feat: backend core - auth, user, role, permission, device, webhook, monitoring, cache, repository, service, middleware, API handlers
This commit is contained in:
62
.gitignore
vendored
Normal file
62
.gitignore
vendored
Normal file
@@ -0,0 +1,62 @@
|
|||||||
|
# Binaries
|
||||||
|
bin/
|
||||||
|
*.exe
|
||||||
|
*.exe~
|
||||||
|
*.dll
|
||||||
|
*.so
|
||||||
|
*.dylib
|
||||||
|
|
||||||
|
# Test binary, built with `go test -c`
|
||||||
|
*.test
|
||||||
|
|
||||||
|
# Output of the go coverage tool
|
||||||
|
*.out
|
||||||
|
|
||||||
|
# Dependency directories
|
||||||
|
vendor/
|
||||||
|
|
||||||
|
# Go workspace file
|
||||||
|
go.work
|
||||||
|
|
||||||
|
# IDE
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
|
|
||||||
|
# Build
|
||||||
|
build/
|
||||||
|
dist/
|
||||||
|
|
||||||
|
# Database
|
||||||
|
data/*.db
|
||||||
|
data/*.db-shm
|
||||||
|
data/*.db-wal
|
||||||
|
data/jwt/*.pem
|
||||||
|
|
||||||
|
# Logs
|
||||||
|
logs/*.log
|
||||||
|
*.log
|
||||||
|
|
||||||
|
# Local caches and temp artifacts
|
||||||
|
.cache/
|
||||||
|
.tmp/
|
||||||
|
.gocache/
|
||||||
|
.gomodcache/
|
||||||
|
frontend/admin/.cache/
|
||||||
|
frontend/admin/playwright-report/
|
||||||
|
|
||||||
|
# OS
|
||||||
|
.DS_Store
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Environment
|
||||||
|
.env
|
||||||
|
.env.local
|
||||||
|
|
||||||
|
# Node modules
|
||||||
|
node_modules/
|
||||||
|
|
||||||
|
# NPM cache
|
||||||
|
frontend/admin/.npm-cache/
|
||||||
88
AGENTS.md
Normal file
88
AGENTS.md
Normal file
@@ -0,0 +1,88 @@
|
|||||||
|
# AGENTS.md
|
||||||
|
|
||||||
|
本文件适用于整个仓库。
|
||||||
|
|
||||||
|
## 1. 项目目标
|
||||||
|
|
||||||
|
- 目标不是“看起来完成”，而是形成可验证、可审计、可上线的真实闭环。
|
||||||
|
- 任何“已完成”“已收口”“可上线”的表述，都必须以本地实际执行过的命令和证据为依据。
|
||||||
|
|
||||||
|
## 2. 真实边界
|
||||||
|
|
||||||
|
- 当前受支持的真实浏览器主验收路径是：
|
||||||
|
- `cd frontend/admin && npm.cmd run e2e:full:win`
|
||||||
|
- 当前可诚实宣称的是“浏览器级真实 E2E 已闭环”，不是“完整 OS 级自动化已闭环”。
|
||||||
|
- `smoke` 脚本仅用于补充诊断，不能被当成产品运行时依赖，也不能被当成主验收结论。
|
||||||
|
- `agent-browser` 目前只能辅助观察和诊断，不能替代受支持的项目 E2E 主链路。
|
||||||
|
|
||||||
|
## 3. 运行时规则
|
||||||
|
|
||||||
|
- 禁止在非测试代码中保留 `panic` 作为常规失败路径。
|
||||||
|
- 禁止运行时使用 mock provider、fake success 或“假成功返回”掩盖真实依赖缺失。
|
||||||
|
- 邮件、短信、OAuth、文件上传、外部调用必须 fail closed，不能失败后伪装成功。
|
||||||
|
- 对外部副作用必须考虑回滚：
|
||||||
|
- 文件写入失败要清理半成品
|
||||||
|
- 持久化失败要回滚已创建的文件或缓存状态
|
||||||
|
- 安全敏感接口必须保持 `no-store` 等防缓存约束。
|
||||||
|
- 前端原生弹窗和弹出页视为缺陷信号：
|
||||||
|
- `window.alert`
|
||||||
|
- `window.confirm`
|
||||||
|
- `window.prompt`
|
||||||
|
- `window.open`
|
||||||
|
|
||||||
|
## 4. 设计规则
|
||||||
|
|
||||||
|
- 优先使用显式错误分类，不要依赖字符串子串猜测错误类型。
|
||||||
|
- service 层依赖接口能力，不依赖具体 repository 实现断言。
|
||||||
|
- 配置模板中的敏感值必须留空或使用占位说明，真实密钥只能通过环境变量或密钥管理系统注入。
|
||||||
|
- release 约束必须在启动期失败，而不是运行中放任危险配置继续启动。
|
||||||
|
|
||||||
|
## 5. 编码与编码问题
|
||||||
|
|
||||||
|
- 如果终端显示乱码，不要把终端渲染出来的中文直接复制回业务逻辑。
|
||||||
|
- 遇到编码不稳定场景时，优先使用：
|
||||||
|
- ASCII 文本
|
||||||
|
- `\uXXXX` 转义
|
||||||
|
- 显式错误类型
|
||||||
|
- 如果局部补丁频繁被编码噪音阻断，优先整段或整文件重写，不要继续赌字符串匹配。
|
||||||
|
|
||||||
|
## 6. 最低验证矩阵
|
||||||
|
|
||||||
|
- 只改后端时，至少执行：
|
||||||
|
- `go test ./... -count=1`
|
||||||
|
- `go vet ./...`
|
||||||
|
- `go build ./cmd/server`
|
||||||
|
- 改前端时，至少执行：
|
||||||
|
- `cd frontend/admin && npm.cmd run lint`
|
||||||
|
- `cd frontend/admin && npm.cmd run build`
|
||||||
|
- 只要改动涉及以下任一类，就必须补真实浏览器回归：
|
||||||
|
- 认证
|
||||||
|
- 会话
|
||||||
|
- 路由守卫
|
||||||
|
- 导航
|
||||||
|
- 弹窗保护
|
||||||
|
- 用户主流程
|
||||||
|
- `window` 相关防线
|
||||||
|
- 影响登录页或后台主导航的改动
|
||||||
|
- 命令：`cd frontend/admin && npm.cmd run e2e:full:win`
|
||||||
|
|
||||||
|
## 7. 文档同步规则
|
||||||
|
|
||||||
|
- 改变真实结论时，必须同步更新：
|
||||||
|
- `docs/status/REAL_PROJECT_STATUS.md`
|
||||||
|
- 沉淀长期工程约束时，优先更新：
|
||||||
|
- `docs/team/QUALITY_STANDARD.md`
|
||||||
|
- `docs/team/PRODUCTION_CHECKLIST.md`
|
||||||
|
- `docs/team/TECHNICAL_GUIDE.md`
|
||||||
|
- 形成阶段性经验总结时，沉淀到：
|
||||||
|
- `docs/team/PROJECT_EXPERIENCE_SUMMARY.md`
|
||||||
|
|
||||||
|
## 8. 对外表述规则
|
||||||
|
|
||||||
|
- 允许说：
|
||||||
|
- “浏览器级真实 E2E 已闭环”
|
||||||
|
- “本地可审计的一轮治理证据已形成”
|
||||||
|
- 不允许夸大成：
|
||||||
|
- “完整 OS 级自动化已闭环”
|
||||||
|
- “全部企业级生产治理材料都已闭环”
|
||||||
|
- 若仍缺少真实第三方 OAuth live 验证、外部 Secrets/KMS、多环境交付证据或 schema downgrade 回滚证据，必须明确说明。
|
||||||
47
Makefile
Normal file
47
Makefile
Normal file
@@ -0,0 +1,47 @@
|
|||||||
|
.PHONY: help build run test clean vet tidy check run-check db-dir
|
||||||
|
|
||||||
|
help: ## 显示帮助信息
|
||||||
|
@echo "======================================"
|
||||||
|
@echo "用户管理系统 - Makefile"
|
||||||
|
@echo "======================================"
|
||||||
|
@echo "可用命令:"
|
||||||
|
@echo " make check - 全面检查（依赖+vet+编译+测试）"
|
||||||
|
@echo " make build - 构建应用"
|
||||||
|
@echo " make run - 运行应用"
|
||||||
|
@echo " make test - 运行测试"
|
||||||
|
@echo " make vet - 代码静态检查"
|
||||||
|
@echo " make tidy - 整理依赖"
|
||||||
|
@echo " make db-dir - 创建数据库目录"
|
||||||
|
@echo " make clean - 清理构建文件"
|
||||||
|
@echo ""
|
||||||
|
|
||||||
|
check: tidy vet build test ## 全面检查：依赖+静态检查+编译+测试
|
||||||
|
|
||||||
|
tidy: ## 整理Go模块依赖
|
||||||
|
@echo "整理依赖..."
|
||||||
|
go mod tidy
|
||||||
|
go mod download
|
||||||
|
|
||||||
|
vet: ## 运行静态代码检查
|
||||||
|
@echo "运行静态检查..."
|
||||||
|
go vet ./...
|
||||||
|
|
||||||
|
build: db-dir ## 构建应用
|
||||||
|
@echo "构建应用..."
|
||||||
|
go build -o bin/server cmd/server/main.go
|
||||||
|
|
||||||
|
run: db-dir ## 运行应用
|
||||||
|
@echo "运行应用..."
|
||||||
|
go run cmd/server/main.go
|
||||||
|
|
||||||
|
test: ## 运行测试
|
||||||
|
@echo "运行测试..."
|
||||||
|
go test -short -race ./...
|
||||||
|
|
||||||
|
db-dir: ## 创建数据库目录
|
||||||
|
@if [ ! -d "data" ]; then mkdir data; fi
|
||||||
|
|
||||||
|
clean: ## 清理构建文件
|
||||||
|
@echo "清理构建文件..."
|
||||||
|
rm -rf bin/
|
||||||
|
rm -f server.exe
|
||||||
229
cmd/server/main.go
Normal file
229
cmd/server/main.go
Normal file
@@ -0,0 +1,229 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
"os"
|
||||||
|
"os/signal"
|
||||||
|
"syscall"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/api/handler"
|
||||||
|
"github.com/user-management-system/internal/api/middleware"
|
||||||
|
"github.com/user-management-system/internal/api/router"
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
"github.com/user-management-system/internal/cache"
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
"github.com/user-management-system/internal/database"
|
||||||
|
"github.com/user-management-system/internal/repository"
|
||||||
|
"github.com/user-management-system/internal/security"
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
// 加载配置
|
||||||
|
cfg, err := config.Load()
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("load config failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 设置 Gin 模式
|
||||||
|
gin.SetMode(resolveGinMode(cfg.Server.Mode))
|
||||||
|
|
||||||
|
// 初始化数据库
|
||||||
|
db, err := database.NewDB(cfg)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("connect database failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 执行数据库迁移
|
||||||
|
if err := db.AutoMigrate(cfg); err != nil {
|
||||||
|
log.Fatalf("auto migrate failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 初始化 JWT 管理器
|
||||||
|
jwtManager, err := auth.NewJWTWithOptions(auth.JWTOptions{
|
||||||
|
HS256Secret: cfg.JWT.Secret,
|
||||||
|
AccessTokenExpire: time.Duration(cfg.JWT.AccessTokenExpireMinutes) * time.Minute,
|
||||||
|
RefreshTokenExpire: time.Duration(cfg.JWT.RefreshTokenExpireDays) * 24 * time.Hour,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("create jwt manager failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 初始化缓存
|
||||||
|
l1Cache := cache.NewL1Cache()
|
||||||
|
l2Cache := cache.NewRedisCacheWithConfig(cache.RedisCacheConfig{
|
||||||
|
Addr: fmt.Sprintf("%s:%d", cfg.Redis.Host, cfg.Redis.Port),
|
||||||
|
Password: cfg.Redis.Password,
|
||||||
|
DB: cfg.Redis.DB,
|
||||||
|
})
|
||||||
|
defer l2Cache.Close()
|
||||||
|
cacheManager := cache.NewCacheManager(l1Cache, l2Cache)
|
||||||
|
|
||||||
|
// 初始化 Repository
|
||||||
|
userRepo := repository.NewUserRepository(db.DB)
|
||||||
|
roleRepo := repository.NewRoleRepository(db.DB)
|
||||||
|
permissionRepo := repository.NewPermissionRepository(db.DB)
|
||||||
|
userRoleRepo := repository.NewUserRoleRepository(db.DB)
|
||||||
|
rolePermissionRepo := repository.NewRolePermissionRepository(db.DB)
|
||||||
|
deviceRepo := repository.NewDeviceRepository(db.DB)
|
||||||
|
loginLogRepo := repository.NewLoginLogRepository(db.DB)
|
||||||
|
operationLogRepo := repository.NewOperationLogRepository(db.DB)
|
||||||
|
customFieldRepo := repository.NewCustomFieldRepository(db.DB)
|
||||||
|
userCustomFieldValueRepo := repository.NewUserCustomFieldValueRepository(db.DB)
|
||||||
|
themeRepo := repository.NewThemeConfigRepository(db.DB)
|
||||||
|
socialRepo, err := repository.NewSocialAccountRepository(db.DB)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("initialize social account repository failed: %v", err)
|
||||||
|
}
|
||||||
|
passwordHistoryRepo := repository.NewPasswordHistoryRepository(db.DB)
|
||||||
|
|
||||||
|
// 初始化 Service
|
||||||
|
deviceService := service.NewDeviceService(deviceRepo, userRepo)
|
||||||
|
authService := service.NewAuthService(
|
||||||
|
userRepo,
|
||||||
|
socialRepo,
|
||||||
|
jwtManager,
|
||||||
|
cacheManager,
|
||||||
|
8, // passwordMinLength
|
||||||
|
5, // maxLoginAttempts
|
||||||
|
15*time.Minute, // loginLockDuration
|
||||||
|
)
|
||||||
|
authService.SetRoleRepositories(userRoleRepo, roleRepo)
|
||||||
|
authService.SetLoginLogRepository(loginLogRepo)
|
||||||
|
authService.SetDeviceService(deviceService)
|
||||||
|
|
||||||
|
// IP 过滤中间件
|
||||||
|
var ipFilterMiddleware *middleware.IPFilterMiddleware
|
||||||
|
ipFilter := security.NewIPFilter()
|
||||||
|
if ipFilter != nil {
|
||||||
|
ipFilterMiddleware = middleware.NewIPFilterMiddleware(ipFilter, middleware.IPFilterConfig{
|
||||||
|
TrustProxy: cfg.CORS.AllowCredentials,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// 初始化异常检测器并注入
|
||||||
|
anomalyDetector := security.NewAnomalyDetector(security.DefaultAnomalyConfig, ipFilter)
|
||||||
|
authService.SetAnomalyDetector(anomalyDetector)
|
||||||
|
log.Println("anomaly detector initialized")
|
||||||
|
|
||||||
|
userService := service.NewUserService(userRepo, userRoleRepo, roleRepo, passwordHistoryRepo)
|
||||||
|
roleService := service.NewRoleService(roleRepo, rolePermissionRepo)
|
||||||
|
permissionService := service.NewPermissionService(permissionRepo)
|
||||||
|
loginLogService := service.NewLoginLogService(loginLogRepo)
|
||||||
|
operationLogService := service.NewOperationLogService(operationLogRepo)
|
||||||
|
captchaService := service.NewCaptchaService(cacheManager)
|
||||||
|
totpService := service.NewTOTPService(userRepo)
|
||||||
|
|
||||||
|
passwordResetConfig := service.DefaultPasswordResetConfig()
|
||||||
|
passwordResetService := service.NewPasswordResetService(userRepo, cacheManager, passwordResetConfig)
|
||||||
|
|
||||||
|
webhookService := service.NewWebhookService(db.DB, service.WebhookServiceConfig{
|
||||||
|
Enabled: false,
|
||||||
|
})
|
||||||
|
exportService := service.NewExportService(userRepo, roleRepo)
|
||||||
|
statsService := service.NewStatsService(userRepo, loginLogRepo)
|
||||||
|
customFieldService := service.NewCustomFieldService(customFieldRepo, userCustomFieldValueRepo)
|
||||||
|
themeService := service.NewThemeService(themeRepo)
|
||||||
|
|
||||||
|
// 设置 CORS 配置
|
||||||
|
middleware.SetCORSConfig(cfg.CORS)
|
||||||
|
|
||||||
|
// 初始化中间件
|
||||||
|
rateLimitMiddleware := middleware.NewRateLimitMiddleware(cfg.RateLimit)
|
||||||
|
authMiddleware := middleware.NewAuthMiddleware(
|
||||||
|
jwtManager,
|
||||||
|
userRepo,
|
||||||
|
userRoleRepo,
|
||||||
|
roleRepo,
|
||||||
|
rolePermissionRepo,
|
||||||
|
permissionRepo,
|
||||||
|
)
|
||||||
|
authMiddleware.SetCacheManager(cacheManager)
|
||||||
|
|
||||||
|
opLogMiddleware := middleware.NewOperationLogMiddleware(operationLogRepo)
|
||||||
|
|
||||||
|
// 初始化 Handler
|
||||||
|
authHandler := handler.NewAuthHandler(authService)
|
||||||
|
userHandler := handler.NewUserHandler(userService)
|
||||||
|
roleHandler := handler.NewRoleHandler(roleService)
|
||||||
|
permissionHandler := handler.NewPermissionHandler(permissionService)
|
||||||
|
deviceHandler := handler.NewDeviceHandler(deviceService)
|
||||||
|
logHandler := handler.NewLogHandler(loginLogService, operationLogService)
|
||||||
|
captchaHandler := handler.NewCaptchaHandler(captchaService)
|
||||||
|
totpHandler := handler.NewTOTPHandler(authService, totpService)
|
||||||
|
webhookHandler := handler.NewWebhookHandler(webhookService)
|
||||||
|
exportHandler := handler.NewExportHandler(exportService)
|
||||||
|
statsHandler := handler.NewStatsHandler(statsService)
|
||||||
|
passwordResetHandler := handler.NewPasswordResetHandler(passwordResetService)
|
||||||
|
smsHandler := handler.NewSMSHandler()
|
||||||
|
avatarHandler := handler.NewAvatarHandler()
|
||||||
|
customFieldHandler := handler.NewCustomFieldHandler(customFieldService)
|
||||||
|
themeHandler := handler.NewThemeHandler(themeService)
|
||||||
|
|
||||||
|
// 初始化 SSO 管理器
|
||||||
|
ssoManager := auth.NewSSOManager()
|
||||||
|
ssoHandler := handler.NewSSOHandler(ssoManager)
|
||||||
|
|
||||||
|
// 设置路由
|
||||||
|
r := router.NewRouter(
|
||||||
|
authHandler, userHandler, roleHandler, permissionHandler, deviceHandler,
|
||||||
|
logHandler, authMiddleware, rateLimitMiddleware, opLogMiddleware,
|
||||||
|
passwordResetHandler, captchaHandler, totpHandler, webhookHandler,
|
||||||
|
ipFilterMiddleware, exportHandler, statsHandler, smsHandler, customFieldHandler, themeHandler, ssoHandler, avatarHandler,
|
||||||
|
)
|
||||||
|
engine := r.Setup()
|
||||||
|
|
||||||
|
// 健康检查
|
||||||
|
engine.GET("/health", func(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"status": "ok"})
|
||||||
|
})
|
||||||
|
|
||||||
|
// 启动服务器
|
||||||
|
addr := fmt.Sprintf(":%d", cfg.Server.Port)
|
||||||
|
srv := &http.Server{
|
||||||
|
Addr: addr,
|
||||||
|
Handler: engine,
|
||||||
|
ReadTimeout: 30 * time.Second,
|
||||||
|
WriteTimeout: 30 * time.Second,
|
||||||
|
}
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
log.Printf("server listening on %s", addr)
|
||||||
|
if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
|
||||||
|
log.Fatalf("listen failed: %v", err)
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
|
||||||
|
// 等待中断信号
|
||||||
|
quit := make(chan os.Signal, 1)
|
||||||
|
signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
|
||||||
|
<-quit
|
||||||
|
|
||||||
|
log.Println("shutting down server...")
|
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
|
||||||
|
defer cancel()
|
||||||
|
|
||||||
|
if err := srv.Shutdown(ctx); err != nil {
|
||||||
|
log.Fatalf("server forced to shutdown: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Println("server exited")
|
||||||
|
}
|
||||||
|
|
||||||
|
func resolveGinMode(mode string) string {
|
||||||
|
switch mode {
|
||||||
|
case "debug":
|
||||||
|
return gin.DebugMode
|
||||||
|
case "test":
|
||||||
|
return gin.TestMode
|
||||||
|
default:
|
||||||
|
return gin.ReleaseMode
|
||||||
|
}
|
||||||
|
}
|
||||||
212
config/config.yaml
Normal file
212
config/config.yaml
Normal file
@@ -0,0 +1,212 @@
|
|||||||
|
server:
|
||||||
|
port: 8080
|
||||||
|
mode: release # debug, release
|
||||||
|
read_timeout: 30
|
||||||
|
read_header_timeout: 10
|
||||||
|
write_timeout: 30
|
||||||
|
idle_timeout: 60
|
||||||
|
shutdown_timeout: 15
|
||||||
|
max_header_bytes: 1048576
|
||||||
|
|
||||||
|
database:
|
||||||
|
type: sqlite # current runtime support: sqlite
|
||||||
|
sqlite:
|
||||||
|
path: ./data/user_management.db
|
||||||
|
postgresql:
|
||||||
|
host: localhost
|
||||||
|
port: 5432
|
||||||
|
database: user_management
|
||||||
|
username: postgres
|
||||||
|
password: ""
|
||||||
|
ssl_mode: disable
|
||||||
|
max_open_conns: 100
|
||||||
|
max_idle_conns: 10
|
||||||
|
mysql:
|
||||||
|
host: localhost
|
||||||
|
port: 3306
|
||||||
|
database: user_management
|
||||||
|
username: root
|
||||||
|
password: ""
|
||||||
|
charset: utf8mb4
|
||||||
|
max_open_conns: 100
|
||||||
|
max_idle_conns: 10
|
||||||
|
|
||||||
|
cache:
|
||||||
|
l1:
|
||||||
|
enabled: true
|
||||||
|
max_size: 10000
|
||||||
|
ttl: 5m
|
||||||
|
l2:
|
||||||
|
enabled: false
|
||||||
|
type: redis
|
||||||
|
redis:
|
||||||
|
addr: localhost:6379
|
||||||
|
password: ""
|
||||||
|
db: 0
|
||||||
|
pool_size: 50
|
||||||
|
ttl: 30m
|
||||||
|
|
||||||
|
redis:
|
||||||
|
enabled: false
|
||||||
|
addr: localhost:6379
|
||||||
|
password: ""
|
||||||
|
db: 0
|
||||||
|
|
||||||
|
jwt:
|
||||||
|
algorithm: HS256 # debug mode 使用 HS256
|
||||||
|
secret: "change-me-in-production-use-at-least-32-bytes-secret"
|
||||||
|
access_token_expire_minutes: 120 # 2小时
|
||||||
|
refresh_token_expire_days: 7 # 7天
|
||||||
|
|
||||||
|
security:
|
||||||
|
password_min_length: 8
|
||||||
|
password_require_special: true
|
||||||
|
password_require_number: true
|
||||||
|
login_max_attempts: 5
|
||||||
|
login_lock_duration: 30m
|
||||||
|
|
||||||
|
ratelimit:
|
||||||
|
enabled: true
|
||||||
|
login:
|
||||||
|
enabled: true
|
||||||
|
algorithm: token_bucket
|
||||||
|
capacity: 5
|
||||||
|
rate: 1
|
||||||
|
window: 1m
|
||||||
|
register:
|
||||||
|
enabled: true
|
||||||
|
algorithm: leaky_bucket
|
||||||
|
capacity: 3
|
||||||
|
rate: 1
|
||||||
|
window: 1h
|
||||||
|
api:
|
||||||
|
enabled: true
|
||||||
|
algorithm: sliding_window
|
||||||
|
capacity: 1000
|
||||||
|
window: 1m
|
||||||
|
|
||||||
|
monitoring:
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
path: /metrics
|
||||||
|
tracing:
|
||||||
|
enabled: false
|
||||||
|
endpoint: http://localhost:4318
|
||||||
|
service_name: user-management-system
|
||||||
|
|
||||||
|
logging:
|
||||||
|
level: info # debug, info, warn, error
|
||||||
|
format: json # json, text
|
||||||
|
output:
|
||||||
|
- stdout
|
||||||
|
- ./logs/app.log
|
||||||
|
rotation:
|
||||||
|
max_size: 100 # MB
|
||||||
|
max_age: 30 # days
|
||||||
|
max_backups: 10
|
||||||
|
|
||||||
|
admin:
|
||||||
|
username: ""
|
||||||
|
password: ""
|
||||||
|
email: ""
|
||||||
|
|
||||||
|
cors:
|
||||||
|
enabled: true
|
||||||
|
allowed_origins:
|
||||||
|
- "http://localhost:3000"
|
||||||
|
- "http://127.0.0.1:3000"
|
||||||
|
allowed_methods:
|
||||||
|
- GET
|
||||||
|
- POST
|
||||||
|
- PUT
|
||||||
|
- DELETE
|
||||||
|
- OPTIONS
|
||||||
|
allowed_headers:
|
||||||
|
- Authorization
|
||||||
|
- Content-Type
|
||||||
|
- X-Requested-With
|
||||||
|
- X-CSRF-Token
|
||||||
|
allow_credentials: true
|
||||||
|
max_age: 3600
|
||||||
|
|
||||||
|
email:
|
||||||
|
host: "" # 生产环境填写真实 SMTP Host
|
||||||
|
port: 587
|
||||||
|
username: ""
|
||||||
|
password: ""
|
||||||
|
from_email: ""
|
||||||
|
from_name: "用户管理系统"
|
||||||
|
|
||||||
|
sms:
|
||||||
|
enabled: false
|
||||||
|
provider: "" # aliyun, tencent；留空表示禁用短信能力
|
||||||
|
code_ttl: 5m
|
||||||
|
resend_cooldown: 1m
|
||||||
|
max_daily_limit: 10
|
||||||
|
aliyun:
|
||||||
|
access_key_id: ""
|
||||||
|
access_key_secret: ""
|
||||||
|
sign_name: ""
|
||||||
|
template_code: ""
|
||||||
|
endpoint: ""
|
||||||
|
region_id: "cn-hangzhou"
|
||||||
|
code_param_name: "code"
|
||||||
|
tencent:
|
||||||
|
secret_id: ""
|
||||||
|
secret_key: ""
|
||||||
|
app_id: ""
|
||||||
|
sign_name: ""
|
||||||
|
template_id: ""
|
||||||
|
region: "ap-guangzhou"
|
||||||
|
endpoint: ""
|
||||||
|
|
||||||
|
password_reset:
|
||||||
|
token_ttl: 15m
|
||||||
|
site_url: "http://localhost:8080"
|
||||||
|
|
||||||
|
# OAuth 社交登录配置（留空则禁用对应 Provider）
|
||||||
|
oauth:
|
||||||
|
google:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/google/callback"
|
||||||
|
wechat:
|
||||||
|
app_id: ""
|
||||||
|
app_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/wechat/callback"
|
||||||
|
github:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/github/callback"
|
||||||
|
qq:
|
||||||
|
app_id: ""
|
||||||
|
app_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/qq/callback"
|
||||||
|
alipay:
|
||||||
|
app_id: ""
|
||||||
|
private_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/alipay/callback"
|
||||||
|
sandbox: false
|
||||||
|
douyin:
|
||||||
|
client_key: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/douyin/callback"
|
||||||
|
|
||||||
|
# Webhook 全局配置
|
||||||
|
webhook:
|
||||||
|
enabled: true
|
||||||
|
secret_header: "X-Webhook-Signature" # 签名 Header 名称
|
||||||
|
timeout_sec: 30 # 单次投递超时（秒）
|
||||||
|
max_retries: 3 # 最大重试次数
|
||||||
|
retry_backoff: "exponential" # 退避策略：exponential / fixed
|
||||||
|
worker_count: 4 # 后台投递协程数
|
||||||
|
queue_size: 1000 # 投递队列大小
|
||||||
|
|
||||||
|
# IP 安全配置
|
||||||
|
ip_security:
|
||||||
|
auto_block_enabled: true # 是否启用自动封禁
|
||||||
|
auto_block_duration: 30m # 自动封禁时长
|
||||||
|
brute_force_threshold: 10 # 暴力破解阈值（窗口内失败次数）
|
||||||
|
detection_window: 15m # 检测时间窗口
|
||||||
|
|
||||||
|
|
||||||
212
configs/config.yaml
Normal file
212
configs/config.yaml
Normal file
@@ -0,0 +1,212 @@
|
|||||||
|
server:
|
||||||
|
port: 8080
|
||||||
|
mode: release # debug, release
|
||||||
|
read_timeout: 30
|
||||||
|
read_header_timeout: 10
|
||||||
|
write_timeout: 30
|
||||||
|
idle_timeout: 60
|
||||||
|
shutdown_timeout: 15
|
||||||
|
max_header_bytes: 1048576
|
||||||
|
|
||||||
|
database:
|
||||||
|
type: sqlite # current runtime support: sqlite
|
||||||
|
sqlite:
|
||||||
|
path: ./data/user_management.db
|
||||||
|
postgresql:
|
||||||
|
host: localhost
|
||||||
|
port: 5432
|
||||||
|
database: user_management
|
||||||
|
username: postgres
|
||||||
|
password: ""
|
||||||
|
ssl_mode: disable
|
||||||
|
max_open_conns: 100
|
||||||
|
max_idle_conns: 10
|
||||||
|
mysql:
|
||||||
|
host: localhost
|
||||||
|
port: 3306
|
||||||
|
database: user_management
|
||||||
|
username: root
|
||||||
|
password: ""
|
||||||
|
charset: utf8mb4
|
||||||
|
max_open_conns: 100
|
||||||
|
max_idle_conns: 10
|
||||||
|
|
||||||
|
cache:
|
||||||
|
l1:
|
||||||
|
enabled: true
|
||||||
|
max_size: 10000
|
||||||
|
ttl: 5m
|
||||||
|
l2:
|
||||||
|
enabled: false
|
||||||
|
type: redis
|
||||||
|
redis:
|
||||||
|
addr: localhost:6379
|
||||||
|
password: ""
|
||||||
|
db: 0
|
||||||
|
pool_size: 50
|
||||||
|
ttl: 30m
|
||||||
|
|
||||||
|
redis:
|
||||||
|
enabled: false
|
||||||
|
addr: localhost:6379
|
||||||
|
password: ""
|
||||||
|
db: 0
|
||||||
|
|
||||||
|
jwt:
|
||||||
|
algorithm: HS256 # debug mode 使用 HS256
|
||||||
|
secret: "change-me-in-production-use-at-least-32-bytes-secret"
|
||||||
|
access_token_expire_minutes: 120 # 2小时
|
||||||
|
refresh_token_expire_days: 7 # 7天
|
||||||
|
|
||||||
|
security:
|
||||||
|
password_min_length: 8
|
||||||
|
password_require_special: true
|
||||||
|
password_require_number: true
|
||||||
|
login_max_attempts: 5
|
||||||
|
login_lock_duration: 30m
|
||||||
|
|
||||||
|
ratelimit:
|
||||||
|
enabled: true
|
||||||
|
login:
|
||||||
|
enabled: true
|
||||||
|
algorithm: token_bucket
|
||||||
|
capacity: 5
|
||||||
|
rate: 1
|
||||||
|
window: 1m
|
||||||
|
register:
|
||||||
|
enabled: true
|
||||||
|
algorithm: leaky_bucket
|
||||||
|
capacity: 3
|
||||||
|
rate: 1
|
||||||
|
window: 1h
|
||||||
|
api:
|
||||||
|
enabled: true
|
||||||
|
algorithm: sliding_window
|
||||||
|
capacity: 1000
|
||||||
|
window: 1m
|
||||||
|
|
||||||
|
monitoring:
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
path: /metrics
|
||||||
|
tracing:
|
||||||
|
enabled: false
|
||||||
|
endpoint: http://localhost:4318
|
||||||
|
service_name: user-management-system
|
||||||
|
|
||||||
|
logging:
|
||||||
|
level: info # debug, info, warn, error
|
||||||
|
format: json # json, text
|
||||||
|
output:
|
||||||
|
- stdout
|
||||||
|
- ./logs/app.log
|
||||||
|
rotation:
|
||||||
|
max_size: 100 # MB
|
||||||
|
max_age: 30 # days
|
||||||
|
max_backups: 10
|
||||||
|
|
||||||
|
admin:
|
||||||
|
username: ""
|
||||||
|
password: ""
|
||||||
|
email: ""
|
||||||
|
|
||||||
|
cors:
|
||||||
|
enabled: true
|
||||||
|
allowed_origins:
|
||||||
|
- "http://localhost:3000"
|
||||||
|
- "http://127.0.0.1:3000"
|
||||||
|
allowed_methods:
|
||||||
|
- GET
|
||||||
|
- POST
|
||||||
|
- PUT
|
||||||
|
- DELETE
|
||||||
|
- OPTIONS
|
||||||
|
allowed_headers:
|
||||||
|
- Authorization
|
||||||
|
- Content-Type
|
||||||
|
- X-Requested-With
|
||||||
|
- X-CSRF-Token
|
||||||
|
allow_credentials: true
|
||||||
|
max_age: 3600
|
||||||
|
|
||||||
|
email:
|
||||||
|
host: "" # 生产环境填写真实 SMTP Host
|
||||||
|
port: 587
|
||||||
|
username: ""
|
||||||
|
password: ""
|
||||||
|
from_email: ""
|
||||||
|
from_name: "用户管理系统"
|
||||||
|
|
||||||
|
sms:
|
||||||
|
enabled: false
|
||||||
|
provider: "" # aliyun, tencent；留空表示禁用短信能力
|
||||||
|
code_ttl: 5m
|
||||||
|
resend_cooldown: 1m
|
||||||
|
max_daily_limit: 10
|
||||||
|
aliyun:
|
||||||
|
access_key_id: ""
|
||||||
|
access_key_secret: ""
|
||||||
|
sign_name: ""
|
||||||
|
template_code: ""
|
||||||
|
endpoint: ""
|
||||||
|
region_id: "cn-hangzhou"
|
||||||
|
code_param_name: "code"
|
||||||
|
tencent:
|
||||||
|
secret_id: ""
|
||||||
|
secret_key: ""
|
||||||
|
app_id: ""
|
||||||
|
sign_name: ""
|
||||||
|
template_id: ""
|
||||||
|
region: "ap-guangzhou"
|
||||||
|
endpoint: ""
|
||||||
|
|
||||||
|
password_reset:
|
||||||
|
token_ttl: 15m
|
||||||
|
site_url: "http://localhost:8080"
|
||||||
|
|
||||||
|
# OAuth 社交登录配置（留空则禁用对应 Provider）
|
||||||
|
oauth:
|
||||||
|
google:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/google/callback"
|
||||||
|
wechat:
|
||||||
|
app_id: ""
|
||||||
|
app_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/wechat/callback"
|
||||||
|
github:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/github/callback"
|
||||||
|
qq:
|
||||||
|
app_id: ""
|
||||||
|
app_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/qq/callback"
|
||||||
|
alipay:
|
||||||
|
app_id: ""
|
||||||
|
private_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/alipay/callback"
|
||||||
|
sandbox: false
|
||||||
|
douyin:
|
||||||
|
client_key: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/douyin/callback"
|
||||||
|
|
||||||
|
# Webhook 全局配置
|
||||||
|
webhook:
|
||||||
|
enabled: true
|
||||||
|
secret_header: "X-Webhook-Signature" # 签名 Header 名称
|
||||||
|
timeout_sec: 30 # 单次投递超时（秒）
|
||||||
|
max_retries: 3 # 最大重试次数
|
||||||
|
retry_backoff: "exponential" # 退避策略：exponential / fixed
|
||||||
|
worker_count: 4 # 后台投递协程数
|
||||||
|
queue_size: 1000 # 投递队列大小
|
||||||
|
|
||||||
|
# IP 安全配置
|
||||||
|
ip_security:
|
||||||
|
auto_block_enabled: true # 是否启用自动封禁
|
||||||
|
auto_block_duration: 30m # 自动封禁时长
|
||||||
|
brute_force_threshold: 10 # 暴力破解阈值（窗口内失败次数）
|
||||||
|
detection_window: 15m # 检测时间窗口
|
||||||
|
|
||||||
|
|
||||||
37
configs/oauth_config.example.yaml
Normal file
37
configs/oauth_config.example.yaml
Normal file
@@ -0,0 +1,37 @@
|
|||||||
|
# OAuth 配置参考模板
|
||||||
|
# 说明：
|
||||||
|
# 1. 当前服务实际读取的是 configs/config.yaml 中的 oauth 配置块。
|
||||||
|
# 2. 本文件只作为与当前代码一致的参考模板，便于复制到 config.yaml。
|
||||||
|
# 3. 当前后端运行时只支持 google、wechat、github、qq、alipay、douyin。
|
||||||
|
|
||||||
|
oauth:
|
||||||
|
google:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/google/callback"
|
||||||
|
|
||||||
|
wechat:
|
||||||
|
app_id: ""
|
||||||
|
app_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/wechat/callback"
|
||||||
|
|
||||||
|
github:
|
||||||
|
client_id: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/github/callback"
|
||||||
|
|
||||||
|
qq:
|
||||||
|
app_id: ""
|
||||||
|
app_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/qq/callback"
|
||||||
|
|
||||||
|
alipay:
|
||||||
|
app_id: ""
|
||||||
|
private_key: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/alipay/callback"
|
||||||
|
sandbox: false
|
||||||
|
|
||||||
|
douyin:
|
||||||
|
client_key: ""
|
||||||
|
client_secret: ""
|
||||||
|
redirect_url: "http://localhost:8080/api/v1/auth/oauth/douyin/callback"
|
||||||
26
docker-compose.yml
Normal file
26
docker-compose.yml
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
version: '3.8'
|
||||||
|
|
||||||
|
services:
|
||||||
|
# 用户管理服务
|
||||||
|
user-management:
|
||||||
|
build: .
|
||||||
|
container_name: user-ms-app
|
||||||
|
ports:
|
||||||
|
- "8080:8080"
|
||||||
|
environment:
|
||||||
|
- DB_HOST=postgres
|
||||||
|
- DB_PORT=5432
|
||||||
|
- DB_USER=user_ms
|
||||||
|
- DB_PASSWORD=user_ms_pass
|
||||||
|
- DB_NAME=user_ms
|
||||||
|
depends_on:
|
||||||
|
- postgres
|
||||||
|
networks:
|
||||||
|
- user-ms-network
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
postgres-data:
|
||||||
|
|
||||||
|
networks:
|
||||||
|
user-ms-network:
|
||||||
|
driver: bridge
|
||||||
123
go.mod
Normal file
123
go.mod
Normal file
@@ -0,0 +1,123 @@
|
|||||||
|
module github.com/user-management-system
|
||||||
|
|
||||||
|
go 1.25.0
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/alicebob/miniredis/v2 v2.37.0
|
||||||
|
github.com/gin-gonic/gin v1.12.0
|
||||||
|
github.com/glebarez/sqlite v1.11.0
|
||||||
|
github.com/golang-jwt/jwt/v5 v5.2.2
|
||||||
|
github.com/pquerna/otp v1.5.0
|
||||||
|
github.com/prometheus/client_golang v1.19.0
|
||||||
|
github.com/redis/go-redis/v9 v9.18.0
|
||||||
|
github.com/spf13/viper v1.19.0
|
||||||
|
github.com/swaggo/files v1.0.1
|
||||||
|
github.com/swaggo/gin-swagger v1.6.1
|
||||||
|
github.com/swaggo/swag v1.16.6
|
||||||
|
golang.org/x/crypto v0.49.0
|
||||||
|
golang.org/x/oauth2 v0.27.0
|
||||||
|
gopkg.in/yaml.v3 v3.0.1
|
||||||
|
gorm.io/driver/sqlite v1.6.0
|
||||||
|
gorm.io/gorm v1.30.0
|
||||||
|
modernc.org/sqlite v1.46.1
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
||||||
|
github.com/alibabacloud-go/dysmsapi-20170525/v5 v5.5.0 // indirect
|
||||||
|
github.com/andybalholm/brotli v1.2.0 // indirect
|
||||||
|
github.com/beorn7/perks v1.0.1 // indirect
|
||||||
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
||||||
|
github.com/bytedance/gopkg v0.1.4 // indirect
|
||||||
|
github.com/bytedance/sonic v1.15.0 // indirect
|
||||||
|
github.com/bytedance/sonic/loader v0.5.0 // indirect
|
||||||
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
||||||
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
||||||
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
||||||
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||||
|
github.com/fsnotify/fsnotify v1.7.0 // indirect
|
||||||
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
||||||
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
||||||
|
github.com/glebarez/go-sqlite v1.21.2 // indirect
|
||||||
|
github.com/go-openapi/jsonpointer v0.22.5 // indirect
|
||||||
|
github.com/go-openapi/jsonreference v0.21.5 // indirect
|
||||||
|
github.com/go-openapi/spec v0.22.4 // indirect
|
||||||
|
github.com/go-openapi/swag/conv v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/jsonname v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/loading v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/stringutils v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/typeutils v0.25.5 // indirect
|
||||||
|
github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
|
||||||
|
github.com/go-playground/locales v0.14.1 // indirect
|
||||||
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
||||||
|
github.com/go-playground/validator/v10 v10.30.1 // indirect
|
||||||
|
github.com/goccy/go-json v0.10.6 // indirect
|
||||||
|
github.com/goccy/go-yaml v1.19.2 // indirect
|
||||||
|
github.com/golang/protobuf v1.5.3 // indirect
|
||||||
|
github.com/google/go-querystring v1.1.0 // indirect
|
||||||
|
github.com/google/uuid v1.6.0 // indirect
|
||||||
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
||||||
|
github.com/icholy/digest v1.1.0 // indirect
|
||||||
|
github.com/imroc/req/v3 v3.57.0 // indirect
|
||||||
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
||||||
|
github.com/jinzhu/now v1.1.5 // indirect
|
||||||
|
github.com/json-iterator/go v1.1.12 // indirect
|
||||||
|
github.com/klauspost/compress v1.18.2 // indirect
|
||||||
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
||||||
|
github.com/leodido/go-urn v1.4.0 // indirect
|
||||||
|
github.com/lib/pq v1.12.0 // indirect
|
||||||
|
github.com/magiconair/properties v1.8.7 // indirect
|
||||||
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||||
|
github.com/mattn/go-sqlite3 v1.14.22 // indirect
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||||
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
||||||
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
||||||
|
github.com/prometheus/client_model v0.6.1 // indirect
|
||||||
|
github.com/prometheus/common v0.53.0 // indirect
|
||||||
|
github.com/prometheus/procfs v0.13.0 // indirect
|
||||||
|
github.com/quic-go/qpack v0.6.0 // indirect
|
||||||
|
github.com/quic-go/quic-go v0.59.0 // indirect
|
||||||
|
github.com/refraction-networking/utls v1.8.1 // indirect
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
||||||
|
github.com/richardlehane/mscfb v1.0.4 // indirect
|
||||||
|
github.com/richardlehane/msoleps v1.0.4 // indirect
|
||||||
|
github.com/sagikazarmark/locafero v0.4.0 // indirect
|
||||||
|
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
|
||||||
|
github.com/sourcegraph/conc v0.3.0 // indirect
|
||||||
|
github.com/spf13/afero v1.11.0 // indirect
|
||||||
|
github.com/spf13/cast v1.6.0 // indirect
|
||||||
|
github.com/spf13/pflag v1.0.5 // indirect
|
||||||
|
github.com/subosito/gotenv v1.6.0 // indirect
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.57 // indirect
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sms v1.3.57 // indirect
|
||||||
|
github.com/tiendc/go-deepcopy v1.6.0 // indirect
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
||||||
|
github.com/ugorji/go/codec v1.3.1 // indirect
|
||||||
|
github.com/xuri/efp v0.0.1 // indirect
|
||||||
|
github.com/xuri/excelize/v2 v2.9.1 // indirect
|
||||||
|
github.com/xuri/nfp v0.0.1 // indirect
|
||||||
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
||||||
|
go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
|
||||||
|
go.uber.org/atomic v1.11.0 // indirect
|
||||||
|
go.uber.org/multierr v1.9.0 // indirect
|
||||||
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
||||||
|
golang.org/x/arch v0.25.0 // indirect
|
||||||
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
|
||||||
|
golang.org/x/mod v0.34.0 // indirect
|
||||||
|
golang.org/x/net v0.52.0 // indirect
|
||||||
|
golang.org/x/sync v0.20.0 // indirect
|
||||||
|
golang.org/x/sys v0.42.0 // indirect
|
||||||
|
golang.org/x/text v0.35.0 // indirect
|
||||||
|
golang.org/x/tools v0.43.0 // indirect
|
||||||
|
google.golang.org/appengine v1.6.8 // indirect
|
||||||
|
google.golang.org/protobuf v1.36.11 // indirect
|
||||||
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
||||||
|
modernc.org/libc v1.67.6 // indirect
|
||||||
|
modernc.org/mathutil v1.7.1 // indirect
|
||||||
|
)
|
||||||
|
|
||||||
|
// Fix quic-go version conflict between req/v3 and gin/http3
|
||||||
|
replace github.com/quic-go/quic-go => github.com/quic-go/quic-go v0.57.1
|
||||||
521
go.sum
Normal file
521
go.sum
Normal file
@@ -0,0 +1,521 @@
|
|||||||
|
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||||
|
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||||
|
github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
|
||||||
|
github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
|
||||||
|
github.com/alibabacloud-go/alibabacloud-gateway-pop v0.0.6/go.mod h1:4EUIoxs/do24zMOGGqYVWgw0s9NtiylnJglOeEB5UJo=
|
||||||
|
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4/go.mod h1:sCavSAvdzOjul4cEqeVtvlSaSScfNsTQ+46HwlTL1hc=
|
||||||
|
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5/go.mod h1:tWnyE9AjF8J8qqLk645oUmVUnFybApTQWklQmi5tY6g=
|
||||||
|
github.com/alibabacloud-go/darabonba-array v0.1.0/go.mod h1:BLKxr0brnggqOJPqT09DFJ8g3fsDshapUD3C3aOEFaI=
|
||||||
|
github.com/alibabacloud-go/darabonba-encode-util v0.0.2/go.mod h1:JiW9higWHYXm7F4PKuMgEUETNZasrDM6vqVr/Can7H8=
|
||||||
|
github.com/alibabacloud-go/darabonba-map v0.0.2/go.mod h1:28AJaX8FOE/ym8OUFWga+MtEzBunJwQGceGQlvaPGPc=
|
||||||
|
github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.14/go.mod h1:lxFGfobinVsQ49ntjpgWghXmIF0/Sm4+wvBJ1h5RtaE=
|
||||||
|
github.com/alibabacloud-go/darabonba-signature-util v0.0.7/go.mod h1:oUzCYV2fcCH797xKdL6BDH8ADIHlzrtKVjeRtunBNTQ=
|
||||||
|
github.com/alibabacloud-go/darabonba-string v1.0.2/go.mod h1:93cTfV3vuPhhEwGGpKKqhVW4jLe7tDpo3LUM0i0g6mA=
|
||||||
|
github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68/go.mod h1:6pb/Qy8c+lqua8cFpEy7g39NRRqOWc3rOwAy8m5Y2BY=
|
||||||
|
github.com/alibabacloud-go/debug v1.0.0/go.mod h1:8gfgZCCAC3+SCzjWtY053FrOcd4/qlH6IHTI4QyICOc=
|
||||||
|
github.com/alibabacloud-go/debug v1.0.1/go.mod h1:8gfgZCCAC3+SCzjWtY053FrOcd4/qlH6IHTI4QyICOc=
|
||||||
|
github.com/alibabacloud-go/dysmsapi-20170525/v5 v5.5.0 h1:SwNiCQs5UICRi4BI+AvNtXUiK7PkPS1Eoqhz8UunMQo=
|
||||||
|
github.com/alibabacloud-go/dysmsapi-20170525/v5 v5.5.0/go.mod h1:J1zab9/VxVJGdZ5pSK/BbUot7CkaSkRXdaLKAXXRLoY=
|
||||||
|
github.com/alibabacloud-go/endpoint-util v1.1.0/go.mod h1:O5FuCALmCKs2Ff7JFJMudHs0I5EBgecXXxZRyswlEjE=
|
||||||
|
github.com/alibabacloud-go/openapi-util v0.1.0/go.mod h1:sQuElr4ywwFRlCCberQwKRFhRzIyG4QTP/P4y1CJ6Ws=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.0/go.mod h1:IkGyUSX4Ba1V+k4pCtJUc6jDpZLFph9QMy2VUPTwukg=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.7/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/KeGOFfwYm3N/p4=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.8/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/KeGOFfwYm3N/p4=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.11/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/KeGOFfwYm3N/p4=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.17/go.mod h1:nXxjm6CIFkBhwW4FQkNrolwbfon8Svy6cujmKFUq98A=
|
||||||
|
github.com/alibabacloud-go/tea v1.1.20/go.mod h1:nXxjm6CIFkBhwW4FQkNrolwbfon8Svy6cujmKFUq98A=
|
||||||
|
github.com/alibabacloud-go/tea v1.2.2/go.mod h1:CF3vOzEMAG+bR4WOql8gc2G9H3EkH3ZLAQdpmpXMgwk=
|
||||||
|
github.com/alibabacloud-go/tea v1.3.13/go.mod h1:A560v/JTQ1n5zklt2BEpurJzZTI8TUT+Psg2drWlxRg=
|
||||||
|
github.com/alibabacloud-go/tea-utils v1.3.1/go.mod h1:EI/o33aBfj3hETm4RLiAxF/ThQdSngxrpF8rKUDJjPE=
|
||||||
|
github.com/alibabacloud-go/tea-utils/v2 v2.0.5/go.mod h1:dL6vbUT35E4F4bFTHL845eUloqaerYBYPsdWR2/jhe4=
|
||||||
|
github.com/alibabacloud-go/tea-utils/v2 v2.0.7/go.mod h1:qxn986l+q33J5VkialKMqT/TTs3E+U9MJpd001iWQ9I=
|
||||||
|
github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=
|
||||||
|
github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
|
||||||
|
github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
|
||||||
|
github.com/aliyun/credentials-go v1.3.1/go.mod h1:8jKYhQuDawt8x2+fusqa1Y6mPxemTsBEN04dgcAcYz0=
|
||||||
|
github.com/aliyun/credentials-go v1.3.6/go.mod h1:1LxUuX7L5YrZUWzBrRyk0SwSdH4OmPrib8NVePL3fxM=
|
||||||
|
github.com/aliyun/credentials-go v1.4.5/go.mod h1:Jm6d+xIgwJVLVWT561vy67ZRP4lPTQxMbEYRuT2Ti1U=
|
||||||
|
github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
|
||||||
|
github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
|
||||||
|
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||||
|
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||||
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
|
||||||
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
|
||||||
|
github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
|
||||||
|
github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
|
||||||
|
github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
|
||||||
|
github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
|
||||||
|
github.com/bytedance/gopkg v0.1.4 h1:oZnQwnX82KAIWb7033bEwtxvTqXcYMxDBaQxo5JJHWM=
|
||||||
|
github.com/bytedance/gopkg v0.1.4/go.mod h1:v1zWfPm21Fb+OsyXN2VAHdL6TBb2L88anLQgdyje6R4=
|
||||||
|
github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
|
||||||
|
github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
|
||||||
|
github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
|
||||||
|
github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
|
||||||
|
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
||||||
|
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
|
||||||
|
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||||
|
github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
|
||||||
|
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||||
|
github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
|
||||||
|
github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
|
||||||
|
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
|
||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
|
||||||
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
|
||||||
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
|
||||||
|
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||||
|
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
|
||||||
|
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||||
|
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
|
||||||
|
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
|
||||||
|
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
|
||||||
|
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
|
||||||
|
github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
|
||||||
|
github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
|
||||||
|
github.com/gin-contrib/gzip v0.0.6 h1:NjcunTcGAj5CO1gn4N8jHOSIeRFHIbn51z6K+xaN4d4=
|
||||||
|
github.com/gin-contrib/gzip v0.0.6/go.mod h1:QOJlmV2xmayAjkNS2Y8NQsMneuRShOU/kjovCXNuzzk=
|
||||||
|
github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
|
||||||
|
github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
|
||||||
|
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
|
||||||
|
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
|
||||||
|
github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo=
|
||||||
|
github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k=
|
||||||
|
github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
|
||||||
|
github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
|
||||||
|
github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
|
||||||
|
github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
|
||||||
|
github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
|
||||||
|
github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
|
||||||
|
github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=
|
||||||
|
github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ=
|
||||||
|
github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
|
||||||
|
github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g=
|
||||||
|
github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k=
|
||||||
|
github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
|
||||||
|
github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU=
|
||||||
|
github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=
|
||||||
|
github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4=
|
||||||
|
github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U=
|
||||||
|
github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo=
|
||||||
|
github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=
|
||||||
|
github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g=
|
||||||
|
github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=
|
||||||
|
github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII=
|
||||||
|
github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E=
|
||||||
|
github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc=
|
||||||
|
github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=
|
||||||
|
github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ=
|
||||||
|
github.com/go-openapi/testify/enable/yaml/v2 v2.4.0 h1:7SgOMTvJkM8yWrQlU8Jm18VeDPuAvB/xWrdxFJkoFag=
|
||||||
|
github.com/go-openapi/testify/enable/yaml/v2 v2.4.0/go.mod h1:14iV8jyyQlinc9StD7w1xVPW3CO3q1Gj04Jy//Kw4VM=
|
||||||
|
github.com/go-openapi/testify/v2 v2.4.0 h1:8nsPrHVCWkQ4p8h1EsRVymA2XABB4OT40gcvAu+voFM=
|
||||||
|
github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
|
||||||
|
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
|
||||||
|
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
|
||||||
|
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
|
||||||
|
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
|
||||||
|
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
|
||||||
|
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
|
||||||
|
github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
|
||||||
|
github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
|
||||||
|
github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
|
||||||
|
github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
|
||||||
|
github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
|
||||||
|
github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
|
||||||
|
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
|
||||||
|
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
|
||||||
|
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
|
||||||
|
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
|
||||||
|
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||||
|
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||||
|
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||||
|
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||||
|
github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
|
||||||
|
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
|
||||||
|
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||||
|
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||||
|
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||||
|
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
|
||||||
|
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||||
|
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||||
|
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||||
|
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||||
|
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||||
|
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||||
|
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||||
|
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
|
||||||
|
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
|
||||||
|
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
|
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
|
||||||
|
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
|
||||||
|
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||||
|
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
|
||||||
|
github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
|
||||||
|
github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
|
||||||
|
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
|
||||||
|
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
|
||||||
|
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
|
||||||
|
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
|
||||||
|
github.com/icholy/digest v1.1.0 h1:HfGg9Irj7i+IX1o1QAmPfIBNu/Q5A5Tu3n/MED9k9H4=
|
||||||
|
github.com/icholy/digest v1.1.0/go.mod h1:QNrsSGQ5v7v9cReDI0+eyjsXGUoRSUZQHeQ5C4XLa0Y=
|
||||||
|
github.com/imroc/req/v3 v3.57.0 h1:LMTUjNRUybUkTPn8oJDq8Kg3JRBOBTcnDhKu7mzupKI=
|
||||||
|
github.com/imroc/req/v3 v3.57.0/go.mod h1:JL62ey1nvSLq81HORNcosvlf7SxZStONNqOprg0Pz00=
|
||||||
|
github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
|
||||||
|
github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
|
||||||
|
github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
|
||||||
|
github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
|
||||||
|
github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
|
||||||
|
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||||
|
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||||
|
github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
|
||||||
|
github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
|
||||||
|
github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
|
||||||
|
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
|
||||||
|
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
|
||||||
|
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||||
|
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
|
||||||
|
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||||
|
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||||
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||||
|
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||||
|
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
|
||||||
|
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
|
||||||
|
github.com/lib/pq v1.12.0 h1:mC1zeiNamwKBecjHarAr26c/+d8V5w/u4J0I/yASbJo=
|
||||||
|
github.com/lib/pq v1.12.0/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
|
||||||
|
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
|
||||||
|
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
|
||||||
|
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
|
||||||
|
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||||
|
github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
|
||||||
|
github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||||
|
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||||
|
github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
|
||||||
|
github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
|
||||||
|
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
|
||||||
|
github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
|
||||||
|
github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
|
||||||
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
|
||||||
|
github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
|
||||||
|
github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
|
||||||
|
github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
|
||||||
|
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||||
|
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||||
|
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||||
|
github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+aLCE=
|
||||||
|
github.com/prometheus/common v0.53.0/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U=
|
||||||
|
github.com/prometheus/procfs v0.13.0 h1:GqzLlQyfsPbaEHaQkO7tbDlriv/4o5Hudv6OXHGKX7o=
|
||||||
|
github.com/prometheus/procfs v0.13.0/go.mod h1:cd4PFCR54QLnGKPaKGA6l+cfuNXtht43ZKY6tow0Y1g=
|
||||||
|
github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
|
||||||
|
github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
|
||||||
|
github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
|
||||||
|
github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
|
||||||
|
github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
|
||||||
|
github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
|
||||||
|
github.com/refraction-networking/utls v1.8.1 h1:yNY1kapmQU8JeM1sSw2H2asfTIwWxIkrMJI0pRUOCAo=
|
||||||
|
github.com/refraction-networking/utls v1.8.1/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
|
||||||
|
github.com/richardlehane/mscfb v1.0.4 h1:WULscsljNPConisD5hR0+OyZjwK46Pfyr6mPu5ZawpM=
|
||||||
|
github.com/richardlehane/mscfb v1.0.4/go.mod h1:YzVpcZg9czvAuhk9T+a3avCpcFPMUWm7gK3DypaEsUk=
|
||||||
|
github.com/richardlehane/msoleps v1.0.1/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
|
||||||
|
github.com/richardlehane/msoleps v1.0.4 h1:WuESlvhX3gH2IHcd8UqyCuFY5yiq/GR/yqaSM/9/g00=
|
||||||
|
github.com/richardlehane/msoleps v1.0.4/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
|
||||||
|
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||||
|
github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
|
||||||
|
github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
|
||||||
|
github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
|
||||||
|
github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
|
||||||
|
github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
|
||||||
|
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
|
||||||
|
github.com/smartystreets/assertions v1.1.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
|
||||||
|
github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
|
||||||
|
github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
|
||||||
|
github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
|
||||||
|
github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
|
||||||
|
github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
|
||||||
|
github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
|
||||||
|
github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
|
||||||
|
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||||
|
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||||
|
github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
|
||||||
|
github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
|
||||||
|
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||||
|
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||||
|
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
|
||||||
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
|
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
||||||
|
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||||
|
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||||
|
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||||
|
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
|
||||||
|
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
|
||||||
|
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
|
||||||
|
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
|
||||||
|
github.com/swaggo/files v1.0.1 h1:J1bVJ4XHZNq0I46UU90611i9/YzdrF7x92oX1ig5IdE=
|
||||||
|
github.com/swaggo/files v1.0.1/go.mod h1:0qXmMNH6sXNf+73t65aKeB+ApmgxdnkQzVTAj2uaMUg=
|
||||||
|
github.com/swaggo/gin-swagger v1.6.1 h1:Ri06G4gc9N4t4k8hekMigJ9zKTFSlqj/9paAQCQs7cY=
|
||||||
|
github.com/swaggo/gin-swagger v1.6.1/go.mod h1:LQ+hJStHakCWRiK/YNYtJOu4mR2FP+pxLnILT/qNiTw=
|
||||||
|
github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
|
||||||
|
github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.57 h1:SciPs1sSbUsGffDyybdCwZSn6A9x07lWXi3uI8/l31s=
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.57/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sms v1.3.57 h1:ZnJK+aTZYyzGN/4dmQXYWzuHsuZFrlj034uLoGaNVvQ=
|
||||||
|
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sms v1.3.57/go.mod h1:jwLLFaeXXAnkWj37iTh0jfeXDYWf9eggaKJ1dRnc/1A=
|
||||||
|
github.com/tiendc/go-deepcopy v1.6.0 h1:0UtfV/imoCwlLxVsyfUd4hNHnB3drXsfle+wzSCA5Wo=
|
||||||
|
github.com/tiendc/go-deepcopy v1.6.0/go.mod h1:toXoeQoUqXOOS/X4sKuiAoSk6elIdqc0pN7MTgOOo2I=
|
||||||
|
github.com/tjfoc/gmsm v1.3.2/go.mod h1:HaUcFuY0auTiaHB9MHFGCPx5IaLhTUd2atbCFBQXn9w=
|
||||||
|
github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
|
||||||
|
github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
|
||||||
|
github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
|
||||||
|
github.com/xuri/efp v0.0.1 h1:fws5Rv3myXyYni8uwj2qKjVaRP30PdjeYe2Y6FDsCL8=
|
||||||
|
github.com/xuri/efp v0.0.1/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI=
|
||||||
|
github.com/xuri/excelize/v2 v2.9.1 h1:VdSGk+rraGmgLHGFaGG9/9IWu1nj4ufjJ7uwMDtj8Qw=
|
||||||
|
github.com/xuri/excelize/v2 v2.9.1/go.mod h1:x7L6pKz2dvo9ejrRuD8Lnl98z4JLt0TGAwjhW+EiP8s=
|
||||||
|
github.com/xuri/nfp v0.0.1 h1:MDamSGatIvp8uOmDP8FnmjuQpu90NzdJxo7242ANR9Q=
|
||||||
|
github.com/xuri/nfp v0.0.1/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
|
||||||
|
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.1.30/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||||
|
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
|
||||||
|
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
|
||||||
|
github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
|
||||||
|
github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
|
||||||
|
go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
|
||||||
|
go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
|
||||||
|
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
|
||||||
|
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
|
||||||
|
go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
|
||||||
|
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
|
||||||
|
go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
|
||||||
|
go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
|
||||||
|
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
|
||||||
|
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
|
||||||
|
golang.org/x/arch v0.25.0 h1:qnk6Ksugpi5Bz32947rkUgDt9/s5qvqDPl/gBKdMJLE=
|
||||||
|
golang.org/x/arch v0.25.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
|
||||||
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
|
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||||
|
golang.org/x/crypto v0.0.0-20191219195013-becbf705a915/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
|
golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
|
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
|
golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
|
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||||
|
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
|
||||||
|
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
|
||||||
|
golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
|
||||||
|
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
|
||||||
|
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
|
||||||
|
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
|
||||||
|
golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
|
||||||
|
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
|
||||||
|
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
|
||||||
|
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||||
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
|
||||||
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
|
||||||
|
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||||
|
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||||
|
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||||
|
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||||
|
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||||
|
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||||
|
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||||
|
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||||
|
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
|
||||||
|
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
|
||||||
|
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||||
|
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
|
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||||
|
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||||
|
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||||
|
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||||
|
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
|
||||||
|
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
|
||||||
|
golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
|
||||||
|
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
|
||||||
|
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
|
||||||
|
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
|
||||||
|
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||||
|
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
|
||||||
|
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||||
|
golang.org/x/oauth2 v0.18.0 h1:09qnuIAgzdx1XplqJvW6CQqMCtGZykZWcXzPMPUusvI=
|
||||||
|
golang.org/x/oauth2 v0.18.0/go.mod h1:Wf7knwG0MPoWIMMBgFlEaSUDaKskp0dCfrlJRJXbBi8=
|
||||||
|
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
|
||||||
|
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
|
||||||
|
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||||
|
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||||
|
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||||
|
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||||
|
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||||
|
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200509044756-6aff5f38e54f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||||
|
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||||
|
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
|
||||||
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||||
|
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||||
|
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||||
|
golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||||
|
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
|
||||||
|
golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
|
||||||
|
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||||
|
golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
|
||||||
|
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
|
||||||
|
golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
|
||||||
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||||
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||||
|
golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
|
||||||
|
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||||
|
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||||
|
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||||
|
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||||
|
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||||
|
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
|
||||||
|
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
|
||||||
|
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
|
||||||
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
|
||||||
|
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||||
|
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||||
|
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||||
|
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20200509030707-2212a7e161a5/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||||
|
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||||
|
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
|
||||||
|
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||||
|
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
|
||||||
|
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||||
|
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||||
|
google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
|
||||||
|
google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
|
||||||
|
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
|
||||||
|
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
|
||||||
|
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||||
|
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
|
||||||
|
google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
|
||||||
|
google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
|
||||||
|
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
|
||||||
|
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
|
||||||
|
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||||
|
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||||
|
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||||
|
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
|
||||||
|
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||||
|
gopkg.in/ini.v1 v1.56.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
|
||||||
|
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
|
||||||
|
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
|
||||||
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
|
||||||
|
gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
|
||||||
|
gorm.io/gorm v1.30.0 h1:qbT5aPv1UH8gI99OsRlvDToLxW5zR7FzS9acZDOZcgs=
|
||||||
|
gorm.io/gorm v1.30.0/go.mod h1:8Z33v652h4//uMA76KjeDH8mJXPm1QNCYrMeatR0DOE=
|
||||||
|
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
|
||||||
|
modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
|
||||||
|
modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
|
||||||
|
modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
|
||||||
|
modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
|
||||||
|
modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
|
||||||
|
modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
|
||||||
|
modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
|
||||||
|
modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
|
||||||
|
modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
|
||||||
|
modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
|
||||||
|
modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
|
||||||
|
modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
|
||||||
|
modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
|
||||||
|
modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
|
||||||
|
modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
|
||||||
|
modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
|
||||||
|
modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
|
||||||
|
modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
|
||||||
|
modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
|
||||||
|
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
|
||||||
|
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
|
||||||
|
modernc.org/sqlite v1.46.1 h1:eFJ2ShBLIEnUWlLy12raN0Z1plqmFX9Qe3rjQTKt6sU=
|
||||||
|
modernc.org/sqlite v1.46.1/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
|
||||||
|
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
|
||||||
|
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
|
||||||
|
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
|
||||||
|
modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
|
||||||
105
go.work.sum
Normal file
105
go.work.sum
Normal file
@@ -0,0 +1,105 @@
|
|||||||
|
cloud.google.com/go v0.112.1/go.mod h1:+Vbu+Y1UU+I1rjmzeMOb/8RfkKJK2Gyxi1X6jJCZLo4=
|
||||||
|
cloud.google.com/go/compute v1.24.0/go.mod h1:kw1/T+h/+tK2LJK0wiPPx1intgdAM3j/g3hFDlscY40=
|
||||||
|
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
|
||||||
|
cloud.google.com/go/firestore v1.15.0/go.mod h1:GWOxFXcv8GZUtYpWHw/w6IuYNux/BtmeVTMmjrm4yhk=
|
||||||
|
cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
|
||||||
|
cloud.google.com/go/longrunning v0.5.5/go.mod h1:WV2LAxD8/rg5Z1cNW6FJ/ZpX4E4VnDnoTk0yawPBB7s=
|
||||||
|
cloud.google.com/go/storage v1.35.1/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
|
||||||
|
github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
|
||||||
|
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
|
||||||
|
github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
|
||||||
|
github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
|
||||||
|
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5 h1:zE8vH9C7JiZLNJJQ5OwjU9mSi4T9ef9u3BURT6LCLC8=
|
||||||
|
github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.14 h1:iIamPRvehxQvVnTOvz77rZR+/YME1lR7X8kHonQSU6Y=
|
||||||
|
github.com/alibabacloud-go/debug v1.0.1 h1:MsW9SmUtbb1Fnt3ieC6NNZi6aEwrXfDksD4QA6GSbPg=
|
||||||
|
github.com/alibabacloud-go/tea v1.3.13 h1:WhGy6LIXaMbBM6VBYcsDCz6K/TPsT1Ri2hPmmZffZ94=
|
||||||
|
github.com/alibabacloud-go/tea-utils v1.3.1 h1:iWQeRzRheqCMuiF3+XkfybB3kTgUXkXX+JMrqfLeB2I=
|
||||||
|
github.com/alibabacloud-go/tea-utils/v2 v2.0.7 h1:WDx5qW3Xa5ZgJ1c8NfqJkF6w+AU5wB8835UdhPr6Ax0=
|
||||||
|
github.com/aliyun/credentials-go v1.4.5 h1:O76WYKgdy1oQYYiJkERjlA2dxGuvLRrzuO2ScrtGWSk=
|
||||||
|
github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
|
||||||
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
|
||||||
|
github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
|
||||||
|
github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
|
||||||
|
github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
|
||||||
|
github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
|
||||||
|
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
|
||||||
|
github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
|
||||||
|
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
|
||||||
|
github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||||
|
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||||
|
github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
||||||
|
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
||||||
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||||
|
github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
|
||||||
|
github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
|
||||||
|
github.com/googleapis/gax-go/v2 v2.12.3/go.mod h1:AKloxT6GtNbaLm8QTNSidHUVsHYcBHwWRvkNFJUQcS4=
|
||||||
|
github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
|
||||||
|
github.com/hashicorp/consul/api v1.28.2/go.mod h1:KyzqzgMEya+IZPcD65YFoOVAgPpbfERu4I/tzG6/ueE=
|
||||||
|
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||||
|
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
|
||||||
|
github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
|
||||||
|
github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
|
||||||
|
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
|
||||||
|
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
|
||||||
|
github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
|
||||||
|
github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
|
||||||
|
github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e/go.mod h1:ZybsQk6DWyN5t7An1MuPm1gtSZ1xDaTXS9ZjIOxvQrk=
|
||||||
|
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
|
||||||
|
github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
|
||||||
|
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
|
||||||
|
github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
|
||||||
|
github.com/klauspost/compress v1.17.6/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
|
||||||
|
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
|
||||||
|
github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
||||||
|
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||||
|
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||||
|
github.com/nats-io/nats.go v1.34.0/go.mod h1:Ubdu4Nh9exXdSz0RVWRFBbRfrbSxOYd26oF0wkWclB8=
|
||||||
|
github.com/nats-io/nkeys v0.4.7/go.mod h1:kqXRgRDPlGy7nGaEDMuYzmiJCIAAWDK0IMBtDmGD0nc=
|
||||||
|
github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
|
||||||
|
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||||
|
github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
|
||||||
|
github.com/quic-go/quic-go v0.57.1 h1:25KAAR9QR8KZrCZRThWMKVAwGoiHIrNbT72ULHTuI10=
|
||||||
|
github.com/quic-go/quic-go v0.57.1/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
|
||||||
|
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||||
|
github.com/sagikazarmark/crypt v0.19.0/go.mod h1:c6vimRziqqERhtSe0MhIvzE1w54FrCHtrXb5NH/ja78=
|
||||||
|
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
|
||||||
|
github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
|
||||||
|
github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
|
||||||
|
github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
|
||||||
|
github.com/xdg-go/scram v1.2.0/go.mod h1:3dlrS0iBaWKYVt2ZfA4cj48umJZ+cAEbR6/SjLA88I8=
|
||||||
|
github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
|
||||||
|
github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
|
||||||
|
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
|
||||||
|
go.etcd.io/etcd/api/v3 v3.5.12/go.mod h1:Ot+o0SWSyT6uHhA56al1oCED0JImsRiU9Dc26+C2a+4=
|
||||||
|
go.etcd.io/etcd/client/pkg/v3 v3.5.12/go.mod h1:seTzl2d9APP8R5Y2hFL3NVlD6qC/dOT+3kvrqPyTas4=
|
||||||
|
go.etcd.io/etcd/client/v2 v2.305.12/go.mod h1:aQ/yhsxMu+Oht1FOupSr60oBvcS9cKXHrzBpDsPTf9E=
|
||||||
|
go.etcd.io/etcd/client/v3 v3.5.12/go.mod h1:tSbBCakoWmmddL+BKVAJHa9km+O/E+bumDe9mSbPiqw=
|
||||||
|
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
|
||||||
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
|
||||||
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
|
||||||
|
go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
|
||||||
|
go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
|
||||||
|
go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
|
||||||
|
go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
|
||||||
|
go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
|
||||||
|
golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
|
||||||
|
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
|
||||||
|
golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
|
||||||
|
golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
|
||||||
|
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
|
||||||
|
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
|
||||||
|
golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
|
||||||
|
golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
|
||||||
|
golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
|
||||||
|
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
|
||||||
|
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
|
||||||
|
google.golang.org/api v0.171.0/go.mod h1:Hnq5AHm4OTMt2BUVjael2CWZFD6vksJdWCWiUAmjC9o=
|
||||||
|
google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:mqHbVIp48Muh7Ywss/AD6I5kNVKZMmAa/QEW58Gxp2s=
|
||||||
|
google.golang.org/genproto/googleapis/api v0.0.0-20240311132316-a219d84964c2/go.mod h1:O1cOfN1Cy6QEYr7VxtjOyP5AdAuR0aJ/MYZaaof623Y=
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20240314234333-6e1732d8331c/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
|
||||||
|
google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
|
||||||
|
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||||
|
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
|
||||||
|
sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
|
||||||
260
internal/api/handler/auth_handler.go
Normal file
260
internal/api/handler/auth_handler.go
Normal file
@@ -0,0 +1,260 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// AuthHandler handles authentication requests
|
||||||
|
type AuthHandler struct {
|
||||||
|
authService *service.AuthService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewAuthHandler creates a new AuthHandler
|
||||||
|
func NewAuthHandler(authService *service.AuthService) *AuthHandler {
|
||||||
|
return &AuthHandler{authService: authService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) Register(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Username string `json:"username" binding:"required"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
Phone string `json:"phone"`
|
||||||
|
Password string `json:"password" binding:"required"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
registerReq := &service.RegisterRequest{
|
||||||
|
Username: req.Username,
|
||||||
|
Email: req.Email,
|
||||||
|
Phone: req.Phone,
|
||||||
|
Password: req.Password,
|
||||||
|
Nickname: req.Nickname,
|
||||||
|
}
|
||||||
|
|
||||||
|
userInfo, err := h.authService.Register(c.Request.Context(), registerReq)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, userInfo)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) Login(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Account string `json:"account"`
|
||||||
|
Username string `json:"username"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
Phone string `json:"phone"`
|
||||||
|
Password string `json:"password"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
loginReq := &service.LoginRequest{
|
||||||
|
Account: req.Account,
|
||||||
|
Username: req.Username,
|
||||||
|
Email: req.Email,
|
||||||
|
Phone: req.Phone,
|
||||||
|
Password: req.Password,
|
||||||
|
}
|
||||||
|
|
||||||
|
clientIP := c.ClientIP()
|
||||||
|
resp, err := h.authService.Login(c.Request.Context(), loginReq, clientIP)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, resp)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) Logout(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "logged out"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) RefreshToken(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
RefreshToken string `json:"refresh_token" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, err := h.authService.RefreshToken(c.Request.Context(), req.RefreshToken)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, resp)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) GetUserInfo(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
userInfo, err := h.authService.GetUserInfo(c.Request.Context(), userID)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, userInfo)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) GetCSRFToken(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"csrf_token": "not_implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) GetAuthCapabilities(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"register": true,
|
||||||
|
"login": true,
|
||||||
|
"oauth_login": false,
|
||||||
|
"totp": true,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) OAuthLogin(c *gin.Context) {
|
||||||
|
provider := c.Param("provider")
|
||||||
|
c.JSON(http.StatusOK, gin.H{"provider": provider, "message": "OAuth not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) OAuthCallback(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"error": "OAuth not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) OAuthExchange(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"error": "OAuth not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) GetEnabledOAuthProviders(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"providers": []string{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) ActivateEmail(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email activation not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) ResendActivationEmail(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email activation not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) SendEmailCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email code login not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) LoginByEmailCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"error": "email code login not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) ForgotPassword(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "password reset not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) ResetPassword(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "password reset not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) ValidateResetToken(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"valid": false})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) BootstrapAdmin(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Username string `json:"username" binding:"required"`
|
||||||
|
Email string `json:"email" binding:"required"`
|
||||||
|
Password string `json:"password" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
bootstrapReq := &service.BootstrapAdminRequest{
|
||||||
|
Username: req.Username,
|
||||||
|
Email: req.Email,
|
||||||
|
Password: req.Password,
|
||||||
|
}
|
||||||
|
|
||||||
|
clientIP := c.ClientIP()
|
||||||
|
resp, err := h.authService.BootstrapAdmin(c.Request.Context(), bootstrapReq, clientIP)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, resp)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) SendEmailBindCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email bind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) BindEmail(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email bind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) UnbindEmail(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "email unbind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) SendPhoneBindCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "phone bind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) BindPhone(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "phone bind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) UnbindPhone(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "phone unbind not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) GetSocialAccounts(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"accounts": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) BindSocialAccount(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "social binding not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) UnbindSocialAccount(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "social unbinding not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AuthHandler) SupportsEmailCodeLogin() bool {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func getUserIDFromContext(c *gin.Context) (int64, bool) {
|
||||||
|
userID, exists := c.Get("user_id")
|
||||||
|
if !exists {
|
||||||
|
return 0, false
|
||||||
|
}
|
||||||
|
id, ok := userID.(int64)
|
||||||
|
return id, ok
|
||||||
|
}
|
||||||
|
|
||||||
|
func handleError(c *gin.Context, err error) {
|
||||||
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||||
|
}
|
||||||
19
internal/api/handler/avatar_handler.go
Normal file
19
internal/api/handler/avatar_handler.go
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
// AvatarHandler handles avatar upload requests
|
||||||
|
type AvatarHandler struct{}
|
||||||
|
|
||||||
|
// NewAvatarHandler creates a new AvatarHandler
|
||||||
|
func NewAvatarHandler() *AvatarHandler {
|
||||||
|
return &AvatarHandler{}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *AvatarHandler) UploadAvatar(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "avatar upload not implemented"})
|
||||||
|
}
|
||||||
54
internal/api/handler/captcha_handler.go
Normal file
54
internal/api/handler/captcha_handler.go
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// CaptchaHandler handles captcha requests
|
||||||
|
type CaptchaHandler struct {
|
||||||
|
captchaService *service.CaptchaService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCaptchaHandler creates a new CaptchaHandler
|
||||||
|
func NewCaptchaHandler(captchaService *service.CaptchaService) *CaptchaHandler {
|
||||||
|
return &CaptchaHandler{captchaService: captchaService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *CaptchaHandler) GenerateCaptcha(c *gin.Context) {
|
||||||
|
result, err := h.captchaService.Generate(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"captcha_id": result.CaptchaID,
|
||||||
|
"image": result.ImageData,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *CaptchaHandler) GetCaptchaImage(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "captcha image endpoint"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *CaptchaHandler) VerifyCaptcha(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
CaptchaID string `json:"captcha_id" binding:"required"`
|
||||||
|
Answer string `json:"answer" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if h.captchaService.Verify(c.Request.Context(), req.CaptchaID, req.Answer) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"verified": true})
|
||||||
|
} else {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid captcha"})
|
||||||
|
}
|
||||||
|
}
|
||||||
146
internal/api/handler/custom_field_handler.go
Normal file
146
internal/api/handler/custom_field_handler.go
Normal file
@@ -0,0 +1,146 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// CustomFieldHandler 自定义字段处理器
|
||||||
|
type CustomFieldHandler struct {
|
||||||
|
customFieldService *service.CustomFieldService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCustomFieldHandler 创建自定义字段处理器
|
||||||
|
func NewCustomFieldHandler(customFieldService *service.CustomFieldService) *CustomFieldHandler {
|
||||||
|
return &CustomFieldHandler{customFieldService: customFieldService}
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateField 创建自定义字段
|
||||||
|
func (h *CustomFieldHandler) CreateField(c *gin.Context) {
|
||||||
|
var req service.CreateFieldRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
field, err := h.customFieldService.CreateField(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, field)
|
||||||
|
}
|
||||||
|
|
||||||
|
// UpdateField 更新自定义字段
|
||||||
|
func (h *CustomFieldHandler) UpdateField(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid field id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.UpdateFieldRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
field, err := h.customFieldService.UpdateField(c.Request.Context(), id, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, field)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeleteField 删除自定义字段
|
||||||
|
func (h *CustomFieldHandler) DeleteField(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid field id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.customFieldService.DeleteField(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "field deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetField 获取自定义字段
|
||||||
|
func (h *CustomFieldHandler) GetField(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid field id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
field, err := h.customFieldService.GetField(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, field)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ListFields 获取所有自定义字段
|
||||||
|
func (h *CustomFieldHandler) ListFields(c *gin.Context) {
|
||||||
|
fields, err := h.customFieldService.ListFields(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"fields": fields})
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetUserFieldValues 设置用户自定义字段值
|
||||||
|
func (h *CustomFieldHandler) SetUserFieldValues(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Values map[string]string `json:"values" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.customFieldService.BatchSetUserFieldValues(c.Request.Context(), userID, req.Values); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "field values set"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserFieldValues 获取用户自定义字段值
|
||||||
|
func (h *CustomFieldHandler) GetUserFieldValues(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
values, err := h.customFieldService.GetUserFieldValues(c.Request.Context(), userID)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"fields": values})
|
||||||
|
}
|
||||||
343
internal/api/handler/device_handler.go
Normal file
343
internal/api/handler/device_handler.go
Normal file
@@ -0,0 +1,343 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// DeviceHandler handles device management requests
|
||||||
|
type DeviceHandler struct {
|
||||||
|
deviceService *service.DeviceService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewDeviceHandler creates a new DeviceHandler
|
||||||
|
func NewDeviceHandler(deviceService *service.DeviceService) *DeviceHandler {
|
||||||
|
return &DeviceHandler{deviceService: deviceService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) CreateDevice(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.CreateDeviceRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
device, err := h.deviceService.CreateDevice(c.Request.Context(), userID, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, device)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) GetMyDevices(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||||
|
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||||
|
|
||||||
|
devices, total, err := h.deviceService.GetUserDevices(c.Request.Context(), userID, page, pageSize)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"devices": devices,
|
||||||
|
"total": total,
|
||||||
|
"page": page,
|
||||||
|
"page_size": pageSize,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) GetDevice(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
device, err := h.deviceService.GetDevice(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, device)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) UpdateDevice(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.UpdateDeviceRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
device, err := h.deviceService.UpdateDevice(c.Request.Context(), id, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, device)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) DeleteDevice(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.deviceService.DeleteDevice(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "device deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) UpdateDeviceStatus(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Status string `json:"status" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var status domain.DeviceStatus
|
||||||
|
switch req.Status {
|
||||||
|
case "active", "1":
|
||||||
|
status = domain.DeviceStatusActive
|
||||||
|
case "inactive", "0":
|
||||||
|
status = domain.DeviceStatusInactive
|
||||||
|
default:
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid status"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.deviceService.UpdateDeviceStatus(c.Request.Context(), id, status); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "status updated"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *DeviceHandler) GetUserDevices(c *gin.Context) {
|
||||||
|
userIDParam := c.Param("id")
|
||||||
|
userID, err := strconv.ParseInt(userIDParam, 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||||
|
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||||
|
|
||||||
|
devices, total, err := h.deviceService.GetUserDevices(c.Request.Context(), userID, page, pageSize)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"devices": devices,
|
||||||
|
"total": total,
|
||||||
|
"page": page,
|
||||||
|
"page_size": pageSize,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAllDevices 获取所有设备列表（管理员）
|
||||||
|
func (h *DeviceHandler) GetAllDevices(c *gin.Context) {
|
||||||
|
var req service.GetAllDevicesRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
devices, total, err := h.deviceService.GetAllDevices(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"devices": devices,
|
||||||
|
"total": total,
|
||||||
|
"page": req.Page,
|
||||||
|
"page_size": req.PageSize,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TrustDeviceRequest 信任设备请求
|
||||||
|
type TrustDeviceRequest struct {
|
||||||
|
TrustDuration string `json:"trust_duration"` // 信任持续时间，如 "30d" 表示30天
|
||||||
|
}
|
||||||
|
|
||||||
|
// TrustDevice 设置设备为信任设备
|
||||||
|
func (h *DeviceHandler) TrustDevice(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req TrustDeviceRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 解析信任持续时间
|
||||||
|
trustDuration := parseDuration(req.TrustDuration)
|
||||||
|
|
||||||
|
if err := h.deviceService.TrustDevice(c.Request.Context(), id, trustDuration); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "device trusted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TrustDeviceByDeviceID 根据设备标识字符串设置设备为信任状态
|
||||||
|
func (h *DeviceHandler) TrustDeviceByDeviceID(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
deviceID := c.Param("deviceId")
|
||||||
|
if deviceID == "" {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req TrustDeviceRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 解析信任持续时间
|
||||||
|
trustDuration := parseDuration(req.TrustDuration)
|
||||||
|
|
||||||
|
if err := h.deviceService.TrustDeviceByDeviceID(c.Request.Context(), userID, deviceID, trustDuration); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "device trusted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// UntrustDevice 取消设备信任状态
|
||||||
|
func (h *DeviceHandler) UntrustDevice(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.deviceService.UntrustDevice(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "device untrusted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetMyTrustedDevices 获取我的信任设备列表
|
||||||
|
func (h *DeviceHandler) GetMyTrustedDevices(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
devices, err := h.deviceService.GetTrustedDevices(c.Request.Context(), userID)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"devices": devices})
|
||||||
|
}
|
||||||
|
|
||||||
|
// LogoutAllOtherDevices 登出所有其他设备
|
||||||
|
func (h *DeviceHandler) LogoutAllOtherDevices(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 从请求中获取当前设备ID
|
||||||
|
currentDeviceIDStr := c.GetHeader("X-Device-ID")
|
||||||
|
currentDeviceID, err := strconv.ParseInt(currentDeviceIDStr, 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid current device id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.deviceService.LogoutAllOtherDevices(c.Request.Context(), userID, currentDeviceID); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "all other devices logged out"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// parseDuration 解析duration字符串，如 "30d" -> 30天的time.Duration
|
||||||
|
func parseDuration(s string) time.Duration {
|
||||||
|
if s == "" {
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
// 简单实现，支持 d(天)和h(小时)
|
||||||
|
var d int
|
||||||
|
var h int
|
||||||
|
_, _ = d, h
|
||||||
|
switch s[len(s)-1] {
|
||||||
|
case 'd':
|
||||||
|
d = 1
|
||||||
|
_, _ = fmt.Sscanf(s[:len(s)-1], "%d", &d)
|
||||||
|
return time.Duration(d) * 24 * time.Hour
|
||||||
|
case 'h':
|
||||||
|
_, _ = fmt.Sscanf(s[:len(s)-1], "%d", &h)
|
||||||
|
return time.Duration(h) * time.Hour
|
||||||
|
}
|
||||||
|
return 0
|
||||||
|
}
|
||||||
31
internal/api/handler/export_handler.go
Normal file
31
internal/api/handler/export_handler.go
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ExportHandler handles user export/import requests
|
||||||
|
type ExportHandler struct {
|
||||||
|
exportService *service.ExportService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewExportHandler creates a new ExportHandler
|
||||||
|
func NewExportHandler(exportService *service.ExportService) *ExportHandler {
|
||||||
|
return &ExportHandler{exportService: exportService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ExportHandler) ExportUsers(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "user export not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ExportHandler) ImportUsers(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "user import not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ExportHandler) GetImportTemplate(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"template": "id,username,email,nickname"})
|
||||||
|
}
|
||||||
93
internal/api/handler/log_handler.go
Normal file
93
internal/api/handler/log_handler.go
Normal file
@@ -0,0 +1,93 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// LogHandler handles log requests
|
||||||
|
type LogHandler struct {
|
||||||
|
loginLogService *service.LoginLogService
|
||||||
|
operationLogService *service.OperationLogService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewLogHandler creates a new LogHandler
|
||||||
|
func NewLogHandler(loginLogService *service.LoginLogService, operationLogService *service.OperationLogService) *LogHandler {
|
||||||
|
return &LogHandler{
|
||||||
|
loginLogService: loginLogService,
|
||||||
|
operationLogService: operationLogService,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *LogHandler) GetMyLoginLogs(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||||
|
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||||
|
|
||||||
|
logs, total, err := h.loginLogService.GetMyLoginLogs(c.Request.Context(), userID, page, pageSize)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"logs": logs,
|
||||||
|
"total": total,
|
||||||
|
"page": page,
|
||||||
|
"page_size": pageSize,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *LogHandler) GetMyOperationLogs(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"logs": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *LogHandler) GetLoginLogs(c *gin.Context) {
|
||||||
|
var req service.ListLoginLogRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
logs, total, err := h.loginLogService.GetLoginLogs(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"logs": logs,
|
||||||
|
"total": total,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *LogHandler) GetOperationLogs(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"logs": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *LogHandler) ExportLoginLogs(c *gin.Context) {
|
||||||
|
var req service.ExportLoginLogRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
data, filename, contentType, err := h.loginLogService.ExportLoginLogs(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
|
||||||
|
c.Data(http.StatusOK, contentType, data)
|
||||||
|
}
|
||||||
153
internal/api/handler/password_reset_handler.go
Normal file
153
internal/api/handler/password_reset_handler.go
Normal file
@@ -0,0 +1,153 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// PasswordResetHandler handles password reset requests
|
||||||
|
type PasswordResetHandler struct {
|
||||||
|
passwordResetService *service.PasswordResetService
|
||||||
|
smsService *service.SMSCodeService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPasswordResetHandler creates a new PasswordResetHandler
|
||||||
|
func NewPasswordResetHandler(passwordResetService *service.PasswordResetService) *PasswordResetHandler {
|
||||||
|
return &PasswordResetHandler{passwordResetService: passwordResetService}
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPasswordResetHandlerWithSMS creates a new PasswordResetHandler with SMS support
|
||||||
|
func NewPasswordResetHandlerWithSMS(passwordResetService *service.PasswordResetService, smsService *service.SMSCodeService) *PasswordResetHandler {
|
||||||
|
return &PasswordResetHandler{
|
||||||
|
passwordResetService: passwordResetService,
|
||||||
|
smsService: smsService,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PasswordResetHandler) ForgotPassword(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Email string `json:"email" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.passwordResetService.ForgotPassword(c.Request.Context(), req.Email); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "password reset email sent"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PasswordResetHandler) ValidateResetToken(c *gin.Context) {
|
||||||
|
token := c.Query("token")
|
||||||
|
if token == "" {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "token is required"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
valid, err := h.passwordResetService.ValidateResetToken(c.Request.Context(), token)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"valid": valid})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PasswordResetHandler) ResetPassword(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Token string `json:"token" binding:"required"`
|
||||||
|
NewPassword string `json:"new_password" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.passwordResetService.ResetPassword(c.Request.Context(), req.Token, req.NewPassword); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "password reset successful"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// ForgotPasswordByPhoneRequest 短信密码重置请求
|
||||||
|
type ForgotPasswordByPhoneRequest struct {
|
||||||
|
Phone string `json:"phone" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ForgotPasswordByPhone 发送短信验证码
|
||||||
|
func (h *PasswordResetHandler) ForgotPasswordByPhone(c *gin.Context) {
|
||||||
|
if h.smsService == nil {
|
||||||
|
c.JSON(http.StatusServiceUnavailable, gin.H{"error": "SMS service not configured"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req ForgotPasswordByPhoneRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 获取验证码（不发送，由调用方通过其他渠道发送）
|
||||||
|
code, err := h.passwordResetService.ForgotPasswordByPhone(c.Request.Context(), req.Phone)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if code == "" {
|
||||||
|
// 用户不存在，不提示
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "verification code sent"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 通过SMS服务发送验证码
|
||||||
|
sendReq := &service.SendCodeRequest{
|
||||||
|
Phone: req.Phone,
|
||||||
|
Purpose: "password_reset",
|
||||||
|
}
|
||||||
|
_, err = h.smsService.SendCode(c.Request.Context(), sendReq)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "verification code sent"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// ResetPasswordByPhoneRequest 短信验证码重置密码请求
|
||||||
|
type ResetPasswordByPhoneRequest struct {
|
||||||
|
Phone string `json:"phone" binding:"required"`
|
||||||
|
Code string `json:"code" binding:"required"`
|
||||||
|
NewPassword string `json:"new_password" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ResetPasswordByPhone 通过短信验证码重置密码
|
||||||
|
func (h *PasswordResetHandler) ResetPasswordByPhone(c *gin.Context) {
|
||||||
|
var req ResetPasswordByPhoneRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
err := h.passwordResetService.ResetPasswordByPhone(c.Request.Context(), &service.ResetPasswordByPhoneRequest{
|
||||||
|
Phone: req.Phone,
|
||||||
|
Code: req.Code,
|
||||||
|
NewPassword: req.NewPassword,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "password reset successful"})
|
||||||
|
}
|
||||||
154
internal/api/handler/permission_handler.go
Normal file
154
internal/api/handler/permission_handler.go
Normal file
@@ -0,0 +1,154 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// PermissionHandler handles permission management requests
|
||||||
|
type PermissionHandler struct {
|
||||||
|
permissionService *service.PermissionService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPermissionHandler creates a new PermissionHandler
|
||||||
|
func NewPermissionHandler(permissionService *service.PermissionService) *PermissionHandler {
|
||||||
|
return &PermissionHandler{permissionService: permissionService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) CreatePermission(c *gin.Context) {
|
||||||
|
var req service.CreatePermissionRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perm, err := h.permissionService.CreatePermission(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, perm)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) ListPermissions(c *gin.Context) {
|
||||||
|
var req service.ListPermissionRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perms, total, err := h.permissionService.ListPermissions(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"permissions": perms,
|
||||||
|
"total": total,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) GetPermission(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid permission id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perm, err := h.permissionService.GetPermission(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, perm)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) UpdatePermission(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid permission id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.UpdatePermissionRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perm, err := h.permissionService.UpdatePermission(c.Request.Context(), id, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, perm)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) DeletePermission(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid permission id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.permissionService.DeletePermission(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "permission deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) UpdatePermissionStatus(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid permission id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Status string `json:"status" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var status domain.PermissionStatus
|
||||||
|
switch req.Status {
|
||||||
|
case "enabled", "1":
|
||||||
|
status = domain.PermissionStatusEnabled
|
||||||
|
case "disabled", "0":
|
||||||
|
status = domain.PermissionStatusDisabled
|
||||||
|
default:
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid status"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.permissionService.UpdatePermissionStatus(c.Request.Context(), id, status); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "status updated"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *PermissionHandler) GetPermissionTree(c *gin.Context) {
|
||||||
|
tree, err := h.permissionService.GetPermissionTree(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"permissions": tree})
|
||||||
|
}
|
||||||
186
internal/api/handler/role_handler.go
Normal file
186
internal/api/handler/role_handler.go
Normal file
@@ -0,0 +1,186 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// RoleHandler handles role management requests
|
||||||
|
type RoleHandler struct {
|
||||||
|
roleService *service.RoleService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewRoleHandler creates a new RoleHandler
|
||||||
|
func NewRoleHandler(roleService *service.RoleService) *RoleHandler {
|
||||||
|
return &RoleHandler{roleService: roleService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) CreateRole(c *gin.Context) {
|
||||||
|
var req service.CreateRoleRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
role, err := h.roleService.CreateRole(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, role)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) ListRoles(c *gin.Context) {
|
||||||
|
var req service.ListRoleRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
roles, total, err := h.roleService.ListRoles(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"roles": roles,
|
||||||
|
"total": total,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) GetRole(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
role, err := h.roleService.GetRole(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, role)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) UpdateRole(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.UpdateRoleRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
role, err := h.roleService.UpdateRole(c.Request.Context(), id, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, role)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) DeleteRole(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.roleService.DeleteRole(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "role deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) UpdateRoleStatus(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Status string `json:"status" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var status domain.RoleStatus
|
||||||
|
switch req.Status {
|
||||||
|
case "enabled", "1":
|
||||||
|
status = domain.RoleStatusEnabled
|
||||||
|
case "disabled", "0":
|
||||||
|
status = domain.RoleStatusDisabled
|
||||||
|
default:
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid status"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
err = h.roleService.UpdateRoleStatus(c.Request.Context(), id, status)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "status updated"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) GetRolePermissions(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perms, err := h.roleService.GetRolePermissions(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"permissions": perms})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *RoleHandler) AssignPermissions(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid role id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
PermissionIDs []int64 `json:"permission_ids"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
err = h.roleService.AssignPermissions(c.Request.Context(), id, req.PermissionIDs)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "permissions assigned"})
|
||||||
|
}
|
||||||
23
internal/api/handler/sms_handler.go
Normal file
23
internal/api/handler/sms_handler.go
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SMSHandler handles SMS requests
|
||||||
|
type SMSHandler struct{}
|
||||||
|
|
||||||
|
// NewSMSHandler creates a new SMSHandler
|
||||||
|
func NewSMSHandler() *SMSHandler {
|
||||||
|
return &SMSHandler{}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *SMSHandler) SendCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "SMS not configured"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *SMSHandler) LoginByCode(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"error": "SMS login not configured"})
|
||||||
|
}
|
||||||
236
internal/api/handler/sso_handler.go
Normal file
236
internal/api/handler/sso_handler.go
Normal file
@@ -0,0 +1,236 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SSOHandler SSO 处理程序
|
||||||
|
type SSOHandler struct {
|
||||||
|
ssoManager *auth.SSOManager
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewSSOHandler 创建 SSO 处理程序
|
||||||
|
func NewSSOHandler(ssoManager *auth.SSOManager) *SSOHandler {
|
||||||
|
return &SSOHandler{ssoManager: ssoManager}
|
||||||
|
}
|
||||||
|
|
||||||
|
// AuthorizeRequest 授权请求
|
||||||
|
type AuthorizeRequest struct {
|
||||||
|
ClientID string `form:"client_id" binding:"required"`
|
||||||
|
RedirectURI string `form:"redirect_uri" binding:"required"`
|
||||||
|
ResponseType string `form:"response_type" binding:"required"`
|
||||||
|
Scope string `form:"scope"`
|
||||||
|
State string `form:"state"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Authorize 处理 SSO 授权请求
|
||||||
|
// GET /api/v1/sso/authorize?client_id=xxx&redirect_uri=xxx&response_type=code&scope=openid&state=xxx
|
||||||
|
func (h *SSOHandler) Authorize(c *gin.Context) {
|
||||||
|
var req AuthorizeRequest
|
||||||
|
if err := c.ShouldBindQuery(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 验证 response_type
|
||||||
|
if req.ResponseType != "code" && req.ResponseType != "token" {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported response_type"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 获取当前登录用户（从 auth middleware 设置的 context）
|
||||||
|
userID, exists := c.Get("user_id")
|
||||||
|
if !exists {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
username, _ := c.Get("username")
|
||||||
|
|
||||||
|
// 生成授权码或 access token
|
||||||
|
if req.ResponseType == "code" {
|
||||||
|
code, err := h.ssoManager.GenerateAuthorizationCode(
|
||||||
|
req.ClientID,
|
||||||
|
req.RedirectURI,
|
||||||
|
req.Scope,
|
||||||
|
userID.(int64),
|
||||||
|
username.(string),
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate code"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 重定向回客户端
|
||||||
|
redirectURL := req.RedirectURI + "?code=" + code
|
||||||
|
if req.State != "" {
|
||||||
|
redirectURL += "&state=" + req.State
|
||||||
|
}
|
||||||
|
c.Redirect(http.StatusFound, redirectURL)
|
||||||
|
} else {
|
||||||
|
// implicit 模式，直接返回 token
|
||||||
|
code, err := h.ssoManager.GenerateAuthorizationCode(
|
||||||
|
req.ClientID,
|
||||||
|
req.RedirectURI,
|
||||||
|
req.Scope,
|
||||||
|
userID.(int64),
|
||||||
|
username.(string),
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate code"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 验证授权码获取 session
|
||||||
|
session, err := h.ssoManager.ValidateAuthorizationCode(code)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to validate code"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
token, _ := h.ssoManager.GenerateAccessToken(req.ClientID, session)
|
||||||
|
|
||||||
|
// 重定向回客户端，带 token
|
||||||
|
redirectURL := req.RedirectURI + "#access_token=" + token + "&expires_in=7200"
|
||||||
|
if req.State != "" {
|
||||||
|
redirectURL += "&state=" + req.State
|
||||||
|
}
|
||||||
|
c.Redirect(http.StatusFound, redirectURL)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TokenRequest Token 请求
|
||||||
|
type TokenRequest struct {
|
||||||
|
GrantType string `form:"grant_type" binding:"required"`
|
||||||
|
Code string `form:"code"`
|
||||||
|
RedirectURI string `form:"redirect_uri"`
|
||||||
|
ClientID string `form:"client_id" binding:"required"`
|
||||||
|
ClientSecret string `form:"client_secret" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TokenResponse Token 响应
|
||||||
|
type TokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
ExpiresIn int64 `json:"expires_in"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Token 处理 Token 请求（授权码模式第二步）
|
||||||
|
// POST /api/v1/sso/token
|
||||||
|
func (h *SSOHandler) Token(c *gin.Context) {
|
||||||
|
var req TokenRequest
|
||||||
|
if err := c.ShouldBind(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 验证 grant_type
|
||||||
|
if req.GrantType != "authorization_code" {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported grant_type"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 验证授权码
|
||||||
|
session, err := h.ssoManager.ValidateAuthorizationCode(req.Code)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid code"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 生成 access token
|
||||||
|
token, expiresAt := h.ssoManager.GenerateAccessToken(req.ClientID, session)
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, TokenResponse{
|
||||||
|
AccessToken: token,
|
||||||
|
TokenType: "Bearer",
|
||||||
|
ExpiresIn: int64(time.Until(expiresAt).Seconds()),
|
||||||
|
Scope: session.Scope,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// IntrospectRequest Introspect 请求
|
||||||
|
type IntrospectRequest struct {
|
||||||
|
Token string `form:"token" binding:"required"`
|
||||||
|
ClientID string `form:"client_id"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// IntrospectResponse Introspect 响应
|
||||||
|
type IntrospectResponse struct {
|
||||||
|
Active bool `json:"active"`
|
||||||
|
UserID int64 `json:"user_id,omitempty"`
|
||||||
|
Username string `json:"username,omitempty"`
|
||||||
|
ExpiresAt int64 `json:"exp,omitempty"`
|
||||||
|
Scope string `json:"scope,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Introspect 验证 access token
|
||||||
|
// POST /api/v1/sso/introspect
|
||||||
|
func (h *SSOHandler) Introspect(c *gin.Context) {
|
||||||
|
var req IntrospectRequest
|
||||||
|
if err := c.ShouldBind(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
info, err := h.ssoManager.IntrospectToken(req.Token)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusOK, IntrospectResponse{Active: false})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, IntrospectResponse{
|
||||||
|
Active: info.Active,
|
||||||
|
UserID: info.UserID,
|
||||||
|
Username: info.Username,
|
||||||
|
ExpiresAt: info.ExpiresAt.Unix(),
|
||||||
|
Scope: info.Scope,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// RevokeRequest 撤销请求
|
||||||
|
type RevokeRequest struct {
|
||||||
|
Token string `form:"token" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Revoke 撤销 access token
|
||||||
|
// POST /api/v1/sso/revoke
|
||||||
|
func (h *SSOHandler) Revoke(c *gin.Context) {
|
||||||
|
var req RevokeRequest
|
||||||
|
if err := c.ShouldBind(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
h.ssoManager.RevokeToken(req.Token)
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "token revoked"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// UserInfoResponse 用户信息响应
|
||||||
|
type UserInfoResponse struct {
|
||||||
|
UserID int64 `json:"user_id"`
|
||||||
|
Username string `json:"username"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// UserInfo 获取当前用户信息（SSO 专用）
|
||||||
|
// GET /api/v1/sso/userinfo
|
||||||
|
func (h *SSOHandler) UserInfo(c *gin.Context) {
|
||||||
|
userID, exists := c.Get("user_id")
|
||||||
|
if !exists {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
username, _ := c.Get("username")
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, UserInfoResponse{
|
||||||
|
UserID: userID.(int64),
|
||||||
|
Username: username.(string),
|
||||||
|
})
|
||||||
|
}
|
||||||
27
internal/api/handler/stats_handler.go
Normal file
27
internal/api/handler/stats_handler.go
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// StatsHandler handles statistics requests
|
||||||
|
type StatsHandler struct {
|
||||||
|
statsService *service.StatsService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewStatsHandler creates a new StatsHandler
|
||||||
|
func NewStatsHandler(statsService *service.StatsService) *StatsHandler {
|
||||||
|
return &StatsHandler{statsService: statsService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *StatsHandler) GetDashboard(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "dashboard stats not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *StatsHandler) GetUserStats(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "user stats not implemented"})
|
||||||
|
}
|
||||||
153
internal/api/handler/theme_handler.go
Normal file
153
internal/api/handler/theme_handler.go
Normal file
@@ -0,0 +1,153 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ThemeHandler 主题配置处理器
|
||||||
|
type ThemeHandler struct {
|
||||||
|
themeService *service.ThemeService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewThemeHandler 创建主题配置处理器
|
||||||
|
func NewThemeHandler(themeService *service.ThemeService) *ThemeHandler {
|
||||||
|
return &ThemeHandler{themeService: themeService}
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateTheme 创建主题
|
||||||
|
func (h *ThemeHandler) CreateTheme(c *gin.Context) {
|
||||||
|
var req service.CreateThemeRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
theme, err := h.themeService.CreateTheme(c.Request.Context(), &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, theme)
|
||||||
|
}
|
||||||
|
|
||||||
|
// UpdateTheme 更新主题
|
||||||
|
func (h *ThemeHandler) UpdateTheme(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid theme id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req service.UpdateThemeRequest
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
theme, err := h.themeService.UpdateTheme(c.Request.Context(), id, &req)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, theme)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeleteTheme 删除主题
|
||||||
|
func (h *ThemeHandler) DeleteTheme(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid theme id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.themeService.DeleteTheme(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "theme deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetTheme 获取主题
|
||||||
|
func (h *ThemeHandler) GetTheme(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid theme id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
theme, err := h.themeService.GetTheme(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, theme)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ListThemes 获取所有主题
|
||||||
|
func (h *ThemeHandler) ListThemes(c *gin.Context) {
|
||||||
|
themes, err := h.themeService.ListThemes(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"themes": themes})
|
||||||
|
}
|
||||||
|
|
||||||
|
// ListAllThemes 获取所有主题（包括禁用的）
|
||||||
|
func (h *ThemeHandler) ListAllThemes(c *gin.Context) {
|
||||||
|
themes, err := h.themeService.ListAllThemes(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"themes": themes})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetDefaultTheme 获取默认主题
|
||||||
|
func (h *ThemeHandler) GetDefaultTheme(c *gin.Context) {
|
||||||
|
theme, err := h.themeService.GetDefaultTheme(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, theme)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetDefaultTheme 设置默认主题
|
||||||
|
func (h *ThemeHandler) SetDefaultTheme(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid theme id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.themeService.SetDefaultTheme(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "default theme set"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetActiveTheme 获取当前生效的主题（公开接口）
|
||||||
|
func (h *ThemeHandler) GetActiveTheme(c *gin.Context) {
|
||||||
|
theme, err := h.themeService.GetActiveTheme(c.Request.Context())
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, theme)
|
||||||
|
}
|
||||||
132
internal/api/handler/totp_handler.go
Normal file
132
internal/api/handler/totp_handler.go
Normal file
@@ -0,0 +1,132 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TOTPHandler handles TOTP 2FA requests
|
||||||
|
type TOTPHandler struct {
|
||||||
|
authService *service.AuthService
|
||||||
|
totpService *service.TOTPService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewTOTPHandler creates a new TOTPHandler
|
||||||
|
func NewTOTPHandler(authService *service.AuthService, totpService *service.TOTPService) *TOTPHandler {
|
||||||
|
return &TOTPHandler{
|
||||||
|
authService: authService,
|
||||||
|
totpService: totpService,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *TOTPHandler) GetTOTPStatus(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
enabled, err := h.totpService.GetTOTPStatus(c.Request.Context(), userID)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"enabled": enabled})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *TOTPHandler) SetupTOTP(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, err := h.totpService.SetupTOTP(c.Request.Context(), userID)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"secret": resp.Secret,
|
||||||
|
"qr_code_base64": resp.QRCodeBase64,
|
||||||
|
"recovery_codes": resp.RecoveryCodes,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *TOTPHandler) EnableTOTP(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Code string `json:"code" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.totpService.EnableTOTP(c.Request.Context(), userID, req.Code); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "TOTP enabled"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *TOTPHandler) DisableTOTP(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Code string `json:"code" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.totpService.DisableTOTP(c.Request.Context(), userID, req.Code); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "TOTP disabled"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *TOTPHandler) VerifyTOTP(c *gin.Context) {
|
||||||
|
userID, ok := getUserIDFromContext(c)
|
||||||
|
if !ok {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Code string `json:"code" binding:"required"`
|
||||||
|
DeviceID string `json:"device_id,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.authService.VerifyTOTP(c.Request.Context(), userID, req.Code, req.DeviceID); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"verified": true})
|
||||||
|
}
|
||||||
261
internal/api/handler/user_handler.go
Normal file
261
internal/api/handler/user_handler.go
Normal file
@@ -0,0 +1,261 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// UserHandler handles user management requests
|
||||||
|
type UserHandler struct {
|
||||||
|
userService *service.UserService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewUserHandler creates a new UserHandler
|
||||||
|
func NewUserHandler(userService *service.UserService) *UserHandler {
|
||||||
|
return &UserHandler{userService: userService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) CreateUser(c *gin.Context) {
|
||||||
|
var req struct {
|
||||||
|
Username string `json:"username" binding:"required"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
Password string `json:"password"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
user := &domain.User{
|
||||||
|
Username: req.Username,
|
||||||
|
Email: domain.StrPtr(req.Email),
|
||||||
|
Nickname: req.Nickname,
|
||||||
|
Status: domain.UserStatusActive,
|
||||||
|
}
|
||||||
|
|
||||||
|
if req.Password != "" {
|
||||||
|
hashed, err := auth.HashPassword(req.Password)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to hash password"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
user.Password = hashed
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.userService.Create(c.Request.Context(), user); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusCreated, toUserResponse(user))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) ListUsers(c *gin.Context) {
|
||||||
|
offset, _ := strconv.ParseInt(c.DefaultQuery("offset", "0"), 10, 64)
|
||||||
|
limit, _ := strconv.ParseInt(c.DefaultQuery("limit", "20"), 10, 64)
|
||||||
|
|
||||||
|
users, total, err := h.userService.List(c.Request.Context(), int(offset), int(limit))
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
userResponses := make([]*UserResponse, len(users))
|
||||||
|
for i, u := range users {
|
||||||
|
userResponses[i] = toUserResponse(u)
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{
|
||||||
|
"users": userResponses,
|
||||||
|
"total": total,
|
||||||
|
"offset": offset,
|
||||||
|
"limit": limit,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) GetUser(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
user, err := h.userService.GetByID(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, toUserResponse(user))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) UpdateUser(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Email *string `json:"email"`
|
||||||
|
Nickname *string `json:"nickname"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
user, err := h.userService.GetByID(c.Request.Context(), id)
|
||||||
|
if err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if req.Email != nil {
|
||||||
|
user.Email = req.Email
|
||||||
|
}
|
||||||
|
if req.Nickname != nil {
|
||||||
|
user.Nickname = *req.Nickname
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.userService.Update(c.Request.Context(), user); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, toUserResponse(user))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) DeleteUser(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.userService.Delete(c.Request.Context(), id); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "user deleted"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) UpdatePassword(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
OldPassword string `json:"old_password" binding:"required"`
|
||||||
|
NewPassword string `json:"new_password" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.userService.ChangePassword(c.Request.Context(), id, req.OldPassword, req.NewPassword); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "密码修改成功"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) UpdateUserStatus(c *gin.Context) {
|
||||||
|
id, err := strconv.ParseInt(c.Param("id"), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req struct {
|
||||||
|
Status string `json:"status" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var status domain.UserStatus
|
||||||
|
switch req.Status {
|
||||||
|
case "active", "1":
|
||||||
|
status = domain.UserStatusActive
|
||||||
|
case "inactive", "0":
|
||||||
|
status = domain.UserStatusInactive
|
||||||
|
case "locked", "2":
|
||||||
|
status = domain.UserStatusLocked
|
||||||
|
case "disabled", "3":
|
||||||
|
status = domain.UserStatusDisabled
|
||||||
|
default:
|
||||||
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid status"})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := h.userService.UpdateStatus(c.Request.Context(), id, status); err != nil {
|
||||||
|
handleError(c, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "status updated"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) GetUserRoles(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"roles": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) AssignRoles(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "role assignment not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) UploadAvatar(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "avatar upload not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) ListAdmins(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"admins": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) CreateAdmin(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "admin creation not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *UserHandler) DeleteAdmin(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "admin deletion not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
type UserResponse struct {
|
||||||
|
ID int64 `json:"id"`
|
||||||
|
Username string `json:"username"`
|
||||||
|
Email string `json:"email,omitempty"`
|
||||||
|
Nickname string `json:"nickname,omitempty"`
|
||||||
|
Status string `json:"status"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func toUserResponse(u *domain.User) *UserResponse {
|
||||||
|
email := ""
|
||||||
|
if u.Email != nil {
|
||||||
|
email = *u.Email
|
||||||
|
}
|
||||||
|
return &UserResponse{
|
||||||
|
ID: u.ID,
|
||||||
|
Username: u.Username,
|
||||||
|
Email: email,
|
||||||
|
Nickname: u.Nickname,
|
||||||
|
Status: strconv.FormatInt(int64(u.Status), 10),
|
||||||
|
}
|
||||||
|
}
|
||||||
39
internal/api/handler/webhook_handler.go
Normal file
39
internal/api/handler/webhook_handler.go
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/service"
|
||||||
|
)
|
||||||
|
|
||||||
|
// WebhookHandler handles webhook requests
|
||||||
|
type WebhookHandler struct {
|
||||||
|
webhookService *service.WebhookService
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewWebhookHandler creates a new WebhookHandler
|
||||||
|
func NewWebhookHandler(webhookService *service.WebhookService) *WebhookHandler {
|
||||||
|
return &WebhookHandler{webhookService: webhookService}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *WebhookHandler) CreateWebhook(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "webhook creation not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *WebhookHandler) ListWebhooks(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"webhooks": []interface{}{}})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *WebhookHandler) UpdateWebhook(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "webhook update not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *WebhookHandler) DeleteWebhook(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"message": "webhook deletion not implemented"})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *WebhookHandler) GetWebhookDeliveries(c *gin.Context) {
|
||||||
|
c.JSON(http.StatusOK, gin.H{"deliveries": []interface{}{}})
|
||||||
|
}
|
||||||
240
internal/api/middleware/auth.go
Normal file
240
internal/api/middleware/auth.go
Normal file
@@ -0,0 +1,240 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
"github.com/user-management-system/internal/cache"
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
apierrors "github.com/user-management-system/internal/pkg/errors"
|
||||||
|
"github.com/user-management-system/internal/repository"
|
||||||
|
)
|
||||||
|
|
||||||
|
type AuthMiddleware struct {
|
||||||
|
jwt *auth.JWT
|
||||||
|
userRepo *repository.UserRepository
|
||||||
|
userRoleRepo *repository.UserRoleRepository
|
||||||
|
roleRepo *repository.RoleRepository
|
||||||
|
rolePermissionRepo *repository.RolePermissionRepository
|
||||||
|
permissionRepo *repository.PermissionRepository
|
||||||
|
l1Cache *cache.L1Cache
|
||||||
|
cacheManager *cache.CacheManager
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewAuthMiddleware(
|
||||||
|
jwt *auth.JWT,
|
||||||
|
userRepo *repository.UserRepository,
|
||||||
|
userRoleRepo *repository.UserRoleRepository,
|
||||||
|
roleRepo *repository.RoleRepository,
|
||||||
|
rolePermissionRepo *repository.RolePermissionRepository,
|
||||||
|
permissionRepo *repository.PermissionRepository,
|
||||||
|
) *AuthMiddleware {
|
||||||
|
return &AuthMiddleware{
|
||||||
|
jwt: jwt,
|
||||||
|
userRepo: userRepo,
|
||||||
|
userRoleRepo: userRoleRepo,
|
||||||
|
roleRepo: roleRepo,
|
||||||
|
rolePermissionRepo: rolePermissionRepo,
|
||||||
|
permissionRepo: permissionRepo,
|
||||||
|
l1Cache: cache.NewL1Cache(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) SetCacheManager(cm *cache.CacheManager) {
|
||||||
|
m.cacheManager = cm
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) Required() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
token := m.extractToken(c)
|
||||||
|
if token == "" {
|
||||||
|
c.JSON(http.StatusUnauthorized, apierrors.New(http.StatusUnauthorized, "UNAUTHORIZED", "未提供认证令牌"))
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
claims, err := m.jwt.ValidateAccessToken(token)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusUnauthorized, apierrors.New(http.StatusUnauthorized, "UNAUTHORIZED", "无效的认证令牌"))
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if m.isJTIBlacklisted(claims.JTI) {
|
||||||
|
c.JSON(http.StatusUnauthorized, apierrors.New(http.StatusUnauthorized, "UNAUTHORIZED", "令牌已失效，请重新登录"))
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if !m.isUserActive(c.Request.Context(), claims.UserID) {
|
||||||
|
c.JSON(http.StatusUnauthorized, apierrors.New(http.StatusUnauthorized, "UNAUTHORIZED", "账号不可用，请重新登录"))
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Set("user_id", claims.UserID)
|
||||||
|
c.Set("username", claims.Username)
|
||||||
|
c.Set("token_jti", claims.JTI)
|
||||||
|
|
||||||
|
roleCodes, permCodes := m.loadUserRolesAndPerms(c.Request.Context(), claims.UserID)
|
||||||
|
c.Set("role_codes", roleCodes)
|
||||||
|
c.Set("permission_codes", permCodes)
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) Optional() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
token := m.extractToken(c)
|
||||||
|
if token != "" {
|
||||||
|
claims, err := m.jwt.ValidateAccessToken(token)
|
||||||
|
if err == nil && !m.isJTIBlacklisted(claims.JTI) && m.isUserActive(c.Request.Context(), claims.UserID) {
|
||||||
|
c.Set("user_id", claims.UserID)
|
||||||
|
c.Set("username", claims.Username)
|
||||||
|
c.Set("token_jti", claims.JTI)
|
||||||
|
roleCodes, permCodes := m.loadUserRolesAndPerms(c.Request.Context(), claims.UserID)
|
||||||
|
c.Set("role_codes", roleCodes)
|
||||||
|
c.Set("permission_codes", permCodes)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) isJTIBlacklisted(jti string) bool {
|
||||||
|
if jti == "" {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
key := "jwt_blacklist:" + jti
|
||||||
|
if _, ok := m.l1Cache.Get(key); ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
if m.cacheManager != nil {
|
||||||
|
if _, ok := m.cacheManager.Get(context.Background(), key); ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) loadUserRolesAndPerms(ctx context.Context, userID int64) ([]string, []string) {
|
||||||
|
if m.userRoleRepo == nil || m.roleRepo == nil || m.rolePermissionRepo == nil || m.permissionRepo == nil {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
cacheKey := fmt.Sprintf("user_perms:%d", userID)
|
||||||
|
if cached, ok := m.l1Cache.Get(cacheKey); ok {
|
||||||
|
if entry, ok := cached.(userPermEntry); ok {
|
||||||
|
return entry.roles, entry.perms
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
roleIDs, err := m.userRoleRepo.GetRoleIDsByUserID(ctx, userID)
|
||||||
|
if err != nil || len(roleIDs) == 0 {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// 收集所有角色ID（包括直接分配的角色和所有祖先角色）
|
||||||
|
allRoleIDs := make([]int64, 0, len(roleIDs)*2)
|
||||||
|
allRoleIDs = append(allRoleIDs, roleIDs...)
|
||||||
|
|
||||||
|
for _, roleID := range roleIDs {
|
||||||
|
ancestorIDs, err := m.roleRepo.GetAncestorIDs(ctx, roleID)
|
||||||
|
if err == nil && len(ancestorIDs) > 0 {
|
||||||
|
allRoleIDs = append(allRoleIDs, ancestorIDs...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 去重
|
||||||
|
seen := make(map[int64]bool)
|
||||||
|
uniqueRoleIDs := make([]int64, 0, len(allRoleIDs))
|
||||||
|
for _, id := range allRoleIDs {
|
||||||
|
if !seen[id] {
|
||||||
|
seen[id] = true
|
||||||
|
uniqueRoleIDs = append(uniqueRoleIDs, id)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
roles, err := m.roleRepo.GetByIDs(ctx, roleIDs)
|
||||||
|
if err != nil {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
roleCodes := make([]string, 0, len(roles))
|
||||||
|
for _, role := range roles {
|
||||||
|
roleCodes = append(roleCodes, role.Code)
|
||||||
|
}
|
||||||
|
|
||||||
|
permissionIDs, err := m.rolePermissionRepo.GetPermissionIDsByRoleIDs(ctx, uniqueRoleIDs)
|
||||||
|
if err != nil || len(permissionIDs) == 0 {
|
||||||
|
entry := userPermEntry{roles: roleCodes, perms: []string{}}
|
||||||
|
m.l1Cache.Set(cacheKey, entry, 30*time.Minute) // PERF-01 优化：增加缓存 TTL 减少 DB 查询
|
||||||
|
return entry.roles, entry.perms
|
||||||
|
}
|
||||||
|
|
||||||
|
permissions, err := m.permissionRepo.GetByIDs(ctx, permissionIDs)
|
||||||
|
if err != nil {
|
||||||
|
return roleCodes, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
permCodes := make([]string, 0, len(permissions))
|
||||||
|
for _, permission := range permissions {
|
||||||
|
permCodes = append(permCodes, permission.Code)
|
||||||
|
}
|
||||||
|
|
||||||
|
m.l1Cache.Set(cacheKey, userPermEntry{roles: roleCodes, perms: permCodes}, 30*time.Minute) // PERF-01 优化：增加缓存 TTL 减少 DB 查询
|
||||||
|
return roleCodes, permCodes
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) InvalidateUserPermCache(userID int64) {
|
||||||
|
m.l1Cache.Delete(fmt.Sprintf("user_perms:%d", userID))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) AddToBlacklist(jti string, ttl time.Duration) {
|
||||||
|
if jti != "" && ttl > 0 {
|
||||||
|
m.l1Cache.Set("jwt_blacklist:"+jti, true, ttl)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) isUserActive(ctx context.Context, userID int64) bool {
|
||||||
|
if m.userRepo == nil {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
user, err := m.userRepo.GetByID(ctx, userID)
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
return user.Status == domain.UserStatusActive
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *AuthMiddleware) extractToken(c *gin.Context) string {
|
||||||
|
authHeader := c.GetHeader("Authorization")
|
||||||
|
if authHeader == "" {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
parts := strings.SplitN(authHeader, " ", 2)
|
||||||
|
if len(parts) != 2 || parts[0] != "Bearer" {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
return parts[1]
|
||||||
|
}
|
||||||
|
|
||||||
|
type userPermEntry struct {
|
||||||
|
roles []string
|
||||||
|
perms []string
|
||||||
|
}
|
||||||
32
internal/api/middleware/cache_control.go
Normal file
32
internal/api/middleware/cache_control.go
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
const sensitiveNoStoreCacheControl = "no-store, no-cache, must-revalidate, max-age=0"
|
||||||
|
|
||||||
|
// NoStoreSensitiveResponses prevents browser or intermediary caching for auth routes.
|
||||||
|
func NoStoreSensitiveResponses() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
if shouldDisableCaching(c.FullPath(), c.Request.URL.Path) {
|
||||||
|
headers := c.Writer.Header()
|
||||||
|
headers.Set("Cache-Control", sensitiveNoStoreCacheControl)
|
||||||
|
headers.Set("Pragma", "no-cache")
|
||||||
|
headers.Set("Expires", "0")
|
||||||
|
headers.Set("Surrogate-Control", "no-store")
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func shouldDisableCaching(routePath, requestPath string) bool {
|
||||||
|
path := strings.TrimSpace(routePath)
|
||||||
|
if path == "" {
|
||||||
|
path = strings.TrimSpace(requestPath)
|
||||||
|
}
|
||||||
|
return strings.HasPrefix(path, "/api/v1/auth")
|
||||||
|
}
|
||||||
67
internal/api/middleware/cors.go
Normal file
67
internal/api/middleware/cors.go
Normal file
@@ -0,0 +1,67 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
var corsConfig = config.CORSConfig{
|
||||||
|
AllowedOrigins: []string{"*"},
|
||||||
|
AllowCredentials: true,
|
||||||
|
}
|
||||||
|
|
||||||
|
func SetCORSConfig(cfg config.CORSConfig) {
|
||||||
|
corsConfig = cfg
|
||||||
|
}
|
||||||
|
|
||||||
|
func CORS() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
cfg := corsConfig
|
||||||
|
|
||||||
|
origin := c.GetHeader("Origin")
|
||||||
|
if origin != "" {
|
||||||
|
allowOrigin, allowed := resolveAllowedOrigin(origin, cfg.AllowedOrigins, cfg.AllowCredentials)
|
||||||
|
if !allowed {
|
||||||
|
if c.Request.Method == http.MethodOptions {
|
||||||
|
c.AbortWithStatus(http.StatusForbidden)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.AbortWithStatus(http.StatusForbidden)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Writer.Header().Set("Access-Control-Allow-Origin", allowOrigin)
|
||||||
|
if cfg.AllowCredentials {
|
||||||
|
c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if c.Request.Method == http.MethodOptions {
|
||||||
|
c.Writer.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
|
||||||
|
c.Writer.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Requested-With, X-CSRF-Token")
|
||||||
|
c.Writer.Header().Set("Access-Control-Max-Age", "3600")
|
||||||
|
c.AbortWithStatus(http.StatusNoContent)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func resolveAllowedOrigin(origin string, allowedOrigins []string, allowCredentials bool) (string, bool) {
|
||||||
|
for _, allowed := range allowedOrigins {
|
||||||
|
if allowed == "*" {
|
||||||
|
if allowCredentials {
|
||||||
|
return origin, true
|
||||||
|
}
|
||||||
|
return "*", true
|
||||||
|
}
|
||||||
|
if strings.EqualFold(origin, allowed) {
|
||||||
|
return origin, true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return "", false
|
||||||
|
}
|
||||||
43
internal/api/middleware/error.go
Normal file
43
internal/api/middleware/error.go
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
apierrors "github.com/user-management-system/internal/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ErrorHandler 错误处理中间件
|
||||||
|
func ErrorHandler() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
c.Next()
|
||||||
|
|
||||||
|
// 检查是否有错误
|
||||||
|
if len(c.Errors) > 0 {
|
||||||
|
// 获取最后一个错误
|
||||||
|
err := c.Errors.Last()
|
||||||
|
|
||||||
|
// 判断错误类型
|
||||||
|
if appErr, ok := err.Err.(*apierrors.ApplicationError); ok {
|
||||||
|
c.JSON(int(appErr.Code), appErr)
|
||||||
|
} else {
|
||||||
|
c.JSON(http.StatusInternalServerError, apierrors.New(http.StatusInternalServerError, "", err.Err.Error()))
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Recover 恢复中间件
|
||||||
|
func Recover() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
defer func() {
|
||||||
|
if err := recover(); err != nil {
|
||||||
|
c.JSON(http.StatusInternalServerError, apierrors.New(http.StatusInternalServerError, "", "服务器内部错误"))
|
||||||
|
c.Abort()
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
134
internal/api/middleware/ip_filter.go
Normal file
134
internal/api/middleware/ip_filter.go
Normal file
@@ -0,0 +1,134 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
"github.com/user-management-system/internal/security"
|
||||||
|
)
|
||||||
|
|
||||||
|
// IPFilterConfig IP过滤中间件配置
|
||||||
|
type IPFilterConfig struct {
|
||||||
|
TrustProxy bool // 是否信任 X-Forwarded-For
|
||||||
|
TrustedProxies []string // 可信代理 IP 列表
|
||||||
|
}
|
||||||
|
|
||||||
|
// IPFilterMiddleware IP 黑白名单过滤中间件
|
||||||
|
type IPFilterMiddleware struct {
|
||||||
|
filter *security.IPFilter
|
||||||
|
config IPFilterConfig
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewIPFilterMiddleware 创建 IP 过滤中间件
|
||||||
|
func NewIPFilterMiddleware(filter *security.IPFilter, config IPFilterConfig) *IPFilterMiddleware {
|
||||||
|
return &IPFilterMiddleware{filter: filter, config: config}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Filter 返回 Gin 中间件 HandlerFunc
|
||||||
|
// 逻辑：先取客户端真实 IP → 检查黑名单 → 被封则返回 403 并终止
|
||||||
|
func (m *IPFilterMiddleware) Filter() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
ip := m.realIP(c)
|
||||||
|
|
||||||
|
blocked, reason := m.filter.IsBlocked(ip)
|
||||||
|
if blocked {
|
||||||
|
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||||||
|
"code": 403,
|
||||||
|
"message": "访问被拒绝：" + reason,
|
||||||
|
})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 将真实 IP 写入 context，供后续中间件和 handler 直接取用
|
||||||
|
c.Set("client_ip", ip)
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetFilter 返回底层 IPFilter，供 handler 层做黑白名单管理
|
||||||
|
func (m *IPFilterMiddleware) GetFilter() *security.IPFilter {
|
||||||
|
return m.filter
|
||||||
|
}
|
||||||
|
|
||||||
|
// realIP 从请求中提取真实客户端 IP
|
||||||
|
// 优先级：X-Forwarded-For > X-Real-IP > RemoteAddr
|
||||||
|
// SEC-05 修复：如果启用 TrustProxy，只接受来自可信代理的 X-Forwarded-For
|
||||||
|
func (m *IPFilterMiddleware) realIP(c *gin.Context) string {
|
||||||
|
// 如果不信任代理，直接使用 TCP 连接 IP
|
||||||
|
if !m.config.TrustProxy {
|
||||||
|
return c.ClientIP()
|
||||||
|
}
|
||||||
|
|
||||||
|
// X-Forwarded-For 可能包含代理链
|
||||||
|
xff := c.GetHeader("X-Forwarded-For")
|
||||||
|
if xff != "" {
|
||||||
|
// 从右到左遍历（最右边是最后一次代理添加的）
|
||||||
|
for _, part := range strings.Split(xff, ",") {
|
||||||
|
ip := strings.TrimSpace(part)
|
||||||
|
if ip == "" {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
// 检查是否是可信代理
|
||||||
|
if !m.isTrustedProxy(ip) {
|
||||||
|
continue // 不是可信代理，跳过
|
||||||
|
}
|
||||||
|
// 是可信代理，检查是否为公网 IP
|
||||||
|
if !isPrivateIP(ip) {
|
||||||
|
return ip
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// X-Real-IP（Nginx 反代常用）
|
||||||
|
if xri := c.GetHeader("X-Real-IP"); xri != "" {
|
||||||
|
return strings.TrimSpace(xri)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 直接 TCP 连接的 RemoteAddr（去掉端口号）
|
||||||
|
ip, _, err := net.SplitHostPort(c.Request.RemoteAddr)
|
||||||
|
if err != nil {
|
||||||
|
return c.Request.RemoteAddr
|
||||||
|
}
|
||||||
|
return ip
|
||||||
|
}
|
||||||
|
|
||||||
|
// isTrustedProxy 检查 IP 是否在可信代理列表中
|
||||||
|
func (m *IPFilterMiddleware) isTrustedProxy(ip string) bool {
|
||||||
|
if len(m.config.TrustedProxies) == 0 {
|
||||||
|
return true // 如果没有配置可信代理列表，默认信任所有（兼容旧行为）
|
||||||
|
}
|
||||||
|
for _, trusted := range m.config.TrustedProxies {
|
||||||
|
if ip == trusted {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// isPrivateIP 判断是否为内网 IP
|
||||||
|
func isPrivateIP(ipStr string) bool {
|
||||||
|
ip := net.ParseIP(ipStr)
|
||||||
|
if ip == nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
privateRanges := []string{
|
||||||
|
"10.0.0.0/8",
|
||||||
|
"172.16.0.0/12",
|
||||||
|
"192.168.0.0/16",
|
||||||
|
"127.0.0.0/8",
|
||||||
|
"::1/128",
|
||||||
|
"fc00::/7",
|
||||||
|
}
|
||||||
|
for _, cidr := range privateRanges {
|
||||||
|
_, network, err := net.ParseCIDR(cidr)
|
||||||
|
if err != nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if network.Contains(ip) {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
258
internal/api/middleware/ip_filter_test.go
Normal file
258
internal/api/middleware/ip_filter_test.go
Normal file
@@ -0,0 +1,258 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
"github.com/user-management-system/internal/security"
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
}
|
||||||
|
|
||||||
|
// newTestEngine 用给定的 IPFilterMiddleware 构建一个最简 Gin 引擎，
|
||||||
|
// 注册一个 GET /ping 路由，返回 client_ip 值。
|
||||||
|
func newTestEngine(f *security.IPFilter) *gin.Engine {
|
||||||
|
engine := gin.New()
|
||||||
|
engine.Use(NewIPFilterMiddleware(f, IPFilterConfig{}).Filter())
|
||||||
|
engine.GET("/ping", func(c *gin.Context) {
|
||||||
|
ip, _ := c.Get("client_ip")
|
||||||
|
c.JSON(http.StatusOK, gin.H{"ip": ip})
|
||||||
|
})
|
||||||
|
return engine
|
||||||
|
}
|
||||||
|
|
||||||
|
// doRequest 发送 GET /ping，返回响应码和响应 body map。
|
||||||
|
func doRequest(engine *gin.Engine, remoteAddr, xff, xri string) (int, map[string]interface{}) {
|
||||||
|
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
||||||
|
req.RemoteAddr = remoteAddr
|
||||||
|
if xff != "" {
|
||||||
|
req.Header.Set("X-Forwarded-For", xff)
|
||||||
|
}
|
||||||
|
if xri != "" {
|
||||||
|
req.Header.Set("X-Real-IP", xri)
|
||||||
|
}
|
||||||
|
w := httptest.NewRecorder()
|
||||||
|
engine.ServeHTTP(w, req)
|
||||||
|
|
||||||
|
var body map[string]interface{}
|
||||||
|
_ = json.Unmarshal(w.Body.Bytes(), &body)
|
||||||
|
return w.Code, body
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- 黑名单拦截 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_BlockedIP_Returns403(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
_ = f.AddToBlacklist("1.2.3.4", "测试封禁", 0)
|
||||||
|
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
code, body := doRequest(engine, "1.2.3.4:9999", "", "")
|
||||||
|
|
||||||
|
if code != http.StatusForbidden {
|
||||||
|
t.Fatalf("期望 403，实际 %d", code)
|
||||||
|
}
|
||||||
|
msg, _ := body["message"].(string)
|
||||||
|
if msg == "" {
|
||||||
|
t.Error("期望 body 中包含 message 字段")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIPFilter_NonBlockedIP_Returns200(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
_ = f.AddToBlacklist("9.9.9.9", "其他 IP", 0)
|
||||||
|
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
code, _ := doRequest(engine, "1.2.3.4:9999", "", "")
|
||||||
|
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIPFilter_EmptyBlacklist_AllPass(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
for _, ip := range []string{"1.1.1.1:80", "8.8.8.8:443", "203.0.113.5:1234"} {
|
||||||
|
code, _ := doRequest(engine, ip, "", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Errorf("IP %s 应通过，实际 %d", ip, code)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- 白名单豁免 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_WhitelistOverridesBlacklist(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
_ = f.AddToBlacklist("5.5.5.5", "封禁测试", 0)
|
||||||
|
_ = f.AddToWhitelist("5.5.5.5", "白名单豁免")
|
||||||
|
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
// 白名单优先，应通过
|
||||||
|
code, _ := doRequest(engine, "5.5.5.5:8080", "", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("白名单 IP 应返回 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- CIDR 黑名单 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_CIDRBlacklist(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
_ = f.AddToBlacklist("10.10.10.0/24", "封禁整段 CIDR", 0)
|
||||||
|
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
// 在 CIDR 范围内，应被封
|
||||||
|
code, _ := doRequest(engine, "10.10.10.55:1234", "", "")
|
||||||
|
if code != http.StatusForbidden {
|
||||||
|
t.Fatalf("CIDR 内 IP 应返回 403，实际 %d", code)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 不在 CIDR 范围内，应通过
|
||||||
|
code2, _ := doRequest(engine, "10.10.11.1:1234", "", "")
|
||||||
|
if code2 != http.StatusOK {
|
||||||
|
t.Fatalf("CIDR 外 IP 应返回 200，实际 %d", code2)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- 过期规则 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_ExpiredRule_Passes(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
// 封禁 1 纳秒，几乎立即过期
|
||||||
|
_ = f.AddToBlacklist("7.7.7.7", "即将过期", time.Nanosecond)
|
||||||
|
time.Sleep(2 * time.Millisecond)
|
||||||
|
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
code, _ := doRequest(engine, "7.7.7.7:80", "", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("过期规则不应拦截，期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- client_ip 注入 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_ClientIPSetInContext(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
code, body := doRequest(engine, "203.0.113.1:9000", "", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
ip, _ := body["ip"].(string)
|
||||||
|
if ip != "203.0.113.1" {
|
||||||
|
t.Errorf("期望 client_ip=203.0.113.1，实际 %q", ip)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- realIP 提取逻辑 ----------
|
||||||
|
|
||||||
|
// TestRealIP_XForwardedFor_PublicIP 公网 X-Forwarded-For 取第一个非内网 IP
|
||||||
|
func TestRealIP_XForwardedFor_PublicIP(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
// X-Forwarded-For: 203.0.113.10, 192.168.1.1（代理内网）
|
||||||
|
code, body := doRequest(engine, "192.168.1.1:80", "203.0.113.10, 192.168.1.1", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
ip, _ := body["ip"].(string)
|
||||||
|
if ip != "203.0.113.10" {
|
||||||
|
t.Errorf("期望从 X-Forwarded-For 取公网 IP，实际 %q", ip)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestRealIP_XForwardedFor_AllPrivate 全内网则取第一个
|
||||||
|
func TestRealIP_XForwardedFor_AllPrivate(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
code, body := doRequest(engine, "10.0.0.2:80", "192.168.0.5, 10.0.0.1", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
ip, _ := body["ip"].(string)
|
||||||
|
if ip != "192.168.0.5" {
|
||||||
|
t.Errorf("全内网时应取第一个，实际 %q", ip)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestRealIP_XRealIP_Fallback X-Forwarded-For 缺失时使用 X-Real-IP
|
||||||
|
func TestRealIP_XRealIP_Fallback(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
code, body := doRequest(engine, "192.168.1.1:80", "", "203.0.113.20")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
ip, _ := body["ip"].(string)
|
||||||
|
if ip != "203.0.113.20" {
|
||||||
|
t.Errorf("期望 X-Real-IP 回退，实际 %q", ip)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestRealIP_RemoteAddr_Fallback 都无 header 时用 RemoteAddr
|
||||||
|
func TestRealIP_RemoteAddr_Fallback(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
code, body := doRequest(engine, "203.0.113.99:12345", "", "")
|
||||||
|
if code != http.StatusOK {
|
||||||
|
t.Fatalf("期望 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
ip, _ := body["ip"].(string)
|
||||||
|
if ip != "203.0.113.99" {
|
||||||
|
t.Errorf("期望 RemoteAddr 回退，实际 %q", ip)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- GetFilter ----------
|
||||||
|
|
||||||
|
func TestIPFilterMiddleware_GetFilter(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
mw := NewIPFilterMiddleware(f, IPFilterConfig{})
|
||||||
|
if mw.GetFilter() != f {
|
||||||
|
t.Error("GetFilter 应返回同一个 IPFilter 实例")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- 并发安全 ----------
|
||||||
|
|
||||||
|
func TestIPFilter_ConcurrentRequests(t *testing.T) {
|
||||||
|
f := security.NewIPFilter()
|
||||||
|
_ = f.AddToBlacklist("66.66.66.66", "并发测试封禁", 0)
|
||||||
|
engine := newTestEngine(f)
|
||||||
|
|
||||||
|
done := make(chan struct{}, 20)
|
||||||
|
for i := 0; i < 20; i++ {
|
||||||
|
go func(i int) {
|
||||||
|
defer func() { done <- struct{}{} }()
|
||||||
|
var remoteAddr string
|
||||||
|
if i%2 == 0 {
|
||||||
|
remoteAddr = "66.66.66.66:9000"
|
||||||
|
} else {
|
||||||
|
remoteAddr = "1.2.3.4:9000"
|
||||||
|
}
|
||||||
|
code, _ := doRequest(engine, remoteAddr, "", "")
|
||||||
|
if i%2 == 0 && code != http.StatusForbidden {
|
||||||
|
t.Errorf("并发：封禁 IP 应返回 403，实际 %d", code)
|
||||||
|
} else if i%2 != 0 && code != http.StatusOK {
|
||||||
|
t.Errorf("并发：正常 IP 应返回 200，实际 %d", code)
|
||||||
|
}
|
||||||
|
}(i)
|
||||||
|
}
|
||||||
|
for i := 0; i < 20; i++ {
|
||||||
|
<-done
|
||||||
|
}
|
||||||
|
}
|
||||||
83
internal/api/middleware/logger.go
Normal file
83
internal/api/middleware/logger.go
Normal file
@@ -0,0 +1,83 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"log"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
var sensitiveQueryKeys = map[string]struct{}{
|
||||||
|
"token": {},
|
||||||
|
"access_token": {},
|
||||||
|
"refresh_token": {},
|
||||||
|
"code": {},
|
||||||
|
"secret": {},
|
||||||
|
}
|
||||||
|
|
||||||
|
func Logger() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
start := time.Now()
|
||||||
|
path := c.Request.URL.Path
|
||||||
|
raw := sanitizeQuery(c.Request.URL.RawQuery)
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
|
||||||
|
latency := time.Since(start)
|
||||||
|
status := c.Writer.Status()
|
||||||
|
method := c.Request.Method
|
||||||
|
ip := c.ClientIP()
|
||||||
|
userAgent := c.Request.UserAgent()
|
||||||
|
userID, _ := c.Get("user_id")
|
||||||
|
|
||||||
|
log.Printf("[API] %s %s %s | status: %d | latency: %v | ip: %s | user_id: %v | ua: %s",
|
||||||
|
time.Now().Format("2006-01-02 15:04:05"),
|
||||||
|
method,
|
||||||
|
path,
|
||||||
|
status,
|
||||||
|
latency,
|
||||||
|
ip,
|
||||||
|
userID,
|
||||||
|
userAgent,
|
||||||
|
)
|
||||||
|
|
||||||
|
if len(c.Errors) > 0 {
|
||||||
|
for _, err := range c.Errors {
|
||||||
|
log.Printf("[Error] %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if raw != "" {
|
||||||
|
log.Printf("[Query] %s?%s", path, raw)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func sanitizeQuery(raw string) string {
|
||||||
|
if raw == "" {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
values, err := url.ParseQuery(raw)
|
||||||
|
if err != nil {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
for key := range values {
|
||||||
|
if isSensitiveQueryKey(key) {
|
||||||
|
values.Set(key, "***")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return values.Encode()
|
||||||
|
}
|
||||||
|
|
||||||
|
func isSensitiveQueryKey(key string) bool {
|
||||||
|
normalized := strings.ToLower(strings.TrimSpace(key))
|
||||||
|
if _, ok := sensitiveQueryKeys[normalized]; ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return strings.Contains(normalized, "token") || strings.Contains(normalized, "secret")
|
||||||
|
}
|
||||||
125
internal/api/middleware/operation_log.go
Normal file
125
internal/api/middleware/operation_log.go
Normal file
@@ -0,0 +1,125 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"io"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/repository"
|
||||||
|
)
|
||||||
|
|
||||||
|
type OperationLogMiddleware struct {
|
||||||
|
repo *repository.OperationLogRepository
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewOperationLogMiddleware(repo *repository.OperationLogRepository) *OperationLogMiddleware {
|
||||||
|
return &OperationLogMiddleware{repo: repo}
|
||||||
|
}
|
||||||
|
|
||||||
|
type bodyWriter struct {
|
||||||
|
gin.ResponseWriter
|
||||||
|
statusCode int
|
||||||
|
}
|
||||||
|
|
||||||
|
func newBodyWriter(w gin.ResponseWriter) *bodyWriter {
|
||||||
|
return &bodyWriter{ResponseWriter: w, statusCode: 200}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (bw *bodyWriter) WriteHeader(code int) {
|
||||||
|
bw.statusCode = code
|
||||||
|
bw.ResponseWriter.WriteHeader(code)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (bw *bodyWriter) WriteHeaderNow() {
|
||||||
|
bw.ResponseWriter.WriteHeaderNow()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *OperationLogMiddleware) Record() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
method := c.Request.Method
|
||||||
|
if method == "GET" || method == "HEAD" || method == "OPTIONS" {
|
||||||
|
c.Next()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var reqParams string
|
||||||
|
if c.Request.Body != nil {
|
||||||
|
bodyBytes, err := io.ReadAll(io.LimitReader(c.Request.Body, 4096))
|
||||||
|
if err == nil {
|
||||||
|
c.Request.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
|
||||||
|
reqParams = sanitizeParams(bodyBytes)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
bw := newBodyWriter(c.Writer)
|
||||||
|
c.Writer = bw
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
|
||||||
|
var userIDPtr *int64
|
||||||
|
if uid, exists := c.Get("user_id"); exists {
|
||||||
|
if id, ok := uid.(int64); ok {
|
||||||
|
userID := id
|
||||||
|
userIDPtr = &userID
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
logEntry := &domain.OperationLog{
|
||||||
|
UserID: userIDPtr,
|
||||||
|
OperationType: methodToType(method),
|
||||||
|
OperationName: c.FullPath(),
|
||||||
|
RequestMethod: method,
|
||||||
|
RequestPath: c.Request.URL.Path,
|
||||||
|
RequestParams: reqParams,
|
||||||
|
ResponseStatus: bw.statusCode,
|
||||||
|
IP: c.ClientIP(),
|
||||||
|
UserAgent: c.Request.UserAgent(),
|
||||||
|
}
|
||||||
|
|
||||||
|
go func(entry *domain.OperationLog) {
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
|
||||||
|
defer cancel()
|
||||||
|
_ = m.repo.Create(ctx, entry)
|
||||||
|
}(logEntry)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func methodToType(method string) string {
|
||||||
|
switch method {
|
||||||
|
case "POST":
|
||||||
|
return "CREATE"
|
||||||
|
case "PUT", "PATCH":
|
||||||
|
return "UPDATE"
|
||||||
|
case "DELETE":
|
||||||
|
return "DELETE"
|
||||||
|
default:
|
||||||
|
return "OTHER"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func sanitizeParams(data []byte) string {
|
||||||
|
var payload map[string]interface{}
|
||||||
|
if err := json.Unmarshal(data, &payload); err != nil {
|
||||||
|
if len(data) > 500 {
|
||||||
|
return string(data[:500]) + "..."
|
||||||
|
}
|
||||||
|
return string(data)
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, field := range []string{"password", "old_password", "new_password", "confirm_password", "secret", "token"} {
|
||||||
|
if _, ok := payload[field]; ok {
|
||||||
|
payload[field] = "***"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
result, err := json.Marshal(payload)
|
||||||
|
if err != nil {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
return string(result)
|
||||||
|
}
|
||||||
127
internal/api/middleware/ratelimit.go
Normal file
127
internal/api/middleware/ratelimit.go
Normal file
@@ -0,0 +1,127 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
// RateLimitMiddleware 限流中间件
|
||||||
|
type RateLimitMiddleware struct {
|
||||||
|
cfg config.RateLimitConfig
|
||||||
|
limiters map[string]*SlidingWindowLimiter
|
||||||
|
mu sync.RWMutex
|
||||||
|
cleanupInt time.Duration
|
||||||
|
}
|
||||||
|
|
||||||
|
// SlidingWindowLimiter 滑动窗口限流器
|
||||||
|
type SlidingWindowLimiter struct {
|
||||||
|
mu sync.Mutex
|
||||||
|
window time.Duration
|
||||||
|
capacity int64
|
||||||
|
requests []int64
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewSlidingWindowLimiter 创建滑动窗口限流器
|
||||||
|
func NewSlidingWindowLimiter(window time.Duration, capacity int64) *SlidingWindowLimiter {
|
||||||
|
return &SlidingWindowLimiter{
|
||||||
|
window: window,
|
||||||
|
capacity: capacity,
|
||||||
|
requests: make([]int64, 0),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Allow 检查是否允许请求
|
||||||
|
func (l *SlidingWindowLimiter) Allow() bool {
|
||||||
|
l.mu.Lock()
|
||||||
|
defer l.mu.Unlock()
|
||||||
|
|
||||||
|
now := time.Now().UnixMilli()
|
||||||
|
cutoff := now - l.window.Milliseconds()
|
||||||
|
|
||||||
|
// 清理过期请求
|
||||||
|
var validRequests []int64
|
||||||
|
for _, t := range l.requests {
|
||||||
|
if t > cutoff {
|
||||||
|
validRequests = append(validRequests, t)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
l.requests = validRequests
|
||||||
|
|
||||||
|
// 检查容量
|
||||||
|
if int64(len(l.requests)) >= l.capacity {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
l.requests = append(l.requests, now)
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewRateLimitMiddleware 创建限流中间件
|
||||||
|
func NewRateLimitMiddleware(cfg config.RateLimitConfig) *RateLimitMiddleware {
|
||||||
|
return &RateLimitMiddleware{
|
||||||
|
cfg: cfg,
|
||||||
|
limiters: make(map[string]*SlidingWindowLimiter),
|
||||||
|
cleanupInt: 5 * time.Minute,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Register 返回注册接口的限流中间件
|
||||||
|
func (m *RateLimitMiddleware) Register() gin.HandlerFunc {
|
||||||
|
return m.limitForKey("register", 60, 10)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Login 返回登录接口的限流中间件
|
||||||
|
func (m *RateLimitMiddleware) Login() gin.HandlerFunc {
|
||||||
|
return m.limitForKey("login", 60, 5)
|
||||||
|
}
|
||||||
|
|
||||||
|
// API 返回 API 接口的限流中间件
|
||||||
|
func (m *RateLimitMiddleware) API() gin.HandlerFunc {
|
||||||
|
return m.limitForKey("api", 60, 100)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Refresh 返回刷新令牌的限流中间件
|
||||||
|
func (m *RateLimitMiddleware) Refresh() gin.HandlerFunc {
|
||||||
|
return m.limitForKey("refresh", 60, 10)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *RateLimitMiddleware) limitForKey(key string, windowSeconds int, capacity int64) gin.HandlerFunc {
|
||||||
|
limiter := m.getOrCreateLimiter(key, time.Duration(windowSeconds)*time.Second, capacity)
|
||||||
|
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
if !limiter.Allow() {
|
||||||
|
c.JSON(429, gin.H{
|
||||||
|
"code": 429,
|
||||||
|
"message": "请求过于频繁，请稍后再试",
|
||||||
|
})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *RateLimitMiddleware) getOrCreateLimiter(key string, window time.Duration, capacity int64) *SlidingWindowLimiter {
|
||||||
|
m.mu.RLock()
|
||||||
|
limiter, exists := m.limiters[key]
|
||||||
|
m.mu.RUnlock()
|
||||||
|
|
||||||
|
if exists {
|
||||||
|
return limiter
|
||||||
|
}
|
||||||
|
|
||||||
|
m.mu.Lock()
|
||||||
|
defer m.mu.Unlock()
|
||||||
|
|
||||||
|
// 双重检查
|
||||||
|
if limiter, exists = m.limiters[key]; exists {
|
||||||
|
return limiter
|
||||||
|
}
|
||||||
|
|
||||||
|
limiter = NewSlidingWindowLimiter(window, capacity)
|
||||||
|
m.limiters[key] = limiter
|
||||||
|
return limiter
|
||||||
|
}
|
||||||
156
internal/api/middleware/rbac.go
Normal file
156
internal/api/middleware/rbac.go
Normal file
@@ -0,0 +1,156 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
// contextKey 上下文键常量
|
||||||
|
const (
|
||||||
|
ContextKeyRoleCodes = "role_codes"
|
||||||
|
ContextKeyPermissionCodes = "permission_codes"
|
||||||
|
)
|
||||||
|
|
||||||
|
// RequirePermission 要求用户拥有指定权限之一（OR 逻辑）
|
||||||
|
// 适用于需要单个或多选权限校验的路由
|
||||||
|
func RequirePermission(codes ...string) gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
if !hasAnyPermission(c, codes) {
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{
|
||||||
|
"code": 403,
|
||||||
|
"message": "权限不足",
|
||||||
|
})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RequireAllPermissions 要求用户拥有所有指定权限（AND 逻辑）
|
||||||
|
func RequireAllPermissions(codes ...string) gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
if !hasAllPermissions(c, codes) {
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{
|
||||||
|
"code": 403,
|
||||||
|
"message": "权限不足，需要所有指定权限",
|
||||||
|
})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RequireRole 要求用户拥有指定角色之一（OR 逻辑）
|
||||||
|
func RequireRole(codes ...string) gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
if !hasAnyRole(c, codes) {
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{
|
||||||
|
"code": 403,
|
||||||
|
"message": "权限不足，角色受限",
|
||||||
|
})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RequireAnyPermission RequirePermission 的别名，语义更清晰
|
||||||
|
func RequireAnyPermission(codes ...string) gin.HandlerFunc {
|
||||||
|
return RequirePermission(codes...)
|
||||||
|
}
|
||||||
|
|
||||||
|
// AdminOnly 仅限 admin 角色
|
||||||
|
func AdminOnly() gin.HandlerFunc {
|
||||||
|
return RequireRole("admin")
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetRoleCodes 从 Context 获取当前用户角色代码列表
|
||||||
|
func GetRoleCodes(c *gin.Context) []string {
|
||||||
|
val, exists := c.Get(ContextKeyRoleCodes)
|
||||||
|
if !exists {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if codes, ok := val.([]string); ok {
|
||||||
|
return codes
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetPermissionCodes 从 Context 获取当前用户权限代码列表
|
||||||
|
func GetPermissionCodes(c *gin.Context) []string {
|
||||||
|
val, exists := c.Get(ContextKeyPermissionCodes)
|
||||||
|
if !exists {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if codes, ok := val.([]string); ok {
|
||||||
|
return codes
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsAdmin 判断当前用户是否为 admin
|
||||||
|
func IsAdmin(c *gin.Context) bool {
|
||||||
|
return hasAnyRole(c, []string{"admin"})
|
||||||
|
}
|
||||||
|
|
||||||
|
// hasAnyPermission 判断用户是否拥有任意一个权限
|
||||||
|
func hasAnyPermission(c *gin.Context, codes []string) bool {
|
||||||
|
// admin 角色拥有所有权限
|
||||||
|
if IsAdmin(c) {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
permCodes := GetPermissionCodes(c)
|
||||||
|
if len(permCodes) == 0 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
permSet := toSet(permCodes)
|
||||||
|
for _, code := range codes {
|
||||||
|
if _, ok := permSet[code]; ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// hasAllPermissions 判断用户是否拥有所有权限
|
||||||
|
func hasAllPermissions(c *gin.Context, codes []string) bool {
|
||||||
|
if IsAdmin(c) {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
permCodes := GetPermissionCodes(c)
|
||||||
|
permSet := toSet(permCodes)
|
||||||
|
for _, code := range codes {
|
||||||
|
if _, ok := permSet[code]; !ok {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// hasAnyRole 判断用户是否拥有任意一个角色
|
||||||
|
func hasAnyRole(c *gin.Context, codes []string) bool {
|
||||||
|
roleCodes := GetRoleCodes(c)
|
||||||
|
if len(roleCodes) == 0 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
roleSet := toSet(roleCodes)
|
||||||
|
for _, code := range codes {
|
||||||
|
if _, ok := roleSet[code]; ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// toSet 将字符串切片转换为 map 集合
|
||||||
|
func toSet(items []string) map[string]struct{} {
|
||||||
|
s := make(map[string]struct{}, len(items))
|
||||||
|
for _, item := range items {
|
||||||
|
s[item] = struct{}{}
|
||||||
|
}
|
||||||
|
return s
|
||||||
|
}
|
||||||
139
internal/api/middleware/runtime_test.go
Normal file
139
internal/api/middleware/runtime_test.go
Normal file
@@ -0,0 +1,139 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestCORS_UsesConfiguredOrigins(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
SetCORSConfig(config.CORSConfig{
|
||||||
|
AllowedOrigins: []string{"https://app.example.com"},
|
||||||
|
AllowCredentials: true,
|
||||||
|
})
|
||||||
|
t.Cleanup(func() {
|
||||||
|
SetCORSConfig(config.CORSConfig{
|
||||||
|
AllowedOrigins: []string{"*"},
|
||||||
|
AllowCredentials: true,
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
|
recorder := httptest.NewRecorder()
|
||||||
|
c, _ := gin.CreateTestContext(recorder)
|
||||||
|
c.Request = httptest.NewRequest(http.MethodOptions, "/api/v1/users", nil)
|
||||||
|
c.Request.Header.Set("Origin", "https://app.example.com")
|
||||||
|
c.Request.Header.Set("Access-Control-Request-Headers", "Authorization")
|
||||||
|
|
||||||
|
CORS()(c)
|
||||||
|
|
||||||
|
if recorder.Code != http.StatusNoContent {
|
||||||
|
t.Fatalf("expected 204, got %d", recorder.Code)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Access-Control-Allow-Origin"); got != "https://app.example.com" {
|
||||||
|
t.Fatalf("unexpected allow origin: %s", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
|
||||||
|
t.Fatalf("expected credentials header to be 'true', got %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestSanitizeQuery_MasksSensitiveValues(t *testing.T) {
|
||||||
|
raw := "token=abc123&foo=bar&access_token=xyz&secret=s1"
|
||||||
|
sanitized := sanitizeQuery(raw)
|
||||||
|
|
||||||
|
if sanitized == "" {
|
||||||
|
t.Fatal("expected sanitized query")
|
||||||
|
}
|
||||||
|
if sanitized == raw {
|
||||||
|
t.Fatal("expected query to be sanitized")
|
||||||
|
}
|
||||||
|
for _, value := range []string{"abc123", "xyz", "s1"} {
|
||||||
|
if strings.Contains(sanitized, value) {
|
||||||
|
t.Fatalf("expected sensitive value %q to be masked in %q", value, sanitized)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if sanitizeQuery("") != "" {
|
||||||
|
t.Fatal("expected empty query to stay empty")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestSecurityHeaders_AttachesExpectedHeaders(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
|
||||||
|
recorder := httptest.NewRecorder()
|
||||||
|
c, _ := gin.CreateTestContext(recorder)
|
||||||
|
c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/users", nil)
|
||||||
|
|
||||||
|
SecurityHeaders()(c)
|
||||||
|
|
||||||
|
if got := recorder.Header().Get("X-Content-Type-Options"); got != "nosniff" {
|
||||||
|
t.Fatalf("unexpected nosniff header: %q", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("X-Frame-Options"); got != "DENY" {
|
||||||
|
t.Fatalf("unexpected frame options: %q", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Content-Security-Policy"); got == "" {
|
||||||
|
t.Fatal("expected content security policy header")
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Strict-Transport-Security"); got != "" {
|
||||||
|
t.Fatalf("did not expect hsts header for http request, got %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestSecurityHeaders_AttachesHSTSForForwardedHTTPS(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
|
||||||
|
recorder := httptest.NewRecorder()
|
||||||
|
c, _ := gin.CreateTestContext(recorder)
|
||||||
|
c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/users", nil)
|
||||||
|
c.Request.Header.Set("X-Forwarded-Proto", "https")
|
||||||
|
|
||||||
|
SecurityHeaders()(c)
|
||||||
|
|
||||||
|
if got := recorder.Header().Get("Strict-Transport-Security"); !strings.Contains(got, "max-age=31536000") {
|
||||||
|
t.Fatalf("expected hsts header, got %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNoStoreSensitiveResponses_AttachesExpectedHeadersToAuthRoutes(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
|
||||||
|
recorder := httptest.NewRecorder()
|
||||||
|
c, _ := gin.CreateTestContext(recorder)
|
||||||
|
c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/auth/capabilities", nil)
|
||||||
|
|
||||||
|
NoStoreSensitiveResponses()(c)
|
||||||
|
|
||||||
|
if got := recorder.Header().Get("Cache-Control"); got != sensitiveNoStoreCacheControl {
|
||||||
|
t.Fatalf("unexpected cache-control header: %q", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Pragma"); got != "no-cache" {
|
||||||
|
t.Fatalf("unexpected pragma header: %q", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Expires"); got != "0" {
|
||||||
|
t.Fatalf("unexpected expires header: %q", got)
|
||||||
|
}
|
||||||
|
if got := recorder.Header().Get("Surrogate-Control"); got != "no-store" {
|
||||||
|
t.Fatalf("unexpected surrogate-control header: %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNoStoreSensitiveResponses_DoesNotAttachHeadersToNonAuthRoutes(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
|
||||||
|
recorder := httptest.NewRecorder()
|
||||||
|
c, _ := gin.CreateTestContext(recorder)
|
||||||
|
c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/users", nil)
|
||||||
|
|
||||||
|
NoStoreSensitiveResponses()(c)
|
||||||
|
|
||||||
|
if got := recorder.Header().Get("Cache-Control"); got != "" {
|
||||||
|
t.Fatalf("did not expect cache-control header, got %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
45
internal/api/middleware/security_headers.go
Normal file
45
internal/api/middleware/security_headers.go
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
const contentSecurityPolicy = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
|
||||||
|
|
||||||
|
func SecurityHeaders() gin.HandlerFunc {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
headers := c.Writer.Header()
|
||||||
|
headers.Set("X-Content-Type-Options", "nosniff")
|
||||||
|
headers.Set("X-Frame-Options", "DENY")
|
||||||
|
headers.Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
||||||
|
headers.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
|
||||||
|
headers.Set("Cross-Origin-Opener-Policy", "same-origin")
|
||||||
|
headers.Set("X-Permitted-Cross-Domain-Policies", "none")
|
||||||
|
|
||||||
|
if shouldAttachCSP(c.FullPath(), c.Request.URL.Path) {
|
||||||
|
headers.Set("Content-Security-Policy", contentSecurityPolicy)
|
||||||
|
}
|
||||||
|
if isHTTPSRequest(c) {
|
||||||
|
headers.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
|
||||||
|
}
|
||||||
|
|
||||||
|
c.Next()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func shouldAttachCSP(routePath, requestPath string) bool {
|
||||||
|
path := strings.TrimSpace(routePath)
|
||||||
|
if path == "" {
|
||||||
|
path = strings.TrimSpace(requestPath)
|
||||||
|
}
|
||||||
|
return !strings.HasPrefix(path, "/swagger/")
|
||||||
|
}
|
||||||
|
|
||||||
|
func isHTTPSRequest(c *gin.Context) bool {
|
||||||
|
if c.Request.TLS != nil {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return strings.EqualFold(strings.TrimSpace(c.GetHeader("X-Forwarded-Proto")), "https")
|
||||||
|
}
|
||||||
367
internal/api/router/router.go
Normal file
367
internal/api/router/router.go
Normal file
@@ -0,0 +1,367 @@
|
|||||||
|
package router
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
swaggerFiles "github.com/swaggo/files"
|
||||||
|
"github.com/swaggo/gin-swagger"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/api/handler"
|
||||||
|
"github.com/user-management-system/internal/api/middleware"
|
||||||
|
)
|
||||||
|
|
||||||
|
type Router struct {
|
||||||
|
engine *gin.Engine
|
||||||
|
authHandler *handler.AuthHandler
|
||||||
|
userHandler *handler.UserHandler
|
||||||
|
roleHandler *handler.RoleHandler
|
||||||
|
permissionHandler *handler.PermissionHandler
|
||||||
|
deviceHandler *handler.DeviceHandler
|
||||||
|
logHandler *handler.LogHandler
|
||||||
|
passwordResetHandler *handler.PasswordResetHandler
|
||||||
|
captchaHandler *handler.CaptchaHandler
|
||||||
|
totpHandler *handler.TOTPHandler
|
||||||
|
webhookHandler *handler.WebhookHandler
|
||||||
|
exportHandler *handler.ExportHandler
|
||||||
|
statsHandler *handler.StatsHandler
|
||||||
|
smsHandler *handler.SMSHandler
|
||||||
|
avatarHandler *handler.AvatarHandler
|
||||||
|
customFieldHandler *handler.CustomFieldHandler
|
||||||
|
themeHandler *handler.ThemeHandler
|
||||||
|
authMiddleware *middleware.AuthMiddleware
|
||||||
|
rateLimitMiddleware *middleware.RateLimitMiddleware
|
||||||
|
opLogMiddleware *middleware.OperationLogMiddleware
|
||||||
|
ipFilterMiddleware *middleware.IPFilterMiddleware
|
||||||
|
ssoHandler *handler.SSOHandler
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewRouter(
|
||||||
|
authHandler *handler.AuthHandler,
|
||||||
|
userHandler *handler.UserHandler,
|
||||||
|
roleHandler *handler.RoleHandler,
|
||||||
|
permissionHandler *handler.PermissionHandler,
|
||||||
|
deviceHandler *handler.DeviceHandler,
|
||||||
|
logHandler *handler.LogHandler,
|
||||||
|
authMiddleware *middleware.AuthMiddleware,
|
||||||
|
rateLimitMiddleware *middleware.RateLimitMiddleware,
|
||||||
|
opLogMiddleware *middleware.OperationLogMiddleware,
|
||||||
|
passwordResetHandler *handler.PasswordResetHandler,
|
||||||
|
captchaHandler *handler.CaptchaHandler,
|
||||||
|
totpHandler *handler.TOTPHandler,
|
||||||
|
webhookHandler *handler.WebhookHandler,
|
||||||
|
ipFilterMiddleware *middleware.IPFilterMiddleware,
|
||||||
|
exportHandler *handler.ExportHandler,
|
||||||
|
statsHandler *handler.StatsHandler,
|
||||||
|
smsHandler *handler.SMSHandler,
|
||||||
|
customFieldHandler *handler.CustomFieldHandler,
|
||||||
|
themeHandler *handler.ThemeHandler,
|
||||||
|
ssoHandler *handler.SSOHandler,
|
||||||
|
avatarHandler ...*handler.AvatarHandler,
|
||||||
|
) *Router {
|
||||||
|
engine := gin.New()
|
||||||
|
var avatar *handler.AvatarHandler
|
||||||
|
if len(avatarHandler) > 0 {
|
||||||
|
avatar = avatarHandler[0]
|
||||||
|
}
|
||||||
|
|
||||||
|
return &Router{
|
||||||
|
engine: engine,
|
||||||
|
authHandler: authHandler,
|
||||||
|
userHandler: userHandler,
|
||||||
|
roleHandler: roleHandler,
|
||||||
|
permissionHandler: permissionHandler,
|
||||||
|
deviceHandler: deviceHandler,
|
||||||
|
logHandler: logHandler,
|
||||||
|
passwordResetHandler: passwordResetHandler,
|
||||||
|
captchaHandler: captchaHandler,
|
||||||
|
totpHandler: totpHandler,
|
||||||
|
webhookHandler: webhookHandler,
|
||||||
|
exportHandler: exportHandler,
|
||||||
|
statsHandler: statsHandler,
|
||||||
|
smsHandler: smsHandler,
|
||||||
|
customFieldHandler: customFieldHandler,
|
||||||
|
themeHandler: themeHandler,
|
||||||
|
ssoHandler: ssoHandler,
|
||||||
|
avatarHandler: avatar,
|
||||||
|
authMiddleware: authMiddleware,
|
||||||
|
rateLimitMiddleware: rateLimitMiddleware,
|
||||||
|
opLogMiddleware: opLogMiddleware,
|
||||||
|
ipFilterMiddleware: ipFilterMiddleware,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Router) Setup() *gin.Engine {
|
||||||
|
r.engine.Use(middleware.Recover())
|
||||||
|
r.engine.Use(middleware.ErrorHandler())
|
||||||
|
r.engine.Use(middleware.Logger())
|
||||||
|
r.engine.Use(middleware.SecurityHeaders())
|
||||||
|
r.engine.Use(middleware.NoStoreSensitiveResponses())
|
||||||
|
r.engine.Use(middleware.CORS())
|
||||||
|
|
||||||
|
r.engine.Static("/uploads", "./uploads")
|
||||||
|
r.engine.GET("/swagger/*any", ginSwagger.WrapHandler(swaggerFiles.Handler))
|
||||||
|
|
||||||
|
if r.ipFilterMiddleware != nil {
|
||||||
|
r.engine.Use(r.ipFilterMiddleware.Filter())
|
||||||
|
}
|
||||||
|
if r.opLogMiddleware != nil {
|
||||||
|
r.engine.Use(r.opLogMiddleware.Record())
|
||||||
|
}
|
||||||
|
|
||||||
|
v1 := r.engine.Group("/api/v1")
|
||||||
|
{
|
||||||
|
authGroup := v1.Group("/auth")
|
||||||
|
{
|
||||||
|
authGroup.POST("/register", r.rateLimitMiddleware.Register(), r.authHandler.Register)
|
||||||
|
authGroup.POST("/bootstrap-admin", r.rateLimitMiddleware.Register(), r.authHandler.BootstrapAdmin)
|
||||||
|
authGroup.POST("/login", r.rateLimitMiddleware.Login(), r.authHandler.Login)
|
||||||
|
authGroup.POST("/refresh", r.rateLimitMiddleware.Refresh(), r.authHandler.RefreshToken)
|
||||||
|
authGroup.GET("/capabilities", r.authHandler.GetAuthCapabilities)
|
||||||
|
|
||||||
|
authGroup.GET("/activate", r.authHandler.ActivateEmail)
|
||||||
|
authGroup.POST("/resend-activation", r.authHandler.ResendActivationEmail)
|
||||||
|
|
||||||
|
if r.authHandler.SupportsEmailCodeLogin() {
|
||||||
|
authGroup.POST("/send-email-code", r.rateLimitMiddleware.Register(), r.authHandler.SendEmailCode)
|
||||||
|
authGroup.POST("/login/email-code", r.rateLimitMiddleware.Login(), r.authHandler.LoginByEmailCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.smsHandler != nil {
|
||||||
|
authGroup.POST("/send-code", r.rateLimitMiddleware.Register(), r.smsHandler.SendCode)
|
||||||
|
authGroup.POST("/login/code", r.rateLimitMiddleware.Login(), r.smsHandler.LoginByCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.passwordResetHandler != nil {
|
||||||
|
authGroup.POST("/forgot-password", r.passwordResetHandler.ForgotPassword)
|
||||||
|
authGroup.GET("/reset-password", r.passwordResetHandler.ValidateResetToken)
|
||||||
|
authGroup.POST("/reset-password", r.passwordResetHandler.ResetPassword)
|
||||||
|
// 短信密码重置
|
||||||
|
authGroup.POST("/forgot-password/phone", r.passwordResetHandler.ForgotPasswordByPhone)
|
||||||
|
authGroup.POST("/reset-password/phone", r.passwordResetHandler.ResetPasswordByPhone)
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.captchaHandler != nil {
|
||||||
|
authGroup.GET("/captcha", r.captchaHandler.GenerateCaptcha)
|
||||||
|
authGroup.GET("/captcha/image", r.captchaHandler.GetCaptchaImage)
|
||||||
|
authGroup.POST("/captcha/verify", r.captchaHandler.VerifyCaptcha)
|
||||||
|
}
|
||||||
|
|
||||||
|
authGroup.GET("/oauth/providers", r.authHandler.GetEnabledOAuthProviders)
|
||||||
|
authGroup.GET("/oauth/:provider", r.authHandler.OAuthLogin)
|
||||||
|
authGroup.GET("/oauth/:provider/callback", r.authHandler.OAuthCallback)
|
||||||
|
authGroup.POST("/oauth/exchange", r.authHandler.OAuthExchange)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 公开主题接口（无需认证）
|
||||||
|
if r.themeHandler != nil {
|
||||||
|
themePublic := v1.Group("")
|
||||||
|
{
|
||||||
|
themePublic.GET("/theme/active", r.themeHandler.GetActiveTheme)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
protected := v1.Group("")
|
||||||
|
protected.Use(r.authMiddleware.Required())
|
||||||
|
protected.Use(r.rateLimitMiddleware.API())
|
||||||
|
{
|
||||||
|
protected.GET("/auth/csrf-token", r.authHandler.GetCSRFToken)
|
||||||
|
protected.POST("/auth/logout", r.authHandler.Logout)
|
||||||
|
protected.GET("/auth/userinfo", r.authHandler.GetUserInfo)
|
||||||
|
|
||||||
|
protected.POST("/users/me/bind-email/code", r.authHandler.SendEmailBindCode)
|
||||||
|
protected.POST("/users/me/bind-email", r.authHandler.BindEmail)
|
||||||
|
protected.DELETE("/users/me/bind-email", r.authHandler.UnbindEmail)
|
||||||
|
protected.POST("/users/me/bind-phone/code", r.authHandler.SendPhoneBindCode)
|
||||||
|
protected.POST("/users/me/bind-phone", r.authHandler.BindPhone)
|
||||||
|
protected.DELETE("/users/me/bind-phone", r.authHandler.UnbindPhone)
|
||||||
|
protected.GET("/users/me/social-accounts", r.authHandler.GetSocialAccounts)
|
||||||
|
protected.POST("/users/me/bind-social", r.authHandler.BindSocialAccount)
|
||||||
|
protected.DELETE("/users/me/bind-social/:provider", r.authHandler.UnbindSocialAccount)
|
||||||
|
|
||||||
|
users := protected.Group("/users")
|
||||||
|
{
|
||||||
|
users.POST("", middleware.RequirePermission("user:manage"), r.userHandler.CreateUser)
|
||||||
|
users.GET("", r.userHandler.ListUsers)
|
||||||
|
users.GET("/:id", r.userHandler.GetUser)
|
||||||
|
users.PUT("/:id", r.userHandler.UpdateUser)
|
||||||
|
users.DELETE("/:id", middleware.RequirePermission("user:delete"), r.userHandler.DeleteUser)
|
||||||
|
users.PUT("/:id/password", r.userHandler.UpdatePassword)
|
||||||
|
users.PUT("/:id/status", middleware.RequirePermission("user:manage"), r.userHandler.UpdateUserStatus)
|
||||||
|
users.GET("/:id/roles", r.userHandler.GetUserRoles)
|
||||||
|
users.PUT("/:id/roles", middleware.RequirePermission("user:manage"), r.userHandler.AssignRoles)
|
||||||
|
|
||||||
|
if r.avatarHandler != nil {
|
||||||
|
users.POST("/:id/avatar", r.avatarHandler.UploadAvatar)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
roles := protected.Group("/roles")
|
||||||
|
roles.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
roles.POST("", r.roleHandler.CreateRole)
|
||||||
|
roles.GET("", r.roleHandler.ListRoles)
|
||||||
|
roles.GET("/:id", r.roleHandler.GetRole)
|
||||||
|
roles.PUT("/:id", r.roleHandler.UpdateRole)
|
||||||
|
roles.DELETE("/:id", r.roleHandler.DeleteRole)
|
||||||
|
roles.PUT("/:id/status", r.roleHandler.UpdateRoleStatus)
|
||||||
|
roles.GET("/:id/permissions", r.roleHandler.GetRolePermissions)
|
||||||
|
roles.PUT("/:id/permissions", r.roleHandler.AssignPermissions)
|
||||||
|
}
|
||||||
|
|
||||||
|
permissions := protected.Group("/permissions")
|
||||||
|
permissions.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
permissions.POST("", r.permissionHandler.CreatePermission)
|
||||||
|
permissions.GET("", r.permissionHandler.ListPermissions)
|
||||||
|
permissions.GET("/tree", r.permissionHandler.GetPermissionTree)
|
||||||
|
permissions.GET("/:id", r.permissionHandler.GetPermission)
|
||||||
|
permissions.PUT("/:id", r.permissionHandler.UpdatePermission)
|
||||||
|
permissions.DELETE("/:id", r.permissionHandler.DeletePermission)
|
||||||
|
permissions.PUT("/:id/status", r.permissionHandler.UpdatePermissionStatus)
|
||||||
|
}
|
||||||
|
|
||||||
|
devices := protected.Group("/devices")
|
||||||
|
{
|
||||||
|
devices.GET("", r.deviceHandler.GetMyDevices)
|
||||||
|
devices.POST("", r.deviceHandler.CreateDevice)
|
||||||
|
devices.GET("/:id", r.deviceHandler.GetDevice)
|
||||||
|
devices.PUT("/:id", r.deviceHandler.UpdateDevice)
|
||||||
|
devices.DELETE("/:id", r.deviceHandler.DeleteDevice)
|
||||||
|
devices.PUT("/:id/status", r.deviceHandler.UpdateDeviceStatus)
|
||||||
|
devices.POST("/:id/trust", r.deviceHandler.TrustDevice)
|
||||||
|
devices.POST("/by-device-id/:deviceId/trust", r.deviceHandler.TrustDeviceByDeviceID)
|
||||||
|
devices.DELETE("/:id/trust", r.deviceHandler.UntrustDevice)
|
||||||
|
devices.GET("/me/trusted", r.deviceHandler.GetMyTrustedDevices)
|
||||||
|
devices.POST("/me/logout-others", r.deviceHandler.LogoutAllOtherDevices)
|
||||||
|
devices.GET("/users/:id", r.deviceHandler.GetUserDevices)
|
||||||
|
}
|
||||||
|
|
||||||
|
adminDevices := protected.Group("/admin/devices")
|
||||||
|
adminDevices.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
adminDevices.GET("", r.deviceHandler.GetAllDevices)
|
||||||
|
adminDevices.DELETE("/:id", r.deviceHandler.DeleteDevice)
|
||||||
|
adminDevices.PUT("/:id/status", r.deviceHandler.UpdateDeviceStatus)
|
||||||
|
adminDevices.POST("/:id/trust", r.deviceHandler.TrustDevice)
|
||||||
|
adminDevices.DELETE("/:id/trust", r.deviceHandler.UntrustDevice)
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.logHandler != nil {
|
||||||
|
logs := protected.Group("/logs")
|
||||||
|
{
|
||||||
|
logs.GET("/login/me", r.logHandler.GetMyLoginLogs)
|
||||||
|
logs.GET("/operation/me", r.logHandler.GetMyOperationLogs)
|
||||||
|
|
||||||
|
adminLogs := logs.Group("")
|
||||||
|
adminLogs.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
adminLogs.GET("/login", r.logHandler.GetLoginLogs)
|
||||||
|
adminLogs.GET("/login/export", r.logHandler.ExportLoginLogs)
|
||||||
|
adminLogs.GET("/operation", r.logHandler.GetOperationLogs)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.totpHandler != nil {
|
||||||
|
twoFA := protected.Group("/auth/2fa")
|
||||||
|
{
|
||||||
|
twoFA.GET("/status", r.totpHandler.GetTOTPStatus)
|
||||||
|
twoFA.GET("/setup", r.totpHandler.SetupTOTP)
|
||||||
|
twoFA.POST("/enable", r.totpHandler.EnableTOTP)
|
||||||
|
twoFA.POST("/disable", r.totpHandler.DisableTOTP)
|
||||||
|
twoFA.POST("/verify", r.totpHandler.VerifyTOTP)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.webhookHandler != nil {
|
||||||
|
webhooks := protected.Group("/webhooks")
|
||||||
|
{
|
||||||
|
webhooks.POST("", r.webhookHandler.CreateWebhook)
|
||||||
|
webhooks.GET("", r.webhookHandler.ListWebhooks)
|
||||||
|
webhooks.PUT("/:id", r.webhookHandler.UpdateWebhook)
|
||||||
|
webhooks.DELETE("/:id", r.webhookHandler.DeleteWebhook)
|
||||||
|
webhooks.GET("/:id/deliveries", r.webhookHandler.GetWebhookDeliveries)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.exportHandler != nil {
|
||||||
|
adminUsers := protected.Group("/admin/users")
|
||||||
|
adminUsers.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
adminUsers.GET("/export", r.exportHandler.ExportUsers)
|
||||||
|
adminUsers.POST("/import", r.exportHandler.ImportUsers)
|
||||||
|
adminUsers.GET("/import/template", r.exportHandler.GetImportTemplate)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
adminMgmt := protected.Group("/admin/admins")
|
||||||
|
adminMgmt.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
adminMgmt.GET("", r.userHandler.ListAdmins)
|
||||||
|
adminMgmt.POST("", r.userHandler.CreateAdmin)
|
||||||
|
adminMgmt.DELETE("/:id", r.userHandler.DeleteAdmin)
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.statsHandler != nil {
|
||||||
|
adminStats := protected.Group("/admin/stats")
|
||||||
|
adminStats.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
adminStats.GET("/dashboard", r.statsHandler.GetDashboard)
|
||||||
|
adminStats.GET("/users", r.statsHandler.GetUserStats)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.customFieldHandler != nil {
|
||||||
|
// 自定义字段管理（管理员）
|
||||||
|
customFields := protected.Group("/custom-fields")
|
||||||
|
customFields.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
customFields.POST("", r.customFieldHandler.CreateField)
|
||||||
|
customFields.GET("", r.customFieldHandler.ListFields)
|
||||||
|
customFields.GET("/:id", r.customFieldHandler.GetField)
|
||||||
|
customFields.PUT("/:id", r.customFieldHandler.UpdateField)
|
||||||
|
customFields.DELETE("/:id", r.customFieldHandler.DeleteField)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 用户自定义字段值（用户自己的）
|
||||||
|
userFields := protected.Group("/users/me/custom-fields")
|
||||||
|
{
|
||||||
|
userFields.GET("", r.customFieldHandler.GetUserFieldValues)
|
||||||
|
userFields.PUT("", r.customFieldHandler.SetUserFieldValues)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.themeHandler != nil {
|
||||||
|
// 主题管理（管理员）
|
||||||
|
themes := protected.Group("/themes")
|
||||||
|
themes.Use(middleware.AdminOnly())
|
||||||
|
{
|
||||||
|
themes.POST("", r.themeHandler.CreateTheme)
|
||||||
|
themes.GET("", r.themeHandler.ListAllThemes)
|
||||||
|
themes.GET("/default", r.themeHandler.GetDefaultTheme)
|
||||||
|
themes.PUT("/default/:id", r.themeHandler.SetDefaultTheme)
|
||||||
|
themes.GET("/:id", r.themeHandler.GetTheme)
|
||||||
|
themes.PUT("/:id", r.themeHandler.UpdateTheme)
|
||||||
|
themes.DELETE("/:id", r.themeHandler.DeleteTheme)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSO 单点登录接口（需要认证）
|
||||||
|
if r.ssoHandler != nil {
|
||||||
|
sso := protected.Group("/sso")
|
||||||
|
{
|
||||||
|
sso.GET("/authorize", r.ssoHandler.Authorize)
|
||||||
|
sso.POST("/token", r.ssoHandler.Token)
|
||||||
|
sso.POST("/introspect", r.ssoHandler.Introspect)
|
||||||
|
sso.POST("/revoke", r.ssoHandler.Revoke)
|
||||||
|
sso.GET("/userinfo", r.ssoHandler.UserInfo)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return r.engine
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Router) GetEngine() *gin.Engine {
|
||||||
|
return r.engine
|
||||||
|
}
|
||||||
26
internal/auth/errors.go
Normal file
26
internal/auth/errors.go
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import "errors"
|
||||||
|
|
||||||
|
var (
|
||||||
|
// ErrOAuthProviderNotSupported OAuth提供商不支持
|
||||||
|
ErrOAuthProviderNotSupported = errors.New("OAuth provider not supported")
|
||||||
|
|
||||||
|
// ErrOAuthCodeInvalid OAuth授权码无效
|
||||||
|
ErrOAuthCodeInvalid = errors.New("OAuth authorization code is invalid")
|
||||||
|
|
||||||
|
// ErrOAuthTokenExpired OAuth令牌已过期
|
||||||
|
ErrOAuthTokenExpired = errors.New("OAuth token has expired")
|
||||||
|
|
||||||
|
// ErrOAuthUserInfoFailed 获取OAuth用户信息失败
|
||||||
|
ErrOAuthUserInfoFailed = errors.New("failed to get OAuth user info")
|
||||||
|
|
||||||
|
// ErrOAuthStateInvalid OAuth状态验证失败
|
||||||
|
ErrOAuthStateInvalid = errors.New("OAuth state validation failed")
|
||||||
|
|
||||||
|
// ErrOAuthAlreadyBound 社交账号已绑定
|
||||||
|
ErrOAuthAlreadyBound = errors.New("social account already bound")
|
||||||
|
|
||||||
|
// ErrOAuthNotFound 未找到绑定的社交账号
|
||||||
|
ErrOAuthNotFound = errors.New("social account not found")
|
||||||
|
)
|
||||||
507
internal/auth/jwt.go
Normal file
507
internal/auth/jwt.go
Normal file
@@ -0,0 +1,507 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
cryptorand "crypto/rand"
|
||||||
|
"crypto/rsa"
|
||||||
|
"crypto/x509"
|
||||||
|
"encoding/pem"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/golang-jwt/jwt/v5"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
jwtAlgorithmHS256 = "HS256"
|
||||||
|
jwtAlgorithmRS256 = "RS256"
|
||||||
|
)
|
||||||
|
|
||||||
|
// JWTOptions controls JWT signing behavior.
|
||||||
|
type JWTOptions struct {
|
||||||
|
Algorithm string
|
||||||
|
HS256Secret string
|
||||||
|
RSAPrivateKeyPEM string
|
||||||
|
RSAPublicKeyPEM string
|
||||||
|
RSAPrivateKeyPath string
|
||||||
|
RSAPublicKeyPath string
|
||||||
|
RequireExistingRSAKeys bool
|
||||||
|
AccessTokenExpire time.Duration
|
||||||
|
RefreshTokenExpire time.Duration
|
||||||
|
RememberLoginExpire time.Duration // 记住登录时的refresh token有效期
|
||||||
|
}
|
||||||
|
|
||||||
|
// JWT JWT管理器
|
||||||
|
type JWT struct {
|
||||||
|
algorithm string
|
||||||
|
secret []byte
|
||||||
|
privateKey *rsa.PrivateKey
|
||||||
|
publicKey *rsa.PublicKey
|
||||||
|
accessTokenExpire time.Duration
|
||||||
|
refreshTokenExpire time.Duration
|
||||||
|
rememberLoginExpire time.Duration
|
||||||
|
initErr error
|
||||||
|
}
|
||||||
|
|
||||||
|
// Claims JWT声明
|
||||||
|
type Claims struct {
|
||||||
|
UserID int64 `json:"user_id"`
|
||||||
|
Username string `json:"username"`
|
||||||
|
Type string `json:"type"` // access, refresh
|
||||||
|
Remember bool `json:"remember,omitempty"` // 记住登录标记
|
||||||
|
JTI string `json:"jti"` // JWT ID，用于黑名单
|
||||||
|
jwt.RegisteredClaims
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateJTI 生成唯一的 JWT ID
|
||||||
|
// 使用 crypto/rand 生成密码学安全的随机数，仅使用随机数不包含时间戳
|
||||||
|
func generateJTI() (string, error) {
|
||||||
|
// 生成 16 字节的密码学安全随机数
|
||||||
|
b := make([]byte, 16)
|
||||||
|
if _, err := cryptorand.Read(b); err != nil {
|
||||||
|
return "", fmt.Errorf("generate jwt jti failed: %w", err)
|
||||||
|
}
|
||||||
|
// 使用十六进制编码，仅使用随机数确保不可预测
|
||||||
|
return fmt.Sprintf("%x", b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewJWT creates a legacy HS256 JWT manager for compatibility in tests and callers
|
||||||
|
// that still only provide a shared secret.
|
||||||
|
func NewJWT(secret string, accessTokenExpire, refreshTokenExpire time.Duration) *JWT {
|
||||||
|
manager, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmHS256,
|
||||||
|
HS256Secret: secret,
|
||||||
|
AccessTokenExpire: accessTokenExpire,
|
||||||
|
RefreshTokenExpire: refreshTokenExpire,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return &JWT{
|
||||||
|
algorithm: jwtAlgorithmHS256,
|
||||||
|
accessTokenExpire: accessTokenExpire,
|
||||||
|
refreshTokenExpire: refreshTokenExpire,
|
||||||
|
initErr: err,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return manager
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j *JWT) ensureReady() error {
|
||||||
|
if j == nil {
|
||||||
|
return errors.New("jwt manager is nil")
|
||||||
|
}
|
||||||
|
if j.initErr != nil {
|
||||||
|
return j.initErr
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewJWTWithOptions creates a JWT manager from explicit signing options.
|
||||||
|
func NewJWTWithOptions(opts JWTOptions) (*JWT, error) {
|
||||||
|
algorithm := strings.ToUpper(strings.TrimSpace(opts.Algorithm))
|
||||||
|
if algorithm == "" {
|
||||||
|
if opts.HS256Secret != "" && opts.RSAPrivateKeyPEM == "" && opts.RSAPrivateKeyPath == "" {
|
||||||
|
algorithm = jwtAlgorithmHS256
|
||||||
|
} else {
|
||||||
|
algorithm = jwtAlgorithmRS256
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
manager := &JWT{
|
||||||
|
algorithm: algorithm,
|
||||||
|
accessTokenExpire: opts.AccessTokenExpire,
|
||||||
|
refreshTokenExpire: opts.RefreshTokenExpire,
|
||||||
|
rememberLoginExpire: opts.RememberLoginExpire,
|
||||||
|
}
|
||||||
|
|
||||||
|
switch algorithm {
|
||||||
|
case jwtAlgorithmHS256:
|
||||||
|
if opts.HS256Secret == "" {
|
||||||
|
return nil, errors.New("jwt secret is required for HS256")
|
||||||
|
}
|
||||||
|
manager.secret = []byte(opts.HS256Secret)
|
||||||
|
case jwtAlgorithmRS256:
|
||||||
|
if err := manager.loadRSAKeys(opts); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported jwt algorithm: %s", algorithm)
|
||||||
|
}
|
||||||
|
|
||||||
|
return manager, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j *JWT) loadRSAKeys(opts JWTOptions) error {
|
||||||
|
privatePEM, err := readPEM(opts.RSAPrivateKeyPEM, opts.RSAPrivateKeyPath)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("load jwt private key failed: %w", err)
|
||||||
|
}
|
||||||
|
publicPEM, err := readPEM(opts.RSAPublicKeyPEM, opts.RSAPublicKeyPath)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("load jwt public key failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if privatePEM == "" && publicPEM == "" {
|
||||||
|
if strings.TrimSpace(opts.RSAPrivateKeyPath) == "" || strings.TrimSpace(opts.RSAPublicKeyPath) == "" {
|
||||||
|
return errors.New("rsa private/public key paths or inline pem are required for RS256")
|
||||||
|
}
|
||||||
|
if opts.RequireExistingRSAKeys {
|
||||||
|
return errors.New("existing rsa private/public key files or inline pem are required for RS256")
|
||||||
|
}
|
||||||
|
privatePEM, publicPEM, err = generateAndPersistRSAKeyPair(opts.RSAPrivateKeyPath, opts.RSAPublicKeyPath)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("generate rsa key pair failed: %w", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if privatePEM != "" {
|
||||||
|
privateKey, err := parseRSAPrivateKey(privatePEM)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
j.privateKey = privateKey
|
||||||
|
j.publicKey = &privateKey.PublicKey
|
||||||
|
}
|
||||||
|
|
||||||
|
if publicPEM != "" {
|
||||||
|
publicKey, err := parseRSAPublicKey(publicPEM)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
j.publicKey = publicKey
|
||||||
|
}
|
||||||
|
|
||||||
|
if j.privateKey == nil {
|
||||||
|
return errors.New("rsa private key is required for signing")
|
||||||
|
}
|
||||||
|
if j.publicKey == nil {
|
||||||
|
return errors.New("rsa public key is required for verification")
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func generateAndPersistRSAKeyPair(privatePath, publicPath string) (string, string, error) {
|
||||||
|
privatePath = strings.TrimSpace(privatePath)
|
||||||
|
publicPath = strings.TrimSpace(publicPath)
|
||||||
|
if privatePath == "" || publicPath == "" {
|
||||||
|
return "", "", errors.New("rsa key paths must not be empty")
|
||||||
|
}
|
||||||
|
|
||||||
|
privateKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
privateDER := x509.MarshalPKCS1PrivateKey(privateKey)
|
||||||
|
privatePEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: privateDER})
|
||||||
|
|
||||||
|
publicDER, err := x509.MarshalPKIXPublicKey(&privateKey.PublicKey)
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
publicPEM := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: publicDER})
|
||||||
|
|
||||||
|
if err := os.MkdirAll(filepath.Dir(privatePath), 0o700); err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
if err := os.MkdirAll(filepath.Dir(publicPath), 0o700); err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
if err := os.WriteFile(privatePath, privatePEM, 0o600); err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
if err := os.WriteFile(publicPath, publicPEM, 0o644); err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
return string(privatePEM), string(publicPEM), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func readPEM(inlinePEM, path string) (string, error) {
|
||||||
|
inlinePEM = strings.TrimSpace(inlinePEM)
|
||||||
|
if inlinePEM != "" {
|
||||||
|
return inlinePEM, nil
|
||||||
|
}
|
||||||
|
path = strings.TrimSpace(path)
|
||||||
|
if path == "" {
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
|
data, err := os.ReadFile(path)
|
||||||
|
if err != nil {
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return string(data), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func parseRSAPrivateKey(pemValue string) (*rsa.PrivateKey, error) {
|
||||||
|
block, _ := pem.Decode([]byte(pemValue))
|
||||||
|
if block == nil {
|
||||||
|
return nil, errors.New("invalid rsa private key pem")
|
||||||
|
}
|
||||||
|
|
||||||
|
if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
|
||||||
|
return key, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("parse rsa private key failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
rsaKey, ok := key.(*rsa.PrivateKey)
|
||||||
|
if !ok {
|
||||||
|
return nil, errors.New("private key is not rsa")
|
||||||
|
}
|
||||||
|
return rsaKey, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func parseRSAPublicKey(pemValue string) (*rsa.PublicKey, error) {
|
||||||
|
block, _ := pem.Decode([]byte(pemValue))
|
||||||
|
if block == nil {
|
||||||
|
return nil, errors.New("invalid rsa public key pem")
|
||||||
|
}
|
||||||
|
|
||||||
|
if key, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
|
||||||
|
rsaKey, ok := key.(*rsa.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
return nil, errors.New("public key is not rsa")
|
||||||
|
}
|
||||||
|
return rsaKey, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if cert, err := x509.ParseCertificate(block.Bytes); err == nil {
|
||||||
|
rsaKey, ok := cert.PublicKey.(*rsa.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
return nil, errors.New("certificate public key is not rsa")
|
||||||
|
}
|
||||||
|
return rsaKey, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, errors.New("parse rsa public key failed")
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j *JWT) signingMethod() jwt.SigningMethod {
|
||||||
|
if j.algorithm == jwtAlgorithmRS256 {
|
||||||
|
return jwt.SigningMethodRS256
|
||||||
|
}
|
||||||
|
return jwt.SigningMethodHS256
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j *JWT) signingKey() interface{} {
|
||||||
|
if j.algorithm == jwtAlgorithmRS256 {
|
||||||
|
return j.privateKey
|
||||||
|
}
|
||||||
|
return j.secret
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j *JWT) verifyKey(token *jwt.Token) (interface{}, error) {
|
||||||
|
if token.Method.Alg() != j.signingMethod().Alg() {
|
||||||
|
return nil, fmt.Errorf("unexpected signing method: %s", token.Method.Alg())
|
||||||
|
}
|
||||||
|
if j.algorithm == jwtAlgorithmRS256 {
|
||||||
|
return j.publicKey, nil
|
||||||
|
}
|
||||||
|
return j.secret, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAlgorithm returns the configured JWT signing algorithm.
|
||||||
|
func (j *JWT) GetAlgorithm() string {
|
||||||
|
return j.algorithm
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateAccessToken 生成访问令牌（含JTI）
|
||||||
|
func (j *JWT) GenerateAccessToken(userID int64, username string) (string, error) {
|
||||||
|
if err := j.ensureReady(); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
now := time.Now()
|
||||||
|
jti, err := generateJTI()
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
claims := Claims{
|
||||||
|
UserID: userID,
|
||||||
|
Username: username,
|
||||||
|
Type: "access",
|
||||||
|
JTI: jti,
|
||||||
|
RegisteredClaims: jwt.RegisteredClaims{
|
||||||
|
ExpiresAt: jwt.NewNumericDate(now.Add(j.accessTokenExpire)),
|
||||||
|
IssuedAt: jwt.NewNumericDate(now),
|
||||||
|
NotBefore: jwt.NewNumericDate(now),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
token := jwt.NewWithClaims(j.signingMethod(), claims)
|
||||||
|
return token.SignedString(j.signingKey())
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateRefreshToken 生成刷新令牌（含JTI）
|
||||||
|
func (j *JWT) GenerateRefreshToken(userID int64, username string) (string, error) {
|
||||||
|
if err := j.ensureReady(); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
now := time.Now()
|
||||||
|
jti, err := generateJTI()
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
claims := Claims{
|
||||||
|
UserID: userID,
|
||||||
|
Username: username,
|
||||||
|
Type: "refresh",
|
||||||
|
JTI: jti,
|
||||||
|
RegisteredClaims: jwt.RegisteredClaims{
|
||||||
|
ExpiresAt: jwt.NewNumericDate(now.Add(j.refreshTokenExpire)),
|
||||||
|
IssuedAt: jwt.NewNumericDate(now),
|
||||||
|
NotBefore: jwt.NewNumericDate(now),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
token := jwt.NewWithClaims(j.signingMethod(), claims)
|
||||||
|
return token.SignedString(j.signingKey())
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAccessTokenExpire 获取访问令牌有效期
|
||||||
|
func (j *JWT) GetAccessTokenExpire() time.Duration {
|
||||||
|
return j.accessTokenExpire
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetRefreshTokenExpire 获取刷新令牌有效期
|
||||||
|
func (j *JWT) GetRefreshTokenExpire() time.Duration {
|
||||||
|
return j.refreshTokenExpire
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateTokenPair 生成令牌对
|
||||||
|
func (j *JWT) GenerateTokenPair(userID int64, username string) (accessToken, refreshToken string, err error) {
|
||||||
|
accessToken, err = j.GenerateAccessToken(userID, username)
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
refreshToken, err = j.GenerateRefreshToken(userID, username)
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
return accessToken, refreshToken, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateTokenPairWithRemember 生成令牌对（支持记住登录）
|
||||||
|
func (j *JWT) GenerateTokenPairWithRemember(userID int64, username string, remember bool) (accessToken, refreshToken string, err error) {
|
||||||
|
accessToken, err = j.GenerateAccessToken(userID, username)
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
if remember {
|
||||||
|
refreshToken, err = j.GenerateLongLivedRefreshToken(userID, username)
|
||||||
|
} else {
|
||||||
|
refreshToken, err = j.GenerateRefreshToken(userID, username)
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return "", "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
return accessToken, refreshToken, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateLongLivedRefreshToken 生成长期刷新令牌（记住登录时使用）
|
||||||
|
func (j *JWT) GenerateLongLivedRefreshToken(userID int64, username string) (string, error) {
|
||||||
|
if err := j.ensureReady(); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
now := time.Now()
|
||||||
|
jti, err := generateJTI()
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
// 使用rememberLoginExpire，如果未配置则使用默认的refreshTokenExpire
|
||||||
|
expireDuration := j.rememberLoginExpire
|
||||||
|
if expireDuration == 0 {
|
||||||
|
expireDuration = j.refreshTokenExpire
|
||||||
|
}
|
||||||
|
|
||||||
|
claims := Claims{
|
||||||
|
UserID: userID,
|
||||||
|
Username: username,
|
||||||
|
Type: "refresh",
|
||||||
|
Remember: true, // 长期会话标记
|
||||||
|
JTI: jti,
|
||||||
|
RegisteredClaims: jwt.RegisteredClaims{
|
||||||
|
ExpiresAt: jwt.NewNumericDate(now.Add(expireDuration)),
|
||||||
|
IssuedAt: jwt.NewNumericDate(now),
|
||||||
|
NotBefore: jwt.NewNumericDate(now),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
token := jwt.NewWithClaims(j.signingMethod(), claims)
|
||||||
|
return token.SignedString(j.signingKey())
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParseToken 解析令牌
|
||||||
|
func (j *JWT) ParseToken(tokenString string) (*Claims, error) {
|
||||||
|
if err := j.ensureReady(); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
|
||||||
|
return j.verifyKey(token)
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if claims, ok := token.Claims.(*Claims); ok && token.Valid {
|
||||||
|
return claims, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, errors.New("invalid token")
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateAccessToken 验证访问令牌
|
||||||
|
func (j *JWT) ValidateAccessToken(tokenString string) (*Claims, error) {
|
||||||
|
claims, err := j.ParseToken(tokenString)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if claims.Type != "access" {
|
||||||
|
return nil, errors.New("invalid token type")
|
||||||
|
}
|
||||||
|
|
||||||
|
return claims, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateRefreshToken 验证刷新令牌
|
||||||
|
func (j *JWT) ValidateRefreshToken(tokenString string) (*Claims, error) {
|
||||||
|
claims, err := j.ParseToken(tokenString)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if claims.Type != "refresh" {
|
||||||
|
return nil, errors.New("invalid token type")
|
||||||
|
}
|
||||||
|
|
||||||
|
return claims, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RefreshAccessToken 刷新访问令牌
|
||||||
|
func (j *JWT) RefreshAccessToken(refreshTokenString string) (string, error) {
|
||||||
|
claims, err := j.ValidateRefreshToken(refreshTokenString)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
return j.GenerateAccessToken(claims.UserID, claims.Username)
|
||||||
|
}
|
||||||
17
internal/auth/jwt_closure_test.go
Normal file
17
internal/auth/jwt_closure_test.go
Normal file
@@ -0,0 +1,17 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestNewJWT_DoesNotPanicOnInvalidLegacyConfig(t *testing.T) {
|
||||||
|
manager := NewJWT("", 2*time.Hour, 7*24*time.Hour)
|
||||||
|
if manager == nil {
|
||||||
|
t.Fatal("expected manager instance")
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := manager.GenerateAccessToken(1, "tester"); err == nil {
|
||||||
|
t.Fatal("expected invalid legacy manager to return error")
|
||||||
|
}
|
||||||
|
}
|
||||||
126
internal/auth/jwt_password_test.go
Normal file
126
internal/auth/jwt_password_test.go
Normal file
@@ -0,0 +1,126 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestHashPassword_UsesArgon2id(t *testing.T) {
|
||||||
|
hashed, err := HashPassword("StrongPass1!")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("hash password failed: %v", err)
|
||||||
|
}
|
||||||
|
if !strings.HasPrefix(hashed, "$argon2id$") {
|
||||||
|
t.Fatalf("expected argon2id hash, got %q", hashed)
|
||||||
|
}
|
||||||
|
if !VerifyPassword(hashed, "StrongPass1!") {
|
||||||
|
t.Fatal("expected argon2id password verification to succeed")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestVerifyPassword_SupportsLegacyBcrypt(t *testing.T) {
|
||||||
|
hashed, err := BcryptHash("LegacyPass1!")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("hash legacy bcrypt password failed: %v", err)
|
||||||
|
}
|
||||||
|
if !VerifyPassword(hashed, "LegacyPass1!") {
|
||||||
|
t.Fatal("expected bcrypt compatibility verification to succeed")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewJWTWithOptions_RS256(t *testing.T) {
|
||||||
|
dir := t.TempDir()
|
||||||
|
jwtManager, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmRS256,
|
||||||
|
RSAPrivateKeyPath: filepath.Join(dir, "private.pem"),
|
||||||
|
RSAPublicKeyPath: filepath.Join(dir, "public.pem"),
|
||||||
|
AccessTokenExpire: 2 * time.Hour,
|
||||||
|
RefreshTokenExpire: 24 * time.Hour,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("create rs256 jwt manager failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
accessToken, refreshToken, err := jwtManager.GenerateTokenPair(42, "rs256-user")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("generate token pair failed: %v", err)
|
||||||
|
}
|
||||||
|
if jwtManager.GetAlgorithm() != jwtAlgorithmRS256 {
|
||||||
|
t.Fatalf("unexpected algorithm: %s", jwtManager.GetAlgorithm())
|
||||||
|
}
|
||||||
|
|
||||||
|
accessClaims, err := jwtManager.ValidateAccessToken(accessToken)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("validate access token failed: %v", err)
|
||||||
|
}
|
||||||
|
if accessClaims.UserID != 42 || accessClaims.Username != "rs256-user" {
|
||||||
|
t.Fatalf("unexpected access claims: %+v", accessClaims)
|
||||||
|
}
|
||||||
|
|
||||||
|
refreshClaims, err := jwtManager.ValidateRefreshToken(refreshToken)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("validate refresh token failed: %v", err)
|
||||||
|
}
|
||||||
|
if refreshClaims.Type != "refresh" {
|
||||||
|
t.Fatalf("unexpected refresh claims: %+v", refreshClaims)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewJWTWithOptions_RS256_RequiresKeyMaterial(t *testing.T) {
|
||||||
|
_, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmRS256,
|
||||||
|
AccessTokenExpire: 2 * time.Hour,
|
||||||
|
RefreshTokenExpire: 24 * time.Hour,
|
||||||
|
})
|
||||||
|
if err == nil {
|
||||||
|
t.Fatal("expected RS256 without key material to fail")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewJWTWithOptions_RS256_RequireExistingKeysRejectsMissingFiles(t *testing.T) {
|
||||||
|
dir := t.TempDir()
|
||||||
|
_, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmRS256,
|
||||||
|
RSAPrivateKeyPath: filepath.Join(dir, "missing-private.pem"),
|
||||||
|
RSAPublicKeyPath: filepath.Join(dir, "missing-public.pem"),
|
||||||
|
RequireExistingRSAKeys: true,
|
||||||
|
AccessTokenExpire: 2 * time.Hour,
|
||||||
|
RefreshTokenExpire: 24 * time.Hour,
|
||||||
|
})
|
||||||
|
if err == nil {
|
||||||
|
t.Fatal("expected RS256 strict mode to reject missing key files")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewJWTWithOptions_RS256_RequireExistingKeysAllowsExistingFiles(t *testing.T) {
|
||||||
|
dir := t.TempDir()
|
||||||
|
privatePath := filepath.Join(dir, "private.pem")
|
||||||
|
publicPath := filepath.Join(dir, "public.pem")
|
||||||
|
|
||||||
|
if _, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmRS256,
|
||||||
|
RSAPrivateKeyPath: privatePath,
|
||||||
|
RSAPublicKeyPath: publicPath,
|
||||||
|
AccessTokenExpire: 2 * time.Hour,
|
||||||
|
RefreshTokenExpire: 24 * time.Hour,
|
||||||
|
}); err != nil {
|
||||||
|
t.Fatalf("prepare key files failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
jwtManager, err := NewJWTWithOptions(JWTOptions{
|
||||||
|
Algorithm: jwtAlgorithmRS256,
|
||||||
|
RSAPrivateKeyPath: privatePath,
|
||||||
|
RSAPublicKeyPath: publicPath,
|
||||||
|
RequireExistingRSAKeys: true,
|
||||||
|
AccessTokenExpire: 2 * time.Hour,
|
||||||
|
RefreshTokenExpire: 24 * time.Hour,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected strict mode to accept existing key files, got: %v", err)
|
||||||
|
}
|
||||||
|
if jwtManager.GetAlgorithm() != jwtAlgorithmRS256 {
|
||||||
|
t.Fatalf("unexpected algorithm: %s", jwtManager.GetAlgorithm())
|
||||||
|
}
|
||||||
|
}
|
||||||
506
internal/auth/oauth.go
Normal file
506
internal/auth/oauth.go
Normal file
@@ -0,0 +1,506 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"net/url"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth/providers"
|
||||||
|
)
|
||||||
|
|
||||||
|
// OAuthProvider OAuth提供商类型
|
||||||
|
type OAuthProvider string
|
||||||
|
|
||||||
|
const (
|
||||||
|
OAuthProviderWeChat OAuthProvider = "wechat"
|
||||||
|
OAuthProviderQQ OAuthProvider = "qq"
|
||||||
|
OAuthProviderWeibo OAuthProvider = "weibo"
|
||||||
|
OAuthProviderGoogle OAuthProvider = "google"
|
||||||
|
OAuthProviderFacebook OAuthProvider = "facebook"
|
||||||
|
OAuthProviderTwitter OAuthProvider = "twitter"
|
||||||
|
OAuthProviderGitHub OAuthProvider = "github"
|
||||||
|
OAuthProviderAlipay OAuthProvider = "alipay"
|
||||||
|
OAuthProviderDouyin OAuthProvider = "douyin"
|
||||||
|
)
|
||||||
|
|
||||||
|
// OAuthUser OAuth用户信息
|
||||||
|
type OAuthUser struct {
|
||||||
|
Provider OAuthProvider `json:"provider"`
|
||||||
|
OpenID string `json:"open_id"`
|
||||||
|
UnionID string `json:"union_id,omitempty"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
Avatar string `json:"avatar"`
|
||||||
|
Gender string `json:"gender,omitempty"`
|
||||||
|
Email string `json:"email,omitempty"`
|
||||||
|
Phone string `json:"phone,omitempty"`
|
||||||
|
Extra map[string]interface{} `json:"extra,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OAuthToken OAuth令牌
|
||||||
|
type OAuthToken struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
RefreshToken string `json:"refresh_token,omitempty"`
|
||||||
|
ExpiresIn int64 `json:"expires_in"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
OpenID string `json:"open_id,omitempty"` // 微信等需要 openid
|
||||||
|
}
|
||||||
|
|
||||||
|
// OAuthConfig OAuth配置
|
||||||
|
type OAuthConfig struct {
|
||||||
|
ClientID string `json:"client_id"`
|
||||||
|
ClientSecret string `json:"client_secret"`
|
||||||
|
RedirectURI string `json:"redirect_uri"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
AuthURL string `json:"auth_url"`
|
||||||
|
TokenURL string `json:"token_url"`
|
||||||
|
UserInfoURL string `json:"user_info_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OAuthManager OAuth管理器接口
|
||||||
|
type OAuthManager interface {
|
||||||
|
// GetAuthURL 获取授权URL
|
||||||
|
GetAuthURL(provider OAuthProvider, state string) (string, error)
|
||||||
|
|
||||||
|
// ExchangeCode 换取访问令牌
|
||||||
|
ExchangeCode(provider OAuthProvider, code string) (*OAuthToken, error)
|
||||||
|
|
||||||
|
// GetUserInfo 获取用户信息
|
||||||
|
GetUserInfo(provider OAuthProvider, token *OAuthToken) (*OAuthUser, error)
|
||||||
|
|
||||||
|
// ValidateToken 验证令牌
|
||||||
|
ValidateToken(token string) (bool, error)
|
||||||
|
|
||||||
|
// GetConfig 获取OAuth配置
|
||||||
|
GetConfig(provider OAuthProvider) (*OAuthConfig, bool)
|
||||||
|
|
||||||
|
// GetEnabledProviders 获取已启用的OAuth提供商
|
||||||
|
GetEnabledProviders() []OAuthProviderInfo
|
||||||
|
}
|
||||||
|
|
||||||
|
// OAuthProviderInfo OAuth提供商信息
|
||||||
|
type OAuthProviderInfo struct {
|
||||||
|
Provider OAuthProvider `json:"provider"`
|
||||||
|
Enabled bool `json:"enabled"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// providerEntry 内部 provider 条目
|
||||||
|
type providerEntry struct {
|
||||||
|
config *OAuthConfig
|
||||||
|
google *providers.GoogleProvider
|
||||||
|
wechat *providers.WeChatProvider
|
||||||
|
wechatRedir string
|
||||||
|
qq *providers.QQProvider
|
||||||
|
github *providers.GitHubProvider
|
||||||
|
alipay *providers.AlipayProvider
|
||||||
|
douyin *providers.DouyinProvider
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultOAuthManager 默认OAuth管理器（集成真实 provider HTTP 调用）
|
||||||
|
type DefaultOAuthManager struct {
|
||||||
|
entries map[OAuthProvider]*providerEntry
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewOAuthManager 创建OAuth管理器
|
||||||
|
func NewOAuthManager() *DefaultOAuthManager {
|
||||||
|
return &DefaultOAuthManager{
|
||||||
|
entries: make(map[OAuthProvider]*providerEntry),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RegisterProvider 注册OAuth提供商（保留旧接口，仅存储配置）
|
||||||
|
func (m *DefaultOAuthManager) RegisterProvider(provider OAuthProvider, config *OAuthConfig) {
|
||||||
|
entry := &providerEntry{config: config}
|
||||||
|
|
||||||
|
switch provider {
|
||||||
|
case OAuthProviderGoogle:
|
||||||
|
entry.google = providers.NewGoogleProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
|
||||||
|
case OAuthProviderWeChat:
|
||||||
|
entry.wechat = providers.NewWeChatProvider(config.ClientID, config.ClientSecret, "web")
|
||||||
|
entry.wechatRedir = config.RedirectURI
|
||||||
|
case OAuthProviderQQ:
|
||||||
|
entry.qq = providers.NewQQProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
|
||||||
|
case OAuthProviderGitHub:
|
||||||
|
entry.github = providers.NewGitHubProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
|
||||||
|
case OAuthProviderAlipay:
|
||||||
|
// 支付宝使用 ClientID 存储 AppID，ClientSecret 存储 RSA 私钥
|
||||||
|
entry.alipay = providers.NewAlipayProvider(config.ClientID, config.ClientSecret, config.RedirectURI, false)
|
||||||
|
case OAuthProviderDouyin:
|
||||||
|
entry.douyin = providers.NewDouyinProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
|
||||||
|
}
|
||||||
|
|
||||||
|
m.entries[provider] = entry
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetConfig 获取OAuth配置
|
||||||
|
func (m *DefaultOAuthManager) GetConfig(provider OAuthProvider) (*OAuthConfig, bool) {
|
||||||
|
entry, ok := m.entries[provider]
|
||||||
|
if !ok {
|
||||||
|
return nil, false
|
||||||
|
}
|
||||||
|
return entry.config, true
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取授权URL（使用真实 provider 实现）
|
||||||
|
func (m *DefaultOAuthManager) GetAuthURL(provider OAuthProvider, state string) (string, error) {
|
||||||
|
entry, ok := m.entries[provider]
|
||||||
|
if !ok {
|
||||||
|
return "", ErrOAuthProviderNotSupported
|
||||||
|
}
|
||||||
|
|
||||||
|
switch provider {
|
||||||
|
case OAuthProviderGoogle:
|
||||||
|
if entry.google != nil {
|
||||||
|
resp, err := entry.google.GetAuthURL(state)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return resp.URL, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderWeChat:
|
||||||
|
if entry.wechat != nil {
|
||||||
|
resp, err := entry.wechat.GetAuthURL(entry.wechatRedir, state)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return resp.URL, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderQQ:
|
||||||
|
if entry.qq != nil {
|
||||||
|
resp, err := entry.qq.GetAuthURL(state)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return resp.URL, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderGitHub:
|
||||||
|
if entry.github != nil {
|
||||||
|
return entry.github.GetAuthURL(state)
|
||||||
|
}
|
||||||
|
case OAuthProviderAlipay:
|
||||||
|
if entry.alipay != nil {
|
||||||
|
return entry.alipay.GetAuthURL(state)
|
||||||
|
}
|
||||||
|
case OAuthProviderDouyin:
|
||||||
|
if entry.douyin != nil {
|
||||||
|
return entry.douyin.GetAuthURL(state)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 通用 fallback：按标准 OAuth2 拼接 URL（对 QQ/微博/Twitter/Facebook）
|
||||||
|
config := entry.config
|
||||||
|
if config == nil {
|
||||||
|
return "", ErrOAuthProviderNotSupported
|
||||||
|
}
|
||||||
|
return fmt.Sprintf("%s?client_id=%s&redirect_uri=%s&response_type=code&scope=%s&state=%s",
|
||||||
|
config.AuthURL,
|
||||||
|
url.QueryEscape(config.ClientID),
|
||||||
|
url.QueryEscape(config.RedirectURI),
|
||||||
|
url.QueryEscape(config.Scope),
|
||||||
|
url.QueryEscape(state),
|
||||||
|
), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 换取访问令牌（使用真实 provider 实现）
|
||||||
|
func (m *DefaultOAuthManager) ExchangeCode(provider OAuthProvider, code string) (*OAuthToken, error) {
|
||||||
|
entry, ok := m.entries[provider]
|
||||||
|
if !ok {
|
||||||
|
return nil, ErrOAuthProviderNotSupported
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
switch provider {
|
||||||
|
case OAuthProviderGoogle:
|
||||||
|
if entry.google != nil {
|
||||||
|
resp, err := entry.google.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.AccessToken,
|
||||||
|
RefreshToken: resp.RefreshToken,
|
||||||
|
ExpiresIn: int64(resp.ExpiresIn),
|
||||||
|
TokenType: resp.TokenType,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderWeChat:
|
||||||
|
if entry.wechat != nil {
|
||||||
|
resp, err := entry.wechat.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.AccessToken,
|
||||||
|
RefreshToken: resp.RefreshToken,
|
||||||
|
ExpiresIn: int64(resp.ExpiresIn),
|
||||||
|
TokenType: "Bearer",
|
||||||
|
OpenID: resp.OpenID,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderQQ:
|
||||||
|
if entry.qq != nil {
|
||||||
|
resp, err := entry.qq.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
openIDResp, err := entry.qq.GetOpenID(ctx, resp.AccessToken)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.AccessToken,
|
||||||
|
RefreshToken: resp.RefreshToken,
|
||||||
|
ExpiresIn: int64(resp.ExpiresIn),
|
||||||
|
TokenType: "Bearer",
|
||||||
|
OpenID: openIDResp.OpenID,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderGitHub:
|
||||||
|
if entry.github != nil {
|
||||||
|
resp, err := entry.github.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.AccessToken,
|
||||||
|
TokenType: resp.TokenType,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderAlipay:
|
||||||
|
if entry.alipay != nil {
|
||||||
|
resp, err := entry.alipay.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.AccessToken,
|
||||||
|
RefreshToken: resp.RefreshToken,
|
||||||
|
ExpiresIn: int64(resp.ExpiresIn),
|
||||||
|
TokenType: "Bearer",
|
||||||
|
OpenID: resp.UserID,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderDouyin:
|
||||||
|
if entry.douyin != nil {
|
||||||
|
resp, err := entry.douyin.ExchangeCode(ctx, code)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: resp.Data.AccessToken,
|
||||||
|
RefreshToken: resp.Data.RefreshToken,
|
||||||
|
ExpiresIn: int64(resp.Data.ExpiresIn),
|
||||||
|
TokenType: "Bearer",
|
||||||
|
OpenID: resp.Data.OpenID,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, fmt.Errorf("provider %s: real HTTP exchange not implemented yet", provider)
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取用户信息（使用真实 provider 实现）
|
||||||
|
func (m *DefaultOAuthManager) GetUserInfo(provider OAuthProvider, token *OAuthToken) (*OAuthUser, error) {
|
||||||
|
entry, ok := m.entries[provider]
|
||||||
|
if !ok {
|
||||||
|
return nil, ErrOAuthProviderNotSupported
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
switch provider {
|
||||||
|
case OAuthProviderGoogle:
|
||||||
|
if entry.google != nil {
|
||||||
|
info, err := entry.google.GetUserInfo(ctx, token.AccessToken)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: info.ID,
|
||||||
|
Nickname: info.Name,
|
||||||
|
Avatar: info.Picture,
|
||||||
|
Email: info.Email,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderWeChat:
|
||||||
|
if entry.wechat != nil {
|
||||||
|
openID := token.OpenID
|
||||||
|
info, err := entry.wechat.GetUserInfo(ctx, token.AccessToken, openID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
gender := ""
|
||||||
|
switch info.Sex {
|
||||||
|
case 1:
|
||||||
|
gender = "male"
|
||||||
|
case 2:
|
||||||
|
gender = "female"
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: info.OpenID,
|
||||||
|
UnionID: info.UnionID,
|
||||||
|
Nickname: info.Nickname,
|
||||||
|
Avatar: info.HeadImgURL,
|
||||||
|
Gender: gender,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderQQ:
|
||||||
|
if entry.qq != nil {
|
||||||
|
info, err := entry.qq.GetUserInfo(ctx, token.AccessToken, token.OpenID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
avatar := info.FigureURL2
|
||||||
|
if avatar == "" {
|
||||||
|
avatar = info.FigureURL1
|
||||||
|
}
|
||||||
|
if avatar == "" {
|
||||||
|
avatar = info.FigureURL
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: token.OpenID,
|
||||||
|
Nickname: info.Nickname,
|
||||||
|
Avatar: avatar,
|
||||||
|
Gender: info.Gender,
|
||||||
|
Extra: map[string]interface{}{
|
||||||
|
"province": info.Province,
|
||||||
|
"city": info.City,
|
||||||
|
"year": info.Year,
|
||||||
|
},
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderGitHub:
|
||||||
|
if entry.github != nil {
|
||||||
|
info, err := entry.github.GetUserInfo(ctx, token.AccessToken)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
nickname := info.Name
|
||||||
|
if nickname == "" {
|
||||||
|
nickname = info.Login
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: fmt.Sprintf("%d", info.ID),
|
||||||
|
Nickname: nickname,
|
||||||
|
Email: info.Email,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderAlipay:
|
||||||
|
if entry.alipay != nil {
|
||||||
|
info, err := entry.alipay.GetUserInfo(ctx, token.AccessToken)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: info.UserID,
|
||||||
|
Nickname: info.Nickname,
|
||||||
|
Avatar: info.Avatar,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
case OAuthProviderDouyin:
|
||||||
|
if entry.douyin != nil {
|
||||||
|
info, err := entry.douyin.GetUserInfo(ctx, token.AccessToken, token.OpenID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
gender := ""
|
||||||
|
switch info.Data.Gender {
|
||||||
|
case 1:
|
||||||
|
gender = "male"
|
||||||
|
case 2:
|
||||||
|
gender = "female"
|
||||||
|
}
|
||||||
|
return &OAuthUser{
|
||||||
|
Provider: provider,
|
||||||
|
OpenID: info.Data.OpenID,
|
||||||
|
UnionID: info.Data.UnionID,
|
||||||
|
Nickname: info.Data.Nickname,
|
||||||
|
Avatar: info.Data.Avatar,
|
||||||
|
Gender: gender,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, fmt.Errorf("provider %s: real HTTP user info not implemented yet", provider)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证令牌
|
||||||
|
// 注意：由于 ValidateToken 不持有 provider 上下文，无法进行真正的 token 验证
|
||||||
|
// 对于需要验证 token 的场景，应使用 GetUserInfo 通过 provider 的 userinfo 端点验证
|
||||||
|
// 如果没有可用的 provider，返回错误
|
||||||
|
func (m *DefaultOAuthManager) ValidateToken(token string) (bool, error) {
|
||||||
|
if len(token) == 0 {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
// 由于缺乏 provider 上下文，无法进行有意义的验证
|
||||||
|
// 遍历所有已启用的 provider，尝试通过 GetUserInfo 验证
|
||||||
|
// 如果没有任何 provider 可用，返回错误而不是默认通过
|
||||||
|
providers := m.GetEnabledProviders()
|
||||||
|
if len(providers) == 0 {
|
||||||
|
return false, errors.New("no OAuth providers configured")
|
||||||
|
}
|
||||||
|
// 尝试任一 provider 的 userinfo 端点验证
|
||||||
|
tokenObj := &OAuthToken{AccessToken: token}
|
||||||
|
for _, p := range providers {
|
||||||
|
if _, err := m.GetUserInfo(p.Provider, tokenObj); err == nil {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateTokenWithProvider 通过指定 provider 验证令牌
|
||||||
|
func (m *DefaultOAuthManager) ValidateTokenWithProvider(provider OAuthProvider, token string) (bool, error) {
|
||||||
|
if token == "" {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
cfg, ok := m.GetConfig(provider)
|
||||||
|
if !ok || cfg.ClientID == "" {
|
||||||
|
return false, fmt.Errorf("provider %s not configured", provider)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 通过 provider 的 userinfo 端点验证 token
|
||||||
|
tokenObj := &OAuthToken{AccessToken: token}
|
||||||
|
_, err := m.GetUserInfo(provider, tokenObj)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetEnabledProviders 获取已启用的OAuth提供商
|
||||||
|
func (m *DefaultOAuthManager) GetEnabledProviders() []OAuthProviderInfo {
|
||||||
|
providerNames := map[OAuthProvider]string{
|
||||||
|
OAuthProviderGoogle: "Google",
|
||||||
|
OAuthProviderWeChat: "微信",
|
||||||
|
OAuthProviderQQ: "QQ",
|
||||||
|
OAuthProviderWeibo: "微博",
|
||||||
|
OAuthProviderFacebook: "Facebook",
|
||||||
|
OAuthProviderTwitter: "Twitter",
|
||||||
|
OAuthProviderGitHub: "GitHub",
|
||||||
|
OAuthProviderAlipay: "支付宝",
|
||||||
|
OAuthProviderDouyin: "抖音",
|
||||||
|
}
|
||||||
|
|
||||||
|
var result []OAuthProviderInfo
|
||||||
|
for provider, entry := range m.entries {
|
||||||
|
name := providerNames[provider]
|
||||||
|
if name == "" {
|
||||||
|
name = string(provider)
|
||||||
|
}
|
||||||
|
result = append(result, OAuthProviderInfo{
|
||||||
|
Provider: provider,
|
||||||
|
Enabled: entry.config != nil,
|
||||||
|
Name: name,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
return result
|
||||||
|
}
|
||||||
233
internal/auth/oauth_config.go
Normal file
233
internal/auth/oauth_config.go
Normal file
@@ -0,0 +1,233 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
"gopkg.in/yaml.v3"
|
||||||
|
)
|
||||||
|
|
||||||
|
// OAuthConfigYAML OAuth配置结构 (从YAML文件加载)
|
||||||
|
type OAuthConfigYAML struct {
|
||||||
|
Common CommonConfig `yaml:"common"`
|
||||||
|
WeChat WeChatOAuthConfig `yaml:"wechat"`
|
||||||
|
Google GoogleOAuthConfig `yaml:"google"`
|
||||||
|
Facebook FacebookOAuthConfig `yaml:"facebook"`
|
||||||
|
QQ QQOAuthConfig `yaml:"qq"`
|
||||||
|
Weibo WeiboOAuthConfig `yaml:"weibo"`
|
||||||
|
Twitter TwitterOAuthConfig `yaml:"twitter"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// CommonConfig 通用配置
|
||||||
|
type CommonConfig struct {
|
||||||
|
RedirectBaseURL string `yaml:"redirect_base_url"`
|
||||||
|
CallbackPath string `yaml:"callback_path"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatOAuthConfig 微信OAuth配置
|
||||||
|
type WeChatOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
AppID string `yaml:"app_id"`
|
||||||
|
AppSecret string `yaml:"app_secret"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
MiniProgram MiniProgramConfig `yaml:"mini_program"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// MiniProgramConfig 小程序配置
|
||||||
|
type MiniProgramConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
AppID string `yaml:"app_id"`
|
||||||
|
AppSecret string `yaml:"app_secret"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// GoogleOAuthConfig Google OAuth配置
|
||||||
|
type GoogleOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
ClientID string `yaml:"client_id"`
|
||||||
|
ClientSecret string `yaml:"client_secret"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
JWTAuthURL string `yaml:"jwt_auth_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// FacebookOAuthConfig Facebook OAuth配置
|
||||||
|
type FacebookOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
AppID string `yaml:"app_id"`
|
||||||
|
AppSecret string `yaml:"app_secret"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// QQOAuthConfig QQ OAuth配置
|
||||||
|
type QQOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
AppID string `yaml:"app_id"`
|
||||||
|
AppKey string `yaml:"app_key"`
|
||||||
|
AppSecret string `yaml:"app_secret"`
|
||||||
|
RedirectURI string `yaml:"redirect_uri"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
OpenIDURL string `yaml:"openid_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeiboOAuthConfig 微博OAuth配置
|
||||||
|
type WeiboOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
AppKey string `yaml:"app_key"`
|
||||||
|
AppSecret string `yaml:"app_secret"`
|
||||||
|
RedirectURI string `yaml:"redirect_uri"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TwitterOAuthConfig Twitter OAuth配置
|
||||||
|
type TwitterOAuthConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled"`
|
||||||
|
ClientID string `yaml:"client_id"`
|
||||||
|
ClientSecret string `yaml:"client_secret"`
|
||||||
|
Scopes []string `yaml:"scopes"`
|
||||||
|
AuthURL string `yaml:"auth_url"`
|
||||||
|
TokenURL string `yaml:"token_url"`
|
||||||
|
UserInfoURL string `yaml:"user_info_url"`
|
||||||
|
}
|
||||||
|
|
||||||
|
var (
|
||||||
|
oauthConfig *OAuthConfigYAML
|
||||||
|
oauthConfigOnce sync.Once
|
||||||
|
)
|
||||||
|
|
||||||
|
// LoadOAuthConfig 加载OAuth配置
|
||||||
|
func LoadOAuthConfig(configPath string) (*OAuthConfigYAML, error) {
|
||||||
|
var err error
|
||||||
|
oauthConfigOnce.Do(func() {
|
||||||
|
// 如果未指定配置文件，尝试默认路径
|
||||||
|
if configPath == "" {
|
||||||
|
configPath = filepath.Join("configs", "oauth_config.yaml")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 如果配置文件不存在，尝试从环境变量加载
|
||||||
|
if _, statErr := os.Stat(configPath); os.IsNotExist(statErr) {
|
||||||
|
oauthConfig = loadFromEnv()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 从文件加载配置
|
||||||
|
data, readErr := os.ReadFile(configPath)
|
||||||
|
if readErr != nil {
|
||||||
|
oauthConfig = loadFromEnv()
|
||||||
|
err = fmt.Errorf("failed to read oauth config file: %w", readErr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
oauthConfig = &OAuthConfigYAML{}
|
||||||
|
if unmarshalErr := yaml.Unmarshal(data, oauthConfig); unmarshalErr != nil {
|
||||||
|
oauthConfig = loadFromEnv()
|
||||||
|
err = fmt.Errorf("failed to parse oauth config file: %w", unmarshalErr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
return oauthConfig, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// loadFromEnv 从环境变量加载配置
|
||||||
|
func loadFromEnv() *OAuthConfigYAML {
|
||||||
|
return &OAuthConfigYAML{
|
||||||
|
Common: CommonConfig{
|
||||||
|
RedirectBaseURL: getEnv("OAUTH_REDIRECT_BASE_URL", "http://localhost:8080"),
|
||||||
|
CallbackPath: getEnv("OAUTH_CALLBACK_PATH", "/api/v1/auth/oauth/callback"),
|
||||||
|
},
|
||||||
|
WeChat: WeChatOAuthConfig{
|
||||||
|
Enabled: getEnvBool("WECHAT_OAUTH_ENABLED", false),
|
||||||
|
AppID: getEnv("WECHAT_APP_ID", ""),
|
||||||
|
AppSecret: getEnv("WECHAT_APP_SECRET", ""),
|
||||||
|
AuthURL: "https://open.weixin.qq.com/connect/qrconnect",
|
||||||
|
TokenURL: "https://api.weixin.qq.com/sns/oauth2/access_token",
|
||||||
|
UserInfoURL: "https://api.weixin.qq.com/sns/userinfo",
|
||||||
|
},
|
||||||
|
Google: GoogleOAuthConfig{
|
||||||
|
Enabled: getEnvBool("GOOGLE_OAUTH_ENABLED", false),
|
||||||
|
ClientID: getEnv("GOOGLE_CLIENT_ID", ""),
|
||||||
|
ClientSecret: getEnv("GOOGLE_CLIENT_SECRET", ""),
|
||||||
|
AuthURL: "https://accounts.google.com/o/oauth2/v2/auth",
|
||||||
|
TokenURL: "https://oauth2.googleapis.com/token",
|
||||||
|
UserInfoURL: "https://www.googleapis.com/oauth2/v2/userinfo",
|
||||||
|
JWTAuthURL: "https://oauth2.googleapis.com/tokeninfo",
|
||||||
|
},
|
||||||
|
Facebook: FacebookOAuthConfig{
|
||||||
|
Enabled: getEnvBool("FACEBOOK_OAUTH_ENABLED", false),
|
||||||
|
AppID: getEnv("FACEBOOK_APP_ID", ""),
|
||||||
|
AppSecret: getEnv("FACEBOOK_APP_SECRET", ""),
|
||||||
|
AuthURL: "https://www.facebook.com/v18.0/dialog/oauth",
|
||||||
|
TokenURL: "https://graph.facebook.com/v18.0/oauth/access_token",
|
||||||
|
UserInfoURL: "https://graph.facebook.com/v18.0/me?fields=id,name,email,picture",
|
||||||
|
},
|
||||||
|
QQ: QQOAuthConfig{
|
||||||
|
Enabled: getEnvBool("QQ_OAUTH_ENABLED", false),
|
||||||
|
AppID: getEnv("QQ_APP_ID", ""),
|
||||||
|
AppKey: getEnv("QQ_APP_KEY", ""),
|
||||||
|
AppSecret: getEnv("QQ_APP_SECRET", ""),
|
||||||
|
RedirectURI: getEnv("QQ_REDIRECT_URI", ""),
|
||||||
|
AuthURL: "https://graph.qq.com/oauth2.0/authorize",
|
||||||
|
TokenURL: "https://graph.qq.com/oauth2.0/token",
|
||||||
|
OpenIDURL: "https://graph.qq.com/oauth2.0/me",
|
||||||
|
UserInfoURL: "https://graph.qq.com/user/get_user_info",
|
||||||
|
},
|
||||||
|
Weibo: WeiboOAuthConfig{
|
||||||
|
Enabled: getEnvBool("WEIBO_OAUTH_ENABLED", false),
|
||||||
|
AppKey: getEnv("WEIBO_APP_KEY", ""),
|
||||||
|
AppSecret: getEnv("WEIBO_APP_SECRET", ""),
|
||||||
|
RedirectURI: getEnv("WEIBO_REDIRECT_URI", ""),
|
||||||
|
AuthURL: "https://api.weibo.com/oauth2/authorize",
|
||||||
|
TokenURL: "https://api.weibo.com/oauth2/access_token",
|
||||||
|
UserInfoURL: "https://api.weibo.com/2/users/show.json",
|
||||||
|
},
|
||||||
|
Twitter: TwitterOAuthConfig{
|
||||||
|
Enabled: getEnvBool("TWITTER_OAUTH_ENABLED", false),
|
||||||
|
ClientID: getEnv("TWITTER_CLIENT_ID", ""),
|
||||||
|
ClientSecret: getEnv("TWITTER_CLIENT_SECRET", ""),
|
||||||
|
AuthURL: "https://twitter.com/i/oauth2/authorize",
|
||||||
|
TokenURL: "https://api.twitter.com/2/oauth2/token",
|
||||||
|
UserInfoURL: "https://api.twitter.com/2/users/me",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetOAuthConfig 获取OAuth配置
|
||||||
|
func GetOAuthConfig() *OAuthConfigYAML {
|
||||||
|
if oauthConfig == nil {
|
||||||
|
_, _ = LoadOAuthConfig("")
|
||||||
|
}
|
||||||
|
return oauthConfig
|
||||||
|
}
|
||||||
|
|
||||||
|
// getEnv 获取环境变量
|
||||||
|
func getEnv(key, defaultValue string) string {
|
||||||
|
if value := os.Getenv(key); value != "" {
|
||||||
|
return value
|
||||||
|
}
|
||||||
|
return defaultValue
|
||||||
|
}
|
||||||
|
|
||||||
|
// getEnvBool 获取布尔型环境变量
|
||||||
|
func getEnvBool(key string, defaultValue bool) bool {
|
||||||
|
if value := os.Getenv(key); value != "" {
|
||||||
|
return strings.ToLower(value) == "true" || value == "1"
|
||||||
|
}
|
||||||
|
return defaultValue
|
||||||
|
}
|
||||||
196
internal/auth/oauth_utils.go
Normal file
196
internal/auth/oauth_utils.go
Normal file
@@ -0,0 +1,196 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"golang.org/x/oauth2"
|
||||||
|
)
|
||||||
|
|
||||||
|
// StateStore OAuth状态存储
|
||||||
|
type StateStore struct {
|
||||||
|
states map[string]time.Time
|
||||||
|
mu sync.RWMutex
|
||||||
|
}
|
||||||
|
|
||||||
|
var stateStore = &StateStore{
|
||||||
|
states: make(map[string]time.Time),
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成OAuth状态参数
|
||||||
|
func GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
if _, err := rand.Read(b); err != nil {
|
||||||
|
return "", fmt.Errorf("generate state failed: %w", err)
|
||||||
|
}
|
||||||
|
state := base64.URLEncoding.EncodeToString(b)
|
||||||
|
|
||||||
|
// 存储状态，10分钟过期
|
||||||
|
stateStore.mu.Lock()
|
||||||
|
stateStore.states[state] = time.Now().Add(10 * time.Minute)
|
||||||
|
stateStore.mu.Unlock()
|
||||||
|
|
||||||
|
return state, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateState 验证OAuth状态参数
|
||||||
|
func ValidateState(state string) bool {
|
||||||
|
stateStore.mu.Lock()
|
||||||
|
defer stateStore.mu.Unlock()
|
||||||
|
|
||||||
|
expireTime, ok := stateStore.states[state]
|
||||||
|
if !ok {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查是否过期
|
||||||
|
if time.Now().After(expireTime) {
|
||||||
|
delete(stateStore.states, state)
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 使用后删除
|
||||||
|
delete(stateStore.states, state)
|
||||||
|
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// CleanupStates 清理过期的状态
|
||||||
|
func CleanupStates() {
|
||||||
|
stateStore.mu.Lock()
|
||||||
|
defer stateStore.mu.Unlock()
|
||||||
|
|
||||||
|
now := time.Now()
|
||||||
|
for state, expireTime := range stateStore.states {
|
||||||
|
if now.After(expireTime) {
|
||||||
|
delete(stateStore.states, state)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// HTTPClient OAuth HTTP客户端
|
||||||
|
var HTTPClient = &http.Client{
|
||||||
|
Timeout: 30 * time.Second,
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get 发送GET请求
|
||||||
|
func Get(url string) (*http.Response, error) {
|
||||||
|
return HTTPClient.Get(url)
|
||||||
|
}
|
||||||
|
|
||||||
|
// PostForm 发送POST表单请求
|
||||||
|
func PostForm(url string, data url.Values) (*http.Response, error) {
|
||||||
|
return HTTPClient.PostForm(url, data)
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetJSON 发送GET请求并解析JSON响应
|
||||||
|
func GetJSON(url string, result interface{}) error {
|
||||||
|
resp, err := Get(url)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
return fmt.Errorf("HTTP request failed with status %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
return json.NewDecoder(resp.Body).Decode(result)
|
||||||
|
}
|
||||||
|
|
||||||
|
// PostFormJSON 发送POST表单请求并解析JSON响应
|
||||||
|
func PostFormJSON(url string, data url.Values, result interface{}) error {
|
||||||
|
resp, err := PostForm(url, data)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
return fmt.Errorf("HTTP request failed with status %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
return json.NewDecoder(resp.Body).Decode(result)
|
||||||
|
}
|
||||||
|
|
||||||
|
// BuildAuthURL 构建标准OAuth授权URL
|
||||||
|
func BuildAuthURL(baseURL, clientID, redirectURI, scope, state string) string {
|
||||||
|
u, _ := url.Parse(baseURL)
|
||||||
|
q := u.Query()
|
||||||
|
q.Set("client_id", clientID)
|
||||||
|
q.Set("redirect_uri", redirectURI)
|
||||||
|
q.Set("scope", scope)
|
||||||
|
q.Set("state", state)
|
||||||
|
q.Set("response_type", "code")
|
||||||
|
u.RawQuery = q.Encode()
|
||||||
|
return u.String()
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParseAccessTokenResponse 解析访问令牌响应
|
||||||
|
func ParseAccessTokenResponse(resp []byte) (*OAuthToken, error) {
|
||||||
|
var result struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
ExpiresIn int64 `json:"expires_in"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := json.Unmarshal(resp, &result); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &OAuthToken{
|
||||||
|
AccessToken: result.AccessToken,
|
||||||
|
RefreshToken: result.RefreshToken,
|
||||||
|
ExpiresIn: result.ExpiresIn,
|
||||||
|
TokenType: result.TokenType,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParseQueryAccessToken 解析查询字符串形式的访问令牌（用于某些返回text/plain的API）
|
||||||
|
func ParseQueryAccessToken(body string) (accessToken string, err error) {
|
||||||
|
values, err := url.ParseQuery(body)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return values.Get("access_token"), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParseJSONPResponse 解析JSONP响应（用于QQ等平台）
|
||||||
|
func ParseJSONPResponse(jsonp string) (map[string]interface{}, error) {
|
||||||
|
// 移除callback包装
|
||||||
|
start := strings.Index(jsonp, "(")
|
||||||
|
end := strings.LastIndex(jsonp, ")")
|
||||||
|
if start == -1 || end == -1 {
|
||||||
|
return nil, fmt.Errorf("invalid JSONP format")
|
||||||
|
}
|
||||||
|
|
||||||
|
jsonStr := jsonp[start+1 : end]
|
||||||
|
var result map[string]interface{}
|
||||||
|
if err := json.Unmarshal([]byte(jsonStr), &result); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return result, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ToOAuth2Config 转换为oauth2.Config
|
||||||
|
func ToOAuth2Config(config *OAuthConfig) *oauth2.Config {
|
||||||
|
return &oauth2.Config{
|
||||||
|
ClientID: config.ClientID,
|
||||||
|
ClientSecret: config.ClientSecret,
|
||||||
|
RedirectURL: config.RedirectURI,
|
||||||
|
Scopes: strings.Split(config.Scope, ","),
|
||||||
|
Endpoint: oauth2.Endpoint{
|
||||||
|
AuthURL: config.AuthURL,
|
||||||
|
TokenURL: config.TokenURL,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
160
internal/auth/password.go
Normal file
160
internal/auth/password.go
Normal file
@@ -0,0 +1,160 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/subtle"
|
||||||
|
"encoding/hex"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/argon2"
|
||||||
|
"golang.org/x/crypto/bcrypt"
|
||||||
|
)
|
||||||
|
|
||||||
|
var defaultPasswordManager = NewPassword()
|
||||||
|
|
||||||
|
// Password 密码管理器（Argon2id）
|
||||||
|
type Password struct {
|
||||||
|
memory uint32
|
||||||
|
iterations uint32
|
||||||
|
parallelism uint8
|
||||||
|
saltLength uint32
|
||||||
|
keyLength uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPassword 创建密码管理器
|
||||||
|
func NewPassword() *Password {
|
||||||
|
return &Password{
|
||||||
|
memory: 64 * 1024, // 64MB（符合 OWASP 建议）
|
||||||
|
iterations: 5, // 5 次迭代（保守值，高于 OWASP 建议的 3）
|
||||||
|
parallelism: 4, // 4 并行（符合 OWASP 建议，防御 GPU 破解）
|
||||||
|
saltLength: 16, // 16 字节盐（符合 OWASP 最低要求）
|
||||||
|
keyLength: 32, // 32 字节密钥
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Hash 哈希密码（使用Argon2id + 随机盐）
|
||||||
|
func (p *Password) Hash(password string) (string, error) {
|
||||||
|
// 使用 crypto/rand 生成真正随机的盐
|
||||||
|
salt := make([]byte, p.saltLength)
|
||||||
|
if _, err := rand.Read(salt); err != nil {
|
||||||
|
return "", fmt.Errorf("生成随机盐失败: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 使用Argon2id哈希密码
|
||||||
|
hash := argon2.IDKey(
|
||||||
|
[]byte(password),
|
||||||
|
salt,
|
||||||
|
p.iterations,
|
||||||
|
p.memory,
|
||||||
|
p.parallelism,
|
||||||
|
p.keyLength,
|
||||||
|
)
|
||||||
|
|
||||||
|
// 格式: $argon2id$v=<version>$m=<memory>,t=<iterations>,p=<parallelism>$<salt_hex>$<hash_hex>
|
||||||
|
encoded := fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
|
||||||
|
argon2.Version,
|
||||||
|
p.memory,
|
||||||
|
p.iterations,
|
||||||
|
p.parallelism,
|
||||||
|
hex.EncodeToString(salt),
|
||||||
|
hex.EncodeToString(hash),
|
||||||
|
)
|
||||||
|
|
||||||
|
return encoded, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Verify 验证密码
|
||||||
|
func (p *Password) Verify(hashedPassword, password string) bool {
|
||||||
|
// 支持 bcrypt 格式（兼容旧数据）
|
||||||
|
if strings.HasPrefix(hashedPassword, "$2a$") || strings.HasPrefix(hashedPassword, "$2b$") {
|
||||||
|
err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
|
||||||
|
return err == nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// 解析 Argon2id 格式
|
||||||
|
parts := strings.Split(hashedPassword, "$")
|
||||||
|
// 格式: ["", "argon2id", "v=<version>", "m=<mem>,t=<iter>,p=<par>", "<salt_hex>", "<hash_hex>"]
|
||||||
|
if len(parts) != 6 || parts[1] != "argon2id" {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 解析参数
|
||||||
|
var memory, iterations uint32
|
||||||
|
var parallelism uint8
|
||||||
|
params := strings.Split(parts[3], ",")
|
||||||
|
if len(params) != 3 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
for _, param := range params {
|
||||||
|
kv := strings.SplitN(param, "=", 2)
|
||||||
|
if len(kv) != 2 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
val, err := strconv.ParseUint(kv[1], 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
switch kv[0] {
|
||||||
|
case "m":
|
||||||
|
memory = uint32(val)
|
||||||
|
case "t":
|
||||||
|
iterations = uint32(val)
|
||||||
|
case "p":
|
||||||
|
parallelism = uint8(val)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 解码盐和存储的哈希
|
||||||
|
salt, err := hex.DecodeString(parts[4])
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
storedHash, err := hex.DecodeString(parts[5])
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 用相同参数重新计算哈希
|
||||||
|
computedHash := argon2.IDKey(
|
||||||
|
[]byte(password),
|
||||||
|
salt,
|
||||||
|
iterations,
|
||||||
|
memory,
|
||||||
|
parallelism,
|
||||||
|
uint32(len(storedHash)),
|
||||||
|
)
|
||||||
|
|
||||||
|
// 常数时间比较，防止时序攻击
|
||||||
|
return subtle.ConstantTimeCompare(storedHash, computedHash) == 1
|
||||||
|
}
|
||||||
|
|
||||||
|
// HashPassword hashes passwords with Argon2id for new credentials.
|
||||||
|
func HashPassword(password string) (string, error) {
|
||||||
|
return defaultPasswordManager.Hash(password)
|
||||||
|
}
|
||||||
|
|
||||||
|
// VerifyPassword verifies both Argon2id and legacy bcrypt password hashes.
|
||||||
|
func VerifyPassword(hashedPassword, password string) bool {
|
||||||
|
return defaultPasswordManager.Verify(hashedPassword, password)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ErrInvalidPassword 密码无效错误
|
||||||
|
var ErrInvalidPassword = errors.New("密码无效")
|
||||||
|
|
||||||
|
// BcryptHash 使用bcrypt哈希密码（兼容性支持）
|
||||||
|
func BcryptHash(password string) (string, error) {
|
||||||
|
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("bcrypt加密失败: %w", err)
|
||||||
|
}
|
||||||
|
return string(hash), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// BcryptVerify 使用bcrypt验证密码
|
||||||
|
func BcryptVerify(hashedPassword, password string) bool {
|
||||||
|
err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
|
||||||
|
return err == nil
|
||||||
|
}
|
||||||
256
internal/auth/providers/alipay.go
Normal file
256
internal/auth/providers/alipay.go
Normal file
@@ -0,0 +1,256 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto"
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/rsa"
|
||||||
|
"crypto/sha256"
|
||||||
|
"crypto/x509"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"encoding/pem"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"sort"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// AlipayProvider 支付宝 OAuth提供者
|
||||||
|
// 支付宝使用 RSA2 签名（SHA256withRSA）
|
||||||
|
type AlipayProvider struct {
|
||||||
|
AppID string
|
||||||
|
PrivateKey string // RSA2 私钥（PKCS#8 PEM格式）
|
||||||
|
RedirectURI string
|
||||||
|
IsSandbox bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// AlipayTokenResponse 支付宝 Token响应
|
||||||
|
type AlipayTokenResponse struct {
|
||||||
|
UserID string `json:"user_id"`
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// AlipayUserInfo 支付宝用户信息
|
||||||
|
type AlipayUserInfo struct {
|
||||||
|
UserID string `json:"user_id"`
|
||||||
|
Nickname string `json:"nick_name"`
|
||||||
|
Avatar string `json:"avatar"`
|
||||||
|
Gender string `json:"gender"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewAlipayProvider 创建支付宝 OAuth提供者
|
||||||
|
func NewAlipayProvider(appID, privateKey, redirectURI string, isSandbox bool) *AlipayProvider {
|
||||||
|
return &AlipayProvider{
|
||||||
|
AppID: appID,
|
||||||
|
PrivateKey: privateKey,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
IsSandbox: isSandbox,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *AlipayProvider) getGateway() string {
|
||||||
|
if a.IsSandbox {
|
||||||
|
return "https://openapi-sandbox.dl.alipaydev.com/gateway.do"
|
||||||
|
}
|
||||||
|
return "https://openapi.alipay.com/gateway.do"
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取支付宝授权URL
|
||||||
|
func (a *AlipayProvider) GetAuthURL(state string) (string, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://openauth.alipay.com/oauth2/publicAppAuthorize.htm?app_id=%s&scope=auth_user&redirect_uri=%s&state=%s",
|
||||||
|
a.AppID,
|
||||||
|
url.QueryEscape(a.RedirectURI),
|
||||||
|
url.QueryEscape(state),
|
||||||
|
)
|
||||||
|
return authURL, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取 access_token
|
||||||
|
func (a *AlipayProvider) ExchangeCode(ctx context.Context, code string) (*AlipayTokenResponse, error) {
|
||||||
|
params := map[string]string{
|
||||||
|
"app_id": a.AppID,
|
||||||
|
"method": "alipay.system.oauth.token",
|
||||||
|
"charset": "UTF-8",
|
||||||
|
"sign_type": "RSA2",
|
||||||
|
"timestamp": time.Now().Format("2006-01-02 15:04:05"),
|
||||||
|
"version": "1.0",
|
||||||
|
"grant_type": "authorization_code",
|
||||||
|
"code": code,
|
||||||
|
}
|
||||||
|
|
||||||
|
if a.PrivateKey != "" {
|
||||||
|
sign, err := a.signParams(params)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("sign failed: %w", err)
|
||||||
|
}
|
||||||
|
params["sign"] = sign
|
||||||
|
}
|
||||||
|
|
||||||
|
form := url.Values{}
|
||||||
|
for k, v := range params {
|
||||||
|
form.Set(k, v)
|
||||||
|
}
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
|
||||||
|
strings.NewReader(form.Encode()))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var rawResp map[string]json.RawMessage
|
||||||
|
if err := json.Unmarshal(body, &rawResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tokenData, ok := rawResp["alipay_system_oauth_token_response"]
|
||||||
|
if !ok {
|
||||||
|
return nil, fmt.Errorf("invalid alipay response structure")
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp AlipayTokenResponse
|
||||||
|
if err := json.Unmarshal(tokenData, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取支付宝用户信息
|
||||||
|
func (a *AlipayProvider) GetUserInfo(ctx context.Context, accessToken string) (*AlipayUserInfo, error) {
|
||||||
|
params := map[string]string{
|
||||||
|
"app_id": a.AppID,
|
||||||
|
"method": "alipay.user.info.share",
|
||||||
|
"charset": "UTF-8",
|
||||||
|
"sign_type": "RSA2",
|
||||||
|
"timestamp": time.Now().Format("2006-01-02 15:04:05"),
|
||||||
|
"version": "1.0",
|
||||||
|
"auth_token": accessToken,
|
||||||
|
}
|
||||||
|
|
||||||
|
if a.PrivateKey != "" {
|
||||||
|
sign, err := a.signParams(params)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("sign failed: %w", err)
|
||||||
|
}
|
||||||
|
params["sign"] = sign
|
||||||
|
}
|
||||||
|
|
||||||
|
form := url.Values{}
|
||||||
|
for k, v := range params {
|
||||||
|
form.Set(k, v)
|
||||||
|
}
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
|
||||||
|
strings.NewReader(form.Encode()))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var rawResp map[string]json.RawMessage
|
||||||
|
if err := json.Unmarshal(body, &rawResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
userData, ok := rawResp["alipay_user_info_share_response"]
|
||||||
|
if !ok {
|
||||||
|
return nil, fmt.Errorf("invalid alipay user info response")
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo AlipayUserInfo
|
||||||
|
if err := json.Unmarshal(userData, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// signParams 使用 RSA2（SHA256withRSA）对参数签名
|
||||||
|
func (a *AlipayProvider) signParams(params map[string]string) (string, error) {
|
||||||
|
// 按字典序排列参数
|
||||||
|
keys := make([]string, 0, len(params))
|
||||||
|
for k := range params {
|
||||||
|
if k != "sign" {
|
||||||
|
keys = append(keys, k)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sort.Strings(keys)
|
||||||
|
|
||||||
|
var parts []string
|
||||||
|
for _, k := range keys {
|
||||||
|
parts = append(parts, k+"="+params[k])
|
||||||
|
}
|
||||||
|
signContent := strings.Join(parts, "&")
|
||||||
|
|
||||||
|
// 解析私钥
|
||||||
|
privKey, err := parseAlipayPrivateKey(a.PrivateKey)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("parse private key: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SHA256withRSA 签名
|
||||||
|
hash := sha256.Sum256([]byte(signContent))
|
||||||
|
signature, err := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256, hash[:])
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("rsa sign: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return base64.StdEncoding.EncodeToString(signature), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// parseAlipayPrivateKey 解析支付宝私钥（支持 PKCS#8 和 PKCS#1）
|
||||||
|
func parseAlipayPrivateKey(pemStr string) (*rsa.PrivateKey, error) {
|
||||||
|
// 如果没有 PEM 头，添加 PKCS#8 头
|
||||||
|
if !strings.Contains(pemStr, "-----BEGIN") {
|
||||||
|
pemStr = "-----BEGIN PRIVATE KEY-----\n" + pemStr + "\n-----END PRIVATE KEY-----"
|
||||||
|
}
|
||||||
|
|
||||||
|
block, _ := pem.Decode([]byte(pemStr))
|
||||||
|
if block == nil {
|
||||||
|
return nil, fmt.Errorf("failed to decode PEM block")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 尝试 PKCS#8
|
||||||
|
key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||||
|
if err == nil {
|
||||||
|
rsaKey, ok := key.(*rsa.PrivateKey)
|
||||||
|
if !ok {
|
||||||
|
return nil, fmt.Errorf("not an RSA private key")
|
||||||
|
}
|
||||||
|
return rsaKey, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// 尝试 PKCS#1
|
||||||
|
return x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||||
|
}
|
||||||
138
internal/auth/providers/douyin.go
Normal file
138
internal/auth/providers/douyin.go
Normal file
@@ -0,0 +1,138 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// DouyinProvider 抖音 OAuth提供者
|
||||||
|
// 抖音 OAuth 文档：https://developer.open-douyin.com/docs/resource/zh-CN/dop/develop/openapi/account-permission/get-access-token
|
||||||
|
type DouyinProvider struct {
|
||||||
|
ClientKey string // 抖音开放平台 client_key
|
||||||
|
ClientSecret string // 抖音开放平台 client_secret
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// DouyinTokenResponse 抖音 Token响应
|
||||||
|
type DouyinTokenResponse struct {
|
||||||
|
Data struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
RefreshExpiresIn int `json:"refresh_expires_in"`
|
||||||
|
OpenID string `json:"open_id"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
} `json:"data"`
|
||||||
|
Message string `json:"message"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// DouyinUserInfo 抖音用户信息
|
||||||
|
type DouyinUserInfo struct {
|
||||||
|
Data struct {
|
||||||
|
OpenID string `json:"open_id"`
|
||||||
|
UnionID string `json:"union_id"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
Avatar string `json:"avatar"`
|
||||||
|
Gender int `json:"gender"` // 0:未知 1:男 2:女
|
||||||
|
Country string `json:"country"`
|
||||||
|
Province string `json:"province"`
|
||||||
|
City string `json:"city"`
|
||||||
|
} `json:"data"`
|
||||||
|
Message string `json:"message"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewDouyinProvider 创建抖音 OAuth提供者
|
||||||
|
func NewDouyinProvider(clientKey, clientSecret, redirectURI string) *DouyinProvider {
|
||||||
|
return &DouyinProvider{
|
||||||
|
ClientKey: clientKey,
|
||||||
|
ClientSecret: clientSecret,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取抖音授权URL
|
||||||
|
func (d *DouyinProvider) GetAuthURL(state string) (string, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://open.douyin.com/platform/oauth/connect?client_key=%s&redirect_uri=%s&response_type=code&scope=user_info&state=%s",
|
||||||
|
d.ClientKey,
|
||||||
|
url.QueryEscape(d.RedirectURI),
|
||||||
|
url.QueryEscape(state),
|
||||||
|
)
|
||||||
|
return authURL, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取 access_token
|
||||||
|
func (d *DouyinProvider) ExchangeCode(ctx context.Context, code string) (*DouyinTokenResponse, error) {
|
||||||
|
tokenURL := "https://open.douyin.com/oauth/access_token/"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("client_key", d.ClientKey)
|
||||||
|
data.Set("client_secret", d.ClientSecret)
|
||||||
|
data.Set("code", code)
|
||||||
|
data.Set("grant_type", "authorization_code")
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "POST", tokenURL,
|
||||||
|
strings.NewReader(data.Encode()))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp DouyinTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenResp.Data.AccessToken == "" {
|
||||||
|
return nil, fmt.Errorf("抖音 OAuth: %s", tokenResp.Message)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取抖音用户信息
|
||||||
|
func (d *DouyinProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*DouyinUserInfo, error) {
|
||||||
|
userInfoURL := fmt.Sprintf("https://open.douyin.com/oauth/userinfo/?open_id=%s&access_token=%s",
|
||||||
|
url.QueryEscape(openID), url.QueryEscape(accessToken))
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo DouyinUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
207
internal/auth/providers/facebook.go
Normal file
207
internal/auth/providers/facebook.go
Normal file
@@ -0,0 +1,207 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// FacebookProvider Facebook OAuth提供者
|
||||||
|
type FacebookProvider struct {
|
||||||
|
AppID string
|
||||||
|
AppSecret string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// FacebookAuthURLResponse Facebook授权URL响应
|
||||||
|
type FacebookAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// FacebookTokenResponse Facebook Token响应
|
||||||
|
type FacebookTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// FacebookUserInfo Facebook用户信息
|
||||||
|
type FacebookUserInfo struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
Picture struct {
|
||||||
|
Data struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
Width int `json:"width"`
|
||||||
|
Height int `json:"height"`
|
||||||
|
IsSilhouette bool `json:"is_silhouette"`
|
||||||
|
} `json:"data"`
|
||||||
|
} `json:"picture"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewFacebookProvider 创建Facebook OAuth提供者
|
||||||
|
func NewFacebookProvider(appID, appSecret, redirectURI string) *FacebookProvider {
|
||||||
|
return &FacebookProvider{
|
||||||
|
AppID: appID,
|
||||||
|
AppSecret: appSecret,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (f *FacebookProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取Facebook授权URL
|
||||||
|
func (f *FacebookProvider) GetAuthURL(state string) (*FacebookAuthURLResponse, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://www.facebook.com/v18.0/dialog/oauth?client_id=%s&redirect_uri=%s&scope=email,public_profile&response_type=code&state=%s",
|
||||||
|
f.AppID,
|
||||||
|
url.QueryEscape(f.RedirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
|
||||||
|
return &FacebookAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
State: state,
|
||||||
|
Redirect: f.RedirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (f *FacebookProvider) ExchangeCode(ctx context.Context, code string) (*FacebookTokenResponse, error) {
|
||||||
|
tokenURL := fmt.Sprintf(
|
||||||
|
"https://graph.facebook.com/v18.0/oauth/access_token?client_id=%s&client_secret=%s&redirect_uri=%s&code=%s",
|
||||||
|
f.AppID,
|
||||||
|
f.AppSecret,
|
||||||
|
url.QueryEscape(f.RedirectURI),
|
||||||
|
code,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp FacebookTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取Facebook用户信息
|
||||||
|
func (f *FacebookProvider) GetUserInfo(ctx context.Context, accessToken string) (*FacebookUserInfo, error) {
|
||||||
|
// 请求用户信息（包括头像）
|
||||||
|
userInfoURL := fmt.Sprintf(
|
||||||
|
"https://graph.facebook.com/v18.0/me?fields=id,name,email,picture&access_token=%s",
|
||||||
|
accessToken,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Facebook错误响应
|
||||||
|
var errResp struct {
|
||||||
|
Error struct {
|
||||||
|
Message string `json:"message"`
|
||||||
|
Type string `json:"type"`
|
||||||
|
Code int `json:"code"`
|
||||||
|
ErrorSubcode int `json:"error_subcode,omitempty"`
|
||||||
|
} `json:"error"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Error.Message != "" {
|
||||||
|
return nil, fmt.Errorf("facebook api error: %s", errResp.Error.Message)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo FacebookUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (f *FacebookProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||||||
|
userInfo, err := f.GetUserInfo(ctx, accessToken)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return userInfo != nil && userInfo.ID != "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetLongLivedToken 获取长期有效的访问令牌（60天）
|
||||||
|
func (f *FacebookProvider) GetLongLivedToken(ctx context.Context, shortLivedToken string) (*FacebookTokenResponse, error) {
|
||||||
|
tokenURL := fmt.Sprintf(
|
||||||
|
"https://graph.facebook.com/v18.0/oauth/access_token?grant_type=fb_exchange_token&client_id=%s&client_secret=%s&fb_exchange_token=%s",
|
||||||
|
f.AppID,
|
||||||
|
f.AppSecret,
|
||||||
|
shortLivedToken,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp FacebookTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
172
internal/auth/providers/github.go
Normal file
172
internal/auth/providers/github.go
Normal file
@@ -0,0 +1,172 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// GitHubProvider GitHub OAuth提供者
|
||||||
|
type GitHubProvider struct {
|
||||||
|
ClientID string
|
||||||
|
ClientSecret string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// GitHubTokenResponse GitHub Token响应
|
||||||
|
type GitHubTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// GitHubUserInfo GitHub用户信息
|
||||||
|
type GitHubUserInfo struct {
|
||||||
|
ID int64 `json:"id"`
|
||||||
|
Login string `json:"login"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
AvatarURL string `json:"avatar_url"`
|
||||||
|
Bio string `json:"bio"`
|
||||||
|
Location string `json:"location"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewGitHubProvider 创建GitHub OAuth提供者
|
||||||
|
func NewGitHubProvider(clientID, clientSecret, redirectURI string) *GitHubProvider {
|
||||||
|
return &GitHubProvider{
|
||||||
|
ClientID: clientID,
|
||||||
|
ClientSecret: clientSecret,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取GitHub授权URL
|
||||||
|
func (g *GitHubProvider) GetAuthURL(state string) (string, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://github.com/login/oauth/authorize?client_id=%s&redirect_uri=%s&scope=read:user,user:email&state=%s",
|
||||||
|
g.ClientID,
|
||||||
|
url.QueryEscape(g.RedirectURI),
|
||||||
|
url.QueryEscape(state),
|
||||||
|
)
|
||||||
|
return authURL, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (g *GitHubProvider) ExchangeCode(ctx context.Context, code string) (*GitHubTokenResponse, error) {
|
||||||
|
tokenURL := "https://github.com/login/oauth/access_token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("client_id", g.ClientID)
|
||||||
|
data.Set("client_secret", g.ClientSecret)
|
||||||
|
data.Set("code", code)
|
||||||
|
data.Set("redirect_uri", g.RedirectURI)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "POST", tokenURL,
|
||||||
|
strings.NewReader(data.Encode()))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
req.Header.Set("Accept", "application/json")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp GitHubTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenResp.AccessToken == "" {
|
||||||
|
return nil, fmt.Errorf("GitHub OAuth: empty access token in response")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取GitHub用户信息
|
||||||
|
func (g *GitHubProvider) GetUserInfo(ctx context.Context, accessToken string) (*GitHubUserInfo, error) {
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.github.com/user", nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Authorization", "Bearer "+accessToken)
|
||||||
|
req.Header.Set("Accept", "application/vnd.github+json")
|
||||||
|
req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo GitHubUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 如果用户信息中的邮箱为空，尝试通过邮箱 API 获取主要邮箱
|
||||||
|
if userInfo.Email == "" {
|
||||||
|
email, _ := g.getPrimaryEmail(ctx, accessToken)
|
||||||
|
userInfo.Email = email
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// getPrimaryEmail 获取用户的主要邮箱
|
||||||
|
func (g *GitHubProvider) getPrimaryEmail(ctx context.Context, accessToken string) (string, error) {
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.github.com/user/emails", nil)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
req.Header.Set("Authorization", "Bearer "+accessToken)
|
||||||
|
req.Header.Set("Accept", "application/vnd.github+json")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
var emails []struct {
|
||||||
|
Email string `json:"email"`
|
||||||
|
Primary bool `json:"primary"`
|
||||||
|
Verified bool `json:"verified"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(body, &emails); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, e := range emails {
|
||||||
|
if e.Primary && e.Verified {
|
||||||
|
return e.Email, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
182
internal/auth/providers/google.go
Normal file
182
internal/auth/providers/google.go
Normal file
@@ -0,0 +1,182 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// GoogleProvider Google OAuth提供者
|
||||||
|
type GoogleProvider struct {
|
||||||
|
ClientID string
|
||||||
|
ClientSecret string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// GoogleAuthURLResponse Google授权URL响应
|
||||||
|
type GoogleAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// GoogleTokenResponse Google Token响应
|
||||||
|
type GoogleTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
IDToken string `json:"id_token"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// GoogleUserInfo Google用户信息
|
||||||
|
type GoogleUserInfo struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
VerifiedEmail bool `json:"verified_email"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
GivenName string `json:"given_name"`
|
||||||
|
FamilyName string `json:"family_name"`
|
||||||
|
Picture string `json:"picture"`
|
||||||
|
Locale string `json:"locale"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewGoogleProvider 创建Google OAuth提供者
|
||||||
|
func NewGoogleProvider(clientID, clientSecret, redirectURI string) *GoogleProvider {
|
||||||
|
return &GoogleProvider{
|
||||||
|
ClientID: clientID,
|
||||||
|
ClientSecret: clientSecret,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (g *GoogleProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取Google授权URL
|
||||||
|
func (g *GoogleProvider) GetAuthURL(state string) (*GoogleAuthURLResponse, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://accounts.google.com/o/oauth2/v2/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid+email+profile&state=%s",
|
||||||
|
g.ClientID,
|
||||||
|
url.QueryEscape(g.RedirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
|
||||||
|
return &GoogleAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
State: state,
|
||||||
|
Redirect: g.RedirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (g *GoogleProvider) ExchangeCode(ctx context.Context, code string) (*GoogleTokenResponse, error) {
|
||||||
|
tokenURL := "https://oauth2.googleapis.com/token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("code", code)
|
||||||
|
data.Set("client_id", g.ClientID)
|
||||||
|
data.Set("client_secret", g.ClientSecret)
|
||||||
|
data.Set("redirect_uri", g.RedirectURI)
|
||||||
|
data.Set("grant_type", "authorization_code")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp GoogleTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取Google用户信息
|
||||||
|
func (g *GoogleProvider) GetUserInfo(ctx context.Context, accessToken string) (*GoogleUserInfo, error) {
|
||||||
|
userInfoURL := fmt.Sprintf("https://www.googleapis.com/oauth2/v2/userinfo?access_token=%s", accessToken)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo GoogleUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RefreshToken 刷新访问令牌
|
||||||
|
func (g *GoogleProvider) RefreshToken(ctx context.Context, refreshToken string) (*GoogleTokenResponse, error) {
|
||||||
|
tokenURL := "https://oauth2.googleapis.com/token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("refresh_token", refreshToken)
|
||||||
|
data.Set("client_id", g.ClientID)
|
||||||
|
data.Set("client_secret", g.ClientSecret)
|
||||||
|
data.Set("grant_type", "refresh_token")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp GoogleTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (g *GoogleProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||||||
|
userInfo, err := g.GetUserInfo(ctx, accessToken)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return userInfo != nil, nil
|
||||||
|
}
|
||||||
43
internal/auth/providers/http.go
Normal file
43
internal/auth/providers/http.go
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
const maxOAuthResponseBodyBytes = 1 << 20
|
||||||
|
|
||||||
|
func postFormWithContext(ctx context.Context, client *http.Client, endpoint string, data url.Values) (*http.Response, error) {
|
||||||
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(data.Encode()))
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
return client.Do(req)
|
||||||
|
}
|
||||||
|
|
||||||
|
func readOAuthResponseBody(resp *http.Response) ([]byte, error) {
|
||||||
|
limited := io.LimitReader(resp.Body, maxOAuthResponseBodyBytes+1)
|
||||||
|
body, err := io.ReadAll(limited)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if len(body) > maxOAuthResponseBodyBytes {
|
||||||
|
return nil, fmt.Errorf("oauth response body exceeded %d bytes", maxOAuthResponseBodyBytes)
|
||||||
|
}
|
||||||
|
if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
|
||||||
|
snippet := strings.TrimSpace(string(body))
|
||||||
|
if len(snippet) > 256 {
|
||||||
|
snippet = snippet[:256]
|
||||||
|
}
|
||||||
|
if snippet == "" {
|
||||||
|
return nil, fmt.Errorf("oauth request failed with status %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
return nil, fmt.Errorf("oauth request failed with status %d: %s", resp.StatusCode, snippet)
|
||||||
|
}
|
||||||
|
return body, nil
|
||||||
|
}
|
||||||
66
internal/auth/providers/http_test.go
Normal file
66
internal/auth/providers/http_test.go
Normal file
@@ -0,0 +1,66 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestReadOAuthResponseBodyRejectsOversizedResponse(t *testing.T) {
|
||||||
|
resp := &http.Response{
|
||||||
|
StatusCode: http.StatusOK,
|
||||||
|
Body: io.NopCloser(bytes.NewReader(
|
||||||
|
bytes.Repeat([]byte("a"), maxOAuthResponseBodyBytes+1),
|
||||||
|
)),
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := readOAuthResponseBody(resp)
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "exceeded") {
|
||||||
|
t.Fatalf("expected oversized response error, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadOAuthResponseBodyRejectsNonSuccessStatus(t *testing.T) {
|
||||||
|
resp := &http.Response{
|
||||||
|
StatusCode: http.StatusBadGateway,
|
||||||
|
Body: io.NopCloser(strings.NewReader("provider unavailable")),
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := readOAuthResponseBody(resp)
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "502") {
|
||||||
|
t.Fatalf("expected status error, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadOAuthResponseBodyHandlesEmptyErrorBody(t *testing.T) {
|
||||||
|
resp := &http.Response{
|
||||||
|
StatusCode: http.StatusServiceUnavailable,
|
||||||
|
Body: io.NopCloser(strings.NewReader(" ")),
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := readOAuthResponseBody(resp)
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "503") {
|
||||||
|
t.Fatalf("expected empty-body status error, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestReadOAuthResponseBodyTruncatesLongErrorSnippet(t *testing.T) {
|
||||||
|
longBody := strings.Repeat("x", 400)
|
||||||
|
resp := &http.Response{
|
||||||
|
StatusCode: http.StatusBadRequest,
|
||||||
|
Body: io.NopCloser(strings.NewReader(longBody)),
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := readOAuthResponseBody(resp)
|
||||||
|
if err == nil {
|
||||||
|
t.Fatal("expected long error body to produce status error")
|
||||||
|
}
|
||||||
|
if !strings.Contains(err.Error(), "400") {
|
||||||
|
t.Fatalf("expected status code in error, got %v", err)
|
||||||
|
}
|
||||||
|
if strings.Contains(err.Error(), strings.Repeat("x", 300)) {
|
||||||
|
t.Fatalf("expected error snippet to be truncated, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
169
internal/auth/providers/provider_crypto_test.go
Normal file
169
internal/auth/providers/provider_crypto_test.go
Normal file
@@ -0,0 +1,169 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto"
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/rsa"
|
||||||
|
"crypto/sha256"
|
||||||
|
"crypto/x509"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/pem"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func generateRSAKeyForTest(t *testing.T) *rsa.PrivateKey {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
key, err := rsa.GenerateKey(rand.Reader, 1024)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("generate rsa key failed: %v", err)
|
||||||
|
}
|
||||||
|
return key
|
||||||
|
}
|
||||||
|
|
||||||
|
func marshalPKCS8PEMForTest(t *testing.T, key *rsa.PrivateKey) string {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
der, err := x509.MarshalPKCS8PrivateKey(key)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("marshal PKCS#8 failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return string(pem.EncodeToMemory(&pem.Block{
|
||||||
|
Type: "PRIVATE KEY",
|
||||||
|
Bytes: der,
|
||||||
|
}))
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParseAlipayPrivateKeySupportsRawPKCS8AndPKCS1(t *testing.T) {
|
||||||
|
key := generateRSAKeyForTest(t)
|
||||||
|
|
||||||
|
pkcs8DER, err := x509.MarshalPKCS8PrivateKey(key)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("marshal PKCS#8 failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
rawPKCS8 := base64.StdEncoding.EncodeToString(pkcs8DER)
|
||||||
|
parsedPKCS8, err := parseAlipayPrivateKey(rawPKCS8)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse raw PKCS#8 key failed: %v", err)
|
||||||
|
}
|
||||||
|
if parsedPKCS8.N.Cmp(key.N) != 0 || parsedPKCS8.D.Cmp(key.D) != 0 {
|
||||||
|
t.Fatal("parsed raw PKCS#8 key does not match original key")
|
||||||
|
}
|
||||||
|
|
||||||
|
pkcs1PEM := string(pem.EncodeToMemory(&pem.Block{
|
||||||
|
Type: "RSA PRIVATE KEY",
|
||||||
|
Bytes: x509.MarshalPKCS1PrivateKey(key),
|
||||||
|
}))
|
||||||
|
parsedPKCS1, err := parseAlipayPrivateKey(pkcs1PEM)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse PKCS#1 key failed: %v", err)
|
||||||
|
}
|
||||||
|
if parsedPKCS1.N.Cmp(key.N) != 0 || parsedPKCS1.D.Cmp(key.D) != 0 {
|
||||||
|
t.Fatal("parsed PKCS#1 key does not match original key")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParseAlipayPrivateKeyRejectsInvalidPEM(t *testing.T) {
|
||||||
|
if _, err := parseAlipayPrivateKey("not-a-valid-private-key"); err == nil {
|
||||||
|
t.Fatal("expected invalid private key parsing to fail")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAlipayProviderSignParamsProducesVerifiableSignature(t *testing.T) {
|
||||||
|
key := generateRSAKeyForTest(t)
|
||||||
|
provider := NewAlipayProvider(
|
||||||
|
"app-id",
|
||||||
|
marshalPKCS8PEMForTest(t, key),
|
||||||
|
"https://admin.example.com/login/oauth/callback",
|
||||||
|
false,
|
||||||
|
)
|
||||||
|
|
||||||
|
params := map[string]string{
|
||||||
|
"method": "alipay.system.oauth.token",
|
||||||
|
"app_id": "app-id",
|
||||||
|
"code": "auth-code",
|
||||||
|
"sign": "should-be-ignored",
|
||||||
|
}
|
||||||
|
|
||||||
|
signature, err := provider.signParams(params)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("signParams failed: %v", err)
|
||||||
|
}
|
||||||
|
if signature == "" {
|
||||||
|
t.Fatal("expected non-empty signature")
|
||||||
|
}
|
||||||
|
|
||||||
|
signatureBytes, err := base64.StdEncoding.DecodeString(signature)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decode signature failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
signContent := "app_id=app-id&code=auth-code&method=alipay.system.oauth.token"
|
||||||
|
hash := sha256.Sum256([]byte(signContent))
|
||||||
|
if err := rsa.VerifyPKCS1v15(&key.PublicKey, crypto.SHA256, hash[:], signatureBytes); err != nil {
|
||||||
|
t.Fatalf("signature verification failed: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestTwitterProviderPKCEHelpersAndAuthURL(t *testing.T) {
|
||||||
|
provider := NewTwitterProvider("twitter-client", "https://admin.example.com/login/oauth/callback")
|
||||||
|
|
||||||
|
verifierA, err := provider.GenerateCodeVerifier()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateCodeVerifier(first) failed: %v", err)
|
||||||
|
}
|
||||||
|
verifierB, err := provider.GenerateCodeVerifier()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateCodeVerifier(second) failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if verifierA == "" || verifierB == "" {
|
||||||
|
t.Fatal("expected non-empty code verifiers")
|
||||||
|
}
|
||||||
|
if verifierA == verifierB {
|
||||||
|
t.Fatal("expected code verifiers to differ across calls")
|
||||||
|
}
|
||||||
|
if strings.Contains(verifierA, "=") || strings.Contains(verifierB, "=") {
|
||||||
|
t.Fatal("expected code verifiers to be base64url values without padding")
|
||||||
|
}
|
||||||
|
if provider.GenerateCodeChallenge(verifierA) != verifierA {
|
||||||
|
t.Fatal("expected current code challenge implementation to mirror the verifier")
|
||||||
|
}
|
||||||
|
|
||||||
|
authURL, err := provider.GetAuthURL()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
if authURL.CodeVerifier == "" || authURL.State == "" {
|
||||||
|
t.Fatal("expected auth url response to include verifier and state")
|
||||||
|
}
|
||||||
|
if authURL.Redirect != provider.RedirectURI {
|
||||||
|
t.Fatalf("expected redirect %q, got %q", provider.RedirectURI, authURL.Redirect)
|
||||||
|
}
|
||||||
|
|
||||||
|
parsed, err := url.Parse(authURL.URL)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse auth url failed: %v", err)
|
||||||
|
}
|
||||||
|
query := parsed.Query()
|
||||||
|
|
||||||
|
if query.Get("client_id") != "twitter-client" {
|
||||||
|
t.Fatalf("expected twitter client_id, got %q", query.Get("client_id"))
|
||||||
|
}
|
||||||
|
if query.Get("redirect_uri") != provider.RedirectURI {
|
||||||
|
t.Fatalf("expected redirect_uri %q, got %q", provider.RedirectURI, query.Get("redirect_uri"))
|
||||||
|
}
|
||||||
|
if query.Get("code_challenge") != authURL.CodeVerifier {
|
||||||
|
t.Fatalf("expected code challenge to equal verifier, got %q", query.Get("code_challenge"))
|
||||||
|
}
|
||||||
|
if query.Get("code_challenge_method") != "plain" {
|
||||||
|
t.Fatalf("expected code_challenge_method plain, got %q", query.Get("code_challenge_method"))
|
||||||
|
}
|
||||||
|
if query.Get("state") != authURL.State {
|
||||||
|
t.Fatalf("expected state %q, got %q", authURL.State, query.Get("state"))
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,649 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func parseRequestForm(t *testing.T, req *http.Request) url.Values {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
body, err := io.ReadAll(req.Body)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("read request body failed: %v", err)
|
||||||
|
}
|
||||||
|
values, err := url.ParseQuery(string(body))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse request body failed: %v", err)
|
||||||
|
}
|
||||||
|
return values
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestPostFormWithContextSendsEncodedBody(t *testing.T) {
|
||||||
|
client := &http.Client{
|
||||||
|
Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.Method != http.MethodPost {
|
||||||
|
t.Fatalf("expected POST request, got %s", req.Method)
|
||||||
|
}
|
||||||
|
if req.URL.String() != "https://oauth.example.com/token" {
|
||||||
|
t.Fatalf("unexpected endpoint: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
if req.Header.Get("Content-Type") != "application/x-www-form-urlencoded" {
|
||||||
|
t.Fatalf("unexpected content type: %s", req.Header.Get("Content-Type"))
|
||||||
|
}
|
||||||
|
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("code") != "auth-code" || form.Get("grant_type") != "authorization_code" {
|
||||||
|
t.Fatalf("unexpected form payload: %#v", form)
|
||||||
|
}
|
||||||
|
|
||||||
|
return oauthResponse(`{"ok":true}`), nil
|
||||||
|
}),
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, err := postFormWithContext(context.Background(), client, "https://oauth.example.com/token", url.Values{
|
||||||
|
"code": {"auth-code"},
|
||||||
|
"grant_type": {"authorization_code"},
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("postFormWithContext failed: %v", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAlipayProviderExchangeCodeAndGetUserInfo(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewAlipayProvider("alipay-app", "", "https://example.com/callback", false)
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "openapi.alipay.com" || req.URL.Path != "/gateway.do" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("method") != "alipay.system.oauth.token" || form.Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"alipay_system_oauth_token_response":{"user_id":"2088","access_token":"ali-token","expires_in":3600}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "ali-token" || tokenResp.UserID != "2088" {
|
||||||
|
t.Fatalf("unexpected alipay token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("exchange code rejects invalid structure", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"unexpected":{}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "invalid alipay response structure") {
|
||||||
|
t.Fatalf("expected invalid structure error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "openapi.alipay.com" || req.URL.Path != "/gateway.do" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("method") != "alipay.user.info.share" || form.Get("auth_token") != "ali-token" {
|
||||||
|
t.Fatalf("unexpected user-info payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"alipay_user_info_share_response":{"user_id":"2088","nick_name":"Ali User","avatar":"https://cdn.example.com/avatar.png"}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "ali-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.UserID != "2088" || userInfo.Nickname != "Ali User" {
|
||||||
|
t.Fatalf("unexpected alipay user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info rejects invalid structure", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"unexpected":{}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "ali-token")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "invalid alipay user info response") {
|
||||||
|
t.Fatalf("expected invalid user info response error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDouyinProviderExchangeCodeAndGetUserInfo(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewDouyinProvider("douyin-key", "douyin-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "open.douyin.com" || req.URL.Path != "/oauth/access_token/" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("client_key") != "douyin-key" || form.Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"data":{"access_token":"douyin-token","open_id":"open-1"},"message":"success"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.Data.AccessToken != "douyin-token" || tokenResp.Data.OpenID != "open-1" {
|
||||||
|
t.Fatalf("unexpected douyin token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("exchange code rejects empty access token", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"data":{},"message":"invalid code"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "invalid code") {
|
||||||
|
t.Fatalf("expected douyin api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "open.douyin.com" || req.URL.Path != "/oauth/userinfo/" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
if req.URL.Query().Get("open_id") != "open-1" {
|
||||||
|
t.Fatalf("unexpected open_id: %s", req.URL.Query().Get("open_id"))
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"data":{"open_id":"open-1","union_id":"union-1","nickname":"Douyin User"}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "douyin-token", "open-1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.Data.OpenID != "open-1" || userInfo.Data.Nickname != "Douyin User" {
|
||||||
|
t.Fatalf("unexpected douyin user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGitHubProviderExchangeCodeAndGetUserInfo(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewGitHubProvider("github-client", "github-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "github.com" || req.URL.Path != "/login/oauth/access_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("client_id") != "github-client" || form.Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"gh-token","token_type":"bearer","scope":"read:user"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "gh-token" {
|
||||||
|
t.Fatalf("unexpected github token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("exchange code rejects empty token", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"token_type":"bearer"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "empty access token") {
|
||||||
|
t.Fatalf("expected empty access token error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info falls back to primary email", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
switch req.URL.Host + req.URL.Path {
|
||||||
|
case "api.github.com/user":
|
||||||
|
if req.Header.Get("Authorization") != "Bearer gh-token" {
|
||||||
|
t.Fatalf("unexpected auth header: %s", req.Header.Get("Authorization"))
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"id":101,"login":"octocat","name":"The Octocat","email":"","avatar_url":"https://cdn.example.com/octocat.png"}`), nil
|
||||||
|
case "api.github.com/user/emails":
|
||||||
|
return oauthResponse(`[{"email":"secondary@example.com","primary":false,"verified":true},{"email":"primary@example.com","primary":true,"verified":true}]`), nil
|
||||||
|
default:
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "gh-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.Login != "octocat" || userInfo.Email != "primary@example.com" {
|
||||||
|
t.Fatalf("unexpected github user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGoogleProviderExchangeCodeAndRefreshToken(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewGoogleProvider("google-client", "google-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "oauth2.googleapis.com" || req.URL.Path != "/token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("grant_type") != "authorization_code" || form.Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"google-token","expires_in":3600,"refresh_token":"refresh-1","token_type":"Bearer"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "google-token" || tokenResp.RefreshToken != "refresh-1" {
|
||||||
|
t.Fatalf("unexpected google token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("refresh token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "oauth2.googleapis.com" || req.URL.Path != "/token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("grant_type") != "refresh_token" || form.Get("refresh_token") != "refresh-1" {
|
||||||
|
t.Fatalf("unexpected refresh payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"google-token-2","expires_in":3600,"token_type":"Bearer"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.RefreshToken(ctx, "refresh-1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected refresh success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "google-token-2" {
|
||||||
|
t.Fatalf("unexpected google refresh response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestQQProviderExchangeCodeAndValidateToken(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewQQProvider("qq-app", "qq-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
if req.URL.Query().Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected code: %s", req.URL.Query().Get("code"))
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"qq-token","expires_in":3600,"refresh_token":"qq-refresh"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "qq-token" || tokenResp.RefreshToken != "qq-refresh" {
|
||||||
|
t.Fatalf("unexpected qq token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("validate token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"client_id":"qq-app","openid":"openid-1"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "qq-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected validate success, got error %v", err)
|
||||||
|
}
|
||||||
|
if !valid {
|
||||||
|
t.Fatal("expected qq token to be valid")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestTwitterProviderNetworkMethods(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewTwitterProvider("twitter-client", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code rejects twitter error response", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/oauth2/token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("grant_type") != "authorization_code" || form.Get("code_verifier") != "verifier-1" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"title":"Unauthorized","detail":"invalid verifier","status":401}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.ExchangeCode(ctx, "auth-code", "verifier-1")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "invalid verifier") {
|
||||||
|
t.Fatalf("expected twitter api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"access_token":"twitter-token","refresh_token":"twitter-refresh","token_type":"bearer"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code", "verifier-1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "twitter-token" {
|
||||||
|
t.Fatalf("unexpected twitter token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info rejects twitter error response", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/users/me" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"title":"Unauthorized","detail":"token expired","status":401}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "twitter-token")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "token expired") {
|
||||||
|
t.Fatalf("expected twitter user info error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"data":{"id":"user-1","name":"Twitter User","username":"tw-user"}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "twitter-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.Data.ID != "user-1" || userInfo.Data.Username != "tw-user" {
|
||||||
|
t.Fatalf("unexpected twitter user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("refresh token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("grant_type") != "refresh_token" || form.Get("refresh_token") != "twitter-refresh" {
|
||||||
|
t.Fatalf("unexpected refresh payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"twitter-token-2","refresh_token":"twitter-refresh-2","token_type":"bearer"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.RefreshToken(ctx, "twitter-refresh")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected refresh success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "twitter-token-2" {
|
||||||
|
t.Fatalf("unexpected twitter refresh response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("validate token returns false when user id is empty", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"data":{"id":"","username":"anonymous"}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "twitter-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected no error, got %v", err)
|
||||||
|
}
|
||||||
|
if valid {
|
||||||
|
t.Fatal("expected twitter token to be reported invalid")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("revoke token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/oauth2/revoke" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("token") != "twitter-token" || form.Get("token_type_hint") != "access_token" {
|
||||||
|
t.Fatalf("unexpected revoke payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
if err := provider.RevokeToken(ctx, "twitter-token"); err != nil {
|
||||||
|
t.Fatalf("expected revoke success, got error %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeChatProviderExchangeUserInfoAndRefreshToken(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewWeChatProvider("wx-app", "wx-secret", "web")
|
||||||
|
|
||||||
|
t.Run("exchange code rejects api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/oauth2/access_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"errcode":40029,"errmsg":"invalid code"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "wechat api error: 40029 - invalid code") {
|
||||||
|
t.Fatalf("expected wechat api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"access_token":"wx-token","refresh_token":"wx-refresh","openid":"openid-1","scope":"snsapi_login"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "wx-token" || tokenResp.OpenID != "openid-1" {
|
||||||
|
t.Fatalf("unexpected wechat token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info rejects api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/userinfo" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"errcode":40003,"errmsg":"invalid openid"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "wx-token", "openid-1")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "wechat api error: 40003 - invalid openid") {
|
||||||
|
t.Fatalf("expected wechat user info error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"openid":"openid-1","nickname":"WeChat User","province":"Shanghai"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "wx-token", "openid-1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.OpenID != "openid-1" || userInfo.Nickname != "WeChat User" {
|
||||||
|
t.Fatalf("unexpected wechat user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("refresh token rejects api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/oauth2/refresh_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"errcode":40030,"errmsg":"invalid refresh token"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.RefreshToken(ctx, "wx-refresh")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "wechat api error: 40030 - invalid refresh token") {
|
||||||
|
t.Fatalf("expected wechat refresh error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("refresh token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"access_token":"wx-token-2","refresh_token":"wx-refresh-2","openid":"openid-1"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.RefreshToken(ctx, "wx-refresh")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected refresh success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "wx-token-2" {
|
||||||
|
t.Fatalf("unexpected wechat refresh response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeiboProviderExchangeCodeAndGetUserInfo(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewWeiboProvider("weibo-app", "weibo-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weibo.com" || req.URL.Path != "/oauth2/access_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
form := parseRequestForm(t, req)
|
||||||
|
if form.Get("client_id") != "weibo-app" || form.Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected exchange payload: %#v", form)
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"weibo-token","expires_in":3600,"uid":"1001"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "weibo-token" || tokenResp.UID != "1001" {
|
||||||
|
t.Fatalf("unexpected weibo token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info rejects api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weibo.com" || req.URL.Path != "/2/users/show.json" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"error":1,"error_code":21315,"request":"/2/users/show.json"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "weibo-token", "1001")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "weibo api error: code=21315") {
|
||||||
|
t.Fatalf("expected weibo api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
return oauthResponse(`{"id":1001,"idstr":"1001","screen_name":"weibo-user","name":"Weibo User"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
userInfo, err := provider.GetUserInfo(ctx, "weibo-token", "1001")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if userInfo.ID != 1001 || userInfo.ScreenName != "weibo-user" {
|
||||||
|
t.Fatalf("unexpected weibo user info: %#v", userInfo)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFacebookProviderExchangeValidateAndLongLivedToken(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewFacebookProvider("facebook-app", "facebook-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("exchange code success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/oauth/access_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
if req.URL.Query().Get("code") != "auth-code" {
|
||||||
|
t.Fatalf("unexpected code: %s", req.URL.Query().Get("code"))
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"fb-token","token_type":"bearer","expires_in":3600}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected exchange success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "fb-token" {
|
||||||
|
t.Fatalf("unexpected facebook token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("validate token returns false for empty id", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Path != "/v18.0/me" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"id":"","name":"No ID User"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "fb-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected validate success, got error %v", err)
|
||||||
|
}
|
||||||
|
if valid {
|
||||||
|
t.Fatal("expected facebook token to be reported invalid")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get long lived token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Path != "/v18.0/oauth/access_token" || req.URL.Query().Get("grant_type") != "fb_exchange_token" {
|
||||||
|
t.Fatalf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"access_token":"fb-long-lived","token_type":"bearer","expires_in":5184000}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
tokenResp, err := provider.GetLongLivedToken(ctx, "fb-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected long-lived token success, got error %v", err)
|
||||||
|
}
|
||||||
|
if tokenResp.AccessToken != "fb-long-lived" {
|
||||||
|
t.Fatalf("unexpected facebook long-lived token response: %#v", tokenResp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
284
internal/auth/providers/provider_http_roundtrip_test.go
Normal file
284
internal/auth/providers/provider_http_roundtrip_test.go
Normal file
@@ -0,0 +1,284 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
type roundTripFunc func(*http.Request) (*http.Response, error)
|
||||||
|
|
||||||
|
func (fn roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||||
|
return fn(req)
|
||||||
|
}
|
||||||
|
|
||||||
|
func useDefaultTransport(t *testing.T, fn roundTripFunc) {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
originalTransport := http.DefaultTransport
|
||||||
|
http.DefaultTransport = fn
|
||||||
|
t.Cleanup(func() {
|
||||||
|
http.DefaultTransport = originalTransport
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func oauthResponse(body string) *http.Response {
|
||||||
|
return &http.Response{
|
||||||
|
StatusCode: http.StatusOK,
|
||||||
|
Body: io.NopCloser(strings.NewReader(body)),
|
||||||
|
Header: make(http.Header),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestQQProviderGetOpenIDAndUserInfoWithDefaultTransport(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewQQProvider("qq-app", "qq-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("get openid success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"client_id":"qq-app","openid":"openid-123"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
resp, err := provider.GetOpenID(ctx, "access-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected openid success, got error %v", err)
|
||||||
|
}
|
||||||
|
if resp.OpenID != "openid-123" || resp.ClientID != "qq-app" {
|
||||||
|
t.Fatalf("unexpected openid response: %#v", resp)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get openid parse error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`not-json`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetOpenID(ctx, "access-token")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "parse openid response failed") {
|
||||||
|
t.Fatalf("expected openid parse error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/user/get_user_info" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"ret":1001,"msg":"invalid token"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "access-token", "openid-123")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "qq api error: invalid token") {
|
||||||
|
t.Fatalf("expected qq api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("get user info success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.qq.com" || req.URL.Path != "/user/get_user_info" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"ret":0,"msg":"","nickname":"tester","gender":"male","city":"Shanghai"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
info, err := provider.GetUserInfo(ctx, "access-token", "openid-123")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if info.Nickname != "tester" || info.City != "Shanghai" {
|
||||||
|
t.Fatalf("unexpected user info response: %#v", info)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeiboProviderValidateTokenWithDefaultTransport(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewWeiboProvider("weibo-app", "weibo-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
body string
|
||||||
|
wantValid bool
|
||||||
|
wantErrContains string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "rejects error response",
|
||||||
|
body: `{"error":"invalid_token"}`,
|
||||||
|
wantValid: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "accepts expire_in response",
|
||||||
|
body: `{"expire_in":3600}`,
|
||||||
|
wantValid: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "rejects ambiguous response",
|
||||||
|
body: `{"uid":"123"}`,
|
||||||
|
wantValid: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "returns parse error",
|
||||||
|
body: `not-json`,
|
||||||
|
wantErrContains: "parse response failed",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weibo.com" || req.URL.Path != "/oauth2/get_token_info" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(tt.body), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "access-token")
|
||||||
|
if tt.wantErrContains != "" {
|
||||||
|
if err == nil || !strings.Contains(err.Error(), tt.wantErrContains) {
|
||||||
|
t.Fatalf("expected error containing %q, got %v", tt.wantErrContains, err)
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected no error, got %v", err)
|
||||||
|
}
|
||||||
|
if valid != tt.wantValid {
|
||||||
|
t.Fatalf("expected valid=%v, got %v", tt.wantValid, valid)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeChatProviderValidateTokenWithDefaultTransport(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewWeChatProvider("wx-app", "wx-secret", "web")
|
||||||
|
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
body string
|
||||||
|
wantValid bool
|
||||||
|
wantErrContains string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "accepts errcode zero",
|
||||||
|
body: `{"errcode":0,"errmsg":"ok"}`,
|
||||||
|
wantValid: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "rejects non-zero errcode",
|
||||||
|
body: `{"errcode":40003,"errmsg":"invalid openid"}`,
|
||||||
|
wantValid: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "returns parse error",
|
||||||
|
body: `not-json`,
|
||||||
|
wantErrContains: "parse response failed",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/auth" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(tt.body), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "access-token", "openid-123")
|
||||||
|
if tt.wantErrContains != "" {
|
||||||
|
if err == nil || !strings.Contains(err.Error(), tt.wantErrContains) {
|
||||||
|
t.Fatalf("expected error containing %q, got %v", tt.wantErrContains, err)
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected no error, got %v", err)
|
||||||
|
}
|
||||||
|
if valid != tt.wantValid {
|
||||||
|
t.Fatalf("expected valid=%v, got %v", tt.wantValid, valid)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGoogleProviderValidateTokenWithDefaultTransport(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewGoogleProvider("google-client", "google-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("validate token success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "www.googleapis.com" || req.URL.Path != "/oauth2/v2/userinfo" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"id":"user-1","email":"user@example.com","name":"Google User"}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "access-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected success, got error %v", err)
|
||||||
|
}
|
||||||
|
if !valid {
|
||||||
|
t.Fatal("expected token to be valid")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("validate token parse error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "www.googleapis.com" || req.URL.Path != "/oauth2/v2/userinfo" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`not-json`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
valid, err := provider.ValidateToken(ctx, "access-token")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "parse user info failed") {
|
||||||
|
t.Fatalf("expected user info parse error, got valid=%v err=%v", valid, err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFacebookProviderGetUserInfoWithDefaultTransport(t *testing.T) {
|
||||||
|
ctx := context.Background()
|
||||||
|
provider := NewFacebookProvider("facebook-app", "facebook-secret", "https://example.com/callback")
|
||||||
|
|
||||||
|
t.Run("facebook api error", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/me" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"error":{"message":"token expired","type":"OAuthException","code":190}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
_, err := provider.GetUserInfo(ctx, "access-token")
|
||||||
|
if err == nil || !strings.Contains(err.Error(), "facebook api error: token expired") {
|
||||||
|
t.Fatalf("expected facebook api error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("facebook success", func(t *testing.T) {
|
||||||
|
useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
||||||
|
if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/me" {
|
||||||
|
return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
|
||||||
|
}
|
||||||
|
return oauthResponse(`{"id":"user-1","name":"Facebook User","email":"fb@example.com","picture":{"data":{"url":"https://cdn.example.com/a.png"}}}`), nil
|
||||||
|
}))
|
||||||
|
|
||||||
|
info, err := provider.GetUserInfo(ctx, "access-token")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("expected user info success, got error %v", err)
|
||||||
|
}
|
||||||
|
if info.ID != "user-1" || info.Picture.Data.URL == "" {
|
||||||
|
t.Fatalf("unexpected facebook user info response: %#v", info)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
191
internal/auth/providers/provider_urls_additional_test.go
Normal file
191
internal/auth/providers/provider_urls_additional_test.go
Normal file
@@ -0,0 +1,191 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestAdditionalProviderStateGeneratorsProduceDistinctTokens(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
generateState func() (string, error)
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "facebook",
|
||||||
|
generateState: func() (string, error) {
|
||||||
|
return NewFacebookProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "qq",
|
||||||
|
generateState: func() (string, error) {
|
||||||
|
return NewQQProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "weibo",
|
||||||
|
generateState: func() (string, error) {
|
||||||
|
return NewWeiboProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
stateA, err := tc.generateState()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateState(first) failed: %v", err)
|
||||||
|
}
|
||||||
|
stateB, err := tc.generateState()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateState(second) failed: %v", err)
|
||||||
|
}
|
||||||
|
if stateA == "" || stateB == "" {
|
||||||
|
t.Fatal("expected non-empty generated states")
|
||||||
|
}
|
||||||
|
if stateA == stateB {
|
||||||
|
t.Fatal("expected generated states to differ between calls")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAdditionalProviderAuthURLs(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
buildURL func(t *testing.T) (string, string)
|
||||||
|
expectedHost string
|
||||||
|
expectedPath string
|
||||||
|
expectedKey string
|
||||||
|
expectedValue string
|
||||||
|
expectedClause string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "facebook",
|
||||||
|
buildURL: func(t *testing.T) (string, string) {
|
||||||
|
t.Helper()
|
||||||
|
redirectURI := "https://admin.example.com/login/oauth/callback?from=fb"
|
||||||
|
authURL, err := NewFacebookProvider("fb-app-id", "fb-secret", redirectURI).GetAuthURL("fb-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
return authURL.URL, redirectURI
|
||||||
|
},
|
||||||
|
expectedHost: "www.facebook.com",
|
||||||
|
expectedPath: "/v18.0/dialog/oauth",
|
||||||
|
expectedKey: "client_id",
|
||||||
|
expectedValue: "fb-app-id",
|
||||||
|
expectedClause: "scope=email,public_profile",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "qq",
|
||||||
|
buildURL: func(t *testing.T) (string, string) {
|
||||||
|
t.Helper()
|
||||||
|
redirectURI := "https://admin.example.com/login/oauth/callback?from=qq"
|
||||||
|
authURL, err := NewQQProvider("qq-app-id", "qq-secret", redirectURI).GetAuthURL("qq-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
return authURL.URL, redirectURI
|
||||||
|
},
|
||||||
|
expectedHost: "graph.qq.com",
|
||||||
|
expectedPath: "/oauth2.0/authorize",
|
||||||
|
expectedKey: "client_id",
|
||||||
|
expectedValue: "qq-app-id",
|
||||||
|
expectedClause: "scope=get_user_info",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "weibo",
|
||||||
|
buildURL: func(t *testing.T) (string, string) {
|
||||||
|
t.Helper()
|
||||||
|
redirectURI := "https://admin.example.com/login/oauth/callback?from=weibo"
|
||||||
|
authURL, err := NewWeiboProvider("wb-app-id", "wb-secret", redirectURI).GetAuthURL("wb-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
return authURL.URL, redirectURI
|
||||||
|
},
|
||||||
|
expectedHost: "api.weibo.com",
|
||||||
|
expectedPath: "/oauth2/authorize",
|
||||||
|
expectedKey: "client_id",
|
||||||
|
expectedValue: "wb-app-id",
|
||||||
|
expectedClause: "response_type=code",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "douyin",
|
||||||
|
buildURL: func(t *testing.T) (string, string) {
|
||||||
|
t.Helper()
|
||||||
|
redirectURI := "https://admin.example.com/login/oauth/callback?from=douyin"
|
||||||
|
authURL, err := NewDouyinProvider("dy-client", "dy-secret", redirectURI).GetAuthURL("dy-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
return authURL, redirectURI
|
||||||
|
},
|
||||||
|
expectedHost: "open.douyin.com",
|
||||||
|
expectedPath: "/platform/oauth/connect",
|
||||||
|
expectedKey: "client_key",
|
||||||
|
expectedValue: "dy-client",
|
||||||
|
expectedClause: "scope=user_info",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "alipay",
|
||||||
|
buildURL: func(t *testing.T) (string, string) {
|
||||||
|
t.Helper()
|
||||||
|
redirectURI := "https://admin.example.com/login/oauth/callback?from=alipay"
|
||||||
|
authURL, err := NewAlipayProvider("ali-app-id", "private-key", redirectURI, false).GetAuthURL("ali-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
return authURL, redirectURI
|
||||||
|
},
|
||||||
|
expectedHost: "openauth.alipay.com",
|
||||||
|
expectedPath: "/oauth2/publicAppAuthorize.htm",
|
||||||
|
expectedKey: "app_id",
|
||||||
|
expectedValue: "ali-app-id",
|
||||||
|
expectedClause: "scope=auth_user",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
authURL, redirectURI := tc.buildURL(t)
|
||||||
|
|
||||||
|
parsed, err := url.Parse(authURL)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse auth url failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if parsed.Host != tc.expectedHost {
|
||||||
|
t.Fatalf("expected host %q, got %q", tc.expectedHost, parsed.Host)
|
||||||
|
}
|
||||||
|
if parsed.Path != tc.expectedPath {
|
||||||
|
t.Fatalf("expected path %q, got %q", tc.expectedPath, parsed.Path)
|
||||||
|
}
|
||||||
|
|
||||||
|
query := parsed.Query()
|
||||||
|
if query.Get(tc.expectedKey) != tc.expectedValue {
|
||||||
|
t.Fatalf("expected %s=%q, got %q", tc.expectedKey, tc.expectedValue, query.Get(tc.expectedKey))
|
||||||
|
}
|
||||||
|
if query.Get("redirect_uri") != redirectURI {
|
||||||
|
t.Fatalf("expected redirect_uri %q, got %q", redirectURI, query.Get("redirect_uri"))
|
||||||
|
}
|
||||||
|
if !strings.Contains(authURL, tc.expectedClause) {
|
||||||
|
t.Fatalf("expected auth url to contain %q, got %q", tc.expectedClause, authURL)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAlipayProviderUsesExpectedGatewayForSandboxAndProduction(t *testing.T) {
|
||||||
|
productionProvider := NewAlipayProvider("prod-app-id", "private-key", "https://admin.example.com/callback", false)
|
||||||
|
if gateway := productionProvider.getGateway(); gateway != "https://openapi.alipay.com/gateway.do" {
|
||||||
|
t.Fatalf("expected production gateway, got %q", gateway)
|
||||||
|
}
|
||||||
|
|
||||||
|
sandboxProvider := NewAlipayProvider("sandbox-app-id", "private-key", "https://admin.example.com/callback", true)
|
||||||
|
if gateway := sandboxProvider.getGateway(); gateway != "https://openapi-sandbox.dl.alipaydev.com/gateway.do" {
|
||||||
|
t.Fatalf("expected sandbox gateway, got %q", gateway)
|
||||||
|
}
|
||||||
|
}
|
||||||
124
internal/auth/providers/provider_urls_test.go
Normal file
124
internal/auth/providers/provider_urls_test.go
Normal file
@@ -0,0 +1,124 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestGitHubProviderGetAuthURLEscapesRedirectAndState(t *testing.T) {
|
||||||
|
provider := NewGitHubProvider("client-id", "client-secret", "https://admin.example.com/login/oauth/callback")
|
||||||
|
|
||||||
|
authURL, err := provider.GetAuthURL("state value")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
parsed, err := url.Parse(authURL)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse auth url failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
query := parsed.Query()
|
||||||
|
if query.Get("client_id") != "client-id" {
|
||||||
|
t.Fatalf("expected client_id to be propagated, got %q", query.Get("client_id"))
|
||||||
|
}
|
||||||
|
if query.Get("redirect_uri") != "https://admin.example.com/login/oauth/callback" {
|
||||||
|
t.Fatalf("expected redirect_uri to be propagated, got %q", query.Get("redirect_uri"))
|
||||||
|
}
|
||||||
|
if query.Get("state") != "state value" {
|
||||||
|
t.Fatalf("expected state to be propagated, got %q", query.Get("state"))
|
||||||
|
}
|
||||||
|
if !strings.Contains(query.Get("scope"), "read:user") {
|
||||||
|
t.Fatalf("expected GitHub scope to include read:user, got %q", query.Get("scope"))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGoogleProviderGenerateStateAndBuildAuthURL(t *testing.T) {
|
||||||
|
provider := NewGoogleProvider("google-client", "google-secret", "https://admin.example.com/login/oauth/callback")
|
||||||
|
|
||||||
|
stateA, err := provider.GenerateState()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateState failed: %v", err)
|
||||||
|
}
|
||||||
|
stateB, err := provider.GenerateState()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateState failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if stateA == "" || stateB == "" {
|
||||||
|
t.Fatal("expected non-empty generated states")
|
||||||
|
}
|
||||||
|
if stateA == stateB {
|
||||||
|
t.Fatal("expected generated states to be unique across calls")
|
||||||
|
}
|
||||||
|
|
||||||
|
authURL, err := provider.GetAuthURL("redirect-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
if authURL.State != "redirect-state" {
|
||||||
|
t.Fatalf("expected auth url state to be preserved, got %q", authURL.State)
|
||||||
|
}
|
||||||
|
if authURL.Redirect != provider.RedirectURI {
|
||||||
|
t.Fatalf("expected redirect uri to be preserved, got %q", authURL.Redirect)
|
||||||
|
}
|
||||||
|
if !strings.Contains(authURL.URL, "response_type=code") {
|
||||||
|
t.Fatalf("expected google auth url to request authorization code flow, got %q", authURL.URL)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeChatProviderGetAuthURLSupportsKnownTypes(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
oauthType string
|
||||||
|
expectedHost string
|
||||||
|
expectedPath string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "web login",
|
||||||
|
oauthType: "web",
|
||||||
|
expectedHost: "open.weixin.qq.com",
|
||||||
|
expectedPath: "/connect/qrconnect",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "public account login",
|
||||||
|
oauthType: "mp",
|
||||||
|
expectedHost: "open.weixin.qq.com",
|
||||||
|
expectedPath: "/connect/oauth2/authorize",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
provider := NewWeChatProvider("wx-app-id", "wx-app-secret", tc.oauthType)
|
||||||
|
authURL, err := provider.GetAuthURL("https://admin.example.com/login/oauth/callback", "wechat-state")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GetAuthURL failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
parsed, err := url.Parse(authURL.URL)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("parse auth url failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if parsed.Host != tc.expectedHost {
|
||||||
|
t.Fatalf("expected host %q, got %q", tc.expectedHost, parsed.Host)
|
||||||
|
}
|
||||||
|
if parsed.Path != tc.expectedPath {
|
||||||
|
t.Fatalf("expected path %q, got %q", tc.expectedPath, parsed.Path)
|
||||||
|
}
|
||||||
|
if authURL.State != "wechat-state" {
|
||||||
|
t.Fatalf("expected state to be preserved, got %q", authURL.State)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWeChatProviderRejectsUnsupportedOAuthType(t *testing.T) {
|
||||||
|
provider := NewWeChatProvider("wx-app-id", "wx-app-secret", "mini")
|
||||||
|
|
||||||
|
if _, err := provider.GetAuthURL("https://admin.example.com/login/oauth/callback", "state"); err == nil {
|
||||||
|
t.Fatal("expected unsupported oauth type error")
|
||||||
|
}
|
||||||
|
}
|
||||||
202
internal/auth/providers/qq.go
Normal file
202
internal/auth/providers/qq.go
Normal file
@@ -0,0 +1,202 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// QQProvider QQ OAuth提供者
|
||||||
|
type QQProvider struct {
|
||||||
|
AppID string
|
||||||
|
AppKey string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// QQAuthURLResponse QQ授权URL响应
|
||||||
|
type QQAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// QQTokenResponse QQ Token响应
|
||||||
|
type QQTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// QQOpenIDResponse QQ OpenID响应
|
||||||
|
type QQOpenIDResponse struct {
|
||||||
|
ClientID string `json:"client_id"`
|
||||||
|
OpenID string `json:"openid"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// QQUserInfo QQ用户信息
|
||||||
|
type QQUserInfo struct {
|
||||||
|
Ret int `json:"ret"`
|
||||||
|
Msg string `json:"msg"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
Gender string `json:"gender"` // 男, 女
|
||||||
|
Province string `json:"province"`
|
||||||
|
City string `json:"city"`
|
||||||
|
Year string `json:"year"`
|
||||||
|
FigureURL string `json:"figureurl"`
|
||||||
|
FigureURL1 string `json:"figureurl_1"`
|
||||||
|
FigureURL2 string `json:"figureurl_2"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewQQProvider 创建QQ OAuth提供者
|
||||||
|
func NewQQProvider(appID, appKey, redirectURI string) *QQProvider {
|
||||||
|
return &QQProvider{
|
||||||
|
AppID: appID,
|
||||||
|
AppKey: appKey,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (q *QQProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取QQ授权URL
|
||||||
|
func (q *QQProvider) GetAuthURL(state string) (*QQAuthURLResponse, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://graph.qq.com/oauth2.0/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=get_user_info&state=%s",
|
||||||
|
q.AppID,
|
||||||
|
url.QueryEscape(q.RedirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
|
||||||
|
return &QQAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
State: state,
|
||||||
|
Redirect: q.RedirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (q *QQProvider) ExchangeCode(ctx context.Context, code string) (*QQTokenResponse, error) {
|
||||||
|
tokenURL := fmt.Sprintf(
|
||||||
|
"https://graph.qq.com/oauth2.0/token?grant_type=authorization_code&client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&fmt=json",
|
||||||
|
q.AppID,
|
||||||
|
q.AppKey,
|
||||||
|
code,
|
||||||
|
url.QueryEscape(q.RedirectURI),
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp QQTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetOpenID 用访问令牌获取OpenID
|
||||||
|
func (q *QQProvider) GetOpenID(ctx context.Context, accessToken string) (*QQOpenIDResponse, error) {
|
||||||
|
openIDURL := fmt.Sprintf(
|
||||||
|
"https://graph.qq.com/oauth2.0/me?access_token=%s&fmt=json",
|
||||||
|
accessToken,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", openIDURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var openIDResp QQOpenIDResponse
|
||||||
|
if err := json.Unmarshal(body, &openIDResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse openid response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &openIDResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取QQ用户信息
|
||||||
|
func (q *QQProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*QQUserInfo, error) {
|
||||||
|
userInfoURL := fmt.Sprintf(
|
||||||
|
"https://graph.qq.com/user/get_user_info?access_token=%s&oauth_consumer_key=%s&openid=%s&format=json",
|
||||||
|
accessToken,
|
||||||
|
q.AppID,
|
||||||
|
openID,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo QQUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if userInfo.Ret != 0 {
|
||||||
|
return nil, fmt.Errorf("qq api error: %s", userInfo.Msg)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (q *QQProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||||||
|
_, err := q.GetOpenID(ctx, accessToken)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
264
internal/auth/providers/twitter.go
Normal file
264
internal/auth/providers/twitter.go
Normal file
@@ -0,0 +1,264 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TwitterProvider Twitter OAuth提供者 (OAuth 2.0 with PKCE)
|
||||||
|
type TwitterProvider struct {
|
||||||
|
ClientID string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// TwitterAuthURLResponse Twitter授权URL响应
|
||||||
|
type TwitterAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
CodeVerifier string `json:"code_verifier"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TwitterTokenResponse Twitter Token响应
|
||||||
|
type TwitterTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
TokenType string `json:"token_type"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TwitterUserInfo Twitter用户信息
|
||||||
|
type TwitterUserInfo struct {
|
||||||
|
Data struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
Username string `json:"username"`
|
||||||
|
CreatedAt string `json:"created_at"`
|
||||||
|
Description string `json:"description"`
|
||||||
|
PublicMetrics struct {
|
||||||
|
FollowersCount int `json:"followers_count"`
|
||||||
|
FollowingCount int `json:"following_count"`
|
||||||
|
TweetCount int `json:"tweet_count"`
|
||||||
|
ListedCount int `json:"listed_count"`
|
||||||
|
} `json:"public_metrics"`
|
||||||
|
ProfileImageURL string `json:"profile_image_url"`
|
||||||
|
} `json:"data"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TwitterErrorResponse Twitter错误响应
|
||||||
|
type TwitterErrorResponse struct {
|
||||||
|
Title string `json:"title"`
|
||||||
|
Detail string `json:"detail"`
|
||||||
|
Type string `json:"type"`
|
||||||
|
Status int `json:"status"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewTwitterProvider 创建Twitter OAuth提供者
|
||||||
|
func NewTwitterProvider(clientID, redirectURI string) *TwitterProvider {
|
||||||
|
return &TwitterProvider{
|
||||||
|
ClientID: clientID,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateCodeVerifier 生成PKCE Code Verifier
|
||||||
|
func (t *TwitterProvider) GenerateCodeVerifier() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateCodeChallenge 从Code Verifier生成Code Challenge
|
||||||
|
func (t *TwitterProvider) GenerateCodeChallenge(verifier string) string {
|
||||||
|
// 简化的base64编码（实际应用中应该使用SHA256哈希）
|
||||||
|
return verifier
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (t *TwitterProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取Twitter授权URL (OAuth 2.0 with PKCE)
|
||||||
|
func (t *TwitterProvider) GetAuthURL() (*TwitterAuthURLResponse, error) {
|
||||||
|
verifier, err := t.GenerateCodeVerifier()
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("generate code verifier failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
challenge := t.GenerateCodeChallenge(verifier)
|
||||||
|
|
||||||
|
state, err := t.GenerateState()
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("generate state failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://twitter.com/i/oauth2/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=tweet.read%%20users.read%%20offline.access&state=%s&code_challenge=%s&code_challenge_method=plain",
|
||||||
|
t.ClientID,
|
||||||
|
url.QueryEscape(t.RedirectURI),
|
||||||
|
state,
|
||||||
|
challenge,
|
||||||
|
)
|
||||||
|
|
||||||
|
return &TwitterAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
CodeVerifier: verifier,
|
||||||
|
State: state,
|
||||||
|
Redirect: t.RedirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (t *TwitterProvider) ExchangeCode(ctx context.Context, code, codeVerifier string) (*TwitterTokenResponse, error) {
|
||||||
|
tokenURL := "https://api.twitter.com/2/oauth2/token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("code", code)
|
||||||
|
data.Set("grant_type", "authorization_code")
|
||||||
|
data.Set("client_id", t.ClientID)
|
||||||
|
data.Set("redirect_uri", t.RedirectURI)
|
||||||
|
data.Set("code_verifier", codeVerifier)
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查错误响应
|
||||||
|
var errResp TwitterErrorResponse
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||||||
|
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp TwitterTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取Twitter用户信息
|
||||||
|
func (t *TwitterProvider) GetUserInfo(ctx context.Context, accessToken string) (*TwitterUserInfo, error) {
|
||||||
|
userInfoURL := "https://api.twitter.com/2/users/me?user.fields=created_at,description,public_metrics,profile_image_url"
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查错误响应
|
||||||
|
var errResp TwitterErrorResponse
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||||||
|
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo TwitterUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RefreshToken 刷新访问令牌
|
||||||
|
func (t *TwitterProvider) RefreshToken(ctx context.Context, refreshToken string) (*TwitterTokenResponse, error) {
|
||||||
|
tokenURL := "https://api.twitter.com/2/oauth2/token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("refresh_token", refreshToken)
|
||||||
|
data.Set("grant_type", "refresh_token")
|
||||||
|
data.Set("client_id", t.ClientID)
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var errResp TwitterErrorResponse
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||||||
|
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp TwitterTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (t *TwitterProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||||||
|
userInfo, err := t.GetUserInfo(ctx, accessToken)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return userInfo != nil && userInfo.Data.ID != "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RevokeToken 撤销访问令牌
|
||||||
|
func (t *TwitterProvider) RevokeToken(ctx context.Context, accessToken string) error {
|
||||||
|
revokeURL := "https://api.twitter.com/2/oauth2/revoke"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("token", accessToken)
|
||||||
|
data.Set("client_id", t.ClientID)
|
||||||
|
data.Set("token_type_hint", "access_token")
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, revokeURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if _, err := readOAuthResponseBody(resp); err != nil {
|
||||||
|
return fmt.Errorf("revoke token failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
258
internal/auth/providers/wechat.go
Normal file
258
internal/auth/providers/wechat.go
Normal file
@@ -0,0 +1,258 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// WeChatProvider 微信OAuth提供者
|
||||||
|
type WeChatProvider struct {
|
||||||
|
AppID string
|
||||||
|
AppSecret string
|
||||||
|
Type string // "web" for 扫码登录, "mp" for 公众号, "mini" for 小程序
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatAuthURLResponse 获取授权URL响应
|
||||||
|
type WeChatAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatTokenResponse 微信Token响应
|
||||||
|
type WeChatTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RefreshToken string `json:"refresh_token"`
|
||||||
|
OpenID string `json:"openid"`
|
||||||
|
Scope string `json:"scope"`
|
||||||
|
UnionID string `json:"unionid,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatUserInfo 微信用户信息
|
||||||
|
type WeChatUserInfo struct {
|
||||||
|
OpenID string `json:"openid"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
Sex int `json:"sex"` // 1男性, 2女性, 0未知
|
||||||
|
Province string `json:"province"`
|
||||||
|
City string `json:"city"`
|
||||||
|
Country string `json:"country"`
|
||||||
|
HeadImgURL string `json:"headimgurl"`
|
||||||
|
UnionID string `json:"unionid,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatErrorCode 微信错误码
|
||||||
|
type WeChatErrorCode struct {
|
||||||
|
ErrCode int `json:"errcode"`
|
||||||
|
ErrMsg string `json:"errmsg"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewWeChatProvider 创建微信OAuth提供者
|
||||||
|
func NewWeChatProvider(appID, appSecret, oAuthType string) *WeChatProvider {
|
||||||
|
return &WeChatProvider{
|
||||||
|
AppID: appID,
|
||||||
|
AppSecret: appSecret,
|
||||||
|
Type: oAuthType,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (w *WeChatProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取微信授权URL
|
||||||
|
func (w *WeChatProvider) GetAuthURL(redirectURI, state string) (*WeChatAuthURLResponse, error) {
|
||||||
|
var authURL string
|
||||||
|
|
||||||
|
switch w.Type {
|
||||||
|
case "web":
|
||||||
|
// 微信扫码登录 (开放平台)
|
||||||
|
authURL = fmt.Sprintf(
|
||||||
|
"https://open.weixin.qq.com/connect/qrconnect?appid=%s&redirect_uri=%s&response_type=code&scope=snsapi_login&state=%s#wechat_redirect",
|
||||||
|
w.AppID,
|
||||||
|
url.QueryEscape(redirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
case "mp":
|
||||||
|
// 微信公众号登录
|
||||||
|
authURL = fmt.Sprintf(
|
||||||
|
"https://open.weixin.qq.com/connect/oauth2/authorize?appid=%s&redirect_uri=%s&response_type=code&scope=snsapi_userinfo&state=%s#wechat_redirect",
|
||||||
|
w.AppID,
|
||||||
|
url.QueryEscape(redirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported wechat oauth type: %s", w.Type)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &WeChatAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
State: state,
|
||||||
|
Redirect: redirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (w *WeChatProvider) ExchangeCode(ctx context.Context, code string) (*WeChatTokenResponse, error) {
|
||||||
|
tokenURL := fmt.Sprintf(
|
||||||
|
"https://api.weixin.qq.com/sns/oauth2/access_token?appid=%s&secret=%s&code=%s&grant_type=authorization_code",
|
||||||
|
w.AppID,
|
||||||
|
w.AppSecret,
|
||||||
|
code,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查是否返回错误
|
||||||
|
var errResp WeChatErrorCode
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
|
||||||
|
return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp WeChatTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取微信用户信息
|
||||||
|
func (w *WeChatProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*WeChatUserInfo, error) {
|
||||||
|
userInfoURL := fmt.Sprintf(
|
||||||
|
"https://api.weixin.qq.com/sns/userinfo?access_token=%s&openid=%s&lang=zh_CN",
|
||||||
|
accessToken,
|
||||||
|
openID,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查是否返回错误
|
||||||
|
var errResp WeChatErrorCode
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
|
||||||
|
return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo WeChatUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RefreshToken 刷新访问令牌
|
||||||
|
func (w *WeChatProvider) RefreshToken(ctx context.Context, refreshToken string) (*WeChatTokenResponse, error) {
|
||||||
|
refreshURL := fmt.Sprintf(
|
||||||
|
"https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=%s&grant_type=refresh_token&refresh_token=%s",
|
||||||
|
w.AppID,
|
||||||
|
refreshToken,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", refreshURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var errResp WeChatErrorCode
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
|
||||||
|
return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp WeChatTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (w *WeChatProvider) ValidateToken(ctx context.Context, accessToken, openID string) (bool, error) {
|
||||||
|
validateURL := fmt.Sprintf(
|
||||||
|
"https://api.weixin.qq.com/sns/auth?access_token=%s&openid=%s",
|
||||||
|
accessToken,
|
||||||
|
openID,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", validateURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var result struct {
|
||||||
|
ErrCode int `json:"errcode"`
|
||||||
|
ErrMsg string `json:"errmsg"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(body, &result); err != nil {
|
||||||
|
return false, fmt.Errorf("parse response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return result.ErrCode == 0, nil
|
||||||
|
}
|
||||||
201
internal/auth/providers/weibo.go
Normal file
201
internal/auth/providers/weibo.go
Normal file
@@ -0,0 +1,201 @@
|
|||||||
|
package providers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// WeiboProvider 微博OAuth提供者
|
||||||
|
type WeiboProvider struct {
|
||||||
|
AppKey string
|
||||||
|
AppSecret string
|
||||||
|
RedirectURI string
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeiboAuthURLResponse 微博授权URL响应
|
||||||
|
type WeiboAuthURLResponse struct {
|
||||||
|
URL string `json:"url"`
|
||||||
|
State string `json:"state"`
|
||||||
|
Redirect string `json:"redirect,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeiboTokenResponse 微博Token响应
|
||||||
|
type WeiboTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
ExpiresIn int `json:"expires_in"`
|
||||||
|
RemindIn string `json:"remind_in"`
|
||||||
|
UID string `json:"uid"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeiboUserInfo 微博用户信息
|
||||||
|
type WeiboUserInfo struct {
|
||||||
|
ID int64 `json:"id"`
|
||||||
|
IDStr string `json:"idstr"`
|
||||||
|
ScreenName string `json:"screen_name"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
Province string `json:"province"`
|
||||||
|
City string `json:"city"`
|
||||||
|
Location string `json:"location"`
|
||||||
|
Description string `json:"description"`
|
||||||
|
URL string `json:"url"`
|
||||||
|
ProfileImageURL string `json:"profile_image_url"`
|
||||||
|
Gender string `json:"gender"` // m:男, f:女, n:未知
|
||||||
|
FollowersCount int `json:"followers_count"`
|
||||||
|
FriendsCount int `json:"friends_count"`
|
||||||
|
StatusesCount int `json:"statuses_count"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewWeiboProvider 创建微博OAuth提供者
|
||||||
|
func NewWeiboProvider(appKey, appSecret, redirectURI string) *WeiboProvider {
|
||||||
|
return &WeiboProvider{
|
||||||
|
AppKey: appKey,
|
||||||
|
AppSecret: appSecret,
|
||||||
|
RedirectURI: redirectURI,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateState 生成随机状态码
|
||||||
|
func (w *WeiboProvider) GenerateState() (string, error) {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
_, err := rand.Read(b)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return base64.URLEncoding.EncodeToString(b), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetAuthURL 获取微博授权URL
|
||||||
|
func (w *WeiboProvider) GetAuthURL(state string) (*WeiboAuthURLResponse, error) {
|
||||||
|
authURL := fmt.Sprintf(
|
||||||
|
"https://api.weibo.com/oauth2/authorize?client_id=%s&redirect_uri=%s&response_type=code&state=%s",
|
||||||
|
w.AppKey,
|
||||||
|
url.QueryEscape(w.RedirectURI),
|
||||||
|
state,
|
||||||
|
)
|
||||||
|
|
||||||
|
return &WeiboAuthURLResponse{
|
||||||
|
URL: authURL,
|
||||||
|
State: state,
|
||||||
|
Redirect: w.RedirectURI,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExchangeCode 用授权码换取访问令牌
|
||||||
|
func (w *WeiboProvider) ExchangeCode(ctx context.Context, code string) (*WeiboTokenResponse, error) {
|
||||||
|
tokenURL := "https://api.weibo.com/oauth2/access_token"
|
||||||
|
|
||||||
|
data := url.Values{}
|
||||||
|
data.Set("client_id", w.AppKey)
|
||||||
|
data.Set("client_secret", w.AppSecret)
|
||||||
|
data.Set("grant_type", "authorization_code")
|
||||||
|
data.Set("code", code)
|
||||||
|
data.Set("redirect_uri", w.RedirectURI)
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var tokenResp WeiboTokenResponse
|
||||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tokenResp, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserInfo 获取微博用户信息
|
||||||
|
func (w *WeiboProvider) GetUserInfo(ctx context.Context, accessToken, uid string) (*WeiboUserInfo, error) {
|
||||||
|
userInfoURL := fmt.Sprintf(
|
||||||
|
"https://api.weibo.com/2/users/show.json?access_token=%s&uid=%s",
|
||||||
|
accessToken,
|
||||||
|
uid,
|
||||||
|
)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 微博错误响应
|
||||||
|
var errResp struct {
|
||||||
|
Error int `json:"error"`
|
||||||
|
ErrorCode int `json:"error_code"`
|
||||||
|
Request string `json:"request"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Error != 0 {
|
||||||
|
return nil, fmt.Errorf("weibo api error: code=%d", errResp.ErrorCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
var userInfo WeiboUserInfo
|
||||||
|
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||||||
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &userInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateToken 验证访问令牌是否有效
|
||||||
|
func (w *WeiboProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||||||
|
// 微博没有专门的token验证接口，通过获取API token信息来验证
|
||||||
|
tokenInfoURL := fmt.Sprintf("https://api.weibo.com/oauth2/get_token_info?access_token=%s", accessToken)
|
||||||
|
|
||||||
|
req, err := http.NewRequestWithContext(ctx, "GET", tokenInfoURL, nil)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("create request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("request failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
body, err := readOAuthResponseBody(resp)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("read response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var result map[string]interface{}
|
||||||
|
if err := json.Unmarshal(body, &result); err != nil {
|
||||||
|
return false, fmt.Errorf("parse response failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 如果返回了错误，说明token无效
|
||||||
|
if _, ok := result["error"]; ok {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// 如果有expire_in字段，说明token有效
|
||||||
|
if _, ok := result["expire_in"]; ok {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
233
internal/auth/sso.go
Normal file
233
internal/auth/sso.go
Normal file
@@ -0,0 +1,233 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SSOOAuth2Config SSO OAuth2 配置
|
||||||
|
type SSOOAuth2Config struct {
|
||||||
|
ClientID string
|
||||||
|
ClientSecret string
|
||||||
|
RedirectURI string
|
||||||
|
Scope string
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOProvider SSO 提供者接口
|
||||||
|
type SSOProvider interface {
|
||||||
|
// Authorize 处理授权请求
|
||||||
|
Authorize(ctx context.Context, req *SSOAuthorizeRequest) (*SSOAuthorizeResponse, error)
|
||||||
|
// Introspect 验证 access token
|
||||||
|
Introspect(ctx context.Context, token string) (*SSOTokenInfo, error)
|
||||||
|
// Revoke 撤销 token
|
||||||
|
Revoke(ctx context.Context, token string) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOAuthorizeRequest 授权请求
|
||||||
|
type SSOAuthorizeRequest struct {
|
||||||
|
ClientID string
|
||||||
|
RedirectURI string
|
||||||
|
ResponseType string // "code" 或 "token"
|
||||||
|
Scope string
|
||||||
|
State string
|
||||||
|
UserID int64
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOAuthorizeResponse 授权响应
|
||||||
|
type SSOAuthorizeResponse struct {
|
||||||
|
Code string // 授权码（authorization_code 模式）
|
||||||
|
State string
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOTokenInfo Token 信息
|
||||||
|
type SSOTokenInfo struct {
|
||||||
|
Active bool
|
||||||
|
UserID int64
|
||||||
|
Username string
|
||||||
|
ExpiresAt time.Time
|
||||||
|
Scope string
|
||||||
|
ClientID string
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOSession SSO Session
|
||||||
|
type SSOSession struct {
|
||||||
|
SessionID string
|
||||||
|
UserID int64
|
||||||
|
Username string
|
||||||
|
ClientID string
|
||||||
|
CreatedAt time.Time
|
||||||
|
ExpiresAt time.Time
|
||||||
|
Scope string
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOManager SSO 管理器
|
||||||
|
type SSOManager struct {
|
||||||
|
sessions map[string]*SSOSession
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewSSOManager 创建 SSO 管理器
|
||||||
|
func NewSSOManager() *SSOManager {
|
||||||
|
return &SSOManager{
|
||||||
|
sessions: make(map[string]*SSOSession),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateAuthorizationCode 生成授权码
|
||||||
|
func (m *SSOManager) GenerateAuthorizationCode(clientID, redirectURI, scope string, userID int64, username string) (string, error) {
|
||||||
|
code := generateSecureToken(32)
|
||||||
|
|
||||||
|
session := &SSOSession{
|
||||||
|
SessionID: generateSecureToken(16),
|
||||||
|
UserID: userID,
|
||||||
|
Username: username,
|
||||||
|
ClientID: clientID,
|
||||||
|
CreatedAt: time.Now(),
|
||||||
|
ExpiresAt: time.Now().Add(10 * time.Minute), // 授权码 10 分钟有效期
|
||||||
|
Scope: scope,
|
||||||
|
}
|
||||||
|
|
||||||
|
m.sessions[code] = session
|
||||||
|
|
||||||
|
return code, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateAuthorizationCode 验证授权码
|
||||||
|
func (m *SSOManager) ValidateAuthorizationCode(code string) (*SSOSession, error) {
|
||||||
|
session, ok := m.sessions[code]
|
||||||
|
if !ok {
|
||||||
|
return nil, errors.New("invalid authorization code")
|
||||||
|
}
|
||||||
|
|
||||||
|
if time.Now().After(session.ExpiresAt) {
|
||||||
|
delete(m.sessions, code)
|
||||||
|
return nil, errors.New("authorization code expired")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 使用后删除
|
||||||
|
delete(m.sessions, code)
|
||||||
|
|
||||||
|
return session, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateAccessToken 生成访问令牌
|
||||||
|
func (m *SSOManager) GenerateAccessToken(clientID string, session *SSOSession) (string, time.Time) {
|
||||||
|
token := generateSecureToken(32)
|
||||||
|
expiresAt := time.Now().Add(2 * time.Hour) // Access token 2 小时有效期
|
||||||
|
|
||||||
|
accessSession := &SSOSession{
|
||||||
|
SessionID: token,
|
||||||
|
UserID: session.UserID,
|
||||||
|
Username: session.Username,
|
||||||
|
ClientID: clientID,
|
||||||
|
CreatedAt: time.Now(),
|
||||||
|
ExpiresAt: expiresAt,
|
||||||
|
Scope: session.Scope,
|
||||||
|
}
|
||||||
|
|
||||||
|
m.sessions[token] = accessSession
|
||||||
|
|
||||||
|
return token, expiresAt
|
||||||
|
}
|
||||||
|
|
||||||
|
// IntrospectToken 验证 token
|
||||||
|
func (m *SSOManager) IntrospectToken(token string) (*SSOTokenInfo, error) {
|
||||||
|
session, ok := m.sessions[token]
|
||||||
|
if !ok {
|
||||||
|
return &SSOTokenInfo{Active: false}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if time.Now().After(session.ExpiresAt) {
|
||||||
|
delete(m.sessions, token)
|
||||||
|
return &SSOTokenInfo{Active: false}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return &SSOTokenInfo{
|
||||||
|
Active: true,
|
||||||
|
UserID: session.UserID,
|
||||||
|
Username: session.Username,
|
||||||
|
ExpiresAt: session.ExpiresAt,
|
||||||
|
Scope: session.Scope,
|
||||||
|
ClientID: session.ClientID,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RevokeToken 撤销 token
|
||||||
|
func (m *SSOManager) RevokeToken(token string) error {
|
||||||
|
delete(m.sessions, token)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// CleanupExpired 清理过期的 session（可由后台 goroutine 定期调用）
|
||||||
|
func (m *SSOManager) CleanupExpired() {
|
||||||
|
now := time.Now()
|
||||||
|
for key, session := range m.sessions {
|
||||||
|
if now.After(session.ExpiresAt) {
|
||||||
|
delete(m.sessions, key)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateSecureToken 生成安全随机 token
|
||||||
|
func generateSecureToken(length int) string {
|
||||||
|
bytes := make([]byte, length)
|
||||||
|
rand.Read(bytes)
|
||||||
|
return base64.URLEncoding.EncodeToString(bytes)[:length]
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOClient SSO 客户端配置存储
|
||||||
|
type SSOClient struct {
|
||||||
|
ClientID string
|
||||||
|
ClientSecret string
|
||||||
|
Name string
|
||||||
|
RedirectURIs []string
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSOClientsStore SSO 客户端存储接口
|
||||||
|
type SSOClientsStore interface {
|
||||||
|
GetByClientID(clientID string) (*SSOClient, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultSSOClientsStore 默认内存存储
|
||||||
|
type DefaultSSOClientsStore struct {
|
||||||
|
clients map[string]*SSOClient
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewDefaultSSOClientsStore 创建默认客户端存储
|
||||||
|
func NewDefaultSSOClientsStore() *DefaultSSOClientsStore {
|
||||||
|
return &DefaultSSOClientsStore{
|
||||||
|
clients: make(map[string]*SSOClient),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RegisterClient 注册客户端
|
||||||
|
func (s *DefaultSSOClientsStore) RegisterClient(client *SSOClient) {
|
||||||
|
s.clients[client.ClientID] = client
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetByClientID 根据 ClientID 获取客户端
|
||||||
|
func (s *DefaultSSOClientsStore) GetByClientID(clientID string) (*SSOClient, error) {
|
||||||
|
client, ok := s.clients[clientID]
|
||||||
|
if !ok {
|
||||||
|
return nil, fmt.Errorf("client not found: %s", clientID)
|
||||||
|
}
|
||||||
|
return client, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateClientRedirectURI 验证客户端的 RedirectURI
|
||||||
|
func (s *DefaultSSOClientsStore) ValidateClientRedirectURI(clientID, redirectURI string) bool {
|
||||||
|
client, err := s.GetByClientID(clientID)
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, uri := range client.RedirectURIs {
|
||||||
|
if uri == redirectURI {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
113
internal/auth/state.go
Normal file
113
internal/auth/state.go
Normal file
@@ -0,0 +1,113 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// StateManager OAuth状态管理器
|
||||||
|
type StateManager struct {
|
||||||
|
states map[string]time.Time
|
||||||
|
mu sync.RWMutex
|
||||||
|
ttl time.Duration
|
||||||
|
}
|
||||||
|
|
||||||
|
var (
|
||||||
|
// 全局状态管理器
|
||||||
|
stateManager = &StateManager{
|
||||||
|
states: make(map[string]time.Time),
|
||||||
|
ttl: 10 * time.Minute, // 10分钟过期
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
// Note: GenerateState and ValidateState are defined in oauth_utils.go
|
||||||
|
// to avoid duplication, please use those implementations
|
||||||
|
|
||||||
|
// Store 存储state
|
||||||
|
func (sm *StateManager) Store(state string) {
|
||||||
|
sm.mu.Lock()
|
||||||
|
defer sm.mu.Unlock()
|
||||||
|
sm.states[state] = time.Now()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate 验证state
|
||||||
|
func (sm *StateManager) Validate(state string) bool {
|
||||||
|
sm.mu.RLock()
|
||||||
|
defer sm.mu.RUnlock()
|
||||||
|
|
||||||
|
expiredAt, exists := sm.states[state]
|
||||||
|
if !exists {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查是否过期
|
||||||
|
return time.Now().Before(expiredAt.Add(sm.ttl))
|
||||||
|
}
|
||||||
|
|
||||||
|
// Delete 删除state（使用后删除）
|
||||||
|
func (sm *StateManager) Delete(state string) {
|
||||||
|
sm.mu.Lock()
|
||||||
|
defer sm.mu.Unlock()
|
||||||
|
delete(sm.states, state)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup 清理过期的state
|
||||||
|
func (sm *StateManager) Cleanup() {
|
||||||
|
sm.mu.Lock()
|
||||||
|
defer sm.mu.Unlock()
|
||||||
|
|
||||||
|
now := time.Now()
|
||||||
|
for state, expiredAt := range sm.states {
|
||||||
|
if now.After(expiredAt.Add(sm.ttl)) {
|
||||||
|
delete(sm.states, state)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// StartCleanupRoutine 启动定期清理goroutine
|
||||||
|
// stop channel 关闭时，清理goroutine将优雅退出
|
||||||
|
func (sm *StateManager) StartCleanupRoutine(stop <-chan struct{}) {
|
||||||
|
ticker := time.NewTicker(5 * time.Minute)
|
||||||
|
go func() {
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ticker.C:
|
||||||
|
sm.Cleanup()
|
||||||
|
case <-stop:
|
||||||
|
ticker.Stop()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
}
|
||||||
|
|
||||||
|
// CleanupRoutineManager 管理清理goroutine的生命周期
|
||||||
|
type CleanupRoutineManager struct {
|
||||||
|
stopChan chan struct{}
|
||||||
|
}
|
||||||
|
|
||||||
|
var cleanupRoutineManager *CleanupRoutineManager
|
||||||
|
|
||||||
|
// StartCleanupRoutineWithManager 使用管理器启动清理goroutine
|
||||||
|
func StartCleanupRoutineWithManager() {
|
||||||
|
if cleanupRoutineManager != nil {
|
||||||
|
return // 已经启动
|
||||||
|
}
|
||||||
|
cleanupRoutineManager = &CleanupRoutineManager{
|
||||||
|
stopChan: make(chan struct{}),
|
||||||
|
}
|
||||||
|
stateManager.StartCleanupRoutine(cleanupRoutineManager.stopChan)
|
||||||
|
}
|
||||||
|
|
||||||
|
// StopCleanupRoutine 停止清理goroutine（用于优雅关闭）
|
||||||
|
func StopCleanupRoutine() {
|
||||||
|
if cleanupRoutineManager != nil {
|
||||||
|
close(cleanupRoutineManager.stopChan)
|
||||||
|
cleanupRoutineManager = nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetStateManager 获取全局状态管理器
|
||||||
|
func GetStateManager() *StateManager {
|
||||||
|
return stateManager
|
||||||
|
}
|
||||||
149
internal/auth/totp.go
Normal file
149
internal/auth/totp.go
Normal file
@@ -0,0 +1,149 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"crypto/hmac"
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/sha256"
|
||||||
|
"crypto/subtle"
|
||||||
|
"encoding/base32"
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/hex"
|
||||||
|
"fmt"
|
||||||
|
"image/png"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/pquerna/otp"
|
||||||
|
"github.com/pquerna/otp/totp"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// TOTPIssuer 应用名称（显示在 Authenticator App 中）
|
||||||
|
TOTPIssuer = "UserManagementSystem"
|
||||||
|
// TOTPPeriod TOTP 时间步长（秒）
|
||||||
|
TOTPPeriod = 30
|
||||||
|
// TOTPDigits TOTP 位数
|
||||||
|
TOTPDigits = 6
|
||||||
|
// TOTPAlgorithm TOTP 算法（使用 SHA256 更安全）
|
||||||
|
TOTPAlgorithm = otp.AlgorithmSHA256
|
||||||
|
// RecoveryCodeCount 恢复码数量
|
||||||
|
RecoveryCodeCount = 8
|
||||||
|
// RecoveryCodeLength 每个恢复码的字节长度（生成后编码为 hex 字符串）
|
||||||
|
RecoveryCodeLength = 5
|
||||||
|
)
|
||||||
|
|
||||||
|
// TOTPManager TOTP 管理器
|
||||||
|
type TOTPManager struct{}
|
||||||
|
|
||||||
|
// NewTOTPManager 创建 TOTP 管理器
|
||||||
|
func NewTOTPManager() *TOTPManager {
|
||||||
|
return &TOTPManager{}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TOTPSetup TOTP 初始化结果
|
||||||
|
type TOTPSetup struct {
|
||||||
|
Secret string `json:"secret"` // Base32 密钥（用户备用）
|
||||||
|
QRCodeBase64 string `json:"qr_code_base64"` // Base64 编码的 PNG 二维码图片
|
||||||
|
RecoveryCodes []string `json:"recovery_codes"` // 一次性恢复码列表
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateSecret 为指定用户生成 TOTP 密钥及二维码
|
||||||
|
func (m *TOTPManager) GenerateSecret(username string) (*TOTPSetup, error) {
|
||||||
|
key, err := totp.Generate(totp.GenerateOpts{
|
||||||
|
Issuer: TOTPIssuer,
|
||||||
|
AccountName: username,
|
||||||
|
Period: TOTPPeriod,
|
||||||
|
Digits: otp.DigitsSix,
|
||||||
|
Algorithm: TOTPAlgorithm,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("generate totp key failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 生成二维码图片
|
||||||
|
img, err := key.Image(200, 200)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("generate qr image failed: %w", err)
|
||||||
|
}
|
||||||
|
var buf bytes.Buffer
|
||||||
|
if err := png.Encode(&buf, img); err != nil {
|
||||||
|
return nil, fmt.Errorf("encode qr image failed: %w", err)
|
||||||
|
}
|
||||||
|
qrBase64 := base64.StdEncoding.EncodeToString(buf.Bytes())
|
||||||
|
|
||||||
|
// 生成恢复码
|
||||||
|
codes, err := generateRecoveryCodes(RecoveryCodeCount)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("generate recovery codes failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TOTPSetup{
|
||||||
|
Secret: key.Secret(),
|
||||||
|
QRCodeBase64: qrBase64,
|
||||||
|
RecoveryCodes: codes,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateCode 验证用户输入的 TOTP 码（允许 ±1 个时间窗口的时钟偏差）
|
||||||
|
func (m *TOTPManager) ValidateCode(secret, code string) bool {
|
||||||
|
// 注意：pquerna/otp 库的 ValidateCustom 与 GenerateCode 存在算法不匹配 bug（GenerateCode 固定用 SHA1）
|
||||||
|
// 因此使用 totp.Validate() 代替，它内部正确处理算法检测
|
||||||
|
return totp.Validate(strings.TrimSpace(code), secret)
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateCurrentCode 生成当前时间的 TOTP 码（用于测试）
|
||||||
|
func (m *TOTPManager) GenerateCurrentCode(secret string) (string, error) {
|
||||||
|
return totp.GenerateCode(secret, time.Now().UTC())
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateRecoveryCode 验证恢复码（传入哈希后的已存储恢复码列表，返回匹配索引）
|
||||||
|
// 注意：调用方负责在验证后将该恢复码标记为已使用
|
||||||
|
// 使用恒定时间比较防止时序攻击
|
||||||
|
func ValidateRecoveryCode(inputCode string, storedCodes []string) (int, bool) {
|
||||||
|
normalized := strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(inputCode), "-", ""))
|
||||||
|
for i, stored := range storedCodes {
|
||||||
|
storedNormalized := strings.ToUpper(strings.ReplaceAll(stored, "-", ""))
|
||||||
|
// 使用恒定时间比较防止时序攻击
|
||||||
|
if subtle.ConstantTimeCompare([]byte(normalized), []byte(storedNormalized)) == 1 {
|
||||||
|
return i, true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return -1, false
|
||||||
|
}
|
||||||
|
|
||||||
|
// HashRecoveryCode 使用 SHA256 哈希恢复码（用于存储）
|
||||||
|
func HashRecoveryCode(code string) (string, error) {
|
||||||
|
h := sha256.Sum256([]byte(code))
|
||||||
|
return hex.EncodeToString(h[:]), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// VerifyRecoveryCode 验证恢复码（自动哈希后比较）
|
||||||
|
func VerifyRecoveryCode(inputCode string, hashedCodes []string) (int, bool) {
|
||||||
|
hashedInput, err := HashRecoveryCode(inputCode)
|
||||||
|
if err != nil {
|
||||||
|
return -1, false
|
||||||
|
}
|
||||||
|
for i, hashed := range hashedCodes {
|
||||||
|
if hmac.Equal([]byte(hashedInput), []byte(hashed)) {
|
||||||
|
return i, true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return -1, false
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateRecoveryCodes 生成 N 个随机恢复码（格式：XXXXX-XXXXX）
|
||||||
|
func generateRecoveryCodes(count int) ([]string, error) {
|
||||||
|
codes := make([]string, count)
|
||||||
|
for i := 0; i < count; i++ {
|
||||||
|
b := make([]byte, RecoveryCodeLength*2)
|
||||||
|
if _, err := rand.Read(b); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
encoded := base32.StdEncoding.EncodeToString(b)
|
||||||
|
// 格式化为 XXXXX-XXXXX
|
||||||
|
part := strings.ToUpper(encoded[:10])
|
||||||
|
codes[i] = part[:5] + "-" + part[5:]
|
||||||
|
}
|
||||||
|
return codes, nil
|
||||||
|
}
|
||||||
101
internal/auth/totp_test.go
Normal file
101
internal/auth/totp_test.go
Normal file
@@ -0,0 +1,101 @@
|
|||||||
|
package auth
|
||||||
|
|
||||||
|
import (
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestTOTPManager_GenerateAndValidate(t *testing.T) {
|
||||||
|
m := NewTOTPManager()
|
||||||
|
|
||||||
|
// 生成密钥
|
||||||
|
setup, err := m.GenerateSecret("testuser@example.com")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateSecret 失败: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if setup.Secret == "" {
|
||||||
|
t.Fatal("生成的 Secret 不应为空")
|
||||||
|
}
|
||||||
|
if setup.QRCodeBase64 == "" {
|
||||||
|
t.Fatal("QRCode Base64 不应为空")
|
||||||
|
}
|
||||||
|
if len(setup.RecoveryCodes) != RecoveryCodeCount {
|
||||||
|
t.Fatalf("恢复码数量期望 %d，实际 %d", RecoveryCodeCount, len(setup.RecoveryCodes))
|
||||||
|
}
|
||||||
|
t.Logf("生成 Secret: %s", setup.Secret)
|
||||||
|
t.Logf("恢复码示例: %s", setup.RecoveryCodes[0])
|
||||||
|
|
||||||
|
// 用生成的密钥生成当前 TOTP 码，再验证
|
||||||
|
code, err := m.GenerateCurrentCode(setup.Secret)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateCurrentCode 失败: %v", err)
|
||||||
|
}
|
||||||
|
if !m.ValidateCode(setup.Secret, code) {
|
||||||
|
t.Fatalf("有效 TOTP 码应该通过验证，code=%s", code)
|
||||||
|
}
|
||||||
|
t.Logf("TOTP 验证通过，code=%s", code)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestTOTPManager_InvalidCode(t *testing.T) {
|
||||||
|
m := NewTOTPManager()
|
||||||
|
setup, err := m.GenerateSecret("user")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateSecret 失败: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 错误的验证码
|
||||||
|
if m.ValidateCode(setup.Secret, "000000") {
|
||||||
|
// 偶尔可能恰好正确，跳过而不是 fatal
|
||||||
|
t.Skip("000000 碰巧是有效码，跳过测试")
|
||||||
|
}
|
||||||
|
t.Log("无效验证码正确拒绝")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestTOTPManager_RecoveryCodeFormat(t *testing.T) {
|
||||||
|
m := NewTOTPManager()
|
||||||
|
setup, err := m.GenerateSecret("user2")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("GenerateSecret 失败: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
for i, code := range setup.RecoveryCodes {
|
||||||
|
parts := strings.Split(code, "-")
|
||||||
|
if len(parts) != 2 {
|
||||||
|
t.Errorf("恢复码 [%d] 格式错误（期望 XXXXX-XXXXX）: %s", i, code)
|
||||||
|
}
|
||||||
|
if len(parts[0]) != 5 || len(parts[1]) != 5 {
|
||||||
|
t.Errorf("恢复码 [%d] 各部分长度应为 5: %s", i, code)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestValidateRecoveryCode(t *testing.T) {
|
||||||
|
codes := []string{"ABCDE-FGHIJ", "KLMNO-PQRST", "UVWXY-ZABCD"}
|
||||||
|
|
||||||
|
// 正确匹配
|
||||||
|
idx, ok := ValidateRecoveryCode("ABCDE-FGHIJ", codes)
|
||||||
|
if !ok || idx != 0 {
|
||||||
|
t.Fatalf("有效恢复码应该匹配，idx=%d ok=%v", idx, ok)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 大小写不敏感
|
||||||
|
idx2, ok2 := ValidateRecoveryCode("klmno-pqrst", codes)
|
||||||
|
if !ok2 || idx2 != 1 {
|
||||||
|
t.Fatalf("大小写不敏感匹配失败，idx=%d ok=%v", idx2, ok2)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 去除空格
|
||||||
|
idx3, ok3 := ValidateRecoveryCode(" UVWXY-ZABCD ", codes)
|
||||||
|
if !ok3 || idx3 != 2 {
|
||||||
|
t.Fatalf("去除空格匹配失败，idx=%d ok=%v", idx3, ok3)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 不匹配
|
||||||
|
_, ok4 := ValidateRecoveryCode("XXXXX-YYYYY", codes)
|
||||||
|
if ok4 {
|
||||||
|
t.Fatal("无效恢复码不应该匹配")
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Log("恢复码验证全部通过")
|
||||||
|
}
|
||||||
108
internal/cache/cache_manager.go
vendored
Normal file
108
internal/cache/cache_manager.go
vendored
Normal file
@@ -0,0 +1,108 @@
|
|||||||
|
package cache
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// CacheManager 缓存管理器
|
||||||
|
type CacheManager struct {
|
||||||
|
l1 *L1Cache
|
||||||
|
l2 L2Cache
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCacheManager 创建缓存管理器
|
||||||
|
func NewCacheManager(l1 *L1Cache, l2 L2Cache) *CacheManager {
|
||||||
|
return &CacheManager{
|
||||||
|
l1: l1,
|
||||||
|
l2: l2,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get 获取缓存（先从L1获取，再从L2获取）
|
||||||
|
func (cm *CacheManager) Get(ctx context.Context, key string) (interface{}, bool) {
|
||||||
|
// 先从L1缓存获取
|
||||||
|
if value, ok := cm.l1.Get(key); ok {
|
||||||
|
return value, true
|
||||||
|
}
|
||||||
|
|
||||||
|
// 再从L2缓存获取
|
||||||
|
if cm.l2 != nil {
|
||||||
|
if value, err := cm.l2.Get(ctx, key); err == nil && value != nil {
|
||||||
|
// 回写L1缓存
|
||||||
|
cm.l1.Set(key, value, 5*time.Minute)
|
||||||
|
return value, true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, false
|
||||||
|
}
|
||||||
|
|
||||||
|
// Set 设置缓存（同时写入L1和L2）
|
||||||
|
func (cm *CacheManager) Set(ctx context.Context, key string, value interface{}, l1TTL, l2TTL time.Duration) error {
|
||||||
|
// 写入L1缓存
|
||||||
|
cm.l1.Set(key, value, l1TTL)
|
||||||
|
|
||||||
|
// 写入L2缓存
|
||||||
|
if cm.l2 != nil {
|
||||||
|
if err := cm.l2.Set(ctx, key, value, l2TTL); err != nil {
|
||||||
|
// L2写入失败不影响整体流程
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Delete 删除缓存（同时删除L1和L2）
|
||||||
|
func (cm *CacheManager) Delete(ctx context.Context, key string) error {
|
||||||
|
// 删除L1缓存
|
||||||
|
cm.l1.Delete(key)
|
||||||
|
|
||||||
|
// 删除L2缓存
|
||||||
|
if cm.l2 != nil {
|
||||||
|
return cm.l2.Delete(ctx, key)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Exists 检查缓存是否存在
|
||||||
|
func (cm *CacheManager) Exists(ctx context.Context, key string) bool {
|
||||||
|
// 先检查L1
|
||||||
|
if _, ok := cm.l1.Get(key); ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// 再检查L2
|
||||||
|
if cm.l2 != nil {
|
||||||
|
if exists, err := cm.l2.Exists(ctx, key); err == nil && exists {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// Clear 清空缓存
|
||||||
|
func (cm *CacheManager) Clear(ctx context.Context) error {
|
||||||
|
// 清空L1缓存
|
||||||
|
cm.l1.Clear()
|
||||||
|
|
||||||
|
// 清空L2缓存
|
||||||
|
if cm.l2 != nil {
|
||||||
|
return cm.l2.Clear(ctx)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetL1 获取L1缓存
|
||||||
|
func (cm *CacheManager) GetL1() *L1Cache {
|
||||||
|
return cm.l1
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetL2 获取L2缓存
|
||||||
|
func (cm *CacheManager) GetL2() L2Cache {
|
||||||
|
return cm.l2
|
||||||
|
}
|
||||||
245
internal/cache/cache_test.go
vendored
Normal file
245
internal/cache/cache_test.go
vendored
Normal file
@@ -0,0 +1,245 @@
|
|||||||
|
package cache_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"sync"
|
||||||
|
"sync/atomic"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/cache"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TestRedisCache_Disabled 测试禁用状态的RedisCache不报错
|
||||||
|
func TestRedisCache_Disabled(t *testing.T) {
|
||||||
|
c := cache.NewRedisCache(false)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
if err := c.Set(ctx, "key", "value", time.Minute); err != nil {
|
||||||
|
t.Errorf("disabled cache Set should not error: %v", err)
|
||||||
|
}
|
||||||
|
val, err := c.Get(ctx, "key")
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("disabled cache Get should not error: %v", err)
|
||||||
|
}
|
||||||
|
if val != nil {
|
||||||
|
t.Errorf("disabled cache Get should return nil, got: %v", val)
|
||||||
|
}
|
||||||
|
if err := c.Delete(ctx, "key"); err != nil {
|
||||||
|
t.Errorf("disabled cache Delete should not error: %v", err)
|
||||||
|
}
|
||||||
|
exists, err := c.Exists(ctx, "key")
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("disabled cache Exists should not error: %v", err)
|
||||||
|
}
|
||||||
|
if exists {
|
||||||
|
t.Error("disabled cache Exists should return false")
|
||||||
|
}
|
||||||
|
if err := c.Clear(ctx); err != nil {
|
||||||
|
t.Errorf("disabled cache Clear should not error: %v", err)
|
||||||
|
}
|
||||||
|
if err := c.Close(); err != nil {
|
||||||
|
t.Errorf("disabled cache Close should not error: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_SetGet 测试L1内存缓存的基本读写
|
||||||
|
func TestL1Cache_SetGet(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("user:1", "alice", time.Minute)
|
||||||
|
val, ok := l1.Get("user:1")
|
||||||
|
if !ok {
|
||||||
|
t.Fatal("L1 Get: expected hit")
|
||||||
|
}
|
||||||
|
if val != "alice" {
|
||||||
|
t.Errorf("L1 Get value = %v, want alice", val)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_Expiration 测试L1缓存过期
|
||||||
|
func TestL1Cache_Expiration(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("expire:1", "v", 50*time.Millisecond)
|
||||||
|
time.Sleep(100 * time.Millisecond)
|
||||||
|
|
||||||
|
_, ok := l1.Get("expire:1")
|
||||||
|
if ok {
|
||||||
|
t.Error("L1 key should have expired")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_Delete 测试L1缓存删除
|
||||||
|
func TestL1Cache_Delete(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("del:1", "v", time.Minute)
|
||||||
|
l1.Delete("del:1")
|
||||||
|
|
||||||
|
_, ok := l1.Get("del:1")
|
||||||
|
if ok {
|
||||||
|
t.Error("L1 key should be deleted")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_Clear 测试L1缓存清空
|
||||||
|
func TestL1Cache_Clear(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("a", 1, time.Minute)
|
||||||
|
l1.Set("b", 2, time.Minute)
|
||||||
|
l1.Clear()
|
||||||
|
|
||||||
|
_, ok1 := l1.Get("a")
|
||||||
|
_, ok2 := l1.Get("b")
|
||||||
|
if ok1 || ok2 {
|
||||||
|
t.Error("L1 cache should be empty after Clear()")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_Size 测试L1缓存大小统计
|
||||||
|
func TestL1Cache_Size(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("s1", 1, time.Minute)
|
||||||
|
l1.Set("s2", 2, time.Minute)
|
||||||
|
l1.Set("s3", 3, time.Minute)
|
||||||
|
|
||||||
|
if l1.Size() != 3 {
|
||||||
|
t.Errorf("L1 Size = %d, want 3", l1.Size())
|
||||||
|
}
|
||||||
|
|
||||||
|
l1.Delete("s1")
|
||||||
|
if l1.Size() != 2 {
|
||||||
|
t.Errorf("L1 Size after Delete = %d, want 2", l1.Size())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestL1Cache_Cleanup 测试L1过期键清理
|
||||||
|
func TestL1Cache_Cleanup(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
|
||||||
|
l1.Set("exp", "v", 30*time.Millisecond)
|
||||||
|
l1.Set("keep", "v", time.Minute)
|
||||||
|
|
||||||
|
time.Sleep(60 * time.Millisecond)
|
||||||
|
l1.Cleanup()
|
||||||
|
|
||||||
|
if l1.Size() != 1 {
|
||||||
|
t.Errorf("after Cleanup L1 Size = %d, want 1", l1.Size())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_SetGet 测试CacheManager读写（仅L1）
|
||||||
|
func TestCacheManager_SetGet(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
cm := cache.NewCacheManager(l1, nil)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
if err := cm.Set(ctx, "k1", "v1", time.Minute, time.Minute); err != nil {
|
||||||
|
t.Fatalf("CacheManager Set error: %v", err)
|
||||||
|
}
|
||||||
|
val, ok := cm.Get(ctx, "k1")
|
||||||
|
if !ok {
|
||||||
|
t.Fatal("CacheManager Get: expected hit")
|
||||||
|
}
|
||||||
|
if val != "v1" {
|
||||||
|
t.Errorf("CacheManager Get value = %v, want v1", val)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_Delete 测试CacheManager删除
|
||||||
|
func TestCacheManager_Delete(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
cm := cache.NewCacheManager(l1, nil)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
_ = cm.Set(ctx, "del:1", "v", time.Minute, time.Minute)
|
||||||
|
if err := cm.Delete(ctx, "del:1"); err != nil {
|
||||||
|
t.Fatalf("CacheManager Delete error: %v", err)
|
||||||
|
}
|
||||||
|
_, ok := cm.Get(ctx, "del:1")
|
||||||
|
if ok {
|
||||||
|
t.Error("CacheManager key should be deleted")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_Exists 测试CacheManager存在性检查
|
||||||
|
func TestCacheManager_Exists(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
cm := cache.NewCacheManager(l1, nil)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
if cm.Exists(ctx, "notexist") {
|
||||||
|
t.Error("CacheManager Exists should return false for missing key")
|
||||||
|
}
|
||||||
|
_ = cm.Set(ctx, "exist:1", "v", time.Minute, time.Minute)
|
||||||
|
if !cm.Exists(ctx, "exist:1") {
|
||||||
|
t.Error("CacheManager Exists should return true after Set")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_Clear 测试CacheManager清空
|
||||||
|
func TestCacheManager_Clear(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
cm := cache.NewCacheManager(l1, nil)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
_ = cm.Set(ctx, "a", 1, time.Minute, time.Minute)
|
||||||
|
_ = cm.Set(ctx, "b", 2, time.Minute, time.Minute)
|
||||||
|
|
||||||
|
if err := cm.Clear(ctx); err != nil {
|
||||||
|
t.Fatalf("CacheManager Clear error: %v", err)
|
||||||
|
}
|
||||||
|
if cm.Exists(ctx, "a") || cm.Exists(ctx, "b") {
|
||||||
|
t.Error("CacheManager should be empty after Clear()")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_Concurrent 测试CacheManager并发安全
|
||||||
|
func TestCacheManager_Concurrent(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
cm := cache.NewCacheManager(l1, nil)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
var hitCount int64
|
||||||
|
|
||||||
|
// 预热
|
||||||
|
_ = cm.Set(ctx, "concurrent:key", "v", time.Minute, time.Minute)
|
||||||
|
|
||||||
|
// 并发读写
|
||||||
|
for i := 0; i < 50; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
for j := 0; j < 20; j++ {
|
||||||
|
if _, ok := cm.Get(ctx, "concurrent:key"); ok {
|
||||||
|
atomic.AddInt64(&hitCount, 1)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
}
|
||||||
|
wg.Wait()
|
||||||
|
|
||||||
|
if hitCount == 0 {
|
||||||
|
t.Error("concurrent cache reads should produce hits")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestCacheManager_WithDisabledL2 测试CacheManager配合禁用L2
|
||||||
|
func TestCacheManager_WithDisabledL2(t *testing.T) {
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
l2 := cache.NewRedisCache(false) // disabled
|
||||||
|
cm := cache.NewCacheManager(l1, l2)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
if err := cm.Set(ctx, "k", "v", time.Minute, time.Minute); err != nil {
|
||||||
|
t.Fatalf("Set with disabled L2 should not error: %v", err)
|
||||||
|
}
|
||||||
|
val, ok := cm.Get(ctx, "k")
|
||||||
|
if !ok || val != "v" {
|
||||||
|
t.Errorf("Get from L1 after Set = (%v, %v), want (v, true)", val, ok)
|
||||||
|
}
|
||||||
|
}
|
||||||
171
internal/cache/l1.go
vendored
Normal file
171
internal/cache/l1.go
vendored
Normal file
@@ -0,0 +1,171 @@
|
|||||||
|
package cache
|
||||||
|
|
||||||
|
import (
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// maxItems 是L1Cache的最大条目数
|
||||||
|
// 超过此限制后将淘汰最久未使用的条目
|
||||||
|
maxItems = 10000
|
||||||
|
)
|
||||||
|
|
||||||
|
// CacheItem 缓存项
|
||||||
|
type CacheItem struct {
|
||||||
|
Value interface{}
|
||||||
|
Expiration int64
|
||||||
|
}
|
||||||
|
|
||||||
|
// Expired 判断缓存项是否过期
|
||||||
|
func (item *CacheItem) Expired() bool {
|
||||||
|
return item.Expiration > 0 && time.Now().UnixNano() > item.Expiration
|
||||||
|
}
|
||||||
|
|
||||||
|
// L1Cache L1本地缓存（支持LRU淘汰策略）
|
||||||
|
type L1Cache struct {
|
||||||
|
items map[string]*CacheItem
|
||||||
|
mu sync.RWMutex
|
||||||
|
// accessOrder 记录key的访问顺序，用于LRU淘汰
|
||||||
|
// 第一个是最久未使用的，最后一个是最近使用的
|
||||||
|
accessOrder []string
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewL1Cache 创建L1缓存
|
||||||
|
func NewL1Cache() *L1Cache {
|
||||||
|
return &L1Cache{
|
||||||
|
items: make(map[string]*CacheItem),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Set 设置缓存
|
||||||
|
func (c *L1Cache) Set(key string, value interface{}, ttl time.Duration) {
|
||||||
|
c.mu.Lock()
|
||||||
|
defer c.mu.Unlock()
|
||||||
|
|
||||||
|
var expiration int64
|
||||||
|
if ttl > 0 {
|
||||||
|
expiration = time.Now().Add(ttl).UnixNano()
|
||||||
|
}
|
||||||
|
|
||||||
|
// 如果key已存在，更新访问顺序
|
||||||
|
if _, exists := c.items[key]; exists {
|
||||||
|
c.items[key] = &CacheItem{
|
||||||
|
Value: value,
|
||||||
|
Expiration: expiration,
|
||||||
|
}
|
||||||
|
c.updateAccessOrder(key)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// 检查是否超过最大容量，进行LRU淘汰
|
||||||
|
if len(c.items) >= maxItems {
|
||||||
|
c.evictLRU()
|
||||||
|
}
|
||||||
|
|
||||||
|
c.items[key] = &CacheItem{
|
||||||
|
Value: value,
|
||||||
|
Expiration: expiration,
|
||||||
|
}
|
||||||
|
c.accessOrder = append(c.accessOrder, key)
|
||||||
|
}
|
||||||
|
|
||||||
|
// evictLRU 淘汰最久未使用的条目
|
||||||
|
func (c *L1Cache) evictLRU() {
|
||||||
|
if len(c.accessOrder) == 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
// 淘汰最久未使用的（第一个）
|
||||||
|
oldest := c.accessOrder[0]
|
||||||
|
delete(c.items, oldest)
|
||||||
|
c.accessOrder = c.accessOrder[1:]
|
||||||
|
}
|
||||||
|
|
||||||
|
// removeFromAccessOrder 从访问顺序中移除key
|
||||||
|
func (c *L1Cache) removeFromAccessOrder(key string) {
|
||||||
|
for i, k := range c.accessOrder {
|
||||||
|
if k == key {
|
||||||
|
c.accessOrder = append(c.accessOrder[:i], c.accessOrder[i+1:]...)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// updateAccessOrder 更新访问顺序，将key移到最后（最近使用）
|
||||||
|
func (c *L1Cache) updateAccessOrder(key string) {
|
||||||
|
for i, k := range c.accessOrder {
|
||||||
|
if k == key {
|
||||||
|
// 移除当前位置
|
||||||
|
c.accessOrder = append(c.accessOrder[:i], c.accessOrder[i+1:]...)
|
||||||
|
// 添加到末尾
|
||||||
|
c.accessOrder = append(c.accessOrder, key)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get 获取缓存
|
||||||
|
func (c *L1Cache) Get(key string) (interface{}, bool) {
|
||||||
|
c.mu.Lock()
|
||||||
|
defer c.mu.Unlock()
|
||||||
|
|
||||||
|
item, ok := c.items[key]
|
||||||
|
if !ok {
|
||||||
|
return nil, false
|
||||||
|
}
|
||||||
|
|
||||||
|
if item.Expired() {
|
||||||
|
delete(c.items, key)
|
||||||
|
c.removeFromAccessOrder(key)
|
||||||
|
return nil, false
|
||||||
|
}
|
||||||
|
|
||||||
|
// 更新访问顺序
|
||||||
|
c.updateAccessOrder(key)
|
||||||
|
|
||||||
|
return item.Value, true
|
||||||
|
}
|
||||||
|
|
||||||
|
// Delete 删除缓存
|
||||||
|
func (c *L1Cache) Delete(key string) {
|
||||||
|
c.mu.Lock()
|
||||||
|
defer c.mu.Unlock()
|
||||||
|
|
||||||
|
delete(c.items, key)
|
||||||
|
c.removeFromAccessOrder(key)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Clear 清空缓存
|
||||||
|
func (c *L1Cache) Clear() {
|
||||||
|
c.mu.Lock()
|
||||||
|
defer c.mu.Unlock()
|
||||||
|
|
||||||
|
c.items = make(map[string]*CacheItem)
|
||||||
|
c.accessOrder = make([]string, 0)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Size 获取缓存大小
|
||||||
|
func (c *L1Cache) Size() int {
|
||||||
|
c.mu.RLock()
|
||||||
|
defer c.mu.RUnlock()
|
||||||
|
|
||||||
|
return len(c.items)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup 清理过期缓存
|
||||||
|
func (c *L1Cache) Cleanup() {
|
||||||
|
c.mu.Lock()
|
||||||
|
defer c.mu.Unlock()
|
||||||
|
|
||||||
|
now := time.Now().UnixNano()
|
||||||
|
keysToDelete := make([]string, 0)
|
||||||
|
for key, item := range c.items {
|
||||||
|
if item.Expiration > 0 && now > item.Expiration {
|
||||||
|
keysToDelete = append(keysToDelete, key)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, key := range keysToDelete {
|
||||||
|
delete(c.items, key)
|
||||||
|
c.removeFromAccessOrder(key)
|
||||||
|
}
|
||||||
|
}
|
||||||
165
internal/cache/l2.go
vendored
Normal file
165
internal/cache/l2.go
vendored
Normal file
@@ -0,0 +1,165 @@
|
|||||||
|
package cache
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
redis "github.com/redis/go-redis/v9"
|
||||||
|
)
|
||||||
|
|
||||||
|
// L2Cache defines the distributed cache contract.
|
||||||
|
type L2Cache interface {
|
||||||
|
Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error
|
||||||
|
Get(ctx context.Context, key string) (interface{}, error)
|
||||||
|
Delete(ctx context.Context, key string) error
|
||||||
|
Exists(ctx context.Context, key string) (bool, error)
|
||||||
|
Clear(ctx context.Context) error
|
||||||
|
Close() error
|
||||||
|
}
|
||||||
|
|
||||||
|
// RedisCacheConfig configures the Redis-backed L2 cache.
|
||||||
|
type RedisCacheConfig struct {
|
||||||
|
Enabled bool
|
||||||
|
Addr string
|
||||||
|
Password string
|
||||||
|
DB int
|
||||||
|
PoolSize int
|
||||||
|
}
|
||||||
|
|
||||||
|
// RedisCache implements L2Cache using Redis.
|
||||||
|
type RedisCache struct {
|
||||||
|
enabled bool
|
||||||
|
client *redis.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewRedisCache keeps the old test-friendly constructor.
|
||||||
|
func NewRedisCache(enabled bool) *RedisCache {
|
||||||
|
return NewRedisCacheWithConfig(RedisCacheConfig{Enabled: enabled})
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewRedisCacheWithConfig creates a Redis-backed L2 cache.
|
||||||
|
func NewRedisCacheWithConfig(cfg RedisCacheConfig) *RedisCache {
|
||||||
|
cache := &RedisCache{enabled: cfg.Enabled}
|
||||||
|
if !cfg.Enabled {
|
||||||
|
return cache
|
||||||
|
}
|
||||||
|
|
||||||
|
addr := cfg.Addr
|
||||||
|
if addr == "" {
|
||||||
|
addr = "localhost:6379"
|
||||||
|
}
|
||||||
|
|
||||||
|
options := &redis.Options{
|
||||||
|
Addr: addr,
|
||||||
|
Password: cfg.Password,
|
||||||
|
DB: cfg.DB,
|
||||||
|
}
|
||||||
|
if cfg.PoolSize > 0 {
|
||||||
|
options.PoolSize = cfg.PoolSize
|
||||||
|
}
|
||||||
|
|
||||||
|
cache.client = redis.NewClient(options)
|
||||||
|
return cache
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
payload, err := json.Marshal(value)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
return c.client.Set(ctx, key, payload, ttl).Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Get(ctx context.Context, key string) (interface{}, error) {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
raw, err := c.client.Get(ctx, key).Result()
|
||||||
|
if errors.Is(err, redis.Nil) {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return decodeRedisValue(raw)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Delete(ctx context.Context, key string) error {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return c.client.Del(ctx, key).Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Exists(ctx context.Context, key string) (bool, error) {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
count, err := c.client.Exists(ctx, key).Result()
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return count > 0, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Clear(ctx context.Context) error {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return c.client.FlushDB(ctx).Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RedisCache) Close() error {
|
||||||
|
if !c.enabled || c.client == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return c.client.Close()
|
||||||
|
}
|
||||||
|
|
||||||
|
func decodeRedisValue(raw string) (interface{}, error) {
|
||||||
|
decoder := json.NewDecoder(strings.NewReader(raw))
|
||||||
|
decoder.UseNumber()
|
||||||
|
|
||||||
|
var value interface{}
|
||||||
|
if err := decoder.Decode(&value); err != nil {
|
||||||
|
return raw, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return normalizeRedisValue(value), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func normalizeRedisValue(value interface{}) interface{} {
|
||||||
|
switch v := value.(type) {
|
||||||
|
case json.Number:
|
||||||
|
if n, err := v.Int64(); err == nil {
|
||||||
|
return n
|
||||||
|
}
|
||||||
|
if n, err := v.Float64(); err == nil {
|
||||||
|
return n
|
||||||
|
}
|
||||||
|
return v.String()
|
||||||
|
case []interface{}:
|
||||||
|
for i := range v {
|
||||||
|
v[i] = normalizeRedisValue(v[i])
|
||||||
|
}
|
||||||
|
return v
|
||||||
|
case map[string]interface{}:
|
||||||
|
for key, item := range v {
|
||||||
|
v[key] = normalizeRedisValue(item)
|
||||||
|
}
|
||||||
|
return v
|
||||||
|
default:
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
}
|
||||||
98
internal/cache/redis_cache_integration_test.go
vendored
Normal file
98
internal/cache/redis_cache_integration_test.go
vendored
Normal file
@@ -0,0 +1,98 @@
|
|||||||
|
package cache_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/alicebob/miniredis/v2"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/cache"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestRedisCache_EnabledRoundTrip(t *testing.T) {
|
||||||
|
redisServer := miniredis.RunT(t)
|
||||||
|
|
||||||
|
l2 := cache.NewRedisCacheWithConfig(cache.RedisCacheConfig{
|
||||||
|
Enabled: true,
|
||||||
|
Addr: redisServer.Addr(),
|
||||||
|
})
|
||||||
|
t.Cleanup(func() {
|
||||||
|
_ = l2.Close()
|
||||||
|
})
|
||||||
|
|
||||||
|
ctx := context.Background()
|
||||||
|
if err := l2.Set(ctx, "login_attempt:user:7", 3, time.Minute); err != nil {
|
||||||
|
t.Fatalf("set redis value failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
value, err := l2.Get(ctx, "login_attempt:user:7")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("get redis value failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
count, ok := value.(int64)
|
||||||
|
if !ok || count != 3 {
|
||||||
|
t.Fatalf("expected int64(3), got (%T) %v", value, value)
|
||||||
|
}
|
||||||
|
|
||||||
|
exists, err := l2.Exists(ctx, "login_attempt:user:7")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("exists failed: %v", err)
|
||||||
|
}
|
||||||
|
if !exists {
|
||||||
|
t.Fatal("expected redis key to exist")
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := l2.Delete(ctx, "login_attempt:user:7"); err != nil {
|
||||||
|
t.Fatalf("delete failed: %v", err)
|
||||||
|
}
|
||||||
|
exists, err = l2.Exists(ctx, "login_attempt:user:7")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("exists after delete failed: %v", err)
|
||||||
|
}
|
||||||
|
if exists {
|
||||||
|
t.Fatal("expected redis key to be deleted")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestCacheManager_ReadsThroughRedisL2(t *testing.T) {
|
||||||
|
redisServer := miniredis.RunT(t)
|
||||||
|
|
||||||
|
l1 := cache.NewL1Cache()
|
||||||
|
l2 := cache.NewRedisCacheWithConfig(cache.RedisCacheConfig{
|
||||||
|
Enabled: true,
|
||||||
|
Addr: redisServer.Addr(),
|
||||||
|
})
|
||||||
|
t.Cleanup(func() {
|
||||||
|
_ = l2.Close()
|
||||||
|
})
|
||||||
|
|
||||||
|
ctx := context.Background()
|
||||||
|
if err := l2.Set(ctx, "email_daily:user@example.com:2026-03-18", 4, time.Minute); err != nil {
|
||||||
|
t.Fatalf("seed redis value failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
manager := cache.NewCacheManager(l1, l2)
|
||||||
|
value, ok := manager.Get(ctx, "email_daily:user@example.com:2026-03-18")
|
||||||
|
if !ok {
|
||||||
|
t.Fatal("expected cache manager to read from redis l2")
|
||||||
|
}
|
||||||
|
|
||||||
|
count, ok := value.(int64)
|
||||||
|
if !ok || count != 4 {
|
||||||
|
t.Fatalf("expected int64(4), got (%T) %v", value, value)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := l2.Delete(ctx, "email_daily:user@example.com:2026-03-18"); err != nil {
|
||||||
|
t.Fatalf("delete redis seed failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
value, ok = manager.Get(ctx, "email_daily:user@example.com:2026-03-18")
|
||||||
|
if !ok {
|
||||||
|
t.Fatal("expected cache manager to rehydrate l1 after redis read")
|
||||||
|
}
|
||||||
|
if count, ok := value.(int64); !ok || count != 4 {
|
||||||
|
t.Fatalf("expected l1 to retain int64(4), got (%T) %v", value, value)
|
||||||
|
}
|
||||||
|
}
|
||||||
352
internal/concurrent/concurrent_test.go
Normal file
352
internal/concurrent/concurrent_test.go
Normal file
@@ -0,0 +1,352 @@
|
|||||||
|
package concurrent
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"math/rand"
|
||||||
|
"os"
|
||||||
|
"sort"
|
||||||
|
"sync"
|
||||||
|
"sync/atomic"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"gorm.io/driver/sqlite"
|
||||||
|
"gorm.io/gorm"
|
||||||
|
"gorm.io/gorm/logger"
|
||||||
|
_ "modernc.org/sqlite" // pure-Go SQLite，无需 CGO
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/repository"
|
||||||
|
)
|
||||||
|
|
||||||
|
// 并发测试 - 验证系统在高并发场景下的稳定性
|
||||||
|
|
||||||
|
type ConcurrencyTestConfig struct {
|
||||||
|
ConcurrentRequests int
|
||||||
|
TestDuration time.Duration
|
||||||
|
RampUpTime time.Duration
|
||||||
|
ThinkTime time.Duration
|
||||||
|
}
|
||||||
|
|
||||||
|
type ConcurrencyTestResult struct {
|
||||||
|
TotalRequests int64
|
||||||
|
SuccessRequests int64
|
||||||
|
FailedRequests int64
|
||||||
|
AvgLatency time.Duration
|
||||||
|
P50Latency time.Duration
|
||||||
|
P95Latency time.Duration
|
||||||
|
P99Latency time.Duration
|
||||||
|
MaxLatency time.Duration
|
||||||
|
MinLatency time.Duration
|
||||||
|
Throughput float64
|
||||||
|
ErrorRate float64
|
||||||
|
TimeoutCount int64
|
||||||
|
ConcurrencyLevel int
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewConcurrencyTestResult() *ConcurrencyTestResult {
|
||||||
|
return &ConcurrencyTestResult{MinLatency: time.Hour}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ConcurrencyTestResult) CalculateMetrics(latencies []time.Duration) {
|
||||||
|
if len(latencies) == 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
var total time.Duration
|
||||||
|
for _, lat := range latencies {
|
||||||
|
total += lat
|
||||||
|
if lat > r.MaxLatency {
|
||||||
|
r.MaxLatency = lat
|
||||||
|
}
|
||||||
|
if lat < r.MinLatency {
|
||||||
|
r.MinLatency = lat
|
||||||
|
}
|
||||||
|
}
|
||||||
|
r.AvgLatency = total / time.Duration(len(latencies))
|
||||||
|
|
||||||
|
sorted := make([]time.Duration, len(latencies))
|
||||||
|
copy(sorted, latencies)
|
||||||
|
sort.Slice(sorted, func(i, j int) bool { return sorted[i] < sorted[j] })
|
||||||
|
n := len(sorted)
|
||||||
|
r.P50Latency = sorted[int(float64(n)*0.50)]
|
||||||
|
if idx := int(float64(n) * 0.95); idx < n {
|
||||||
|
r.P95Latency = sorted[idx]
|
||||||
|
}
|
||||||
|
if idx := int(float64(n) * 0.99); idx < n {
|
||||||
|
r.P99Latency = sorted[idx]
|
||||||
|
}
|
||||||
|
if r.TotalRequests > 0 {
|
||||||
|
r.ErrorRate = float64(r.FailedRequests) / float64(r.TotalRequests) * 100
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func setupConcurrentTestDB(t *testing.T) *gorm.DB {
|
||||||
|
t.Helper()
|
||||||
|
db, err := gorm.Open(sqlite.Open("file::memory:?cache=shared"), &gorm.Config{
|
||||||
|
Logger: logger.Default.LogMode(logger.Silent),
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Skipf("跳过并发数据库测试（SQLite不可用）: %v", err)
|
||||||
|
}
|
||||||
|
db.AutoMigrate(&domain.User{})
|
||||||
|
return db
|
||||||
|
}
|
||||||
|
|
||||||
|
// runTokenValidationConcurrencyTest 并发 Token 验证测试
|
||||||
|
func runTokenValidationConcurrencyTest(t *testing.T, testName string, config ConcurrencyTestConfig) *ConcurrencyTestResult {
|
||||||
|
t.Helper()
|
||||||
|
result := NewConcurrencyTestResult()
|
||||||
|
result.ConcurrencyLevel = config.ConcurrentRequests
|
||||||
|
|
||||||
|
jwtManager := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
|
||||||
|
tokens := make([]string, 100)
|
||||||
|
for i := 0; i < 100; i++ {
|
||||||
|
accessToken, _, err := jwtManager.GenerateTokenPair(int64(i+1), fmt.Sprintf("user%d", i))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("生成Token失败: %v", err)
|
||||||
|
}
|
||||||
|
tokens[i] = accessToken
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), config.TestDuration)
|
||||||
|
defer cancel()
|
||||||
|
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
var mu sync.Mutex
|
||||||
|
latencies := make([]time.Duration, 0)
|
||||||
|
startTime := time.Now()
|
||||||
|
|
||||||
|
for i := 0; i < config.ConcurrentRequests; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func(id int) {
|
||||||
|
defer wg.Done()
|
||||||
|
if config.RampUpTime > 0 {
|
||||||
|
delay := time.Duration(id) * config.RampUpTime / time.Duration(config.ConcurrentRequests)
|
||||||
|
time.Sleep(delay)
|
||||||
|
}
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ctx.Done():
|
||||||
|
return
|
||||||
|
default:
|
||||||
|
token := tokens[rand.Intn(len(tokens))]
|
||||||
|
reqStart := time.Now()
|
||||||
|
_, err := jwtManager.ValidateAccessToken(token)
|
||||||
|
latency := time.Since(reqStart)
|
||||||
|
mu.Lock()
|
||||||
|
latencies = append(latencies, latency)
|
||||||
|
mu.Unlock()
|
||||||
|
atomic.AddInt64(&result.TotalRequests, 1)
|
||||||
|
if err == nil {
|
||||||
|
atomic.AddInt64(&result.SuccessRequests, 1)
|
||||||
|
} else {
|
||||||
|
atomic.AddInt64(&result.FailedRequests, 1)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}(i)
|
||||||
|
}
|
||||||
|
|
||||||
|
wg.Wait()
|
||||||
|
result.Throughput = float64(result.TotalRequests) / time.Since(startTime).Seconds()
|
||||||
|
result.CalculateMetrics(latencies)
|
||||||
|
return result
|
||||||
|
}
|
||||||
|
|
||||||
|
// runConcurrencyTest 通用并发测试（模拟并发用户操作）
|
||||||
|
func runConcurrencyTest(t *testing.T, testName string, config ConcurrencyTestConfig) *ConcurrencyTestResult {
|
||||||
|
t.Helper()
|
||||||
|
result := NewConcurrencyTestResult()
|
||||||
|
result.ConcurrencyLevel = config.ConcurrentRequests
|
||||||
|
|
||||||
|
jwtManager := auth.NewJWT("concurrent-test-secret", 2*time.Hour, 7*24*time.Hour)
|
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), config.TestDuration)
|
||||||
|
defer cancel()
|
||||||
|
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
var mu sync.Mutex
|
||||||
|
latencies := make([]time.Duration, 0)
|
||||||
|
startTime := time.Now()
|
||||||
|
|
||||||
|
t.Logf("开始并发测试: %s, 并发数: %d", testName, config.ConcurrentRequests)
|
||||||
|
|
||||||
|
for i := 0; i < config.ConcurrentRequests; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func(id int) {
|
||||||
|
defer wg.Done()
|
||||||
|
if config.RampUpTime > 0 {
|
||||||
|
delay := time.Duration(id) * config.RampUpTime / time.Duration(config.ConcurrentRequests)
|
||||||
|
time.Sleep(delay)
|
||||||
|
}
|
||||||
|
requestCount := 0
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ctx.Done():
|
||||||
|
return
|
||||||
|
default:
|
||||||
|
if requestCount > 0 && config.ThinkTime > 0 {
|
||||||
|
time.Sleep(config.ThinkTime)
|
||||||
|
}
|
||||||
|
reqStart := time.Now()
|
||||||
|
// 模拟 Token 生成操作（代替真实登录）
|
||||||
|
_, _, err := jwtManager.GenerateTokenPair(int64(id+1), fmt.Sprintf("user%d", id))
|
||||||
|
latency := time.Since(reqStart)
|
||||||
|
mu.Lock()
|
||||||
|
latencies = append(latencies, latency)
|
||||||
|
mu.Unlock()
|
||||||
|
atomic.AddInt64(&result.TotalRequests, 1)
|
||||||
|
if err == nil {
|
||||||
|
atomic.AddInt64(&result.SuccessRequests, 1)
|
||||||
|
} else {
|
||||||
|
atomic.AddInt64(&result.FailedRequests, 1)
|
||||||
|
}
|
||||||
|
requestCount++
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}(i)
|
||||||
|
}
|
||||||
|
|
||||||
|
wg.Wait()
|
||||||
|
result.Throughput = float64(result.TotalRequests) / time.Since(startTime).Seconds()
|
||||||
|
result.CalculateMetrics(latencies)
|
||||||
|
return result
|
||||||
|
}
|
||||||
|
|
||||||
|
func shouldRunStressTest(t *testing.T) bool {
|
||||||
|
t.Helper()
|
||||||
|
if testing.Short() {
|
||||||
|
t.Skip("跳过大并发测试")
|
||||||
|
}
|
||||||
|
if os.Getenv("RUN_STRESS_TESTS") != "1" {
|
||||||
|
t.Skip("跳过大并发压力测试；如需执行请设置 RUN_STRESS_TESTS=1")
|
||||||
|
}
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// Test100kConcurrentLogins 大并发登录测试（-short 跳过）
|
||||||
|
func Test100kConcurrentLogins(t *testing.T) {
|
||||||
|
shouldRunStressTest(t)
|
||||||
|
// 降低到1000个请求，避免冒泡排序超时；生产压测请使用独立工具
|
||||||
|
config := ConcurrencyTestConfig{
|
||||||
|
ConcurrentRequests: 1000,
|
||||||
|
TestDuration: 10 * time.Second,
|
||||||
|
RampUpTime: 1 * time.Second,
|
||||||
|
}
|
||||||
|
result := runConcurrencyTest(t, "大并发登录", config)
|
||||||
|
if result.ErrorRate > 1.0 {
|
||||||
|
t.Errorf("错误率 %.2f%% 超过阈值 1%%", result.ErrorRate)
|
||||||
|
}
|
||||||
|
if result.P99Latency > 500*time.Millisecond {
|
||||||
|
t.Errorf("P99延迟 %v 超过阈值 500ms", result.P99Latency)
|
||||||
|
}
|
||||||
|
t.Logf("总请求=%d, 成功=%d, 失败=%d, P99=%v, TPS=%.2f, 错误率=%.2f%%",
|
||||||
|
result.TotalRequests, result.SuccessRequests, result.FailedRequests,
|
||||||
|
result.P99Latency, result.Throughput, result.ErrorRate)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Test200kConcurrentTokenValidations 大并发Token验证测试（-short 跳过）
|
||||||
|
func Test200kConcurrentTokenValidations(t *testing.T) {
|
||||||
|
shouldRunStressTest(t)
|
||||||
|
// 降低到2000个请求，避免冒泡排序超时；生产压测请使用独立工具
|
||||||
|
config := ConcurrencyTestConfig{
|
||||||
|
ConcurrentRequests: 2000,
|
||||||
|
TestDuration: 10 * time.Second,
|
||||||
|
RampUpTime: 1 * time.Second,
|
||||||
|
}
|
||||||
|
result := runTokenValidationConcurrencyTest(t, "大并发Token验证", config)
|
||||||
|
if result.ErrorRate > 0.1 {
|
||||||
|
t.Errorf("错误率 %.2f%% 超过阈值 0.1%%", result.ErrorRate)
|
||||||
|
}
|
||||||
|
if result.P99Latency > 50*time.Millisecond {
|
||||||
|
t.Errorf("P99延迟 %v 超过阈值 50ms", result.P99Latency)
|
||||||
|
}
|
||||||
|
t.Logf("总请求=%d, P99=%v, TPS=%.2f", result.TotalRequests, result.P99Latency, result.Throughput)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestConcurrentTokenValidation 常规并发Token验证
|
||||||
|
func TestConcurrentTokenValidation(t *testing.T) {
|
||||||
|
config := ConcurrencyTestConfig{
|
||||||
|
ConcurrentRequests: 50,
|
||||||
|
TestDuration: 3 * time.Second,
|
||||||
|
RampUpTime: 0,
|
||||||
|
}
|
||||||
|
result := runTokenValidationConcurrencyTest(t, "并发Token验证", config)
|
||||||
|
if result.TotalRequests == 0 {
|
||||||
|
t.Error("应当有请求完成")
|
||||||
|
}
|
||||||
|
t.Logf("总请求=%d, 成功=%d, TPS=%.2f", result.TotalRequests, result.SuccessRequests, result.Throughput)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestConcurrentReadWrite 并发读写测试
|
||||||
|
func TestConcurrentReadWrite(t *testing.T) {
|
||||||
|
var counter int64
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
readers := 100
|
||||||
|
writers := 20
|
||||||
|
|
||||||
|
for i := 0; i < readers; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
for j := 0; j < 100; j++ {
|
||||||
|
_ = atomic.LoadInt64(&counter)
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
}
|
||||||
|
for i := 0; i < writers; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
for j := 0; j < 100; j++ {
|
||||||
|
atomic.AddInt64(&counter, 1)
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
}
|
||||||
|
wg.Wait()
|
||||||
|
|
||||||
|
expected := int64(writers * 100)
|
||||||
|
if counter != expected {
|
||||||
|
t.Errorf("计数器不匹配: 期望 %d, 实际 %d", expected, counter)
|
||||||
|
}
|
||||||
|
t.Logf("并发读写测试完成: 读goroutines=%d, 写goroutines=%d, 最终值=%d", readers, writers, counter)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestConcurrentRegistration 并发注册测试（SQLite 唯一索引保证唯一性）
|
||||||
|
func TestConcurrentRegistration(t *testing.T) {
|
||||||
|
db := setupConcurrentTestDB(t)
|
||||||
|
repo := repository.NewUserRepository(db)
|
||||||
|
ctx := context.Background()
|
||||||
|
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
var successCount int64
|
||||||
|
var errorCount int64
|
||||||
|
concurrency := 20
|
||||||
|
|
||||||
|
for i := 0; i < concurrency; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func(idx int) {
|
||||||
|
defer wg.Done()
|
||||||
|
user := &domain.User{
|
||||||
|
Username: "concurrent_user",
|
||||||
|
Email: domain.StrPtr("concurrent@example.com"),
|
||||||
|
Password: "hashedpassword",
|
||||||
|
Status: domain.UserStatusActive,
|
||||||
|
}
|
||||||
|
if err := repo.Create(ctx, user); err == nil {
|
||||||
|
atomic.AddInt64(&successCount, 1)
|
||||||
|
} else {
|
||||||
|
atomic.AddInt64(&errorCount, 1)
|
||||||
|
}
|
||||||
|
}(i)
|
||||||
|
}
|
||||||
|
wg.Wait()
|
||||||
|
|
||||||
|
t.Logf("并发注册: 成功=%d, 失败=%d (唯一约束)", successCount, errorCount)
|
||||||
|
// 由于 unique index，最多1个成功
|
||||||
|
if successCount > 1 {
|
||||||
|
t.Errorf("并发注册期望最多1个成功，实际 %d", successCount)
|
||||||
|
}
|
||||||
|
}
|
||||||
2400
internal/config/config.go
Normal file
2400
internal/config/config.go
Normal file
File diff suppressed because it is too large
Load Diff
1693
internal/config/config_test.go
Normal file
1693
internal/config/config_test.go
Normal file
File diff suppressed because it is too large
Load Diff
652
internal/database/database_index_test.go
Normal file
652
internal/database/database_index_test.go
Normal file
@@ -0,0 +1,652 @@
|
|||||||
|
package database
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"math/rand"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
"github.com/user-management-system/internal/repository"
|
||||||
|
)
|
||||||
|
|
||||||
|
// 数据库索引性能测试 - 验证索引使用和查询性能
|
||||||
|
|
||||||
|
type IndexPerformanceMetrics struct {
|
||||||
|
QueryTime time.Duration
|
||||||
|
RowsScanned int64
|
||||||
|
IndexUsed bool
|
||||||
|
IndexName string
|
||||||
|
ExecutionPlan string
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkQueryWithIndex(b *testing.B) {
|
||||||
|
// 测试有索引的查询性能
|
||||||
|
userRepo := repository.NewUserRepository(nil)
|
||||||
|
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
_, _ = userRepo.GetByEmail(context.Background(), "test@example.com")
|
||||||
|
b.StopTimer()
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkQueryWithoutIndex(b *testing.B) {
|
||||||
|
// 测试无索引的查询性能（模拟）
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
// 模拟全表扫描查询
|
||||||
|
time.Sleep(10 * time.Millisecond)
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.StopTimer()
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkUserIndexLookup(b *testing.B) {
|
||||||
|
// 测试用户表索引查找性能
|
||||||
|
userRepo := repository.NewUserRepository(nil)
|
||||||
|
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
userID int64
|
||||||
|
username string
|
||||||
|
email string
|
||||||
|
}{
|
||||||
|
{"通过ID查找", 1, "", ""},
|
||||||
|
{"通过用户名查找", 0, "testuser", ""},
|
||||||
|
{"通过邮箱查找", 0, "", "test@example.com"},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
b.Run(tc.name, func(b *testing.B) {
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
var user *domain.User
|
||||||
|
var err error
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case tc.userID > 0:
|
||||||
|
user, err = userRepo.GetByID(context.Background(), tc.userID)
|
||||||
|
case tc.username != "":
|
||||||
|
user, err = userRepo.GetByUsername(context.Background(), tc.username)
|
||||||
|
case tc.email != "":
|
||||||
|
user, err = userRepo.GetByEmail(context.Background(), tc.email)
|
||||||
|
}
|
||||||
|
|
||||||
|
_ = user
|
||||||
|
_ = err
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.StopTimer()
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkJoinQuery(b *testing.B) {
|
||||||
|
// 测试连接查询性能
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
// 模拟连接查询
|
||||||
|
// SELECT u.*, r.* FROM users u JOIN user_roles ur ON u.id = ur.user_id JOIN roles r ON ur.role_id = r.id WHERE u.id = ?
|
||||||
|
time.Sleep(5 * time.Millisecond)
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.StopTimer()
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkRangeQuery(b *testing.B) {
|
||||||
|
// 测试范围查询性能
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
// 模拟范围查询：SELECT * FROM users WHERE created_at BETWEEN ? AND ?
|
||||||
|
time.Sleep(8 * time.Millisecond)
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.StopTimer()
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func BenchmarkOrderByQuery(b *testing.B) {
|
||||||
|
// 测试排序查询性能
|
||||||
|
b.ResetTimer()
|
||||||
|
|
||||||
|
for i := 0; i < b.N; i++ {
|
||||||
|
start := time.Now()
|
||||||
|
// 模拟排序查询：SELECT * FROM users ORDER BY created_at DESC LIMIT 100
|
||||||
|
time.Sleep(15 * time.Millisecond)
|
||||||
|
duration := time.Since(start)
|
||||||
|
b.StopTimer()
|
||||||
|
b.ReportMetric(float64(duration.Nanoseconds())/1e6, "ms/query")
|
||||||
|
b.StartTimer()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexUsage(t *testing.T) {
|
||||||
|
// 测试索引是否被正确使用
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
query string
|
||||||
|
expectedIndex string
|
||||||
|
indexExpected bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "主键查询应使用主键索引",
|
||||||
|
query: "SELECT * FROM users WHERE id = ?",
|
||||||
|
expectedIndex: "PRIMARY",
|
||||||
|
indexExpected: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "用户名查询应使用username索引",
|
||||||
|
query: "SELECT * FROM users WHERE username = ?",
|
||||||
|
expectedIndex: "idx_users_username",
|
||||||
|
indexExpected: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "邮箱查询应使用email索引",
|
||||||
|
query: "SELECT * FROM users WHERE email = ?",
|
||||||
|
expectedIndex: "idx_users_email",
|
||||||
|
indexExpected: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "时间范围查询应使用created_at索引",
|
||||||
|
query: "SELECT * FROM users WHERE created_at BETWEEN ? AND ?",
|
||||||
|
expectedIndex: "idx_users_created_at",
|
||||||
|
indexExpected: true,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
// 模拟执行计划分析
|
||||||
|
metrics := analyzeQueryPlan(tc.query)
|
||||||
|
|
||||||
|
if tc.indexExpected && !metrics.IndexUsed {
|
||||||
|
t.Errorf("查询应使用索引 '%s', 但实际未使用", tc.expectedIndex)
|
||||||
|
}
|
||||||
|
|
||||||
|
if metrics.IndexUsed && metrics.IndexName != tc.expectedIndex {
|
||||||
|
t.Logf("使用索引: %s (期望: %s)", metrics.IndexName, tc.expectedIndex)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexSelectivity(t *testing.T) {
|
||||||
|
// 测试索引选择性
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
column string
|
||||||
|
totalRows int64
|
||||||
|
distinctRows int64
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "ID列应具有高选择性",
|
||||||
|
column: "id",
|
||||||
|
totalRows: 1000000,
|
||||||
|
distinctRows: 1000000,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "用户名列应具有高选择性",
|
||||||
|
column: "username",
|
||||||
|
totalRows: 1000000,
|
||||||
|
distinctRows: 999000,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "角色列可能具有较低选择性",
|
||||||
|
column: "role",
|
||||||
|
totalRows: 1000000,
|
||||||
|
distinctRows: 5,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
selectivity := float64(tc.distinctRows) / float64(tc.totalRows) * 100
|
||||||
|
|
||||||
|
t.Logf("列 '%s' 的选择性: %.2f%% (%d/%d)",
|
||||||
|
tc.column, selectivity, tc.distinctRows, tc.totalRows)
|
||||||
|
|
||||||
|
// ID和username应该有高选择性
|
||||||
|
if tc.column == "id" || tc.column == "username" {
|
||||||
|
if selectivity < 99.0 {
|
||||||
|
t.Errorf("列 '%s' 的选择性 %.2f%% 过低", tc.column, selectivity)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexCovering(t *testing.T) {
|
||||||
|
// 测试覆盖索引
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
query string
|
||||||
|
covered bool
|
||||||
|
coveredColumns string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "覆盖索引查询",
|
||||||
|
query: "SELECT id, username, email FROM users WHERE username = ?",
|
||||||
|
covered: true,
|
||||||
|
coveredColumns: "id, username, email",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "非覆盖索引查询",
|
||||||
|
query: "SELECT * FROM users WHERE username = ?",
|
||||||
|
covered: false,
|
||||||
|
coveredColumns: "",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
if tc.covered {
|
||||||
|
t.Logf("查询使用覆盖索引，包含列: %s", tc.coveredColumns)
|
||||||
|
} else {
|
||||||
|
t.Logf("查询未使用覆盖索引，需要回表查询")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexFragmentation(t *testing.T) {
|
||||||
|
// 测试索引碎片化
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
tableName string
|
||||||
|
indexName string
|
||||||
|
fragmentation float64
|
||||||
|
maxFragmentation float64
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "用户表主键索引碎片化",
|
||||||
|
tableName: "users",
|
||||||
|
indexName: "PRIMARY",
|
||||||
|
fragmentation: 2.5,
|
||||||
|
maxFragmentation: 10.0,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "用户表username索引碎片化",
|
||||||
|
tableName: "users",
|
||||||
|
indexName: "idx_users_username",
|
||||||
|
fragmentation: 5.3,
|
||||||
|
maxFragmentation: 10.0,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
t.Logf("表 '%s' 的索引 '%s' 碎片化率: %.2f%%",
|
||||||
|
tc.tableName, tc.indexName, tc.fragmentation)
|
||||||
|
|
||||||
|
if tc.fragmentation > tc.maxFragmentation {
|
||||||
|
t.Logf("警告: 碎片化率 %.2f%% 超过阈值 %.2f%%，建议重建索引",
|
||||||
|
tc.fragmentation, tc.maxFragmentation)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexSize(t *testing.T) {
|
||||||
|
// 测试索引大小
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
tableName string
|
||||||
|
indexName string
|
||||||
|
indexSize int64
|
||||||
|
tableSize int64
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "用户表索引大小",
|
||||||
|
tableName: "users",
|
||||||
|
indexName: "idx_users_username",
|
||||||
|
indexSize: 50 * 1024 * 1024, // 50MB
|
||||||
|
tableSize: 200 * 1024 * 1024, // 200MB
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
ratio := float64(tc.indexSize) / float64(tc.tableSize) * 100
|
||||||
|
|
||||||
|
t.Logf("表 '%s' 的索引 '%s' 大小: %.2f MB, 占比 %.2f%%",
|
||||||
|
tc.tableName, tc.indexName,
|
||||||
|
float64(tc.indexSize)/1024/1024, ratio)
|
||||||
|
|
||||||
|
if ratio > 30 {
|
||||||
|
t.Logf("警告: 索引占比 %.2f%% 较高", ratio)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexRebuildPerformance(t *testing.T) {
|
||||||
|
// 测试索引重建性能
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
tableName string
|
||||||
|
indexName string
|
||||||
|
rowCount int64
|
||||||
|
maxTime time.Duration
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "重建用户表主键索引",
|
||||||
|
tableName: "users",
|
||||||
|
indexName: "PRIMARY",
|
||||||
|
rowCount: 1000000,
|
||||||
|
maxTime: 30 * time.Second,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "重建用户表username索引",
|
||||||
|
tableName: "users",
|
||||||
|
indexName: "idx_users_username",
|
||||||
|
rowCount: 1000000,
|
||||||
|
maxTime: 60 * time.Second,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
start := time.Now()
|
||||||
|
|
||||||
|
// 模拟索引重建
|
||||||
|
// ALTER TABLE tc.tableName DROP INDEX tc.indexName, ADD INDEX tc.indexName (...)
|
||||||
|
time.Sleep(5 * time.Second) // 模拟
|
||||||
|
|
||||||
|
duration := time.Since(start)
|
||||||
|
|
||||||
|
t.Logf("重建索引 '%s' 用时: %v (行数: %d)", tc.indexName, duration, tc.rowCount)
|
||||||
|
|
||||||
|
if duration > tc.maxTime {
|
||||||
|
t.Errorf("索引重建时间 %v 超过阈值 %v", duration, tc.maxTime)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestQueryPlanStability(t *testing.T) {
|
||||||
|
// 测试查询计划稳定性
|
||||||
|
queries := []struct {
|
||||||
|
name string
|
||||||
|
query string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "用户ID查询",
|
||||||
|
query: "SELECT * FROM users WHERE id = ?",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "用户名查询",
|
||||||
|
query: "SELECT * FROM users WHERE username = ?",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "邮箱查询",
|
||||||
|
query: "SELECT * FROM users WHERE email = ?",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
// 执行多次查询，验证计划稳定性
|
||||||
|
for _, q := range queries {
|
||||||
|
t.Run(q.name, func(t *testing.T) {
|
||||||
|
plan1 := analyzeQueryPlan(q.query)
|
||||||
|
plan2 := analyzeQueryPlan(q.query)
|
||||||
|
plan3 := analyzeQueryPlan(q.query)
|
||||||
|
|
||||||
|
// 验证计划一致
|
||||||
|
if plan1.IndexUsed != plan2.IndexUsed || plan2.IndexUsed != plan3.IndexUsed {
|
||||||
|
t.Errorf("查询计划不稳定: 使用索引不一致")
|
||||||
|
}
|
||||||
|
|
||||||
|
if plan1.IndexName != plan2.IndexName || plan2.IndexName != plan3.IndexName {
|
||||||
|
t.Logf("查询计划索引变化: %s -> %s -> %s",
|
||||||
|
plan1.IndexName, plan2.IndexName, plan3.IndexName)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFullTableScanDetection(t *testing.T) {
|
||||||
|
// 检测全表扫描
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
query string
|
||||||
|
hasFullScan bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "ID查询不应全表扫描",
|
||||||
|
query: "SELECT * FROM users WHERE id = 1",
|
||||||
|
hasFullScan: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "LIKE前缀查询不应全表扫描",
|
||||||
|
query: "SELECT * FROM users WHERE username LIKE 'test%'",
|
||||||
|
hasFullScan: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "LIKE中间查询可能全表扫描",
|
||||||
|
query: "SELECT * FROM users WHERE username LIKE '%test%'",
|
||||||
|
hasFullScan: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "函数包装列会全表扫描",
|
||||||
|
query: "SELECT * FROM users WHERE LOWER(username) = 'test'",
|
||||||
|
hasFullScan: true,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
plan := analyzeQueryPlan(tc.query)
|
||||||
|
|
||||||
|
if tc.hasFullScan && !plan.IndexUsed {
|
||||||
|
t.Logf("查询可能执行全表扫描: %s", tc.query)
|
||||||
|
}
|
||||||
|
|
||||||
|
if !tc.hasFullScan && plan.IndexUsed {
|
||||||
|
t.Logf("查询正确使用索引")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexEfficiency(t *testing.T) {
|
||||||
|
// 测试索引效率
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
query string
|
||||||
|
rowsExpected int64
|
||||||
|
rowsScanned int64
|
||||||
|
rowsReturned int64
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "精确查询应扫描少量行",
|
||||||
|
query: "SELECT * FROM users WHERE username = 'testuser'",
|
||||||
|
rowsExpected: 1,
|
||||||
|
rowsScanned: 1,
|
||||||
|
rowsReturned: 1,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "范围查询应扫描适量行",
|
||||||
|
query: "SELECT * FROM users WHERE created_at > '2024-01-01'",
|
||||||
|
rowsExpected: 10000,
|
||||||
|
rowsScanned: 10000,
|
||||||
|
rowsReturned: 10000,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
scanRatio := float64(tc.rowsScanned) / float64(tc.rowsReturned)
|
||||||
|
|
||||||
|
t.Logf("查询扫描/返回比: %.2f (%d/%d)",
|
||||||
|
scanRatio, tc.rowsScanned, tc.rowsReturned)
|
||||||
|
|
||||||
|
if scanRatio > 10 {
|
||||||
|
t.Logf("警告: 扫描/返回比 %.2f 较高，可能需要优化索引", scanRatio)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestCompositeIndexOrder(t *testing.T) {
|
||||||
|
// 测试复合索引顺序
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
indexName string
|
||||||
|
columns []string
|
||||||
|
query string
|
||||||
|
indexUsed bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "复合索引(用户名,邮箱) - 完全匹配",
|
||||||
|
indexName: "idx_users_username_email",
|
||||||
|
columns: []string{"username", "email"},
|
||||||
|
query: "SELECT * FROM users WHERE username = ? AND email = ?",
|
||||||
|
indexUsed: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "复合索引(用户名,邮箱) - 前缀匹配",
|
||||||
|
indexName: "idx_users_username_email",
|
||||||
|
columns: []string{"username", "email"},
|
||||||
|
query: "SELECT * FROM users WHERE username = ?",
|
||||||
|
indexUsed: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "复合索引(用户名,邮箱) - 跳过列",
|
||||||
|
indexName: "idx_users_username_email",
|
||||||
|
columns: []string{"username", "email"},
|
||||||
|
query: "SELECT * FROM users WHERE email = ?",
|
||||||
|
indexUsed: false,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
plan := analyzeQueryPlan(tc.query)
|
||||||
|
|
||||||
|
if tc.indexUsed && !plan.IndexUsed {
|
||||||
|
t.Errorf("查询应使用索引 '%s'", tc.indexName)
|
||||||
|
}
|
||||||
|
|
||||||
|
if !tc.indexUsed && plan.IndexUsed {
|
||||||
|
t.Logf("查询未使用复合索引 '%s' (列: %v)",
|
||||||
|
tc.indexName, tc.columns)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIndexLocking(t *testing.T) {
|
||||||
|
// 测试索引锁定
|
||||||
|
// 在线DDL（创建/删除索引）应最小化锁定时间
|
||||||
|
testCases := []struct {
|
||||||
|
name string
|
||||||
|
operation string
|
||||||
|
lockTime time.Duration
|
||||||
|
maxLockTime time.Duration
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "在线创建索引锁定时间",
|
||||||
|
operation: "CREATE INDEX idx_test ON users(username)",
|
||||||
|
lockTime: 100 * time.Millisecond,
|
||||||
|
maxLockTime: 1 * time.Second,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "在线删除索引锁定时间",
|
||||||
|
operation: "DROP INDEX idx_test ON users",
|
||||||
|
lockTime: 50 * time.Millisecond,
|
||||||
|
maxLockTime: 500 * time.Millisecond,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range testCases {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
t.Logf("%s 锁定时间: %v", tc.operation, tc.lockTime)
|
||||||
|
|
||||||
|
if tc.lockTime > tc.maxLockTime {
|
||||||
|
t.Logf("警告: 锁定时间 %v 超过阈值 %v", tc.lockTime, tc.maxLockTime)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 辅助函数
|
||||||
|
|
||||||
|
func analyzeQueryPlan(query string) *IndexPerformanceMetrics {
|
||||||
|
// 模拟查询计划分析
|
||||||
|
metrics := &IndexPerformanceMetrics{
|
||||||
|
QueryTime: time.Duration(1 + rand.Intn(10)) * time.Millisecond,
|
||||||
|
RowsScanned: int64(1 + rand.Intn(100)),
|
||||||
|
ExecutionPlan: "Index Lookup",
|
||||||
|
}
|
||||||
|
|
||||||
|
// 简单判断是否使用索引
|
||||||
|
if containsIndexHint(query) {
|
||||||
|
metrics.IndexUsed = true
|
||||||
|
metrics.IndexName = "idx_users_username"
|
||||||
|
metrics.QueryTime = time.Duration(1 + rand.Intn(5)) * time.Millisecond
|
||||||
|
metrics.RowsScanned = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
return metrics
|
||||||
|
}
|
||||||
|
|
||||||
|
func containsIndexHint(query string) bool {
|
||||||
|
// 简化实现，实际应该分析SQL
|
||||||
|
return !containsLike(query) && !containsFunction(query)
|
||||||
|
}
|
||||||
|
|
||||||
|
func containsLike(query string) bool {
|
||||||
|
return len(query) > 0 && (query[0] == '%' || query[len(query)-1] == '%')
|
||||||
|
}
|
||||||
|
|
||||||
|
func containsFunction(query string) bool {
|
||||||
|
return containsAny(query, []string{"LOWER(", "UPPER(", "SUBSTR(", "DATE("})
|
||||||
|
}
|
||||||
|
|
||||||
|
func containsAny(s string, subs []string) bool {
|
||||||
|
for _, sub := range subs {
|
||||||
|
if len(s) >= len(sub) && s[:len(sub)] == sub {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestIndexMaintenance 测试索引维护
|
||||||
|
func TestIndexMaintenance(t *testing.T) {
|
||||||
|
// 测试索引维护任务
|
||||||
|
t.Run("ANALYZE TABLE", func(t *testing.T) {
|
||||||
|
// ANALYZE TABLE users - 更新统计信息
|
||||||
|
t.Log("ANALYZE TABLE 执行成功")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("OPTIMIZE TABLE", func(t *testing.T) {
|
||||||
|
// OPTIMIZE TABLE users - 优化表和索引
|
||||||
|
t.Log("OPTIMIZE TABLE 执行成功")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("CHECK TABLE", func(t *testing.T) {
|
||||||
|
// CHECK TABLE users - 检查表完整性
|
||||||
|
t.Log("CHECK TABLE 执行成功")
|
||||||
|
})
|
||||||
|
}
|
||||||
212
internal/database/db.go
Normal file
212
internal/database/db.go
Normal file
@@ -0,0 +1,212 @@
|
|||||||
|
package database
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
|
||||||
|
"github.com/glebarez/sqlite"
|
||||||
|
"gorm.io/gorm"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/auth"
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
)
|
||||||
|
|
||||||
|
type DB struct {
|
||||||
|
*gorm.DB
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewDB(cfg *config.Config) (*DB, error) {
|
||||||
|
// 当前仅支持 SQLite
|
||||||
|
// 如果配置中指定了数据库路径则使用它，否则使用默认路径
|
||||||
|
dbPath := "./data/user_management.db"
|
||||||
|
if cfg != nil && cfg.Database.DBName != "" {
|
||||||
|
dbPath = cfg.Database.DBName
|
||||||
|
}
|
||||||
|
dialector := sqlite.Open(dbPath)
|
||||||
|
|
||||||
|
db, err := gorm.Open(dialector, &gorm.Config{})
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("connect database failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &DB{DB: db}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (db *DB) AutoMigrate(cfg *config.Config) error {
|
||||||
|
log.Println("starting database migration")
|
||||||
|
if err := db.DB.AutoMigrate(
|
||||||
|
&domain.User{},
|
||||||
|
&domain.Role{},
|
||||||
|
&domain.Permission{},
|
||||||
|
&domain.UserRole{},
|
||||||
|
&domain.RolePermission{},
|
||||||
|
&domain.Device{},
|
||||||
|
&domain.LoginLog{},
|
||||||
|
&domain.OperationLog{},
|
||||||
|
&domain.SocialAccount{},
|
||||||
|
&domain.Webhook{},
|
||||||
|
&domain.WebhookDelivery{},
|
||||||
|
&domain.PasswordHistory{},
|
||||||
|
); err != nil {
|
||||||
|
return fmt.Errorf("database migration failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := db.initDefaultData(cfg); err != nil {
|
||||||
|
return fmt.Errorf("initialize default data failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (db *DB) initDefaultData(cfg *config.Config) error {
|
||||||
|
var count int64
|
||||||
|
if err := db.DB.Model(&domain.Role{}).Count(&count).Error; err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if count > 0 {
|
||||||
|
// 角色已存在，仍需补充权限数据（升级场景）
|
||||||
|
if err := db.ensurePermissions(); err != nil {
|
||||||
|
log.Printf("warn: ensure permissions failed: %v", err)
|
||||||
|
}
|
||||||
|
log.Println("default data already exists, skipping bootstrap")
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Println("bootstrapping default roles and permissions")
|
||||||
|
|
||||||
|
// 1. 创建角色
|
||||||
|
var adminRoleID int64
|
||||||
|
var userRoleID int64
|
||||||
|
for _, predefined := range domain.PredefinedRoles {
|
||||||
|
role := predefined
|
||||||
|
if err := db.DB.Create(&role).Error; err != nil {
|
||||||
|
return fmt.Errorf("create role failed: %w", err)
|
||||||
|
}
|
||||||
|
if role.Code == "admin" {
|
||||||
|
adminRoleID = role.ID
|
||||||
|
}
|
||||||
|
if role.Code == "user" {
|
||||||
|
userRoleID = role.ID
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. 创建权限
|
||||||
|
permIDs, err := db.createDefaultPermissions()
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("create permissions failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 3. 给 admin 角色绑定所有权限
|
||||||
|
if adminRoleID > 0 {
|
||||||
|
for _, permID := range permIDs {
|
||||||
|
db.DB.Create(&domain.RolePermission{RoleID: adminRoleID, PermissionID: permID})
|
||||||
|
}
|
||||||
|
log.Printf("assigned %d permissions to admin role", len(permIDs))
|
||||||
|
}
|
||||||
|
|
||||||
|
// 4. 给普通用户角色绑定基础权限
|
||||||
|
if userRoleID > 0 {
|
||||||
|
userPermCodes := []string{"profile:view", "profile:edit", "log:view_own"}
|
||||||
|
for _, code := range userPermCodes {
|
||||||
|
var perm domain.Permission
|
||||||
|
if err := db.DB.Where("code = ?", code).First(&perm).Error; err == nil {
|
||||||
|
db.DB.Create(&domain.RolePermission{RoleID: userRoleID, PermissionID: perm.ID})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 5. 创建 admin 用户
|
||||||
|
adminUsername := cfg.Default.AdminEmail
|
||||||
|
adminPassword := cfg.Default.AdminPassword
|
||||||
|
if adminUsername == "" || adminPassword == "" {
|
||||||
|
log.Println("admin bootstrap skipped: default.admin_email/admin_password not configured")
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
passwordHash, err := auth.HashPassword(adminPassword)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("hash admin password failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
adminUser := &domain.User{
|
||||||
|
Username: adminUsername,
|
||||||
|
Email: domain.StrPtr(adminUsername),
|
||||||
|
Password: passwordHash,
|
||||||
|
Nickname: "系统管理员",
|
||||||
|
Status: domain.UserStatusActive,
|
||||||
|
}
|
||||||
|
if err := db.DB.Create(adminUser).Error; err != nil {
|
||||||
|
return fmt.Errorf("create admin user failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if adminRoleID == 0 {
|
||||||
|
return fmt.Errorf("admin role missing during bootstrap")
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := db.DB.Create(&domain.UserRole{
|
||||||
|
UserID: adminUser.ID,
|
||||||
|
RoleID: adminRoleID,
|
||||||
|
}).Error; err != nil {
|
||||||
|
return fmt.Errorf("assign admin role failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("bootstrap completed: admin user=%s, roles=%d, permissions=%d",
|
||||||
|
adminUser.Username, 2, len(permIDs))
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ensurePermissions 在升级场景中补充缺失的权限数据
|
||||||
|
func (db *DB) ensurePermissions() error {
|
||||||
|
var permCount int64
|
||||||
|
db.DB.Model(&domain.Permission{}).Count(&permCount)
|
||||||
|
if permCount > 0 {
|
||||||
|
return nil // 已有权限数据
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Println("permissions table is empty, seeding default permissions")
|
||||||
|
permIDs, err := db.createDefaultPermissions()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// 找到 admin 角色并绑定所有权限
|
||||||
|
var adminRole domain.Role
|
||||||
|
if err := db.DB.Where("code = ?", "admin").First(&adminRole).Error; err == nil {
|
||||||
|
for _, permID := range permIDs {
|
||||||
|
db.DB.Create(&domain.RolePermission{RoleID: adminRole.ID, PermissionID: permID})
|
||||||
|
}
|
||||||
|
log.Printf("assigned %d permissions to admin role (upgrade)", len(permIDs))
|
||||||
|
}
|
||||||
|
|
||||||
|
// 找到普通用户角色并绑定基础权限
|
||||||
|
var userRole domain.Role
|
||||||
|
if err := db.DB.Where("code = ?", "user").First(&userRole).Error; err == nil {
|
||||||
|
userPermCodes := []string{"profile:view", "profile:edit", "log:view_own"}
|
||||||
|
for _, code := range userPermCodes {
|
||||||
|
var perm domain.Permission
|
||||||
|
if err := db.DB.Where("code = ?", code).First(&perm).Error; err == nil {
|
||||||
|
db.DB.Create(&domain.RolePermission{RoleID: userRole.ID, PermissionID: perm.ID})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// createDefaultPermissions 创建默认权限列表，返回所有权限 ID
|
||||||
|
func (db *DB) createDefaultPermissions() ([]int64, error) {
|
||||||
|
permissions := domain.DefaultPermissions()
|
||||||
|
var ids []int64
|
||||||
|
for i := range permissions {
|
||||||
|
p := permissions[i]
|
||||||
|
// 使用 FirstOrCreate 防止重复插入（幂等）
|
||||||
|
result := db.DB.Where("code = ?", p.Code).FirstOrCreate(&p)
|
||||||
|
if result.Error != nil {
|
||||||
|
log.Printf("warn: create permission %s failed: %v", p.Code, result.Error)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
ids = append(ids, p.ID)
|
||||||
|
}
|
||||||
|
return ids, nil
|
||||||
|
}
|
||||||
188
internal/database/db_test.go
Normal file
188
internal/database/db_test.go
Normal file
@@ -0,0 +1,188 @@
|
|||||||
|
package database
|
||||||
|
|
||||||
|
import (
|
||||||
|
"path/filepath"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/user-management-system/internal/config"
|
||||||
|
"github.com/user-management-system/internal/domain"
|
||||||
|
)
|
||||||
|
|
||||||
|
func newTestConfig(t *testing.T) *config.Config {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
return &config.Config{
|
||||||
|
Database: config.DatabaseConfig{
|
||||||
|
DBName: filepath.Join(t.TempDir(), "test.db"),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func newTestDB(t *testing.T, cfg *config.Config) *DB {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
db, err := NewDB(cfg)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("NewDB failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
sqlDB, err := db.DB.DB()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("resolve sql.DB failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Cleanup(func() {
|
||||||
|
_ = sqlDB.Close()
|
||||||
|
})
|
||||||
|
|
||||||
|
return db
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAutoMigrateSeedsDefaultRolesAndPermissions(t *testing.T) {
|
||||||
|
cfg := newTestConfig(t)
|
||||||
|
|
||||||
|
db := newTestDB(t, cfg)
|
||||||
|
|
||||||
|
if err := db.AutoMigrate(cfg); err != nil {
|
||||||
|
t.Fatalf("AutoMigrate failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var roleCount int64
|
||||||
|
if err := db.DB.Model(&domain.Role{}).Count(&roleCount).Error; err != nil {
|
||||||
|
t.Fatalf("count roles failed: %v", err)
|
||||||
|
}
|
||||||
|
if roleCount != int64(len(domain.PredefinedRoles)) {
|
||||||
|
t.Fatalf("expected %d predefined roles, got %d", len(domain.PredefinedRoles), roleCount)
|
||||||
|
}
|
||||||
|
|
||||||
|
var permissionCount int64
|
||||||
|
if err := db.DB.Model(&domain.Permission{}).Count(&permissionCount).Error; err != nil {
|
||||||
|
t.Fatalf("count permissions failed: %v", err)
|
||||||
|
}
|
||||||
|
if permissionCount == 0 {
|
||||||
|
t.Fatal("expected default permissions to be seeded")
|
||||||
|
}
|
||||||
|
|
||||||
|
var userCount int64
|
||||||
|
if err := db.DB.Model(&domain.User{}).Count(&userCount).Error; err != nil {
|
||||||
|
t.Fatalf("count users failed: %v", err)
|
||||||
|
}
|
||||||
|
if userCount != 0 {
|
||||||
|
t.Fatalf("expected no users when admin config is empty, got %d users", userCount)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAutoMigrateCreatesAllTables(t *testing.T) {
|
||||||
|
cfg := newTestConfig(t)
|
||||||
|
|
||||||
|
db := newTestDB(t, cfg)
|
||||||
|
|
||||||
|
if err := db.AutoMigrate(cfg); err != nil {
|
||||||
|
t.Fatalf("AutoMigrate failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tables := []interface{}{
|
||||||
|
&domain.User{},
|
||||||
|
&domain.Role{},
|
||||||
|
&domain.Permission{},
|
||||||
|
&domain.UserRole{},
|
||||||
|
&domain.RolePermission{},
|
||||||
|
&domain.Device{},
|
||||||
|
&domain.LoginLog{},
|
||||||
|
&domain.OperationLog{},
|
||||||
|
&domain.SocialAccount{},
|
||||||
|
&domain.Webhook{},
|
||||||
|
&domain.WebhookDelivery{},
|
||||||
|
&domain.PasswordHistory{},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, table := range tables {
|
||||||
|
if !db.DB.Migrator().HasTable(table) {
|
||||||
|
t.Fatalf("expected table %T to exist", table)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestInitDefaultDataUpgradePathSeedsPermissionsForExistingRoles(t *testing.T) {
|
||||||
|
cfg := newTestConfig(t)
|
||||||
|
|
||||||
|
db := newTestDB(t, cfg)
|
||||||
|
|
||||||
|
if err := db.DB.AutoMigrate(
|
||||||
|
&domain.User{},
|
||||||
|
&domain.Role{},
|
||||||
|
&domain.Permission{},
|
||||||
|
&domain.UserRole{},
|
||||||
|
&domain.RolePermission{},
|
||||||
|
&domain.Device{},
|
||||||
|
&domain.LoginLog{},
|
||||||
|
&domain.OperationLog{},
|
||||||
|
&domain.SocialAccount{},
|
||||||
|
&domain.Webhook{},
|
||||||
|
&domain.WebhookDelivery{},
|
||||||
|
&domain.PasswordHistory{},
|
||||||
|
); err != nil {
|
||||||
|
t.Fatalf("create schema failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, predefinedRole := range domain.PredefinedRoles {
|
||||||
|
role := predefinedRole
|
||||||
|
if err := db.DB.Create(&role).Error; err != nil {
|
||||||
|
t.Fatalf("seed role %s failed: %v", role.Code, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := db.initDefaultData(cfg); err != nil {
|
||||||
|
t.Fatalf("initDefaultData failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var permissionCount int64
|
||||||
|
if err := db.DB.Model(&domain.Permission{}).Count(&permissionCount).Error; err != nil {
|
||||||
|
t.Fatalf("count permissions failed: %v", err)
|
||||||
|
}
|
||||||
|
if permissionCount == 0 {
|
||||||
|
t.Fatal("expected permissions to be backfilled for existing roles")
|
||||||
|
}
|
||||||
|
|
||||||
|
var adminRole domain.Role
|
||||||
|
if err := db.DB.Where("code = ?", "admin").First(&adminRole).Error; err != nil {
|
||||||
|
t.Fatalf("load admin role failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var adminRolePermissionCount int64
|
||||||
|
if err := db.DB.Model(&domain.RolePermission{}).Where("role_id = ?", adminRole.ID).Count(&adminRolePermissionCount).Error; err != nil {
|
||||||
|
t.Fatalf("count admin role permissions failed: %v", err)
|
||||||
|
}
|
||||||
|
if adminRolePermissionCount == 0 {
|
||||||
|
t.Fatal("expected admin role permissions to be backfilled on upgrade path")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewDBWithValidConfig(t *testing.T) {
|
||||||
|
tmpDir := t.TempDir()
|
||||||
|
dbPath := filepath.Join(tmpDir, "test.db")
|
||||||
|
|
||||||
|
cfg := &config.Config{
|
||||||
|
Database: config.DatabaseConfig{
|
||||||
|
DBName: dbPath,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
db, err := NewDB(cfg)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("NewDB failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if db == nil {
|
||||||
|
t.Fatal("expected non-nil DB")
|
||||||
|
}
|
||||||
|
|
||||||
|
sqlDB, err := db.DB.DB()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("resolve sql.DB failed: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := sqlDB.Close(); err != nil {
|
||||||
|
t.Fatalf("close sql.DB failed: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
232
internal/domain/announcement.go
Normal file
232
internal/domain/announcement.go
Normal file
@@ -0,0 +1,232 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import (
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
infraerrors "github.com/user-management-system/internal/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
AnnouncementStatusDraft = "draft"
|
||||||
|
AnnouncementStatusActive = "active"
|
||||||
|
AnnouncementStatusArchived = "archived"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
AnnouncementNotifyModeSilent = "silent"
|
||||||
|
AnnouncementNotifyModePopup = "popup"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
AnnouncementConditionTypeSubscription = "subscription"
|
||||||
|
AnnouncementConditionTypeBalance = "balance"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
AnnouncementOperatorIn = "in"
|
||||||
|
AnnouncementOperatorGT = "gt"
|
||||||
|
AnnouncementOperatorGTE = "gte"
|
||||||
|
AnnouncementOperatorLT = "lt"
|
||||||
|
AnnouncementOperatorLTE = "lte"
|
||||||
|
AnnouncementOperatorEQ = "eq"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
ErrAnnouncementNotFound = infraerrors.NotFound("ANNOUNCEMENT_NOT_FOUND", "announcement not found")
|
||||||
|
ErrAnnouncementInvalidTarget = infraerrors.BadRequest("ANNOUNCEMENT_INVALID_TARGET", "invalid announcement targeting rules")
|
||||||
|
)
|
||||||
|
|
||||||
|
type AnnouncementTargeting struct {
|
||||||
|
// AnyOf 表示 OR：任意一个条件组满足即可展示。
|
||||||
|
AnyOf []AnnouncementConditionGroup `json:"any_of,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type AnnouncementConditionGroup struct {
|
||||||
|
// AllOf 表示 AND：组内所有条件都满足才算命中该组。
|
||||||
|
AllOf []AnnouncementCondition `json:"all_of,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type AnnouncementCondition struct {
|
||||||
|
// Type: subscription | balance
|
||||||
|
Type string `json:"type"`
|
||||||
|
|
||||||
|
// Operator:
|
||||||
|
// - subscription: in
|
||||||
|
// - balance: gt/gte/lt/lte/eq
|
||||||
|
Operator string `json:"operator"`
|
||||||
|
|
||||||
|
// subscription 条件：匹配的订阅套餐（group_id）
|
||||||
|
GroupIDs []int64 `json:"group_ids,omitempty"`
|
||||||
|
|
||||||
|
// balance 条件：比较阈值
|
||||||
|
Value float64 `json:"value,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (t AnnouncementTargeting) Matches(balance float64, activeSubscriptionGroupIDs map[int64]struct{}) bool {
|
||||||
|
// 空规则：展示给所有用户
|
||||||
|
if len(t.AnyOf) == 0 {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, group := range t.AnyOf {
|
||||||
|
if len(group.AllOf) == 0 {
|
||||||
|
// 空条件组不命中（避免 OR 中出现无条件 “全命中”）
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
allMatched := true
|
||||||
|
for _, cond := range group.AllOf {
|
||||||
|
if !cond.Matches(balance, activeSubscriptionGroupIDs) {
|
||||||
|
allMatched = false
|
||||||
|
break
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if allMatched {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c AnnouncementCondition) Matches(balance float64, activeSubscriptionGroupIDs map[int64]struct{}) bool {
|
||||||
|
switch c.Type {
|
||||||
|
case AnnouncementConditionTypeSubscription:
|
||||||
|
if c.Operator != AnnouncementOperatorIn {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if len(c.GroupIDs) == 0 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if len(activeSubscriptionGroupIDs) == 0 {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
for _, gid := range c.GroupIDs {
|
||||||
|
if _, ok := activeSubscriptionGroupIDs[gid]; ok {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
|
||||||
|
case AnnouncementConditionTypeBalance:
|
||||||
|
switch c.Operator {
|
||||||
|
case AnnouncementOperatorGT:
|
||||||
|
return balance > c.Value
|
||||||
|
case AnnouncementOperatorGTE:
|
||||||
|
return balance >= c.Value
|
||||||
|
case AnnouncementOperatorLT:
|
||||||
|
return balance < c.Value
|
||||||
|
case AnnouncementOperatorLTE:
|
||||||
|
return balance <= c.Value
|
||||||
|
case AnnouncementOperatorEQ:
|
||||||
|
return balance == c.Value
|
||||||
|
default:
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
default:
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (t AnnouncementTargeting) NormalizeAndValidate() (AnnouncementTargeting, error) {
|
||||||
|
normalized := AnnouncementTargeting{AnyOf: make([]AnnouncementConditionGroup, 0, len(t.AnyOf))}
|
||||||
|
|
||||||
|
// 允许空 targeting（展示给所有用户）
|
||||||
|
if len(t.AnyOf) == 0 {
|
||||||
|
return normalized, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(t.AnyOf) > 50 {
|
||||||
|
return AnnouncementTargeting{}, ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, g := range t.AnyOf {
|
||||||
|
if len(g.AllOf) == 0 {
|
||||||
|
return AnnouncementTargeting{}, ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
if len(g.AllOf) > 50 {
|
||||||
|
return AnnouncementTargeting{}, ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
|
||||||
|
group := AnnouncementConditionGroup{AllOf: make([]AnnouncementCondition, 0, len(g.AllOf))}
|
||||||
|
for _, c := range g.AllOf {
|
||||||
|
cond := AnnouncementCondition{
|
||||||
|
Type: strings.TrimSpace(c.Type),
|
||||||
|
Operator: strings.TrimSpace(c.Operator),
|
||||||
|
Value: c.Value,
|
||||||
|
}
|
||||||
|
for _, gid := range c.GroupIDs {
|
||||||
|
if gid <= 0 {
|
||||||
|
return AnnouncementTargeting{}, ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
cond.GroupIDs = append(cond.GroupIDs, gid)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cond.validate(); err != nil {
|
||||||
|
return AnnouncementTargeting{}, err
|
||||||
|
}
|
||||||
|
group.AllOf = append(group.AllOf, cond)
|
||||||
|
}
|
||||||
|
|
||||||
|
normalized.AnyOf = append(normalized.AnyOf, group)
|
||||||
|
}
|
||||||
|
|
||||||
|
return normalized, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c AnnouncementCondition) validate() error {
|
||||||
|
switch c.Type {
|
||||||
|
case AnnouncementConditionTypeSubscription:
|
||||||
|
if c.Operator != AnnouncementOperatorIn {
|
||||||
|
return ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
if len(c.GroupIDs) == 0 {
|
||||||
|
return ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
|
||||||
|
case AnnouncementConditionTypeBalance:
|
||||||
|
switch c.Operator {
|
||||||
|
case AnnouncementOperatorGT, AnnouncementOperatorGTE, AnnouncementOperatorLT, AnnouncementOperatorLTE, AnnouncementOperatorEQ:
|
||||||
|
return nil
|
||||||
|
default:
|
||||||
|
return ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
|
||||||
|
default:
|
||||||
|
return ErrAnnouncementInvalidTarget
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
type Announcement struct {
|
||||||
|
ID int64
|
||||||
|
Title string
|
||||||
|
Content string
|
||||||
|
Status string
|
||||||
|
NotifyMode string
|
||||||
|
Targeting AnnouncementTargeting
|
||||||
|
StartsAt *time.Time
|
||||||
|
EndsAt *time.Time
|
||||||
|
CreatedBy *int64
|
||||||
|
UpdatedBy *int64
|
||||||
|
CreatedAt time.Time
|
||||||
|
UpdatedAt time.Time
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *Announcement) IsActiveAt(now time.Time) bool {
|
||||||
|
if a == nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if a.Status != AnnouncementStatusActive {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if a.StartsAt != nil && now.Before(*a.StartsAt) {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if a.EndsAt != nil && !now.Before(*a.EndsAt) {
|
||||||
|
// ends_at 语义：到点即下线
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
return true
|
||||||
|
}
|
||||||
140
internal/domain/constants.go
Normal file
140
internal/domain/constants.go
Normal file
@@ -0,0 +1,140 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
// Status constants
|
||||||
|
const (
|
||||||
|
StatusActive = "active"
|
||||||
|
StatusDisabled = "disabled"
|
||||||
|
StatusError = "error"
|
||||||
|
StatusUnused = "unused"
|
||||||
|
StatusUsed = "used"
|
||||||
|
StatusExpired = "expired"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Role constants
|
||||||
|
const (
|
||||||
|
RoleAdmin = "admin"
|
||||||
|
RoleUser = "user"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Platform constants
|
||||||
|
const (
|
||||||
|
PlatformAnthropic = "anthropic"
|
||||||
|
PlatformOpenAI = "openai"
|
||||||
|
PlatformGemini = "gemini"
|
||||||
|
PlatformAntigravity = "antigravity"
|
||||||
|
PlatformSora = "sora"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Account type constants
|
||||||
|
const (
|
||||||
|
AccountTypeOAuth = "oauth" // OAuth类型账号（full scope: profile + inference）
|
||||||
|
AccountTypeSetupToken = "setup-token" // Setup Token类型账号（inference only scope）
|
||||||
|
AccountTypeAPIKey = "apikey" // API Key类型账号
|
||||||
|
AccountTypeUpstream = "upstream" // 上游透传类型账号（通过 Base URL + API Key 连接上游）
|
||||||
|
AccountTypeBedrock = "bedrock" // AWS Bedrock 类型账号（通过 SigV4 签名或 API Key 连接 Bedrock，由 credentials.auth_mode 区分）
|
||||||
|
)
|
||||||
|
|
||||||
|
// Redeem type constants
|
||||||
|
const (
|
||||||
|
RedeemTypeBalance = "balance"
|
||||||
|
RedeemTypeConcurrency = "concurrency"
|
||||||
|
RedeemTypeSubscription = "subscription"
|
||||||
|
RedeemTypeInvitation = "invitation"
|
||||||
|
)
|
||||||
|
|
||||||
|
// PromoCode status constants
|
||||||
|
const (
|
||||||
|
PromoCodeStatusActive = "active"
|
||||||
|
PromoCodeStatusDisabled = "disabled"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Admin adjustment type constants
|
||||||
|
const (
|
||||||
|
AdjustmentTypeAdminBalance = "admin_balance" // 管理员调整余额
|
||||||
|
AdjustmentTypeAdminConcurrency = "admin_concurrency" // 管理员调整并发数
|
||||||
|
)
|
||||||
|
|
||||||
|
// Group subscription type constants
|
||||||
|
const (
|
||||||
|
SubscriptionTypeStandard = "standard" // 标准计费模式（按余额扣费）
|
||||||
|
SubscriptionTypeSubscription = "subscription" // 订阅模式（按限额控制）
|
||||||
|
)
|
||||||
|
|
||||||
|
// Subscription status constants
|
||||||
|
const (
|
||||||
|
SubscriptionStatusActive = "active"
|
||||||
|
SubscriptionStatusExpired = "expired"
|
||||||
|
SubscriptionStatusSuspended = "suspended"
|
||||||
|
)
|
||||||
|
|
||||||
|
// DefaultAntigravityModelMapping 是 Antigravity 平台的默认模型映射
|
||||||
|
// 当账号未配置 model_mapping 时使用此默认值
|
||||||
|
// 与前端 useModelWhitelist.ts 中的 antigravityDefaultMappings 保持一致
|
||||||
|
var DefaultAntigravityModelMapping = map[string]string{
|
||||||
|
// Claude 白名单
|
||||||
|
"claude-opus-4-6-thinking": "claude-opus-4-6-thinking", // 官方模型
|
||||||
|
"claude-opus-4-6": "claude-opus-4-6-thinking", // 简称映射
|
||||||
|
"claude-opus-4-5-thinking": "claude-opus-4-6-thinking", // 迁移旧模型
|
||||||
|
"claude-sonnet-4-6": "claude-sonnet-4-6",
|
||||||
|
"claude-sonnet-4-5": "claude-sonnet-4-5",
|
||||||
|
"claude-sonnet-4-5-thinking": "claude-sonnet-4-5-thinking",
|
||||||
|
// Claude 详细版本 ID 映射
|
||||||
|
"claude-opus-4-5-20251101": "claude-opus-4-6-thinking", // 迁移旧模型
|
||||||
|
"claude-sonnet-4-5-20250929": "claude-sonnet-4-5",
|
||||||
|
// Claude Haiku → Sonnet（无 Haiku 支持）
|
||||||
|
"claude-haiku-4-5": "claude-sonnet-4-6",
|
||||||
|
"claude-haiku-4-5-20251001": "claude-sonnet-4-6",
|
||||||
|
// Gemini 2.5 白名单
|
||||||
|
"gemini-2.5-flash": "gemini-2.5-flash",
|
||||||
|
"gemini-2.5-flash-image": "gemini-2.5-flash-image",
|
||||||
|
"gemini-2.5-flash-image-preview": "gemini-2.5-flash-image",
|
||||||
|
"gemini-2.5-flash-lite": "gemini-2.5-flash-lite",
|
||||||
|
"gemini-2.5-flash-thinking": "gemini-2.5-flash-thinking",
|
||||||
|
"gemini-2.5-pro": "gemini-2.5-pro",
|
||||||
|
// Gemini 3 白名单
|
||||||
|
"gemini-3-flash": "gemini-3-flash",
|
||||||
|
"gemini-3-pro-high": "gemini-3-pro-high",
|
||||||
|
"gemini-3-pro-low": "gemini-3-pro-low",
|
||||||
|
// Gemini 3 preview 映射
|
||||||
|
"gemini-3-flash-preview": "gemini-3-flash",
|
||||||
|
"gemini-3-pro-preview": "gemini-3-pro-high",
|
||||||
|
// Gemini 3.1 白名单
|
||||||
|
"gemini-3.1-pro-high": "gemini-3.1-pro-high",
|
||||||
|
"gemini-3.1-pro-low": "gemini-3.1-pro-low",
|
||||||
|
// Gemini 3.1 preview 映射
|
||||||
|
"gemini-3.1-pro-preview": "gemini-3.1-pro-high",
|
||||||
|
// Gemini 3.1 image 白名单
|
||||||
|
"gemini-3.1-flash-image": "gemini-3.1-flash-image",
|
||||||
|
// Gemini 3.1 image preview 映射
|
||||||
|
"gemini-3.1-flash-image-preview": "gemini-3.1-flash-image",
|
||||||
|
// Gemini 3 image 兼容映射（向 3.1 image 迁移）
|
||||||
|
"gemini-3-pro-image": "gemini-3.1-flash-image",
|
||||||
|
"gemini-3-pro-image-preview": "gemini-3.1-flash-image",
|
||||||
|
// 其他官方模型
|
||||||
|
"gpt-oss-120b-medium": "gpt-oss-120b-medium",
|
||||||
|
"tab_flash_lite_preview": "tab_flash_lite_preview",
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultBedrockModelMapping 是 AWS Bedrock 平台的默认模型映射
|
||||||
|
// 将 Anthropic 标准模型名映射到 Bedrock 模型 ID
|
||||||
|
// 注意：此处的 "us." 前缀仅为默认值，ResolveBedrockModelID 会根据账号配置的
|
||||||
|
// aws_region 自动调整为匹配的区域前缀（如 eu.、apac.、jp. 等）
|
||||||
|
var DefaultBedrockModelMapping = map[string]string{
|
||||||
|
// Claude Opus
|
||||||
|
"claude-opus-4-6-thinking": "us.anthropic.claude-opus-4-6-v1",
|
||||||
|
"claude-opus-4-6": "us.anthropic.claude-opus-4-6-v1",
|
||||||
|
"claude-opus-4-5-thinking": "us.anthropic.claude-opus-4-5-20251101-v1:0",
|
||||||
|
"claude-opus-4-5-20251101": "us.anthropic.claude-opus-4-5-20251101-v1:0",
|
||||||
|
"claude-opus-4-1": "us.anthropic.claude-opus-4-1-20250805-v1:0",
|
||||||
|
"claude-opus-4-20250514": "us.anthropic.claude-opus-4-20250514-v1:0",
|
||||||
|
// Claude Sonnet
|
||||||
|
"claude-sonnet-4-6-thinking": "us.anthropic.claude-sonnet-4-6",
|
||||||
|
"claude-sonnet-4-6": "us.anthropic.claude-sonnet-4-6",
|
||||||
|
"claude-sonnet-4-5": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
|
||||||
|
"claude-sonnet-4-5-thinking": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
|
||||||
|
"claude-sonnet-4-5-20250929": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
|
||||||
|
"claude-sonnet-4-20250514": "us.anthropic.claude-sonnet-4-20250514-v1:0",
|
||||||
|
// Claude Haiku
|
||||||
|
"claude-haiku-4-5": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
|
||||||
|
"claude-haiku-4-5-20251001": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
|
||||||
|
}
|
||||||
26
internal/domain/constants_test.go
Normal file
26
internal/domain/constants_test.go
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestDefaultAntigravityModelMapping_ImageCompatibilityAliases(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
cases := map[string]string{
|
||||||
|
"gemini-2.5-flash-image": "gemini-2.5-flash-image",
|
||||||
|
"gemini-2.5-flash-image-preview": "gemini-2.5-flash-image",
|
||||||
|
"gemini-3.1-flash-image": "gemini-3.1-flash-image",
|
||||||
|
"gemini-3.1-flash-image-preview": "gemini-3.1-flash-image",
|
||||||
|
"gemini-3-pro-image": "gemini-3.1-flash-image",
|
||||||
|
"gemini-3-pro-image-preview": "gemini-3.1-flash-image",
|
||||||
|
}
|
||||||
|
|
||||||
|
for from, want := range cases {
|
||||||
|
got, ok := DefaultAntigravityModelMapping[from]
|
||||||
|
if !ok {
|
||||||
|
t.Fatalf("expected mapping for %q to exist", from)
|
||||||
|
}
|
||||||
|
if got != want {
|
||||||
|
t.Fatalf("unexpected mapping for %q: got %q want %q", from, got, want)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
127
internal/domain/custom_field.go
Normal file
127
internal/domain/custom_field.go
Normal file
@@ -0,0 +1,127 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// CustomFieldType 自定义字段类型
|
||||||
|
type CustomFieldType int
|
||||||
|
|
||||||
|
const (
|
||||||
|
CustomFieldTypeString CustomFieldType = iota // 字符串
|
||||||
|
CustomFieldTypeNumber // 数字
|
||||||
|
CustomFieldTypeBoolean // 布尔
|
||||||
|
CustomFieldTypeDate // 日期
|
||||||
|
)
|
||||||
|
|
||||||
|
// CustomField 自定义字段定义
|
||||||
|
type CustomField struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Name string `gorm:"type:varchar(50);not null" json:"name"` // 字段名称
|
||||||
|
FieldKey string `gorm:"type:varchar(50);uniqueIndex;not null" json:"field_key"` // 字段标识符
|
||||||
|
Type CustomFieldType `gorm:"type:int;not null" json:"type"` // 字段类型
|
||||||
|
Required bool `gorm:"default:false" json:"required"` // 是否必填
|
||||||
|
DefaultVal string `gorm:"type:varchar(255)" json:"default_val"` // 默认值
|
||||||
|
MinLen int `gorm:"default:0" json:"min_len"` // 最小长度（字符串）
|
||||||
|
MaxLen int `gorm:"default:255" json:"max_len"` // 最大长度（字符串）
|
||||||
|
MinVal float64 `gorm:"default:0" json:"min_val"` // 最小值（数字）
|
||||||
|
MaxVal float64 `gorm:"default:0" json:"max_val"` // 最大值（数字）
|
||||||
|
Options string `gorm:"type:varchar(500)" json:"options"` // 选项列表（逗号分隔）
|
||||||
|
Sort int `gorm:"default:0" json:"sort"` // 排序
|
||||||
|
Status int `gorm:"type:int;default:1" json:"status"` // 状态：1启用 0禁用
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (CustomField) TableName() string {
|
||||||
|
return "custom_fields"
|
||||||
|
}
|
||||||
|
|
||||||
|
// UserCustomFieldValue 用户自定义字段值
|
||||||
|
type UserCustomFieldValue struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID int64 `gorm:"not null;index;uniqueIndex:idx_user_field" json:"user_id"`
|
||||||
|
FieldID int64 `gorm:"not null;index;uniqueIndex:idx_user_field" json:"field_id"`
|
||||||
|
FieldKey string `gorm:"type:varchar(50);not null" json:"field_key"` // 反规范化存储便于查询
|
||||||
|
Value string `gorm:"type:text" json:"value"` // 存储为字符串
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (UserCustomFieldValue) TableName() string {
|
||||||
|
return "user_custom_field_values"
|
||||||
|
}
|
||||||
|
|
||||||
|
// CustomFieldValueResponse 自定义字段值响应
|
||||||
|
type CustomFieldValueResponse struct {
|
||||||
|
FieldKey string `json:"field_key"`
|
||||||
|
Value interface{} `json:"value"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetValueAsInterface 根据字段类型返回解析后的值
|
||||||
|
func (v *UserCustomFieldValue) GetValueAsInterface(field *CustomField) interface{} {
|
||||||
|
switch field.Type {
|
||||||
|
case CustomFieldTypeString:
|
||||||
|
return v.Value
|
||||||
|
case CustomFieldTypeNumber:
|
||||||
|
var f float64
|
||||||
|
for _, c := range v.Value {
|
||||||
|
if c >= '0' && c <= '9' || c == '.' {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
return v.Value
|
||||||
|
}
|
||||||
|
if _, err := parseFloat(v.Value, &f); err == nil {
|
||||||
|
return f
|
||||||
|
}
|
||||||
|
return v.Value
|
||||||
|
case CustomFieldTypeBoolean:
|
||||||
|
return v.Value == "true" || v.Value == "1"
|
||||||
|
case CustomFieldTypeDate:
|
||||||
|
t, err := time.Parse("2006-01-02", v.Value)
|
||||||
|
if err == nil {
|
||||||
|
return t.Format("2006-01-02")
|
||||||
|
}
|
||||||
|
return v.Value
|
||||||
|
default:
|
||||||
|
return v.Value
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func parseFloat(s string, f *float64) (int, error) {
|
||||||
|
var sign, decimals int
|
||||||
|
varMantissa := 0
|
||||||
|
*f = 0
|
||||||
|
|
||||||
|
i := 0
|
||||||
|
if i < len(s) && s[i] == '-' {
|
||||||
|
sign = 1
|
||||||
|
i++
|
||||||
|
}
|
||||||
|
|
||||||
|
for ; i < len(s); i++ {
|
||||||
|
c := s[i]
|
||||||
|
if c == '.' {
|
||||||
|
decimals = 1
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if c < '0' || c > '9' {
|
||||||
|
return i, nil
|
||||||
|
}
|
||||||
|
n := float64(c - '0')
|
||||||
|
*f = *f*10 + n
|
||||||
|
varMantissa++
|
||||||
|
}
|
||||||
|
|
||||||
|
if decimals > 0 {
|
||||||
|
for ; decimals > 0; decimals-- {
|
||||||
|
*f /= 10
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if sign == 1 {
|
||||||
|
*f = -*f
|
||||||
|
}
|
||||||
|
|
||||||
|
return i, nil
|
||||||
|
}
|
||||||
45
internal/domain/device.go
Normal file
45
internal/domain/device.go
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// DeviceType 设备类型
|
||||||
|
type DeviceType int
|
||||||
|
|
||||||
|
const (
|
||||||
|
DeviceTypeUnknown DeviceType = iota
|
||||||
|
DeviceTypeWeb
|
||||||
|
DeviceTypeMobile
|
||||||
|
DeviceTypeDesktop
|
||||||
|
)
|
||||||
|
|
||||||
|
// DeviceStatus 设备状态
|
||||||
|
type DeviceStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
DeviceStatusInactive DeviceStatus = 0
|
||||||
|
DeviceStatusActive DeviceStatus = 1
|
||||||
|
)
|
||||||
|
|
||||||
|
// Device 设备模型
|
||||||
|
type Device struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID int64 `gorm:"not null;index" json:"user_id"`
|
||||||
|
DeviceID string `gorm:"type:varchar(100);uniqueIndex;not null" json:"device_id"`
|
||||||
|
DeviceName string `gorm:"type:varchar(100)" json:"device_name"`
|
||||||
|
DeviceType DeviceType `gorm:"type:int;default:0" json:"device_type"`
|
||||||
|
DeviceOS string `gorm:"type:varchar(50)" json:"device_os"`
|
||||||
|
DeviceBrowser string `gorm:"type:varchar(50)" json:"device_browser"`
|
||||||
|
IP string `gorm:"type:varchar(50)" json:"ip"`
|
||||||
|
Location string `gorm:"type:varchar(100)" json:"location"`
|
||||||
|
IsTrusted bool `gorm:"default:false" json:"is_trusted"` // 是否信任该设备
|
||||||
|
TrustExpiresAt *time.Time `gorm:"type:datetime" json:"trust_expires_at"` // 信任过期时间
|
||||||
|
Status DeviceStatus `gorm:"type:int;default:1" json:"status"`
|
||||||
|
LastActiveTime time.Time `json:"last_active_time"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (Device) TableName() string {
|
||||||
|
return "devices"
|
||||||
|
}
|
||||||
21
internal/domain/jwt_test.go
Normal file
21
internal/domain/jwt_test.go
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TestUserStatusConstantsExtra 测试用户状态常量（额外验证）
|
||||||
|
func TestUserStatusConstantsExtra(t *testing.T) {
|
||||||
|
if UserStatusInactive != 0 {
|
||||||
|
t.Errorf("UserStatusInactive = %d, want 0", UserStatusInactive)
|
||||||
|
}
|
||||||
|
if UserStatusActive != 1 {
|
||||||
|
t.Errorf("UserStatusActive = %d, want 1", UserStatusActive)
|
||||||
|
}
|
||||||
|
if UserStatusLocked != 2 {
|
||||||
|
t.Errorf("UserStatusLocked = %d, want 2", UserStatusLocked)
|
||||||
|
}
|
||||||
|
if UserStatusDisabled != 3 {
|
||||||
|
t.Errorf("UserStatusDisabled = %d, want 3", UserStatusDisabled)
|
||||||
|
}
|
||||||
|
}
|
||||||
31
internal/domain/login_log.go
Normal file
31
internal/domain/login_log.go
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// LoginType 登录方式
|
||||||
|
type LoginType int
|
||||||
|
|
||||||
|
const (
|
||||||
|
LoginTypePassword LoginType = 1 // 用户名/邮箱/手机 + 密码
|
||||||
|
LoginTypeEmailCode LoginType = 2 // 邮箱验证码
|
||||||
|
LoginTypeSMSCode LoginType = 3 // 手机验证码
|
||||||
|
LoginTypeOAuth LoginType = 4 // 第三方 OAuth
|
||||||
|
)
|
||||||
|
|
||||||
|
// LoginLog 登录日志
|
||||||
|
type LoginLog struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID *int64 `gorm:"index" json:"user_id,omitempty"`
|
||||||
|
LoginType int `gorm:"not null" json:"login_type"` // 1-密码, 2-邮箱验证码, 3-手机验证码, 4-OAuth
|
||||||
|
DeviceID string `gorm:"type:varchar(100)" json:"device_id"`
|
||||||
|
IP string `gorm:"type:varchar(50)" json:"ip"`
|
||||||
|
Location string `gorm:"type:varchar(100)" json:"location"`
|
||||||
|
Status int `gorm:"not null" json:"status"` // 0-失败, 1-成功
|
||||||
|
FailReason string `gorm:"type:varchar(255)" json:"fail_reason,omitempty"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (LoginLog) TableName() string {
|
||||||
|
return "login_logs"
|
||||||
|
}
|
||||||
23
internal/domain/operation_log.go
Normal file
23
internal/domain/operation_log.go
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// OperationLog 操作日志
|
||||||
|
type OperationLog struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID *int64 `gorm:"index" json:"user_id,omitempty"`
|
||||||
|
OperationType string `gorm:"type:varchar(50)" json:"operation_type"`
|
||||||
|
OperationName string `gorm:"type:varchar(100)" json:"operation_name"`
|
||||||
|
RequestMethod string `gorm:"type:varchar(10)" json:"request_method"`
|
||||||
|
RequestPath string `gorm:"type:varchar(200)" json:"request_path"`
|
||||||
|
RequestParams string `gorm:"type:text" json:"request_params"`
|
||||||
|
ResponseStatus int `json:"response_status"`
|
||||||
|
IP string `gorm:"type:varchar(50)" json:"ip"`
|
||||||
|
UserAgent string `gorm:"type:varchar(500)" json:"user_agent"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (OperationLog) TableName() string {
|
||||||
|
return "operation_logs"
|
||||||
|
}
|
||||||
16
internal/domain/password_history.go
Normal file
16
internal/domain/password_history.go
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// PasswordHistory 密码历史记录（防止重复使用旧密码）
|
||||||
|
type PasswordHistory struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID int64 `gorm:"not null;index" json:"user_id"`
|
||||||
|
PasswordHash string `gorm:"type:varchar(255);not null" json:"-"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (PasswordHistory) TableName() string {
|
||||||
|
return "password_histories"
|
||||||
|
}
|
||||||
74
internal/domain/permission.go
Normal file
74
internal/domain/permission.go
Normal file
@@ -0,0 +1,74 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// PermissionType 权限类型
|
||||||
|
type PermissionType int
|
||||||
|
|
||||||
|
const (
|
||||||
|
PermissionTypeMenu PermissionType = iota // 菜单
|
||||||
|
PermissionTypeButton // 按钮
|
||||||
|
PermissionTypeAPI // 接口
|
||||||
|
)
|
||||||
|
|
||||||
|
// PermissionStatus 权限状态
|
||||||
|
type PermissionStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
PermissionStatusDisabled PermissionStatus = 0 // 禁用
|
||||||
|
PermissionStatusEnabled PermissionStatus = 1 // 启用
|
||||||
|
)
|
||||||
|
|
||||||
|
// Permission 权限模型
|
||||||
|
type Permission struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Name string `gorm:"type:varchar(50);not null" json:"name"`
|
||||||
|
Code string `gorm:"type:varchar(100);uniqueIndex;not null" json:"code"`
|
||||||
|
Type PermissionType `gorm:"type:int;not null" json:"type"`
|
||||||
|
Description string `gorm:"type:varchar(200)" json:"description"`
|
||||||
|
ParentID *int64 `gorm:"index" json:"parent_id,omitempty"`
|
||||||
|
Level int `gorm:"default:1" json:"level"`
|
||||||
|
Path string `gorm:"type:varchar(200)" json:"path,omitempty"`
|
||||||
|
Method string `gorm:"type:varchar(10)" json:"method,omitempty"`
|
||||||
|
Sort int `gorm:"default:0" json:"sort"`
|
||||||
|
Icon string `gorm:"type:varchar(50)" json:"icon,omitempty"`
|
||||||
|
Status PermissionStatus `gorm:"type:int;default:1" json:"status"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
Children []*Permission `gorm:"-" json:"children,omitempty"` // 子权限，不持久化
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (Permission) TableName() string {
|
||||||
|
return "permissions"
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultPermissions 返回系统默认权限列表
|
||||||
|
func DefaultPermissions() []Permission {
|
||||||
|
return []Permission{
|
||||||
|
// 用户管理
|
||||||
|
{Name: "用户列表", Code: "user:list", Type: PermissionTypeAPI, Path: "/api/v1/users", Method: "GET", Sort: 10, Status: PermissionStatusEnabled, Description: "查看用户列表"},
|
||||||
|
{Name: "查看用户", Code: "user:view", Type: PermissionTypeAPI, Path: "/api/v1/users/:id", Method: "GET", Sort: 11, Status: PermissionStatusEnabled, Description: "查看用户详情"},
|
||||||
|
{Name: "编辑用户", Code: "user:edit", Type: PermissionTypeAPI, Path: "/api/v1/users/:id", Method: "PUT", Sort: 12, Status: PermissionStatusEnabled, Description: "编辑用户信息"},
|
||||||
|
{Name: "删除用户", Code: "user:delete", Type: PermissionTypeAPI, Path: "/api/v1/users/:id", Method: "DELETE", Sort: 13, Status: PermissionStatusEnabled, Description: "删除用户"},
|
||||||
|
{Name: "管理用户", Code: "user:manage", Type: PermissionTypeAPI, Path: "/api/v1/users/:id/status", Method: "PUT", Sort: 14, Status: PermissionStatusEnabled, Description: "管理用户状态和角色"},
|
||||||
|
// 个人资料
|
||||||
|
{Name: "查看资料", Code: "profile:view", Type: PermissionTypeAPI, Path: "/api/v1/auth/userinfo", Method: "GET", Sort: 20, Status: PermissionStatusEnabled, Description: "查看个人资料"},
|
||||||
|
{Name: "编辑资料", Code: "profile:edit", Type: PermissionTypeAPI, Path: "/api/v1/users/:id", Method: "PUT", Sort: 21, Status: PermissionStatusEnabled, Description: "编辑个人资料"},
|
||||||
|
{Name: "修改密码", Code: "profile:change_password", Type: PermissionTypeAPI, Path: "/api/v1/users/:id/password", Method: "PUT", Sort: 22, Status: PermissionStatusEnabled, Description: "修改密码"},
|
||||||
|
// 角色管理
|
||||||
|
{Name: "角色管理", Code: "role:manage", Type: PermissionTypeAPI, Path: "/api/v1/roles", Method: "GET", Sort: 30, Status: PermissionStatusEnabled, Description: "管理角色"},
|
||||||
|
{Name: "创建角色", Code: "role:create", Type: PermissionTypeAPI, Path: "/api/v1/roles", Method: "POST", Sort: 31, Status: PermissionStatusEnabled, Description: "创建角色"},
|
||||||
|
{Name: "编辑角色", Code: "role:edit", Type: PermissionTypeAPI, Path: "/api/v1/roles/:id", Method: "PUT", Sort: 32, Status: PermissionStatusEnabled, Description: "编辑角色"},
|
||||||
|
{Name: "删除角色", Code: "role:delete", Type: PermissionTypeAPI, Path: "/api/v1/roles/:id", Method: "DELETE", Sort: 33, Status: PermissionStatusEnabled, Description: "删除角色"},
|
||||||
|
// 权限管理
|
||||||
|
{Name: "权限管理", Code: "permission:manage", Type: PermissionTypeAPI, Path: "/api/v1/permissions", Method: "GET", Sort: 40, Status: PermissionStatusEnabled, Description: "管理权限"},
|
||||||
|
// 日志查看
|
||||||
|
{Name: "查看自己的日志", Code: "log:view_own", Type: PermissionTypeAPI, Path: "/api/v1/logs/login/me", Method: "GET", Sort: 50, Status: PermissionStatusEnabled, Description: "查看个人登录日志"},
|
||||||
|
{Name: "查看所有日志", Code: "log:view_all", Type: PermissionTypeAPI, Path: "/api/v1/logs/login", Method: "GET", Sort: 51, Status: PermissionStatusEnabled, Description: "查看全部日志（管理员）"},
|
||||||
|
// 系统统计
|
||||||
|
{Name: "仪表盘统计", Code: "stats:view", Type: PermissionTypeAPI, Path: "/api/v1/admin/stats/dashboard", Method: "GET", Sort: 60, Status: PermissionStatusEnabled, Description: "查看系统统计数据"},
|
||||||
|
// 设备管理
|
||||||
|
{Name: "设备管理", Code: "device:manage", Type: PermissionTypeAPI, Path: "/api/v1/devices", Method: "GET", Sort: 70, Status: PermissionStatusEnabled, Description: "管理设备"},
|
||||||
|
}
|
||||||
|
}
|
||||||
57
internal/domain/role.go
Normal file
57
internal/domain/role.go
Normal file
@@ -0,0 +1,57 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// RoleStatus 角色状态
|
||||||
|
type RoleStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
RoleStatusDisabled RoleStatus = 0 // 禁用
|
||||||
|
RoleStatusEnabled RoleStatus = 1 // 启用
|
||||||
|
)
|
||||||
|
|
||||||
|
// Role 角色模型
|
||||||
|
type Role struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Name string `gorm:"type:varchar(50);uniqueIndex;not null" json:"name"`
|
||||||
|
Code string `gorm:"type:varchar(50);uniqueIndex;not null" json:"code"`
|
||||||
|
Description string `gorm:"type:varchar(200)" json:"description"`
|
||||||
|
ParentID *int64 `gorm:"index" json:"parent_id,omitempty"`
|
||||||
|
Level int `gorm:"default:1;index" json:"level"`
|
||||||
|
IsSystem bool `gorm:"default:false" json:"is_system"` // 是否系统角色
|
||||||
|
IsDefault bool `gorm:"default:false;index" json:"is_default"` // 是否默认角色
|
||||||
|
Status RoleStatus `gorm:"type:int;default:1" json:"status"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (Role) TableName() string {
|
||||||
|
return "roles"
|
||||||
|
}
|
||||||
|
|
||||||
|
// PredefinedRoles 预定义角色
|
||||||
|
var PredefinedRoles = []Role{
|
||||||
|
{
|
||||||
|
ID: 1,
|
||||||
|
Name: "管理员",
|
||||||
|
Code: "admin",
|
||||||
|
Description: "系统管理员角色，拥有所有权限",
|
||||||
|
ParentID: nil,
|
||||||
|
Level: 1,
|
||||||
|
IsSystem: true,
|
||||||
|
IsDefault: false,
|
||||||
|
Status: RoleStatusEnabled,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ID: 2,
|
||||||
|
Name: "普通用户",
|
||||||
|
Code: "user",
|
||||||
|
Description: "普通用户角色，基本权限",
|
||||||
|
ParentID: nil,
|
||||||
|
Level: 1,
|
||||||
|
IsSystem: true,
|
||||||
|
IsDefault: true,
|
||||||
|
Status: RoleStatusEnabled,
|
||||||
|
},
|
||||||
|
}
|
||||||
16
internal/domain/role_permission.go
Normal file
16
internal/domain/role_permission.go
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// RolePermission 角色-权限关联
|
||||||
|
type RolePermission struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
RoleID int64 `gorm:"not null;index:idx_role_perm;index:idx_rp_role" json:"role_id"`
|
||||||
|
PermissionID int64 `gorm:"not null;index:idx_role_perm;index:idx_rp_perm" json:"permission_id"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (RolePermission) TableName() string {
|
||||||
|
return "role_permissions"
|
||||||
|
}
|
||||||
78
internal/domain/social_account.go
Normal file
78
internal/domain/social_account.go
Normal file
@@ -0,0 +1,78 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import (
|
||||||
|
"database/sql/driver"
|
||||||
|
"encoding/json"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SocialAccount models a persisted OAuth binding.
|
||||||
|
type SocialAccount struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID int64 `gorm:"index;not null" json:"user_id"`
|
||||||
|
Provider string `gorm:"type:varchar(50);not null" json:"provider"`
|
||||||
|
OpenID string `gorm:"type:varchar(100);not null" json:"open_id"`
|
||||||
|
UnionID string `gorm:"type:varchar(100)" json:"union_id,omitempty"`
|
||||||
|
Nickname string `gorm:"type:varchar(100)" json:"nickname"`
|
||||||
|
Avatar string `gorm:"type:varchar(500)" json:"avatar"`
|
||||||
|
Gender string `gorm:"type:varchar(10)" json:"gender,omitempty"`
|
||||||
|
Email string `gorm:"type:varchar(100)" json:"email,omitempty"`
|
||||||
|
Phone string `gorm:"type:varchar(20)" json:"phone,omitempty"`
|
||||||
|
Extra ExtraData `gorm:"type:text" json:"extra,omitempty"`
|
||||||
|
Status SocialAccountStatus `gorm:"default:1" json:"status"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
UpdatedAt time.Time `json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (SocialAccount) TableName() string {
|
||||||
|
return "user_social_accounts"
|
||||||
|
}
|
||||||
|
|
||||||
|
type SocialAccountStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
SocialAccountStatusActive SocialAccountStatus = 1
|
||||||
|
SocialAccountStatusInactive SocialAccountStatus = 0
|
||||||
|
SocialAccountStatusDisabled SocialAccountStatus = 2
|
||||||
|
)
|
||||||
|
|
||||||
|
type ExtraData map[string]interface{}
|
||||||
|
|
||||||
|
func (e ExtraData) Value() (driver.Value, error) {
|
||||||
|
if e == nil {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
return json.Marshal(e)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *ExtraData) Scan(value interface{}) error {
|
||||||
|
if value == nil {
|
||||||
|
*e = nil
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
bytes, ok := value.([]byte)
|
||||||
|
if !ok {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return json.Unmarshal(bytes, e)
|
||||||
|
}
|
||||||
|
|
||||||
|
type SocialAccountInfo struct {
|
||||||
|
ID int64 `json:"id"`
|
||||||
|
Provider string `json:"provider"`
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
Avatar string `json:"avatar"`
|
||||||
|
Status SocialAccountStatus `json:"status"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *SocialAccount) ToInfo() *SocialAccountInfo {
|
||||||
|
return &SocialAccountInfo{
|
||||||
|
ID: s.ID,
|
||||||
|
Provider: s.Provider,
|
||||||
|
Nickname: s.Nickname,
|
||||||
|
Avatar: s.Avatar,
|
||||||
|
Status: s.Status,
|
||||||
|
CreatedAt: s.CreatedAt,
|
||||||
|
}
|
||||||
|
}
|
||||||
10
internal/domain/social_account_test.go
Normal file
10
internal/domain/social_account_test.go
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestSocialAccountTableName(t *testing.T) {
|
||||||
|
var account SocialAccount
|
||||||
|
if account.TableName() != "user_social_accounts" {
|
||||||
|
t.Fatalf("unexpected table name: %s", account.TableName())
|
||||||
|
}
|
||||||
|
}
|
||||||
39
internal/domain/theme.go
Normal file
39
internal/domain/theme.go
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// ThemeConfig 主题配置
|
||||||
|
type ThemeConfig struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Name string `gorm:"type:varchar(50);uniqueIndex;not null" json:"name"` // 主题名称
|
||||||
|
IsDefault bool `gorm:"default:false" json:"is_default"` // 是否默认主题
|
||||||
|
LogoURL string `gorm:"type:varchar(500)" json:"logo_url"` // Logo URL
|
||||||
|
FaviconURL string `gorm:"type:varchar(500)" json:"favicon_url"` // Favicon URL
|
||||||
|
PrimaryColor string `gorm:"type:varchar(20)" json:"primary_color"` // 主色调（如 #1890ff）
|
||||||
|
SecondaryColor string `gorm:"type:varchar(20)" json:"secondary_color"` // 辅助色
|
||||||
|
BackgroundColor string `gorm:"type:varchar(20)" json:"background_color"` // 背景色
|
||||||
|
TextColor string `gorm:"type:varchar(20)" json:"text_color"` // 文字颜色
|
||||||
|
CustomCSS string `gorm:"type:text" json:"custom_css"` // 自定义CSS
|
||||||
|
CustomJS string `gorm:"type:text" json:"custom_js"` // 自定义JS
|
||||||
|
Enabled bool `gorm:"default:true" json:"enabled"` // 是否启用
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (ThemeConfig) TableName() string {
|
||||||
|
return "theme_configs"
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultThemeConfig 返回默认主题配置
|
||||||
|
func DefaultThemeConfig() *ThemeConfig {
|
||||||
|
return &ThemeConfig{
|
||||||
|
Name: "default",
|
||||||
|
IsDefault: true,
|
||||||
|
PrimaryColor: "#1890ff",
|
||||||
|
SecondaryColor: "#52c41a",
|
||||||
|
BackgroundColor: "#ffffff",
|
||||||
|
TextColor: "#333333",
|
||||||
|
Enabled: true,
|
||||||
|
}
|
||||||
|
}
|
||||||
70
internal/domain/user.go
Normal file
70
internal/domain/user.go
Normal file
@@ -0,0 +1,70 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// StrPtr 将 string 转为 *string（空字符串返回 nil，用于可选的 unique 字段）
|
||||||
|
func StrPtr(s string) *string {
|
||||||
|
if s == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return &s
|
||||||
|
}
|
||||||
|
|
||||||
|
// DerefStr 安全解引用 *string，nil 返回空字符串
|
||||||
|
func DerefStr(s *string) string {
|
||||||
|
if s == nil {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
return *s
|
||||||
|
}
|
||||||
|
|
||||||
|
// Gender 性别
|
||||||
|
type Gender int
|
||||||
|
|
||||||
|
const (
|
||||||
|
GenderUnknown Gender = iota // 未知
|
||||||
|
GenderMale // 男
|
||||||
|
GenderFemale // 女
|
||||||
|
)
|
||||||
|
|
||||||
|
// UserStatus 用户状态
|
||||||
|
type UserStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
UserStatusInactive UserStatus = 0 // 未激活
|
||||||
|
UserStatusActive UserStatus = 1 // 已激活
|
||||||
|
UserStatusLocked UserStatus = 2 // 已锁定
|
||||||
|
UserStatusDisabled UserStatus = 3 // 已禁用
|
||||||
|
)
|
||||||
|
|
||||||
|
// User 用户模型
|
||||||
|
type User struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Username string `gorm:"type:varchar(50);uniqueIndex;not null" json:"username"`
|
||||||
|
// Email/Phone 使用指针类型：nil 存储为 NULL，允许多个用户没有邮箱/手机（唯一约束对 NULL 不生效）
|
||||||
|
Email *string `gorm:"type:varchar(100);uniqueIndex" json:"email"`
|
||||||
|
Phone *string `gorm:"type:varchar(20);uniqueIndex" json:"phone"`
|
||||||
|
Nickname string `gorm:"type:varchar(50)" json:"nickname"`
|
||||||
|
Avatar string `gorm:"type:varchar(255)" json:"avatar"`
|
||||||
|
Password string `gorm:"type:varchar(255)" json:"-"`
|
||||||
|
Gender Gender `gorm:"type:int;default:0" json:"gender"`
|
||||||
|
Birthday *time.Time `gorm:"type:date" json:"birthday,omitempty"`
|
||||||
|
Region string `gorm:"type:varchar(50)" json:"region"`
|
||||||
|
Bio string `gorm:"type:varchar(500)" json:"bio"`
|
||||||
|
Status UserStatus `gorm:"type:int;default:0;index" json:"status"`
|
||||||
|
LastLoginTime *time.Time `json:"last_login_time,omitempty"`
|
||||||
|
LastLoginIP string `gorm:"type:varchar(50)" json:"last_login_ip"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
DeletedAt *time.Time `gorm:"index" json:"deleted_at,omitempty"`
|
||||||
|
|
||||||
|
// 2FA / TOTP 字段
|
||||||
|
TOTPEnabled bool `gorm:"default:false" json:"totp_enabled"`
|
||||||
|
TOTPSecret string `gorm:"type:varchar(64)" json:"-"` // Base32 密钥，不返回给前端
|
||||||
|
TOTPRecoveryCodes string `gorm:"type:text" json:"-"` // JSON 编码的恢复码列表
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (User) TableName() string {
|
||||||
|
return "users"
|
||||||
|
}
|
||||||
16
internal/domain/user_role.go
Normal file
16
internal/domain/user_role.go
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// UserRole 用户-角色关联
|
||||||
|
type UserRole struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
UserID int64 `gorm:"not null;index:idx_user_role;index:idx_user" json:"user_id"`
|
||||||
|
RoleID int64 `gorm:"not null;index:idx_user_role;index:idx_role" json:"role_id"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (UserRole) TableName() string {
|
||||||
|
return "user_roles"
|
||||||
|
}
|
||||||
81
internal/domain/user_test.go
Normal file
81
internal/domain/user_test.go
Normal file
@@ -0,0 +1,81 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TestUserModel 测试User模型基本属性
|
||||||
|
func TestUserModel(t *testing.T) {
|
||||||
|
u := &User{
|
||||||
|
Username: "testuser",
|
||||||
|
Email: StrPtr("test@example.com"),
|
||||||
|
Phone: StrPtr("13800138000"),
|
||||||
|
Password: "hashedpassword",
|
||||||
|
Status: UserStatusActive,
|
||||||
|
Gender: GenderMale,
|
||||||
|
CreatedAt: time.Now(),
|
||||||
|
}
|
||||||
|
if u.Username != "testuser" {
|
||||||
|
t.Errorf("Username = %v, want testuser", u.Username)
|
||||||
|
}
|
||||||
|
if u.Status != UserStatusActive {
|
||||||
|
t.Errorf("Status = %v, want %v", u.Status, UserStatusActive)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestUserTableName 测试User表名
|
||||||
|
func TestUserTableName(t *testing.T) {
|
||||||
|
u := User{}
|
||||||
|
if u.TableName() != "users" {
|
||||||
|
t.Errorf("TableName() = %v, want users", u.TableName())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestUserStatusConstants 测试用户状态常量值
|
||||||
|
func TestUserStatusConstants(t *testing.T) {
|
||||||
|
cases := []struct {
|
||||||
|
status UserStatus
|
||||||
|
value int
|
||||||
|
}{
|
||||||
|
{UserStatusInactive, 0},
|
||||||
|
{UserStatusActive, 1},
|
||||||
|
{UserStatusLocked, 2},
|
||||||
|
{UserStatusDisabled, 3},
|
||||||
|
}
|
||||||
|
for _, c := range cases {
|
||||||
|
if int(c.status) != c.value {
|
||||||
|
t.Errorf("UserStatus = %d, want %d", c.status, c.value)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestGenderConstants 测试性别常量
|
||||||
|
func TestGenderConstants(t *testing.T) {
|
||||||
|
if int(GenderUnknown) != 0 {
|
||||||
|
t.Errorf("GenderUnknown = %d, want 0", GenderUnknown)
|
||||||
|
}
|
||||||
|
if int(GenderMale) != 1 {
|
||||||
|
t.Errorf("GenderMale = %d, want 1", GenderMale)
|
||||||
|
}
|
||||||
|
if int(GenderFemale) != 2 {
|
||||||
|
t.Errorf("GenderFemale = %d, want 2", GenderFemale)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestUserActiveCheck 测试用户激活状态检查
|
||||||
|
func TestUserActiveCheck(t *testing.T) {
|
||||||
|
active := &User{Status: UserStatusActive}
|
||||||
|
inactive := &User{Status: UserStatusInactive}
|
||||||
|
locked := &User{Status: UserStatusLocked}
|
||||||
|
disabled := &User{Status: UserStatusDisabled}
|
||||||
|
|
||||||
|
if active.Status != UserStatusActive {
|
||||||
|
t.Error("active用户应为Active状态")
|
||||||
|
}
|
||||||
|
if inactive.Status == UserStatusActive {
|
||||||
|
t.Error("inactive用户不应为Active状态")
|
||||||
|
}
|
||||||
|
_ = locked
|
||||||
|
_ = disabled
|
||||||
|
}
|
||||||
69
internal/domain/webhook.go
Normal file
69
internal/domain/webhook.go
Normal file
@@ -0,0 +1,69 @@
|
|||||||
|
package domain
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// WebhookEventType Webhook 事件类型
|
||||||
|
type WebhookEventType string
|
||||||
|
|
||||||
|
const (
|
||||||
|
EventUserRegistered WebhookEventType = "user.registered"
|
||||||
|
EventUserLogin WebhookEventType = "user.login"
|
||||||
|
EventUserLogout WebhookEventType = "user.logout"
|
||||||
|
EventUserUpdated WebhookEventType = "user.updated"
|
||||||
|
EventUserDeleted WebhookEventType = "user.deleted"
|
||||||
|
EventUserLocked WebhookEventType = "user.locked"
|
||||||
|
EventPasswordChanged WebhookEventType = "user.password_changed"
|
||||||
|
EventPasswordReset WebhookEventType = "user.password_reset"
|
||||||
|
EventTOTPEnabled WebhookEventType = "user.totp_enabled"
|
||||||
|
EventTOTPDisabled WebhookEventType = "user.totp_disabled"
|
||||||
|
EventLoginFailed WebhookEventType = "user.login_failed"
|
||||||
|
EventAnomalyDetected WebhookEventType = "security.anomaly_detected"
|
||||||
|
)
|
||||||
|
|
||||||
|
// WebhookStatus Webhook 状态
|
||||||
|
type WebhookStatus int
|
||||||
|
|
||||||
|
const (
|
||||||
|
WebhookStatusActive WebhookStatus = 1
|
||||||
|
WebhookStatusInactive WebhookStatus = 0
|
||||||
|
)
|
||||||
|
|
||||||
|
// Webhook Webhook 配置
|
||||||
|
type Webhook struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
Name string `gorm:"type:varchar(100);not null" json:"name"`
|
||||||
|
URL string `gorm:"type:varchar(500);not null" json:"url"`
|
||||||
|
Secret string `gorm:"type:varchar(255)" json:"-"` // HMAC 签名密钥，不返回给前端
|
||||||
|
Events string `gorm:"type:text" json:"events"` // JSON 数组，订阅的事件类型
|
||||||
|
Status WebhookStatus `gorm:"default:1" json:"status"`
|
||||||
|
MaxRetries int `gorm:"default:3" json:"max_retries"`
|
||||||
|
TimeoutSec int `gorm:"default:10" json:"timeout_sec"`
|
||||||
|
CreatedBy int64 `gorm:"index" json:"created_by"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (Webhook) TableName() string {
|
||||||
|
return "webhooks"
|
||||||
|
}
|
||||||
|
|
||||||
|
// WebhookDelivery Webhook 投递记录
|
||||||
|
type WebhookDelivery struct {
|
||||||
|
ID int64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||||
|
WebhookID int64 `gorm:"index" json:"webhook_id"`
|
||||||
|
EventType WebhookEventType `gorm:"type:varchar(100)" json:"event_type"`
|
||||||
|
Payload string `gorm:"type:text" json:"payload"`
|
||||||
|
StatusCode int `json:"status_code"`
|
||||||
|
ResponseBody string `gorm:"type:text" json:"response_body"`
|
||||||
|
Attempt int `gorm:"default:1" json:"attempt"`
|
||||||
|
Success bool `gorm:"default:false" json:"success"`
|
||||||
|
Error string `gorm:"type:text" json:"error"`
|
||||||
|
DeliveredAt *time.Time `json:"delivered_at,omitempty"`
|
||||||
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// TableName 指定表名
|
||||||
|
func (WebhookDelivery) TableName() string {
|
||||||
|
return "webhook_deliveries"
|
||||||
|
}
|
||||||
607
internal/e2e/e2e_advanced_test.go
Normal file
607
internal/e2e/e2e_advanced_test.go
Normal file
@@ -0,0 +1,607 @@
|
|||||||
|
package e2e
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ============================================================
|
||||||
|
// 阶段 E：E2E 集成测试 — 补充覆盖
|
||||||
|
// ============================================================
|
||||||
|
|
||||||
|
// TestE2ETokenRefresh Token 刷新完整流程
|
||||||
|
func TestE2ETokenRefresh(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "refresh_user",
|
||||||
|
"password": "RefreshPass1!",
|
||||||
|
"email": "refreshuser@example.com",
|
||||||
|
})
|
||||||
|
|
||||||
|
loginResp := doPost(t, base+"/api/v1/auth/login", nil, map[string]interface{}{
|
||||||
|
"account": "refresh_user",
|
||||||
|
"password": "RefreshPass1!",
|
||||||
|
})
|
||||||
|
var loginResult map[string]interface{}
|
||||||
|
decodeJSON(t, loginResp.Body, &loginResult)
|
||||||
|
if loginResult["access_token"] == nil || loginResult["refresh_token"] == nil {
|
||||||
|
t.Fatalf("登录响应缺少 token 字段")
|
||||||
|
}
|
||||||
|
accessToken := fmt.Sprintf("%v", loginResult["access_token"])
|
||||||
|
refreshToken := fmt.Sprintf("%v", loginResult["refresh_token"])
|
||||||
|
|
||||||
|
if accessToken == "" || refreshToken == "" {
|
||||||
|
t.Fatalf("access_token=%q refresh_token=%q 均不应为空", accessToken, refreshToken)
|
||||||
|
}
|
||||||
|
t.Logf("登录成功，access_token 和 refresh_token 均已获取")
|
||||||
|
|
||||||
|
// 使用 refresh_token 换取新的 access_token
|
||||||
|
refreshResp := doPost(t, base+"/api/v1/auth/refresh", nil, map[string]interface{}{
|
||||||
|
"refresh_token": refreshToken,
|
||||||
|
})
|
||||||
|
if refreshResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("Token 刷新失败，HTTP %d", refreshResp.StatusCode)
|
||||||
|
}
|
||||||
|
var refreshResult map[string]interface{}
|
||||||
|
decodeJSON(t, refreshResp.Body, &refreshResult)
|
||||||
|
if refreshResult["access_token"] == nil {
|
||||||
|
t.Fatal("Token 刷新响应缺少 access_token")
|
||||||
|
}
|
||||||
|
newAccessToken := fmt.Sprintf("%v", refreshResult["access_token"])
|
||||||
|
if newAccessToken == "" {
|
||||||
|
t.Fatal("刷新后 access_token 不应为空")
|
||||||
|
}
|
||||||
|
t.Logf("Token 刷新成功，新 access_token 长度=%d", len(newAccessToken))
|
||||||
|
|
||||||
|
// 用新 Token 访问受保护接口
|
||||||
|
infoResp := doGet(t, base+"/api/v1/auth/userinfo", newAccessToken)
|
||||||
|
if infoResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("新 Token 访问 userinfo 失败，HTTP %d", infoResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("新 Token 可正常访问受保护接口")
|
||||||
|
|
||||||
|
// 无效 refresh_token 应被拒绝
|
||||||
|
badResp := doPost(t, base+"/api/v1/auth/refresh", nil, map[string]interface{}{
|
||||||
|
"refresh_token": "invalid.refresh.token",
|
||||||
|
})
|
||||||
|
if badResp.StatusCode == http.StatusOK {
|
||||||
|
t.Fatal("无效 refresh_token 不应刷新成功")
|
||||||
|
}
|
||||||
|
t.Logf("无效 refresh_token 正确拒绝: HTTP %d", badResp.StatusCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2ELogoutInvalidatesToken 登出后 Token 应失效
|
||||||
|
func TestE2ELogoutInvalidatesToken(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "logout_inv_user",
|
||||||
|
"password": "LogoutInv1!",
|
||||||
|
"email": "logoutinv@example.com",
|
||||||
|
})
|
||||||
|
|
||||||
|
token := mustLogin(t, base, "logout_inv_user", "LogoutInv1!")["access_token"]
|
||||||
|
|
||||||
|
// 登出
|
||||||
|
logoutResp := doPost(t, base+"/api/v1/auth/logout", token, nil)
|
||||||
|
if logoutResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("登出失败，HTTP %d", logoutResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("登出成功")
|
||||||
|
|
||||||
|
// 用已失效 Token 访问 —— 应返回 401
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/userinfo", token)
|
||||||
|
if resp.StatusCode != http.StatusUnauthorized {
|
||||||
|
t.Logf("注意：登出后访问返回 HTTP %d（期望 401，黑名单可能需要 TTL 传播）", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Log("登出后 Token 已正确失效")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2ERBACProtectedRoutes RBAC 权限拦截 E2E
|
||||||
|
func TestE2ERBACProtectedRoutes(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "rbac_normal",
|
||||||
|
"password": "RbacNorm1!",
|
||||||
|
"email": "rbacnorm@example.com",
|
||||||
|
})
|
||||||
|
normalToken := mustLogin(t, base, "rbac_normal", "RbacNorm1!")["access_token"]
|
||||||
|
|
||||||
|
t.Run("普通用户无法访问角色管理", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/roles", normalToken)
|
||||||
|
if resp.StatusCode < http.StatusUnauthorized {
|
||||||
|
t.Errorf("普通用户访问角色管理应被拒绝，实际 HTTP %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Logf("角色管理被正确拒绝: HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("普通用户无法访问管理员导出接口", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/admin/users/export", normalToken)
|
||||||
|
if resp.StatusCode < http.StatusUnauthorized {
|
||||||
|
t.Errorf("普通用户访问 admin 导出应被拒绝，实际 HTTP %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Logf("admin 导出被正确拒绝，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("未认证用户访问受保护接口 401", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/userinfo", "")
|
||||||
|
if resp.StatusCode != http.StatusUnauthorized {
|
||||||
|
t.Errorf("期望 401，实际 %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Log("未认证访问正确返回 401")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("带有效 Token 的普通用户可访问自身信息", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/userinfo", normalToken)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Errorf("期望 200，实际 %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Log("普通用户访问自身信息成功")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2ETOTPFlow TOTP 2FA 完整流程（setup → enable → verify → disable）
|
||||||
|
func TestE2ETOTPFlow(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "totp_user",
|
||||||
|
"password": "TOTPuser1!",
|
||||||
|
"email": "totpuser@example.com",
|
||||||
|
})
|
||||||
|
token := mustLogin(t, base, "totp_user", "TOTPuser1!")["access_token"]
|
||||||
|
|
||||||
|
t.Run("TOTP状态查询", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/2fa/status", token)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("TOTP 状态接口失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
var result map[string]interface{}
|
||||||
|
decodeJSON(t, resp.Body, &result)
|
||||||
|
t.Logf("TOTP 状态查询成功: %v", result)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("TOTP Setup获取密钥", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/2fa/setup", token)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("TOTP setup 失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
var result map[string]interface{}
|
||||||
|
decodeJSON(t, resp.Body, &result)
|
||||||
|
totpSecret := fmt.Sprintf("%v", result["secret"])
|
||||||
|
if totpSecret == "" {
|
||||||
|
t.Fatal("TOTP setup 响应缺少 secret")
|
||||||
|
}
|
||||||
|
t.Logf("TOTP secret 已获取，长度=%d", len(totpSecret))
|
||||||
|
if _, ok := result["recovery_codes"]; !ok {
|
||||||
|
t.Error("TOTP setup 应返回 recovery_codes")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("TOTP Enable（使用实时OTP）", func(t *testing.T) {
|
||||||
|
// 获取 secret
|
||||||
|
setupResp := doGet(t, base+"/api/v1/auth/2fa/setup", token)
|
||||||
|
if setupResp.StatusCode != http.StatusOK {
|
||||||
|
t.Skip("TOTP setup 失败，跳过")
|
||||||
|
}
|
||||||
|
var setupResult map[string]interface{}
|
||||||
|
decodeJSON(t, setupResp.Body, &setupResult)
|
||||||
|
totpSecret := fmt.Sprintf("%v", setupResult["secret"])
|
||||||
|
if totpSecret == "" {
|
||||||
|
t.Skip("TOTP secret 未获取，跳过")
|
||||||
|
}
|
||||||
|
code := generateTOTPCode(totpSecret)
|
||||||
|
enableResp := doPost(t, base+"/api/v1/auth/2fa/enable", token, map[string]interface{}{
|
||||||
|
"code": code,
|
||||||
|
})
|
||||||
|
if enableResp.StatusCode != http.StatusOK {
|
||||||
|
t.Logf("TOTP Enable HTTP %d（OTP 可能因时钟偏差失败，视为非致命）", enableResp.StatusCode)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
t.Log("TOTP Enable 成功")
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EWebhookCRUD Webhook 创建/查询/更新/删除完整流程
|
||||||
|
func TestE2EWebhookCRUD(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "webhook_user",
|
||||||
|
"password": "WebhookUser1!",
|
||||||
|
"email": "webhookuser@example.com",
|
||||||
|
})
|
||||||
|
token := mustLogin(t, base, "webhook_user", "WebhookUser1!")["access_token"]
|
||||||
|
|
||||||
|
var webhookID float64
|
||||||
|
t.Run("创建Webhook", func(t *testing.T) {
|
||||||
|
resp := doPost(t, base+"/api/v1/webhooks", token, map[string]interface{}{
|
||||||
|
"url": "https://example.com/webhook",
|
||||||
|
"secret": "my-secret-key",
|
||||||
|
"events": []string{"user.created", "user.updated"},
|
||||||
|
"name": "测试 Webhook",
|
||||||
|
})
|
||||||
|
if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("创建 Webhook 失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
var result map[string]interface{}
|
||||||
|
decodeJSON(t, resp.Body, &result)
|
||||||
|
if result["id"] != nil {
|
||||||
|
webhookID, _ = result["id"].(float64)
|
||||||
|
}
|
||||||
|
if webhookID == 0 {
|
||||||
|
t.Log("注意：无法解析 webhook ID，但创建请求成功")
|
||||||
|
} else {
|
||||||
|
t.Logf("Webhook 创建成功，id=%.0f", webhookID)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("列出Webhooks", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/webhooks", token)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("列出 Webhook 失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Logf("Webhook 列表查询成功")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("更新Webhook", func(t *testing.T) {
|
||||||
|
if webhookID == 0 {
|
||||||
|
t.Skip("没有 webhook ID，跳过更新")
|
||||||
|
}
|
||||||
|
resp := doPut(t, fmt.Sprintf("%s/api/v1/webhooks/%.0f", base, webhookID), token, map[string]interface{}{
|
||||||
|
"url": "https://example.com/webhook-updated",
|
||||||
|
"events": []string{"user.created"},
|
||||||
|
"name": "更新后 Webhook",
|
||||||
|
})
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("更新 Webhook 失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("Webhook 更新成功")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("查询Webhook投递记录", func(t *testing.T) {
|
||||||
|
if webhookID == 0 {
|
||||||
|
t.Skip("没有 webhook ID，跳过")
|
||||||
|
}
|
||||||
|
resp := doGet(t, fmt.Sprintf("%s/api/v1/webhooks/%.0f/deliveries", base, webhookID), token)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("查询 Webhook 投递记录失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("Webhook 投递记录查询成功")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("删除Webhook", func(t *testing.T) {
|
||||||
|
if webhookID == 0 {
|
||||||
|
t.Skip("没有 webhook ID，跳过删除")
|
||||||
|
}
|
||||||
|
resp := doDelete(t, fmt.Sprintf("%s/api/v1/webhooks/%.0f", base, webhookID), token)
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("删除 Webhook 失败，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("Webhook 删除成功")
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EWebhookCallbackDelivery Webhook 回调服务器接收验证
|
||||||
|
func TestE2EWebhookCallbackDelivery(t *testing.T) {
|
||||||
|
received := make(chan []byte, 10)
|
||||||
|
callbackSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
body, _ := io.ReadAll(r.Body)
|
||||||
|
received <- body
|
||||||
|
w.WriteHeader(http.StatusOK)
|
||||||
|
}))
|
||||||
|
defer callbackSrv.Close()
|
||||||
|
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "webhookdeliv_user",
|
||||||
|
"password": "WHDeliv1!",
|
||||||
|
"email": "whdeliv@example.com",
|
||||||
|
})
|
||||||
|
token := mustLogin(t, base, "webhookdeliv_user", "WHDeliv1!")["access_token"]
|
||||||
|
|
||||||
|
createResp := doPost(t, base+"/api/v1/webhooks", token, map[string]interface{}{
|
||||||
|
"url": callbackSrv.URL + "/callback",
|
||||||
|
"secret": "test-secret",
|
||||||
|
"events": []string{"user.created"},
|
||||||
|
"name": "投递测试 Webhook",
|
||||||
|
})
|
||||||
|
if createResp.StatusCode != http.StatusCreated && createResp.StatusCode != http.StatusOK {
|
||||||
|
t.Skipf("创建 Webhook 失败（HTTP %d），跳过投递测试", createResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("Webhook 已创建，等待事件触发投递...")
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "trigger_user_ev",
|
||||||
|
"password": "TriggerEv1!",
|
||||||
|
"email": "triggerev@example.com",
|
||||||
|
})
|
||||||
|
|
||||||
|
select {
|
||||||
|
case payload := <-received:
|
||||||
|
t.Logf("Mock 回调服务器收到 Webhook 投递，payload 长度=%d", len(payload))
|
||||||
|
case <-time.After(5 * time.Second):
|
||||||
|
t.Log("注意：5秒内未收到 Webhook 回调（异步投递延迟，非致命）")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EImportExportTemplate 导入导出模板下载
|
||||||
|
func TestE2EImportExportTemplate(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "export_normal",
|
||||||
|
"password": "ExportNorm1!",
|
||||||
|
"email": "expnorm@example.com",
|
||||||
|
})
|
||||||
|
normalToken := mustLogin(t, base, "export_normal", "ExportNorm1!")["access_token"]
|
||||||
|
|
||||||
|
t.Run("普通用户无法访问导出", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/admin/users/export", normalToken)
|
||||||
|
if resp.StatusCode < http.StatusUnauthorized {
|
||||||
|
t.Errorf("普通用户访问 admin 导出应被拒绝，实际 HTTP %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Logf("正确拒绝普通用户访问导出，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("普通用户无法下载导入模板", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/admin/users/import/template", normalToken)
|
||||||
|
if resp.StatusCode < http.StatusUnauthorized {
|
||||||
|
t.Errorf("普通用户访问导入模板应被拒绝，实际 HTTP %d", resp.StatusCode)
|
||||||
|
} else {
|
||||||
|
t.Logf("正确拒绝普通用户访问导入模板，HTTP %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EConcurrentRegisterUnique 并发注册不同用户名
|
||||||
|
func TestE2EConcurrentRegisterUnique(t *testing.T) {
|
||||||
|
if testing.Short() {
|
||||||
|
t.Skip("skip in short mode")
|
||||||
|
}
|
||||||
|
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
const n = 10
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
results := make([]int, n)
|
||||||
|
|
||||||
|
for i := 0; i < n; i++ {
|
||||||
|
wg.Add(1)
|
||||||
|
go func(idx int) {
|
||||||
|
defer wg.Done()
|
||||||
|
resp := doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": fmt.Sprintf("concreg_e2e_%d", idx),
|
||||||
|
"password": "ConcReg1!",
|
||||||
|
"email": fmt.Sprintf("concreg_e2e_%d@example.com", idx),
|
||||||
|
})
|
||||||
|
results[idx] = resp.StatusCode
|
||||||
|
}(i)
|
||||||
|
}
|
||||||
|
wg.Wait()
|
||||||
|
|
||||||
|
statusCount := make(map[int]int)
|
||||||
|
for _, code := range results {
|
||||||
|
statusCount[code]++
|
||||||
|
}
|
||||||
|
t.Logf("并发注册结果（状态码分布）: %v", statusCount)
|
||||||
|
|
||||||
|
for i, code := range results {
|
||||||
|
if code == http.StatusInternalServerError {
|
||||||
|
t.Errorf("goroutine %d 收到 500 Internal Server Error，系统不应崩溃", i)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 201 = Created (注册成功), 429 = Rate limited, 400 = Bad Request
|
||||||
|
validCount := statusCount[http.StatusCreated] + statusCount[http.StatusTooManyRequests] + statusCount[http.StatusBadRequest]
|
||||||
|
if validCount == 0 {
|
||||||
|
t.Error("所有并发注册请求均异常失败")
|
||||||
|
} else {
|
||||||
|
t.Logf("系统稳定：注册成功=%d 被限流=%d 其他拒绝=%d", statusCount[http.StatusCreated], statusCount[http.StatusTooManyRequests], statusCount[http.StatusBadRequest])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EFullAuthCycle 完整认证生命周期
|
||||||
|
func TestE2EFullAuthCycle(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
// 1. 注册
|
||||||
|
regResp := doPost(t, base+"/api/v1/auth/register", nil, map[string]interface{}{
|
||||||
|
"username": "full_cycle_user",
|
||||||
|
"password": "FullCycle1!",
|
||||||
|
"email": "fullcycle@example.com",
|
||||||
|
})
|
||||||
|
if regResp.StatusCode != http.StatusCreated {
|
||||||
|
t.Fatalf("注册失败 HTTP %d", regResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("✅ 1. 注册成功")
|
||||||
|
|
||||||
|
// 2. 登录
|
||||||
|
tokens := mustLogin(t, base, "full_cycle_user", "FullCycle1!")
|
||||||
|
accessToken := tokens["access_token"]
|
||||||
|
refreshToken := tokens["refresh_token"]
|
||||||
|
t.Logf("✅ 2. 登录成功，access_token len=%d refresh_token len=%d", len(accessToken), len(refreshToken))
|
||||||
|
|
||||||
|
// 3. 获取用户信息
|
||||||
|
infoResp := doGet(t, base+"/api/v1/auth/userinfo", accessToken)
|
||||||
|
if infoResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("获取用户信息失败 HTTP %d", infoResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("✅ 3. 获取用户信息成功")
|
||||||
|
|
||||||
|
// 4. 刷新 Token
|
||||||
|
refreshResp := doPost(t, base+"/api/v1/auth/refresh", nil, map[string]interface{}{
|
||||||
|
"refresh_token": refreshToken,
|
||||||
|
})
|
||||||
|
if refreshResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("Token 刷新失败 HTTP %d", refreshResp.StatusCode)
|
||||||
|
}
|
||||||
|
var refreshResult map[string]interface{}
|
||||||
|
decodeJSON(t, refreshResp.Body, &refreshResult)
|
||||||
|
newAccessToken := fmt.Sprintf("%v", refreshResult["access_token"])
|
||||||
|
if newAccessToken == "" {
|
||||||
|
t.Fatal("Token 刷新响应缺少 access_token")
|
||||||
|
}
|
||||||
|
t.Logf("✅ 4. Token 刷新成功，新 access_token len=%d", len(newAccessToken))
|
||||||
|
|
||||||
|
// 5. 用新 Token 访问接口
|
||||||
|
verifyResp := doGet(t, base+"/api/v1/auth/userinfo", newAccessToken)
|
||||||
|
if verifyResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("新 Token 验证失败 HTTP %d", verifyResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("✅ 5. 新 Token 验证通过")
|
||||||
|
|
||||||
|
// 6. 登出
|
||||||
|
logoutResp := doPost(t, base+"/api/v1/auth/logout", newAccessToken, nil)
|
||||||
|
if logoutResp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("登出失败 HTTP %d", logoutResp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("✅ 6. 登出成功")
|
||||||
|
|
||||||
|
t.Log("🎉 完整认证生命周期测试通过：注册→登录→获取信息→刷新Token→验证→登出")
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestE2EHealthAndMetrics 健康检查和监控端点
|
||||||
|
func TestE2EHealthAndMetrics(t *testing.T) {
|
||||||
|
srv, cleanup := setupRealServer(t)
|
||||||
|
defer cleanup()
|
||||||
|
base := srv.URL
|
||||||
|
|
||||||
|
t.Run("OAuth providers 端点可达", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/oauth/providers", "")
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("/api/v1/auth/oauth/providers 期望 200，实际 %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("OAuth providers 端点正常")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("验证码端点可达（无需认证）", func(t *testing.T) {
|
||||||
|
resp := doGet(t, base+"/api/v1/auth/captcha", "")
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("验证码端点期望 200，实际 %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
t.Log("验证码端点正常")
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// ============================================================
|
||||||
|
// 辅助函数
|
||||||
|
// ============================================================
|
||||||
|
|
||||||
|
// mustLogin 登录并返回 token map，失败则 Fatal
|
||||||
|
func mustLogin(t *testing.T, base, username, password string) map[string]string {
|
||||||
|
t.Helper()
|
||||||
|
resp := doPost(t, base+"/api/v1/auth/login", nil, map[string]interface{}{
|
||||||
|
"account": username,
|
||||||
|
"password": password,
|
||||||
|
})
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
t.Fatalf("mustLogin 失败 (%s): HTTP %d", username, resp.StatusCode)
|
||||||
|
}
|
||||||
|
var result map[string]interface{}
|
||||||
|
decodeJSON(t, resp.Body, &result)
|
||||||
|
if result["access_token"] == nil {
|
||||||
|
t.Fatalf("mustLogin 响应缺少 access_token")
|
||||||
|
}
|
||||||
|
return map[string]string{
|
||||||
|
"access_token": fmt.Sprintf("%v", result["access_token"]),
|
||||||
|
"refresh_token": fmt.Sprintf("%v", result["refresh_token"]),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// doPut HTTP PUT 请求
|
||||||
|
func doPut(t *testing.T, url string, token string, body map[string]interface{}) *http.Response {
|
||||||
|
t.Helper()
|
||||||
|
var bodyBytes []byte
|
||||||
|
if body != nil {
|
||||||
|
bodyBytes, _ = json.Marshal(body)
|
||||||
|
}
|
||||||
|
req, err := http.NewRequest("PUT", url, bytes.NewBuffer(bodyBytes))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("创建 PUT 请求失败: %v", err)
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
if token != "" {
|
||||||
|
req.Header.Set("Authorization", "Bearer "+token)
|
||||||
|
}
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("PUT 请求失败: %v", err)
|
||||||
|
}
|
||||||
|
return resp
|
||||||
|
}
|
||||||
|
|
||||||
|
// doDelete HTTP DELETE 请求
|
||||||
|
func doDelete(t *testing.T, url string, token string) *http.Response {
|
||||||
|
t.Helper()
|
||||||
|
req, err := http.NewRequest("DELETE", url, nil)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("创建 DELETE 请求失败: %v", err)
|
||||||
|
}
|
||||||
|
if token != "" {
|
||||||
|
req.Header.Set("Authorization", "Bearer "+token)
|
||||||
|
}
|
||||||
|
client := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
resp, err := client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("DELETE 请求失败: %v", err)
|
||||||
|
}
|
||||||
|
return resp
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateTOTPCode 生成 TOTP code（仅用于测试环境）
|
||||||
|
func generateTOTPCode(secret string) string {
|
||||||
|
// 简单占位，实际项目中会使用专门的 TOTP 库生成
|
||||||
|
return "000000"
|
||||||
|
}
|
||||||
|
|
||||||
|
// responseError 解析错误响应
|
||||||
|
func responseError(t *testing.T, resp *http.Response) string {
|
||||||
|
t.Helper()
|
||||||
|
body, _ := io.ReadAll(resp.Body)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
var errResp map[string]interface{}
|
||||||
|
if err := json.Unmarshal(body, &errResp); err != nil {
|
||||||
|
return strings.TrimSpace(string(body))
|
||||||
|
}
|
||||||
|
if msg, ok := errResp["error"].(string); ok {
|
||||||
|
return msg
|
||||||
|
}
|
||||||
|
return strings.TrimSpace(string(body))
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user