chore: disallow some restful api for CMFA

hub/route/configs.go

@@ -24,9 +24,11 @@ import (
 func configRouter() http.Handler {
 	r := chi.NewRouter()
 	r.Get("/", getConfigs)
+	if !embedMode { // disallow update/patch configs in embed mode
 		r.Put("/", updateConfigs)
 		r.Post("/geo", updateGeoDatabases)
 		r.Patch("/", patchConfigs)
+	}
 	return r
 }
 

hub/route/groups.go

@@ -16,7 +16,7 @@ import (
 	"github.com/metacubex/mihomo/tunnel"
 )
 
-func GroupRouter() http.Handler {
+func groupRouter() http.Handler {
 	r := chi.NewRouter()
 	r.Get("/", getGroups)
 

hub/route/patch_android.go

@@ -0,0 +1,7 @@
+//go:build android && cmfa
+
+package route
+
+func init() {
+	SetEmbedMode(true) // set embed mode default
+}

hub/route/server.go

@@ -36,8 +36,14 @@ var (
 	tlsServer  *http.Server
 	unixServer *http.Server
 	pipeServer *http.Server
+
+	embedMode = false
 )
 
+func SetEmbedMode(embed bool) {
+	embedMode = embed
+}
+
 type Traffic struct {
 	Up   int64 `json:"up"`
 	Down int64 `json:"down"`
@@ -114,15 +120,17 @@ func router(isDebug bool, secret string, dohServer string, cors Cors) *chi.Mux {
 		r.Get("/version", version)
 		r.Mount("/configs", configRouter())
 		r.Mount("/proxies", proxyRouter())
-		r.Mount("/group", GroupRouter())
+		r.Mount("/group", groupRouter())
 		r.Mount("/rules", ruleRouter())
 		r.Mount("/connections", connectionRouter())
 		r.Mount("/providers/proxies", proxyProviderRouter())
 		r.Mount("/providers/rules", ruleProviderRouter())
 		r.Mount("/cache", cacheRouter())
 		r.Mount("/dns", dnsRouter())
+		if !embedMode { // disallow restart and upgrade in embed mode
 			r.Mount("/restart", restartRouter())
 			r.Mount("/upgrade", upgradeRouter())
+		}
 		addExternalRouters(r)
 
 	})