Initial commit (code only without large binaries)

EdgeAPI/internal/rpc/services/anti-ddos/service_ad_network.go

@@ -0,0 +1,140 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build plus
+
+package antiddos
+
+import (
+	"context"
+	"errors"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+type ADNetworkService struct {
+	services.BaseService
+}
+
+// CreateADNetwork 创建线路
+func (this *ADNetworkService) CreateADNetwork(ctx context.Context, req *pb.CreateADNetworkRequest) (*pb.CreateADNetworkResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	networkId, err := models.SharedADNetworkDAO.CreateNetwork(tx, req.Name, req.Description)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.CreateADNetworkResponse{AdNetworkId: networkId}, nil
+}
+
+// UpdateADNetwork 修改线路
+func (this *ADNetworkService) UpdateADNetwork(ctx context.Context, req *pb.UpdateADNetworkRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	if req.AdNetworkId <= 0 {
+		return nil, errors.New("invalid adNetworkId")
+	}
+	err = models.SharedADNetworkDAO.UpdateNetwork(tx, req.AdNetworkId, req.IsOn, req.Name, req.Description)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}
+
+// FindADNetwork 查找单个线路
+func (this *ADNetworkService) FindADNetwork(ctx context.Context, req *pb.FindADNetworkRequest) (*pb.FindADNetworkResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, req.AdNetworkId)
+	if err != nil {
+		return nil, err
+	}
+	if network == nil {
+		return &pb.FindADNetworkResponse{AdNetwork: nil}, nil
+	}
+
+	return &pb.FindADNetworkResponse{AdNetwork: &pb.ADNetwork{
+		Id:          int64(network.Id),
+		IsOn:        network.IsOn,
+		Name:        network.Name,
+		Description: network.Description,
+	}}, nil
+}
+
+// FindAllADNetworks 列出所有线路
+func (this *ADNetworkService) FindAllADNetworks(ctx context.Context, req *pb.FindAllADNetworkRequest) (*pb.FindAllADNetworkResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	networks, err := models.SharedADNetworkDAO.FindAllNetworks(tx)
+	if err != nil {
+		return nil, err
+	}
+	var pbNetworks = []*pb.ADNetwork{}
+	for _, network := range networks {
+		pbNetworks = append(pbNetworks, &pb.ADNetwork{
+			Id:          int64(network.Id),
+			IsOn:        network.IsOn,
+			Name:        network.Name,
+			Description: network.Description,
+		})
+	}
+	return &pb.FindAllADNetworkResponse{
+		AdNetworks: pbNetworks,
+	}, nil
+}
+
+// FindAllAvailableADNetworks 列出所有可用的线路
+func (this *ADNetworkService) FindAllAvailableADNetworks(ctx context.Context, req *pb.FindAllAvailableADNetworksRequest) (*pb.FindAllAvailableADNetworksResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	networks, err := models.SharedADNetworkDAO.FindAllAvailableNetworks(tx)
+	if err != nil {
+		return nil, err
+	}
+	var pbNetworks = []*pb.ADNetwork{}
+	for _, network := range networks {
+		pbNetworks = append(pbNetworks, &pb.ADNetwork{
+			Id:          int64(network.Id),
+			IsOn:        network.IsOn,
+			Name:        network.Name,
+			Description: network.Description,
+		})
+	}
+	return &pb.FindAllAvailableADNetworksResponse{
+		AdNetworks: pbNetworks,
+	}, nil
+}
+
+// DeleteADNetwork 删除线路
+func (this *ADNetworkService) DeleteADNetwork(ctx context.Context, req *pb.DeleteADNetworkRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedADNetworkDAO.DisableADNetwork(tx, req.AdNetworkId)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}

EdgeAPI/internal/rpc/services/anti-ddos/service_ad_package.go

@@ -0,0 +1,273 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build plus
+
+package antiddos
+
+import (
+	"context"
+	"errors"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/types"
+)
+
+// ADPackageService 高防产品服务
+type ADPackageService struct {
+	services.BaseService
+}
+
+// CreateADPackage 创建高防产品
+func (this *ADPackageService) CreateADPackage(ctx context.Context, req *pb.CreateADPackageRequest) (*pb.CreateADPackageResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// 检查线路
+	if req.AdNetworkId <= 0 {
+		return nil, errors.New("invalid adNetworkId")
+	}
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, req.AdNetworkId)
+	if err != nil {
+		return nil, err
+	}
+	if network == nil {
+		return nil, errors.New("invalid network")
+	}
+
+	packageId, err := models.SharedADPackageDAO.CreatePackage(tx, req.AdNetworkId, req.ProtectionBandwidthSize, req.ProtectionBandwidthUnit, req.ServerBandwidthSize, req.ServerBandwidthUnit)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.CreateADPackageResponse{AdPackageId: packageId}, nil
+}
+
+// UpdateADPackage 修改高防产品
+func (this *ADPackageService) UpdateADPackage(ctx context.Context, req *pb.UpdateADPackageRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// 检查线路
+	if req.AdNetworkId <= 0 {
+		return nil, errors.New("invalid adNetworkId")
+	}
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, req.AdNetworkId)
+	if err != nil {
+		return nil, err
+	}
+	if network == nil {
+		return nil, errors.New("invalid network")
+	}
+
+	err = models.SharedADPackageDAO.UpdatePackage(tx, req.AdPackageId, req.IsOn, req.AdNetworkId, req.ProtectionBandwidthSize, req.ProtectionBandwidthUnit, req.ServerBandwidthSize, req.ServerBandwidthUnit)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}
+
+// FindADPackage 查找单个高防产品
+func (this *ADPackageService) FindADPackage(ctx context.Context, req *pb.FindADPackageRequest) (*pb.FindADPackageResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+	if adPackage == nil {
+		return &pb.FindADPackageResponse{AdPackage: nil}, nil
+	}
+
+	// 线路
+	var pbNetwork *pb.ADNetwork
+	var network *models.ADNetwork
+	if adPackage.NetworkId > 0 {
+		network, err = models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+		if err != nil {
+			return nil, err
+		}
+		if network != nil {
+			pbNetwork = &pb.ADNetwork{
+				Id:          int64(network.Id),
+				IsOn:        network.IsOn,
+				Name:        network.Name,
+				Description: network.Description,
+			}
+		}
+	}
+
+	return &pb.FindADPackageResponse{AdPackage: &pb.ADPackage{
+		Id:                      int64(adPackage.Id),
+		IsOn:                    adPackage.IsOn,
+		AdNetworkId:             int64(adPackage.NetworkId),
+		ProtectionBandwidthSize: types.Int32(adPackage.ProtectionBandwidthSize),
+		ProtectionBandwidthUnit: adPackage.ProtectionBandwidthUnit,
+		ServerBandwidthSize:     types.Int32(adPackage.ServerBandwidthSize),
+		ServerBandwidthUnit:     adPackage.ServerBandwidthUnit,
+		Summary:                 adPackage.Summary(network),
+		AdNetwork:               pbNetwork,
+	}}, nil
+}
+
+// CountADPackages 查询高防产品数量
+func (this *ADPackageService) CountADPackages(ctx context.Context, req *pb.CountADPackagesRequest) (*pb.RPCCountResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedADPackageDAO.CountAllPackages(tx, req.AdNetworkId)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.SuccessCount(count)
+}
+
+// CountAllIdleADPackages 查询可用的产品数量
+func (this *ADPackageService) CountAllIdleADPackages(ctx context.Context, req *pb.CountAllIdleADPackages) (*pb.RPCCountResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedADPackageDAO.CountAllIdlePackages(tx)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.SuccessCount(count)
+}
+
+// ListADPackages 列出单页高防产品
+func (this *ADPackageService) ListADPackages(ctx context.Context, req *pb.ListADPackagesRequest) (*pb.ListADPackagesResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	packages, err := models.SharedADPackageDAO.ListPackages(tx, req.AdNetworkId, req.Offset, req.Size)
+	if err != nil {
+		return nil, err
+	}
+	var pbPackages = []*pb.ADPackage{}
+
+	for _, p := range packages {
+		// 线路
+		var pbNetwork *pb.ADNetwork
+		var network *models.ADNetwork
+		if p.NetworkId > 0 {
+			network, err = models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(p.NetworkId))
+			if err != nil {
+				return nil, err
+			}
+			if network != nil {
+				pbNetwork = &pb.ADNetwork{
+					Id:          int64(network.Id),
+					IsOn:        network.IsOn,
+					Name:        network.Name,
+					Description: network.Description,
+				}
+			}
+		}
+
+		pbPackages = append(pbPackages, &pb.ADPackage{
+			Id:                      int64(p.Id),
+			IsOn:                    p.IsOn,
+			AdNetworkId:             int64(p.NetworkId),
+			ProtectionBandwidthSize: int32(p.ProtectionBandwidthSize),
+			ProtectionBandwidthUnit: p.ProtectionBandwidthUnit,
+			ServerBandwidthSize:     int32(p.ServerBandwidthSize),
+			ServerBandwidthUnit:     p.ServerBandwidthUnit,
+			Summary:                 p.Summary(network),
+			AdNetwork:               pbNetwork,
+		})
+	}
+
+	return &pb.ListADPackagesResponse{AdPackages: pbPackages}, nil
+}
+
+// FindAllIdleADPackages 列出所有可用的高防产品
+func (this *ADPackageService) FindAllIdleADPackages(ctx context.Context, req *pb.FindAllIdleADPackagesRequest) (*pb.FindAllIdleADPackagesResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	packages, err := models.SharedADPackageDAO.FindAllIdlePackages(tx)
+	if err != nil {
+		return nil, err
+	}
+	var pbPackages = []*pb.ADPackage{}
+	for _, p := range packages {
+		// 线路
+		var pbNetwork *pb.ADNetwork
+		var network *models.ADNetwork
+		if p.NetworkId > 0 {
+			network, err = models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(p.NetworkId))
+			if err != nil {
+				return nil, err
+			}
+			if network != nil {
+				pbNetwork = &pb.ADNetwork{
+					Id:          int64(network.Id),
+					IsOn:        network.IsOn,
+					Name:        network.Name,
+					Description: network.Description,
+				}
+			}
+		}
+
+		// 可用实例
+		countIdleInstances, err := models.SharedADPackageInstanceDAO.CountIdleInstances(tx, int64(p.Id))
+		if err != nil {
+			return nil, err
+		}
+
+		pbPackages = append(pbPackages, &pb.ADPackage{
+			Id:                          int64(p.Id),
+			IsOn:                        p.IsOn,
+			AdNetworkId:                 int64(p.NetworkId),
+			ProtectionBandwidthSize:     int32(p.ProtectionBandwidthSize),
+			ProtectionBandwidthUnit:     p.ProtectionBandwidthUnit,
+			ServerBandwidthSize:         int32(p.ServerBandwidthSize),
+			ServerBandwidthUnit:         p.ServerBandwidthUnit,
+			Summary:                     p.Summary(network),
+			AdNetwork:                   pbNetwork,
+			CountIdleADPackageInstances: countIdleInstances,
+		})
+	}
+
+	return &pb.FindAllIdleADPackagesResponse{AdPackages: pbPackages}, nil
+}
+
+// DeleteADPackage 删除高防产品
+func (this *ADPackageService) DeleteADPackage(ctx context.Context, req *pb.DeleteADPackageRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedADPackageDAO.DisableADPackage(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}

EdgeAPI/internal/rpc/services/anti-ddos/service_ad_package_instance.go

@@ -0,0 +1,378 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package antiddos
+
+import (
+	"context"
+	"errors"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/types"
+)
+
+// ADPackageInstanceService 高防实例服务
+type ADPackageInstanceService struct {
+	services.BaseService
+}
+
+// CreateADPackageInstance 创建实例
+func (this *ADPackageInstanceService) CreateADPackageInstance(ctx context.Context, req *pb.CreateADPackageInstanceRequest) (*pb.CreateADPackageInstanceResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// validate
+	if req.AdPackageId <= 0 {
+		return nil, errors.New("invalid 'adPackageId'")
+	}
+	if req.NodeClusterId <= 0 {
+		return nil, errors.New("invalid 'nodeClusterId'")
+	}
+
+	instanceId, err := models.SharedADPackageInstanceDAO.CreateInstance(tx, req.AdPackageId, req.NodeClusterId, req.NodeIds, req.IpAddresses)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.CreateADPackageInstanceResponse{AdPackageInstanceId: instanceId}, nil
+}
+
+// UpdateADPackageInstance 修改实例
+func (this *ADPackageInstanceService) UpdateADPackageInstance(ctx context.Context, req *pb.UpdateADPackageInstanceRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// validate
+	if req.AdPackageInstanceId <= 0 {
+		return nil, errors.New("invalid 'adPackageInstanceId'")
+	}
+	if req.NodeClusterId <= 0 {
+		return nil, errors.New("invalid 'nodeClusterId'")
+	}
+
+	err = models.SharedADPackageInstanceDAO.UpdateInstance(tx, req.AdPackageInstanceId, req.NodeClusterId, req.NodeIds, req.IpAddresses, req.IsOn)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}
+
+// FindADPackageInstance 查找单个实例
+func (this *ADPackageInstanceService) FindADPackageInstance(ctx context.Context, req *pb.FindADPackageInstanceRequest) (*pb.FindADPackageInstanceResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	instance, err := models.SharedADPackageInstanceDAO.FindEnabledADPackageInstance(tx, req.AdPackageInstanceId)
+	if err != nil {
+		return nil, err
+	}
+	if instance == nil {
+		return &pb.FindADPackageInstanceResponse{
+			AdPackageInstance: nil,
+		}, nil
+	}
+
+	// package
+	adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, int64(instance.PackageId))
+	if err != nil {
+		return nil, err
+	}
+	if adPackage == nil {
+		return &pb.FindADPackageInstanceResponse{
+			AdPackageInstance: nil,
+		}, nil
+	}
+
+	var pbPackage *pb.ADPackage
+
+	// network
+	var pbNetwork *pb.ADNetwork
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+	if err != nil {
+		return nil, err
+	}
+	if network == nil {
+		return &pb.FindADPackageInstanceResponse{
+			AdPackageInstance: nil,
+		}, nil
+	}
+	pbNetwork = &pb.ADNetwork{
+		Id:          int64(network.Id),
+		IsOn:        network.IsOn,
+		Name:        network.Name,
+		Description: network.Description,
+	}
+
+	pbPackage = &pb.ADPackage{
+		Id:                      int64(adPackage.Id),
+		ProtectionBandwidthSize: types.Int32(adPackage.ProtectionBandwidthSize),
+		ProtectionBandwidthUnit: adPackage.ProtectionBandwidthUnit,
+		ServerBandwidthSize:     types.Int32(adPackage.ServerBandwidthSize),
+		ServerBandwidthUnit:     adPackage.ServerBandwidthUnit,
+		AdNetwork:               pbNetwork,
+		IsOn:                    adPackage.IsOn,
+		Summary:                 adPackage.Summary(network),
+	}
+
+	return &pb.FindADPackageInstanceResponse{AdPackageInstance: &pb.ADPackageInstance{
+		Id:            int64(instance.Id),
+		IsOn:          instance.IsOn,
+		AdPackageId:   int64(instance.PackageId),
+		NodeClusterId: int64(instance.ClusterId),
+		NodeIds:       instance.DecodeNodeIds(),
+		IpAddresses:   instance.DecodeIPAddresses(),
+		AdPackage:     pbPackage,
+	}}, nil
+}
+
+// FindAllADPackageInstances 列出单个高防产品所有实例
+func (this *ADPackageInstanceService) FindAllADPackageInstances(ctx context.Context, req *pb.FindAllADPackageInstancesRequest) (*pb.FindAllADPackageInstancesResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	var pbInstances = []*pb.ADPackageInstance{}
+	instances, err := models.SharedADPackageInstanceDAO.FindAllPackageInstances(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+
+	// package
+	adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+	if adPackage == nil {
+		return &pb.FindAllADPackageInstancesResponse{
+			AdPackageInstances: nil,
+		}, nil
+	}
+
+	var pbPackage *pb.ADPackage
+
+	// network
+	var pbNetwork *pb.ADNetwork
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+	if err != nil {
+		return nil, err
+	}
+	if network != nil {
+		pbNetwork = &pb.ADNetwork{
+			Id:          int64(network.Id),
+			IsOn:        network.IsOn,
+			Name:        network.Name,
+			Description: network.Description,
+		}
+	}
+
+	pbPackage = &pb.ADPackage{
+		Id:                      int64(adPackage.Id),
+		ProtectionBandwidthSize: types.Int32(adPackage.ProtectionBandwidthSize),
+		ProtectionBandwidthUnit: adPackage.ProtectionBandwidthUnit,
+		ServerBandwidthSize:     types.Int32(adPackage.ServerBandwidthSize),
+		ServerBandwidthUnit:     adPackage.ServerBandwidthUnit,
+		AdNetwork:               pbNetwork,
+		IsOn:                    adPackage.IsOn,
+		Summary:                 adPackage.Summary(network),
+	}
+
+	for _, instance := range instances {
+		// 集群
+		var pbCluster *pb.NodeCluster
+		cluster, err := models.SharedNodeClusterDAO.FindClusterBasicInfo(tx, int64(instance.ClusterId), nil)
+		if err != nil {
+			return nil, err
+		}
+		if cluster != nil {
+			pbCluster = &pb.NodeCluster{
+				Id:   int64(cluster.Id),
+				Name: cluster.Name,
+				IsOn: cluster.IsOn,
+			}
+		}
+
+		pbInstances = append(pbInstances, &pb.ADPackageInstance{
+			Id:            int64(instance.Id),
+			IsOn:          instance.IsOn,
+			AdPackageId:   int64(instance.PackageId),
+			NodeClusterId: int64(instance.ClusterId),
+			NodeIds:       instance.DecodeNodeIds(),
+			IpAddresses:   instance.DecodeIPAddresses(),
+			NodeCluster:   pbCluster,
+			AdPackage:     pbPackage,
+		})
+	}
+
+	return &pb.FindAllADPackageInstancesResponse{AdPackageInstances: pbInstances}, nil
+}
+
+// DeleteADPackageInstance 删除实例
+func (this *ADPackageInstanceService) DeleteADPackageInstance(ctx context.Context, req *pb.DeleteADPackageInstanceRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedADPackageInstanceDAO.DisableADPackageInstance(tx, req.AdPackageInstanceId)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}
+
+// CountIdleADPackageInstances 计算可购的实例数量
+func (this *ADPackageInstanceService) CountIdleADPackageInstances(ctx context.Context, req *pb.CountIdleADPackageInstancesRequest) (*pb.RPCCountResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedADPackageInstanceDAO.CountIdleInstances(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.SuccessCount(count)
+}
+
+// CountADPackageInstances 计算实例数量
+func (this *ADPackageInstanceService) CountADPackageInstances(ctx context.Context, req *pb.CountADPackageInstancesRequest) (*pb.RPCCountResponse, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	if userId > 0 {
+		req.UserId = userId
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedADPackageInstanceDAO.CountInstances(tx, req.UserId, req.AdNetworkId, req.AdPackageId, req.Ip)
+	if err != nil {
+		return nil, err
+	}
+	return this.SuccessCount(count)
+}
+
+// ListADPackageInstances 列出单页实例
+func (this *ADPackageInstanceService) ListADPackageInstances(ctx context.Context, req *pb.ListADPackageInstancesRequest) (*pb.ListADPackageInstancesResponse, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	if userId > 0 {
+		req.UserId = userId
+	}
+
+	var tx = this.NullTx()
+
+	var pbInstances = []*pb.ADPackageInstance{}
+	instances, err := models.SharedADPackageInstanceDAO.ListInstances(tx, req.UserId, req.AdNetworkId, req.AdPackageId, req.Ip, req.Offset, req.Size)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, instance := range instances {
+		// 集群
+		var pbCluster *pb.NodeCluster
+		if instance.ClusterId > 0 {
+			cluster, err := models.SharedNodeClusterDAO.FindClusterBasicInfo(tx, int64(instance.ClusterId), nil)
+			if err != nil {
+				return nil, err
+			}
+			if cluster != nil {
+				pbCluster = &pb.NodeCluster{
+					Id:   int64(cluster.Id),
+					Name: cluster.Name,
+					IsOn: cluster.IsOn,
+				}
+			}
+		}
+
+		// package
+		adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, int64(instance.PackageId))
+		if err != nil {
+			return nil, err
+		}
+		if adPackage == nil {
+			continue
+		}
+
+		var pbPackage *pb.ADPackage
+
+		// network
+		var pbNetwork *pb.ADNetwork
+		network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+		if err != nil {
+			return nil, err
+		}
+		if network == nil {
+			continue
+		}
+		pbNetwork = &pb.ADNetwork{
+			Id:          int64(network.Id),
+			IsOn:        network.IsOn,
+			Name:        network.Name,
+			Description: network.Description,
+		}
+
+		pbPackage = &pb.ADPackage{
+			Id:                      int64(adPackage.Id),
+			ProtectionBandwidthSize: types.Int32(adPackage.ProtectionBandwidthSize),
+			ProtectionBandwidthUnit: adPackage.ProtectionBandwidthUnit,
+			ServerBandwidthSize:     types.Int32(adPackage.ServerBandwidthSize),
+			ServerBandwidthUnit:     adPackage.ServerBandwidthUnit,
+			AdNetwork:               pbNetwork,
+			IsOn:                    adPackage.IsOn,
+			Summary:                 adPackage.Summary(network),
+		}
+
+		// user
+		var pbUser *pb.User
+		user, err := instance.CurrentUser()
+		if err != nil {
+			return nil, err
+		}
+		if user != nil {
+			pbUser = &pb.User{
+				Id:       int64(user.Id),
+				Fullname: user.Fullname,
+				Username: user.Username,
+			}
+		}
+
+		pbInstances = append(pbInstances, &pb.ADPackageInstance{
+			Id:            int64(instance.Id),
+			IsOn:          instance.IsOn,
+			AdPackageId:   int64(instance.PackageId),
+			NodeClusterId: int64(instance.ClusterId),
+			NodeIds:       instance.DecodeNodeIds(),
+			IpAddresses:   instance.DecodeIPAddresses(),
+			UserId:        int64(instance.UserId),
+			UserDayTo:     instance.UserDayTo,
+			NodeCluster:   pbCluster,
+			AdPackage:     pbPackage,
+			User:          pbUser,
+		})
+	}
+
+	return &pb.ListADPackageInstancesResponse{AdPackageInstances: pbInstances}, nil
+}

EdgeAPI/internal/rpc/services/anti-ddos/service_ad_package_period.go

@@ -0,0 +1,147 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build plus
+
+package antiddos
+
+import (
+	"context"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+// ADPackagePeriodService 高防实例有效期服务
+type ADPackagePeriodService struct {
+	services.BaseService
+}
+
+// CreateADPackagePeriod 创建有效期
+func (this *ADPackagePeriodService) CreateADPackagePeriod(ctx context.Context, req *pb.CreateADPackagePeriodRequest) (*pb.CreateADPackagePeriodResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	periodId, err := models.SharedADPackagePeriodDAO.CreatePeriod(tx, req.Count, req.Unit)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.CreateADPackagePeriodResponse{
+		AdPackagePeriodId: periodId,
+	}, nil
+}
+
+// UpdateADPackagePeriod 修改有效期
+func (this *ADPackagePeriodService) UpdateADPackagePeriod(ctx context.Context, req *pb.UpdateADPackagePeriodRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedADPackagePeriodDAO.UpdatePeriod(tx, req.AdPackagePeriodId, req.IsOn)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}
+
+// DeleteADPackagePeriod 删除有效期
+func (this *ADPackagePeriodService) DeleteADPackagePeriod(ctx context.Context, req *pb.DeleteADPackagePeriodRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedADPackagePeriodDAO.DisableADPackagePeriod(tx, req.AdPackagePeriodId)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}
+
+// FindADPackagePeriod 查找有效期
+func (this *ADPackagePeriodService) FindADPackagePeriod(ctx context.Context, req *pb.FindADPackagePeriodRequest) (*pb.FindADPackagePeriodResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	period, err := models.SharedADPackagePeriodDAO.FindEnabledADPackagePeriod(tx, req.AdPackagePeriodId)
+	if err != nil {
+		return nil, err
+	}
+
+	if period == nil {
+		return &pb.FindADPackagePeriodResponse{AdPackagePeriod: nil}, nil
+	}
+
+	return &pb.FindADPackagePeriodResponse{AdPackagePeriod: &pb.ADPackagePeriod{
+		Id:     int64(period.Id),
+		IsOn:   period.IsOn,
+		Count:  int32(period.Count),
+		Unit:   period.Unit,
+		Months: int32(period.Months),
+	}}, nil
+}
+
+// FindAllADPackagePeriods 列出所有有效期
+func (this *ADPackagePeriodService) FindAllADPackagePeriods(ctx context.Context, req *pb.FindAllADPackagePeriodsRequest) (*pb.FindAllADPackagePeriodsResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	periods, err := models.SharedADPackagePeriodDAO.FindAllPeriods(tx)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbPeriods = []*pb.ADPackagePeriod{}
+	for _, period := range periods {
+		pbPeriods = append(pbPeriods, &pb.ADPackagePeriod{
+			Id:     int64(period.Id),
+			IsOn:   period.IsOn,
+			Count:  int32(period.Count),
+			Unit:   period.Unit,
+			Months: int32(period.Months),
+		})
+	}
+
+	return &pb.FindAllADPackagePeriodsResponse{
+		AdPackagePeriods: pbPeriods,
+	}, nil
+}
+
+// FindAllAvailableADPackagePeriods 列出所有可用有效期
+func (this *ADPackagePeriodService) FindAllAvailableADPackagePeriods(ctx context.Context, req *pb.FindAllAvailableADPackagePeriodsRequest) (*pb.FindAllAvailableADPackagePeriodsResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	periods, err := models.SharedADPackagePeriodDAO.FindAllAvailablePeriods(tx)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbPeriods = []*pb.ADPackagePeriod{}
+	for _, period := range periods {
+		pbPeriods = append(pbPeriods, &pb.ADPackagePeriod{
+			Id:     int64(period.Id),
+			IsOn:   period.IsOn,
+			Count:  int32(period.Count),
+			Unit:   period.Unit,
+			Months: int32(period.Months),
+		})
+	}
+
+	return &pb.FindAllAvailableADPackagePeriodsResponse{
+		AdPackagePeriods: pbPeriods,
+	}, nil
+}

EdgeAPI/internal/rpc/services/anti-ddos/service_ad_package_price.go

@@ -0,0 +1,120 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build plus
+
+package antiddos
+
+import (
+	"context"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+type ADPackagePriceService struct {
+	services.BaseService
+}
+
+// UpdateADPackagePrice 设置高防产品价格
+func (this *ADPackagePriceService) UpdateADPackagePrice(ctx context.Context, req *pb.UpdateADPackagePriceRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// TODO 检查各项参数的有效性
+
+	err = models.SharedADPackagePriceDAO.UpdatePackagePrice(tx, req.AdPackageId, req.AdPackagePeriodId, req.Price)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}
+
+// FindADPackagePrice 获取单个高防产品具体价格
+func (this *ADPackagePriceService) FindADPackagePrice(ctx context.Context, req *pb.FindADPackagePriceRequest) (*pb.FindADPackagePriceResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	price, err := models.SharedADPackagePriceDAO.FindPackagePrice(tx, req.AdPackageId, req.AdPackagePeriodId)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.FindADPackagePriceResponse{
+		Price:  price,
+		Amount: float64(req.Count) * price,
+	}, nil
+}
+
+// CountADPackagePrices 计算高防产品价格项数量
+func (this *ADPackagePriceService) CountADPackagePrices(ctx context.Context, req *pb.CountADPackagePricesRequest) (*pb.RPCCountResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedADPackagePriceDAO.CountPackagePrices(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.SuccessCount(count)
+}
+
+// FindADPackagePrices 查找高防产品价格
+func (this *ADPackagePriceService) FindADPackagePrices(ctx context.Context, req *pb.FindADPackagePricesRequest) (*pb.FindADPackagePricesResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	prices, err := models.SharedADPackagePriceDAO.FindPackagePrices(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbPrices = []*pb.ADPackagePrice{}
+	for _, price := range prices {
+		pbPrices = append(pbPrices, &pb.ADPackagePrice{
+			AdPackageId:       int64(price.PackageId),
+			AdPackagePeriodId: int64(price.PeriodId),
+			Price:             price.Price,
+		})
+	}
+	return &pb.FindADPackagePricesResponse{
+		AdPackagePrices: pbPrices,
+	}, nil
+}
+
+// FindAllADPackagePrices 查找所有高防产品价格
+func (this *ADPackagePriceService) FindAllADPackagePrices(ctx context.Context, req *pb.FindAllADPackagePricesRequest) (*pb.FindAllADPackagePricesResponse, error) {
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	prices, err := models.SharedADPackagePriceDAO.FindAllPackagePrices(tx)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbPrices = []*pb.ADPackagePrice{}
+	for _, price := range prices {
+		pbPrices = append(pbPrices, &pb.ADPackagePrice{
+			AdPackageId:       int64(price.PackageId),
+			AdPackagePeriodId: int64(price.PeriodId),
+			Price:             price.Price,
+		})
+	}
+	return &pb.FindAllADPackagePricesResponse{
+		AdPackagePrices: pbPrices,
+	}, nil
+}

EdgeAPI/internal/rpc/services/anti-ddos/service_user_ad_instance.go

@@ -0,0 +1,732 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build plus
+
+package antiddos
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
+	"github.com/TeaOSLab/EdgeAPI/internal/db/models/accounts"
+	"github.com/TeaOSLab/EdgeAPI/internal/rpc/services"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/userconfigs"
+	"github.com/iwind/TeaGo/dbs"
+	"github.com/iwind/TeaGo/maps"
+	"github.com/iwind/TeaGo/types"
+	"strings"
+)
+
+// UserADInstanceService 用户高防实例服务
+type UserADInstanceService struct {
+	services.BaseService
+}
+
+// CreateUserADInstance 创建用户高防实例
+func (this *UserADInstanceService) CreateUserADInstance(ctx context.Context, req *pb.CreateUserADInstanceRequest) (*pb.CreateUserADInstanceResponse, error) {
+	adminId, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// 高防产品
+	if req.AdPackageId <= 0 {
+		return nil, errors.New("invalid 'adPackageId'")
+	}
+	adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+	if adPackage == nil {
+		return nil, errors.New("invalid 'adPackage'")
+	}
+
+	// 有效期选项
+	if req.AdPackagePeriodId <= 0 {
+		return nil, errors.New("invalid 'adPackagePeriodId'")
+	}
+
+	period, err := models.SharedADPackagePeriodDAO.FindEnabledADPackagePeriod(tx, req.AdPackagePeriodId)
+	if err != nil {
+		return nil, err
+	}
+	if period == nil || !period.IsOn {
+		return nil, errors.New("could not find instance period with id '" + types.String(req.AdPackagePeriodId) + "'")
+	}
+	_, dayTo := period.DayPeriod()
+
+	// 数量
+	if req.Count <= 0 {
+		return nil, errors.New("invalid 'count'")
+	}
+
+	instances, err := models.SharedADPackageInstanceDAO.FindIdlePackageInstances(tx, req.AdPackageId, req.Count)
+	if err != nil {
+		return nil, err
+	}
+
+	var countInstances = int32(len(instances))
+	if countInstances < req.Count {
+		return nil, errors.New("no enough instances")
+	}
+	if countInstances > req.Count {
+		instances = instances[:req.Count]
+	}
+
+	var userInstanceIds = []int64{}
+	err = this.RunTx(func(tx *dbs.Tx) error {
+		for _, instance := range instances {
+			var instanceId = int64(instance.Id)
+			userInstanceId, err := models.SharedUserADInstanceDAO.CreateUserInstance(tx, req.UserId, adminId, instanceId, req.AdPackagePeriodId)
+			if err != nil {
+				return err
+			}
+
+			err = models.SharedADPackageInstanceDAO.UpdateInstanceUser(tx, instanceId, req.UserId, dayTo, userInstanceId)
+			if err != nil {
+				return err
+			}
+
+			userInstanceIds = append(userInstanceIds, userInstanceId)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &pb.CreateUserADInstanceResponse{
+		UserADInstanceIds: userInstanceIds,
+	}, nil
+}
+
+// BuyUserADInstance 购买用户高防实例
+func (this *UserADInstanceService) BuyUserADInstance(ctx context.Context, req *pb.BuyUserADInstanceRequest) (*pb.BuyUserADInstanceResponse, error) {
+	adminId, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	if userId > 0 {
+		req.UserId = userId
+	}
+	userId = req.UserId
+
+	var tx = this.NullTx()
+
+	// 高防产品
+	if req.AdPackageId <= 0 {
+		return nil, errors.New("invalid 'adPackageId'")
+	}
+	adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, req.AdPackageId)
+	if err != nil {
+		return nil, err
+	}
+	if adPackage == nil {
+		return nil, errors.New("invalid 'adPackage'")
+	}
+
+	// 线路
+	network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+	if err != nil {
+		return nil, err
+	}
+	if network == nil {
+		return nil, errors.New("invalid 'network'")
+	}
+
+	// 有效期选项
+	if req.AdPackagePeriodId <= 0 {
+		return nil, errors.New("invalid 'adPackagePeriodId'")
+	}
+
+	period, err := models.SharedADPackagePeriodDAO.FindEnabledADPackagePeriod(tx, req.AdPackagePeriodId)
+	if err != nil {
+		return nil, err
+	}
+	if period == nil || !period.IsOn {
+		return nil, errors.New("could not find instance period with id '" + types.String(req.AdPackagePeriodId) + "'")
+	}
+	_, dayTo := period.DayPeriod()
+
+	// 数量
+	if req.Count <= 0 {
+		return nil, errors.New("invalid 'count'")
+	}
+
+	var userInstanceIds = []int64{}
+
+	err = this.RunTx(func(tx *dbs.Tx) error {
+		var packageId = int64(adPackage.Id)
+		instances, err := models.SharedADPackageInstanceDAO.FindIdlePackageInstances(tx, packageId, req.Count)
+		if err != nil {
+			return err
+		}
+
+		var countInstances = int32(len(instances))
+		if countInstances < req.Count {
+			return errors.New("no enough instances")
+		}
+		if countInstances > req.Count {
+			instances = instances[:req.Count]
+		}
+
+		// 获取价格
+		price, err := models.SharedADPackagePriceDAO.FindPackagePrice(tx, packageId, req.AdPackagePeriodId)
+		if err != nil {
+			return err
+		}
+		if price <= 0 {
+			return errors.New("invalid package price, id:" + types.String(packageId))
+		}
+		var amount = price * float64(req.Count)
+
+		// 先减少余额
+		account, err := accounts.SharedUserAccountDAO.FindUserAccountWithUserId(tx, userId)
+		if err != nil {
+			return err
+		}
+		if account == nil || account.Total < amount {
+			return errors.New("no enough balance to buy the package")
+		}
+
+		err = accounts.SharedUserAccountDAO.UpdateUserAccount(tx, int64(account.Id), -amount, userconfigs.AccountEventTypeBuyAntiDDoSPackage, "购买DDoS高防实例，线路："+network.Name+" / 防护带宽："+types.String(adPackage.ProtectionBandwidthSize)+userconfigs.ADPackageSizeFullUnit(adPackage.ProtectionBandwidthUnit)+" / 业务带宽："+types.String(adPackage.ServerBandwidthSize)+userconfigs.ADPackageSizeFullUnit(adPackage.ServerBandwidthUnit)+" / "+types.String(period.Count)+userconfigs.ADPackagePeriodUnitName(period.Unit)+"\" x "+types.String(req.Count), maps.Map{
+			"adNetworkId":             network.Id,
+			"adPackageId":             packageId,
+			"protectionBandwidthSize": adPackage.ProtectionBandwidthSize,
+			"protectionBandwidthUnit": adPackage.ProtectionBandwidthUnit,
+			"serverBandwidthSize":     adPackage.ServerBandwidthSize,
+			"serverBandwidthUnit":     adPackage.ServerBandwidthUnit,
+			"adPackagePeriodId":       req.AdPackagePeriodId,
+			"adPackagePeriodCount":    period.Count,
+			"adPackagePeriodUnit":     period.Unit,
+			"count":                   req.Count,
+		})
+		if err != nil {
+			return err
+		}
+
+		for _, instance := range instances {
+			var instanceId = int64(instance.Id)
+			userInstanceId, err := models.SharedUserADInstanceDAO.CreateUserInstance(tx, req.UserId, adminId, instanceId, req.AdPackagePeriodId)
+			if err != nil {
+				return err
+			}
+
+			err = models.SharedADPackageInstanceDAO.UpdateInstanceUser(tx, instanceId, req.UserId, dayTo, userInstanceId)
+			if err != nil {
+				return err
+			}
+
+			userInstanceIds = append(userInstanceIds, userInstanceId)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &pb.BuyUserADInstanceResponse{
+		UserADInstanceIds: userInstanceIds,
+	}, nil
+}
+
+// CountUserADInstances 查询当前高防实例数量
+func (this *UserADInstanceService) CountUserADInstances(ctx context.Context, req *pb.CountUserADInstancesRequest) (*pb.RPCCountResponse, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	if userId > 0 {
+		req.UserId = userId
+	}
+
+	var tx = this.NullTx()
+	count, err := models.SharedUserADInstanceDAO.CountUserInstances(tx, req.AdNetworkId, req.UserId, req.AdPackagePeriodId, req.ExpiresDay, req.AvailableOnly)
+	if err != nil {
+		return nil, err
+	}
+	return this.SuccessCount(count)
+}
+
+// ListUserADInstances 列出单页高防实例
+func (this *UserADInstanceService) ListUserADInstances(ctx context.Context, req *pb.ListUserADInstancesRequest) (*pb.ListUserADInstancesResponse, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var fromUser = false
+	if userId > 0 {
+		fromUser = true
+		req.UserId = userId
+	}
+
+	var tx = this.NullTx()
+	userInstances, err := models.SharedUserADInstanceDAO.ListUserInstances(tx, req.AdNetworkId, req.UserId, req.AdPackagePeriodId, req.ExpiresDay, req.AvailableOnly, req.Offset, req.Size)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbUserInstances = []*pb.UserADInstance{}
+	for _, userInstance := range userInstances {
+		instanceIsAvailable, err := userInstance.CheckAvailable(tx)
+		if err != nil {
+			return nil, err
+		}
+
+		// instance
+		instance, err := models.SharedADPackageInstanceDAO.FindEnabledADPackageInstance(tx, int64(userInstance.InstanceId))
+		if err != nil {
+			return nil, err
+		}
+		if instance == nil {
+			continue
+		}
+
+		// package
+		p, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, int64(instance.PackageId))
+		if err != nil {
+			return nil, err
+		}
+
+		var pbPackage *pb.ADPackage
+		if p != nil {
+			// network
+			var pbNetwork *pb.ADNetwork
+			network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(p.NetworkId))
+			if err != nil {
+				return nil, err
+			}
+			if network != nil {
+				pbNetwork = &pb.ADNetwork{
+					Id:          int64(network.Id),
+					IsOn:        network.IsOn,
+					Name:        network.Name,
+					Description: network.Description,
+				}
+			}
+
+			pbPackage = &pb.ADPackage{
+				Id:                      int64(p.Id),
+				ProtectionBandwidthSize: types.Int32(p.ProtectionBandwidthSize),
+				ProtectionBandwidthUnit: p.ProtectionBandwidthUnit,
+				ServerBandwidthSize:     types.Int32(p.ServerBandwidthSize),
+				ServerBandwidthUnit:     p.ServerBandwidthUnit,
+				Summary:                 p.Summary(network),
+				AdNetwork:               pbNetwork,
+				IsOn:                    p.IsOn,
+			}
+		}
+
+		// 集群
+		var pbCluster *pb.NodeCluster
+		if !fromUser {
+			cluster, err := models.SharedNodeClusterDAO.FindClusterBasicInfo(tx, int64(instance.ClusterId), nil)
+			if err != nil {
+				return nil, err
+			}
+			if cluster != nil {
+				pbCluster = &pb.NodeCluster{
+					Id:   int64(cluster.Id),
+					Name: cluster.Name,
+					IsOn: cluster.IsOn,
+				}
+			}
+		}
+
+		var pbInstance = &pb.ADPackageInstance{
+			Id:             int64(instance.Id),
+			NodeClusterId:  int64(instance.ClusterId),
+			NodeIds:        instance.DecodeNodeIds(),
+			IpAddresses:    instance.DecodeIPAddresses(),
+			NodeCluster:    pbCluster,
+			AdPackage:      pbPackage,
+			UserInstanceId: int64(instance.UserInstanceId),
+		}
+
+		// user
+		var pbUser *pb.User
+		user, err := models.SharedUserDAO.FindEnabledBasicUser(tx, int64(userInstance.UserId))
+		if err != nil {
+			return nil, err
+		}
+		if user != nil {
+			pbUser = &pb.User{
+				Id:       int64(user.Id),
+				Username: user.Username,
+				Fullname: user.Fullname,
+				IsOn:     user.IsOn,
+			}
+		}
+
+		pbUserInstances = append(pbUserInstances, &pb.UserADInstance{
+			Id:                   int64(userInstance.Id),
+			UserId:               int64(userInstance.UserId),
+			AdPackageInstanceId:  int64(userInstance.InstanceId),
+			AdPackagePeriodId:    int64(userInstance.PeriodId),
+			AdPackagePeriodCount: int32(userInstance.PeriodCount),
+			AdPackagePeriodUnit:  userInstance.PeriodUnit,
+			DayFrom:              userInstance.DayFrom,
+			DayTo:                userInstance.DayTo,
+			CreatedAt:            int64(userInstance.CreatedAt),
+			MaxObjects:           types.Int32(userInstance.MaxObjects),
+			ObjectCodes:          userInstance.DecodeObjectCodes(),
+			AdPackageInstance:    pbInstance,
+			User:                 pbUser,
+			CanDelete:            userInstance.AdminId > 0,
+			IsAvailable:          instanceIsAvailable,
+			CountObjects:         int32(len(userInstance.DecodeObjectCodes())),
+		})
+	}
+	return &pb.ListUserADInstancesResponse{
+		UserADInstances: pbUserInstances,
+	}, nil
+}
+
+// FindUserADInstance 查找单个用户高防实例
+func (this *UserADInstanceService) FindUserADInstance(ctx context.Context, req *pb.FindUserADInstanceRequest) (*pb.FindUserADInstanceResponse, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	userInstance, err := models.SharedUserADInstanceDAO.FindEnabledUserADInstance(tx, req.UserADInstanceId)
+	if err != nil {
+		return nil, err
+	}
+
+	if userInstance == nil {
+		return &pb.FindUserADInstanceResponse{
+			UserADInstance: nil,
+		}, nil
+	}
+
+	// 检查用户
+	if userId > 0 && int64(userInstance.UserId) != userId {
+		return nil, this.PermissionError()
+	}
+
+	// 是否有效
+	instanceIsAvailable, err := userInstance.CheckAvailable(tx)
+	if err != nil {
+		return nil, err
+	}
+
+	// 防护对象
+	objects, err := userInstance.DecodeObjects()
+	if err != nil {
+		return nil, err
+	}
+	if objects == nil {
+		objects = []maps.Map{}
+	}
+	objectsJSON, err := json.Marshal(objects)
+	if err != nil {
+		return nil, err
+	}
+
+	// instance
+	instance, err := models.SharedADPackageInstanceDAO.FindEnabledADPackageInstance(tx, int64(userInstance.InstanceId))
+	if err != nil {
+		return nil, err
+	}
+	if instance == nil {
+		return &pb.FindUserADInstanceResponse{
+			UserADInstance: nil,
+		}, nil
+	}
+
+	// package
+	p, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, int64(instance.PackageId))
+	if err != nil {
+		return nil, err
+	}
+
+	var pbPackage *pb.ADPackage
+	if p != nil {
+		// network
+		var pbNetwork *pb.ADNetwork
+		network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(p.NetworkId))
+		if err != nil {
+			return nil, err
+		}
+		if network != nil {
+			pbNetwork = &pb.ADNetwork{
+				Id:          int64(network.Id),
+				IsOn:        network.IsOn,
+				Name:        network.Name,
+				Description: network.Description,
+			}
+		}
+
+		pbPackage = &pb.ADPackage{
+			Id:                      int64(p.Id),
+			ProtectionBandwidthSize: types.Int32(p.ProtectionBandwidthSize),
+			ProtectionBandwidthUnit: p.ProtectionBandwidthUnit,
+			ServerBandwidthSize:     types.Int32(p.ServerBandwidthSize),
+			ServerBandwidthUnit:     p.ServerBandwidthUnit,
+			Summary:                 p.Summary(network),
+			AdNetwork:               pbNetwork,
+			IsOn:                    p.IsOn,
+		}
+	}
+
+	var pbInstance = &pb.ADPackageInstance{
+		Id:             int64(instance.Id),
+		AdPackageId:    int64(instance.PackageId),
+		NodeClusterId:  int64(instance.ClusterId),
+		NodeIds:        instance.DecodeNodeIds(),
+		IpAddresses:    instance.DecodeIPAddresses(),
+		NodeCluster:    nil,
+		AdPackage:      pbPackage,
+		UserInstanceId: int64(instance.UserInstanceId),
+	}
+
+	// user
+	var pbUser *pb.User
+	user, err := models.SharedUserDAO.FindEnabledBasicUser(tx, int64(userInstance.UserId))
+	if err != nil {
+		return nil, err
+	}
+	if user != nil {
+		pbUser = &pb.User{
+			Id:       int64(user.Id),
+			Username: user.Username,
+			Fullname: user.Fullname,
+		}
+	}
+
+	return &pb.FindUserADInstanceResponse{
+		UserADInstance: &pb.UserADInstance{
+			Id:                   int64(userInstance.Id),
+			UserId:               int64(userInstance.UserId),
+			AdPackageInstanceId:  int64(userInstance.InstanceId),
+			AdPackagePeriodId:    int64(userInstance.PeriodId),
+			AdPackagePeriodCount: int32(userInstance.PeriodCount),
+			IsAvailable:          instanceIsAvailable,
+			AdPackagePeriodUnit:  userInstance.PeriodUnit,
+			DayFrom:              userInstance.DayFrom,
+			DayTo:                userInstance.DayTo,
+			CreatedAt:            int64(userInstance.CreatedAt),
+			MaxObjects:           types.Int32(userInstance.MaxObjects),
+			ObjectCodes:          userInstance.DecodeObjectCodes(),
+			ObjectsJSON:          objectsJSON,
+			AdPackageInstance:    pbInstance,
+			User:                 pbUser,
+			CanDelete:            userInstance.AdminId > 0,
+		}}, nil
+}
+
+// DeleteUserADInstance 删除高防实例
+func (this *UserADInstanceService) DeleteUserADInstance(ctx context.Context, req *pb.DeleteUserADInstanceRequest) (*pb.RPCSuccess, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	userInstance, err := models.SharedUserADInstanceDAO.FindEnabledUserADInstance(tx, req.UserADInstanceId)
+	if err != nil {
+		return nil, err
+	}
+	if userInstance == nil {
+		// 不存在，则直接成功
+		return this.Success()
+	}
+
+	// 检查用户
+	if userId > 0 {
+		if userId != int64(userInstance.UserId) {
+			return nil, this.PermissionError()
+		}
+	}
+
+	var instanceId = int64(userInstance.InstanceId)
+
+	err = this.RunTx(func(tx *dbs.Tx) error {
+		err = models.SharedUserADInstanceDAO.DisableUserADInstance(tx, req.UserADInstanceId)
+		if err != nil {
+			return err
+		}
+
+		return models.SharedADPackageInstanceDAO.ResetInstanceUser(tx, instanceId)
+	})
+
+	return this.Success()
+}
+
+// RenewUserADInstance 续期
+func (this *UserADInstanceService) RenewUserADInstance(ctx context.Context, req *pb.RenewUserADInstanceRequest) (*pb.RPCSuccess, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	userInstance, err := models.SharedUserADInstanceDAO.FindEnabledUserADInstance(tx, req.UserADInstanceId)
+	if err != nil {
+		return nil, err
+	}
+	if userInstance == nil {
+		return nil, errors.New("could not find user instance to renew")
+	}
+
+	// 检查用户
+	if userId > 0 {
+		if userId != int64(userInstance.UserId) {
+			return nil, errors.New("could not find user instance to renew")
+		}
+	}
+
+	err = this.RunTx(func(tx *dbs.Tx) error {
+		// 查找实例信息
+		var instanceId = int64(userInstance.InstanceId)
+		instance, err := models.SharedADPackageInstanceDAO.FindEnabledADPackageInstance(tx, instanceId)
+		if err != nil {
+			return err
+		}
+		if instance == nil {
+			return errors.New("the instance has been invalid")
+		}
+
+		// 确保操作的是同一个实例
+		if instance.UserInstanceId > 0 && int64(instance.UserInstanceId) != req.UserADInstanceId {
+			return errors.New("the instance has been token by other user")
+		}
+
+		var packageId = int64(instance.PackageId)
+		adPackage, err := models.SharedADPackageDAO.FindEnabledADPackage(tx, packageId)
+		if err != nil {
+			return err
+		}
+		if adPackage == nil || !adPackage.IsOn {
+			return errors.New("the package has been invalid")
+		}
+
+		// 线路
+		network, err := models.SharedADNetworkDAO.FindEnabledADNetwork(tx, int64(adPackage.NetworkId))
+		if err != nil {
+			return err
+		}
+		if network == nil {
+			return errors.New("the network has been invalid")
+		}
+
+		// 检查有效期
+		if req.AdPackagePeriodId <= 0 {
+			return errors.New("invalid 'adPackagePeriodId'")
+		}
+		period, err := models.SharedADPackagePeriodDAO.FindEnabledADPackagePeriod(tx, req.AdPackagePeriodId)
+		if err != nil {
+			return err
+		}
+		if period == nil {
+			return errors.New("could not find period '" + types.String(req.AdPackagePeriodId) + "'")
+		}
+
+		price, err := models.SharedADPackagePriceDAO.FindPackagePrice(tx, packageId, req.AdPackagePeriodId)
+		if err != nil {
+			return err
+		}
+		if price <= 0 {
+			return errors.New("can not find price for the instance")
+		}
+
+		// 如果是用户需要支付费用
+		if userId > 0 {
+			var amount = price
+
+			// 先减少余额
+			account, err := accounts.SharedUserAccountDAO.FindUserAccountWithUserId(tx, userId)
+			if err != nil {
+				return err
+			}
+			if account == nil || account.Total < amount {
+				return errors.New("no enough balance to buy the package")
+			}
+
+			err = accounts.SharedUserAccountDAO.UpdateUserAccount(tx, int64(account.Id), -amount, userconfigs.AccountEventTypeRenewAntiDDoSPackage, "续费高DDoS防实例，线路："+network.Name+" / 防护带宽："+types.String(adPackage.ProtectionBandwidthSize)+userconfigs.ADPackageSizeFullUnit(adPackage.ProtectionBandwidthUnit)+" / 业务带宽："+types.String(adPackage.ServerBandwidthSize)+userconfigs.ADPackageSizeFullUnit(adPackage.ServerBandwidthUnit)+" / 高防IP："+strings.Join(instance.DecodeIPAddresses(), "，")+" / "+types.String(period.Count)+userconfigs.ADPackagePeriodUnitName(period.Unit), maps.Map{
+				"adNetworkId":             network.Id,
+				"adPackageId":             packageId,
+				"protectionBandwidthSize": adPackage.ProtectionBandwidthSize,
+				"protectionBandwidthUnit": adPackage.ProtectionBandwidthUnit,
+				"serverBandwidthSize":     adPackage.ServerBandwidthSize,
+				"serverBandwidthUnit":     adPackage.ServerBandwidthUnit,
+				"adPackagePeriodId":       req.AdPackagePeriodId,
+				"adPackagePeriodCount":    period.Count,
+				"adPackagePeriodUnit":     period.Unit,
+				"count":                   1,
+			})
+			if err != nil {
+				return err
+			}
+		}
+
+		_, err = models.SharedUserADInstanceDAO.RenewUserInstance(tx, userInstance, period)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}
+
+// UpdateUserADInstanceObjects 修改实例防护对象
+func (this *UserADInstanceService) UpdateUserADInstanceObjects(ctx context.Context, req *pb.UpdateUserADInstanceObjectsRequest) (*pb.RPCSuccess, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	userInstance, err := models.SharedUserADInstanceDAO.FindEnabledUserADInstance(tx, req.UserADInstanceId)
+	if err != nil {
+		return nil, err
+	}
+	if userInstance == nil {
+		return nil, errors.New("could not find user instance with id '" + types.String(req.UserADInstanceId) + "'")
+	}
+	var instanceId = int64(userInstance.InstanceId)
+
+	// 检查用户
+	if userId > 0 {
+		if int64(userInstance.UserId) != userId {
+			return nil, this.PermissionError()
+		}
+	}
+
+	// 检查当前实例是否有效
+	isAvailable, err := userInstance.CheckAvailable(tx)
+	if err != nil {
+		return nil, err
+	}
+	if !isAvailable {
+		return nil, errors.New("the user instance is not available")
+	}
+
+	// TODO 检查有没有超出最大防护对象数量
+
+	err = this.RunTx(func(tx *dbs.Tx) error {
+		err = models.SharedUserADInstanceDAO.UpdateUserInstanceObjects(tx, req.UserADInstanceId, req.ObjectCodes)
+		if err != nil {
+			return err
+		}
+
+		return models.SharedADPackageInstanceDAO.UpdateInstanceObjects(tx, instanceId, req.ObjectCodes)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}