mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-10-01 06:36:38 +08:00
ryan
c9b702d234
Architecture: - Move GetFromContext/SetToContext from plugins/domain/auth to pkg/util - Move auth context key constants to core/contracts (AuthUserObjKey, AuthTokenAuthKey, etc.) - Add AuthUserIDKey, AuthUserNameKey, GetCurrentUserID, RevokeToken to contracts.AuthService - All 4 domain plugin Apply() methods now resolve AuthService via core.Using IoC - Plugin route middleware uses authSvc.RequireAuthMiddleware() cast to gin.HandlerFunc - DisallowTokenAuth added to AuthService contract Migration: - Replace cmd/app.go SetMigrationRunner bridge with gooseEngine implementing core.MigrationEngine - Remove cmd/root.go PreRun migration hooks and runMigrations() function - Migrations now run via core.App.Start() → RunMigrations() Events: - Add complete domain event topic catalog and payload DTOs to core/contracts/events.go - 15 event topics across auth, user, admin, upload, message_gateway, risk_control Downstream: - Create downstream/ directory with README and custom_example plugin scaffold CI: - Update Makefile code-check architecture guards for Cordis layering - Enforce: core no gin/gorm/asynq, contracts no plugins/, pkg no plugins/, domain no cross-domain
101 lines
3.8 KiB
Go
101 lines
3.8 KiB
Go
// Copyright 2026 Arctel.net
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
// Package contracts defines unified service interfaces and DTOs for cross-plugin communication.
|
|
package contracts
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
)
|
|
|
|
// UserDTO represents a unified user data transfer object across plugins.
|
|
type UserDTO struct {
|
|
ID uint64 `json:"id,string"`
|
|
Username string `json:"username"`
|
|
Nickname string `json:"nickname"`
|
|
Email string `json:"email"`
|
|
AvatarURL string `json:"avatar_url"`
|
|
IsActive bool `json:"is_active"`
|
|
IsAdmin bool `json:"is_admin"`
|
|
NeedChangePassword bool `json:"need_change_password,omitempty"`
|
|
Bio string `json:"bio,omitempty"`
|
|
Phone string `json:"phone,omitempty"`
|
|
Gender string `json:"gender,omitempty"`
|
|
Website string `json:"website,omitempty"`
|
|
Location string `json:"location,omitempty"`
|
|
LastLoginAt time.Time `json:"last_login_at"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
// TableName returns w_users.
|
|
func (UserDTO) TableName() string {
|
|
return "w_users"
|
|
}
|
|
|
|
// OAuthUserInfoDTO contains user identity claims obtained from an OAuth provider.
|
|
type OAuthUserInfoDTO struct {
|
|
ID uint64 `json:"id"`
|
|
Sub string `json:"sub"`
|
|
Username string `json:"username"`
|
|
PreferredUsername string `json:"preferred_username"`
|
|
Email string `json:"email"`
|
|
Name string `json:"name"`
|
|
Active bool `json:"active"`
|
|
AvatarURL string `json:"avatar_url"`
|
|
}
|
|
|
|
// OAuthProvider defines the pluggable OAuth provider contract.
|
|
type OAuthProvider interface {
|
|
Name() string
|
|
GetAuthURL(state string) string
|
|
ExchangeCode(ctx context.Context, code string) (*OAuthUserInfoDTO, error)
|
|
}
|
|
|
|
// AuthService defines the contract for authentication, session verification, and token management.
|
|
type AuthService interface {
|
|
// RequireAuthMiddleware returns a middleware handler (compatible with gin.HandlerFunc or standard middleware).
|
|
RequireAuthMiddleware() any
|
|
|
|
// RequireAdminMiddleware returns an admin authorization middleware.
|
|
RequireAdminMiddleware() any
|
|
|
|
// GetCurrentUser retrieves the authenticated UserDTO from context.
|
|
GetCurrentUser(ctx context.Context) (*UserDTO, error)
|
|
|
|
// GetCurrentUserID retrieves the authenticated user ID from session/context.
|
|
GetCurrentUserID(ctx context.Context) (uint64, error)
|
|
|
|
// VerifyToken validates an access token and returns the associated user DTO.
|
|
VerifyToken(ctx context.Context, token string) (*UserDTO, error)
|
|
|
|
// CreateSession establishes an authenticated session for the given user ID.
|
|
CreateSession(ctx context.Context, userID uint64, extras map[string]any) (string, error)
|
|
|
|
// RevokeToken invalidates a specific access token by its hash.
|
|
RevokeToken(ctx context.Context, tokenHash string) error
|
|
|
|
// RevokeUserSessions revokes all active sessions and cached tokens for a user.
|
|
RevokeUserSessions(ctx context.Context, userID uint64) error
|
|
|
|
// DisallowTokenAuthMiddleware returns a middleware that rejects requests authenticated via access token.
|
|
DisallowTokenAuthMiddleware() any
|
|
}
|
|
|
|
// AuthRegistry allows downstream and domain plugins to register custom authentication providers.
|
|
type AuthRegistry interface {
|
|
RegisterOAuthProvider(name string, provider OAuthProvider)
|
|
GetOAuthProvider(name string) (OAuthProvider, bool)
|
|
ListOAuthProviders() []string
|
|
}
|
|
|
|
// Auth context keys — stored in Gin context by auth middleware, consumed by domain plugins.
|
|
const (
|
|
AuthUserIDKey = "user_id"
|
|
AuthUserNameKey = "username"
|
|
AuthUserObjKey = "user_obj"
|
|
AuthTokenAuthKey = "token_auth" // marks if request uses access token auth
|
|
AuthTokenAdminKey = "token_admin" // whether the access token has admin privileges
|
|
)
|