|
|
//
|
|
|
// Copyright (C) 2024 veypi <i@veypi.com>
|
|
|
// 2025-07-24 15:27:31
|
|
|
// Distributed under terms of the MIT license.
|
|
|
//
|
|
|
|
|
|
package oauth
|
|
|
|
|
|
import (
|
|
|
"time"
|
|
|
|
|
|
"github.com/veypi/OneAuth/models"
|
|
|
"gorm.io/gorm"
|
|
|
)
|
|
|
|
|
|
// User 用户表
|
|
|
type User struct {
|
|
|
models.BaseModel
|
|
|
Username string `json:"username" gorm:"uniqueIndex;not null;size:50;comment:用户名""`
|
|
|
Email string `json:"email" gorm:"uniqueIndex;size:100;comment:邮箱地址"`
|
|
|
Phone string `json:"phone" gorm:"uniqueIndex;size:20;comment:手机号码"`
|
|
|
PasswordHash string `json:"-" gorm:"not null;size:255;comment:密码哈希"`
|
|
|
Nickname string `json:"nickname" gorm:"size:50;comment:昵称"`
|
|
|
Avatar string `json:"avatar" gorm:"size:255;comment:头像URL"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
IsSuperuser bool `json:"is_superuser" gorm:"default:false;comment:是否为超级用户"`
|
|
|
LastLoginAt *time.Time `json:"last_login_at" gorm:"comment:最后登录时间"`
|
|
|
EmailVerified bool `json:"email_verified" gorm:"default:false;comment:邮箱是否已验证"`
|
|
|
PhoneVerified bool `json:"phone_verified" gorm:"default:false;comment:手机是否已验证"`
|
|
|
TwoFactorAuth bool `json:"two_factor_auth" gorm:"default:false;comment:是否启用双因素认证"`
|
|
|
Locale string `json:"locale" gorm:"size:10;default:zh-CN;comment:语言偏好"`
|
|
|
Timezone string `json:"timezone" gorm:"size:50;default:Asia/Shanghai;comment:时区"`
|
|
|
Bio string `json:"bio" gorm:"type:text;comment:个人简介"`
|
|
|
|
|
|
// 关联关系
|
|
|
Roles []Role `json:"roles" gorm:"many2many:user_roles;"`
|
|
|
UserRoles []UserRole `json:"-"`
|
|
|
OAuthAccounts []OAuthAccount `json:"oauth_accounts"`
|
|
|
Tokens []UserToken `json:"-"`
|
|
|
MetaData []byte `json:"meta_data" gorm:"type:jsonb;comment:用户元数据"` // 存储用户自定义的元数据
|
|
|
}
|
|
|
|
|
|
// Role 角色表
|
|
|
type Role struct {
|
|
|
models.BaseModel
|
|
|
Name string `json:"name" gorm:"uniqueIndex;not null;size:50;comment:角色名称" validate:"required"`
|
|
|
DisplayName string `json:"display_name" gorm:"size:100;comment:显示名称"`
|
|
|
Description string `json:"description" gorm:"type:text;comment:角色描述"`
|
|
|
IsSystem bool `json:"is_system" gorm:"default:false;comment:是否为系统角色"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
|
|
|
// 关联关系
|
|
|
Users []User `json:"-" gorm:"many2many:user_roles;"`
|
|
|
UserRoles []UserRole `json:"-"`
|
|
|
Permissions []Permission `json:"permissions" gorm:"many2many:role_permissions;"`
|
|
|
}
|
|
|
|
|
|
// Permission 权限表
|
|
|
type Permission struct {
|
|
|
models.BaseModel
|
|
|
Name string `json:"name" gorm:"uniqueIndex;not null;size:100;comment:权限名称" validate:"required"`
|
|
|
DisplayName string `json:"display_name" gorm:"size:100;comment:显示名称"`
|
|
|
Description string `json:"description" gorm:"type:text;comment:权限描述"`
|
|
|
Resource string `json:"resource" gorm:"not null;size:50;comment:资源名称" validate:"required"`
|
|
|
Action string `json:"action" gorm:"not null;size:50;comment:操作类型" validate:"required"`
|
|
|
IsSystem bool `json:"is_system" gorm:"default:false;comment:是否为系统权限"`
|
|
|
|
|
|
// 关联关系
|
|
|
Roles []Role `json:"-" gorm:"many2many:role_permissions;"`
|
|
|
}
|
|
|
|
|
|
// UserRole 用户角色关联表
|
|
|
type UserRole struct {
|
|
|
UserID string `json:"user_id" gorm:"primaryKey;type:varchar(32);comment:用户ID"`
|
|
|
RoleID string `json:"role_id" gorm:"primaryKey;type:varchar(32);comment:角色ID"`
|
|
|
GrantedBy string `json:"granted_by" gorm:"type:varchar(32);comment:授权人ID"`
|
|
|
GrantedAt time.Time `json:"granted_at" gorm:"autoCreateTime;comment:授权时间"`
|
|
|
ExpiresAt *time.Time `json:"expires_at" gorm:"comment:过期时间"`
|
|
|
|
|
|
// 关联关系
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
Role *Role `json:"role" gorm:"foreignKey:RoleID"`
|
|
|
GrantedByUser *User `json:"granted_by_user" gorm:"foreignKey:GrantedBy"`
|
|
|
}
|
|
|
|
|
|
// RolePermission 角色权限关联表
|
|
|
type RolePermission struct {
|
|
|
RoleID string `json:"role_id" gorm:"primaryKey;type:varchar(32);comment:角色ID"`
|
|
|
PermissionID string `json:"permission_id" gorm:"primaryKey;type:varchar(32);comment:权限ID"`
|
|
|
GrantedBy string `json:"granted_by" gorm:"type:varchar(32);comment:授权人ID"`
|
|
|
GrantedAt time.Time `json:"granted_at" gorm:"autoCreateTime;comment:授权时间"`
|
|
|
|
|
|
// 关联关系
|
|
|
Role *Role `json:"role" gorm:"foreignKey:RoleID"`
|
|
|
Permission *Permission `json:"permission" gorm:"foreignKey:PermissionID"`
|
|
|
GrantedByUser *User `json:"granted_by_user" gorm:"foreignKey:GrantedBy"`
|
|
|
}
|
|
|
|
|
|
// UserLoginLog 用户登录日志表
|
|
|
type UserLoginLog struct {
|
|
|
models.BaseModel
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
IPAddress string `json:"ip_address" gorm:"size:45;comment:IP地址"`
|
|
|
UserAgent string `json:"user_agent" gorm:"type:text;comment:用户代理"`
|
|
|
LoginAt time.Time `json:"login_at" gorm:"autoCreateTime;comment:登录时间"`
|
|
|
Success bool `json:"success" gorm:"default:true;comment:是否成功"`
|
|
|
FailReason string `json:"fail_reason" gorm:"size:255;comment:失败原因"`
|
|
|
Location string `json:"location" gorm:"size:100;comment:地理位置"` // 地理位置
|
|
|
|
|
|
// 关联关系
|
|
|
User User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
}
|
|
|
|
|
|
// GORM Hooks
|
|
|
func (u *User) BeforeCreate(tx *gorm.DB) error {
|
|
|
if err := u.BaseModel.BeforeCreate(tx); err != nil {
|
|
|
return err
|
|
|
}
|
|
|
if u.Locale == "" {
|
|
|
u.Locale = "zh-CN"
|
|
|
}
|
|
|
if u.Timezone == "" {
|
|
|
u.Timezone = "Asia/Shanghai"
|
|
|
}
|
|
|
return nil
|
|
|
}
|
|
|
|
|
|
// 用户方法
|
|
|
func (u *User) HasRole(roleName string) bool {
|
|
|
for _, role := range u.Roles {
|
|
|
if role.Name == roleName {
|
|
|
return true
|
|
|
}
|
|
|
}
|
|
|
return false
|
|
|
}
|
|
|
|
|
|
func (u *User) HasPermission(resource, action string) bool {
|
|
|
for _, role := range u.Roles {
|
|
|
for _, permission := range role.Permissions {
|
|
|
if permission.Resource == resource && permission.Action == action {
|
|
|
return true
|
|
|
}
|
|
|
}
|
|
|
}
|
|
|
return false
|
|
|
}
|
|
|
|
|
|
func (u *User) GetPermissions() []Permission {
|
|
|
var permissions []Permission
|
|
|
permissionMap := make(map[string]bool)
|
|
|
|
|
|
for _, role := range u.Roles {
|
|
|
for _, permission := range role.Permissions {
|
|
|
if !permissionMap[permission.ID] {
|
|
|
permissions = append(permissions, permission)
|
|
|
permissionMap[permission.ID] = true
|
|
|
}
|
|
|
}
|
|
|
}
|
|
|
return permissions
|
|
|
}
|
|
|
|
|
|
// 角色方法
|
|
|
func (r *Role) HasPermission(resource, action string) bool {
|
|
|
for _, permission := range r.Permissions {
|
|
|
if permission.Resource == resource && permission.Action == action {
|
|
|
return true
|
|
|
}
|
|
|
}
|
|
|
return false
|
|
|
}
|
|
|
|
|
|
// ===== OAuth 服务器相关模型 =====
|
|
|
|
|
|
// OAuthClient OAuth客户端表
|
|
|
type OAuthClient struct {
|
|
|
models.BaseModel
|
|
|
ClientID string `json:"client_id" gorm:"uniqueIndex;not null;size:255;comment:客户端ID"`
|
|
|
ClientSecret string `json:"-" gorm:"not null;size:255;comment:客户端密钥"`
|
|
|
ClientName string `json:"client_name" gorm:"not null;size:255;comment:客户端名称"`
|
|
|
ClientURI string `json:"client_uri" gorm:"size:500;comment:客户端主页"`
|
|
|
LogoURI string `json:"logo_uri" gorm:"size:500;comment:客户端Logo"`
|
|
|
TermsOfServiceURI string `json:"tos_uri" gorm:"size:500;comment:服务条款URL"`
|
|
|
PolicyURI string `json:"policy_uri" gorm:"size:500;comment:隐私政策URL"`
|
|
|
RedirectURIs string `json:"redirect_uris" gorm:"type:text;comment:重定向URI列表,JSON格式"`
|
|
|
ResponseTypes string `json:"response_types" gorm:"size:255;default:'code';comment:响应类型"`
|
|
|
GrantTypes string `json:"grant_types" gorm:"size:255;default:'authorization_code,refresh_token';comment:授权类型"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
Contacts string `json:"contacts" gorm:"type:text;comment:联系人邮箱,JSON格式"`
|
|
|
IsPublic bool `json:"is_public" gorm:"default:false;comment:是否为公开客户端"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
OwnerID string `json:"owner_id" gorm:"type:varchar(32);comment:客户端拥有者ID"`
|
|
|
|
|
|
// 关联关系
|
|
|
Owner *User `json:"owner" gorm:"foreignKey:OwnerID"`
|
|
|
AuthorizationCodes []OAuthAuthorizationCode `json:"-"`
|
|
|
AccessTokens []OAuthAccessToken `json:"-"`
|
|
|
RefreshTokens []OAuthRefreshToken `json:"-"`
|
|
|
}
|
|
|
|
|
|
// OAuthAuthorizationCode 授权码表
|
|
|
type OAuthAuthorizationCode struct {
|
|
|
models.BaseModel
|
|
|
Code string `json:"code" gorm:"uniqueIndex;not null;size:255;comment:授权码"`
|
|
|
ClientID string `json:"client_id" gorm:"not null;type:varchar(32);index;comment:客户端ID"`
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
RedirectURI string `json:"redirect_uri" gorm:"not null;size:500;comment:重定向URI"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
CodeChallenge string `json:"code_challenge" gorm:"size:255;comment:PKCE代码挑战"`
|
|
|
CodeChallengeMethod string `json:"code_challenge_method" gorm:"size:50;comment:PKCE挑战方法"`
|
|
|
ExpiresAt time.Time `json:"expires_at" gorm:"not null;comment:过期时间"`
|
|
|
Used bool `json:"used" gorm:"default:false;comment:是否已使用"`
|
|
|
|
|
|
// 关联关系
|
|
|
Client *OAuthClient `json:"client" gorm:"foreignKey:ClientID"`
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
}
|
|
|
|
|
|
// OAuthAccessToken 访问令牌表
|
|
|
type OAuthAccessToken struct {
|
|
|
models.BaseModel
|
|
|
Token string `json:"token" gorm:"uniqueIndex;not null;size:500;comment:访问令牌"`
|
|
|
ClientID string `json:"client_id" gorm:"not null;type:varchar(32);index;comment:客户端ID"`
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
ExpiresAt time.Time `json:"expires_at" gorm:"not null;comment:过期时间"`
|
|
|
Revoked bool `json:"revoked" gorm:"default:false;comment:是否已撤销"`
|
|
|
|
|
|
// 关联关系
|
|
|
Client *OAuthClient `json:"client" gorm:"foreignKey:ClientID"`
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
RefreshToken *OAuthRefreshToken `json:"refresh_token"`
|
|
|
}
|
|
|
|
|
|
// OAuthRefreshToken 刷新令牌表
|
|
|
type OAuthRefreshToken struct {
|
|
|
models.BaseModel
|
|
|
Token string `json:"token" gorm:"uniqueIndex;not null;size:500;comment:刷新令牌"`
|
|
|
AccessTokenID string `json:"access_token_id" gorm:"type:varchar(32);uniqueIndex;comment:访问令牌ID"`
|
|
|
ClientID string `json:"client_id" gorm:"not null;type:varchar(32);index;comment:客户端ID"`
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
ExpiresAt time.Time `json:"expires_at" gorm:"not null;comment:过期时间"`
|
|
|
Revoked bool `json:"revoked" gorm:"default:false;comment:是否已撤销"`
|
|
|
|
|
|
// 关联关系
|
|
|
Client *OAuthClient `json:"client" gorm:"foreignKey:ClientID"`
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
AccessToken *OAuthAccessToken `json:"access_token" gorm:"foreignKey:AccessTokenID"`
|
|
|
}
|
|
|
|
|
|
// OAuthScope OAuth授权范围表
|
|
|
type OAuthScope struct {
|
|
|
models.BaseModel
|
|
|
Name string `json:"name" gorm:"uniqueIndex;not null;size:100;comment:范围名称"`
|
|
|
DisplayName string `json:"display_name" gorm:"size:100;comment:显示名称"`
|
|
|
Description string `json:"description" gorm:"type:text;comment:范围描述"`
|
|
|
IsDefault bool `json:"is_default" gorm:"default:false;comment:是否为默认范围"`
|
|
|
IsSystem bool `json:"is_system" gorm:"default:false;comment:是否为系统范围"`
|
|
|
}
|
|
|
|
|
|
// OAuthClientScope 客户端授权范围关联表
|
|
|
type OAuthClientScope struct {
|
|
|
ClientID string `json:"client_id" gorm:"primaryKey;type:varchar(32);comment:客户端ID"`
|
|
|
ScopeID string `json:"scope_id" gorm:"primaryKey;type:varchar(32);comment:范围ID"`
|
|
|
|
|
|
// 关联关系
|
|
|
Client *OAuthClient `json:"client" gorm:"foreignKey:ClientID"`
|
|
|
Scope *OAuthScope `json:"scope" gorm:"foreignKey:ScopeID"`
|
|
|
}
|
|
|
|
|
|
// OAuthProvider 第三方OAuth提供商表（用于OAuth客户端模式）
|
|
|
type OAuthProvider struct {
|
|
|
models.BaseModel
|
|
|
Name string `json:"name" gorm:"uniqueIndex;not null;size:100;comment:提供商名称"`
|
|
|
DisplayName string `json:"display_name" gorm:"size:100;comment:显示名称"`
|
|
|
ClientID string `json:"client_id" gorm:"not null;size:255;comment:客户端ID"`
|
|
|
ClientSecret string `json:"-" gorm:"not null;size:255;comment:客户端密钥"`
|
|
|
AuthURL string `json:"auth_url" gorm:"not null;size:500;comment:授权URL"`
|
|
|
TokenURL string `json:"token_url" gorm:"not null;size:500;comment:令牌URL"`
|
|
|
UserInfoURL string `json:"user_info_url" gorm:"size:500;comment:用户信息URL"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:默认授权范围"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
|
|
|
// 关联关系
|
|
|
OAuthAccounts []OAuthAccount `json:"oauth_accounts"`
|
|
|
}
|
|
|
|
|
|
// OAuthAccount 用户OAuth账户表（第三方登录）
|
|
|
type OAuthAccount struct {
|
|
|
models.BaseModel
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
ProviderID string `json:"provider_id" gorm:"not null;type:varchar(32);index;comment:提供商ID"`
|
|
|
ProviderUserID string `json:"provider_user_id" gorm:"not null;size:255;comment:提供商用户ID"`
|
|
|
Email string `json:"email" gorm:"size:255;comment:邮箱"`
|
|
|
Username string `json:"username" gorm:"size:255;comment:用户名"`
|
|
|
Nickname string `json:"nickname" gorm:"size:255;comment:昵称"`
|
|
|
Avatar string `json:"avatar" gorm:"size:500;comment:头像URL"`
|
|
|
AccessToken string `json:"-" gorm:"type:text;comment:访问令牌"`
|
|
|
RefreshToken string `json:"-" gorm:"type:text;comment:刷新令牌"`
|
|
|
ExpiresAt *time.Time `json:"expires_at" gorm:"comment:令牌过期时间"`
|
|
|
|
|
|
// 关联关系
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
Provider *OAuthProvider `json:"provider" gorm:"foreignKey:ProviderID"`
|
|
|
}
|
|
|
|
|
|
// UserToken 用户令牌表（API令牌等）
|
|
|
type UserToken struct {
|
|
|
models.BaseModel
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
TokenType string `json:"token_type" gorm:"not null;size:50;comment:令牌类型"` // api, session, etc.
|
|
|
Token string `json:"token" gorm:"uniqueIndex;not null;size:500;comment:令牌值"`
|
|
|
Name string `json:"name" gorm:"size:100;comment:令牌名称"`
|
|
|
Description string `json:"description" gorm:"type:text;comment:令牌描述"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
ExpiresAt *time.Time `json:"expires_at" gorm:"comment:过期时间"`
|
|
|
LastUsedAt *time.Time `json:"last_used_at" gorm:"comment:最后使用时间"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
|
|
|
// 关联关系
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
}
|
|
|
|
|
|
// UserSession 用户会话表
|
|
|
type UserSession struct {
|
|
|
models.BaseModel
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
SessionID string `json:"session_id" gorm:"uniqueIndex;not null;size:255;comment:会话ID"`
|
|
|
IPAddress string `json:"ip_address" gorm:"size:45;comment:IP地址"`
|
|
|
UserAgent string `json:"user_agent" gorm:"type:text;comment:用户代理"`
|
|
|
ExpiresAt time.Time `json:"expires_at" gorm:"not null;comment:过期时间"`
|
|
|
IsActive bool `json:"is_active" gorm:"default:true;comment:是否激活"`
|
|
|
LastActivity time.Time `json:"last_activity" gorm:"comment:最后活动时间"`
|
|
|
|
|
|
// 关联关系
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
}
|
|
|
|
|
|
// OAuthUserConsent 用户授权同意表
|
|
|
type OAuthUserConsent struct {
|
|
|
models.BaseModel
|
|
|
UserID string `json:"user_id" gorm:"not null;type:varchar(32);index;comment:用户ID"`
|
|
|
ClientID string `json:"client_id" gorm:"not null;type:varchar(32);index;comment:客户端ID"`
|
|
|
Scope string `json:"scope" gorm:"type:text;comment:授权范围"`
|
|
|
ConsentAt time.Time `json:"consent_at" gorm:"autoCreateTime;comment:同意时间"`
|
|
|
ExpiresAt *time.Time `json:"expires_at" gorm:"comment:同意过期时间"`
|
|
|
|
|
|
// 关联关系
|
|
|
User *User `json:"user" gorm:"foreignKey:UserID"`
|
|
|
Client *OAuthClient `json:"client" gorm:"foreignKey:ClientID"`
|
|
|
}
|
|
|
|
|
|
// ===== OAuth 模型方法 =====
|
|
|
|
|
|
// OAuthClient 方法
|
|
|
func (c *OAuthClient) IsRedirectURIValid(uri string) bool {
|
|
|
// 这里应该解析 RedirectURIs JSON 并验证
|
|
|
// 简化实现，实际使用时需要完善
|
|
|
return true
|
|
|
}
|
|
|
|
|
|
func (c *OAuthClient) HasScope(scope string) bool {
|
|
|
// 这里应该解析 Scope 并检查
|
|
|
// 简化实现，实际使用时需要完善
|
|
|
return true
|
|
|
}
|
|
|
|
|
|
// OAuthAuthorizationCode 方法
|
|
|
func (code *OAuthAuthorizationCode) IsExpired() bool {
|
|
|
return time.Now().After(code.ExpiresAt)
|
|
|
}
|
|
|
|
|
|
// OAuthAccessToken 方法
|
|
|
func (token *OAuthAccessToken) IsExpired() bool {
|
|
|
return time.Now().After(token.ExpiresAt)
|
|
|
}
|
|
|
|
|
|
func (token *OAuthAccessToken) IsValid() bool {
|
|
|
return !token.Revoked && !token.IsExpired()
|
|
|
}
|
|
|
|
|
|
// OAuthRefreshToken 方法
|
|
|
func (token *OAuthRefreshToken) IsExpired() bool {
|
|
|
return time.Now().After(token.ExpiresAt)
|
|
|
}
|
|
|
|
|
|
func (token *OAuthRefreshToken) IsValid() bool {
|
|
|
return !token.Revoked && !token.IsExpired()
|
|
|
}
|
|
|
|
|
|
// UserSession 方法
|
|
|
func (s *UserSession) IsExpired() bool {
|
|
|
return time.Now().After(s.ExpiresAt)
|
|
|
}
|
|
|
|
|
|
func (s *UserSession) IsValid() bool {
|
|
|
return s.IsActive && !s.IsExpired()
|
|
|
}
|