From 0dede50f9e26a7fba8f9f0306c2196045791e0a3 Mon Sep 17 00:00:00 2001
From: tian <11429339@qq.com>
Date: Fri, 8 May 2026 19:41:42 +0800
Subject: [PATCH] fix: proxy device metrics through backend to avoid CORS

---
 internal/web/ui.go                       | 12 ++++++++++++
 internal/web/ui/templates/dashboard.html |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/internal/web/ui.go b/internal/web/ui.go
index 841c1a0..9aa29ea 100644
--- a/internal/web/ui.go
+++ b/internal/web/ui.go
@@ -677,6 +677,7 @@ func (u *UI) Routes() (chi.Router, error) {
 	r.Get("/monitor", u.pageMonitor)
 	r.Get("/hls/*", u.proxyHLS)
 	r.Get("/api/monitor/channels", u.apiMonitorChannels)
+	r.Get("/api/device-metrics", u.apiDeviceMetrics)
 	r.Get("/recognition", u.pageRecognition)
 	r.Get("/logs", u.pageLogs)
 
@@ -4179,3 +4180,14 @@ func (u *UI) actionFaceGalleryDeletePhoto(w http.ResponseWriter, r *http.Request
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]any{"ok": true})
 }
+func (u *UI) apiDeviceMetrics(w http.ResponseWriter, r *http.Request) {
+	deviceID := r.URL.Query().Get("device_id")
+	if deviceID == "" { http.Error(w, "missing device_id", http.StatusBadRequest); return }
+	dev, ok := u.findDevice(deviceID)
+	if !ok { http.Error(w, "device not found", http.StatusNotFound); return }
+	body, code, err := u.agent.Do("GET", dev.IP, dev.AgentPort, "/v1/metrics", nil)
+	if err != nil { http.Error(w, err.Error(), http.StatusBadGateway); return }
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	w.Write(body)
+}
diff --git a/internal/web/ui/templates/dashboard.html b/internal/web/ui/templates/dashboard.html
index 3360e0b..e018b48 100644
--- a/internal/web/ui/templates/dashboard.html
+++ b/internal/web/ui/templates/dashboard.html
@@ -79,10 +79,10 @@
   var body=document.getElementById('metrics-body'),time=document.getElementById('metrics-time');
   function load(){
     time.textContent='加载中…';
-    var devs=[{{range .Devices}}{{if .Online}}{ip:"{{.IP}}",port:{{.AgentPort}},name:"{{.DisplayName}}"},{{end}}{{end}}];
+    var devs=[{{range .Devices}}{{if .Online}}{id:"{{.DeviceID}}",name:"{{.DisplayName}}"},{{end}}{{end}}];
     if(!devs.length){body.innerHTML='<span class="muted">无在线设备</span>';return}
     Promise.all(devs.map(function(d){
-      return fetch('http://'+d.ip+':'+d.port+'/v1/metrics',{headers:{'X-RK-Token':''}}).then(function(r){return r.json()}).catch(function(){return null}).then(function(m){return{name:d.name,data:m}});
+      return fetch('/ui/api/device-metrics?device_id='+d.id).then(function(r){return r.json()}).catch(function(){return null}).then(function(m){return{name:d.name,data:m}});
     })).then(function(r){
       var html='';
       r.forEach(function(item){