pro/im_server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: avoid admin dependency on login entrypoints

Browse Source
This commit is contained in:
richjohnrambo
2026-09-09 15:19:13 +08:00
parent 9159ec7fc7
commit 45c6c7eacb
3 changed files with 52 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth_audit.go
+5 -3
View File
@@ -93,7 +93,8 @@ func checkUserLoginIPWhitelist(tenantID types.TenantID, uid types.Uid, remoteAdd
if errors.Is(err, types.ErrUnsupported) {
return nil
}
return err
logs.Warn.Printf("login ip whitelist user lookup failed tenant:%d uid:%s err:%v", tenantID, uid, err)
return nil
}
if result == nil || len(result.Items) == 0 {
return nil
@@ -118,7 +119,8 @@ func checkUserLoginIPWhitelist(tenantID types.TenantID, uid types.Uid, remoteAdd
func checkTenantLoginIPWhitelist(tenantID types.TenantID, platform, remoteAddr string) error {
config, err := loadTenantLoginIPWhitelist(tenantID)
if err != nil {
return err
logs.Warn.Printf("login ip whitelist tenant lookup failed tenant:%d platform:%s err:%v", tenantID, platform, err)
return nil
}
if config == nil {
return nil
@@ -154,7 +156,7 @@ func loadTenantLoginIPWhitelist(tenantID types.TenantID) (*tenantLoginIPWhitelis
result := cached.config
return &result, nil
}
return nil, err
config = &tenantLoginIPWhitelistConfig{TenantID: tenantID, AppList: []string{}, WebList: []string{}}
}
if config == nil {
config = &tenantLoginIPWhitelistConfig{TenantID: tenantID, AppList: []string{}, WebList: []string{}}
server/store/store.go
+35 -15
View File
@@ -296,6 +296,16 @@ func (tenantsMapper) GetByCode(code string) (*types.Tenant, error) {
if tenant, ok := tenantByCodeCache.get(code); ok {
return cloneTenant(tenant), nil
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if ok {
if tenant, err := tenantAdp.TenantGetByCode(code); err == nil && tenant != nil {
tenantByCodeCache.set(code, cloneTenant(tenant))
tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(tenant))
return tenant, nil
} else if err != nil && !errors.Is(err, types.ErrNotFound) {
logs.Warn.Printf("local tenant by code lookup failed: code=%s err=%v", code, err)
}
}
if adminInternalConfigProvider != nil {
if tenant, err := adminInternalConfigProvider.GetTenantByCode(code); err == nil && tenant != nil {
tenantByCodeCache.set(code, cloneTenant(tenant))
@@ -305,16 +315,10 @@ func (tenantsMapper) GetByCode(code string) (*types.Tenant, error) {
logs.Warn.Printf("admin internal tenant by code fallback failed: code=%s err=%v", code, err)
}
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if !ok {
return nil, types.ErrUnsupported
}
tenant, err := tenantAdp.TenantGetByCode(code)
if err == nil && tenant != nil {
tenantByCodeCache.set(code, cloneTenant(tenant))
tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(tenant))
}
return tenant, err
return tenantAdp.TenantGetByCode(code)
}
// GetByID resolves an internal tenant ID to its registry record.
@@ -326,6 +330,16 @@ func (tenantsMapper) GetByID(id types.TenantID) (*types.Tenant, error) {
if tenant, ok := tenantByIDCache.get(idKey); ok {
return cloneTenant(tenant), nil
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if ok {
if tenant, err := tenantAdp.TenantGetByID(id); err == nil && tenant != nil {
tenantByIDCache.set(idKey, cloneTenant(tenant))
tenantByCodeCache.set(tenant.Code, cloneTenant(tenant))
return tenant, nil
} else if err != nil && !errors.Is(err, types.ErrNotFound) {
logs.Warn.Printf("local tenant by id lookup failed: tenant=%d err=%v", id, err)
}
}
if adminInternalConfigProvider != nil {
if tenant, err := adminInternalConfigProvider.GetTenantByID(id); err == nil && tenant != nil {
tenantByIDCache.set(idKey, cloneTenant(tenant))
@@ -335,22 +349,29 @@ func (tenantsMapper) GetByID(id types.TenantID) (*types.Tenant, error) {
logs.Warn.Printf("admin internal tenant by id fallback failed: tenant=%d err=%v", id, err)
}
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if !ok {
return nil, types.ErrUnsupported
}
tenant, err := tenantAdp.TenantGetByID(id)
if err == nil && tenant != nil {
tenantByIDCache.set(idKey, cloneTenant(tenant))
tenantByCodeCache.set(tenant.Code, cloneTenant(tenant))
}
return tenant, err
return tenantAdp.TenantGetByID(id)
}
func (tenantsMapper) ListActive(limit int) ([]types.Tenant, error) {
if limit <= 0 {
limit = 1000
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if ok {
if tenants, err := tenantAdp.TenantListActive(limit); err == nil {
for i := range tenants {
tenant := tenants[i]
tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(&tenant))
tenantByCodeCache.set(tenant.Code, cloneTenant(&tenant))
}
return tenants, nil
} else {
logs.Warn.Printf("local active tenants lookup failed: err=%v", err)
}
}
if adminInternalConfigProvider != nil {
if tenants, err := adminInternalConfigProvider.ListActiveTenants(limit); err == nil {
for i := range tenants {
@@ -363,7 +384,6 @@ func (tenantsMapper) ListActive(limit int) ([]types.Tenant, error) {
logs.Warn.Printf("admin internal active tenants fallback failed: err=%v", err)
}
}
tenantAdp, ok := adp.(adapter.TenantAdapter)
if !ok {
return nil, types.ErrUnsupported
}
server/tenant_login_ip_whitelist_test.go
+12
View File
@@ -69,3 +69,15 @@ func TestCheckTenantLoginIPWhitelistEmptyMeansUnrestricted(t *testing.T) {
t.Fatalf("未配置渠道白名单时不应限制登录: %v", err)
}
}
func TestCheckTenantLoginIPWhitelistProviderFailureAllowsLogin(t *testing.T) {
resetTenantLoginIPWhitelistTestState(t)
tenantID := types.TenantID(1)
loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{err: errors.New("admin timeout")}
if err := checkTenantLoginIPWhitelist(tenantID, "ios", "203.0.113.10:443"); err != nil {
t.Fatalf("白名单配置服务失败时不应阻断登录: %v", err)
}
if err := checkTenantLoginIPWhitelist(tenantID, "web", "198.51.100.8:443"); err != nil {
t.Fatalf("白名单失败空配置应被短暂缓存并继续放行: %v", err)
}
}