wonder/xinfra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(delivery): switch to a single root@% admin account model

Browse Source 
- CreateTask now accepts only mysql_root_password; drop
  mysql_admin_password and the paired root/admin validation,
  keeping the >=16-char length and alphanumeric-only checks
- deploymentCredentialVars extracts mysql_root_password only,
  remaining compatible with legacy root@localhost records
- Both delivery playbooks drop xinfra_admin provisioning and
  the mysql_admin_password assertion, creating 'root'@'%'
  as the remote admin account instead
This commit is contained in:
Hungerdream
2026-07-29 18:07:32 +08:00
parent ad1ec79563
commit ef6508938c
3 changed files with 14 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/service/delivery.go
+8 -16
View File
@@ -65,7 +65,6 @@ type MySQLDeliveryInput struct {
BinlogExpireLogsSeconds int64 `json:"binlog_expire_logs_seconds"`
MaxBinlogSize string `json:"max_binlog_size"`
MySQLRootPassword string `json:"mysql_root_password"`
MySQLAdminPassword string `json:"mysql_admin_password"`
}
type deliveryPayload struct {
@@ -575,23 +574,18 @@ func (s *DeliveryService) CreateTask(ctx context.Context, userID uint64, isAdmin
return nil, false, err
}
credentialInput := map[string]string{
"root@localhost": strings.TrimSpace(input.MySQLRootPassword),
"xinfra_admin@%": strings.TrimSpace(input.MySQLAdminPassword),
"root@%": strings.TrimSpace(input.MySQLRootPassword),
}
hasCredentialInput := credentialInput["root@localhost"] != "" || credentialInput["xinfra_admin@%"] != ""
hasCredentialInput := credentialInput["root@%"] != ""
if hasCredentialInput {
if credentialInput["root@localhost"] == "" || credentialInput["xinfra_admin@%"] == "" {
return nil, false, fmt.Errorf("mysql_root_password and mysql_admin_password must be provided together")
if len(credentialInput["root@%"]) < 16 {
return nil, false, fmt.Errorf("mysql root password must be at least 16 characters")
}
if len(credentialInput["root@localhost"]) < 16 || len(credentialInput["xinfra_admin@%"]) < 16 {
return nil, false, fmt.Errorf("mysql passwords must be at least 16 characters")
}
if !mysqlPasswordPattern.MatchString(credentialInput["root@localhost"]) || !mysqlPasswordPattern.MatchString(credentialInput["xinfra_admin@%"]) {
if !mysqlPasswordPattern.MatchString(credentialInput["root@%"]) {
return nil, false, fmt.Errorf("mysql passwords may only contain letters and digits")
}
}
input.MySQLRootPassword = ""
input.MySQLAdminPassword = ""
var existing model.DeliveryTask
if err := s.db.WithContext(ctx).Where("idempotency_key = ?", idempotencyKey).First(&existing).Error; err == nil {
@@ -990,14 +984,12 @@ func (s *DeliveryService) deploymentCredentialVars(ctx context.Context, taskID s
return nil, err
}
switch item.Username + "@" + item.AccountHost {
case "root@localhost":
case "root@%", "root@localhost":
values["mysql_root_password"] = password
case "xinfra_admin@%":
values["mysql_admin_password"] = password
}
}
if values["mysql_root_password"] == "" || values["mysql_admin_password"] == "" {
return nil, fmt.Errorf("deployment credentials are missing for task %s", taskID)
if values["mysql_root_password"] == "" {
return nil, fmt.Errorf("root deployment credential is missing for task %s", taskID)
}
return values, nil
}