mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-10-02 23:06:36 +08:00
ryan
c9b702d234
Architecture: - Move GetFromContext/SetToContext from plugins/domain/auth to pkg/util - Move auth context key constants to core/contracts (AuthUserObjKey, AuthTokenAuthKey, etc.) - Add AuthUserIDKey, AuthUserNameKey, GetCurrentUserID, RevokeToken to contracts.AuthService - All 4 domain plugin Apply() methods now resolve AuthService via core.Using IoC - Plugin route middleware uses authSvc.RequireAuthMiddleware() cast to gin.HandlerFunc - DisallowTokenAuth added to AuthService contract Migration: - Replace cmd/app.go SetMigrationRunner bridge with gooseEngine implementing core.MigrationEngine - Remove cmd/root.go PreRun migration hooks and runMigrations() function - Migrations now run via core.App.Start() → RunMigrations() Events: - Add complete domain event topic catalog and payload DTOs to core/contracts/events.go - 15 event topics across auth, user, admin, upload, message_gateway, risk_control Downstream: - Create downstream/ directory with README and custom_example plugin scaffold CI: - Update Makefile code-check architecture guards for Cordis layering - Enforce: core no gin/gorm/asynq, contracts no plugins/, pkg no plugins/, domain no cross-domain
92 lines
2.5 KiB
Go
92 lines
2.5 KiB
Go
// Copyright 2026 Arctel.net
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
// Package risk_control provides the access control, IP rate limiting, and telemetry risk analysis domain plugin for Cordis.
|
|
package risk_control
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/Rain-kl/Wavelet/core/contracts"
|
|
"github.com/Rain-kl/Wavelet/pkg/config"
|
|
"github.com/Rain-kl/Wavelet/pkg/idgen"
|
|
"github.com/Rain-kl/Wavelet/pkg/response"
|
|
"github.com/Rain-kl/Wavelet/pkg/util"
|
|
"github.com/Rain-kl/Wavelet/plugins/domain/risk_control/logstore"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// Middleware is an alias for RiskControlMiddleware.
|
|
var Middleware = RiskControlMiddleware
|
|
|
|
// RiskControlMiddleware 全局日志采集中间件
|
|
func RiskControlMiddleware() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// 如果未启用 ClickHouse，直接放行
|
|
if config.Config == nil || !config.Config.ClickHouse.Enabled {
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
// 1. 限流背压检测（检测本地缓冲队列是否已满）
|
|
if IsBufferFull() {
|
|
response.AbortTooManyRequests(c, "系统繁忙，请稍后再试")
|
|
return
|
|
}
|
|
|
|
start := time.Now()
|
|
|
|
// 2. 执行后续请求（穿过业务处理和认证中间件）
|
|
c.Next()
|
|
|
|
// 3. 后置身份检查：仅记录通过认证的请求
|
|
userObj, exists := util.GetFromContext[*contracts.UserDTO](c, contracts.AuthUserObjKey)
|
|
if !exists || userObj == nil {
|
|
return
|
|
}
|
|
|
|
// 4. 计算耗时并异步推送到缓冲队列
|
|
latency := time.Since(start).Milliseconds()
|
|
|
|
var headersStr string
|
|
if c.Request.Header != nil {
|
|
// 克隆 Header，避免污染原 HTTP 请求的 Header 对象
|
|
clonedHeaders := make(http.Header)
|
|
for k, v := range c.Request.Header {
|
|
clonedHeaders[k] = v
|
|
}
|
|
clonedHeaders.Del("Cookie")
|
|
|
|
if headersBytes, err := json.Marshal(clonedHeaders); err == nil {
|
|
headersStr = string(headersBytes)
|
|
}
|
|
}
|
|
|
|
const maxHTTPStatus = 999
|
|
status := c.Writer.Status()
|
|
if status < 0 {
|
|
status = 0
|
|
} else if status > maxHTTPStatus {
|
|
status = maxHTTPStatus
|
|
}
|
|
|
|
logItem := &logstore.UserAccessLog{
|
|
ID: idgen.NextUint64ID(),
|
|
UserID: userObj.ID, // 直接从 Context 获取已登录用户ID，避免数据库查询
|
|
Path: c.Request.URL.Path,
|
|
Method: c.Request.Method,
|
|
IP: c.ClientIP(),
|
|
UserAgent: c.Request.UserAgent(),
|
|
Headers: headersStr,
|
|
Status: int32(status),
|
|
Latency: latency,
|
|
CreatedAt: time.Now(),
|
|
}
|
|
|
|
// 非阻塞地推入缓存队列
|
|
QueueAccessLog(logItem)
|
|
}
|
|
}
|