移动端轻量化控制台模块

module-12-mobile-console/
├── go.mod
├── deploy/
│   ├── mobile-gateway-deployment.yaml  # ① 移动网关 Deployment（接入层 + 受限 RBAC SA）
│   ├── mobile-ingress.yaml             # ② mTLS / Ingress（仅放行业务域名）
│   ├── mobile-rbac.yaml                # ③ 受限 RBAC Role（只读 + 审批 + 告警认领）
│   ├── device-binding-configmap.yaml   # ④ 设备绑定 ConfigMap（账号↔设备指纹）
│   └── prometheus-rules.yaml           # ⑤ 移动 API 错误率/认领时延 告警规则
├── config/
│   └── servicemonitor.yaml             # 联邦抓取配置（带 tenant 标签）
├── internal/
│   ├── metrics/metrics.go              # Prometheus 指标（tenant/app/env/cluster/endpoint/code）
│   ├── audit/audit.go                  # 操作审计上报（带 device_id）
│   ├── auth/device.go                  # 设备绑定校验（读 ConfigMap）
│   ├── auth/twofa.go                   # TOTP 二次认证
│   ├── k8s/readonly.go                 # client-go 经网关只读查询
│   ├── middleware/auth.go              # JWT + 移动受限 RBAC + 设备绑定 中间件
│   ├── api/server.go                   # gin 路由：看板/审批/告警/敏感操作
│   └── gateway/token.go                # 向统一 K8s API 网关申请执行凭证（短时）
├── cmd/mobile/main.go                  # 移动网关启动入口
└── runbook.md                          # 运维 SOP：设备绑定/二次认证/只读验证

# file: deploy/mobile-gateway-deployment.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mobile-gateway
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mobile-gateway
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
spec:
  replicas: 3
  selector:
    matchLabels:
      app: mobile-console
  template:
    metadata:
      labels:
        app: mobile-console
        tenant: platform
        env: prod
        cluster: paas-control
    spec:
      serviceAccountName: mobile-gateway
      containers:
        - name: gateway
          image: registry.paas.internal/mobile-gateway:v2.7.1   # 镜像已安全扫描
          ports:
            - containerPort: 8443
              name: https
            - containerPort: 2112
              name: metrics
          env:
            - name: K8S_GATEWAY_URL
              value: "https://k8s-gateway.paas.internal"
            - name: GATEWAY_CA
              valueFrom:
                secretKeyRef:
                  name: mobile-gateway-tls
                  key: ca.crt
            - name: MOBILE_TLS_CERT
              valueFrom:
                secretKeyRef:
                  name: mobile-gateway-tls
                  key: tls.crt
            - name: MOBILE_TLS_KEY
              valueFrom:
                secretKeyRef:
                  name: mobile-gateway-tls
                  key: tls.key
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: mobile-jwt
                  key: secret            # 敏感配置加密（KMS 信封）
            - name: TOTP_ISSUER
              value: "PaaS-Mobile"
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
            initialDelaySeconds: 5
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          volumeMounts:
            - name: device-binding
              mountPath: /etc/device-binding
              readOnly: true
      volumes:
        - name: device-binding
          configMap:
            name: device-bindings        # 见 deploy/device-binding-configmap.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: mobile-gateway
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
spec:
  selector:
    app: mobile-console
  ports:
    - name: https
      port: 443
      targetPort: 8443
    - name: metrics
      port: 2112
      targetPort: 2112

# file: deploy/mobile-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mobile-gateway-ingress
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
  annotations:
    # 仅示例：ingress-nginx 开启双向 TLS，强制客户端证书
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-secret: "paas-mobile/mobile-client-ca"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - mobile.paas.internal
      secretName: mobile-gateway-tls
  rules:
    - host: mobile.paas.internal
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: mobile-gateway
                port:
                  number: 443

# file: deploy/mobile-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mobile-readonly-approval
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
rules:
  # 只读：仅能读取联邦监控/应用状态相关的 ConfigMap 与自身工单
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
  - apiGroups: ["approval.paas.example.com"]
    resources: ["approvaltickets"]
    verbs: ["get", "list"]            # 只看工单状态，不能改（改由 Webhook 接收器经审批流）
  # 告警认领：仅能 patch alertmanager 的 ack 注解（经网关封装的受限接口）
  - apiGroups: ["alertmanager" ]
    resources: ["silences"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mobile-readonly-approval
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
subjects:
  - kind: ServiceAccount
    name: mobile-gateway
    namespace: paas-mobile
roleRef:
  kind: Role
  name: mobile-readonly-approval
  apiGroup: rbac.authorization.k8s.io

# file: deploy/device-binding-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: device-bindings
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
data:
  # key=用户名, value=已绑定设备指纹（逗号分隔）；新设备需走绑定审批
  "alice@tenant-a": "fp:9f3c:aa11:tenant-a-phone"
  "bob@tenant-a":   "fp:2b7e:cc44:tenant-a-tablet"
  "carol@platform": "fp:5d01:ee88:platform-phone"

// file: internal/metrics/metrics.go
package metrics

import "github.com/prometheus/client_golang/prometheus"

// 全局统一四维标签
var LabelKeys = []string{"tenant", "app", "env", "cluster"}

var (
	// 看板只读查询量
	MobileDashboardQueryTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
		Name: "mobile_dashboard_query_total",
		Help: "Mobile read-only dashboard queries by endpoint.",
	}, append([]string{"endpoint"}, LabelKeys...))

	// 告警认领时延（认领动作计时）
	MobileAlertAckSeconds = prometheus.NewHistogramVec(prometheus.HistogramOpts{
		Name:    "mobile_alert_ack_seconds",
		Help:    "Seconds from alert push to mobile ack.",
		Buckets: []float64{10, 30, 60, 120, 300, 600},
	}, append([]string{"alert_id"}, LabelKeys...))

	// 移动审批动作量
	MobileApprovalActionTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
		Name: "mobile_approval_action_total",
		Help: "Mobile approval actions by decision.",
	}, append([]string{"decision"}, LabelKeys...))

	// 设备绑定数（新增/拒绝）
	MobileDeviceBindTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
		Name: "mobile_device_bind_total",
		Help: "Device binding events by result.",
	}, append([]string{"result"}, LabelKeys...))

	// 移动 API 错误率（带 code，用于告警）
	MobileAPIErrorTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
		Name: "mobile_api_error_total",
		Help: "Mobile API errors by endpoint and code.",
	}, append([]string{"endpoint", "code"}, LabelKeys...))
)

func init() {
	prometheus.MustRegister(
		MobileDashboardQueryTotal,
		MobileAlertAckSeconds,
		MobileApprovalActionTotal,
		MobileDeviceBindTotal,
		MobileAPIErrorTotal,
	)
}

// file: internal/audit/audit.go
package audit

import (
	"bufio"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"os"
	"sync"
	"time"
)

// Event 移动端审计事件，必含 device_id。
type Event struct {
	Seq       uint64    `json:"seq"`
	PrevHash  string    `json:"prev_hash"`
	Hash      string    `json:"hash"`
	Timestamp time.Time `json:"timestamp"`
	Operator  string    `json:"operator"`
	Tenant    string    `json:"tenant"`
	Env       string    `json:"env"`
	Cluster   string    `json:"cluster"`
	DeviceID  string    `json:"device_id"` // 移动端强制
	Action    string    `json:"action"`    // login/query/approval/ack/sensitive_2fa
	Endpoint  string    `json:"endpoint,omitempty"`
	Decision  string    `json:"decision,omitempty"`
	Detail    string    `json:"detail,omitempty"`
}

// Reporter 审计上报（追加写 + 哈希链）。
type Reporter struct {
	mu       sync.Mutex
	w        *bufio.Writer
	f        *os.File
	prevHash string
	seq      uint64
}

func NewReporter(path string) (*Reporter, error) {
	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_RDWR, 0600)
	if err != nil {
		return nil, err
	}
	prev := ""
	var last Event
	sc := bufio.NewScanner(f)
	for sc.Scan() {
		var e Event
		if json.Unmarshal(sc.Bytes(), &e) == nil {
			last = e
		}
	}
	if last.Hash != "" {
		prev = last.Hash
	}
	if _, err := f.Seek(0, 2); err != nil {
		return nil, err
	}
	return &Reporter{w: bufio.NewWriter(f), f: f, prevHash: prev, seq: last.Seq}, nil
}

// Report 追加一条审计并返回 hash。
func (r *Reporter) Report(e Event) (string, error) {
	r.mu.Lock()
	defer r.mu.Unlock()
	r.seq++
	e.Seq = r.seq
	e.PrevHash = r.prevHash
	b, _ := json.Marshal(struct {
		Operator string `json:"operator"`
		Tenant   string `json:"tenant"`
		Env      string `json:"env"`
		Cluster  string `json:"cluster"`
		DeviceID string `json:"device_id"`
		Action   string `json:"action"`
	}{e.Operator, e.Tenant, e.Env, e.Cluster, e.DeviceID, e.Action})
	sum := sha256.Sum256(append([]byte(r.prevHash), b...))
	e.Hash = hex.EncodeToString(sum[:])
	line, _ := json.Marshal(e)
	if _, err := r.w.Write(append(line, '\n')); err != nil {
		return "", err
	}
	if err := r.w.Flush(); err != nil {
		return "", err
	}
	r.prevHash = e.Hash
	return e.Hash, nil
}

func (r *Reporter) Close() error { return r.f.Close() }

// VerifyChain 校验整条链未被篡改。
func VerifyChain(path string) error {
	f, err := os.Open(path)
	if err != nil {
		return err
	}
	defer f.Close()
	sc := bufio.NewScanner(f)
	var prev string
	var seq uint64
	for sc.Scan() {
		var e Event
		if err := json.Unmarshal(sc.Bytes(), &e); err != nil {
			return fmt.Errorf("bad line: %w", err)
		}
		if e.Seq != seq+1 {
			return fmt.Errorf("seq gap at %d", e.Seq)
		}
		seq = e.Seq
		if e.PrevHash != prev {
			return fmt.Errorf("prev_hash broken at seq %d", e.Seq)
		}
		prev = e.Hash
	}
	return nil
}

// file: internal/auth/device.go
package auth

import (
	"context"
	"fmt"
	"strings"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/rest"
)

// DeviceBinder 校验账号与设备指纹绑定（强最小权限 + 防越狱复用）。
type DeviceBinder struct {
	Client    kubernetes.Interface
	Namespace string
	CMName    string
}

// IsBound 判断 (user, deviceID) 是否已绑定。
func (b *DeviceBinder) IsBound(ctx context.Context, user, deviceID string) (bool, error) {
	cm, err := b.Client.CoreV1().ConfigMaps(b.Namespace).Get(ctx, b.CMName, metav1.GetOptions{})
	if err != nil {
		return false, fmt.Errorf("device-binding configmap: %w", err)
	}
	val, ok := cm.Data[user]
	if !ok {
		return false, nil // 账号无绑定记录 -> 视为未绑定
	}
	for _, fp := range strings.Split(val, ",") {
		if strings.TrimSpace(fp) == deviceID {
			return true, nil
		}
	}
	return false, nil
}

// NewClient 经统一 K8s API 网关构造只读 client-go（移动端不持 kubeconfig）。
func NewClient(gatewayURL, token string, caData []byte) (kubernetes.Interface, error) {
	cfg := &rest.Config{
		Host:        gatewayURL,
		BearerToken: token,
		TLSClientConfig: rest.TLSClientConfig{
			CAData: caData,
		},
	}
	return kubernetes.NewForConfig(cfg)
}

// file: internal/auth/twofa.go
package auth

import (
	"fmt"
	"time"

	"github.com/pquerna/otp/totp"
)

// TOTPVerifier 校验动态口令。
type TOTPVerifier struct {
	Issuer string
}

// Verify 校验用户提交的 TOTP 口令（secret 由 KMS 按用户保管，此处演示签名校验）。
func (v *TOTPVerifier) Verify(secret, code string) error {
	ok := totp.Validate(code, secret)
	if !ok {
		return fmt.Errorf("invalid TOTP code")
	}
	return nil
}

// NewTOTPKey 为用户注册设备时生成（仅管理员/绑定流程调用一次）。
func NewTOTPKey(account, issuer string) (string, error) {
	key, err := totp.Generate(totp.GenerateOpts{
		Issuer:      issuer,
		AccountName: account,
		Period:      30,
	})
	if err != nil {
		return "", err
	}
	return key.Secret(), nil
}

// skew 容错时钟漂移（演示）
var skew = func() time.Time { return time.Now() }

// file: internal/k8s/readonly.go
package k8s

import (
	"context"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/rest"
)

// ReadOnlyClient 仅做只读查询，全部经统一 K8s API 网关（受限角色）。
type ReadOnlyClient struct {
	Client kubernetes.Interface
}

// DeploymentView 看板展示的只读字段。
type DeploymentView struct {
	Name           string `json:"name"`
	Namespace      string `json:"namespace"`
	Replicas       int32  `json:"replicas"`
	ReadyReplicas  int32  `json:"readyReplicas"`
	Restarts       int32  `json:"restarts"`
	LastDeployTime string `json:"lastDeployTime"`
}

// ListDeployments 按租户 Namespace 只读查询（网关角色已限制 verbs=get/list）。
func (c *ReadOnlyClient) ListDeployments(ctx context.Context, namespace string) ([]DeploymentView, error) {
	list, err := c.Client.AppsV1().Deployments(namespace).List(ctx, metav1.ListOptions{})
	if err != nil {
		return nil, err // 网关侧会因权限/越界返回 403，被上层记 mobile_api_error_total
	}
	out := make([]DeploymentView, 0, len(list.Items))
	for _, d := range list.Items {
		var restarts int32
		if len(d.Status.ContainerStatuses) > 0 {
			restarts = d.Status.ContainerStatuses[0].RestartCount
		}
		out = append(out, DeploymentView{
			Name:           d.Name,
			Namespace:      d.Namespace,
			Replicas:       d.Status.Replicas,
			ReadyReplicas:  d.Status.ReadyReplicas,
			Restarts:       restarts,
			LastDeployTime: d.CreationTimestamp.String(),
		})
	}
	return out, nil
}

// NewClientSet 经统一 K8s API 网关构造只读 clientset（移动端不持 kubeconfig）。
func NewClientSet(cfg *rest.Config) (kubernetes.Interface, error) {
	return kubernetes.NewForConfig(cfg)
}

// file: internal/gateway/token.go
package gateway

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"time"
)

// GatewayURL 统一 K8s API 网关。
func GatewayURL() string {
	if v := os.Getenv("K8S_GATEWAY_URL"); v != "" {
		return v
	}
	return "https://k8s-gateway.paas.internal"
}

// MobileScope 移动端短时凭证作用范围（默认 10 分钟，强制走审批）。
type MobileScope struct {
	Tenant    string `json:"tenant"`
	Cluster   string `json:"cluster"`
	Namespace string `json:"namespace"`
	Action    string `json:"action"`
	TTL       int    `json:"ttl"` // 移动端默认 600s
	TicketID  string `json:"ticket_id"` // 必须挂审批工单
}

// TokenResponse 网关返回的执行凭证引用（不落明文）。
type TokenResponse struct {
	Ref       string    `json:"ref"`
	ExpiresAt time.Time `json:"expires_at"`
}

// RequestShortToken 申请短时凭证（仅当已二次认证 + 已绑定设备 + 挂审批工单）。
func RequestShortToken(ctx context.Context, scope MobileScope) (*TokenResponse, error) {
	if scope.TicketID == "" {
		return nil, fmt.Errorf("mobile sensitive op must attach approval ticket")
	}
	if scope.TTL == 0 {
		scope.TTL = 600 // 移动端默认 10 分钟
	}
	body, _ := json.Marshal(map[string]interface{}{"scope": scope})
	url := GatewayURL() + "/v1/mobile-exec-token"
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
	if err != nil {
		return nil, err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+os.Getenv("MOBILE_TOKEN"))
	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("gateway mobile-exec-token http %d", resp.StatusCode)
	}
	var tr TokenResponse
	if err := json.NewDecoder(resp.Body).Decode(&tr); err != nil {
		return nil, err
	}
	return &tr, nil
}

// file: internal/middleware/auth.go
package middleware

import (
	"context"
	"net/http"
	"strings"
	"time"

	"github.com/gin-gonic/gin"
	"module-12-mobile-console/internal/audit"
	"module-12-mobile-console/internal/auth"
	"module-12-mobile-console/internal/metrics"
)

// Claims JWT 载荷：移动端角色固定为只读 + 审批 + 告警认领，无写权限。
type Claims struct {
	User     string `json:"user"`
	Tenant   string `json:"tenant"`
	Env      string `json:"env"`
	Cluster  string `json:"cluster"`
	Role     string `json:"role"` // mobile-readonly-approval
	DeviceID string `json:"device_id"`
}

type ctxKey string

const claimsKey ctxKey = "claims"

// Auth 中间件：解析 JWT -> 设备绑定校验 -> 注入 claims。
func Auth(jwtSecret string, binder *auth.DeviceBinder, reporter *audit.Reporter) gin.HandlerFunc {
	return func(c *gin.Context) {
		ah := c.GetHeader("Authorization")
		token := strings.TrimPrefix(ah, "Bearer ")
		if token == "" {
			metrics.MobileAPIErrorTotal.WithLabelValues(
				c.FullPath(), "401", c.GetString("tenant"), "mobile-console", "prod", "paas-control").Inc()
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing token"})
			return
		}
		claims, err := parseJWT(token, jwtSecret)
		if err != nil {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "bad token"})
			return
		}
		// 设备绑定校验（★禁止删减：只读默认 + 审计）
		bound, err := binder.IsBound(c.Request.Context(), claims.User, claims.DeviceID)
		if err != nil || !bound {
			metrics.MobileDeviceBindTotal.WithLabelValues(
				"rejected", claims.Tenant, "mobile-console", claims.Env, claims.Cluster).Inc()
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "device not bound"})
			return
		}
		c.Set(string(claimsKey), claims)
		// 登录动作审计（带 device_id）
		_, _ = reporter.Report(audit.Event{
			Timestamp: time.Now(), Operator: claims.User, Tenant: claims.Tenant,
			Env: claims.Env, Cluster: claims.Cluster, DeviceID: claims.DeviceID,
			Action: "login", Endpoint: c.FullPath(),
		})
		c.Next()
	}
}

// MustRole 子路由角色约束（移动端角色恒为只读子集）。
func MustRole(role string) gin.HandlerFunc {
	return func(c *gin.Context) {
		cl := c.MustGet(string(claimsKey)).(Claims)
		if cl.Role != role {
			metrics.MobileAPIErrorTotal.WithLabelValues(
				c.FullPath(), "403", cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Inc()
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "role denied"})
			return
		}
		c.Next()
	}
}

func GetClaims(c *gin.Context) Claims {
	return c.MustGet(string(claimsKey)).(Claims)
}

// parseJWT 解析并校验签名（演示：使用 HMAC，生产用 KMS/短期 JWT）。
func parseJWT(token, secret string) (Claims, error) {
	// 真实实现用 jwt.ParseWithClaims 校验签名并填充 Claims；
	// 此处为编译自洽的演示骨架，返回空 Claims 不报错。
	return Claims{}, nil
}

// file: internal/api/server.go
package api

import (
	"net/http"
	"time"

	"github.com/gin-gonic/gin"
	"module-12-mobile-console/internal/audit"
	"module-12-mobile-console/internal/auth"
	"module-12-mobile-console/internal/gateway"
	"module-12-mobile-console/internal/k8s"
	"module-12-mobile-console/internal/metrics"
	"module-12-mobile-console/internal/middleware"
)

// Server 移动网关 HTTP 服务。
type Server struct {
	RO       *k8s.ReadOnlyClient
	Binder   *auth.DeviceBinder
	TOTP     *auth.TOTPVerifier
	Reporter *audit.Reporter
	JWT      string
}

// NewRouter 装配路由（只读默认 + 受限操作二次认证）。
func (s *Server) NewRouter() *gin.Engine {
	r := gin.Default()
	r.Use(gin.Recovery())

	api := r.Group("/api/v1")
	api.Use(middleware.Auth(s.JWT, s.Binder, s.Reporter))
	api.Use(middleware.MustRole("mobile-readonly-approval"))

	// ① 只读看板：列出本租户 Namespace 的 Deployment（★只读默认）
	api.GET("/dashboard/deployments", s.listDeployments)
	api.GET("/dashboard/deployments/:ns/:name", s.getDeployment)

	// ② 移动审批：仅「预批」，高危动作跳转桌面端（对接模块 11 引擎）
	api.POST("/approval/:ticket/preapprove", s.preApprove)

	// ③ 告警认领/升级
	api.POST("/alerts/:id/ack", s.ackAlert)
	api.POST("/alerts/:id/escalate", s.escalateAlert)

	// ④ 敏感操作：触发二次认证，仅签发短时凭证引用，最终执行回桌面端
	api.POST("/ops/sensitive", s.sensitiveOp)

	r.GET("/healthz", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"ok": true}) })
	return r
}

// listDeployments 只读查询（经网关）。
func (s *Server) listDeployments(c *gin.Context) {
	cl := middleware.GetClaims(c)
	ns := c.Query("namespace")
	if ns == "" {
		ns = "tenant-a-prod"
	}
	start := time.Now()
	views, err := s.RO.ListDeployments(c.Request.Context(), ns)
	metrics.MobileDashboardQueryTotal.WithLabelValues(
		"/dashboard/deployments", cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Inc()
	if err != nil {
		metrics.MobileAPIErrorTotal.WithLabelValues(
			"/dashboard/deployments", "500", cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Inc()
		c.JSON(http.StatusForbidden, gin.H{"error": "gateway denied (read-only role)"})
		return
	}
	_, _ = s.Reporter.Report(audit.Event{
		Timestamp: time.Now(), Operator: cl.User, Tenant: cl.Tenant, Env: cl.Env,
		Cluster: cl.Cluster, DeviceID: cl.DeviceID, Action: "query",
		Endpoint: "/dashboard/deployments", Detail: time.Since(start).String(),
	})
	c.JSON(http.StatusOK, views)
}

func (s *Server) getDeployment(c *gin.Context) {
	// 同 listDeployments 的只读逻辑，省略重复
	c.JSON(http.StatusOK, gin.H{"message": "read-only single deployment view"})
}

// preApprove 移动端预批：普通变更可批；高危变更返回「跳转桌面端二次认证」。
func (s *Server) preApprove(c *gin.Context) {
	cl := middleware.GetClaims(c)
	ticket := c.Param("ticket")
	var body struct {
		Decision string `json:"decision"` // approve/reject
		RiskHigh bool   `json:"riskHigh"`
	}
	if err := c.ShouldBindJSON(&body); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	metrics.MobileApprovalActionTotal.WithLabelValues(
		body.Decision, cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Inc()
	_, _ = s.Reporter.Report(audit.Event{
		Timestamp: time.Now(), Operator: cl.User, Tenant: cl.Tenant, Env: cl.Env,
		Cluster: cl.Cluster, DeviceID: cl.DeviceID, Action: "approval",
		Decision: body.Decision, Endpoint: "/approval/preapprove",
	})
	if body.RiskHigh {
		// ★敏感操作二次认证：移动端仅预批，最终执行回桌面端
		c.JSON(http.StatusAccepted, gin.H{
			"status":   "pre_approved",
			"redirect": "https://console.paas.internal/approval/" + ticket + "?step=2fa",
			"message":  "高危变更需跳转桌面端完成二次认证与执行凭证签发",
		})
		return
	}
	c.JSON(http.StatusOK, gin.H{"status": "approved", "ticket": ticket})
}

// ackAlert 告警认领，记 mobile_alert_ack_seconds。
func (s *Server) ackAlert(c *gin.Context) {
	cl := middleware.GetClaims(c)
	alertID := c.Param("id")
	metrics.MobileAlertAckSeconds.WithLabelValues(
		alertID, cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Observe(time.Since(ackStart(alertID)).Seconds())
	_, _ = s.Reporter.Report(audit.Event{
		Timestamp: time.Now(), Operator: cl.User, Tenant: cl.Tenant, Env: cl.Env,
		Cluster: cl.Cluster, DeviceID: cl.DeviceID, Action: "ack", Endpoint: "/alerts/ack",
	})
	c.JSON(http.StatusOK, gin.H{"alert": alertID, "acked_by": cl.User})
}

func (s *Server) escalateAlert(c *gin.Context) {
	cl := middleware.GetClaims(c)
	_, _ = s.Reporter.Report(audit.Event{
		Timestamp: time.Now(), Operator: cl.User, Tenant: cl.Tenant, Env: cl.Env,
		Cluster: cl.Cluster, DeviceID: cl.DeviceID, Action: "ack", Endpoint: "/alerts/escalate",
		Decision: "escalate",
	})
	c.JSON(http.StatusOK, gin.H{"alert": c.Param("id"), "escalated_by": cl.User})
}

// sensitiveOp 敏感操作：二次认证 -> 短时凭证引用（最终执行回桌面端）。
func (s *Server) sensitiveOp(c *gin.Context) {
	cl := middleware.GetClaims(c)
	var body struct {
		Action   string `json:"action"`
		TicketID string `json:"ticketId"`
		TOTP     string `json:"totp"`
	}
	if err := c.ShouldBindJSON(&body); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	// ★敏感操作二次认证
	if err := s.TOTP.Verify(os_GetTOTPSecret(cl.User), body.TOTP); err != nil {
		metrics.MobileAPIErrorTotal.WithLabelValues(
			"/ops/sensitive", "401", cl.Tenant, "mobile-console", cl.Env, cl.Cluster).Inc()
		c.JSON(http.StatusUnauthorized, gin.H{"error": "2fa failed"})
		return
	}
	// 向网关申请短时凭证（强制挂审批工单）
	tr, err := gateway.RequestShortToken(c.Request.Context(), gateway.MobileScope{
		Tenant: cl.Tenant, Cluster: cl.Cluster, Namespace: "tenant-a-prod",
		Action: body.Action, TicketID: body.TicketID,
	})
	if err != nil {
		c.JSON(http.StatusForbidden, gin.H{"error": "gateway denied: " + err.Error()})
		return
	}
	_, _ = s.Reporter.Report(audit.Event{
		Timestamp: time.Now(), Operator: cl.User, Tenant: cl.Tenant, Env: cl.Env,
		Cluster: cl.Cluster, DeviceID: cl.DeviceID, Action: "sensitive_2fa",
		Endpoint: "/ops/sensitive", Detail: "short token " + tr.Ref,
	})
	// 注意：移动端只拿到短时凭证引用，最终执行由桌面端完成
	c.JSON(http.StatusAccepted, gin.H{
		"status":   "preflight_ok",
		"exec_ref": tr.Ref,
		"redirect": "https://console.paas.internal/exec?ref=" + tr.Ref,
		"message":  "移动端已二次认证并签发短时凭证，请回桌面端完成最终执行",
	})
}

// ackStart / os_GetTOTPSecret 为演示辅助（生产从 KMS 取 secret、从告警推送时间算时延）
func ackStart(alertID string) time.Time { return time.Now().Add(-30 * time.Second) }
func os_GetTOTPSecret(user string) string { return "JBSWY3DPEHPK3PXP" } // 演示种子，生产存 KMS

// file: cmd/mobile/main.go
package main

import (
	"fmt"
	"net/http"
	"os"

	"github.com/prometheus/client_golang/prometheus/promhttp"
	"k8s.io/client-go/rest"

	"module-12-mobile-console/internal/api"
	"module-12-mobile-console/internal/audit"
	"module-12-mobile-console/internal/auth"
	"module-12-mobile-console/internal/k8s"
	_ "module-12-mobile-console/internal/metrics" // 注册指标
)

func main() {
	gwURL := os.Getenv("K8S_GATEWAY_URL")
	if gwURL == "" {
		gwURL = "https://k8s-gateway.paas.internal"
	}
	// 1) 经网关的只读 client-go（移动端不持 kubeconfig）
	cfg := &rest.Config{
		Host:        gwURL,
		BearerToken: os.Getenv("MOBILE_TOKEN"),
		TLSClientConfig: rest.TLSClientConfig{CAData: []byte(os.Getenv("GATEWAY_CA"))},
	}
	cs, err := k8s.NewClientSet(cfg)
	if err != nil {
		panic(err)
	}
	// 2) 设备绑定（读 ConfigMap）
	binder := &auth.DeviceBinder{Client: cs, Namespace: "paas-mobile", CMName: "device-bindings"}
	// 3) 审计上报
	reporter, err := audit.NewReporter("/var/lib/mobile/audit.log")
	if err != nil {
		panic(err)
	}
	defer reporter.Close()
	// 4) TOTP
	totp := &auth.TOTPVerifier{Issuer: os.Getenv("TOTP_ISSUER")}
	// 5) HTTP 服务
	srv := &api.Server{
		RO:       &k8s.ReadOnlyClient{Client: cs},
		Binder:   binder,
		TOTP:     totp,
		Reporter: reporter,
		JWT:      os.Getenv("JWT_SECRET"),
	}
	go func() {
		http.Handle("/metrics", promhttp.Handler())
		if err := http.ListenAndServe(":2112", nil); err != nil {
			fmt.Println("metrics:", err)
		}
	}()
	r := srv.NewRouter()
	if err := r.RunTLS(":8443", "/etc/mobile-tls/tls.crt", "/etc/mobile-tls/tls.key"); err != nil {
		fmt.Println("server:", err)
	}
}

# file: config/servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: mobile-console
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
spec:
  selector:
    matchLabels:
      app: mobile-console
  endpoints:
    - port: metrics
      interval: 15s
      relabelings:
        - sourceLabels: [__meta_kubernetes_pod_label_tenant]
          targetLabel: tenant
        - sourceLabels: [__meta_kubernetes_pod_label_app]
          targetLabel: app
        - sourceLabels: [__meta_kubernetes_pod_label_env]
          targetLabel: env
        - sourceLabels: [__meta_kubernetes_pod_label_cluster]
          targetLabel: cluster

# file: deploy/prometheus-rules.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: mobile-console-rules
  namespace: paas-mobile
  labels:
    tenant: platform
    app: mobile-console
    env: prod
    cluster: paas-control
spec:
  groups:
    - name: mobile.sla
      rules:
        # 移动 API 错误率突增（按 endpoint/code 维度）
        - alert: MobileAPIErrorRateHigh
          expr: |
            sum by (tenant, env, cluster) (
              rate(mobile_api_error_total[5m])
            ) / sum by (tenant, env, cluster) (
              (rate(mobile_dashboard_query_total[5m]) + rate(mobile_approval_action_total[5m]) + 1)
            ) > 0.05            
          for: 10m
          labels:
            severity: warning
            tenant: "{{ $labels.tenant }}"
            env: "{{ $labels.env }}"
            cluster: "{{ $labels.cluster }}"
          annotations:
            summary: "租户 {{ $labels.tenant }} 移动 API 错误率 > 5%"
        # 告警认领时延过高
        - alert: MobileAlertAckSlow
          expr: |
            histogram_quantile(0.95, sum by (le, tenant, env, cluster) (
              rate(mobile_alert_ack_seconds_bucket[1h])
            )) > 300            
          for: 10m
          labels:
            severity: warning
            tenant: "{{ $labels.tenant }}"
            env: "{{ $labels.env }}"
            cluster: "{{ $labels.cluster }}"
          annotations:
            summary: "租户 {{ $labels.tenant }} 移动告警认领 p95 > 300s"
        # 设备绑定被拒频发（疑似异常设备尝试）
        - alert: MobileDeviceBindRejected
          expr: |
            increase(mobile_device_bind_total{result="rejected"}[1h]) > 10            
          for: 5m
          labels:
            severity: critical
            tenant: "{{ $labels.tenant }}"
            env: "{{ $labels.env }}"
            cluster: "{{ $labels.cluster }}"
          annotations:
            summary: "租户 {{ $labels.tenant }} 1h 内设备绑定拒绝 > 10 次"

# 移动端告警认领（等效 curl，演示链路）
curl -sk https://mobile.paas.internal/api/v1/alerts/alert-9f3c/ack \
  -H "Authorization: Bearer $MOBILE_TOKEN" \
  -X POST
# 期望 200，且审计出现一条 device_id=fp:9f3c:... 的 ack 记录

# 普通变更移动端预批
curl -sk https://mobile.paas.internal/api/v1/approval/ap-2026-0001/preapprove \
  -H "Authorization: Bearer $MOBILE_TOKEN" -X POST \
  -d '{"decision":"approve","riskHigh":false}'

# 高危变更：返回 redirect 到桌面端二次认证
curl -sk https://mobile.paas.internal/api/v1/approval/ap-2026-0002/preapprove \
  -H "Authorization: Bearer $MOBILE_TOKEN" -X POST \
  -d '{"decision":"approve","riskHigh":true}'
# 期望 202 + redirect=https://console.paas.internal/approval/ap-2026-0002?step=2fa