alexei.dolgolyov
582e7e39e3
- Add 'absolute' volume scope for direct host paths (NFS, external mounts) - Allowlist in settings: allowed_volume_paths (JSON array of prefixes) - Validation: absolute source must be under an allowed prefix - Empty allowlist = absolute scope disabled entirely - Settings API exposes/validates allowed_volume_paths - Frontend type updated with absolute scope
46 lines
1.7 KiB
Go
46 lines
1.7 KiB
Go
package store
|
|
|
|
import (
|
|
"fmt"
|
|
)
|
|
|
|
// GetSettings returns the global settings (single-row pattern, always row id=1).
|
|
func (s *Store) GetSettings() (Settings, error) {
|
|
var st Settings
|
|
err := s.db.QueryRow(
|
|
`SELECT domain, server_ip, network, subdomain_pattern, notification_url,
|
|
npm_url, npm_email, npm_password, webhook_secret, polling_interval,
|
|
base_volume_path, ssl_certificate_id, stale_threshold_days,
|
|
allowed_volume_paths, updated_at
|
|
FROM settings WHERE id = 1`,
|
|
).Scan(&st.Domain, &st.ServerIP, &st.Network, &st.SubdomainPattern, &st.NotificationURL,
|
|
&st.NpmURL, &st.NpmEmail, &st.NpmPassword, &st.WebhookSecret, &st.PollingInterval,
|
|
&st.BaseVolumePath, &st.SSLCertificateID, &st.StaleThresholdDays,
|
|
&st.AllowedVolumePaths, &st.UpdatedAt)
|
|
if err != nil {
|
|
return Settings{}, fmt.Errorf("query settings: %w", err)
|
|
}
|
|
return st, nil
|
|
}
|
|
|
|
// UpdateSettings upserts the global settings row.
|
|
func (s *Store) UpdateSettings(st Settings) error {
|
|
st.UpdatedAt = Now()
|
|
_, err := s.db.Exec(
|
|
`UPDATE settings SET
|
|
domain=?, server_ip=?, network=?, subdomain_pattern=?, notification_url=?,
|
|
npm_url=?, npm_email=?, npm_password=?, webhook_secret=?, polling_interval=?,
|
|
base_volume_path=?, ssl_certificate_id=?, stale_threshold_days=?,
|
|
allowed_volume_paths=?, updated_at=?
|
|
WHERE id = 1`,
|
|
st.Domain, st.ServerIP, st.Network, st.SubdomainPattern, st.NotificationURL,
|
|
st.NpmURL, st.NpmEmail, st.NpmPassword, st.WebhookSecret, st.PollingInterval,
|
|
st.BaseVolumePath, st.SSLCertificateID, st.StaleThresholdDays,
|
|
st.AllowedVolumePaths, st.UpdatedAt,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("update settings: %w", err)
|
|
}
|
|
return nil
|
|
}
|