veypi/OneAuth
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

用户加密机制设计初步完成

Browse Source
This commit is contained in:
veypi
2021-10-21 18:09:40 +08:00
parent cd7029c298
commit 82b64a4bb2
40 changed files with 1027 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/api.go
+3
View File
@@ -2,6 +2,7 @@ package api
import (
"OneAuth/api/app"
"OneAuth/api/role"
"OneAuth/api/user"
"OneAuth/api/wx"
"github.com/veypi/OneBD"
@@ -18,5 +19,7 @@ func Router(r OneBD.Router) {
user.Router(r.SubRouter("/user"))
wx.Router(r.SubRouter("wx"))
app.Router(r.SubRouter("app"))
role.Router(r)
//message.Router(r.SubRouter("/message"))
}
api/app/app.go
+33 -6
View File
@@ -2,6 +2,7 @@ package app
import (
"OneAuth/cfg"
"OneAuth/libs/auth"
"OneAuth/libs/base"
"OneAuth/libs/oerr"
"OneAuth/models"
@@ -26,14 +27,40 @@ type appHandler struct {
func (h *appHandler) Get() (interface{}, error) {
id := h.Meta().Params("id")
if id == "" {
return nil, oerr.ApiArgsMissing
}
h.query = &models.App{}
h.query.UUID = id
err := cfg.DB().Where(h.query).First(h.query).Error
isSelf := h.Meta().Query("is_self")
if isSelf != "" {
// 无权限可以获取本系统基本信息
h.query.ID = cfg.CFG.APPID
err := cfg.DB().Where(h.query).First(h.query).Error
return h.query, err
}
err := h.ParsePayload(h.Meta())
if err != nil {
return nil, err
}
return h.query, nil
if !h.GetAuth(auth.APP, id).CanRead() {
return nil, oerr.NoAuth
}
if id != "" {
h.query.UUID = id
err := cfg.DB().Where(h.query).First(h.query).Error
return h.query, err
}
// 注释代码为获取已经绑定的应用
//user := &models.User{}
//user.ID = h.Payload.ID
//err := cfg.DB().Preload("Roles.Auths").Preload("Auths").Where(user).First(user).Error
//if err != nil {
// return nil, oerr.DBErr.Attach(err)
//}
//ids := make([]string, 0, 10)
//for _, a := range user.GetAuths() {
// if a.RID == auth.Login && a.Level.CanDo() {
// ids = append(ids, a.RUID)
// }
//}
list := make([]*models.App, 0, 10)
err = cfg.DB().Find(&list).Error
return list, err
}
api/role/auth.go
+5
View File
@@ -2,7 +2,9 @@ package role
import (
"OneAuth/cfg"
"OneAuth/libs/auth"
"OneAuth/libs/base"
"OneAuth/libs/oerr"
"OneAuth/models"
"github.com/veypi/OneBD"
"github.com/veypi/OneBD/core"
@@ -17,6 +19,9 @@ type authHandler struct {
}
func (h *authHandler) Get() (interface{}, error) {
if !h.GetAuth(auth.Auth).CanRead() {
return nil, oerr.NoAuth
}
l := make([]*models.Auth, 0, 10)
return &l, cfg.DB().Find(&l).Error
}
api/role/role.go
+8 -23
View File
@@ -2,6 +2,7 @@ package role
import (
"OneAuth/cfg"
"OneAuth/libs/auth"
"OneAuth/libs/base"
"OneAuth/libs/oerr"
"OneAuth/models"
@@ -20,8 +21,9 @@ type roleHandler struct {
func (h *roleHandler) Get() (interface{}, error) {
id := h.Meta().ParamsInt("id")
aid := h.Meta().ParamsInt("aid")
act := h.Meta().Params("action")
if !h.GetAuth(auth.Role, h.Meta().Params("id")).CanRead() {
return nil, oerr.NoAuth
}
if id > 0 {
role := &models.Role{}
role.ID = uint(id)
@@ -29,21 +31,6 @@ func (h *roleHandler) Get() (interface{}, error) {
if err != nil {
return nil, err
}
if aid <= 0 {
return role, nil
}
if !h.CheckAuth("admin", "").CanDoAny() {
return nil, oerr.NoAuth
}
at := &models.RoleAuth{}
at.RoleID = role.ID
at.AuthID = uint(aid)
defer models.SyncGlobalRoles()
if act == "bind" {
err = cfg.DB().Where(at).FirstOrCreate(at).Error
} else if act == "unbind" {
err = cfg.DB().Where(at).Delete(at).Error
}
return role, nil
}
roles := make([]*models.Role, 0, 10)
@@ -52,7 +39,7 @@ func (h *roleHandler) Get() (interface{}, error) {
}
func (h *roleHandler) Post() (interface{}, error) {
if !h.CheckAuth("role", "").CanCreate() {
if !h.GetAuth(auth.Role).CanCreate() {
return nil, oerr.NoAuth
}
role := &models.Role{}
@@ -61,15 +48,14 @@ func (h *roleHandler) Post() (interface{}, error) {
return nil, err
}
role.ID = 0
if role.Category == 0 || role.Name == "" {
if role.Name == "" {
return nil, oerr.ApiArgsMissing
}
defer models.SyncGlobalRoles()
return role, cfg.DB().Where(role).FirstOrCreate(role).Error
}
func (h *roleHandler) Patch() (interface{}, error) {
if !h.CheckAuth("role", "").CanUpdate() {
if !h.GetAuth(auth.Role).CanUpdate() {
return nil, oerr.NoAuth
}
query := &struct {
@@ -120,7 +106,7 @@ func (h *roleHandler) Patch() (interface{}, error) {
}
func (h *roleHandler) Delete() (interface{}, error) {
if !h.CheckAuth("role").CanDelete() {
if !h.GetAuth(auth.Role).CanDelete() {
return nil, oerr.NoAuth
}
rid := h.Meta().ParamsInt("id")
@@ -133,6 +119,5 @@ func (h *roleHandler) Delete() (interface{}, error) {
if err != nil {
return nil, err
}
defer models.SyncGlobalRoles()
return nil, cfg.DB().Delete(role).Error
}
api/role/router.go
+1 -1
View File
@@ -8,6 +8,6 @@ import (
func Router(r OneBD.Router) {
r.Set("/role/", roleP, rfc.MethodGet, rfc.MethodPost)
r.Set("/role/:id", roleP, rfc.MethodGet, rfc.MethodDelete, rfc.MethodPatch)
r.Set("/role/:id/:action/:aid", roleP, rfc.MethodGet)
r.Set("/role/:id/:action/:rid", roleP, rfc.MethodGet)
r.Set("/auth/", authP, rfc.MethodGet)
}
api/user/user.go
+67 -37
View File
@@ -2,9 +2,13 @@ package user
import (
"OneAuth/cfg"
"OneAuth/libs/app"
"OneAuth/libs/base"
"OneAuth/libs/oerr"
"OneAuth/libs/token"
"OneAuth/models"
"errors"
//"OneAuth/ws"
"encoding/base64"
"fmt"
@@ -68,10 +72,17 @@ func (h *handler) Get() (interface{}, error) {
// Post register user
func (h *handler) Post() (interface{}, error) {
if !cfg.CFG.EnableRegister {
return nil, oerr.NoAuth.AttachStr("register disabled.")
self := &models.App{}
self.ID = cfg.CFG.APPID
err := cfg.DB().Where(self).First(self).Error
if err != nil {
return nil, oerr.DBErr.Attach(err)
}
if !self.EnableRegister {
return nil, oerr.NoAuth.AttachStr("register disabled")
}
var userdata = struct {
UUID string `json:"uuid"`
Username string `json:"username"`
Password string `json:"password"`
Nickname string `json:"nickname"`
@@ -101,16 +112,40 @@ func (h *handler) Post() (interface{}, error) {
h.User.Username = userdata.Username
h.User.Email = userdata.Email
h.User.Position = userdata.Position
if err := h.User.UpdateAuth(string(pass)); err != nil {
if err := h.User.UpdatePass(string(pass)); err != nil {
log.HandlerErrs(err)
return nil, oerr.ResourceCreatedFailed
}
tx := cfg.DB().Begin()
if err := tx.Create(&h.User).Error; err != nil {
tx.Rollback()
return nil, oerr.ResourceDuplicated
err = cfg.DB().Transaction(func(tx *gorm.DB) error {
if err := tx.Create(&h.User).Error; err != nil {
return oerr.ResourceDuplicated
}
err := app.AddUser(tx, self.ID, h.User.ID, self.InitRoleID)
if err != nil {
return err
}
if userdata.UUID != self.UUID && userdata.UUID != "" {
target := &models.App{}
target.UUID = userdata.UUID
err = tx.Where(target).First(target).Error
if err != nil {
return err
}
if target.EnableRegister {
err := app.AddUser(tx, target.ID, h.User.ID, target.InitRoleID)
if err != nil {
return err
}
} else {
// TODO
}
return err
}
return nil
})
if err != nil {
return nil, err
}
tx.Commit()
return h.User, nil
}
@@ -142,7 +177,7 @@ func (h *handler) Patch() (interface{}, error) {
return nil, oerr.NoAuth
}
if len(opts.Password) >= 6 {
if err := target.UpdateAuth(opts.Password); err != nil {
if err := target.UpdatePass(opts.Password); err != nil {
log.HandlerErrs(err)
return nil, oerr.ApiArgsError.AttachStr(err.Error())
}
@@ -187,9 +222,9 @@ func (h *handler) Head() (interface{}, error) {
if len(uid) == 0 || len(password) == 0 {
return nil, oerr.ApiArgsError
}
appID, err := strconv.Atoi(h.Meta().Query("app_id"))
if err != nil || appID <= 0 {
return nil, oerr.ApiArgsMissing
appUUID := h.Meta().Query("uuid")
if appUUID == "" {
return nil, oerr.ApiArgsMissing.AttachStr("uuid")
}
h.User = new(models.User)
uidType := h.Meta().Query("uid_type")
@@ -203,32 +238,15 @@ func (h *handler) Head() (interface{}, error) {
default:
h.User.Username = uid
}
app := &models.App{}
app.ID = uint(appID)
err = cfg.DB().Where(app).Find(app).Error
target := &models.App{}
target.UUID = appUUID
err = cfg.DB().Where(target).Find(target).Error
if err != nil {
return nil, oerr.DBErr.Attach(err)
}
if err := cfg.DB().Preload("Roles").Where(h.User).First(h.User).Error; err != nil {
if err := cfg.DB().Preload("Roles.Auths").Preload("Auths").Where(h.User).First(h.User).Error; err != nil {
if err.Error() == gorm.ErrRecordNotFound.Error() {
// admin 登录自动注册
if h.User.Username == "admin" {
r := rand.New(rand.NewSource(time.Now().UnixNano()))
h.User.Icon = fmt.Sprintf("/media/icon/default/%04d.jpg", r.Intn(230))
err = h.User.UpdateAuth(password)
if err != nil {
return nil, err
}
role := &models.Role{}
role.ID = 1
h.User.Roles = []*models.Role{role}
err = cfg.DB().Create(h.User).Error
if err != nil {
return nil, err
}
} else {
return nil, oerr.AccountNotExist
}
return nil, oerr.AccountNotExist
} else {
log.HandlerErrs(err)
return nil, oerr.DBErr.Attach(err)
@@ -238,15 +256,27 @@ func (h *handler) Head() (interface{}, error) {
if err != nil || !isAuth {
return nil, oerr.PassError.Attach(err)
}
if h.User.Status == "disabled" {
au := &models.AppUser{}
au.UserID = h.User.ID
au.AppID = target.ID
err = cfg.DB().Where(au).First(au).Error
appID := target.ID
h.Meta().SetHeader("content", target.UserRefreshUrl)
if err != nil {
if !errors.Is(err, gorm.ErrRecordNotFound) {
return nil, err
}
appID = cfg.CFG.APPID
h.Meta().SetHeader("content", "/app/"+target.UUID)
} else if au.Disabled {
return nil, oerr.DisableLogin
}
token, err := h.User.GetToken(app.Key, app.ID)
tokenStr, err := token.GetToken(h.User, appID)
if err != nil {
log.HandlerErrs(err)
return nil, oerr.Unknown.Attach(err)
}
h.Meta().SetHeader("auth_token", token)
h.Meta().SetHeader("auth_token", tokenStr)
log.Info().Msg(h.User.Username + " login")
return nil, nil
}
api/user/user_role.go
+2 -3
View File
@@ -35,9 +35,8 @@ func (h *userRoleHandler) Post() (interface{}, error) {
err = cfg.DB().First(query, query.ID).Error
} else if query.Name != "" {
err = cfg.DB().Where(map[string]interface{}{
"name": query.Name,
"category": query.Category,
"tag": query.Tag,
"name": query.Name,
"tag": query.Tag,
}).First(query).Error
if errors.Is(err, gorm.ErrRecordNotFound) {
err = cfg.DB().Create(query).Error