From 54bf6c1ed2cb870541a89f647012f2aa574a698e Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Tue, 5 Aug 2025 12:16:14 +0800
Subject: [PATCH] Add OpenAPI OAuth handling in defaultGuard

- Implemented guardOpenapiOauth function for OAuth token validation and session ID management.
- Enhanced defaultGuard to check for OpenAPI OAuth requests and process them accordingly.
- Added utility functions for access token and session ID retrieval from requests.
---
 neo/api.go | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/neo/api.go b/neo/api.go
index f9ff8470..0310f352 100644
--- a/neo/api.go
+++ b/neo/api.go
@@ -20,6 +20,7 @@ import (
 	chatctx "github.com/yaoapp/yao/neo/context"
 	"github.com/yaoapp/yao/neo/message"
 	"github.com/yaoapp/yao/neo/store"
+	"github.com/yaoapp/yao/openapi/oauth"
 )
 
 // API registers the Neo API endpoints
@@ -648,6 +649,13 @@ func (neo *DSL) getGuardHandlers() ([]gin.HandlerFunc, error) {
 
 // defaultGuard is the default authentication handler
 func (neo *DSL) defaultGuard(c *gin.Context) {
+
+	// Check if the request is for OpenAPI OAuth
+	if oauth.OAuth != nil {
+		neo.guardOpenapiOauth(c)
+		return
+	}
+
 	token := strings.TrimSpace(strings.TrimPrefix(c.Query("token"), "Bearer "))
 	if token == "" {
 		c.JSON(403, gin.H{"message": "token is required", "code": 403})
@@ -660,6 +668,55 @@ func (neo *DSL) defaultGuard(c *gin.Context) {
 	c.Next()
 }
 
+// Openapi Oauth
+func (neo *DSL) guardOpenapiOauth(c *gin.Context) {
+	s := oauth.OAuth
+	token := neo.getAccessToken(c)
+	if token == "" {
+		c.JSON(403, gin.H{"code": 403, "message": "Not Authorized"})
+		c.Abort()
+		return
+	}
+
+	// Validate the token
+	_, err := s.VerifyToken(token)
+	if err != nil {
+		c.JSON(403, gin.H{"code": 403, "message": "Not Authorized"})
+		c.Abort()
+		return
+	}
+
+	// Get the session ID
+	sid := neo.getSessionID(c)
+	if sid == "" {
+		c.JSON(403, gin.H{"code": 403, "message": "Not Authorized"})
+		c.Abort()
+		return
+	}
+
+	c.Set("__sid", sid)
+}
+
+func (neo *DSL) getAccessToken(c *gin.Context) string {
+	token := c.GetHeader("Authorization")
+	if token == "" || token == "Bearer undefined" {
+		cookie, err := c.Cookie("__Host-access_token")
+		if err != nil {
+			return ""
+		}
+		token = cookie
+	}
+	return strings.TrimPrefix(token, "Bearer ")
+}
+
+func (neo *DSL) getSessionID(c *gin.Context) string {
+	sid, err := c.Cookie("__Host-session_id")
+	if err != nil {
+		return ""
+	}
+	return sid
+}
+
 // handleChatLatest handles getting the latest chat
 func (neo *DSL) handleChatLatest(c *gin.Context) {
 	sid := c.GetString("__sid")