feat: 增加配置参数来控制是否显示 /config 接口

Author: icyleaf

config/hpr.example.yml

@@ -15,6 +15,8 @@ gitlab:
   project_wiki: false
   project_merge_request: false
   project_snippet: false
+api:
+  disable_config: false
 sentry:
   report: true
   dns: https://cd580221c955434b84d8c7fce2e9ed8d:[email protected]/1525034

docs/api.md

@@ -311,7 +311,7 @@ GET /info/busy
 
 ## 查看配置
 
-显示 hpr 配置信息。
+显示 hpr 配置信息，可通过配置文件开启或关闭，认证信息及 Gitlab private token 会加密显示。
 
 ```
 GET /config
@@ -328,12 +328,12 @@ GET /config
   "schedule_in": "1.minute",
   "basic_auth": {
     "enable": false,
-    "user": "hpr",
-    "password": "p@ssw0rd"
+    "user": "******",
+    "password": "******"
   },
   "gitlab": {
     "endpoint": "http://gitlab.example.com/api/v4",
-    "private_token": "<private_token-or-access_token>",
+    "private_token": "<encoded-private_token-or-access_token>",
     "group_name": "mirrors",
     "project_public": false,
     "project_issue": false,

docs/configuration.md

@@ -44,6 +44,14 @@ HTTP APIs 认证机制，如果需要暴露在外网访问为了安全起见目
 | project_merge_request | boolean | 是否开启 MR | `true`/`false` |
 | project_snippet | boolean | 是否开启 Snippet | `true`/`false` |
 
+## api
+
+和 API 相关的配置
+
+| 名称 | 类型 | 说明 | 备注 |
+|---|---|---|---|
+| disable_config | boolean | 开关 [/config](api#查看配置) 接口 | /config 会加密显示隐私字段，敏感的可以开启线上环境禁用此接口 |
+
 ## sentry
 
 匿名错误上报，建议在 hpr 还未稳定之前保持开启状态，hpr 使用过程中遇到的各种问题上报对于尽快修复有很大的帮助作用，同时也减少了您提 issue 的环节和填写补充信息。如果你强烈不想错误上报也可以关闭它。

lib/hpr/web.rb

@@ -16,6 +16,13 @@ class Web < Sinatra::Base
       use Rack::CommonLogger, Logger.new(STDOUT)
       use Raven::Rack
 
+      if Configuration.basic_auth?
+        use Rack::Auth::Basic, 'HPR Auth' do |username, password|
+          username == Configuration.basic_auth.user &&
+            password == Configuration.basic_auth.password
+        end
+      end
+
       set :show_exceptions, :after_handler
     end
 
@@ -36,8 +43,10 @@ class Web < Sinatra::Base
       json busy_jobs
     end
 
-    get '/config' do
-      json Hpr::Configuration.to_safe_h
+    unless Hpr::Configuration.api.disable_config
+      get '/config' do
+        json Hpr::Configuration.to_safe_h
+      end
     end
 
     get '/repositories' do
@@ -146,13 +155,6 @@ def repository_or_404(name)
       end
     end
 
-    if Configuration.basic_auth?
-      use Rack::Auth::Basic, 'HPR Auth' do |username, password|
-        username == Configuration.basic_auth.user &&
-          password == Configuration.basic_auth.password
-      end
-    end
-
     private
 
     def client