Merge pull request #1154 from trheyi/main
Remove signin module and refactor OpenAPI to eliminate signin depende…
This commit is contained in:
Max
GitHub
commit
33a73b8f7c
10 changed files with 111 additions and 3409 deletions
|
|
@ -15,7 +15,6 @@ import (
|
|||
"github.com/yaoapp/yao/openapi/kb"
|
||||
"github.com/yaoapp/yao/openapi/oauth"
|
||||
"github.com/yaoapp/yao/openapi/oauth/types"
|
||||
"github.com/yaoapp/yao/openapi/signin"
|
||||
"github.com/yaoapp/yao/openapi/team"
|
||||
"github.com/yaoapp/yao/openapi/user"
|
||||
)
|
||||
|
|
@ -57,12 +56,6 @@ func Load(appConfig config.Config) (*OpenAPI, error) {
|
|||
return nil, err
|
||||
}
|
||||
|
||||
// Load signin configurations
|
||||
err = signin.Load(appConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Load user configurations
|
||||
err = user.Load(appConfig)
|
||||
if err != nil {
|
||||
|
|
@ -110,9 +103,6 @@ func (openapi *OpenAPI) Attach(router *gin.Engine) {
|
|||
// Chat handlers
|
||||
chat.Attach(group.Group("/chat"), openapi.OAuth)
|
||||
|
||||
// Signin handlers
|
||||
signin.Attach(group, openapi.OAuth)
|
||||
|
||||
// Captcha handlers
|
||||
captcha.Attach(group.Group("/captcha"), openapi.OAuth)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,693 +0,0 @@
|
|||
package signin
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/google/uuid"
|
||||
"github.com/yaoapp/gou/session"
|
||||
"github.com/yaoapp/kun/log"
|
||||
"github.com/yaoapp/yao/openapi/oauth"
|
||||
"github.com/yaoapp/yao/openapi/oauth/types"
|
||||
"github.com/yaoapp/yao/openapi/response"
|
||||
"github.com/yaoapp/yao/openapi/utils"
|
||||
)
|
||||
|
||||
// Attach attaches the signin handlers to the router
|
||||
func Attach(group *gin.RouterGroup, oauth types.OAuth) {
|
||||
group.GET("/signin", getConfig)
|
||||
group.POST("/signin", signin)
|
||||
group.POST("/signin/oauth/:provider/authback", authback)
|
||||
group.GET("/signin/oauth/:provider/authorize", getOAuthAuthorizationURL)
|
||||
group.POST("/signin/oauth/:provider/authorize/prepare", authbackPrepare) // Receive the post data and forward to the authback handler
|
||||
}
|
||||
|
||||
// getConfig is the handler for get signin configuration
|
||||
func getConfig(c *gin.Context) {
|
||||
// Get locale from query parameter (optional)
|
||||
locale := c.Query("locale")
|
||||
|
||||
// Get public configuration for the specified locale
|
||||
config := GetPublicConfig(locale)
|
||||
|
||||
// Set session id if not exists
|
||||
sid := utils.GetSessionID(c)
|
||||
if sid == "" {
|
||||
sid = generateSessionID()
|
||||
response.SendSessionCookie(c, sid)
|
||||
}
|
||||
|
||||
// If no configuration found, return error
|
||||
if config == nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "No signin configuration found for the requested locale",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Return the public configuration
|
||||
response.RespondWithSuccess(c, response.StatusOK, config)
|
||||
}
|
||||
|
||||
// signin is the handler for signin (password login)
|
||||
func signin(c *gin.Context) {}
|
||||
|
||||
// authback is the handler for authback
|
||||
func authbackPrepare(c *gin.Context) {
|
||||
code := c.PostForm("code")
|
||||
state := c.PostForm("state")
|
||||
user := c.PostForm("user") // form_post may include user info
|
||||
providerID := c.Param("provider")
|
||||
redirectURI, err := getRedirectURI(providerID, state)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to get redirect URI",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Cache user info if provided (form_post mode)
|
||||
if user != "" {
|
||||
saveUserInfo(providerID, state, user)
|
||||
}
|
||||
|
||||
params := url.Values{}
|
||||
params.Add("code", code)
|
||||
params.Add("state", state)
|
||||
c.Redirect(http.StatusFound, redirectURI+"?"+params.Encode())
|
||||
}
|
||||
|
||||
// authback is the handler for authback
|
||||
func authback(c *gin.Context) {
|
||||
sid := utils.GetSessionID(c)
|
||||
var params OAuthAuthbackRequest
|
||||
providerID := c.Param("provider")
|
||||
if err := c.ShouldBind(¶ms); err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Invalid request",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
if params.State == "" {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "State is required",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
if err := validateState(providerID, sid, params.State); err != nil {
|
||||
log.With(log.F{"sid": sid, "state": params.State}).Error("Invalid state")
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Invalid state",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Get redirect URI
|
||||
redirectURI, err := getRedirectURI(providerID, params.State)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to get redirect URI",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Get provider
|
||||
provider, err := GetProvider(providerID)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: fmt.Sprintf("Failed to get provider: %v", err),
|
||||
}
|
||||
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// if response mode is form_post
|
||||
if provider.ResponseMode == "form_post" {
|
||||
// Replace the redirectURI to
|
||||
pathname := strings.TrimSuffix(c.Request.URL.Path, "/authback") + "/authorize/prepare"
|
||||
newRedirectURI, err := reconstructRedirectURI(redirectURI, pathname, c)
|
||||
if err != nil {
|
||||
log.Error("Failed to reconstruct redirectURI: %v", err)
|
||||
response.RespondWithError(c, response.StatusBadRequest, &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Invalid redirect URI format",
|
||||
})
|
||||
return
|
||||
}
|
||||
redirectURI = newRedirectURI
|
||||
}
|
||||
|
||||
// Get AccessToken
|
||||
tokenResponse, err := provider.AccessToken(params.Code, redirectURI)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: fmt.Sprintf("Failed to get user info: %v", err),
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Read cached user info before cleaning up (for form_post mode)
|
||||
cachedUserInfo, _ := getUserInfo(providerID, params.State)
|
||||
|
||||
// Remove the state from the session and cache (also cleans up user cache automatically)
|
||||
err = removeState(providerID, sid)
|
||||
if err != nil {
|
||||
log.With(log.F{"sid": sid, "providerID": providerID}).Error("Failed to remove state")
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to remove state",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Get UserInfo - use different method based on user_info_source
|
||||
var userInfo *OAuthUserInfoResponse
|
||||
if provider.UserInfoSource == UserInfoSourceIDToken {
|
||||
// For OAuth providers that use id_token, pass cached user info for merging
|
||||
userInfo, err = provider.GetUserInfoFromTokenResponse(tokenResponse, cachedUserInfo)
|
||||
} else {
|
||||
// For standard OAuth providers that use userinfo endpoint
|
||||
userInfo, err = provider.GetUserInfo(tokenResponse.AccessToken, tokenResponse.TokenType)
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: fmt.Sprintf("Failed to get user info: %v", err),
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// LoginThirdParty(providerID, userInfo)
|
||||
loginResponse, err := LoginThirdParty(providerID, userInfo, userIPAddress(c))
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to login: " + err.Error(),
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Send all login cookies (access token, refresh token, and session ID)
|
||||
SendLoginCookies(c, loginResponse, sid)
|
||||
|
||||
// Send IDToken to the client
|
||||
response.RespondWithSuccess(c, response.StatusOK, map[string]interface{}{"id_token": loginResponse.IDToken})
|
||||
}
|
||||
|
||||
// getOAuthAuthorizationURL generates OAuth authorization URL for a provider
|
||||
func getOAuthAuthorizationURL(c *gin.Context) {
|
||||
providerID := c.Param("provider")
|
||||
if providerID == "" {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Provider ID is required",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Get optional parameters
|
||||
redirectURI := c.Query("redirect_uri")
|
||||
state := c.Query("state")
|
||||
|
||||
provider, err := GetProvider(providerID)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to get provider",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
if provider == nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: fmt.Sprintf("OAuth provider '%s' not found", providerID),
|
||||
}
|
||||
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Validate required provider configuration
|
||||
if provider.ClientID == "" || provider.Endpoints == nil || provider.Endpoints.Authorization == "" {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Provider configuration is incomplete",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Check if state is provided by user and validate format
|
||||
var warnings []string
|
||||
|
||||
// Generate state if not provided
|
||||
if state == "" {
|
||||
var err error
|
||||
state, err = generateRandomState()
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to generate OAuth state",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
} else {
|
||||
// User provided state - check if it's in UUID format
|
||||
if !isValidUUID(state) {
|
||||
warnings = append(warnings, "State parameter is not in UUID format. For better uniqueness and security, consider using UUID format.")
|
||||
}
|
||||
}
|
||||
|
||||
// Set default redirect URI if not provided
|
||||
if redirectURI == "" {
|
||||
redirectURI = fmt.Sprintf("%s://%s/auth/callback", getScheme(c), c.Request.Host)
|
||||
}
|
||||
|
||||
// Build authorization URL
|
||||
params := url.Values{}
|
||||
params.Add("client_id", provider.ClientID)
|
||||
params.Add("response_type", "code")
|
||||
params.Add("redirect_uri", redirectURI)
|
||||
params.Add("state", state)
|
||||
|
||||
// Add scopes
|
||||
if len(provider.Scopes) > 0 {
|
||||
params.Add("scope", strings.Join(provider.Scopes, " "))
|
||||
}
|
||||
|
||||
// Add response_mode if specified (required for Apple with name/email scopes)
|
||||
if provider.ResponseMode != "" {
|
||||
params.Add("response_mode", provider.ResponseMode)
|
||||
}
|
||||
|
||||
// Set session id if not exists
|
||||
sid := utils.GetSessionID(c)
|
||||
if sid == "" {
|
||||
sid = generateSessionID()
|
||||
response.SendSessionCookie(c, sid)
|
||||
}
|
||||
|
||||
// Save the state to the session for 20 minutes
|
||||
err = saveState(providerID, sid, state)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to save OAuth state",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// if response mode is form_post
|
||||
if provider.ResponseMode == "form_post" {
|
||||
// Replace the redirectURI to
|
||||
pathname := c.Request.URL.Path + "/prepare"
|
||||
newRedirectURI, err := reconstructRedirectURI(redirectURI, pathname, c)
|
||||
if err != nil {
|
||||
log.Error("Failed to reconstruct redirectURI: %v", err)
|
||||
response.RespondWithError(c, response.StatusBadRequest, &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Invalid redirect URI format",
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
params.Set("redirect_uri", newRedirectURI)
|
||||
}
|
||||
|
||||
// Save the redirect URI to the cache
|
||||
err = saveRedirectURI(providerID, state, redirectURI)
|
||||
if err != nil {
|
||||
errorResp := &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: "Failed to save OAuth redirect URI",
|
||||
}
|
||||
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
||||
return
|
||||
}
|
||||
|
||||
// Build the authorization URL
|
||||
authorizationURL := fmt.Sprintf("%s?%s", provider.Endpoints.Authorization, params.Encode())
|
||||
|
||||
// Return the authorization URL and state
|
||||
response.RespondWithSuccess(c, response.StatusOK, &OAuthAuthorizationURLResponse{
|
||||
AuthorizationURL: authorizationURL,
|
||||
State: state,
|
||||
Warnings: warnings,
|
||||
})
|
||||
}
|
||||
|
||||
// generateRandomState generates a UUID-based state parameter for better uniqueness
|
||||
func generateRandomState() (string, error) {
|
||||
u := uuid.New()
|
||||
return u.String(), nil
|
||||
}
|
||||
|
||||
// isValidUUID checks if a string is a valid UUID format
|
||||
func isValidUUID(s string) bool {
|
||||
// UUID v4 format: 8-4-4-4-12 hexadecimal characters
|
||||
uuidRegex := regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`)
|
||||
return uuidRegex.MatchString(strings.ToLower(s))
|
||||
}
|
||||
|
||||
// getScheme returns the request scheme (http or https)
|
||||
func getScheme(c *gin.Context) string {
|
||||
if c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https" {
|
||||
return "https"
|
||||
}
|
||||
return "http"
|
||||
}
|
||||
|
||||
// reconstructRedirectURI reconstructs redirectURI with new path while preserving the original host
|
||||
func reconstructRedirectURI(originalRedirectURI, newPath string, c *gin.Context) (string, error) {
|
||||
// Parse the original redirectURI to extract host
|
||||
parsedURL, err := url.Parse(originalRedirectURI)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to parse redirectURI: %v", err)
|
||||
}
|
||||
|
||||
// Reconstruct with the original host and new path
|
||||
newRedirectURI := fmt.Sprintf("%s://%s%s", getScheme(c), parsedURL.Host, newPath)
|
||||
return newRedirectURI, nil
|
||||
}
|
||||
|
||||
// generateSessionID generates a session ID
|
||||
func generateSessionID() string {
|
||||
return session.ID()
|
||||
}
|
||||
|
||||
// userInfoKey returns the key for the user info
|
||||
func userInfoKey(providerID, state string) string {
|
||||
return fmt.Sprintf("signin:user_info:%s:%s", providerID, state)
|
||||
}
|
||||
|
||||
// stateKey returns the key for the state
|
||||
func stateKey(providerID string) string {
|
||||
return fmt.Sprintf("signin:state:%s", providerID)
|
||||
}
|
||||
|
||||
// redirectURIKey returns the key for the redirect URI
|
||||
func redirectURIKey(providerID, state string) string {
|
||||
return fmt.Sprintf("signin:redirect_uri:%s:%s", providerID, state)
|
||||
}
|
||||
|
||||
// saveState saves the state to the session
|
||||
func saveState(providerID, sid, state string) error {
|
||||
return session.Global().ID(sid).SetWithEx(stateKey(providerID), state, 20*time.Minute)
|
||||
}
|
||||
|
||||
// saveRedirectURI saves the redirect URI to the session
|
||||
func saveRedirectURI(providerID, state, redirectURI string) error {
|
||||
key := redirectURIKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
return store.Set(key, redirectURI, 20*time.Minute)
|
||||
}
|
||||
|
||||
// getRedirectURI gets the redirect URI from the session
|
||||
func getRedirectURI(providerID, state string) (string, error) {
|
||||
key := redirectURIKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
value, ok := store.Get(key)
|
||||
if !ok || value == nil {
|
||||
return "", fmt.Errorf("redirect URI not found")
|
||||
}
|
||||
return value.(string), nil
|
||||
}
|
||||
|
||||
func removeRedirectURI(providerID, state string) error {
|
||||
key := redirectURIKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
return store.Del(key)
|
||||
}
|
||||
|
||||
// saveUserInfo saves the user info to cache (for form_post mode)
|
||||
func saveUserInfo(providerID, state, userInfo string) error {
|
||||
key := userInfoKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
return store.Set(key, userInfo, 20*time.Minute)
|
||||
}
|
||||
|
||||
// getUserInfo gets the user info from cache
|
||||
func getUserInfo(providerID, state string) (string, error) {
|
||||
key := userInfoKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
value, ok := store.Get(key)
|
||||
if !ok || value == nil {
|
||||
return "", fmt.Errorf("user info not found")
|
||||
}
|
||||
return value.(string), nil
|
||||
}
|
||||
|
||||
// removeUserInfo removes the user info from cache
|
||||
func removeUserInfo(providerID, state string) error {
|
||||
key := userInfoKey(providerID, state)
|
||||
store := oauth.OAuth.GetCache()
|
||||
return store.Del(key)
|
||||
}
|
||||
|
||||
// removeState removes the state from the session
|
||||
func removeState(providerID, sid string) error {
|
||||
// Get the state from the session
|
||||
state, err := session.Global().ID(sid).Get(stateKey(providerID))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Safely convert state to string
|
||||
stateStr, ok := state.(string)
|
||||
if !ok {
|
||||
return fmt.Errorf("invalid state type: expected string, got %T", state)
|
||||
}
|
||||
|
||||
// Remove all related cached data
|
||||
removeRedirectURI(providerID, stateStr)
|
||||
removeUserInfo(providerID, stateStr)
|
||||
|
||||
return session.Global().ID(sid).Del(stateKey(providerID))
|
||||
}
|
||||
|
||||
// validateState validates the state from the session
|
||||
func validateState(providerID, sid, state string) error {
|
||||
value, err := session.Global().ID(sid).Get(stateKey(providerID))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Safely convert value to string
|
||||
stateStr, ok := value.(string)
|
||||
if !ok {
|
||||
return fmt.Errorf("invalid state type: expected string, got %T", value)
|
||||
}
|
||||
|
||||
if stateStr != state {
|
||||
return fmt.Errorf("invalid state")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// getUserRealIP is the function to get the real IP address of the user
|
||||
func userIPAddress(c *gin.Context) string {
|
||||
// Define HTTP headers to check, ordered by priority
|
||||
headers := []string{
|
||||
"X-Real-IP", // Nginx proxy_set_header X-Real-IP
|
||||
"X-Forwarded-For", // Standard proxy header
|
||||
"X-Client-IP", // Apache mod_remoteip, Squid
|
||||
"X-Forwarded", // Legacy proxy standard
|
||||
"X-Cluster-Client-IP", // Cluster environment
|
||||
"Forwarded-For", // Pre-RFC 7239 standard
|
||||
"Forwarded", // RFC 7239 standard
|
||||
"CF-Connecting-IP", // Cloudflare
|
||||
"True-Client-IP", // Akamai, CloudFlare Enterprise
|
||||
"X-Original-Forwarded-For", // Original forwarded
|
||||
}
|
||||
|
||||
// Check each header one by one
|
||||
for _, header := range headers {
|
||||
value := c.GetHeader(header)
|
||||
if value == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
// Handle cases that may contain multiple IPs (e.g., X-Forwarded-For: client, proxy1, proxy2)
|
||||
ips := parseIPList(value)
|
||||
for _, ip := range ips {
|
||||
if isValidPublicIP(ip) {
|
||||
return ip
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// If none found, use the remote address of the connection
|
||||
remoteAddr := c.Request.RemoteAddr
|
||||
if ip := extractIPFromAddr(remoteAddr); ip != "" && isValidPublicIP(ip) {
|
||||
return ip
|
||||
}
|
||||
|
||||
// Final fallback, return RemoteAddr (may include port)
|
||||
return extractIPFromAddr(remoteAddr)
|
||||
}
|
||||
|
||||
// parseIPList parses IP list string, handles comma-separated multiple IPs
|
||||
func parseIPList(value string) []string {
|
||||
var ips []string
|
||||
|
||||
// Handle RFC 7239 Forwarded header format: for=192.0.2.60;proto=http;by=203.0.113.43
|
||||
if strings.Contains(value, "for=") {
|
||||
parts := strings.Split(value, ";")
|
||||
for _, part := range parts {
|
||||
part = strings.TrimSpace(part)
|
||||
if strings.HasPrefix(part, "for=") {
|
||||
ip := strings.TrimPrefix(part, "for=")
|
||||
// Remove possible quotes and brackets
|
||||
ip = strings.Trim(ip, "\"[]")
|
||||
if ip != "" {
|
||||
ips = append(ips, ip)
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// Handle comma-separated IP list
|
||||
parts := strings.Split(value, ",")
|
||||
for _, part := range parts {
|
||||
ip := strings.TrimSpace(part)
|
||||
if ip != "" {
|
||||
ips = append(ips, ip)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ips
|
||||
}
|
||||
|
||||
// extractIPFromAddr extracts IP from address (which may include port)
|
||||
func extractIPFromAddr(addr string) string {
|
||||
if addr == "" {
|
||||
return ""
|
||||
}
|
||||
|
||||
// Handle IPv6 format [::1]:8080
|
||||
if strings.HasPrefix(addr, "[") {
|
||||
if idx := strings.Index(addr, "]:"); idx != -1 {
|
||||
return addr[1:idx]
|
||||
}
|
||||
return strings.Trim(addr, "[]")
|
||||
}
|
||||
|
||||
// Handle IPv4 format 127.0.0.1:8080
|
||||
if idx := strings.LastIndex(addr, ":"); idx != -1 {
|
||||
return addr[:idx]
|
||||
}
|
||||
|
||||
return addr
|
||||
}
|
||||
|
||||
// isValidPublicIP checks if the IP is a valid public IP
|
||||
func isValidPublicIP(ipStr string) bool {
|
||||
ip := net.ParseIP(ipStr)
|
||||
if ip == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// Filter out private IPs, local IPs, etc.
|
||||
if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
|
||||
return false
|
||||
}
|
||||
|
||||
// Check if it's a private IP range
|
||||
if ip.To4() != nil {
|
||||
// IPv4 private address ranges
|
||||
return !isPrivateIPv4(ip)
|
||||
}
|
||||
// IPv6 private address ranges
|
||||
return !isPrivateIPv6(ip)
|
||||
}
|
||||
|
||||
// isPrivateIPv4 checks if it's an IPv4 private address
|
||||
func isPrivateIPv4(ip net.IP) bool {
|
||||
// 10.0.0.0/8
|
||||
if ip[12] == 10 {
|
||||
return true
|
||||
}
|
||||
// 172.16.0.0/12
|
||||
if ip[12] == 172 && ip[13] >= 16 && ip[13] <= 31 {
|
||||
return true
|
||||
}
|
||||
// 192.168.0.0/16
|
||||
if ip[12] == 192 && ip[13] == 168 {
|
||||
return true
|
||||
}
|
||||
// 169.254.0.0/16 (Link-Local)
|
||||
if ip[12] == 169 && ip[13] == 254 {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// isPrivateIPv6 checks if it's an IPv6 private address
|
||||
func isPrivateIPv6(ip net.IP) bool {
|
||||
// fc00::/7 (Unique Local)
|
||||
if ip[0] >= 0xfc && ip[0] <= 0xfd {
|
||||
return true
|
||||
}
|
||||
// fe80::/10 (Link-Local)
|
||||
if ip[0] == 0xfe && (ip[1]&0xc0) == 0x80 {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// SendLoginCookies sends all necessary cookies for a successful login
|
||||
// This includes access token, refresh token, and session ID cookies with appropriate security settings
|
||||
func SendLoginCookies(c *gin.Context, loginResponse *LoginResponse, sessionID string) {
|
||||
// Format tokens with Bearer prefix
|
||||
accessToken := fmt.Sprintf("%s %s", loginResponse.TokenType, loginResponse.AccessToken)
|
||||
refreshToken := fmt.Sprintf("%s %s", loginResponse.TokenType, loginResponse.RefreshToken)
|
||||
|
||||
// Calculate expiration times
|
||||
expires := time.Now().Add(time.Duration(loginResponse.ExpiresIn) * time.Second)
|
||||
refreshExpires := time.Now().Add(time.Duration(loginResponse.RefreshTokenExpiresIn) * time.Second)
|
||||
|
||||
// Send access token cookie
|
||||
response.SendAccessTokenCookieWithExpiry(c, accessToken, expires)
|
||||
|
||||
// Send refresh token cookie
|
||||
response.SendRefreshTokenCookieWithExpiry(c, refreshToken, refreshExpires)
|
||||
|
||||
// Send session ID cookie with the same expiration as access token
|
||||
// Using HTTP-only flag for security
|
||||
options := response.NewSecureCookieOptions().
|
||||
WithExpires(expires).
|
||||
WithSameSite("Strict")
|
||||
response.SendSecureCookieWithOptions(c, "session_id", sessionID, options)
|
||||
}
|
||||
|
|
@ -1,136 +0,0 @@
|
|||
package signin
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
|
||||
"github.com/yaoapp/kun/log"
|
||||
"github.com/yaoapp/yao/openapi/oauth"
|
||||
"github.com/yaoapp/yao/openapi/oauth/providers/user"
|
||||
oauthtypes "github.com/yaoapp/yao/openapi/oauth/types"
|
||||
)
|
||||
|
||||
// LoginThirdParty is the handler for third party login
|
||||
func LoginThirdParty(providerID string, userinfo *oauthtypes.OIDCUserInfo, ip string) (*LoginResponse, error) {
|
||||
|
||||
// Get provider
|
||||
provider, err := GetProvider(providerID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Check if user exists
|
||||
userProvider, err := oauth.OAuth.GetUserProvider()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Auto register user if not exists
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
var userID string
|
||||
|
||||
// Auto register user if not exists
|
||||
if provider.Register != nil && provider.Register.Auto {
|
||||
userID, err = userProvider.GetOAuthUserID(ctx, providerID, userinfo.Sub)
|
||||
if err != nil && err.Error() == user.ErrOAuthAccountNotFound {
|
||||
|
||||
userData := map[string]interface{}{
|
||||
"name": userinfo.Name,
|
||||
"given_name": userinfo.GivenName,
|
||||
"family_name": userinfo.FamilyName,
|
||||
"picture": userinfo.Picture,
|
||||
"role_id": provider.Register.Role,
|
||||
"status": "active",
|
||||
}
|
||||
|
||||
// Auto register user
|
||||
userID, err = userProvider.CreateUser(ctx, userData)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Create OAuth account
|
||||
userData = userinfo.Map()
|
||||
userData["provider"] = providerID
|
||||
_, err = userProvider.CreateOAuthAccount(ctx, userID, userData)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Get User ID from OAuth account
|
||||
userID, err = userProvider.GetOAuthUserID(ctx, providerID, userinfo.Sub)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return LoginByUserID(userID, ip)
|
||||
}
|
||||
|
||||
// LoginByUserID is the handler for login
|
||||
func LoginByUserID(userid string, ip string) (*LoginResponse, error) {
|
||||
|
||||
// Get User
|
||||
userProvider, err := oauth.OAuth.GetUserProvider()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Get User
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
user, err := userProvider.GetUserWithScopes(ctx, userid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Update Last Login
|
||||
err = userProvider.UpdateUserLastLogin(ctx, userid, ip)
|
||||
if err != nil {
|
||||
log.Warn("Failed to update last login: %s", err.Error())
|
||||
}
|
||||
|
||||
var scopes []string = yaoClientConfig.Scopes
|
||||
if v, ok := user["scopes"].([]string); ok {
|
||||
scopes = v
|
||||
}
|
||||
|
||||
subject, err := oauth.OAuth.Subject(yaoClientConfig.ClientID, userid)
|
||||
if err != nil {
|
||||
log.Warn("Failed to store user fingerprint: %s", err.Error())
|
||||
}
|
||||
oidcUserInfo := oauthtypes.MakeOIDCUserInfo(user)
|
||||
oidcUserInfo.Sub = subject
|
||||
|
||||
// OIDC Token
|
||||
oidcToken, err := oauth.OAuth.SignIDToken(yaoClientConfig.ClientID, strings.Join(scopes, " "), yaoClientConfig.ExpiresIn, oidcUserInfo)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Access Token
|
||||
accessToken, err := oauth.OAuth.MakeAccessToken(yaoClientConfig.ClientID, strings.Join(scopes, " "), subject, yaoClientConfig.ExpiresIn)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Refresh Token
|
||||
refreshToken, err := oauth.OAuth.MakeRefreshToken(yaoClientConfig.ClientID, strings.Join(scopes, " "), subject, yaoClientConfig.RefreshTokenExpiresIn)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &LoginResponse{
|
||||
AccessToken: accessToken,
|
||||
IDToken: oidcToken,
|
||||
RefreshToken: refreshToken,
|
||||
ExpiresIn: yaoClientConfig.ExpiresIn,
|
||||
RefreshTokenExpiresIn: yaoClientConfig.RefreshTokenExpiresIn,
|
||||
TokenType: "Bearer",
|
||||
Scope: strings.Join(scopes, " "),
|
||||
}, nil
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,680 +0,0 @@
|
|||
package signin
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/yaoapp/gou/application"
|
||||
"github.com/yaoapp/kun/log"
|
||||
"github.com/yaoapp/yao/config"
|
||||
"github.com/yaoapp/yao/openapi/oauth"
|
||||
"github.com/yaoapp/yao/openapi/oauth/types"
|
||||
)
|
||||
|
||||
// Global variables to store loaded configurations
|
||||
var (
|
||||
// Client config
|
||||
yaoClientConfig *YaoClientConfig
|
||||
|
||||
// Full configurations with sensitive data (for backend use)
|
||||
fullConfigs = make(map[string]*Config)
|
||||
// Public configurations without sensitive data (for frontend use)
|
||||
publicConfigs = make(map[string]*Config)
|
||||
// Global providers map (decoupled from locale-specific configs)
|
||||
providers = make(map[string]*Provider)
|
||||
// Default configuration (marked with default: true)
|
||||
defaultConfig *Config
|
||||
// Mutex for thread safety
|
||||
configMutex sync.RWMutex
|
||||
)
|
||||
|
||||
// Load loads all signin configurations from the openapi/signin directory
|
||||
func Load(appConfig config.Config) error {
|
||||
configMutex.Lock()
|
||||
defer configMutex.Unlock()
|
||||
|
||||
// Clear existing configurations
|
||||
fullConfigs = make(map[string]*Config)
|
||||
publicConfigs = make(map[string]*Config)
|
||||
providers = make(map[string]*Provider)
|
||||
defaultConfig = nil
|
||||
|
||||
// Load signin configurations
|
||||
err := loadSigninConfigs(appConfig.Root)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to load signin configs: %v", err)
|
||||
}
|
||||
|
||||
// Load providers first
|
||||
err = loadProviders(appConfig.Root)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to load providers: %v", err)
|
||||
}
|
||||
|
||||
// Load client config
|
||||
err = loadClientConfig()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to load client config: %v", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// loadClientConfig loads the client config from the openapi/signin/client.yao file
|
||||
func loadClientConfig() error {
|
||||
// Check if client config exists
|
||||
exists, err := application.App.Exists("openapi/signin/client.yao")
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to check if client config exists: %v", err)
|
||||
}
|
||||
|
||||
if !exists {
|
||||
return fmt.Errorf("client config not found")
|
||||
}
|
||||
|
||||
// Read client config
|
||||
clientConfigRaw, err := application.App.Read("openapi/signin/client.yao")
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read client config: %v", err)
|
||||
}
|
||||
|
||||
var clientConfig YaoClientConfig
|
||||
err = application.Parse("openapi/signin/client.yao", clientConfigRaw, &clientConfig)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to parse client config: %v", err)
|
||||
}
|
||||
|
||||
// Process ENV variables in client config
|
||||
clientConfig.ClientID = replaceENVVar(clientConfig.ClientID)
|
||||
clientConfig.ClientSecret = replaceENVVar(clientConfig.ClientSecret)
|
||||
|
||||
// Validate client config
|
||||
err = validateClientConfig(&clientConfig)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to validate client config: %v", err)
|
||||
}
|
||||
|
||||
yaoClientConfig = &clientConfig
|
||||
return nil
|
||||
}
|
||||
|
||||
// validateClientConfig validates the client config
|
||||
func validateClientConfig(clientConfig *YaoClientConfig) error {
|
||||
|
||||
// Validate client ID
|
||||
err := oauth.OAuth.ValidateClientID(clientConfig.ClientID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
|
||||
// Validate client is registered
|
||||
c := oauth.OAuth.GetClientProvider()
|
||||
_, err = c.GetClientByID(ctx, clientConfig.ClientID)
|
||||
if err != nil {
|
||||
// If client is not registered, register it
|
||||
if strings.Contains(err.Error(), "Client not found") {
|
||||
yaoClientConfig, err = registerClient(clientConfig.ClientID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to register client: %v", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("failed to get client: %v", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// registerClient registers the client config with the OAuth server
|
||||
func registerClient(clientID string) (*YaoClientConfig, error) {
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
|
||||
// Register client
|
||||
response, err := oauth.OAuth.DynamicClientRegistration(ctx, &types.DynamicClientRegistrationRequest{
|
||||
ClientID: clientID,
|
||||
ClientName: "Yao OpenAPI Client",
|
||||
ResponseTypes: []string{"code"},
|
||||
GrantTypes: []string{"client_credentials"},
|
||||
ApplicationType: types.ApplicationTypeWeb,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create client: %v", err)
|
||||
}
|
||||
|
||||
var clientConfig *YaoClientConfig = &YaoClientConfig{}
|
||||
clientConfig.ClientID = response.ClientID
|
||||
clientConfig.ClientSecret = response.ClientSecret
|
||||
clientConfig.ExpiresIn = 3600 * 24 // 24 hours
|
||||
clientConfig.RefreshTokenExpiresIn = 3600 * 24 * 30 // 30 days
|
||||
clientConfig.Scopes = []string{"openid", "profile", "email"}
|
||||
return clientConfig, nil
|
||||
}
|
||||
|
||||
// loadProviders loads all provider configurations from the openapi/signin/providers directory
|
||||
func loadProviders(rootPath string) error {
|
||||
// Use Walk to find all provider files in the signin/providers directory
|
||||
err := application.App.Walk("openapi/signin/providers", func(root, filename string, isdir bool) error {
|
||||
if isdir {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Only process .yao files
|
||||
if !strings.HasSuffix(filename, ".yao") {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Skip client.yao file
|
||||
if filename == "client.yao" {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Extract provider ID from filename (basename without extension)
|
||||
baseName := filepath.Base(filename)
|
||||
providerID := strings.TrimSuffix(baseName, ".yao")
|
||||
|
||||
// Read provider configuration
|
||||
configRaw, err := application.App.Read(filename)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read provider config %s: %v", filename, err)
|
||||
}
|
||||
|
||||
// Parse the provider configuration
|
||||
var provider Provider
|
||||
err = application.Parse(filename, configRaw, &provider)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to parse provider config %s: %v", filename, err)
|
||||
}
|
||||
|
||||
// Set the provider ID
|
||||
provider.ID = providerID
|
||||
|
||||
// Process ENV variables in provider config
|
||||
processProviderENVVariables(&provider, rootPath)
|
||||
|
||||
// Store the provider
|
||||
providers[providerID] = &provider
|
||||
|
||||
return nil
|
||||
}, "*.yao")
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// loadSigninConfigs loads all signin configurations from the openapi/signin directory
|
||||
func loadSigninConfigs(rootPath string) error {
|
||||
// Use Walk to find all signin config files in the signin directory (but not subdirectories)
|
||||
err := application.App.Walk("openapi/signin", func(root, filename string, isdir bool) error {
|
||||
if isdir {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Skip files in subdirectories (like providers/)
|
||||
if filepath.Dir(filename) != "openapi/signin" {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Only process .yao files
|
||||
if !strings.HasSuffix(filename, ".yao") {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Extract language code from filename
|
||||
baseName := filepath.Base(filename)
|
||||
lang := extractLanguageFromFilename(baseName)
|
||||
|
||||
// Read signin configuration
|
||||
configRaw, err := application.App.Read(filename)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read signin config %s: %v", filename, err)
|
||||
}
|
||||
|
||||
// Parse the configuration
|
||||
var signinConfig Config
|
||||
err = application.Parse(filename, configRaw, &signinConfig)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to parse signin config %s: %v", filename, err)
|
||||
}
|
||||
|
||||
// Process ENV variables in full config
|
||||
fullConfig := signinConfig
|
||||
processConfigENVVariables(&fullConfig, rootPath)
|
||||
|
||||
// Set as default config if marked as default
|
||||
if fullConfig.Default {
|
||||
defaultConfig = &fullConfig
|
||||
}
|
||||
|
||||
// Create public config (without sensitive data)
|
||||
publicConfig := createPublicConfig(&fullConfig)
|
||||
|
||||
// Store configurations
|
||||
fullConfigs[lang] = &fullConfig
|
||||
publicConfigs[lang] = &publicConfig
|
||||
|
||||
return nil
|
||||
}, "*.yao")
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// extractLanguageFromFilename extracts language code from filename
|
||||
func extractLanguageFromFilename(filename string) string {
|
||||
// New naming convention:
|
||||
// en.yao -> "en"
|
||||
// zh-cn.yao -> "zh-cn"
|
||||
// default.yao -> "default"
|
||||
|
||||
baseName := strings.TrimSuffix(filename, ".yao")
|
||||
return strings.ToLower(baseName)
|
||||
}
|
||||
|
||||
// processProviderENVVariables processes environment variables in the provider configuration
|
||||
func processProviderENVVariables(provider *Provider, rootPath string) {
|
||||
var missingEnvVars []string
|
||||
|
||||
// Process ClientID
|
||||
if strings.HasPrefix(provider.ClientID, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(provider.ClientID, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
provider.ClientID = replaceENVVar(provider.ClientID)
|
||||
|
||||
// Process ClientSecret
|
||||
if strings.HasPrefix(provider.ClientSecret, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(provider.ClientSecret, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
provider.ClientSecret = replaceENVVar(provider.ClientSecret)
|
||||
|
||||
// Process client secret generator
|
||||
if provider.ClientSecretGenerator != nil {
|
||||
// Check PrivateKey
|
||||
if strings.HasPrefix(provider.ClientSecretGenerator.PrivateKey, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(provider.ClientSecretGenerator.PrivateKey, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
provider.ClientSecretGenerator.PrivateKey = replaceENVVar(provider.ClientSecretGenerator.PrivateKey)
|
||||
|
||||
// Convert relative path to absolute path for private key
|
||||
if provider.ClientSecretGenerator.PrivateKey != "" && !filepath.IsAbs(provider.ClientSecretGenerator.PrivateKey) {
|
||||
provider.ClientSecretGenerator.PrivateKey = filepath.Join(rootPath, "openapi", "certs", provider.ClientSecretGenerator.PrivateKey)
|
||||
}
|
||||
|
||||
// Process and normalize expires_in format
|
||||
if provider.ClientSecretGenerator.ExpiresIn != "" {
|
||||
normalizedDuration, err := normalizeExpiresIn(provider.ClientSecretGenerator.ExpiresIn)
|
||||
if err != nil {
|
||||
log.Warn("Invalid expires_in format '%s' for provider '%s': %v",
|
||||
provider.ClientSecretGenerator.ExpiresIn, provider.ID, err)
|
||||
// Set default to 90 days
|
||||
provider.ClientSecretGenerator.ExpiresIn = "2160h" // 90 * 24 hours
|
||||
} else {
|
||||
provider.ClientSecretGenerator.ExpiresIn = normalizedDuration
|
||||
}
|
||||
}
|
||||
|
||||
// Process header values
|
||||
if provider.ClientSecretGenerator.Header != nil {
|
||||
for key, value := range provider.ClientSecretGenerator.Header {
|
||||
if strValue, ok := value.(string); ok {
|
||||
if strings.HasPrefix(strValue, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(strValue, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
provider.ClientSecretGenerator.Header[key] = replaceENVVar(strValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Process payload values
|
||||
if provider.ClientSecretGenerator.Payload != nil {
|
||||
for key, value := range provider.ClientSecretGenerator.Payload {
|
||||
if strValue, ok := value.(string); ok {
|
||||
if strings.HasPrefix(strValue, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(strValue, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
provider.ClientSecretGenerator.Payload[key] = replaceENVVar(strValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Log warning for missing environment variables
|
||||
if len(missingEnvVars) > 0 {
|
||||
log.Warn("The following environment variables are not set for provider '%s': %v", provider.ID, missingEnvVars)
|
||||
}
|
||||
}
|
||||
|
||||
// processConfigENVVariables processes environment variables in the signin configuration
|
||||
func processConfigENVVariables(config *Config, rootPath string) {
|
||||
var missingEnvVars []string
|
||||
|
||||
// Process client_id and client_secret
|
||||
if strings.HasPrefix(config.ClientID, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(config.ClientID, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.ClientID = replaceENVVar(config.ClientID)
|
||||
|
||||
if strings.HasPrefix(config.ClientSecret, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(config.ClientSecret, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.ClientSecret = replaceENVVar(config.ClientSecret)
|
||||
|
||||
// Process form captcha options
|
||||
if config.Form != nil && config.Form.Captcha != nil && config.Form.Captcha.Options != nil {
|
||||
for key, value := range config.Form.Captcha.Options {
|
||||
if strValue, ok := value.(string); ok {
|
||||
// Check if ENV variable exists before replacement
|
||||
if strings.HasPrefix(strValue, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(strValue, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.Form.Captcha.Options[key] = replaceENVVar(strValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Note: Third party providers are now handled separately in loadProviders()
|
||||
// No need to process provider configurations here anymore
|
||||
|
||||
// Log warning for missing environment variables
|
||||
if len(missingEnvVars) > 0 {
|
||||
log.Warn("The following environment variables are not set in signin configuration: %v", missingEnvVars)
|
||||
log.Warn("Please set these environment variables to avoid exposing placeholder values in configuration")
|
||||
}
|
||||
}
|
||||
|
||||
// replaceENVVar replaces environment variables in the format $ENV.VAR_NAME
|
||||
func replaceENVVar(value string) string {
|
||||
if strings.HasPrefix(value, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(value, "$ENV.")
|
||||
envValue, exists := os.LookupEnv(envVar)
|
||||
if exists {
|
||||
return envValue
|
||||
}
|
||||
// If environment variable doesn't exist, return empty string for security
|
||||
// Never expose ENV placeholder values to prevent configuration leakage
|
||||
return ""
|
||||
}
|
||||
return value
|
||||
}
|
||||
|
||||
// createPublicConfig creates a public version of the configuration without sensitive data
|
||||
func createPublicConfig(fullConfig *Config) Config {
|
||||
// Perform deep copy to avoid modifying the original fullConfig
|
||||
publicConfig := Config{
|
||||
Title: fullConfig.Title,
|
||||
Description: fullConfig.Description,
|
||||
SuccessURL: fullConfig.SuccessURL,
|
||||
FailureURL: fullConfig.FailureURL,
|
||||
}
|
||||
|
||||
// Deep copy Form configuration
|
||||
if fullConfig.Form != nil {
|
||||
publicConfig.Form = &FormConfig{
|
||||
ForgotPasswordLink: fullConfig.Form.ForgotPasswordLink,
|
||||
RememberMe: fullConfig.Form.RememberMe,
|
||||
RegisterLink: fullConfig.Form.RegisterLink,
|
||||
TermsOfServiceLink: fullConfig.Form.TermsOfServiceLink,
|
||||
PrivacyPolicyLink: fullConfig.Form.PrivacyPolicyLink,
|
||||
}
|
||||
|
||||
// Deep copy Username configuration
|
||||
if fullConfig.Form.Username != nil {
|
||||
publicConfig.Form.Username = &UsernameConfig{
|
||||
Placeholder: fullConfig.Form.Username.Placeholder,
|
||||
Fields: append([]string(nil), fullConfig.Form.Username.Fields...),
|
||||
}
|
||||
}
|
||||
|
||||
// Deep copy Password configuration
|
||||
if fullConfig.Form.Password != nil {
|
||||
publicConfig.Form.Password = &PasswordConfig{
|
||||
Placeholder: fullConfig.Form.Password.Placeholder,
|
||||
}
|
||||
}
|
||||
|
||||
// Deep copy Captcha configuration with sensitive data removal
|
||||
if fullConfig.Form.Captcha != nil {
|
||||
publicConfig.Form.Captcha = &CaptchaConfig{
|
||||
Type: fullConfig.Form.Captcha.Type,
|
||||
}
|
||||
|
||||
if fullConfig.Form.Captcha.Options != nil {
|
||||
// Create a new options map without sensitive fields
|
||||
publicOptions := make(map[string]interface{})
|
||||
for key, value := range fullConfig.Form.Captcha.Options {
|
||||
// Only include non-sensitive fields
|
||||
switch key {
|
||||
case "sitekey", "theme", "size", "action", "cdata", "response_mode":
|
||||
// These are safe to expose to frontend
|
||||
publicOptions[key] = value
|
||||
case "secret":
|
||||
// Remove secret field - this should never be exposed to frontend
|
||||
continue
|
||||
default:
|
||||
// For unknown fields, be conservative and exclude them
|
||||
continue
|
||||
}
|
||||
}
|
||||
publicConfig.Form.Captcha.Options = publicOptions
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Deep copy Token configuration
|
||||
if fullConfig.Token != nil {
|
||||
publicConfig.Token = &TokenConfig{
|
||||
ExpiresIn: fullConfig.Token.ExpiresIn,
|
||||
RememberMeExpiresIn: fullConfig.Token.RememberMeExpiresIn,
|
||||
}
|
||||
}
|
||||
|
||||
// Deep copy ThirdParty configuration with sensitive data removal
|
||||
if fullConfig.ThirdParty != nil {
|
||||
publicConfig.ThirdParty = &ThirdParty{}
|
||||
|
||||
// Deep copy Providers with sensitive data removal
|
||||
if fullConfig.ThirdParty.Providers != nil {
|
||||
publicProviders := make([]*Provider, len(fullConfig.ThirdParty.Providers))
|
||||
for i, provider := range fullConfig.ThirdParty.Providers {
|
||||
publicProvider := Provider{
|
||||
ID: provider.ID,
|
||||
Title: provider.Title,
|
||||
Label: provider.Label,
|
||||
Logo: provider.Logo,
|
||||
Color: provider.Color,
|
||||
TextColor: provider.TextColor,
|
||||
// Only expose display fields for frontend
|
||||
// Remove sensitive fields: ClientID, ClientSecret, ClientSecretGenerator, Scopes, Endpoints, Mapping, Register
|
||||
}
|
||||
|
||||
publicProviders[i] = &publicProvider
|
||||
}
|
||||
publicConfig.ThirdParty.Providers = publicProviders
|
||||
}
|
||||
}
|
||||
|
||||
return publicConfig
|
||||
}
|
||||
|
||||
// GetFullConfig returns the full configuration for a given language
|
||||
func GetFullConfig(lang string) *Config {
|
||||
configMutex.RLock()
|
||||
defer configMutex.RUnlock()
|
||||
|
||||
// Normalize language code to lowercase
|
||||
if lang != "" {
|
||||
lang = strings.ToLower(lang)
|
||||
}
|
||||
|
||||
// Try to get specific language config
|
||||
if config, exists := fullConfigs[lang]; exists {
|
||||
return config
|
||||
}
|
||||
|
||||
// Fallback to default config (marked with default: true)
|
||||
if defaultConfig != nil {
|
||||
return defaultConfig
|
||||
}
|
||||
|
||||
// Return any available config as last resort
|
||||
for _, config := range fullConfigs {
|
||||
return config
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetPublicConfig returns the public configuration for a given language
|
||||
func GetPublicConfig(lang string) *Config {
|
||||
configMutex.RLock()
|
||||
defer configMutex.RUnlock()
|
||||
|
||||
// Normalize language code to lowercase
|
||||
if lang != "" {
|
||||
lang = strings.ToLower(lang)
|
||||
}
|
||||
|
||||
// Try to get specific language config
|
||||
if config, exists := publicConfigs[lang]; exists {
|
||||
return config
|
||||
}
|
||||
|
||||
// Fallback to default config's public version
|
||||
if defaultConfig != nil {
|
||||
// Find the public version of the default config
|
||||
for lang, fullConfig := range fullConfigs {
|
||||
if fullConfig == defaultConfig {
|
||||
if publicConfig, exists := publicConfigs[lang]; exists {
|
||||
return publicConfig
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Return any available config as last resort
|
||||
for _, config := range publicConfigs {
|
||||
return config
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetAvailableLanguages returns all available language codes
|
||||
func GetAvailableLanguages() []string {
|
||||
configMutex.RLock()
|
||||
defer configMutex.RUnlock()
|
||||
|
||||
var languages []string
|
||||
for lang := range fullConfigs {
|
||||
languages = append(languages, lang)
|
||||
}
|
||||
|
||||
return languages
|
||||
}
|
||||
|
||||
// GetDefaultLanguage returns the default language code
|
||||
func GetDefaultLanguage() string {
|
||||
configMutex.RLock()
|
||||
defer configMutex.RUnlock()
|
||||
|
||||
// Find the language code for the default config
|
||||
if defaultConfig != nil {
|
||||
for lang, config := range fullConfigs {
|
||||
if config == defaultConfig {
|
||||
return lang
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Return the first available language as fallback
|
||||
for lang := range fullConfigs {
|
||||
return lang
|
||||
}
|
||||
|
||||
return ""
|
||||
}
|
||||
|
||||
// normalizeExpiresIn converts custom time units to Go standard duration format
|
||||
func normalizeExpiresIn(expiresIn string) (string, error) {
|
||||
if expiresIn == "" {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
// Try parsing as standard Go duration first
|
||||
if _, err := time.ParseDuration(expiresIn); err == nil {
|
||||
return expiresIn, nil
|
||||
}
|
||||
|
||||
// Custom unit conversion patterns
|
||||
patterns := map[string]func(int) string{
|
||||
"d": func(n int) string { return fmt.Sprintf("%dh", n*24) }, // days to hours
|
||||
"w": func(n int) string { return fmt.Sprintf("%dh", n*24*7) }, // weeks to hours
|
||||
"M": func(n int) string { return fmt.Sprintf("%dh", n*24*30) }, // months to hours (approximate)
|
||||
"y": func(n int) string { return fmt.Sprintf("%dh", n*24*365) }, // years to hours (approximate)
|
||||
"ms": func(n int) string { return fmt.Sprintf("%dms", n) }, // milliseconds
|
||||
"s": func(n int) string { return fmt.Sprintf("%ds", n) }, // seconds
|
||||
"m": func(n int) string { return fmt.Sprintf("%dm", n) }, // minutes
|
||||
"h": func(n int) string { return fmt.Sprintf("%dh", n) }, // hours
|
||||
}
|
||||
|
||||
// Extract number and unit using regex
|
||||
re := regexp.MustCompile(`^(\d+)(\w+)$`)
|
||||
matches := re.FindStringSubmatch(expiresIn)
|
||||
|
||||
if len(matches) != 3 {
|
||||
return "", fmt.Errorf("invalid duration format: %s", expiresIn)
|
||||
}
|
||||
|
||||
number, err := strconv.Atoi(matches[1])
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid number in duration: %s", matches[1])
|
||||
}
|
||||
|
||||
unit := matches[2]
|
||||
converter, exists := patterns[unit]
|
||||
if !exists {
|
||||
return "", fmt.Errorf("unsupported time unit: %s", unit)
|
||||
}
|
||||
|
||||
normalized := converter(number)
|
||||
|
||||
// Validate the normalized duration
|
||||
if _, err := time.ParseDuration(normalized); err != nil {
|
||||
return "", fmt.Errorf("failed to create valid duration: %v", err)
|
||||
}
|
||||
|
||||
return normalized, nil
|
||||
}
|
||||
|
|
@ -1,190 +0,0 @@
|
|||
package signin
|
||||
|
||||
import (
|
||||
oauthtypes "github.com/yaoapp/yao/openapi/oauth/types"
|
||||
)
|
||||
|
||||
// Config represents the signin page configuration
|
||||
type Config struct {
|
||||
Title string `json:"title,omitempty"`
|
||||
Description string `json:"description,omitempty"`
|
||||
Default bool `json:"default,omitempty"`
|
||||
SuccessURL string `json:"success_url,omitempty"`
|
||||
FailureURL string `json:"failure_url,omitempty"`
|
||||
ClientID string `json:"client_id,omitempty"`
|
||||
ClientSecret string `json:"client_secret,omitempty"`
|
||||
Form *FormConfig `json:"form,omitempty"`
|
||||
Token *TokenConfig `json:"token,omitempty"`
|
||||
ThirdParty *ThirdParty `json:"third_party,omitempty"`
|
||||
}
|
||||
|
||||
// FormConfig represents the form configuration
|
||||
type FormConfig struct {
|
||||
Username *UsernameConfig `json:"username,omitempty"`
|
||||
Password *PasswordConfig `json:"password,omitempty"`
|
||||
Captcha *CaptchaConfig `json:"captcha,omitempty"`
|
||||
ForgotPasswordLink bool `json:"forgot_password_link,omitempty"`
|
||||
RememberMe bool `json:"remember_me,omitempty"`
|
||||
RegisterLink string `json:"register_link,omitempty"`
|
||||
TermsOfServiceLink string `json:"terms_of_service_link,omitempty"`
|
||||
PrivacyPolicyLink string `json:"privacy_policy_link,omitempty"`
|
||||
}
|
||||
|
||||
// UsernameConfig represents the username field configuration
|
||||
type UsernameConfig struct {
|
||||
Placeholder string `json:"placeholder,omitempty"`
|
||||
Fields []string `json:"fields,omitempty"`
|
||||
}
|
||||
|
||||
// PasswordConfig represents the password field configuration
|
||||
type PasswordConfig struct {
|
||||
Placeholder string `json:"placeholder,omitempty"`
|
||||
}
|
||||
|
||||
// CaptchaConfig represents the captcha configuration
|
||||
type CaptchaConfig struct {
|
||||
Type string `json:"type,omitempty"`
|
||||
Options map[string]interface{} `json:"options,omitempty"`
|
||||
}
|
||||
|
||||
// TokenConfig represents the token configuration
|
||||
type TokenConfig struct {
|
||||
ExpiresIn string `json:"expires_in,omitempty"`
|
||||
RememberMeExpiresIn string `json:"remember_me_expires_in,omitempty"`
|
||||
}
|
||||
|
||||
// ThirdParty represents the third party login configuration
|
||||
type ThirdParty struct {
|
||||
Providers []*Provider `json:"providers,omitempty"`
|
||||
}
|
||||
|
||||
// RegisterConfig represents the auto register configuration
|
||||
type RegisterConfig struct {
|
||||
Auto bool `json:"auto,omitempty"`
|
||||
Role string `json:"role,omitempty"`
|
||||
}
|
||||
|
||||
// YaoClientConfig represents the Yao OpenAPI Client config
|
||||
type YaoClientConfig struct {
|
||||
ClientID string `json:"client_id,omitempty"`
|
||||
ClientSecret string `json:"client_secret,omitempty"`
|
||||
Scopes []string `json:"scopes,omitempty"` // Default scopes if not set in the provider config
|
||||
ExpiresIn int `json:"expires_in,omitempty"` // Default expires in for the access token (optional) in seconds
|
||||
RefreshTokenExpiresIn int `json:"refresh_token_expires_in,omitempty"` // Default expires in for the refresh token (optional) in seconds
|
||||
}
|
||||
|
||||
// Provider represents a third party login provider
|
||||
type Provider struct {
|
||||
ID string `json:"id,omitempty"`
|
||||
Label string `json:"label,omitempty"`
|
||||
Title string `json:"title,omitempty"`
|
||||
Logo string `json:"logo,omitempty"`
|
||||
Color string `json:"color,omitempty"`
|
||||
TextColor string `json:"text_color,omitempty"`
|
||||
ClientID string `json:"client_id,omitempty"`
|
||||
ClientSecret string `json:"client_secret,omitempty"`
|
||||
ClientSecretGenerator *SecretGenerator `json:"client_secret_generator,omitempty"`
|
||||
Scopes []string `json:"scopes,omitempty"`
|
||||
ResponseMode string `json:"response_mode,omitempty"`
|
||||
UserInfoSource string `json:"user_info_source,omitempty"` // "endpoint" (default) | "id_token" | "access_token"
|
||||
Endpoints *Endpoints `json:"endpoints,omitempty"`
|
||||
Mapping interface{} `json:"mapping,omitempty"` // string (preset) | map[string]string (custom) | nil (generic)
|
||||
Register *RegisterConfig `json:"register,omitempty"`
|
||||
}
|
||||
|
||||
// SecretGenerator represents the client secret generator configuration
|
||||
type SecretGenerator struct {
|
||||
Type string `json:"type,omitempty"`
|
||||
ExpiresIn string `json:"expires_in,omitempty"`
|
||||
PrivateKey string `json:"private_key,omitempty"`
|
||||
Header map[string]interface{} `json:"header,omitempty"`
|
||||
Payload map[string]interface{} `json:"payload,omitempty"`
|
||||
}
|
||||
|
||||
// Endpoints represents the OAuth endpoints
|
||||
type Endpoints struct {
|
||||
Authorization string `json:"authorization,omitempty"`
|
||||
Token string `json:"token,omitempty"`
|
||||
UserInfo string `json:"user_info,omitempty"`
|
||||
JWKS string `json:"jwks,omitempty"` // JSON Web Key Set endpoint for token verification
|
||||
}
|
||||
|
||||
// ==== API Types ====
|
||||
|
||||
// OAuthAuthorizationURLResponse represents the response for OAuth authorization URL
|
||||
type OAuthAuthorizationURLResponse struct {
|
||||
AuthorizationURL string `json:"authorization_url"`
|
||||
State string `json:"state"`
|
||||
Warnings []string `json:"warnings,omitempty"` // Optional warnings about state format or other issues
|
||||
}
|
||||
|
||||
// OAuthCallbackResponse represents the response for OAuth callback
|
||||
type OAuthCallbackResponse struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
}
|
||||
|
||||
// OAuthAuthbackRequest represents the request for OAuth callback
|
||||
type OAuthAuthbackRequest struct {
|
||||
Locale string `json:"locale" form:"locale"`
|
||||
Code string `json:"code" form:"code"`
|
||||
State string `json:"state" form:"state"`
|
||||
Provider string `json:"provider" form:"provider"`
|
||||
Scope string `json:"scope,omitempty" form:"scope,omitempty"`
|
||||
}
|
||||
|
||||
// OAuthTokenResponse represents the response from OAuth token endpoint
|
||||
type OAuthTokenResponse struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
TokenType string `json:"token_type"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
Scope string `json:"scope"`
|
||||
IDToken string `json:"id_token,omitempty"` // JWT token containing user info (Apple, etc.)
|
||||
Error string `json:"error"`
|
||||
ErrorDesc string `json:"error_description"`
|
||||
}
|
||||
|
||||
// OAuthTokenRequest represents the request to OAuth token endpoint
|
||||
type OAuthTokenRequest struct {
|
||||
GrantType string `json:"grant_type" form:"grant_type"`
|
||||
Code string `json:"code" form:"code"`
|
||||
ClientID string `json:"client_id" form:"client_id"`
|
||||
ClientSecret string `json:"client_secret" form:"client_secret"`
|
||||
RedirectURI string `json:"redirect_uri,omitempty" form:"redirect_uri,omitempty"`
|
||||
}
|
||||
|
||||
// OAuthUserInfoResponse is an alias for OIDC standard user information type
|
||||
type OAuthUserInfoResponse = oauthtypes.OIDCUserInfo
|
||||
|
||||
// OIDCAddress is an alias for OIDC standard address claim type
|
||||
type OIDCAddress = oauthtypes.OIDCAddress
|
||||
|
||||
// LoginResponse represents the response for login
|
||||
type LoginResponse struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
IDToken string `json:"id_token,omitempty"`
|
||||
RefreshToken string `json:"refresh_token,omitempty"`
|
||||
ExpiresIn int `json:"expires_in,omitempty"`
|
||||
RefreshTokenExpiresIn int `json:"refresh_token_expires_in,omitempty"`
|
||||
TokenType string `json:"token_type,omitempty"`
|
||||
Scope string `json:"scope,omitempty"`
|
||||
}
|
||||
|
||||
// Built-in preset mapping types
|
||||
const (
|
||||
MappingGoogle = "google"
|
||||
MappingGitHub = "github"
|
||||
MappingMicrosoft = "microsoft"
|
||||
MappingApple = "apple"
|
||||
MappingWeChat = "wechat"
|
||||
MappingGeneric = "generic"
|
||||
)
|
||||
|
||||
// User info source types
|
||||
const (
|
||||
UserInfoSourceEndpoint = "endpoint" // Default: Get user info from dedicated endpoint
|
||||
UserInfoSourceIDToken = "id_token" // Extract user info from ID token (JWT)
|
||||
UserInfoSourceAccessToken = "access_token" // Extract user info from access token response
|
||||
)
|
||||
|
|
@ -1,510 +0,0 @@
|
|||
package openapi_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/yaoapp/yao/config"
|
||||
"github.com/yaoapp/yao/openapi"
|
||||
"github.com/yaoapp/yao/openapi/signin"
|
||||
"github.com/yaoapp/yao/openapi/tests/testutils"
|
||||
)
|
||||
|
||||
func TestSigninLoad(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Test loading signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Test that we can get available languages
|
||||
languages := signin.GetAvailableLanguages()
|
||||
assert.IsType(t, []string{}, languages, "Should return string slice")
|
||||
t.Logf("Available languages: %v", languages)
|
||||
|
||||
// Test default language
|
||||
defaultLang := signin.GetDefaultLanguage()
|
||||
assert.IsType(t, "", defaultLang, "Should return string")
|
||||
t.Logf("Default language: %s", defaultLang)
|
||||
}
|
||||
|
||||
func TestSigninGetConfigs(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Test getting configs for different languages
|
||||
testCases := []string{"", "en", "zh-cn", "fr"}
|
||||
|
||||
for _, lang := range testCases {
|
||||
t.Run("lang_"+lang, func(t *testing.T) {
|
||||
fullConfig := signin.GetFullConfig(lang)
|
||||
publicConfig := signin.GetPublicConfig(lang)
|
||||
|
||||
if fullConfig != nil {
|
||||
t.Logf("Full config for '%s': %+v", lang, fullConfig.Title)
|
||||
assert.NotNil(t, publicConfig, "Public config should exist if full config exists")
|
||||
|
||||
// Test that public config removes sensitive data from OAuth providers
|
||||
if fullConfig.ThirdParty != nil && fullConfig.ThirdParty.Providers != nil {
|
||||
for i := range fullConfig.ThirdParty.Providers {
|
||||
if publicConfig.ThirdParty != nil && i < len(publicConfig.ThirdParty.Providers) {
|
||||
publicProvider := publicConfig.ThirdParty.Providers[i]
|
||||
|
||||
// In the new structure, providers in ThirdParty only contain display info
|
||||
// Sensitive data is now stored separately in the global providers map
|
||||
|
||||
// Check that only display fields are present in public config
|
||||
assert.NotEmpty(t, publicProvider.ID, "Provider ID should be preserved in public config")
|
||||
assert.NotEmpty(t, publicProvider.Title, "Provider title should be preserved in public config")
|
||||
|
||||
// Sensitive fields should be empty in the ThirdParty providers (they're in global map now)
|
||||
assert.Empty(t, publicProvider.ClientID, "Client ID should be empty in ThirdParty providers")
|
||||
assert.Empty(t, publicProvider.ClientSecret, "Client secret should be empty in ThirdParty providers")
|
||||
assert.Nil(t, publicProvider.ClientSecretGenerator, "Client secret generator should be nil in ThirdParty providers")
|
||||
assert.Empty(t, publicProvider.Scopes, "Scopes should be empty in ThirdParty providers")
|
||||
assert.Nil(t, publicProvider.Endpoints, "Endpoints should be nil in ThirdParty providers")
|
||||
assert.Empty(t, publicProvider.Mapping, "Mapping should be empty in ThirdParty providers")
|
||||
assert.Nil(t, publicProvider.Register, "Register config should be nil in public config (sensitive data)")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Test that public config removes sensitive data from captcha configuration
|
||||
if fullConfig.Form != nil && fullConfig.Form.Captcha != nil && fullConfig.Form.Captcha.Options != nil {
|
||||
if publicConfig.Form != nil && publicConfig.Form.Captcha != nil && publicConfig.Form.Captcha.Options != nil {
|
||||
// Check that secret field is removed
|
||||
_, hasSecret := publicConfig.Form.Captcha.Options["secret"]
|
||||
assert.False(t, hasSecret, "Captcha secret should be removed from public config")
|
||||
|
||||
// Check that safe fields are preserved (if they exist in full config)
|
||||
if _, hasSitekey := fullConfig.Form.Captcha.Options["sitekey"]; hasSitekey {
|
||||
_, publicHasSitekey := publicConfig.Form.Captcha.Options["sitekey"]
|
||||
assert.True(t, publicHasSitekey, "Captcha sitekey should be preserved in public config")
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
t.Logf("No config found for language: %s", lang)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSigninLanguageNormalization(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Test that language codes are normalized to lowercase
|
||||
config1 := signin.GetFullConfig("EN")
|
||||
config2 := signin.GetFullConfig("en")
|
||||
assert.Equal(t, config1, config2, "Language codes should be normalized to lowercase")
|
||||
|
||||
config3 := signin.GetPublicConfig("ZH-CN")
|
||||
config4 := signin.GetPublicConfig("zh-cn")
|
||||
assert.Equal(t, config3, config4, "Language codes should be normalized to lowercase")
|
||||
}
|
||||
|
||||
func TestSigninConfigStructure(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Get a config to test structure
|
||||
config := signin.GetFullConfig("")
|
||||
if config != nil {
|
||||
t.Logf("Config loaded successfully with title: %s", config.Title)
|
||||
|
||||
// Verify config structure is valid
|
||||
assert.IsType(t, &signin.Config{}, config, "Should return correct config type")
|
||||
|
||||
// Test new configuration fields
|
||||
assert.IsType(t, "", config.ClientID, "ClientID should be string")
|
||||
assert.IsType(t, "", config.ClientSecret, "ClientSecret should be string")
|
||||
assert.IsType(t, false, config.Default, "Default should be boolean")
|
||||
t.Logf("Config has ClientID: %t, ClientSecret: %t, Default: %t",
|
||||
config.ClientID != "", config.ClientSecret != "", config.Default)
|
||||
|
||||
// Test form configuration
|
||||
if config.Form != nil {
|
||||
t.Logf("Form configuration found")
|
||||
if config.Form.Username != nil {
|
||||
assert.IsType(t, []string{}, config.Form.Username.Fields, "Username fields should be string slice")
|
||||
}
|
||||
if config.Form.Captcha != nil {
|
||||
assert.IsType(t, map[string]interface{}{}, config.Form.Captcha.Options, "Captcha options should be map")
|
||||
}
|
||||
}
|
||||
|
||||
// Test third party configuration
|
||||
if config.ThirdParty != nil {
|
||||
t.Logf("Third party configuration found with %d providers", len(config.ThirdParty.Providers))
|
||||
if config.ThirdParty.Providers != nil {
|
||||
assert.IsType(t, []*signin.Provider{}, config.ThirdParty.Providers, "Providers should be slice of Provider pointers")
|
||||
for i, provider := range config.ThirdParty.Providers {
|
||||
t.Logf("Provider %d: %s", i, provider.ID)
|
||||
|
||||
// In the new structure, ThirdParty providers only contain display information
|
||||
// Sensitive configuration data is stored separately in the global providers map
|
||||
assert.NotEmpty(t, provider.ID, "Provider ID should not be empty")
|
||||
assert.NotEmpty(t, provider.Title, "Provider title should not be empty")
|
||||
|
||||
// These fields should be empty in ThirdParty providers (they're in global map now)
|
||||
assert.Empty(t, provider.Scopes, "Provider scopes should be empty in ThirdParty providers")
|
||||
assert.Nil(t, provider.Mapping, "Provider mapping should be nil in ThirdParty providers")
|
||||
assert.Nil(t, provider.Endpoints, "Provider endpoints should be nil in ThirdParty providers")
|
||||
assert.Nil(t, provider.Register, "Provider register should be nil in ThirdParty providers (it's in global map now)")
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
t.Log("No signin configuration found")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSigninGlobalProvidersMap(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Test that providers can be retrieved from global map (no locale needed)
|
||||
providerIDs := []string{"google", "microsoft", "apple", "github"}
|
||||
|
||||
for _, providerID := range providerIDs {
|
||||
t.Run("provider_"+providerID, func(t *testing.T) {
|
||||
provider, err := signin.GetProvider(providerID)
|
||||
|
||||
// Note: Provider might not be found if configuration files don't exist
|
||||
// or if environment variables are not set, which is normal in test environment
|
||||
if err != nil {
|
||||
t.Logf("Provider '%s' not found (expected in test environment): %v", providerID, err)
|
||||
return
|
||||
}
|
||||
|
||||
if provider != nil {
|
||||
assert.Equal(t, providerID, provider.ID, "Provider ID should match")
|
||||
t.Logf("Provider '%s' loaded successfully", providerID)
|
||||
|
||||
// Test provider structure
|
||||
assert.IsType(t, "", provider.ClientID, "ClientID should be string")
|
||||
assert.IsType(t, "", provider.ClientSecret, "ClientSecret should be string")
|
||||
assert.IsType(t, []string{}, provider.Scopes, "Scopes should be string slice")
|
||||
|
||||
if provider.Endpoints != nil {
|
||||
assert.IsType(t, "", provider.Endpoints.Authorization, "Authorization endpoint should be string")
|
||||
assert.IsType(t, "", provider.Endpoints.Token, "Token endpoint should be string")
|
||||
assert.IsType(t, "", provider.Endpoints.UserInfo, "UserInfo endpoint should be string")
|
||||
}
|
||||
|
||||
// Test register configuration (should be present in global providers)
|
||||
if provider.Register != nil {
|
||||
assert.IsType(t, false, provider.Register.Auto, "Register auto should be boolean")
|
||||
assert.IsType(t, "", provider.Register.Role, "Register role should be string")
|
||||
t.Logf("Provider '%s' has register config: auto=%t, role=%s",
|
||||
providerID, provider.Register.Auto, provider.Register.Role)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// Test nonexistent provider
|
||||
t.Run("nonexistent_provider", func(t *testing.T) {
|
||||
provider, err := signin.GetProvider("nonexistent")
|
||||
assert.Error(t, err, "Should return error for nonexistent provider")
|
||||
assert.Nil(t, provider, "Should return nil provider for nonexistent provider")
|
||||
assert.Contains(t, err.Error(), "not found", "Error message should indicate provider not found")
|
||||
})
|
||||
}
|
||||
|
||||
func TestSigninAPI(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
// Get base URL from server config
|
||||
baseURL := ""
|
||||
if openapi.Server != nil && openapi.Server.Config != nil {
|
||||
baseURL = openapi.Server.Config.BaseURL
|
||||
}
|
||||
|
||||
// Test API endpoints
|
||||
testCases := []struct {
|
||||
name string
|
||||
endpoint string
|
||||
expectCode int
|
||||
}{
|
||||
{"get config without locale", "/signin", 200},
|
||||
{"get config with en locale", "/signin?locale=en", 200},
|
||||
{"get config with zh-cn locale", "/signin?locale=zh-cn", 200},
|
||||
{"get config with invalid locale", "/signin?locale=invalid", 200}, // should fallback to default
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
url := serverURL + baseURL + tc.endpoint
|
||||
resp, err := http.Get(url)
|
||||
assert.NoError(t, err, "HTTP request should succeed")
|
||||
|
||||
if resp != nil {
|
||||
defer resp.Body.Close()
|
||||
assert.Equal(t, tc.expectCode, resp.StatusCode, "Expected status code %d", tc.expectCode)
|
||||
|
||||
if resp.StatusCode == 200 {
|
||||
// Parse response body
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
assert.NoError(t, err, "Should read response body")
|
||||
|
||||
var config signin.Config
|
||||
err = json.Unmarshal(body, &config)
|
||||
assert.NoError(t, err, "Should parse JSON response")
|
||||
|
||||
t.Logf("API response for %s: %s", tc.endpoint, config.Title)
|
||||
|
||||
// Verify it's public config (no sensitive data)
|
||||
if config.ThirdParty != nil && config.ThirdParty.Providers != nil {
|
||||
for _, provider := range config.ThirdParty.Providers {
|
||||
// Check that sensitive OAuth fields are removed from API response
|
||||
assert.Empty(t, provider.ClientID, "Client ID should be empty in API response")
|
||||
assert.Empty(t, provider.ClientSecret, "Client secret should be empty in API response")
|
||||
assert.Nil(t, provider.ClientSecretGenerator, "Client secret generator should be nil in API response")
|
||||
assert.Empty(t, provider.Scopes, "Scopes should be empty in API response")
|
||||
assert.Nil(t, provider.Endpoints, "Endpoints should be nil in API response")
|
||||
assert.Empty(t, provider.Mapping, "Mapping should be empty in API response")
|
||||
|
||||
// Check that display fields are preserved in API response
|
||||
assert.NotEmpty(t, provider.ID, "Provider ID should be preserved in API response")
|
||||
assert.NotEmpty(t, provider.Title, "Provider title should be preserved in API response")
|
||||
}
|
||||
}
|
||||
|
||||
// Verify captcha sensitive data is removed from API response
|
||||
if config.Form != nil && config.Form.Captcha != nil && config.Form.Captcha.Options != nil {
|
||||
_, hasSecret := config.Form.Captcha.Options["secret"]
|
||||
assert.False(t, hasSecret, "Captcha secret should be removed from API response")
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSigninOAuthAuthorizationURL(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
// Get base URL from server config
|
||||
baseURL := ""
|
||||
if openapi.Server != nil && openapi.Server.Config != nil {
|
||||
baseURL = openapi.Server.Config.BaseURL
|
||||
}
|
||||
|
||||
// Test OAuth authorization URL endpoints
|
||||
// Note: These should return 200 when OAuth client credentials are properly configured
|
||||
// (which they are in this test environment). Only nonexistent providers should return 404.
|
||||
testCases := []struct {
|
||||
name string
|
||||
provider string
|
||||
query string
|
||||
expectCode int
|
||||
expectErrorMsg string
|
||||
}{
|
||||
{"get google oauth url", "google", "", 200, ""},
|
||||
{"get microsoft oauth url", "microsoft", "", 200, ""},
|
||||
{"get apple oauth url", "apple", "", 200, ""},
|
||||
{"get github oauth url", "github", "", 200, ""},
|
||||
{"get oauth url with redirect_uri", "google", "?redirect_uri=https://example.com/callback", 200, ""},
|
||||
{"get oauth url with state", "google", "?state=test-state-123", 200, ""},
|
||||
{"get oauth url for nonexistent provider", "nonexistent", "", 404, "Failed to get provider"},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
url := serverURL + baseURL + "/signin/oauth/" + tc.provider + "/authorize" + tc.query
|
||||
resp, err := http.Get(url)
|
||||
assert.NoError(t, err, "HTTP request should succeed")
|
||||
|
||||
if resp != nil {
|
||||
defer resp.Body.Close()
|
||||
assert.Equal(t, tc.expectCode, resp.StatusCode, "Expected status code %d", tc.expectCode)
|
||||
|
||||
// Parse response body
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
assert.NoError(t, err, "Should read response body")
|
||||
|
||||
t.Logf("Response for %s: status=%d, body=%s", tc.provider, resp.StatusCode, string(body))
|
||||
|
||||
var response map[string]interface{}
|
||||
err = json.Unmarshal(body, &response)
|
||||
assert.NoError(t, err, "Should parse JSON response")
|
||||
|
||||
if tc.expectCode == 200 {
|
||||
// Success case - should have authorization_url
|
||||
if authURL, hasAuthURL := response["authorization_url"]; hasAuthURL {
|
||||
authURLStr, ok := authURL.(string)
|
||||
assert.True(t, ok, "authorization_url should be string")
|
||||
assert.NotEmpty(t, authURLStr, "authorization_url should not be empty")
|
||||
t.Logf("Authorization URL generated successfully for %s", tc.provider)
|
||||
} else {
|
||||
t.Errorf("Success response should contain authorization_url field")
|
||||
}
|
||||
} else {
|
||||
// Error case - should have error fields
|
||||
if errorDescription, hasError := response["error_description"]; hasError {
|
||||
errorDescStr, ok := errorDescription.(string)
|
||||
assert.True(t, ok, "error_description should be string")
|
||||
assert.Equal(t, tc.expectErrorMsg, errorDescStr, "Error message should match expected")
|
||||
} else {
|
||||
t.Errorf("Error response should contain error_description field")
|
||||
}
|
||||
|
||||
// Verify error code is present
|
||||
if errorCode, hasErrorCode := response["error"]; hasErrorCode {
|
||||
assert.Equal(t, "invalid_request", errorCode, "Error code should be invalid_request")
|
||||
} else {
|
||||
t.Errorf("Error response should contain error field")
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSigninENVVariableReplacement(t *testing.T) {
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations to trigger ENV variable processing
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Get full config to check ENV variable replacement
|
||||
fullConfig := signin.GetFullConfig("")
|
||||
assert.NotNil(t, fullConfig, "Should have a signin configuration")
|
||||
|
||||
// Test captcha ENV variable replacement
|
||||
if fullConfig.Form != nil && fullConfig.Form.Captcha != nil && fullConfig.Form.Captcha.Options != nil {
|
||||
if sitekey, hasSitekey := fullConfig.Form.Captcha.Options["sitekey"]; hasSitekey {
|
||||
sitekeyStr, ok := sitekey.(string)
|
||||
assert.True(t, ok, "Sitekey should be string")
|
||||
// Should not contain ENV placeholder (either replaced or empty)
|
||||
assert.NotContains(t, sitekeyStr, "$ENV.", "Sitekey should not contain ENV placeholder")
|
||||
t.Logf("Captcha sitekey after ENV replacement: %s", sitekeyStr)
|
||||
}
|
||||
|
||||
if secret, hasSecret := fullConfig.Form.Captcha.Options["secret"]; hasSecret {
|
||||
secretStr, ok := secret.(string)
|
||||
assert.True(t, ok, "Secret should be string")
|
||||
// Should not contain ENV placeholder (either replaced or empty)
|
||||
assert.NotContains(t, secretStr, "$ENV.", "Secret should not contain ENV placeholder")
|
||||
t.Logf("Captcha secret after ENV replacement: %s", secretStr)
|
||||
}
|
||||
}
|
||||
|
||||
// Test OAuth provider ENV variable replacement
|
||||
if fullConfig.ThirdParty != nil && fullConfig.ThirdParty.Providers != nil {
|
||||
for _, provider := range fullConfig.ThirdParty.Providers {
|
||||
// Check ClientID replacement
|
||||
if provider.ClientID != "" {
|
||||
assert.NotContains(t, provider.ClientID, "$ENV.", "ClientID should not contain ENV placeholder")
|
||||
t.Logf("Provider %s ClientID after ENV replacement: %s", provider.ID, provider.ClientID)
|
||||
}
|
||||
|
||||
// Check ClientSecret replacement
|
||||
if provider.ClientSecret != "" {
|
||||
assert.NotContains(t, provider.ClientSecret, "$ENV.", "ClientSecret should not contain ENV placeholder")
|
||||
t.Logf("Provider %s ClientSecret after ENV replacement: [REDACTED]", provider.ID)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Test that public config doesn't expose ENV variables or actual sensitive values
|
||||
publicConfig := signin.GetPublicConfig("")
|
||||
assert.NotNil(t, publicConfig, "Should have a public signin configuration")
|
||||
|
||||
// Public config should not contain sensitive data even if ENV variables are set
|
||||
if publicConfig.Form != nil && publicConfig.Form.Captcha != nil && publicConfig.Form.Captcha.Options != nil {
|
||||
_, hasSecret := publicConfig.Form.Captcha.Options["secret"]
|
||||
assert.False(t, hasSecret, "Public config should not contain captcha secret")
|
||||
}
|
||||
|
||||
if publicConfig.ThirdParty != nil && publicConfig.ThirdParty.Providers != nil {
|
||||
for _, provider := range publicConfig.ThirdParty.Providers {
|
||||
assert.Empty(t, provider.ClientID, "Public config should not contain ClientID")
|
||||
assert.Empty(t, provider.ClientSecret, "Public config should not contain ClientSecret")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSigninENVVariableMissingHandling(t *testing.T) {
|
||||
// This test verifies that missing ENV variables are handled securely
|
||||
// by returning empty strings instead of exposing the placeholder
|
||||
|
||||
// Initialize test environment
|
||||
serverURL := testutils.Prepare(t)
|
||||
defer testutils.Clean()
|
||||
|
||||
_ = serverURL // Server URL not needed for this test
|
||||
|
||||
// Load signin configurations
|
||||
err := signin.Load(config.Conf)
|
||||
assert.NoError(t, err, "signin.Load should succeed")
|
||||
|
||||
// Get public config (this is what the API returns)
|
||||
publicConfig := signin.GetPublicConfig("")
|
||||
assert.NotNil(t, publicConfig, "Should have a public signin configuration")
|
||||
|
||||
// Verify that even if ENV variables are missing, no placeholders are exposed
|
||||
if publicConfig.Form != nil && publicConfig.Form.Captcha != nil && publicConfig.Form.Captcha.Options != nil {
|
||||
for key, value := range publicConfig.Form.Captcha.Options {
|
||||
if valueStr, ok := value.(string); ok {
|
||||
assert.NotContains(t, valueStr, "$ENV.", "Public config should not contain ENV placeholders in %s", key)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if publicConfig.ThirdParty != nil && publicConfig.ThirdParty.Providers != nil {
|
||||
for _, provider := range publicConfig.ThirdParty.Providers {
|
||||
// These should be empty in public config anyway, but verify no ENV placeholders
|
||||
assert.NotContains(t, provider.ClientID, "$ENV.", "Public config ClientID should not contain ENV placeholders")
|
||||
assert.NotContains(t, provider.ClientSecret, "$ENV.", "Public config ClientSecret should not contain ENV placeholders")
|
||||
}
|
||||
}
|
||||
|
||||
t.Log("ENV variable security test passed: no ENV placeholders exposed in public configuration")
|
||||
}
|
||||
|
|
@ -216,9 +216,9 @@ func loadProviders(_ string) error {
|
|||
return nil
|
||||
}
|
||||
|
||||
// loadSigninConfigs loads all signin configurations from the openapi/user directory
|
||||
// loadSigninConfigs loads all signin configurations from the openapi/signin directory
|
||||
func loadSigninConfigs(_ string) error {
|
||||
// Use Walk to find all configuration files in the signin directory
|
||||
// Use Walk to find all configuration files in the user directory
|
||||
err := application.App.Walk("openapi/user", func(root, filename string, isdir bool) error {
|
||||
if isdir {
|
||||
return nil
|
||||
|
|
@ -236,7 +236,7 @@ func loadSigninConfigs(_ string) error {
|
|||
|
||||
// Extract locale from filename (basename without extension)
|
||||
baseName := filepath.Base(filename)
|
||||
locale := strings.TrimSuffix(baseName, ".yao")
|
||||
locale := strings.ToLower(strings.TrimSuffix(baseName, ".yao"))
|
||||
|
||||
// Read configuration
|
||||
configRaw, err := application.App.Read(filename)
|
||||
|
|
@ -252,8 +252,7 @@ func loadSigninConfigs(_ string) error {
|
|||
}
|
||||
|
||||
// Process ENV variables in the configuration
|
||||
config.ClientID = replaceENVVar(config.ClientID)
|
||||
config.ClientSecret = replaceENVVar(config.ClientSecret)
|
||||
processConfigENVVariables(&config)
|
||||
|
||||
// Store full configuration
|
||||
fullConfigs[locale] = &config
|
||||
|
|
@ -296,30 +295,26 @@ func GetPublicConfig(locale string) *Config {
|
|||
configMutex.RLock()
|
||||
defer configMutex.RUnlock()
|
||||
|
||||
// Normalize language code to lowercase
|
||||
if locale != "" {
|
||||
locale = strings.ToLower(locale)
|
||||
}
|
||||
|
||||
// Try to get the specific locale configuration
|
||||
if config, exists := publicConfigs[locale]; exists {
|
||||
return config
|
||||
}
|
||||
|
||||
// Fallback to default configuration
|
||||
// Fallback to default config's public version
|
||||
if defaultConfig != nil {
|
||||
// Create a copy of default config for public use
|
||||
publicDefault := *defaultConfig
|
||||
publicDefault.ClientSecret = "" // Remove sensitive data
|
||||
|
||||
// Remove captcha secret from public config
|
||||
if publicDefault.Form != nil && publicDefault.Form.Captcha != nil && publicDefault.Form.Captcha.Options != nil {
|
||||
// Create a copy of captcha options without the secret
|
||||
captchaOptions := make(map[string]interface{})
|
||||
for k, v := range publicDefault.Form.Captcha.Options {
|
||||
if k != "secret" {
|
||||
captchaOptions[k] = v
|
||||
// Find the public version of the default config
|
||||
for lang, fullConfig := range fullConfigs {
|
||||
if fullConfig == defaultConfig {
|
||||
if publicConfig, exists := publicConfigs[lang]; exists {
|
||||
return publicConfig
|
||||
}
|
||||
}
|
||||
publicDefault.Form.Captcha.Options = captchaOptions
|
||||
}
|
||||
|
||||
return &publicDefault
|
||||
}
|
||||
|
||||
// If no default, try to get any available configuration
|
||||
|
|
@ -417,3 +412,46 @@ func normalizeDuration(expiresIn string) (string, error) {
|
|||
|
||||
return normalized, nil
|
||||
}
|
||||
|
||||
// processConfigENVVariables processes environment variables in the signin configuration
|
||||
func processConfigENVVariables(config *Config) {
|
||||
var missingEnvVars []string
|
||||
|
||||
// Process client_id and client_secret
|
||||
if strings.HasPrefix(config.ClientID, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(config.ClientID, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.ClientID = replaceENVVar(config.ClientID)
|
||||
|
||||
if strings.HasPrefix(config.ClientSecret, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(config.ClientSecret, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.ClientSecret = replaceENVVar(config.ClientSecret)
|
||||
|
||||
// Process form captcha options
|
||||
if config.Form != nil && config.Form.Captcha != nil && config.Form.Captcha.Options != nil {
|
||||
for key, value := range config.Form.Captcha.Options {
|
||||
if strValue, ok := value.(string); ok {
|
||||
// Check if ENV variable exists before replacement
|
||||
if strings.HasPrefix(strValue, "$ENV.") {
|
||||
envVar := strings.TrimPrefix(strValue, "$ENV.")
|
||||
if _, exists := os.LookupEnv(envVar); !exists {
|
||||
missingEnvVars = append(missingEnvVars, envVar)
|
||||
}
|
||||
}
|
||||
config.Form.Captcha.Options[key] = replaceENVVar(strValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Log warning for missing environment variables (optional, can be removed if log package not available)
|
||||
if len(missingEnvVars) > 0 {
|
||||
fmt.Printf("Warning: The following environment variables are not set in user configuration: %v\n", missingEnvVars)
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,12 +3,14 @@ package user
|
|||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/yaoapp/gou/session"
|
||||
"github.com/yaoapp/kun/log"
|
||||
"github.com/yaoapp/yao/helper"
|
||||
"github.com/yaoapp/yao/openapi/oauth"
|
||||
"github.com/yaoapp/yao/openapi/oauth/providers/user"
|
||||
oauthtypes "github.com/yaoapp/yao/openapi/oauth/types"
|
||||
|
|
@ -51,6 +53,56 @@ func login(c *gin.Context) {
|
|||
// You may need to implement the actual login logic here
|
||||
}
|
||||
|
||||
// getCaptcha is the handler for get captcha image for login
|
||||
func getCaptcha(c *gin.Context) {
|
||||
var option helper.CaptchaOption = helper.NewCaptchaOption()
|
||||
|
||||
err := c.ShouldBindQuery(&option)
|
||||
if err != nil {
|
||||
response.RespondWithError(c, http.StatusBadRequest, &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: err.Error(),
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
// Set the type to image
|
||||
option.Type = "image"
|
||||
id, content := helper.CaptchaMake(option)
|
||||
|
||||
// Return in the format expected by the frontend
|
||||
response.RespondWithSuccess(c, http.StatusOK, gin.H{
|
||||
"captcha_id": id,
|
||||
"captcha_image": content,
|
||||
"expires_in": 300, // 5 minutes
|
||||
})
|
||||
}
|
||||
|
||||
// refreshCaptcha is the handler for refresh captcha image
|
||||
func refreshCaptcha(c *gin.Context) {
|
||||
var option helper.CaptchaOption = helper.NewCaptchaOption()
|
||||
|
||||
err := c.ShouldBindQuery(&option)
|
||||
if err != nil {
|
||||
response.RespondWithError(c, http.StatusBadRequest, &response.ErrorResponse{
|
||||
Code: response.ErrInvalidRequest.Code,
|
||||
ErrorDescription: err.Error(),
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
// Set the type to image
|
||||
option.Type = "image"
|
||||
id, content := helper.CaptchaMake(option)
|
||||
|
||||
// Return in the format expected by the frontend
|
||||
response.RespondWithSuccess(c, http.StatusOK, gin.H{
|
||||
"captcha_id": id,
|
||||
"captcha_image": content,
|
||||
"expires_in": 300, // 5 minutes
|
||||
})
|
||||
}
|
||||
|
||||
// LoginThirdParty is the handler for third party login
|
||||
func LoginThirdParty(providerID string, userinfo *oauthtypes.OIDCUserInfo, ip string) (*LoginResponse, error) {
|
||||
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ func Attach(group *gin.RouterGroup, oauth types.OAuth) {
|
|||
// User Authentication (migrated from /signin)
|
||||
group.GET("/login", getLoginConfig) // Get login page config (public) - migrated from /signin
|
||||
group.POST("/login", login) // User login (public) - migrated from /signin
|
||||
group.GET("/login/captcha", getCaptcha) // Get captcha for login (public)
|
||||
group.POST("/register", placeholder) // User register (public)
|
||||
group.POST("/logout", oauth.Guard, placeholder) // User logout
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue