refactor: Require dashboard username and password when enabled

2026-09-22 00:01:31 +00:00 · 2026-08-24 14:22:35 +08:00
parent 0514ea3230
commit 185c29ed7c
4 changed files with 31 additions and 17 deletions
@@ -118,6 +118,20 @@ impl DashboardConfig {
    pub fn enabled(&self) -> bool {
        self.port > 0
    }
+
+    pub fn validate(&self) -> anyhow::Result<()> {
+        if !self.enabled() {
+            return Ok(());
+        }
+        let user = self.user.trim();
+        let pass = self.password.trim();
+        if user.is_empty() || pass.is_empty() {
+            anyhow::bail!(
+                "dashboard.user and dashboard.password are required when dashboard.port > 0"
+            );
+        }
+        Ok(())
+    }
 }

 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
@@ -417,6 +431,8 @@ impl ServerConfig {
            );
        }

+        self.dashboard.validate()?;
+
        Ok(())
    }

@@ -6,7 +6,8 @@ title: 管理界面

 # 管理界面

-服务端 Web 管理面板。在 `orbien-server.toml` 中配置 `[dashboard]`，且 `port > 0` 时启用。
+服务端 Web 管理面板。 `port > 0` 时启用，启用后 **必须** 配置 `user` 与
+`password`。

 ## 示例

@@ -21,9 +22,11 @@ user = "admin"
 password = "123456"
 ```

-浏览器访问 `http://SERVER_IP:8020`，使用 Basic Auth（`user` / `password`）登录。
+浏览器访问 `http://SERVER_IP:8020`，在弹出框输入用户名和密码登录。

-`addr` 默认为 `127.0.0.1`（仅本机）。需远程访问时设为 `0.0.0.0`。`staticDir` 可省略，省略时使用内置前端。
+:::tip
+`addr` 默认为 `127.0.0.1`（仅本机），需远程访问时设为 `0.0.0.0`
+:::

 ## 参数

@@ -31,6 +34,6 @@ password = "123456"
 |-----------------------|----|-------------|----------------------|
 | `dashboard.addr`      | 否  | `127.0.0.1` | 监听地址；远程访问需 `0.0.0.0` |
 | `dashboard.port`      | 是  | `0`         | 监听端口；`0` 表示关闭        |
-| `dashboard.user`      | 否  |             | Basic Auth 用户名       |
-| `dashboard.password`  | 否  |             | Basic Auth 密码        |
+| `dashboard.user`      | 是  |             | 登录用户名                |
+| `dashboard.password`  | 是  |             | 登录密码                 |
 | `dashboard.staticDir` | 否  |             | 静态资源目录；空则使用内置前端      |
@@ -6,7 +6,7 @@ title: Dashboard

 # Dashboard

-Server web dashboard. Enable it by configuring `[dashboard]` in `orbien-server.toml` with `port > 0`.
+Server web dashboard. Enabled when `port > 0`; **`user` and `password` are required** once enabled.

 ## Example

@@ -21,9 +21,11 @@ user = "admin"
 password = "123456"
 ```

-Open `http://SERVER_IP:8020` in a browser and log in with Basic Auth (`user` / `password`).
+Open `http://SERVER_IP:8020` in a browser and sign in with username and password in the login dialog.

-`addr` defaults to `127.0.0.1` (localhost only). Set it to `0.0.0.0` for remote access. `staticDir` may be omitted; if omitted, the built-in frontend is used.
+:::tip
+`addr` defaults to `127.0.0.1` (localhost only). Set it to `0.0.0.0` for remote access.
+:::

 ## Parameters

@@ -31,6 +33,6 @@ Open `http://SERVER_IP:8020` in a browser and log in with Basic Auth (`user` / `
 |-------------------------|----------|---------------|----------------------------------------------|
 | `dashboard.addr`        | No       | `127.0.0.1`   | Listen address; use `0.0.0.0` for remote access |
 | `dashboard.port`        | Yes      | `0`           | Listen port; `0` disables the dashboard      |
-| `dashboard.user`        | No       |               | Basic Auth username                          |
-| `dashboard.password`    | No       |               | Basic Auth password                          |
+| `dashboard.user`        | Yes      |               | Login username                               |
+| `dashboard.password`    | Yes      |               | Login password                               |
 | `dashboard.staticDir`   | No       |               | Static assets directory; empty uses the built-in frontend |
@@ -43,9 +43,6 @@ pub async fn basic_auth(
    req: Request<Body>,
    next: Next,
 ) -> Result<Response, Response> {
-    if !needs_auth(&state) {
-        return Ok(next.run(req).await);
-    }
    if authorized(&state, req.headers()) {
        return Ok(next.run(req).await);
    }
@@ -57,10 +54,6 @@ pub async fn basic_auth(
    Err(res)
 }

-fn needs_auth(state: &DashState) -> bool {
-    !state.cfg.user.is_empty() || !state.cfg.password.is_empty()
-}
-
 fn authorized(state: &DashState, headers: &HeaderMap) -> bool {
    let Some(h) = headers
        .get(header::AUTHORIZATION)