chore(prometheus): add username to prometheus url

Author: duanhongyi

rootfs/api/urls.py

@@ -249,7 +249,8 @@
         r'^nodes/(?P<node>[a-zA-Z0-9-]+)/proxy/metrics(?:/(?P<metrics>[^/]+))?/?$',
         views.ProxyMetricsView.as_view()),
     # prometheus
-    re_path(r'^prometheus/(?P<path>.+)/?$', views.PrometheusProxy.as_view()),
+    re_path(
+        r'^prometheus/(?P<username>[\w.@+-]+)/(?P<path>.+)/?$', views.PrometheusProxy.as_view()),
     # tokens
     re_path(r'^tokens/?$', views.TokenViewSet.as_view({'get': 'list'})),
     re_path(r"^tokens/(?P<pk>[-_\w]+)/?$", views.TokenViewSet.as_view({'delete': 'destroy'})),

rootfs/api/views.py

@@ -1336,9 +1336,9 @@ class PrometheusProxy(View):
     timeout = aiohttp.ClientTimeout(total=30, connect=10, sock_read=15)
     authentication = authentication.DryccAuthentication()
 
-    async def proxy(self, request, path):
+    async def proxy(self, request, username, path):
         auth = await database_sync_to_async(self.authentication.authenticate)(request)
-        if not auth or len(auth) != 2 or not isinstance(auth[0], User):
+        if not auth or len(auth) != 2 or not auth[0].username != username:
             return JsonResponse({'error': 'access denied'}, status=403)
         if auth[0].is_superuser or auth[0].is_staff:
             path = f"/select/0/prometheus/{path}"