feat: scaffold independent workbench service

internal/auth/auth.go

@@ -0,0 +1,198 @@
+package auth
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.118im.com/im_team/im_workbench/internal/config"
+	"github.com/redis/go-redis/v9"
+)
+
+var (
+	ErrAuthRequired = errors.New("authentication required")
+	ErrForbidden    = errors.New("forbidden")
+)
+
+type Principal struct {
+	TenantID   int64
+	TenantCode string
+	UserID     int64
+	DeviceID   string
+	AuthLevel  string
+}
+
+type Session struct {
+	UserID     int64  `json:"user_id"`
+	TenantID   int64  `json:"tenant_id"`
+	TenantCode string `json:"tenant_code"`
+	DeviceID   string `json:"device_id"`
+	AuthLevel  string `json:"auth_level"`
+	State      string `json:"state"`
+	ExpiresAt  string `json:"expires_at"`
+	IssuedAt   string `json:"issued_at"`
+}
+
+type Authenticator struct {
+	cfg   config.AuthConfig
+	redis *redis.Client
+}
+
+func New(cfg config.AuthConfig, redisClient *redis.Client) *Authenticator {
+	return &Authenticator{cfg: cfg, redis: redisClient}
+}
+
+func (a *Authenticator) Authenticate(req *http.Request) (*Principal, error) {
+	if err := a.validateAPIKey(req); err != nil {
+		return nil, err
+	}
+	if a.cfg.AllowDevHeaderAuth {
+		if principal := principalFromDevHeaders(req); principal != nil {
+			return principal, nil
+		}
+	}
+	if a.cfg.SkipSessionInDev {
+		return &Principal{
+			TenantID:   parseInt64Header(req, "X-Tenant-ID", 1),
+			TenantCode: firstNonEmpty(req.Header.Get("X-Tenant-Code"), "default"),
+			UserID:     parseInt64Header(req, "X-User-ID", 1),
+			AuthLevel:  "auth",
+		}, nil
+	}
+	if a.redis == nil {
+		return nil, ErrAuthRequired
+	}
+	token, err := bearerToken(req)
+	if err != nil {
+		return nil, err
+	}
+	session, err := a.sessionFromRedis(req.Context(), token)
+	if err != nil {
+		return nil, err
+	}
+	if session.UserID <= 0 || session.TenantID <= 0 {
+		return nil, ErrAuthRequired
+	}
+	if state := strings.ToLower(strings.TrimSpace(session.State)); state != "" && state != "active" {
+		return nil, ErrAuthRequired
+	}
+	if session.ExpiresAt != "" {
+		expiresAt, err := time.Parse(time.RFC3339, session.ExpiresAt)
+		if err == nil && time.Now().After(expiresAt) {
+			return nil, ErrAuthRequired
+		}
+	}
+	headerTenant := strings.TrimSpace(req.Header.Get("X-Tenant-Code"))
+	if a.cfg.RequiredTenantCode && headerTenant == "" {
+		return nil, ErrForbidden
+	}
+	if headerTenant != "" && session.TenantCode != "" && headerTenant != session.TenantCode {
+		return nil, ErrForbidden
+	}
+	return &Principal{
+		TenantID:   session.TenantID,
+		TenantCode: firstNonEmpty(session.TenantCode, headerTenant),
+		UserID:     session.UserID,
+		DeviceID:   session.DeviceID,
+		AuthLevel:  session.AuthLevel,
+	}, nil
+}
+
+func (a *Authenticator) validateAPIKey(req *http.Request) error {
+	if len(a.cfg.APIKeys) == 0 && !a.cfg.RequiredAPIKey {
+		return nil
+	}
+	got := strings.TrimSpace(req.Header.Get("X-MeetingIM-APIKey"))
+	if got == "" {
+		got = strings.TrimSpace(req.URL.Query().Get("apikey"))
+	}
+	if got == "" {
+		if a.cfg.RequiredAPIKey {
+			return ErrForbidden
+		}
+		return nil
+	}
+	if len(a.cfg.APIKeys) == 0 {
+		return nil
+	}
+	for _, key := range a.cfg.APIKeys {
+		if subtle.ConstantTimeCompare([]byte(got), []byte(strings.TrimSpace(key))) == 1 {
+			return nil
+		}
+	}
+	return ErrForbidden
+}
+
+func (a *Authenticator) sessionFromRedis(ctx context.Context, token string) (*Session, error) {
+	secret := []byte(strings.TrimSpace(token))
+	if decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(token)); err == nil {
+		secret = decoded
+	}
+	digest := sha256.Sum256(secret)
+	key := fmt.Sprintf(a.cfg.SessionKeyPattern, hex.EncodeToString(digest[:]))
+	data, err := a.redis.Get(ctx, key).Bytes()
+	if err != nil && errors.Is(err, redis.Nil) {
+		return nil, ErrAuthRequired
+	}
+	if err != nil {
+		return nil, err
+	}
+	var session Session
+	if err := json.Unmarshal(data, &session); err != nil {
+		return nil, ErrAuthRequired
+	}
+	return &session, nil
+}
+
+func bearerToken(req *http.Request) (string, error) {
+	authz := strings.TrimSpace(req.Header.Get("Authorization"))
+	token, ok := strings.CutPrefix(authz, "Bearer ")
+	if !ok || strings.TrimSpace(token) == "" {
+		return "", ErrAuthRequired
+	}
+	return strings.TrimSpace(token), nil
+}
+
+func principalFromDevHeaders(req *http.Request) *Principal {
+	uid := parseInt64Header(req, "X-User-ID", 0)
+	if uid <= 0 {
+		return nil
+	}
+	return &Principal{
+		TenantID:   parseInt64Header(req, "X-Tenant-ID", 1),
+		TenantCode: firstNonEmpty(req.Header.Get("X-Tenant-Code"), "default"),
+		UserID:     uid,
+		DeviceID:   strings.TrimSpace(req.Header.Get("X-Device-ID")),
+		AuthLevel:  "auth",
+	}
+}
+
+func parseInt64Header(req *http.Request, key string, fallback int64) int64 {
+	value := strings.TrimSpace(req.Header.Get(key))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		if trimmed := strings.TrimSpace(value); trimmed != "" {
+			return trimmed
+		}
+	}
+	return ""
+}