344 lines
10 KiB
Go
344 lines
10 KiB
Go
package httpapi
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"errors"
|
||
"fmt"
|
||
"net/http"
|
||
"net/url"
|
||
"strings"
|
||
"sync"
|
||
"time"
|
||
|
||
"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/identity"
|
||
)
|
||
|
||
const (
|
||
passwordRateLimitAttempts = 30
|
||
passwordRateLimitWindow = 15 * time.Minute
|
||
)
|
||
|
||
// PasswordSessionIssuer is the HTTP adapter's consumer-owned Identity seam.
|
||
type PasswordSessionIssuer interface {
|
||
Login(context.Context, identity.LoginCommand) (identity.Session, error)
|
||
}
|
||
|
||
// PasswordAuthConfig contains transport configuration for password login.
|
||
// CookieSecure retains the legacy string tri-state (recognized true/false or
|
||
// empty/unrecognized for URL-based resolution).
|
||
type PasswordAuthConfig struct {
|
||
Configured bool
|
||
SessionSecret string
|
||
CookieSecure string
|
||
PublicBaseURL string
|
||
}
|
||
|
||
type authPasswordHandler struct {
|
||
config PasswordAuthConfig
|
||
issuer PasswordSessionIssuer
|
||
limiter *passwordIPLimiter
|
||
}
|
||
|
||
// NewAuthPasswordHandler builds the standalone password-login HTTP adapter.
|
||
func NewAuthPasswordHandler(config PasswordAuthConfig, issuer PasswordSessionIssuer) (http.Handler, error) {
|
||
if config.Configured && issuer == nil {
|
||
return nil, fmt.Errorf("auth/password: configured authentication requires a session issuer")
|
||
}
|
||
return &authPasswordHandler{config: config, issuer: issuer, limiter: newPasswordIPLimiter(time.Now)}, nil
|
||
}
|
||
|
||
func (handler *authPasswordHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||
if r.URL.Path != "/api/auth/password" {
|
||
w.WriteHeader(http.StatusNotFound)
|
||
return
|
||
}
|
||
if r.Method == http.MethodOptions {
|
||
w.Header().Set("Allow", "OPTIONS, POST")
|
||
w.WriteHeader(http.StatusNoContent)
|
||
return
|
||
}
|
||
if r.Method != http.MethodPost {
|
||
w.WriteHeader(http.StatusMethodNotAllowed)
|
||
return
|
||
}
|
||
if !handler.config.Configured || strings.TrimSpace(handler.config.SessionSecret) == "" {
|
||
writePasswordJSON(w, http.StatusServiceUnavailable, map[string]any{"error": "账号认证配置不完整：ZHINIAN_AUTH_SESSION_SECRET"})
|
||
return
|
||
}
|
||
|
||
ip := passwordRequestIP(r)
|
||
if !handler.limiter.allow(ip) {
|
||
writePasswordJSON(w, http.StatusTooManyRequests, map[string]any{"error": "请求过于频繁，请稍后再试。"})
|
||
return
|
||
}
|
||
command, next := decodePasswordRequest(r)
|
||
session, err := handler.issuer.Login(r.Context(), command)
|
||
if err != nil {
|
||
status, message, known := passwordLoginErrorResponse(err)
|
||
if !known {
|
||
writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
|
||
return
|
||
}
|
||
writePasswordJSON(w, status, map[string]any{"error": message})
|
||
return
|
||
}
|
||
// A credential success resets the per-process attempt budget even if later
|
||
// response serialization fails, matching the legacy lifecycle boundary.
|
||
handler.limiter.clear(ip)
|
||
|
||
rawSession, err := json.Marshal(session)
|
||
if err != nil {
|
||
writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
|
||
return
|
||
}
|
||
signed, err := identity.Sign(rawSession, handler.config.SessionSecret)
|
||
if err != nil {
|
||
writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
|
||
return
|
||
}
|
||
secure := identity.ResolveSecureCookie(handler.config.CookieSecure, handler.config.PublicBaseURL, absoluteRequestURL(r))
|
||
writes, err := identity.SetSessionCookies(signed, time.Unix(session.ExpiresAt, 0).UTC(), secure)
|
||
if err != nil {
|
||
writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
|
||
return
|
||
}
|
||
|
||
// Complete all potentially failing serialization before mutating headers.
|
||
response := map[string]any{
|
||
"ok": true,
|
||
"redirectTo": safePasswordNext(next),
|
||
"user": passwordPublicUser(session.User),
|
||
"authMode": session.AuthMode,
|
||
}
|
||
payload, err := json.Marshal(response)
|
||
if err != nil {
|
||
writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
|
||
return
|
||
}
|
||
for _, write := range writes {
|
||
http.SetCookie(w, transportCookie(write))
|
||
}
|
||
w.Header().Set("Content-Type", "application/json")
|
||
w.WriteHeader(http.StatusOK)
|
||
_, _ = w.Write(payload)
|
||
}
|
||
|
||
type passwordRequest struct {
|
||
Phone any `json:"phone"`
|
||
Username any `json:"username"`
|
||
Password any `json:"password"`
|
||
Next any `json:"next"`
|
||
}
|
||
|
||
func decodePasswordRequest(r *http.Request) (identity.LoginCommand, string) {
|
||
var body passwordRequest
|
||
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
|
||
return identity.LoginCommand{}, ""
|
||
}
|
||
phone := stringValue(body.Phone)
|
||
if phone == "" {
|
||
phone = stringValue(body.Username)
|
||
}
|
||
return identity.LoginCommand{Phone: phone, Password: stringValue(body.Password)}, stringValue(body.Next)
|
||
}
|
||
|
||
func stringValue(value any) string {
|
||
text, ok := value.(string)
|
||
if !ok {
|
||
return ""
|
||
}
|
||
return strings.TrimSpace(text)
|
||
}
|
||
|
||
func safePasswordNext(value string) string {
|
||
value = strings.TrimSpace(value)
|
||
if value == "" || !strings.HasPrefix(value, "/") || strings.HasPrefix(value, "//") || strings.Contains(value, "\\") {
|
||
return "/create"
|
||
}
|
||
parsed, err := url.Parse(value)
|
||
if err != nil || parsed.IsAbs() || parsed.Host != "" {
|
||
return "/create"
|
||
}
|
||
// WHATWG URL parsing removes literal and percent-encoded dot segments but
|
||
// otherwise preserves the original path escaping. Go exposes RawPath for
|
||
// that representation, so normalize its segments without decoding %2F.
|
||
canonicalPath := canonicalPasswordPath(parsed.EscapedPath())
|
||
if strings.HasPrefix(canonicalPath, "/api/auth") || strings.HasPrefix(canonicalPath, "/auth/login") || strings.HasPrefix(canonicalPath, "/auth/admin-login") {
|
||
return "/create"
|
||
}
|
||
result := canonicalPath
|
||
if parsed.RawQuery != "" {
|
||
result += "?" + parsed.RawQuery
|
||
}
|
||
if parsed.Fragment != "" {
|
||
result += "#" + parsed.EscapedFragment()
|
||
}
|
||
return result
|
||
}
|
||
|
||
func canonicalPasswordPath(value string) string {
|
||
segments := strings.Split(value, "/")
|
||
canonical := make([]string, 0, len(segments))
|
||
trailingDot := false
|
||
for _, segment := range segments {
|
||
switch {
|
||
case passwordDotSegment(segment) == 1:
|
||
trailingDot = true
|
||
continue
|
||
case passwordDotSegment(segment) == 2:
|
||
if len(canonical) > 1 {
|
||
canonical = canonical[:len(canonical)-1]
|
||
}
|
||
trailingDot = true
|
||
default:
|
||
canonical = append(canonical, segment)
|
||
trailingDot = false
|
||
}
|
||
}
|
||
if trailingDot {
|
||
canonical = append(canonical, "")
|
||
}
|
||
result := strings.Join(canonical, "/")
|
||
if result == "" {
|
||
return "/"
|
||
}
|
||
return result
|
||
}
|
||
|
||
func passwordDotSegment(segment string) int {
|
||
switch strings.ToLower(segment) {
|
||
case ".", "%2e":
|
||
return 1
|
||
case "..", ".%2e", "%2e.", "%2e%2e":
|
||
return 2
|
||
default:
|
||
return 0
|
||
}
|
||
}
|
||
|
||
func passwordPublicUser(user identity.User) publicUser {
|
||
authorities := user.Authorities
|
||
if authorities == nil {
|
||
authorities = []string{}
|
||
}
|
||
scope := user.Scope
|
||
if scope == nil {
|
||
scope = []string{}
|
||
}
|
||
return publicUser{
|
||
ID: user.ID, Subject: user.Subject, Username: user.Username, Phone: user.Phone,
|
||
DisplayName: user.DisplayName, ClientID: user.ClientID, OrganizationID: user.OrganizationID,
|
||
OrganizationName: user.OrganizationName, Role: user.Role, Status: user.Status,
|
||
Authorities: authorities, Scope: scope,
|
||
}
|
||
}
|
||
|
||
func passwordLoginErrorResponse(err error) (int, string, bool) {
|
||
var loginErr *identity.PasswordLoginError
|
||
if !errors.As(err, &loginErr) {
|
||
return 0, "", false
|
||
}
|
||
switch loginErr.Reason {
|
||
case identity.LoginFailureInvalidInput:
|
||
return http.StatusBadRequest, "手机号和密码不能为空。", true
|
||
case identity.LoginFailureInvalidCredentials:
|
||
return http.StatusUnauthorized, "手机号或密码错误。", true
|
||
case identity.LoginFailureAccountDisabled:
|
||
return http.StatusForbidden, "账号已停用，请联系管理员。", true
|
||
case identity.LoginFailureInvalidRole, identity.LoginFailureOrganizationRequired, identity.LoginFailureOrganizationNotActive:
|
||
return http.StatusForbidden, "所属组织已停用，请联系管理员。", true
|
||
case identity.LoginFailureAccountLocked:
|
||
return http.StatusLocked, "登录失败次数过多，请 15 分钟后再试。", true
|
||
default:
|
||
return 0, "", false
|
||
}
|
||
}
|
||
|
||
func writePasswordJSON(w http.ResponseWriter, status int, value any) {
|
||
payload, err := json.Marshal(value)
|
||
if err != nil {
|
||
w.WriteHeader(http.StatusInternalServerError)
|
||
return
|
||
}
|
||
w.Header().Set("Content-Type", "application/json")
|
||
w.WriteHeader(status)
|
||
_, _ = w.Write(payload)
|
||
}
|
||
|
||
func transportCookie(write identity.CookieWrite) *http.Cookie {
|
||
cookie := &http.Cookie{Name: write.Name, Value: write.Value, Path: write.Attributes.Path, HttpOnly: write.Attributes.HTTPOnly, Secure: write.Attributes.Secure}
|
||
if strings.EqualFold(write.Attributes.SameSite, "lax") {
|
||
cookie.SameSite = http.SameSiteLaxMode
|
||
}
|
||
if write.Attributes.Expires != nil {
|
||
cookie.Expires = *write.Attributes.Expires
|
||
}
|
||
if write.Attributes.MaxAgeSeconds != nil {
|
||
if *write.Attributes.MaxAgeSeconds == 0 {
|
||
cookie.MaxAge = -1
|
||
} else {
|
||
cookie.MaxAge = *write.Attributes.MaxAgeSeconds
|
||
}
|
||
}
|
||
return cookie
|
||
}
|
||
|
||
func absoluteRequestURL(r *http.Request) string {
|
||
if r.URL.IsAbs() {
|
||
return r.URL.String()
|
||
}
|
||
scheme := "http"
|
||
if r.TLS != nil {
|
||
scheme = "https"
|
||
}
|
||
return scheme + "://" + r.Host + r.URL.RequestURI()
|
||
}
|
||
|
||
func passwordRequestIP(r *http.Request) string {
|
||
if forwarded := strings.TrimSpace(strings.Split(r.Header.Get("X-Forwarded-For"), ",")[0]); forwarded != "" {
|
||
return forwarded
|
||
}
|
||
if realIP := strings.TrimSpace(r.Header.Get("X-Real-IP")); realIP != "" {
|
||
return realIP
|
||
}
|
||
return "unknown"
|
||
}
|
||
|
||
type passwordRateLimitEntry struct {
|
||
count int
|
||
expiresAt time.Time
|
||
}
|
||
type passwordIPLimiter struct {
|
||
mu sync.Mutex
|
||
entries map[string]passwordRateLimitEntry
|
||
now func() time.Time
|
||
}
|
||
|
||
func newPasswordIPLimiter(now func() time.Time) *passwordIPLimiter {
|
||
return &passwordIPLimiter{entries: make(map[string]passwordRateLimitEntry), now: now}
|
||
}
|
||
|
||
func (limiter *passwordIPLimiter) allow(ip string) bool {
|
||
limiter.mu.Lock()
|
||
defer limiter.mu.Unlock()
|
||
now := limiter.now()
|
||
entry, ok := limiter.entries[ip]
|
||
if !ok || !now.Before(entry.expiresAt) {
|
||
entry = passwordRateLimitEntry{expiresAt: now.Add(passwordRateLimitWindow)}
|
||
}
|
||
if entry.count >= passwordRateLimitAttempts {
|
||
limiter.entries[ip] = entry
|
||
return false
|
||
}
|
||
entry.count++
|
||
limiter.entries[ip] = entry
|
||
return true
|
||
}
|
||
|
||
func (limiter *passwordIPLimiter) clear(ip string) {
|
||
limiter.mu.Lock()
|
||
defer limiter.mu.Unlock()
|
||
delete(limiter.entries, ip)
|
||
}
|