FastAPI
-from fastapi.responses import HTMLResponse, FileResponse, Response
+from fastapi import FastAPI, Request
+from fastapi.responses import HTMLResponse, FileResponse, Response, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 from fastapi.middleware.cors import CORSMiddleware
 from contextlib import asynccontextmanager
@@ -280,14 +280,23 @@ async def auto_unban_task():
 
 # HTML routes for frontend
 static_path = Path(__file__).parent.parent / "static"
+_STATIC_PAGE_NO_CACHE_HEADERS = {
+    "Cache-Control": "no-store, no-cache, must-revalidate",
+    "Pragma": "no-cache",
+    "Expires": "0",
+}
+
+
+def _static_page_response(file_path: Path) -> FileResponse:
+    return FileResponse(str(file_path), headers=_STATIC_PAGE_NO_CACHE_HEADERS)
 
 
 @app.get("/", response_class=HTMLResponse)
 async def index():
     """Redirect to login page"""
     login_file = static_path / "login.html"
     if login_file.exists():
-        return FileResponse(str(login_file))
+        return _static_page_response(login_file)
     return HTMLResponse(content="<h1>Flow2API</h1><p>Frontend not found</p>", status_code=404)
 
 
@@ -296,25 +305,31 @@ async def login_page():
     """Login page"""
     login_file = static_path / "login.html"
     if login_file.exists():
-        return FileResponse(str(login_file))
+        return _static_page_response(login_file)
     return HTMLResponse(content="<h1>Login Page Not Found</h1>", status_code=404)
 
 
 @app.get("/manage", response_class=HTMLResponse)
-async def manage_page():
+async def manage_page(request: Request):
     """Management console page"""
+    guard_response = _ensure_admin_page_session(request)
+    if guard_response is not None:
+        return guard_response
     manage_file = static_path / "manage.html"
     if manage_file.exists():
-        return FileResponse(str(manage_file))
+        return _static_page_response(manage_file)
     return HTMLResponse(content="<h1>Management Page Not Found</h1>", status_code=404)
 
 
 @app.get("/test", response_class=HTMLResponse)
-async def test_page():
+async def test_page(request: Request):
     """Model testing page"""
+    guard_response = _ensure_admin_page_session(request)
+    if guard_response is not None:
+        return guard_response
     test_file = static_path / "test.html"
     if test_file.exists():
-        return FileResponse(str(test_file))
+        return _static_page_response(test_file)
     return HTMLResponse(content="<h1>Test Page Not Found</h1>", status_code=404)
 
 
@@ -323,3 +338,8 @@ async def metrics():
     """Prometheus metrics endpoint for the main Flow2API service."""
     payload = await render_main_metrics(db, concurrency_manager=concurrency_manager)
     return Response(content=payload, media_type=CONTENT_TYPE_LATEST)
+def _ensure_admin_page_session(request: Request):
+    token = admin.get_admin_token_from_cookie(request)
+    if not admin.is_admin_session_token_valid(token):
+        return RedirectResponse(url="/login", status_code=302)
+    return None

static/login.html

@@ -45,9 +45,9 @@ <h1 class="text-4xl font-bold">Flow2API</h1>
 
     <script>
         const form=document.getElementById('loginForm'),btn=document.getElementById('loginButton');
-        form.addEventListener('submit',async(e)=>{e.preventDefault();btn.disabled=true;btn.textContent='登录中...';try{const fd=new FormData(form),r=await fetch('/api/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:fd.get('username'),password:fd.get('password')})});const d=await r.json();d.success?(localStorage.setItem('adminToken',d.token),location.href='/manage'):showToast(d.message||'登录失败','error')}catch(e){showToast('网络错误,请稍后重试','error')}finally{btn.disabled=false;btn.textContent='登录'}});
+        form.addEventListener('submit',async(e)=>{e.preventDefault();btn.disabled=true;btn.textContent='登录中...';try{const fd=new FormData(form),r=await fetch('/api/login',{method:'POST',credentials:'include',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:fd.get('username'),password:fd.get('password')})});const d=await r.json();if(d.success){location.href='/manage'}else showToast(d.message||'登录失败','error')}catch(e){showToast('网络错误,请稍后重试','error')}finally{btn.disabled=false;btn.textContent='登录'}});
         function showToast(m,t='error'){const d=document.createElement('div'),bc={success:'bg-green-600',error:'bg-destructive',info:'bg-primary'};d.className=`fixed bottom-4 right-4 ${bc[t]||bc.error} text-white px-4 py-2.5 rounded-lg shadow-lg text-sm font-medium z-50 animate-slide-up`;d.textContent=m;document.body.appendChild(d);setTimeout(()=>{d.style.opacity='0';d.style.transition='opacity .3s';setTimeout(()=>d.parentNode&&document.body.removeChild(d),300)},2000)}
-        window.addEventListener('DOMContentLoaded',()=>{const t=localStorage.getItem('adminToken');t&&fetch('/api/stats',{headers:{Authorization:`Bearer ${t}`}}).then(r=>{if(r.ok)location.href='/manage'})});
+        window.addEventListener('DOMContentLoaded',()=>{fetch('/api/stats',{credentials:'include'}).then(r=>{if(r.ok)location.href='/manage'}).catch(()=>{})});
     </script>
 </body>
 </html>