122 lines
4.7 KiB
TypeScript
122 lines
4.7 KiB
TypeScript
import type { Lang } from "@/app/page";
|
|
|
|
const copy = {
|
|
en: {
|
|
eyebrow: "Security model",
|
|
title: "Resources are usable. Secrets do not leak.",
|
|
description:
|
|
"Users authorize resources, the platform holds credentials, and sub Agnets only receive short-lived access inside the approved scope.",
|
|
principles: [
|
|
{
|
|
number: "01",
|
|
title: "Secrets never enter the product surface",
|
|
description:
|
|
"Git tokens, cloud access keys, SSH private keys, database passwords, and CodeGW keys never enter Git, Markdown, frontend responses, or ordinary logs.",
|
|
},
|
|
{
|
|
number: "02",
|
|
title: "Only secret_ref is stored",
|
|
description:
|
|
"The Manager database stores resource metadata, permission relationships, and secret_ref. Real long-lived credentials are held by the vault.",
|
|
},
|
|
{
|
|
number: "03",
|
|
title: "Sub Agnets only receive short-lived credentials",
|
|
description:
|
|
"After approval, the platform derives short-lived, least-privilege, auditable credentials by permission and TTL. Sub Agnets do not keep long-lived secrets.",
|
|
},
|
|
{
|
|
number: "04",
|
|
title: "Risky actions are approved in the client",
|
|
description:
|
|
"Production deploys, cloud changes, database writes, production secret access, and large budget consumption require explicit client confirmation.",
|
|
},
|
|
{
|
|
number: "05",
|
|
title: "Audit answers the critical questions",
|
|
description:
|
|
"Who used which resource, for which task, through which sub Agnet, at what time, with what action, and whether approval happened.",
|
|
},
|
|
],
|
|
},
|
|
zh: {
|
|
eyebrow: "Security model",
|
|
title: "资源可用，密钥不外泄",
|
|
description:
|
|
"用户授权资源，平台托管凭证，子 Agnet 只获得被批准范围内的短期访问能力。",
|
|
principles: [
|
|
{
|
|
number: "01",
|
|
title: "密钥不进入产品表面",
|
|
description: "Git token、云 access key、SSH 私钥、数据库密码和 CodeGW key 不进入 Git、Markdown、前端响应或普通日志。",
|
|
},
|
|
{
|
|
number: "02",
|
|
title: "只保存 secret_ref",
|
|
description: "Manager 数据库保存资源元数据、权限关系和 secret_ref，真实长期凭证由密钥保管器托管。",
|
|
},
|
|
{
|
|
number: "03",
|
|
title: "子 Agnet 只拿短期凭证",
|
|
description: "审批通过后，平台按权限和 TTL 派生短期、最小权限、可审计凭证；子 Agnet 不保存长期密钥。",
|
|
},
|
|
{
|
|
number: "04",
|
|
title: "高危操作只在客户端审批",
|
|
description: "生产部署、云资源变更、数据库写入、访问生产密钥和大额预算消耗，必须由用户在客户端明确确认。",
|
|
},
|
|
{
|
|
number: "05",
|
|
title: "审计能回答关键问题",
|
|
description: "谁在什么时候，为了哪个任务，让哪个子 Agnet 使用了哪个资源，执行了什么动作，是否经过审批。",
|
|
},
|
|
],
|
|
},
|
|
} satisfies Record<Lang, {
|
|
eyebrow: string;
|
|
title: string;
|
|
description: string;
|
|
principles: Array<{ number: string; title: string; description: string }>;
|
|
}>;
|
|
|
|
export function Principles({ lang }: { lang: Lang }) {
|
|
const t = copy[lang];
|
|
|
|
return (
|
|
<section id="security" className="border-t border-border bg-card/30 py-20 sm:py-28">
|
|
<div className="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8">
|
|
<div className="mx-auto max-w-2xl text-center">
|
|
<p className="text-sm font-bold tracking-widest text-primary uppercase">
|
|
{t.eyebrow}
|
|
</p>
|
|
<h2 className="mt-4 text-3xl font-black tracking-tight sm:text-5xl">
|
|
{t.title}
|
|
</h2>
|
|
<p className="mt-4 text-muted-foreground">
|
|
{t.description}
|
|
</p>
|
|
</div>
|
|
|
|
<div className="mt-16 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
|
|
{t.principles.map((principle) => (
|
|
<div
|
|
key={principle.number}
|
|
className="group relative overflow-hidden rounded-[1.6rem] border border-border bg-background/80 p-6 transition-colors hover:border-primary/40"
|
|
>
|
|
<span className="absolute -top-2 -right-2 text-7xl font-black text-secondary/40 transition-colors group-hover:text-primary/10">
|
|
{principle.number}
|
|
</span>
|
|
<div className="relative">
|
|
<h3 className="text-lg font-semibold">{principle.title}</h3>
|
|
<p className="mt-3 text-sm leading-relaxed text-muted-foreground">
|
|
{principle.description}
|
|
</p>
|
|
</div>
|
|
</div>
|
|
))}
|
|
</div>
|
|
</div>
|
|
</section>
|
|
);
|
|
}
|