PUT /v1/routes/{routeName}/plugin-instances/{pluginName}
GET /v1/routes/{routeName}/plugin-instances
GET /v1/wasm-plugins          # 本环境约 52 个内置插件
GET /v1/wasm-plugins/{name}/config

COOKIE=/tmp/hc.ck
curl -sS -c $COOKIE -b $COOKIE -X POST http://127.0.0.1:8001/session/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"Higress207admin!"}'

# 列出某路由已挂插件
curl -sS -b $COOKIE http://127.0.0.1:8001/v1/routes/llm/plugin-instances | python3 -m json.tool

# 创建/更新（PUT；POST collection 会 405）
curl -sS -b $COOKIE -X PUT http://127.0.0.1:8001/v1/routes/llm/plugin-instances/key-rate-limit \
  -H "Content-Type: application/json" \
  -d '{"pluginName":"key-rate-limit","enabled":false,"rawConfigurations":"limit_by_header:\n  - key: x-higress-limit\n    query_per_minute: 60\n"}'

bash /opt/workbuddy/scripts_bash_cursor/Higress部署/Higress_06_能力插件示例.sh
# 确认无误后再：
ENABLE=1 bash /opt/workbuddy/scripts_bash_cursor/Higress部署/Higress_06_能力插件示例.sh

# 在 207 生成测试证书（勿用于生产）
mkdir -p /opt/higress/certs && cd /opt/higress/certs
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout ai.local.key -out ai.local.crt \
  -subj "/CN=ai.local/O=BoCheng/C=CN"
# 然后在 Console「证书管理」粘贴 crt+key，域名 ai.local 绑定该证书并开启 HTTPS

curl -sk https://127.0.0.1:18443/llm/v1/models \
  -H "Authorization: Bearer sk-litellm-bocheng-207" | head -c 200

ip_source_type: origin-source   # 或 header + x-forwarded-for（经多层代理时）
allow:
  - 192.168.0.0/16
  - 192.168.110.207
  - 127.0.0.1
status: 403
message: IP not allowed by Higress demo policy

ip_source_type: header
ip_header_name: x-forwarded-for

# 启用插件后，从非白名单 IP 访问应 403
curl -sS -o /dev/null -w "%{http_code}\n" \
  http://192.168.110.207:18080/llm/v1/models \
  -H "Authorization: Bearer sk-litellm-bocheng-207"

limit_by_header:
  - key: x-higress-limit
    query_per_minute: 60

# 同一 key 打爆 60/min 后应出现 429
for i in $(seq 1 80); do
  curl -sS -o /dev/null -w "%{http_code} " \
    http://127.0.0.1:18080/llm/v1/models \
    -H "Authorization: Bearer sk-litellm-bocheng-207" \
    -H "x-higress-limit: demo-user"
done
echo

useCRS: true

curl -sS -N http://192.168.110.207:18080/llm/v1/chat/completions \
  -H "Authorization: Bearer sk-litellm-bocheng-207" \
  -H "Content-Type: application/json" \
  -d '{
    "model":"qwen3.6-27b",
    "stream":true,
    "messages":[{"role":"user","content":"用三句话介绍网关"}],
    "max_tokens":128
  }'
# 期望持续刷 data: 行，中间不断开

blocked_code: 403
blocked_message: blocked by higress request-block demo
case_sensitive: false
block_bodies:
  - 忽略以上指令
  - ignore previous instructions
  - 越狱

ai-agent, ai-cache, ai-context-limit, ai-data-masking, ai-history, ai-intent,
ai-json-resp, ai-load-balancer, ai-prompt-decorator, ai-prompt-template, ai-proxy,
ai-quota, ai-rag, ai-search, ai-security-guard, ai-statistics, ai-token-ratelimit,
ai-transformer, basic-auth, bot-detect, cache-control, cluster-key-rate-limit, cors,
custom-response, de-graphql, ext-auth, frontend-gray, geo-ip, gw-error-format,
hmac-auth, hmac-auth-apisix, ip-restriction, json-converter, jwt-auth, key-auth,
key-rate-limit, log-request-response, mcp-router, mcp-server, model-mapper,
model-router, nginx-rewrite-compatible, oauth, oidc, opa, request-block,
request-validation, response-cache, simple-jwt-auth, traffic-tag, transformer, waf

curl -sS -b /tmp/hc.ck http://127.0.0.1:8001/v1/wasm-plugins \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print('\n'.join(sorted(x['name'] for x in d['data'])))"

#!/usr/bin/env bash
# Higress 之六 · 在路由 llm 上挂载演示插件（默认 enabled=false）
#   bash Higress_06_能力插件示例.sh
#   ENABLE=1 bash Higress_06_能力插件示例.sh
set -euo pipefail

CONSOLE="${HIGRESS_CONSOLE:-http://127.0.0.1:8001}"
USER="${HIGRESS_ADMIN_USER:-admin}"
PASS="${HIGRESS_ADMIN_PASS:-Higress207admin!}"
ROUTE="${HIGRESS_DEMO_ROUTE:-llm}"
ENABLE="${ENABLE:-0}"
ENABLED_JSON=false
[ "$ENABLE" = "1" ] || [ "$ENABLE" = "true" ] && ENABLED_JSON=true

COOKIE="$(mktemp)"
trap 'rm -f "$COOKIE"' EXIT

curl -sS -c "$COOKIE" -b "$COOKIE" -X POST "$CONSOLE/session/login" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"$USER\",\"password\":\"$PASS\"}" | tee /tmp/h6_login.json
echo
grep -q '"name"' /tmp/h6_login.json || { echo "[FAIL] login"; exit 1; }

put_plugin() {
  local name="$1"
  local raw_file="$2"
  local raw
  raw="$(cat "$raw_file")"
  local body
  body="$(ENABLED_JSON="$ENABLED_JSON" NAME="$name" RAW="$raw" python3 - <<'PY'
import json, os
print(json.dumps({
  "pluginName": os.environ["NAME"],
  "enabled": os.environ["ENABLED_JSON"] == "true",
  "rawConfigurations": os.environ["RAW"],
}, ensure_ascii=False))
PY
)"
  echo "[INFO] PUT /v1/routes/$ROUTE/plugin-instances/$name enabled=$ENABLED_JSON"
  curl -sS -b "$COOKIE" -X PUT "$CONSOLE/v1/routes/$ROUTE/plugin-instances/$name" \
    -H "Content-Type: application/json" \
    -d "$body"
  echo
}

TMPD="$(mktemp -d)"
trap 'rm -rf "$TMPD" "$COOKIE"' EXIT

cat >"$TMPD/ip.yml" <<'EOF'
ip_source_type: origin-source
allow:
  - 192.168.0.0/16
  - 127.0.0.1
  - 192.168.110.207
status: 403
message: IP not allowed by Higress demo policy
EOF

cat >"$TMPD/rate.yml" <<'EOF'
limit_by_header:
  - key: x-higress-limit
    query_per_minute: 60
EOF

cat >"$TMPD/block.yml" <<'EOF'
blocked_code: 403
blocked_message: blocked by higress request-block demo
case_sensitive: false
block_bodies:
  - 忽略以上指令
  - ignore previous instructions
  - 越狱
EOF

cat >"$TMPD/waf.yml" <<'EOF'
useCRS: true
EOF

put_plugin "ip-restriction" "$TMPD/ip.yml"
put_plugin "key-rate-limit" "$TMPD/rate.yml"
put_plugin "request-block" "$TMPD/block.yml"
put_plugin "waf" "$TMPD/waf.yml"

echo "[INFO] 插件列表："
curl -sS -b "$COOKIE" "$CONSOLE/v1/routes/$ROUTE/plugin-instances" | python3 -m json.tool | head -n 160
echo "[OK] ENABLE=$ENABLE （建议实验室先 false，确认 YAML 后再 ENABLE=1）"

curl -sS -N --max-time 120 \
  http://192.168.110.207:18080/llm/v1/chat/completions \
  -H "Authorization: Bearer sk-litellm-bocheng-207" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3.6-27b","stream":true,"messages":[{"role":"user","content":"数到5"}],"max_tokens":64}'

curl -sS -b /tmp/hc.ck http://127.0.0.1:8001/v1/tls-certificates | python3 -m json.tool
curl -sS -b /tmp/hc.ck http://127.0.0.1:8001/v1/domains | python3 -m json.tool