mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-09-30 22:26:38 +08:00
ryan
ae3b792e16
- add util.Go with panic recovery for background goroutines - add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries - add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks - enforce session ID rotation upon login/oauth callback to prevent session fixation - add sliding window login failure rate limiting and oauth state rate limiting - fix redis client capture race in pubsub listeners and wait on stop channel - adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast - fix semantic heading levels and missing aria-labels across UI components - document security, concurrency, and a11y standards in AGENTS.md
59 lines
1.5 KiB
Go
59 lines
1.5 KiB
Go
// Copyright 2025 linux.do
|
|
// Copyright 2026 Arctel.net
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package oauth
|
|
|
|
import (
|
|
"encoding/json"
|
|
"time"
|
|
)
|
|
|
|
// Session 用户信息字段 Key
|
|
const (
|
|
UserNameKey = "username"
|
|
UserIDKey = "user_id"
|
|
UserObjKey = "user_obj"
|
|
TokenAuthKey = "token_auth" // 标记当前请求是否通过 Access Token 鉴权
|
|
TokenAdminKey = "token_admin" // Access Token 本身是否具有管理员权限
|
|
SessionTokenKey = "oauth_session_token" //nolint:gosec // false positive: this is a session key, not hardcoded credentials
|
|
PasswordHashKey = "password_hash"
|
|
)
|
|
|
|
// OAuth State 缓存 Key 格式与过期时间
|
|
const (
|
|
OAuthStateCacheKeyFormat = "oauth:state:%s"
|
|
OAuthStateCacheKeyExpiration = 10 * time.Minute
|
|
oauthStateLimitKeyFormat = "oauth:state:limit:%s"
|
|
oauthStateLimitMax = 10
|
|
)
|
|
|
|
// OAuth 授权用途常量
|
|
const (
|
|
OAuthPurposeLogin = "login"
|
|
OAuthPurposeBind = "bind"
|
|
)
|
|
|
|
type oauthStatePayload struct {
|
|
SourceName string `json:"source_name"`
|
|
Purpose string `json:"purpose"`
|
|
UserID uint64 `json:"user_id,omitempty"`
|
|
SessionHash string `json:"session_hash"`
|
|
}
|
|
|
|
func encodeOAuthStatePayload(payload oauthStatePayload) (string, error) {
|
|
data, err := json.Marshal(payload)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(data), nil
|
|
}
|
|
|
|
func decodeOAuthStatePayload(value string) (oauthStatePayload, error) {
|
|
var payload oauthStatePayload
|
|
if err := json.Unmarshal([]byte(value), &payload); err != nil {
|
|
return oauthStatePayload{}, err
|
|
}
|
|
return payload, nil
|
|
}
|