wangjia
a5e25b444f
实现 server/internal/auth 控制面鉴权底座，对应 doc/02 §4.1、doc/06 §3：
- POST /v1/auth/code：IP+邮箱双维度 Redis 滑窗限频（同邮箱 1/min、同 IP 10/h）
+ 一次性邮箱域黑名单（embed 词表）→ 6 位数字码写 auth:code:{email} TTL 10min
→ 异步发信（SMTP / 开发态 log mailer）。
- POST /v1/auth/register：验码（一次性，删 key；超次数烧码）→ 单事务建号
（uuid + dp_uuid 应用层生成、argon2id）+ 7 天 PRO 试用（source='trial'）→ 签发 JWT。
- POST /v1/auth/login：argon2id 校验（失败恒定时、未知用户走 dummy hash）；
失败计数限流 rl:login:{email} + 锁定；banned 拒绝。
- POST /v1/auth/refresh：RS256，access 15min + refresh 30d 落 Redis 白名单
jwt:refresh:{jti}，旋转时删旧写新；JWT 头带 kid，验证端接受新旧公钥支持轮换。
- RequireAuth 中间件：解析 Bearer access，注入 user id（复用 codes.CtxKeyUserID
避免循环依赖）+ uuid + claims 到 context。
- 错误体统一走 internal/apierr 的 {code, message_zh, message_en}，文案双语脱敏。
- 文件拆分：handler/service/password/token/ratelimit/emailcheck/store/mailer/
middleware/errors/keyloader；config 增加可选 JWT PEM 路径/kid 加载。
测试：password/token/ratelimit/emailcheck/service/handler/middleware 单测
（miniredis，含注册全流程、重复邮箱 409、验证码错误/过期/复用/烧码、限频 429
带 Retry-After、登录失败锁定、banned 拒绝、refresh 旋转后旧 token 失效），
go test -race 通过；集成测试 integration_test.go（testcontainers MySQL8+Redis，
register→login→refresh→受保护接口全链路，构建 tag integration）与 codes 模块同构。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
87 lines
2.7 KiB
Go
87 lines
2.7 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/wangjia/pangolin/server/internal/codes"
|
|
)
|
|
|
|
// ctxKey is this package's private context-key type for values other than the
|
|
// numeric user id (which is shared with the codes module — see below).
|
|
type ctxKey string
|
|
|
|
const (
|
|
// ctxKeyUserUUID stores the authenticated user's UUID (the JWT subject).
|
|
ctxKeyUserUUID ctxKey = "user_uuid"
|
|
// ctxKeyClaims stores the full *Claims for handlers that need jti/exp.
|
|
ctxKeyClaims ctxKey = "claims"
|
|
)
|
|
|
|
// The numeric user id is injected under codes.CtxKeyUserID so that the codes
|
|
// module (and any other module sharing that exported key) reads the same value
|
|
// without an import cycle — codes deliberately exports the key for this purpose.
|
|
|
|
// RequireAuth returns middleware that enforces a valid Bearer access token on
|
|
// every wrapped route. On success it injects the numeric user id, the user
|
|
// UUID, and the parsed claims into the request context. This is the auth base
|
|
// for all protected /v1 routes (everything except the auth group).
|
|
func RequireAuth(tm *TokenManager) func(http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
token, ok := bearerToken(r)
|
|
if !ok {
|
|
writeAPIErr(w, ErrUnauthorized, 0)
|
|
return
|
|
}
|
|
claims, err := tm.ParseAccess(token)
|
|
if err != nil {
|
|
writeAPIErr(w, ErrUnauthorized, 0)
|
|
return
|
|
}
|
|
|
|
ctx := r.Context()
|
|
ctx = context.WithValue(ctx, codes.CtxKeyUserID, claims.UID)
|
|
ctx = context.WithValue(ctx, ctxKeyUserUUID, claims.Subject)
|
|
ctx = context.WithValue(ctx, ctxKeyClaims, claims)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
}
|
|
|
|
// bearerToken extracts the token from an "Authorization: Bearer <token>" header.
|
|
func bearerToken(r *http.Request) (string, bool) {
|
|
h := r.Header.Get("Authorization")
|
|
if h == "" {
|
|
return "", false
|
|
}
|
|
const prefix = "Bearer "
|
|
if len(h) <= len(prefix) || !strings.EqualFold(h[:len(prefix)], prefix) {
|
|
return "", false
|
|
}
|
|
token := strings.TrimSpace(h[len(prefix):])
|
|
if token == "" {
|
|
return "", false
|
|
}
|
|
return token, true
|
|
}
|
|
|
|
// UserIDFromContext returns the numeric user id injected by RequireAuth.
|
|
func UserIDFromContext(ctx context.Context) (int64, bool) {
|
|
v, ok := ctx.Value(codes.CtxKeyUserID).(int64)
|
|
return v, ok && v != 0
|
|
}
|
|
|
|
// UserUUIDFromContext returns the user UUID injected by RequireAuth.
|
|
func UserUUIDFromContext(ctx context.Context) (string, bool) {
|
|
v, ok := ctx.Value(ctxKeyUserUUID).(string)
|
|
return v, ok && v != ""
|
|
}
|
|
|
|
// ClaimsFromContext returns the parsed access-token claims injected by RequireAuth.
|
|
func ClaimsFromContext(ctx context.Context) (*Claims, bool) {
|
|
v, ok := ctx.Value(ctxKeyClaims).(*Claims)
|
|
return v, ok
|
|
}
|