Kris
ecd3c90e80
新增设备身份管理、认证限流、并发通道、Webhook路由、RBAC权限控制、SSE/轮询降级等全套网关通道功能，包含： 1. 设备身份生成与签名验证 2. 设备令牌认证与速率限制 3. 内存+数据库双重设备注册表 4. 并发通道限流管理 5. Webhook安全处理与路由 6. RBAC权限校验系统 7. OpenAI API兼容适配层 8. Tailscale认证支持 9. HTTP轮询降级机制
178 lines
4.7 KiB
Python
178 lines
4.7 KiB
Python
from yuxi.channel.gateway.auth import (
|
|
GatewayAuthMode,
|
|
GatewayAuthResult,
|
|
TrustedProxyConfig,
|
|
authenticate_gateway_connect,
|
|
authenticate_tailscale,
|
|
authenticate_trusted_proxy,
|
|
clear_bootstrap_token,
|
|
generate_bootstrap_token,
|
|
get_bootstrap_token,
|
|
set_bootstrap_token,
|
|
)
|
|
from yuxi.channel.gateway.auth_rate_limiter import AuthRateLimiter, AuthRateScope, auth_rate_limiter
|
|
from yuxi.channel.gateway.device_auth import build_device_token, parse_device_token
|
|
from yuxi.channel.gateway.device_identity import (
|
|
derive_device_id,
|
|
generate_device_identity,
|
|
sign_challenge,
|
|
verify_signature,
|
|
)
|
|
from yuxi.channel.gateway.device_registry import (
|
|
list_devices,
|
|
lookup_public_key,
|
|
register_device,
|
|
unregister_device,
|
|
)
|
|
from yuxi.channel.gateway.lanes import ChannelLane, LaneManager, lane_manager
|
|
from yuxi.channel.gateway.net_utils import (
|
|
GatewayBindMode,
|
|
build_ws_security_error,
|
|
can_bind_to_host,
|
|
can_bind_to_host_cached,
|
|
has_forwarded_request_headers,
|
|
has_tailscale_proxy_headers,
|
|
is_local_direct_request,
|
|
is_localish_host,
|
|
is_loopback_address,
|
|
is_loopback_host,
|
|
is_private_host,
|
|
is_private_or_loopback_host,
|
|
is_secure_ws_url,
|
|
is_tailscale_proxy_request,
|
|
is_trusted_proxy_address,
|
|
resolve_client_ip,
|
|
resolve_forwarded_client_ip,
|
|
resolve_gateway_bind_host,
|
|
resolve_tailscale_client_ip,
|
|
)
|
|
from yuxi.channel.gateway.protocol import (
|
|
DeliveryMode,
|
|
FrameType,
|
|
GatewayErrorCode,
|
|
GatewayRpcMethod,
|
|
HelloOk,
|
|
RpcEvent,
|
|
RpcFrame,
|
|
RpcRequest,
|
|
RpcResponse,
|
|
marshal_frame,
|
|
unmarshal_frame,
|
|
)
|
|
from yuxi.channel.gateway.routes import (
|
|
WebhookRegistry,
|
|
build_health_response,
|
|
build_webhook_path,
|
|
webhook_registry,
|
|
)
|
|
from yuxi.channel.gateway.openai_adapter import (
|
|
OPENAI_CHAT_COMPLETIONS_PATH,
|
|
OPENAI_MODELS_PATH,
|
|
OpenAIMessageConverter,
|
|
format_sse_stream,
|
|
)
|
|
from yuxi.channel.gateway.rpc_dispatcher import RpcDispatcher, rpc_dispatcher
|
|
from yuxi.channel.gateway.server import GatewayWsServer, gateway_ws_server
|
|
from yuxi.channel.gateway.sse import GatewaySseEndpoint, gateway_sse_endpoint
|
|
from yuxi.channel.gateway.polling import PollingFallback, polling_fallback, start_polling_cleanup
|
|
from yuxi.channel.gateway.tailscale_auth import (
|
|
TailscaleWhoisIdentity,
|
|
get_tailscale_user_from_headers,
|
|
read_tailscale_whois_identity,
|
|
)
|
|
from yuxi.channel.gateway.webhook_security import (
|
|
WebhookAnomalyTracker,
|
|
WebhookConcurrencyGuard,
|
|
WebhookGuard,
|
|
WebhookGuardConfig,
|
|
WebhookGuardResult,
|
|
WebhookSigner,
|
|
webhook_guard,
|
|
)
|
|
|
|
__all__ = [
|
|
"AuthRateLimiter",
|
|
"AuthRateScope",
|
|
"ChannelLane",
|
|
"DeliveryMode",
|
|
"FrameType",
|
|
"GatewayAuthMode",
|
|
"GatewayAuthResult",
|
|
"GatewayBindMode",
|
|
"GatewayErrorCode",
|
|
"GatewayRpcMethod",
|
|
"HelloOk",
|
|
"GatewayWsServer",
|
|
"GatewaySseEndpoint",
|
|
"LaneManager",
|
|
"OPENAI_CHAT_COMPLETIONS_PATH",
|
|
"OPENAI_MODELS_PATH",
|
|
"OpenAIMessageConverter",
|
|
"PollingFallback",
|
|
"RpcDispatcher",
|
|
"RpcEvent",
|
|
"RpcFrame",
|
|
"RpcRequest",
|
|
"RpcResponse",
|
|
"TailscaleWhoisIdentity",
|
|
"TrustedProxyConfig",
|
|
"WebhookAnomalyTracker",
|
|
"WebhookConcurrencyGuard",
|
|
"WebhookGuard",
|
|
"WebhookGuardConfig",
|
|
"WebhookGuardResult",
|
|
"WebhookRegistry",
|
|
"WebhookSigner",
|
|
"authenticate_gateway_connect",
|
|
"authenticate_tailscale",
|
|
"authenticate_trusted_proxy",
|
|
"auth_rate_limiter",
|
|
"build_device_token",
|
|
"build_health_response",
|
|
"build_webhook_path",
|
|
"build_ws_security_error",
|
|
"can_bind_to_host",
|
|
"can_bind_to_host_cached",
|
|
"clear_bootstrap_token",
|
|
"derive_device_id",
|
|
"gateway_ws_server",
|
|
"gateway_sse_endpoint",
|
|
"format_sse_stream",
|
|
"polling_fallback",
|
|
"generate_bootstrap_token",
|
|
"generate_device_identity",
|
|
"get_bootstrap_token",
|
|
"get_tailscale_user_from_headers",
|
|
"has_forwarded_request_headers",
|
|
"has_tailscale_proxy_headers",
|
|
"is_local_direct_request",
|
|
"is_localish_host",
|
|
"is_loopback_address",
|
|
"is_loopback_host",
|
|
"is_private_host",
|
|
"is_private_or_loopback_host",
|
|
"is_secure_ws_url",
|
|
"is_tailscale_proxy_request",
|
|
"is_trusted_proxy_address",
|
|
"lane_manager",
|
|
"list_devices",
|
|
"lookup_public_key",
|
|
"marshal_frame",
|
|
"parse_device_token",
|
|
"read_tailscale_whois_identity",
|
|
"register_device",
|
|
"resolve_client_ip",
|
|
"resolve_forwarded_client_ip",
|
|
"resolve_gateway_bind_host",
|
|
"resolve_tailscale_client_ip",
|
|
"rpc_dispatcher",
|
|
"set_bootstrap_token",
|
|
"sign_challenge",
|
|
"start_polling_cleanup",
|
|
"unmarshal_frame",
|
|
"unregister_device",
|
|
"verify_signature",
|
|
"webhook_guard",
|
|
"webhook_registry",
|
|
]
|