feat: add user token secret management for channels
- Implemented user token secret generation and retrieval in channel service. - Added ResetUserTokenSecret method to reset the user token secret for channels. - Updated channel configuration parsing to include user token secret. - Enhanced WebSocket service to utilize user token secret for external info retrieval. - Modified dashboard channel edit component to support user token secret display and reset functionality. - Introduced API endpoint for resetting user token secret. - Updated IM and SDK configurations to include user token. - Added tests for user token verification logic.
This commit is contained in:
mlogclub
+10
-8
@@ -17,15 +17,17 @@ type WxWorkKFChannelConfig struct {
|
||||
}
|
||||
|
||||
type WebChannelConfig struct {
|
||||
Title string `json:"title"`
|
||||
Subtitle string `json:"subtitle"`
|
||||
ThemeColor string `json:"themeColor"`
|
||||
Position string `json:"position"`
|
||||
Width string `json:"width"`
|
||||
Title string `json:"title"`
|
||||
Subtitle string `json:"subtitle"`
|
||||
ThemeColor string `json:"themeColor"`
|
||||
Position string `json:"position"`
|
||||
Width string `json:"width"`
|
||||
UserTokenSecret string `json:"userTokenSecret,omitempty"`
|
||||
}
|
||||
|
||||
type WechatMPChannelConfig struct {
|
||||
Title string `json:"title"`
|
||||
Subtitle string `json:"subtitle"`
|
||||
ThemeColor string `json:"themeColor"`
|
||||
Title string `json:"title"`
|
||||
Subtitle string `json:"subtitle"`
|
||||
ThemeColor string `json:"themeColor"`
|
||||
UserTokenSecret string `json:"userTokenSecret,omitempty"`
|
||||
}
|
||||
|
||||
@@ -22,3 +22,7 @@ type UpdateChannelStatusRequest struct {
|
||||
type DeleteChannelRequest struct {
|
||||
ID int64 `json:"id"`
|
||||
}
|
||||
|
||||
type ResetChannelUserTokenSecretRequest struct {
|
||||
ID int64 `json:"id"`
|
||||
}
|
||||
|
||||
@@ -27,7 +27,7 @@ func GetExternalSourceLabel(v ExternalSource) string {
|
||||
// IsAllowedOpenImExternalSource 开放 IM 入口允许的外部来源（闭集校验）。
|
||||
func IsAllowedOpenImExternalSource(s ExternalSource) bool {
|
||||
switch s {
|
||||
case ExternalSourceGuest:
|
||||
case ExternalSourceGuest, ExternalSourceUser:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
|
||||
@@ -4,9 +4,11 @@ package openidentity
|
||||
import (
|
||||
"cs-agent/internal/pkg/enums"
|
||||
"cs-agent/internal/pkg/errorsx"
|
||||
"errors"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/kataras/iris/v12"
|
||||
"github.com/mlogclub/simple/common/strs"
|
||||
"github.com/mlogclub/simple/web/params"
|
||||
@@ -19,8 +21,36 @@ type ExternalInfo struct {
|
||||
ExternalName string `json:"externalName"`
|
||||
}
|
||||
|
||||
type UserTokenClaims struct {
|
||||
UserID string `json:"userId"`
|
||||
Name string `json:"name"`
|
||||
Exp int64 `json:"exp"`
|
||||
Iat int64 `json:"iat"`
|
||||
}
|
||||
|
||||
type userTokenJWTClaims struct {
|
||||
UserID string `json:"userId"`
|
||||
Name string `json:"name"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
// GetExternalInfo 从 Header（X-External-*）或 query（externalSource、externalId、externalName）解析身份。
|
||||
func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
|
||||
return GetExternalInfoWithUserTokenSecret(ctx, "")
|
||||
}
|
||||
|
||||
func GetExternalInfoWithUserTokenSecret(ctx iris.Context, userTokenSecret string) (*ExternalInfo, error) {
|
||||
if userToken := parseUserToken(ctx); userToken != "" {
|
||||
claims, err := VerifyUserToken(userToken, userTokenSecret)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ExternalInfo{
|
||||
ExternalSource: enums.ExternalSourceUser,
|
||||
ExternalID: claims.UserID,
|
||||
ExternalName: claims.Name,
|
||||
}, nil
|
||||
}
|
||||
externalSource, err := parseExternalSource(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -28,6 +58,9 @@ func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
|
||||
if !enums.IsAllowedOpenImExternalSource(externalSource) {
|
||||
return nil, errorsx.InvalidParam("不支持的外部来源")
|
||||
}
|
||||
if externalSource == enums.ExternalSourceUser {
|
||||
return nil, errorsx.Unauthorized("用户身份不能为空")
|
||||
}
|
||||
externalID, err := parseExternalID(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -40,6 +73,71 @@ func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
|
||||
}, nil
|
||||
}
|
||||
|
||||
func VerifyUserToken(userToken, secret string) (*UserTokenClaims, error) {
|
||||
userToken = strings.TrimSpace(userToken)
|
||||
secret = strings.TrimSpace(secret)
|
||||
if userToken == "" {
|
||||
return nil, errorsx.Unauthorized("用户身份不能为空")
|
||||
}
|
||||
if secret == "" {
|
||||
return nil, errorsx.Unauthorized("用户身份校验未配置")
|
||||
}
|
||||
|
||||
claims := &userTokenJWTClaims{}
|
||||
token, err := jwt.ParseWithClaims(userToken, claims, func(token *jwt.Token) (any, error) {
|
||||
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
||||
return nil, errors.New("unsupported signing method")
|
||||
}
|
||||
return []byte(secret), nil
|
||||
}, jwt.WithExpirationRequired(), jwt.WithValidMethods([]string{
|
||||
jwt.SigningMethodHS256.Alg(),
|
||||
jwt.SigningMethodHS384.Alg(),
|
||||
jwt.SigningMethodHS512.Alg(),
|
||||
}))
|
||||
if err != nil {
|
||||
if errors.Is(err, jwt.ErrTokenExpired) {
|
||||
return nil, errorsx.Unauthorized("用户身份已过期")
|
||||
}
|
||||
return nil, errorsx.Unauthorized("用户身份校验失败")
|
||||
}
|
||||
if token == nil || !token.Valid {
|
||||
return nil, errorsx.Unauthorized("用户身份校验失败")
|
||||
}
|
||||
|
||||
userID := strings.TrimSpace(claims.UserID)
|
||||
name := strings.TrimSpace(claims.Name)
|
||||
if userID == "" {
|
||||
return nil, errorsx.Unauthorized("用户标识不能为空")
|
||||
}
|
||||
if name == "" {
|
||||
return nil, errorsx.Unauthorized("用户名称不能为空")
|
||||
}
|
||||
if claims.ExpiresAt == nil {
|
||||
return nil, errorsx.Unauthorized("用户身份已过期")
|
||||
}
|
||||
|
||||
result := &UserTokenClaims{
|
||||
UserID: userID,
|
||||
Name: name,
|
||||
Exp: claims.ExpiresAt.Unix(),
|
||||
}
|
||||
if claims.IssuedAt != nil {
|
||||
result.Iat = claims.IssuedAt.Unix()
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func parseUserToken(ctx iris.Context) string {
|
||||
auth := strings.TrimSpace(ctx.GetHeader("Authorization"))
|
||||
if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
|
||||
if token := strings.TrimSpace(auth[7:]); token != "" {
|
||||
return token
|
||||
}
|
||||
}
|
||||
userToken, _ := params.Get(ctx, "userToken")
|
||||
return strings.TrimSpace(userToken)
|
||||
}
|
||||
|
||||
func parseExternalSource(ctx iris.Context) (enums.ExternalSource, error) {
|
||||
externalSource := ctx.GetHeader("X-External-Source")
|
||||
if strs.IsBlank(externalSource) {
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
package openidentity
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
func TestVerifyUserTokenOK(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
claims, err := VerifyUserToken(token, "secret")
|
||||
if err != nil {
|
||||
t.Fatalf("expected token to verify: %v", err)
|
||||
}
|
||||
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
||||
t.Fatalf("unexpected claims: %#v", claims)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenUsesJWTHeaderAlgorithm(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS384, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
claims, err := VerifyUserToken(token, "secret")
|
||||
if err != nil {
|
||||
t.Fatalf("expected HS384 token to verify from JWT header: %v", err)
|
||||
}
|
||||
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
||||
t.Fatalf("unexpected claims: %#v", claims)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRejectsInvalidSignature(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
}, "secret")
|
||||
|
||||
if _, err := VerifyUserToken(token, "other-secret"); err == nil {
|
||||
t.Fatalf("expected invalid signature to fail")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRejectsExpiredToken(t *testing.T) {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
||||
"userId": "u_10001",
|
||||
"name": "张三",
|
||||
"exp": time.Now().Add(-time.Minute).Unix(),
|
||||
}, "secret")
|
||||
|
||||
if _, err := VerifyUserToken(token, "secret"); err == nil {
|
||||
t.Fatalf("expected expired token to fail")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyUserTokenRequiresUserIDAndName(t *testing.T) {
|
||||
tests := []map[string]any{
|
||||
{"name": "张三", "exp": time.Now().Add(time.Hour).Unix()},
|
||||
{"userId": "u_10001", "exp": time.Now().Add(time.Hour).Unix()},
|
||||
}
|
||||
for _, payload := range tests {
|
||||
token := signTestUserToken(t, jwt.SigningMethodHS256, payload, "secret")
|
||||
if _, err := VerifyUserToken(token, "secret"); err == nil {
|
||||
t.Fatalf("expected payload %#v to fail", payload)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func signTestUserToken(t *testing.T, method jwt.SigningMethod, payload map[string]any, secret string) string {
|
||||
t.Helper()
|
||||
token, err := jwt.NewWithClaims(method, jwt.MapClaims(payload)).SignedString([]byte(secret))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return token
|
||||
}
|
||||
Reference in New Issue
Block a user