From eea9f01f7b355785ece66fa60df4dd5d2ad50409 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Sun, 12 Jul 2026 00:46:24 +0800
Subject: [PATCH] fix: add workflow to fix cmd agent auth

---
 .gitea/workflows/fix-cmd-agent-auth.yml | 43 +++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .gitea/workflows/fix-cmd-agent-auth.yml

diff --git a/.gitea/workflows/fix-cmd-agent-auth.yml b/.gitea/workflows/fix-cmd-agent-auth.yml
new file mode 100644
index 000000000..8510e545e
--- /dev/null
+++ b/.gitea/workflows/fix-cmd-agent-auth.yml
@@ -0,0 +1,43 @@
+name: Fix CMD Agent Auth
+on: [push]
+jobs:
+  fix:
+    runs-on: host
+    steps:
+      - name: 验证不带Bearer
+        run: curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 验证带Bearer（应该失败）
+        run: curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 修复check_auth函数
+        run: |
+          cp /opt/xiaoxia-cmd-agent/server.py /opt/xiaoxia-cmd-agent/server.py.bak
+          python3 -c "
+with open('/opt/xiaoxia-cmd-agent/server.py', 'r') as f:
+    content = f.read()
+old = '''    def check_auth(self):
+        t = self.headers.get(\"Authorization\", \"\")
+        if t != AUTH_TOKEN:
+            self._j({\"error\": \"unauthorized\"}, 401); return False
+        return True'''
+new = '''    def check_auth(self):
+        t = self.headers.get(\"Authorization\", \"\")
+        if t.startswith(\"Bearer \"):
+            t = t[7:]
+        if t != AUTH_TOKEN:
+            self._j({\"error\": \"unauthorized\"}, 401); return False
+        return True'''
+content = content.replace(old, new)
+with open('/opt/xiaoxia-cmd-agent/server.py', 'w') as f:
+    f.write(content)
+print('Fixed')
+"
+      - name: 重启服务
+        run: systemctl restart xiaoxia-cmd-agent
+      - name: 等待服务启动
+        run: sleep 2
+      - name: 修复后验证-不带Bearer
+        run: curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 修复后验证-带Bearer
+        run: curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 公网路径验证
+        run: curl -sk -w "\nHTTP_CODE:%{http_code}" https://127.0.0.1/cmd-agent/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"