| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
all: reformat with goimports as it now force pkg aliases | 7 年前 | |
Move permission.Permission to types model | 1 年前 | |
Move permission.Permission to types model | 1 年前 | |
Move permission.Permission to types model | 1 年前 | |
auth/oidc: auto-create personal team on user registration (#2895) When auth:oidc:auto-create-personal-team is enabled, a freshly auto-registered user gets a team of their own named after their email local part — normalized to the team name rules by NormalizeTeamName, exported in the auth package next to teamNameRegexp so the rule and its normalizer evolve together, falling back to the full email slug when the name is taken. Combined with a team-create default role, this lets a brand-new user create and deploy apps on their first login without any manual role setup by an admin — useful for self-service/sandbox platforms, since default roles at user-create can only carry global-context roles and therefore cannot grant a team. Best effort: team creation failures are logged and never block login. | 21 天前 | |
Move permission.Permission to types model | 1 年前 | |
Move permission.Permission to types model | 1 年前 | |
Migrate MGO to Official Mongo Driver - part 4 (#2712) * Jobs uses new mongo driver * auth/native: token uses new mongo driver * Write roles using new mongo driver * Password tokens using new mongo driver * read and write users using new mongo driver * write team tokens using new mongo driver * fix lint * write teams using new mongodb driver * write plans using new mongodb driver * write cache using new mongo driver * Write webhooks using new mongo driver * Read and write oauth tokens using new mongo driver * Initialize req.Header when is nil * Initialize req.Header when is nil * fix events test * goroutines must avoid context cancelation | 2 年前 | |
Migrate MGO to Official Mongo Driver - part 3 (#2709) * Remove unused param: Writer * Read cluster using new mongo driver * Read router using new mongo driver * Read/Write platform images using new mongo driver * Platform read/write with new mongo driver * Pools using new mongo driver * Fix pool test * Pool constraints using new mongo driver * event: drop helper functions from old mongodriver * Read service using new mongo driver * Read service instances using new mongo driver * Read roles using new mongo driver * use a more conservative strategy without data migration | 2 年前 | |
Migrate App to types part 3 (#2701) | 1 年前 | |
Drop TSURU_APP_TOKEN (#2684) | 2 年前 | |
Expose OIDC settings to clients be able to auth with IDP (#2675) * Expose OIDC settings to clients be able to auth with IDP * Add test to ensure that oidcScheme does not implement auth.UserScheme * wip * Drop unused code * Drop responsability of cmd package to deal with http requests * Add support to define the default authscheme on server * move schemeInfo to types package * Drop unused properties on cmd.Manager * Set default scheme on /schemes * cmd: expose verbosity on context * use environment variable to define verbosity * Move StreamJSONResponse to tsuru-client * Remove MergeFlagSet | 2 年前 | |
Migrate MGO to Official Mongo Driver - part 5 (#2718) * Write services using new mongo driver * Write service instances using new mongo driver * fix lint * Write volumes using new mongo driver * Write tracked instances using new mongo driver * Write dynamic routers using new mongo driver * drop dbtest package * Write service broker using new mongo driver * Drop scopedconfig package * Write quota using new mongo driver * Write clusters using new mongo driver * Write app groups using new mongo driver * Drop unused parts of old mongo driver * Enable metrics to new mongo driver * Read apps using new mongo driver * Healthcheck using new mongo driver * Create app_versions indexes using new mongo driver * Drop some unused references to old driver * fix lint | 1 年前 | |
auth/oidc: auto-create personal team on user registration (#2895) When auth:oidc:auto-create-personal-team is enabled, a freshly auto-registered user gets a team of their own named after their email local part — normalized to the team name rules by NormalizeTeamName, exported in the auth package next to teamNameRegexp so the rule and its normalizer evolve together, falling back to the full email slug when the name is taken. Combined with a team-create default role, this lets a brand-new user create and deploy apps on their first login without any manual role setup by an admin — useful for self-service/sandbox platforms, since default roles at user-create can only carry global-context roles and therefore cannot grant a team. Best effort: team creation failures are logged and never block login. | 21 天前 | |
auth/oidc: auto-create personal team on user registration (#2895) When auth:oidc:auto-create-personal-team is enabled, a freshly auto-registered user gets a team of their own named after their email local part — normalized to the team name rules by NormalizeTeamName, exported in the auth package next to teamNameRegexp so the rule and its normalizer evolve together, falling back to the full email slug when the name is taken. Combined with a team-create default role, this lets a brand-new user create and deploy apps on their first login without any manual role setup by an admin — useful for self-service/sandbox platforms, since default roles at user-create can only carry global-context roles and therefore cannot grant a team. Best effort: team creation failures are logged and never block login. | 21 天前 | |
Propagate email of tsuru team token to Services (#2833) * Writing draft * add tests | 6 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 7 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 21 天前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 21 天前 | ||
| 21 天前 | ||
| 6 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 |