修复安全和请求策略问题

server/index.js

@@ -29,6 +29,7 @@ const PASSWORD_ITERATIONS = parseInt(process.env.PASSWORD_ITERATIONS, 10) || 210
 const ALLOW_REMOTE_SETUP = process.env.ALLOW_REMOTE_SETUP === 'true';
 const COOKIE_SECURE = process.env.COOKIE_SECURE === 'true';
 const APP_SECRET = process.env.APP_SECRET || crypto.randomBytes(32).toString('hex');
+process.env.APP_SECRET = APP_SECRET;
 const RATE_LIMITS = {
   login: { windowMs: 15 * 60 * 1000, max: 8 },
   setup: { windowMs: 10 * 60 * 1000, max: 20 }
@@ -1063,34 +1064,61 @@ async function getOverview(force = false) {
 
   const validMetrics = allMetrics.filter(m => m !== null);
 
-  // Aggregate across all sources
-  let totalServers = 0;
+  // Use Maps to deduplicate servers across multiple Prometheus sources
+  const uniqueOverviewServers = new Map();
+  const uniqueDetailServers = new Map();
+
+  for (const m of validMetrics) {
+    if (m.isOverview) {
+      for (const s of m.servers) {
+        // originalInstance is the true IP/host before token masking
+        const key = `${s.originalInstance}::${s.job}`;
+        if (!uniqueOverviewServers.has(key)) {
+          uniqueOverviewServers.set(key, s);
+        } else if (s.up && !uniqueOverviewServers.get(key).up) {
+          // Prefer 'up' status if duplicate
+          uniqueOverviewServers.set(key, s);
+        }
+      }
+    }
+
+    if (m.isDetail) {
+      for (const s of m.servers) {
+        const key = `${s.originalInstance}::${s.job}`;
+        if (!uniqueDetailServers.has(key)) {
+          uniqueDetailServers.set(key, s);
+        } else if (s.up && !uniqueDetailServers.get(key).up) {
+          uniqueDetailServers.set(key, s);
+        }
+      }
+    }
+  }
+
+  const allOverviewServers = Array.from(uniqueOverviewServers.values());
+  const allDetailServers = Array.from(uniqueDetailServers.values());
+
+  // Aggregate across unique deduplicated servers
+  let totalServers = allOverviewServers.length;
   let activeServers = 0;
   let cpuUsed = 0, cpuTotal = 0;
   let memUsed = 0, memTotal = 0;
   let diskUsed = 0, diskTotal = 0;
   let netRx = 0, netTx = 0;
   let traffic24hRx = 0, traffic24hTx = 0;
-  let allServers = [];
 
-  for (const m of validMetrics) {
-    if (m.isOverview) {
-      totalServers += m.totalServers;
-      activeServers += (m.activeServers !== undefined ? m.activeServers : m.totalServers);
-      cpuUsed += m.cpu.used;
-      cpuTotal += m.cpu.total;
-      memUsed += m.memory.used;
-      memTotal += m.memory.total;
-      diskUsed += m.disk.used;
-      diskTotal += m.disk.total;
-      netRx += m.network.rx;
-      netTx += m.network.tx;
-      traffic24hRx += m.traffic24h.rx;
-      traffic24hTx += m.traffic24h.tx;
-    }
-
-    if (m.isDetail) {
-      allServers = allServers.concat(m.servers);
+  for (const inst of allOverviewServers) {
+    if (inst.up) {
+      activeServers++;
+      cpuUsed += (inst.cpuPercent / 100) * inst.cpuCores;
+      cpuTotal += inst.cpuCores;
+      memUsed += inst.memUsed;
+      memTotal += inst.memTotal;
+      diskUsed += inst.diskUsed;
+      diskTotal += inst.diskTotal;
+      netRx += inst.netRx || 0;
+      netTx += inst.netTx || 0;
+      traffic24hRx += inst.traffic24hRx || 0;
+      traffic24hTx += inst.traffic24hTx || 0;
     }
   }
 
@@ -1122,12 +1150,12 @@ async function getOverview(force = false) {
       tx: traffic24hTx,
       total: traffic24hRx + traffic24hTx
     },
-    servers: allServers
+    servers: allDetailServers
   };
 
   // --- Add Geo Information to Servers ---
   const geoServers = await Promise.all(overview.servers.map(async (server) => {
-    const realInstance = server.originalInstance || prometheusService.resolveToken(server.instance);
+    const realInstance = server.originalInstance || await prometheusService.resolveToken(server.instance);
     // Helper to get host from instance (handles IPv6 with brackets, IPv4:port, etc.)
     let cleanIp = realInstance;
     if (cleanIp.startsWith('[')) {