refactor(auth): delegate access control to be-system
Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
This commit is contained in:
t
@@ -1,139 +1,12 @@
|
||||
package openidentity
|
||||
|
||||
import (
|
||||
"agent-desk/internal/pkg/enums"
|
||||
"agent-desk/internal/pkg/errorsx"
|
||||
"errors"
|
||||
"net/url"
|
||||
"strings"
|
||||
import "code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
|
||||
|
||||
"agent-desk/internal/pkg/httpx/params"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/mlogclub/simple/common/strs"
|
||||
)
|
||||
|
||||
// ExternalUser 外部访客身份（IM 客户），与站内 AuthPrincipal 区分。
|
||||
// ExternalUser is a be-system user identity adapted for customer-service
|
||||
// conversations. Authentication is completed by the host before this value is
|
||||
// created; this package contains no token parsing or verification.
|
||||
type ExternalUser struct {
|
||||
ExternalSource enums.ExternalSource `json:"externalSource"`
|
||||
ExternalID string `json:"externalId"`
|
||||
ExternalName string `json:"externalName"`
|
||||
}
|
||||
|
||||
type UserTokenClaims struct {
|
||||
UserID string `json:"userId"`
|
||||
Name string `json:"name"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
func GetExternalUser(ctx *gin.Context, secret string) (*ExternalUser, error) {
|
||||
if userToken := getUserToken(ctx); strs.IsNotBlank(userToken) {
|
||||
claims, err := verifyUserToken(userToken, secret)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ExternalUser{
|
||||
ExternalSource: enums.ExternalSourceUser,
|
||||
ExternalID: claims.UserID,
|
||||
ExternalName: claims.Name,
|
||||
}, nil
|
||||
}
|
||||
return getGuestUser(ctx)
|
||||
}
|
||||
|
||||
func verifyUserToken(userToken, secret string) (*UserTokenClaims, error) {
|
||||
if strs.IsBlank(userToken) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0263")
|
||||
}
|
||||
if strs.IsBlank(secret) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0266")
|
||||
}
|
||||
|
||||
claims := &UserTokenClaims{}
|
||||
token, err := jwt.ParseWithClaims(userToken, claims, func(token *jwt.Token) (any, error) {
|
||||
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
||||
return nil, errors.New("unsupported signing method")
|
||||
}
|
||||
return []byte(secret), nil
|
||||
}, jwt.WithExpirationRequired(), jwt.WithValidMethods([]string{
|
||||
jwt.SigningMethodHS256.Alg(),
|
||||
jwt.SigningMethodHS384.Alg(),
|
||||
jwt.SigningMethodHS512.Alg(),
|
||||
}))
|
||||
if err != nil {
|
||||
if errors.Is(err, jwt.ErrTokenExpired) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0264")
|
||||
}
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0265")
|
||||
}
|
||||
if token == nil || !token.Valid {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0265")
|
||||
}
|
||||
|
||||
if strs.IsBlank(claims.UserID) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0262")
|
||||
}
|
||||
if strs.IsBlank(claims.Name) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0261")
|
||||
}
|
||||
if claims.ExpiresAt == nil {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0264")
|
||||
}
|
||||
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
func getUserToken(ctx *gin.Context) string {
|
||||
auth := strings.TrimSpace(ctx.GetHeader("Authorization"))
|
||||
if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
|
||||
if token := strings.TrimSpace(auth[7:]); token != "" {
|
||||
return token
|
||||
}
|
||||
}
|
||||
userToken, _ := params.Get(ctx, "userToken")
|
||||
return strings.TrimSpace(userToken)
|
||||
}
|
||||
|
||||
func getGuestUser(ctx *gin.Context) (*ExternalUser, error) {
|
||||
externalID := getExternalID(ctx)
|
||||
if strs.IsBlank(externalID) {
|
||||
return nil, errorsx.UnauthorizedI18n("error.e0262")
|
||||
}
|
||||
return &ExternalUser{
|
||||
ExternalSource: enums.ExternalSourceGuest,
|
||||
ExternalID: externalID,
|
||||
ExternalName: getExternalName(ctx),
|
||||
}, nil
|
||||
}
|
||||
|
||||
func getExternalID(ctx *gin.Context) string {
|
||||
externalID := ctx.GetHeader("X-External-Id")
|
||||
if strs.IsBlank(externalID) {
|
||||
externalID, _ = params.Get(ctx, "externalId")
|
||||
}
|
||||
return externalID
|
||||
}
|
||||
|
||||
func getExternalName(ctx *gin.Context) string {
|
||||
externalName := ctx.GetHeader("X-External-Name")
|
||||
if strs.IsBlank(externalName) {
|
||||
externalName, _ = params.Get(ctx, "externalName")
|
||||
}
|
||||
if strs.IsNotBlank(externalName) {
|
||||
externalName, _ = url.QueryUnescape(externalName)
|
||||
}
|
||||
return externalName
|
||||
}
|
||||
|
||||
func decodeExternalDisplayName(s string) string {
|
||||
s = strings.TrimSpace(s)
|
||||
if s == "" {
|
||||
return ""
|
||||
}
|
||||
dec, err := url.QueryUnescape(s)
|
||||
if err != nil {
|
||||
return s
|
||||
}
|
||||
return strings.TrimSpace(dec)
|
||||
}
|
||||
|
||||
@@ -1,86 +0,0 @@
|
||||
package openidentity
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
func TestVerifyUserTokenOK(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
claims, err := verifyUserToken(token, "secret")
|
||||
if err != nil {
|
||||
t.Fatalf("expected token to verify: %v", err)
|
||||
}
|
||||
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
||||
t.Fatalf("unexpected claims: %#v", claims)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenUsesJWTHeaderAlgorithm(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS384, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
claims, err := verifyUserToken(token, "secret")
|
||||
if err != nil {
|
||||
t.Fatalf("expected HS384 token to verify from JWT header: %v", err)
|
||||
}
|
||||
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
||||
t.Fatalf("unexpected claims: %#v", claims)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRejectsInvalidSignature(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
if _, err := verifyUserToken(token, "other-secret"); err == nil {
|
||||
t.Fatalf("expected invalid signature to fail")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRejectsExpiredToken(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(-time.Minute).Unix(),
|
||||
}, "secret")
|
||||
|
||||
if _, err := verifyUserToken(token, "secret"); err == nil {
|
||||
t.Fatalf("expected expired token to fail")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRequiresUserIDAndName(t *testing.T) {
|
||||
tests := []map[string]any{
|
||||
{"name": "张三", "exp": time.Now().Add(time.Hour).Unix()},
|
||||
{"userId": "u_10001", "exp": time.Now().Add(time.Hour).Unix()},
|
||||
}
|
||||
for _, payload := range tests {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, payload, "secret")
|
||||
if _, err := verifyUserToken(token, "secret"); err == nil {
|
||||
t.Fatalf("expected payload %#v to fail", payload)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func signTestUserToken(t *testing.T, method jwt.SigningMethod, payload map[string]any, secret string) string {
|
||||
t.Helper()
|
||||
token, err := jwt.NewWithClaims(method, jwt.MapClaims(payload)).SignedString([]byte(secret))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return token
|
||||
}
|
||||
Reference in New Issue
Block a user