7 changed files with 510 additions and 35 deletions
@ -0,0 +1,304 @@ |
|||||
|
package auth |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"crypto/rand" |
||||
|
"encoding/base64" |
||||
|
"encoding/hex" |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"io" |
||||
|
"net/http" |
||||
|
"net/url" |
||||
|
"strings" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/youruser/base/internal/svc" |
||||
|
"github.com/youruser/base/internal/util/jwt" |
||||
|
"github.com/youruser/base/model" |
||||
|
|
||||
|
"github.com/zeromicro/go-zero/core/logx" |
||||
|
) |
||||
|
|
||||
|
// casdoorHttpClient 用于与 Casdoor 通信的 HTTP 客户端（带超时）
|
||||
|
var casdoorHttpClient = &http.Client{Timeout: 10 * time.Second} |
||||
|
|
||||
|
type SSOLogic struct { |
||||
|
logx.Logger |
||||
|
ctx context.Context |
||||
|
svcCtx *svc.ServiceContext |
||||
|
} |
||||
|
|
||||
|
func NewSSOLogic(ctx context.Context, svcCtx *svc.ServiceContext) *SSOLogic { |
||||
|
return &SSOLogic{ |
||||
|
Logger: logx.WithContext(ctx), |
||||
|
ctx: ctx, |
||||
|
svcCtx: svcCtx, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// GetLoginUrl 生成 Casdoor SSO 登录链接
|
||||
|
func (l *SSOLogic) GetLoginUrl() (map[string]string, error) { |
||||
|
c := l.svcCtx.Config.Casdoor |
||||
|
|
||||
|
state, err := generateState() |
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("生成 state 失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
loginUrl := fmt.Sprintf("%s/login/oauth/authorize?client_id=%s&response_type=code&redirect_uri=%s&scope=read&state=%s", |
||||
|
c.Endpoint, |
||||
|
url.QueryEscape(c.ClientId), |
||||
|
url.QueryEscape(c.RedirectUrl), |
||||
|
url.QueryEscape(state), |
||||
|
) |
||||
|
|
||||
|
return map[string]string{ |
||||
|
"login_url": loginUrl, |
||||
|
}, nil |
||||
|
} |
||||
|
|
||||
|
// casdoorTokenResponse Casdoor token 响应
|
||||
|
type casdoorTokenResponse struct { |
||||
|
AccessToken string `json:"access_token"` |
||||
|
TokenType string `json:"token_type"` |
||||
|
ExpiresIn int `json:"expires_in"` |
||||
|
Scope string `json:"scope"` |
||||
|
} |
||||
|
|
||||
|
// casdoorUserInfo Casdoor 用户信息
|
||||
|
type casdoorUserInfo struct { |
||||
|
Sub string `json:"sub"` |
||||
|
Name string `json:"name"` |
||||
|
PreferredUsername string `json:"preferred_username"` |
||||
|
Email string `json:"email"` |
||||
|
Phone string `json:"phone"` |
||||
|
Avatar string `json:"avatar"` |
||||
|
} |
||||
|
|
||||
|
// HandleCallback 处理 SSO 回调
|
||||
|
func (l *SSOLogic) HandleCallback(code, state string) (string, error) { |
||||
|
if code == "" { |
||||
|
return "", fmt.Errorf("缺少授权码") |
||||
|
} |
||||
|
|
||||
|
c := l.svcCtx.Config.Casdoor |
||||
|
|
||||
|
// 1. 用 code 换取 access_token
|
||||
|
accessToken, err := l.exchangeToken(code) |
||||
|
if err != nil { |
||||
|
l.Errorf("SSO token 交换失败: %v", err) |
||||
|
return "", fmt.Errorf("token 交换失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
// 2. 获取用户信息
|
||||
|
userInfo, err := l.getUserInfo(accessToken) |
||||
|
if err != nil { |
||||
|
l.Errorf("SSO 获取用户信息失败: %v", err) |
||||
|
return "", fmt.Errorf("获取用户信息失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
// 3. 查找或创建本地用户
|
||||
|
casdoorId := userInfo.Sub |
||||
|
if casdoorId == "" { |
||||
|
casdoorId = userInfo.Name |
||||
|
} |
||||
|
|
||||
|
// 从 Casdoor 信息中提取用户名和邮箱
|
||||
|
username := userInfo.PreferredUsername |
||||
|
if username == "" { |
||||
|
username = userInfo.Name |
||||
|
} |
||||
|
email := userInfo.Email |
||||
|
if email == "" { |
||||
|
email = username + "@sso.local" |
||||
|
} |
||||
|
|
||||
|
localUser, err := model.FindOneByCasdoorId(l.ctx, l.svcCtx.DB, casdoorId) |
||||
|
if err != nil { |
||||
|
if err == model.ErrNotFound { |
||||
|
// 用户不存在，尝试通过邮箱关联已有本地用户
|
||||
|
existingUser, findErr := model.FindOneByEmail(l.ctx, l.svcCtx.DB, email) |
||||
|
if findErr == nil { |
||||
|
existingUser.CasdoorId = casdoorId |
||||
|
existingUser.UserType = "casdoor" |
||||
|
if updateErr := model.Update(l.ctx, l.svcCtx.DB, existingUser); updateErr != nil { |
||||
|
return "", fmt.Errorf("关联用户失败: %v", updateErr) |
||||
|
} |
||||
|
localUser = existingUser |
||||
|
l.Infof("SSO 关联已有用户: userId=%d, casdoorId=%s", existingUser.Id, casdoorId) |
||||
|
} else { |
||||
|
// 创建新用户
|
||||
|
newUser := &model.User{ |
||||
|
Username: username, |
||||
|
Email: email, |
||||
|
Password: "SSO_NO_PASSWORD", // SSO 用户不使用密码登录
|
||||
|
Phone: userInfo.Phone, |
||||
|
CasdoorId: casdoorId, |
||||
|
UserType: "casdoor", |
||||
|
Role: model.RoleUser, |
||||
|
Source: model.SourceCasdoor, |
||||
|
Status: 1, |
||||
|
} |
||||
|
|
||||
|
_, insertErr := model.Insert(l.ctx, l.svcCtx.DB, newUser) |
||||
|
if insertErr != nil { |
||||
|
l.Errorf("SSO 创建用户失败: %v", insertErr) |
||||
|
return "", fmt.Errorf("创建用户失败: %v", insertErr) |
||||
|
} |
||||
|
|
||||
|
localUser = newUser |
||||
|
l.Infof("SSO 新用户创建成功: username=%s, casdoorId=%s", username, casdoorId) |
||||
|
} |
||||
|
} else { |
||||
|
return "", fmt.Errorf("查询用户失败: %v", err) |
||||
|
} |
||||
|
} else { |
||||
|
// 已有用户，同步更新 Casdoor 端的最新信息
|
||||
|
updated := false |
||||
|
if username != "" && localUser.Username != username { |
||||
|
localUser.Username = username |
||||
|
updated = true |
||||
|
} |
||||
|
if email != "" && localUser.Email != email { |
||||
|
localUser.Email = email |
||||
|
updated = true |
||||
|
} |
||||
|
if userInfo.Phone != "" && localUser.Phone != userInfo.Phone { |
||||
|
localUser.Phone = userInfo.Phone |
||||
|
updated = true |
||||
|
} |
||||
|
if updated { |
||||
|
if updateErr := model.Update(l.ctx, l.svcCtx.DB, localUser); updateErr != nil { |
||||
|
l.Errorf("SSO 同步用户信息失败: %v", updateErr) |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// 4. 生成本地 JWT Token
|
||||
|
token, err := jwt.GenerateToken(localUser.Id, localUser.Username, localUser.Role) |
||||
|
if err != nil { |
||||
|
return "", fmt.Errorf("生成 Token 失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
l.Infof("SSO 登录成功: userId=%d, username=%s", localUser.Id, localUser.Username) |
||||
|
|
||||
|
// 5. 构建前端回调 URL
|
||||
|
redirectUrl := fmt.Sprintf("%s/sso/callback?token=%s", |
||||
|
c.FrontendUrl, |
||||
|
url.QueryEscape(token), |
||||
|
) |
||||
|
|
||||
|
return redirectUrl, nil |
||||
|
} |
||||
|
|
||||
|
// exchangeToken 用授权码换取 access_token
|
||||
|
func (l *SSOLogic) exchangeToken(code string) (string, error) { |
||||
|
c := l.svcCtx.Config.Casdoor |
||||
|
|
||||
|
tokenUrl := fmt.Sprintf("%s/api/login/oauth/access_token", c.Endpoint) |
||||
|
|
||||
|
data := url.Values{} |
||||
|
data.Set("grant_type", "authorization_code") |
||||
|
data.Set("client_id", c.ClientId) |
||||
|
data.Set("client_secret", c.ClientSecret) |
||||
|
data.Set("code", code) |
||||
|
data.Set("redirect_uri", c.RedirectUrl) |
||||
|
|
||||
|
req, err := http.NewRequestWithContext(l.ctx, http.MethodPost, tokenUrl, |
||||
|
strings.NewReader(data.Encode())) |
||||
|
if err != nil { |
||||
|
return "", fmt.Errorf("创建请求失败: %v", err) |
||||
|
} |
||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
||||
|
|
||||
|
resp, err := casdoorHttpClient.Do(req) |
||||
|
if err != nil { |
||||
|
return "", fmt.Errorf("请求 token 失败: %v", err) |
||||
|
} |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
if err != nil { |
||||
|
return "", fmt.Errorf("读取响应失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
if resp.StatusCode != http.StatusOK { |
||||
|
return "", fmt.Errorf("token 请求返回 %d: %s", resp.StatusCode, string(body)) |
||||
|
} |
||||
|
|
||||
|
var tokenResp casdoorTokenResponse |
||||
|
if err := json.Unmarshal(body, &tokenResp); err != nil { |
||||
|
return "", fmt.Errorf("解析 token 响应失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
if tokenResp.AccessToken == "" { |
||||
|
return "", fmt.Errorf("未获取到 access_token, 响应: %s", string(body)) |
||||
|
} |
||||
|
|
||||
|
return tokenResp.AccessToken, nil |
||||
|
} |
||||
|
|
||||
|
// getUserInfo 从 access_token JWT 中解析用户信息
|
||||
|
// Casdoor 的 access_token 本身是一个 JWT，包含完整的用户 claims
|
||||
|
func (l *SSOLogic) getUserInfo(accessToken string) (*casdoorUserInfo, error) { |
||||
|
// 解析 JWT payload（不验证签名，因为 token 刚从 Casdoor 获取）
|
||||
|
parts := strings.Split(accessToken, ".") |
||||
|
if len(parts) != 3 { |
||||
|
return nil, fmt.Errorf("access_token 不是有效的 JWT 格式") |
||||
|
} |
||||
|
|
||||
|
// Base64 解码 payload
|
||||
|
payload := parts[1] |
||||
|
// 补齐 base64 padding
|
||||
|
switch len(payload) % 4 { |
||||
|
case 2: |
||||
|
payload += "==" |
||||
|
case 3: |
||||
|
payload += "=" |
||||
|
} |
||||
|
|
||||
|
decoded, err := base64.URLEncoding.DecodeString(payload) |
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("解码 JWT payload 失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
// 解析 JWT claims
|
||||
|
var claims map[string]interface{} |
||||
|
if err := json.Unmarshal(decoded, &claims); err != nil { |
||||
|
return nil, fmt.Errorf("解析 JWT claims 失败: %v", err) |
||||
|
} |
||||
|
|
||||
|
// 从 claims 中提取用户信息（Casdoor JWT 字段名）
|
||||
|
userInfo := &casdoorUserInfo{ |
||||
|
Sub: getStringClaim(claims, "sub"), |
||||
|
} |
||||
|
|
||||
|
// Casdoor JWT 中用户名可能在 name 或 preferred_username 字段
|
||||
|
userInfo.Name = getStringClaim(claims, "name") |
||||
|
userInfo.PreferredUsername = getStringClaim(claims, "preferred_username") |
||||
|
userInfo.Email = getStringClaim(claims, "email") |
||||
|
userInfo.Phone = getStringClaim(claims, "phone") |
||||
|
userInfo.Avatar = getStringClaim(claims, "avatar") |
||||
|
|
||||
|
return userInfo, nil |
||||
|
} |
||||
|
|
||||
|
// getStringClaim 从 claims map 中安全获取字符串值
|
||||
|
func getStringClaim(claims map[string]interface{}, key string) string { |
||||
|
if v, ok := claims[key]; ok { |
||||
|
if s, ok := v.(string); ok { |
||||
|
return s |
||||
|
} |
||||
|
} |
||||
|
return "" |
||||
|
} |
||||
|
|
||||
|
// generateState 生成随机 state 参数（CSRF 防护）
|
||||
|
func generateState() (string, error) { |
||||
|
b := make([]byte, 16) |
||||
|
if _, err := rand.Read(b); err != nil { |
||||
|
return "", err |
||||
|
} |
||||
|
return hex.EncodeToString(b), nil |
||||
|
} |
||||
Loading…
Reference in new issue