mirror of https://github.com/veypi/OneAuth.git
auth check
parent
61d61f28c8
commit
9f93299509
@ -0,0 +1,47 @@
|
||||
//
|
||||
// access.go
|
||||
// Copyright (C) 2024 veypi <i@veypi.com>
|
||||
// 2024-09-23 19:37
|
||||
// Distributed under terms of the MIT license.
|
||||
//
|
||||
|
||||
package auth
|
||||
|
||||
import "github.com/golang-jwt/jwt/v5"
|
||||
|
||||
type AuthLevel uint
|
||||
|
||||
const (
|
||||
DoNone = 0
|
||||
Do = 1
|
||||
DoRead = 1
|
||||
DoCreate = 2
|
||||
DoUpdate = 3
|
||||
DoDelete = 4
|
||||
DoAll = 5
|
||||
)
|
||||
|
||||
type Access []struct {
|
||||
Name string `json:"name"`
|
||||
TID string `json:"tid"`
|
||||
Level AuthLevel `json:"level"`
|
||||
}
|
||||
|
||||
func (a *Access) Check(target string, tid string, l AuthLevel) bool {
|
||||
for _, line := range *a {
|
||||
if target == line.Name && l >= line.Level {
|
||||
if line.TID == "" || line.TID == tid {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
type Claims struct {
|
||||
UID string `json:"uid"`
|
||||
Name string `json:"name"`
|
||||
Icon string `json:"icon"`
|
||||
Access Access `json:"access"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
@ -0,0 +1,63 @@
|
||||
//
|
||||
// jwt.go
|
||||
// Copyright (C) 2024 veypi <i@veypi.com>
|
||||
// 2024-09-23 18:28
|
||||
// Distributed under terms of the MIT license.
|
||||
//
|
||||
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"oa/cfg"
|
||||
"oa/errs"
|
||||
"strings"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/veypi/OneBD/rest"
|
||||
)
|
||||
|
||||
func CheckJWT(x *rest.X) (*Claims, error) {
|
||||
authHeader := x.Request.Header.Get("Authorization")
|
||||
if authHeader == "" {
|
||||
return nil, errs.AuthNotFound
|
||||
}
|
||||
// Token is typically in the format "Bearer <token>"
|
||||
tokenString := strings.TrimPrefix(authHeader, "Bearer ")
|
||||
if tokenString == authHeader {
|
||||
return nil, errs.AuthInvalid
|
||||
}
|
||||
|
||||
// Parse the token
|
||||
claims := &Claims{}
|
||||
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
|
||||
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
||||
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
||||
}
|
||||
return []byte(cfg.Config.JWT), nil
|
||||
})
|
||||
|
||||
if err != nil || !token.Valid {
|
||||
return nil, errs.AuthInvalid
|
||||
}
|
||||
x.Request = x.Request.WithContext(context.WithValue(x.Request.Context(), "uid", claims.ID))
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
func Check(target string, pid string, l AuthLevel) func(x *rest.X) error {
|
||||
return func(x *rest.X) error {
|
||||
claims, err := CheckJWT(x)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
tid := ""
|
||||
if pid != "" {
|
||||
tid = x.Params.GetStr(pid)
|
||||
}
|
||||
if !claims.Access.Check(target, tid, l) {
|
||||
return errs.AuthFailed
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
Loading…
Reference in New Issue