fix(network): скрыть GRE PSK и сохранить признак IPsec

backend/src/routes/filters.ts

@@ -20,6 +20,7 @@ import {
 type ServerRow = typeof servers.$inferSelect
 
 interface RosGre {
+  "ipsec-secret"?: string
   ".id"?: string
   name?: string
   "local-address"?: string
@@ -51,7 +52,7 @@ interface LiveGreTunnel {
   localInnerIp: string
   remoteInnerIp: string
   poolId: string
-  ipsec: null
+  ipsec: { secret: string } | null
   mtu: number
   keepaliveInterval: number
   keepaliveRetries: number
@@ -238,7 +239,8 @@ async function fetchServerFilters(server: ServerRow) {
       localInnerIp: inner.localInnerIp,
       remoteInnerIp: inner.remoteInnerIp,
       poolId: "live",
-      ipsec: null,
+      // This routing catalog carries security state, never key material.
+      ipsec: g["ipsec-secret"]?.trim() ? { secret: "" } : null,
       mtu: Number.parseInt(g.mtu ?? "1476", 10) || 1476,
       keepaliveInterval: keepalive.interval,
       keepaliveRetries: keepalive.retries,

backend/src/routes/gre.ts

@@ -1,5 +1,6 @@
 import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
 import { z } from "zod"
+import { greReadForUser } from "../services/gre-read.js"
 import { MikrotikClient, MikrotikError } from "../services/mikrotik.js"
 import { getEnabledServerById } from "../services/wireguard-live.js"
 import {
@@ -111,7 +112,10 @@ const greRoutes: FastifyPluginAsyncZod = async (app) => {
     const sid = parseDbServerId(q.serverId)
     if (q.serverId !== undefined && sid === null) return reply.status(400).send({ error: "Некорректный serverId GRE" })
     const result = await listGreTunnels({ serverId: sid !== null ? String(sid) : undefined })
-    return reply.send(result)
+    return reply.send({
+      ...result,
+      tunnels: result.tunnels.map(tunnel => greReadForUser(tunnel, req.authUser)),
+    })
   })
 
   app.post("/gre/tunnels", async (req, reply) => {

backend/src/services/gre-read.test.ts

@@ -0,0 +1,9 @@
+import assert from 'node:assert/strict'
+import {greReadForUser} from './gre-read.js'
+import type {AuthUser} from '../lib/permissions.js'
+const tunnel={id:'own209',ipsec:{secret:'own209-PSK',encAlg:'aes-256'},enabled:true}
+for(const permission of ['mm:network:read','mm:filters:write','mm:network:write','mm:network:admin']){const user={id:'own209',email:'',name:'',apps:['mm'],permissions:[permission],isAdmin:false} satisfies AuthUser;const read=greReadForUser(tunnel,user);assert.equal(read.ipsec?.secret,permission==='mm:network:read'||permission==='mm:filters:write'?'':'own209-PSK');assert.equal(read.ipsec?.encAlg,'aes-256');assert.equal(tunnel.ipsec.secret,'own209-PSK')}
+assert.equal(greReadForUser(tunnel),tunnel)
+assert.equal(greReadForUser({ipsec:null},{id:'own209',email:'',name:'',apps:['mm'],permissions:['mm:network:read'],isAdmin:true}).ipsec,null)
+assert.equal(greReadForUser(tunnel,{id:'own209',email:'',name:'',apps:['mm'],permissions:['mm:network:read'],isAdmin:true}).ipsec.secret,'')
+console.log('GRE read projection: PSK hidden, configured state and algorithms preserved, source unchanged, writer/legacy retained')

backend/src/services/gre-read.ts

@@ -0,0 +1,7 @@
+import {hasPermission,type AuthUser} from "../lib/permissions.js"
+
+/** Project HTTP data without changing the secret-bearing native snapshot. */
+export function greReadForUser<T extends {ipsec:{secret:string}|null}>(tunnel:T,user?:AuthUser):T {
+  if (!user || hasPermission(user.permissions,"mm:network:write") || !tunnel.ipsec) return tunnel
+  return {...tunnel,ipsec:{...tunnel.ipsec,secret:""}}
+}