Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.
 
 
 

257 строки
9.0 KiB

  1. package model
  2. import (
  3. "errors"
  4. "fmt"
  5. "strings"
  6. "time"
  7. "github.com/QuantumNous/new-api/common"
  8. )
  9. type accessPolicyPayload struct {
  10. Logic string `json:"logic"`
  11. Conditions []accessConditionItem `json:"conditions"`
  12. Groups []accessPolicyPayload `json:"groups"`
  13. }
  14. type accessConditionItem struct {
  15. Field string `json:"field"`
  16. Op string `json:"op"`
  17. Value any `json:"value"`
  18. }
  19. var supportedAccessPolicyOps = map[string]struct{}{
  20. "eq": {},
  21. "ne": {},
  22. "gt": {},
  23. "gte": {},
  24. "lt": {},
  25. "lte": {},
  26. "in": {},
  27. "not_in": {},
  28. "contains": {},
  29. "not_contains": {},
  30. "exists": {},
  31. "not_exists": {},
  32. }
  33. // CustomOAuthProvider stores configuration for custom OAuth providers
  34. type CustomOAuthProvider struct {
  35. Id int `json:"id" gorm:"primaryKey"`
  36. Name string `json:"name" gorm:"type:varchar(64);not null"` // Display name, e.g., "GitHub Enterprise"
  37. Slug string `json:"slug" gorm:"type:varchar(64);uniqueIndex;not null"` // URL identifier, e.g., "github-enterprise"
  38. Icon string `json:"icon" gorm:"type:varchar(128);default:''"` // Icon name from @lobehub/icons
  39. Enabled bool `json:"enabled" gorm:"default:false"` // Whether this provider is enabled
  40. ClientId string `json:"client_id" gorm:"type:varchar(256)"` // OAuth client ID
  41. ClientSecret string `json:"-" gorm:"type:varchar(512)"` // OAuth client secret (not returned to frontend)
  42. AuthorizationEndpoint string `json:"authorization_endpoint" gorm:"type:varchar(512)"` // Authorization URL
  43. TokenEndpoint string `json:"token_endpoint" gorm:"type:varchar(512)"` // Token exchange URL
  44. UserInfoEndpoint string `json:"user_info_endpoint" gorm:"type:varchar(512)"` // User info URL
  45. Scopes string `json:"scopes" gorm:"type:varchar(256);default:'openid profile email'"` // OAuth scopes
  46. // Field mapping configuration (supports JSONPath via gjson)
  47. UserIdField string `json:"user_id_field" gorm:"type:varchar(128);default:'sub'"` // User ID field path, e.g., "sub", "id", "data.user.id"
  48. UsernameField string `json:"username_field" gorm:"type:varchar(128);default:'preferred_username'"` // Username field path
  49. DisplayNameField string `json:"display_name_field" gorm:"type:varchar(128);default:'name'"` // Display name field path
  50. EmailField string `json:"email_field" gorm:"type:varchar(128);default:'email'"` // Email field path
  51. // Advanced options
  52. WellKnown string `json:"well_known" gorm:"type:varchar(512)"` // OIDC discovery endpoint (optional)
  53. AuthStyle int `json:"auth_style" gorm:"default:0"` // 0=auto, 1=params, 2=header (Basic Auth)
  54. AccessPolicy string `json:"access_policy" gorm:"type:text"` // JSON policy for access control based on user info
  55. AccessDeniedMessage string `json:"access_denied_message" gorm:"type:varchar(512)"` // Custom error message template when access is denied
  56. CreatedAt time.Time `json:"created_at"`
  57. UpdatedAt time.Time `json:"updated_at"`
  58. }
  59. func (CustomOAuthProvider) TableName() string {
  60. return "custom_oauth_providers"
  61. }
  62. // GetAllCustomOAuthProviders returns all custom OAuth providers
  63. func GetAllCustomOAuthProviders() ([]*CustomOAuthProvider, error) {
  64. var providers []*CustomOAuthProvider
  65. err := DB.Order("id asc").Find(&providers).Error
  66. return providers, err
  67. }
  68. // GetEnabledCustomOAuthProviders returns all enabled custom OAuth providers
  69. func GetEnabledCustomOAuthProviders() ([]*CustomOAuthProvider, error) {
  70. var providers []*CustomOAuthProvider
  71. err := DB.Where("enabled = ?", true).Order("id asc").Find(&providers).Error
  72. return providers, err
  73. }
  74. // GetCustomOAuthProviderById returns a custom OAuth provider by ID
  75. func GetCustomOAuthProviderById(id int) (*CustomOAuthProvider, error) {
  76. var provider CustomOAuthProvider
  77. err := DB.First(&provider, id).Error
  78. if err != nil {
  79. return nil, err
  80. }
  81. return &provider, nil
  82. }
  83. // GetCustomOAuthProviderBySlug returns a custom OAuth provider by slug
  84. func GetCustomOAuthProviderBySlug(slug string) (*CustomOAuthProvider, error) {
  85. var provider CustomOAuthProvider
  86. err := DB.Where("slug = ?", slug).First(&provider).Error
  87. if err != nil {
  88. return nil, err
  89. }
  90. return &provider, nil
  91. }
  92. func GetCustomOAuthProvidersBySlugs(slugs []string) ([]*CustomOAuthProvider, error) {
  93. var providers []*CustomOAuthProvider
  94. if len(slugs) == 0 {
  95. return providers, nil
  96. }
  97. err := DB.Where("slug IN ?", slugs).Order("id asc").Find(&providers).Error
  98. return providers, err
  99. }
  100. // CreateCustomOAuthProvider creates a new custom OAuth provider
  101. func CreateCustomOAuthProvider(provider *CustomOAuthProvider) error {
  102. if err := validateCustomOAuthProvider(provider); err != nil {
  103. return err
  104. }
  105. return DB.Create(provider).Error
  106. }
  107. // UpdateCustomOAuthProvider updates an existing custom OAuth provider
  108. func UpdateCustomOAuthProvider(provider *CustomOAuthProvider) error {
  109. if err := validateCustomOAuthProvider(provider); err != nil {
  110. return err
  111. }
  112. return DB.Save(provider).Error
  113. }
  114. // DeleteCustomOAuthProvider deletes a custom OAuth provider by ID
  115. func DeleteCustomOAuthProvider(id int) error {
  116. // First, delete all user bindings for this provider
  117. if err := DB.Where("provider_id = ?", id).Delete(&UserOAuthBinding{}).Error; err != nil {
  118. return err
  119. }
  120. return DB.Delete(&CustomOAuthProvider{}, id).Error
  121. }
  122. // IsSlugTaken checks if a slug is already taken by another provider
  123. // Returns true on DB errors (fail-closed) to prevent slug conflicts
  124. func IsSlugTaken(slug string, excludeId int) bool {
  125. var count int64
  126. query := DB.Model(&CustomOAuthProvider{}).Where("slug = ?", slug)
  127. if excludeId > 0 {
  128. query = query.Where("id != ?", excludeId)
  129. }
  130. res := query.Count(&count)
  131. if res.Error != nil {
  132. // Fail-closed: treat DB errors as slug being taken to prevent conflicts
  133. return true
  134. }
  135. return count > 0
  136. }
  137. // validateCustomOAuthProvider validates a custom OAuth provider configuration
  138. func validateCustomOAuthProvider(provider *CustomOAuthProvider) error {
  139. if provider.Name == "" {
  140. return errors.New("provider name is required")
  141. }
  142. if provider.Slug == "" {
  143. return errors.New("provider slug is required")
  144. }
  145. // Slug must be lowercase and contain only alphanumeric characters and hyphens
  146. slug := strings.ToLower(provider.Slug)
  147. for _, c := range slug {
  148. if !((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-') {
  149. return errors.New("provider slug must contain only lowercase letters, numbers, and hyphens")
  150. }
  151. }
  152. provider.Slug = slug
  153. if provider.ClientId == "" {
  154. return errors.New("client ID is required")
  155. }
  156. if provider.AuthorizationEndpoint == "" {
  157. return errors.New("authorization endpoint is required")
  158. }
  159. if provider.TokenEndpoint == "" {
  160. return errors.New("token endpoint is required")
  161. }
  162. if provider.UserInfoEndpoint == "" {
  163. return errors.New("user info endpoint is required")
  164. }
  165. // Set defaults for field mappings if empty
  166. if provider.UserIdField == "" {
  167. provider.UserIdField = "sub"
  168. }
  169. if provider.UsernameField == "" {
  170. provider.UsernameField = "preferred_username"
  171. }
  172. if provider.DisplayNameField == "" {
  173. provider.DisplayNameField = "name"
  174. }
  175. if provider.EmailField == "" {
  176. provider.EmailField = "email"
  177. }
  178. if provider.Scopes == "" {
  179. provider.Scopes = "openid profile email"
  180. }
  181. if strings.TrimSpace(provider.AccessPolicy) != "" {
  182. var policy accessPolicyPayload
  183. if err := common.UnmarshalJsonStr(provider.AccessPolicy, &policy); err != nil {
  184. return errors.New("access_policy must be valid JSON")
  185. }
  186. if err := validateAccessPolicyPayload(&policy); err != nil {
  187. return fmt.Errorf("access_policy is invalid: %w", err)
  188. }
  189. }
  190. return nil
  191. }
  192. func validateAccessPolicyPayload(policy *accessPolicyPayload) error {
  193. if policy == nil {
  194. return errors.New("policy is nil")
  195. }
  196. logic := strings.ToLower(strings.TrimSpace(policy.Logic))
  197. if logic == "" {
  198. logic = "and"
  199. }
  200. if logic != "and" && logic != "or" {
  201. return fmt.Errorf("unsupported logic: %s", logic)
  202. }
  203. if len(policy.Conditions) == 0 && len(policy.Groups) == 0 {
  204. return errors.New("policy requires at least one condition or group")
  205. }
  206. for index, condition := range policy.Conditions {
  207. field := strings.TrimSpace(condition.Field)
  208. if field == "" {
  209. return fmt.Errorf("condition[%d].field is required", index)
  210. }
  211. op := strings.ToLower(strings.TrimSpace(condition.Op))
  212. if _, ok := supportedAccessPolicyOps[op]; !ok {
  213. return fmt.Errorf("condition[%d].op is unsupported: %s", index, op)
  214. }
  215. if op == "in" || op == "not_in" {
  216. if _, ok := condition.Value.([]any); !ok {
  217. return fmt.Errorf("condition[%d].value must be an array for op %s", index, op)
  218. }
  219. }
  220. }
  221. for index := range policy.Groups {
  222. if err := validateAccessPolicyPayload(&policy.Groups[index]); err != nil {
  223. return fmt.Errorf("group[%d]: %w", index, err)
  224. }
  225. }
  226. return nil
  227. }