mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-09-29 14:06:36 +08:00
ryan
287 lines
9.4 KiB
Go
287 lines
9.4 KiB
Go
package model
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"regexp"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/Rain-kl/Wavelet/internal/db"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
const (
|
|
AuthSourceTypeOIDC = "oidc"
|
|
)
|
|
|
|
var authSourceNamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$`)
|
|
|
|
type AuthSource struct {
|
|
ID uint64 `json:"id" gorm:"primaryKey"`
|
|
Name string `json:"name" gorm:"uniqueIndex;size:80;not null"`
|
|
Type string `json:"type" gorm:"size:20;not null"`
|
|
DisplayName string `json:"display_name" gorm:"size:100"`
|
|
IsActive bool `json:"is_active" gorm:"index;not null;default:false"`
|
|
ClientID string `json:"client_id" gorm:"size:255"`
|
|
ClientSecret string `json:"-" gorm:"size:1024"`
|
|
OpenIDDiscoveryURL string `json:"openid_discovery_url" gorm:"column:openid_discovery_url;size:1024"`
|
|
Scopes string `json:"scopes" gorm:"size:255"`
|
|
IconURL string `json:"icon_url" gorm:"size:1024"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
ClientSecretConfigured bool `json:"client_secret_configured" gorm:"-"`
|
|
}
|
|
|
|
type ExternalAccount struct {
|
|
ID uint64 `json:"id" gorm:"primaryKey"`
|
|
AuthSourceID uint64 `json:"auth_source_id" gorm:"uniqueIndex:idx_external_accounts_source_external,priority:1;index"`
|
|
UserID uint64 `json:"user_id" gorm:"index;not null"`
|
|
ExternalID string `json:"external_id" gorm:"uniqueIndex:idx_external_accounts_source_external,priority:2;size:255;not null"`
|
|
ExternalUsername string `json:"external_username" gorm:"size:255"`
|
|
Email string `json:"email" gorm:"size:255"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
type ExternalAccountView struct {
|
|
ID uint64 `json:"id"`
|
|
AuthSourceID uint64 `json:"auth_source_id"`
|
|
AuthSourceName string `json:"auth_source_name"`
|
|
AuthSourceType string `json:"auth_source_type"`
|
|
AuthSourceLabel string `json:"auth_source_label"`
|
|
ExternalUsername string `json:"external_username"`
|
|
Email string `json:"email"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
|
|
func (source *AuthSource) Normalize() {
|
|
source.Type = strings.ToLower(strings.TrimSpace(source.Type))
|
|
source.Name = strings.TrimSpace(source.Name)
|
|
source.DisplayName = strings.TrimSpace(source.DisplayName)
|
|
source.ClientID = strings.TrimSpace(source.ClientID)
|
|
source.ClientSecret = strings.TrimSpace(source.ClientSecret)
|
|
source.OpenIDDiscoveryURL = strings.TrimSpace(source.OpenIDDiscoveryURL)
|
|
source.Scopes = strings.TrimSpace(source.Scopes)
|
|
source.IconURL = strings.TrimSpace(source.IconURL)
|
|
if source.DisplayName == "" {
|
|
source.DisplayName = source.Name
|
|
}
|
|
if source.Type == AuthSourceTypeOIDC && source.Scopes == "" {
|
|
source.Scopes = "openid profile email"
|
|
}
|
|
}
|
|
|
|
func (source *AuthSource) Validate() error {
|
|
source.Normalize()
|
|
if source.Name == "" {
|
|
return errors.New("认证源名称不能为空")
|
|
}
|
|
if !authSourceNamePattern.MatchString(source.Name) {
|
|
return errors.New("认证源名称只能包含字母、数字、短横线或下划线，且必须以字母或数字开头")
|
|
}
|
|
if source.Type != AuthSourceTypeOIDC {
|
|
return errors.New("认证源类型仅支持 oidc")
|
|
}
|
|
if source.OpenIDDiscoveryURL == "" {
|
|
return errors.New("OIDC 认证源必须配置 Discovery URL")
|
|
}
|
|
if source.IsActive && (source.ClientID == "" || source.ClientSecret == "") {
|
|
return errors.New("启用认证源前必须配置 Client ID 和 Client Secret")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (source *AuthSource) Sanitize() {
|
|
source.ClientSecretConfigured = source.ClientSecret != ""
|
|
source.ClientSecret = ""
|
|
}
|
|
|
|
func GetAuthSources() ([]AuthSource, error) {
|
|
var sources []AuthSource
|
|
if err := db.DB(context.Background()).Order("id asc").Find(&sources).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
for i := range sources {
|
|
sources[i].Sanitize()
|
|
}
|
|
return sources, nil
|
|
}
|
|
|
|
func GetActiveAuthSources() ([]AuthSource, error) {
|
|
var sources []AuthSource
|
|
if err := db.DB(context.Background()).Where("is_active = ?", true).Order("id asc").Find(&sources).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
for i := range sources {
|
|
sources[i].Sanitize()
|
|
}
|
|
return sources, nil
|
|
}
|
|
|
|
func GetAuthSourceByID(id uint64) (*AuthSource, error) {
|
|
if id == 0 {
|
|
return nil, errors.New("认证源 ID 不能为空")
|
|
}
|
|
var source AuthSource
|
|
if err := db.DB(context.Background()).First(&source, "id = ?", id).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
source.ClientSecretConfigured = source.ClientSecret != ""
|
|
return &source, nil
|
|
}
|
|
|
|
func GetAuthSourceByName(name string) (*AuthSource, error) {
|
|
name = strings.TrimSpace(name)
|
|
if name == "" {
|
|
return nil, errors.New("认证源名称不能为空")
|
|
}
|
|
var source AuthSource
|
|
if err := db.DB(context.Background()).First(&source, "name = ?", name).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
source.ClientSecretConfigured = source.ClientSecret != ""
|
|
return &source, nil
|
|
}
|
|
|
|
func CreateAuthSource(source *AuthSource) error {
|
|
if err := source.Validate(); err != nil {
|
|
return err
|
|
}
|
|
return db.DB(context.Background()).Create(source).Error
|
|
}
|
|
|
|
func UpdateAuthSource(source *AuthSource, keepSecret bool) error {
|
|
if source.ID == 0 {
|
|
return errors.New("认证源 ID 不能为空")
|
|
}
|
|
var current AuthSource
|
|
if err := db.DB(context.Background()).First(¤t, "id = ?", source.ID).Error; err != nil {
|
|
return err
|
|
}
|
|
if keepSecret {
|
|
source.ClientSecret = current.ClientSecret
|
|
}
|
|
if err := source.Validate(); err != nil {
|
|
return err
|
|
}
|
|
return db.DB(context.Background()).Model(¤t).Updates(map[string]any{
|
|
"name": source.Name,
|
|
"type": source.Type,
|
|
"display_name": source.DisplayName,
|
|
"is_active": source.IsActive,
|
|
"client_id": source.ClientID,
|
|
"client_secret": source.ClientSecret,
|
|
"openid_discovery_url": source.OpenIDDiscoveryURL,
|
|
"scopes": source.Scopes,
|
|
"icon_url": source.IconURL,
|
|
}).Error
|
|
}
|
|
|
|
func ToggleAuthSource(id uint64, isActive bool) error {
|
|
source, err := GetAuthSourceByID(id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
source.IsActive = isActive
|
|
if err := source.Validate(); err != nil {
|
|
return err
|
|
}
|
|
return db.DB(context.Background()).Model(&AuthSource{}).Where("id = ?", id).Update("is_active", isActive).Error
|
|
}
|
|
|
|
func DeleteAuthSource(id uint64) error {
|
|
if id == 0 {
|
|
return errors.New("认证源 ID 不能为空")
|
|
}
|
|
return db.DB(context.Background()).Transaction(func(tx *gorm.DB) error {
|
|
if err := tx.Where("auth_source_id = ?", id).Delete(&ExternalAccount{}).Error; err != nil {
|
|
return err
|
|
}
|
|
return tx.Delete(&AuthSource{}, "id = ?", id).Error
|
|
})
|
|
}
|
|
|
|
func FindExternalAccount(sourceID uint64, externalID string) (*ExternalAccount, error) {
|
|
var account ExternalAccount
|
|
if err := db.DB(context.Background()).Where("auth_source_id = ? AND external_id = ?", sourceID, externalID).First(&account).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return &account, nil
|
|
}
|
|
|
|
func BindExternalAccount(account *ExternalAccount) error {
|
|
if account.UserID == 0 || strings.TrimSpace(account.ExternalID) == "" {
|
|
return errors.New("外部账号绑定信息不完整")
|
|
}
|
|
account.ExternalID = strings.TrimSpace(account.ExternalID)
|
|
account.ExternalUsername = strings.TrimSpace(account.ExternalUsername)
|
|
account.Email = strings.TrimSpace(account.Email)
|
|
|
|
return db.DB(context.Background()).Transaction(func(tx *gorm.DB) error {
|
|
var current ExternalAccount
|
|
err := tx.Where("auth_source_id = ? AND external_id = ?", account.AuthSourceID, account.ExternalID).First(¤t).Error
|
|
if err == nil {
|
|
if current.UserID != account.UserID {
|
|
return errors.New("该外部账号已绑定到其他用户")
|
|
}
|
|
return tx.Model(¤t).Updates(map[string]any{
|
|
"external_username": account.ExternalUsername,
|
|
"email": account.Email,
|
|
}).Error
|
|
}
|
|
if !errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return err
|
|
}
|
|
return tx.Create(account).Error
|
|
})
|
|
}
|
|
|
|
func ListExternalAccountsByUserID(userID uint64) ([]ExternalAccountView, error) {
|
|
if userID == 0 {
|
|
return nil, errors.New("用户 ID 不能为空")
|
|
}
|
|
var accounts []ExternalAccount
|
|
if err := db.DB(context.Background()).Where("user_id = ?", userID).Order("id asc").Find(&accounts).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
views := make([]ExternalAccountView, 0, len(accounts))
|
|
for _, account := range accounts {
|
|
var name, sourceType, label string
|
|
if account.AuthSourceID == 0 {
|
|
name = "default"
|
|
sourceType = "oidc"
|
|
label = "历史认证源"
|
|
} else {
|
|
source, err := GetAuthSourceByID(account.AuthSourceID)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
name = source.Name
|
|
sourceType = source.Type
|
|
label = source.DisplayName
|
|
if label == "" {
|
|
label = source.Name
|
|
}
|
|
}
|
|
views = append(views, ExternalAccountView{
|
|
ID: account.ID,
|
|
AuthSourceID: account.AuthSourceID,
|
|
AuthSourceName: name,
|
|
AuthSourceType: sourceType,
|
|
AuthSourceLabel: label,
|
|
ExternalUsername: account.ExternalUsername,
|
|
Email: account.Email,
|
|
CreatedAt: account.CreatedAt,
|
|
})
|
|
}
|
|
return views, nil
|
|
}
|
|
|
|
func DeleteExternalAccountForUser(id uint64, userID uint64) error {
|
|
if id == 0 || userID == 0 {
|
|
return errors.New("绑定记录 ID 不能为空")
|
|
}
|
|
return db.DB(context.Background()).Where("id = ? AND user_id = ?", id, userID).Delete(&ExternalAccount{}).Error
|
|
}
|