refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)
* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
This commit is contained in:
Calcium-Ion
@@ -0,0 +1,57 @@
|
||||
/*
|
||||
Copyright (C) 2023-2026 QuantumNous
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
For commercial licensing, please contact support@quantumnous.com
|
||||
*/
|
||||
import { SettingsPage } from '../components/settings-page'
|
||||
import type { SecuritySettings } from '../types'
|
||||
import {
|
||||
SECURITY_DEFAULT_SECTION,
|
||||
getSecuritySectionContent,
|
||||
getSecuritySectionMeta,
|
||||
} from './section-registry.tsx'
|
||||
|
||||
const defaultSecuritySettings: SecuritySettings = {
|
||||
ModelRequestRateLimitEnabled: false,
|
||||
ModelRequestRateLimitCount: 0,
|
||||
ModelRequestRateLimitSuccessCount: 1000,
|
||||
ModelRequestRateLimitDurationMinutes: 1,
|
||||
ModelRequestRateLimitGroup: '',
|
||||
CheckSensitiveEnabled: false,
|
||||
CheckSensitiveOnPromptEnabled: false,
|
||||
SensitiveWords: '',
|
||||
'fetch_setting.enable_ssrf_protection': true,
|
||||
'fetch_setting.allow_private_ip': false,
|
||||
'fetch_setting.domain_filter_mode': false,
|
||||
'fetch_setting.ip_filter_mode': false,
|
||||
'fetch_setting.domain_list': [],
|
||||
'fetch_setting.ip_list': [],
|
||||
'fetch_setting.allowed_ports': [],
|
||||
'fetch_setting.apply_ip_filter_for_domain': false,
|
||||
'token_setting.max_user_tokens': 1000,
|
||||
}
|
||||
|
||||
export function SecuritySettings() {
|
||||
return (
|
||||
<SettingsPage
|
||||
routePath='/_authenticated/system-settings/security/$section'
|
||||
defaultSettings={defaultSecuritySettings}
|
||||
defaultSection={SECURITY_DEFAULT_SECTION}
|
||||
getSectionContent={getSecuritySectionContent}
|
||||
getSectionMeta={getSecuritySectionMeta}
|
||||
/>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,111 @@
|
||||
/*
|
||||
Copyright (C) 2023-2026 QuantumNous
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
For commercial licensing, please contact support@quantumnous.com
|
||||
*/
|
||||
import { RateLimitSection } from '../request-limits/rate-limit-section'
|
||||
import { SensitiveWordsSection } from '../request-limits/sensitive-words-section'
|
||||
import { SSRFSection } from '../request-limits/ssrf-section'
|
||||
import { TokenLimitSection } from '../request-limits/token-limit-section'
|
||||
import type { SecuritySettings } from '../types'
|
||||
import { createSectionRegistry } from '../utils/section-registry'
|
||||
|
||||
const SECURITY_SECTIONS = [
|
||||
{
|
||||
id: 'rate-limit',
|
||||
titleKey: 'Rate Limiting',
|
||||
build: (settings: SecuritySettings) => (
|
||||
<RateLimitSection
|
||||
defaultValues={{
|
||||
ModelRequestRateLimitEnabled: settings.ModelRequestRateLimitEnabled,
|
||||
ModelRequestRateLimitCount: settings.ModelRequestRateLimitCount,
|
||||
ModelRequestRateLimitSuccessCount:
|
||||
settings.ModelRequestRateLimitSuccessCount,
|
||||
ModelRequestRateLimitDurationMinutes:
|
||||
settings.ModelRequestRateLimitDurationMinutes,
|
||||
ModelRequestRateLimitGroup: settings.ModelRequestRateLimitGroup,
|
||||
}}
|
||||
/>
|
||||
),
|
||||
},
|
||||
{
|
||||
id: 'sensitive-words',
|
||||
titleKey: 'Sensitive Words',
|
||||
build: (settings: SecuritySettings) => (
|
||||
<SensitiveWordsSection
|
||||
defaultValues={{
|
||||
CheckSensitiveEnabled: settings.CheckSensitiveEnabled,
|
||||
CheckSensitiveOnPromptEnabled: settings.CheckSensitiveOnPromptEnabled,
|
||||
SensitiveWords: settings.SensitiveWords,
|
||||
}}
|
||||
/>
|
||||
),
|
||||
},
|
||||
{
|
||||
id: 'ssrf',
|
||||
titleKey: 'SSRF Protection',
|
||||
build: (settings: SecuritySettings) => (
|
||||
<SSRFSection
|
||||
defaultValues={{
|
||||
'fetch_setting.enable_ssrf_protection':
|
||||
settings['fetch_setting.enable_ssrf_protection'],
|
||||
'fetch_setting.allow_private_ip':
|
||||
settings['fetch_setting.allow_private_ip'],
|
||||
'fetch_setting.domain_filter_mode':
|
||||
settings['fetch_setting.domain_filter_mode'],
|
||||
'fetch_setting.ip_filter_mode':
|
||||
settings['fetch_setting.ip_filter_mode'],
|
||||
'fetch_setting.domain_list': settings['fetch_setting.domain_list'],
|
||||
'fetch_setting.ip_list': settings['fetch_setting.ip_list'],
|
||||
'fetch_setting.allowed_ports':
|
||||
settings['fetch_setting.allowed_ports'],
|
||||
'fetch_setting.apply_ip_filter_for_domain':
|
||||
settings['fetch_setting.apply_ip_filter_for_domain'],
|
||||
}}
|
||||
/>
|
||||
),
|
||||
},
|
||||
{
|
||||
id: 'token-limits',
|
||||
titleKey: 'Token Limits',
|
||||
build: (settings: SecuritySettings) => (
|
||||
<TokenLimitSection
|
||||
defaultValues={{
|
||||
'token_setting.max_user_tokens':
|
||||
settings['token_setting.max_user_tokens'],
|
||||
}}
|
||||
/>
|
||||
),
|
||||
},
|
||||
] as const
|
||||
|
||||
export type SecuritySectionId = (typeof SECURITY_SECTIONS)[number]['id']
|
||||
|
||||
const securityRegistry = createSectionRegistry<
|
||||
SecuritySectionId,
|
||||
SecuritySettings
|
||||
>({
|
||||
sections: SECURITY_SECTIONS,
|
||||
defaultSection: 'rate-limit',
|
||||
basePath: '/system-settings/security',
|
||||
urlStyle: 'path',
|
||||
})
|
||||
|
||||
export const SECURITY_SECTION_IDS = securityRegistry.sectionIds
|
||||
export const SECURITY_DEFAULT_SECTION = securityRegistry.defaultSection
|
||||
export const getSecuritySectionNavItems = securityRegistry.getSectionNavItems
|
||||
export const getSecuritySectionContent = securityRegistry.getSectionContent
|
||||
export const getSecuritySectionMeta = securityRegistry.getSectionMeta
|
||||
Reference in New Issue
Block a user