platform/web/auth/endpoints.go

package auth

import (
	"context"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"platform/pkg/env"
	"platform/pkg/u"
	g "platform/web/globals"
	"platform/web/globals/orm"
	m "platform/web/models"
	q "platform/web/queries"
	"strings"
	"time"

	"github.com/gofiber/fiber/v2"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// AuthorizeGet 授权端点
func AuthorizeGet(ctx *fiber.Ctx) error {

	// 检查请求
	req := new(AuthorizeGetReq)
	if err := g.Validator.ParseQuery(ctx, req); err != nil {
		return err
	}

	// 检查客户端
	client, err := authClient(req.ClientID)
	if err != nil {
		return err
	}

	if client.RedirectURI == nil || *client.RedirectURI != req.RedirectURI {
		return errors.New("客户端重定向URI错误")
	}

	// todo 检查 scope

	// 授权确认页面
	return nil
}

type AuthorizeGetReq struct {
	ResponseType string `json:"response_type" validate:"eq=code"`
	ClientID     string `json:"client_id" validate:"required"`
	RedirectURI  string `json:"redirect_uri" validate:"required"`
	Scope        string `json:"scope"`
	State        string `json:"state"`
}

func AuthorizePost(ctx *fiber.Ctx) error {

	// todo 解析用户授权的范围

	return nil
}

type AuthorizePostReq struct {
	Accept bool   `json:"accept"`
	Scope  string `json:"scope"`
}

// Token 令牌端点
func Token(c *fiber.Ctx) error {
	now := time.Now()

	// 验证请求参数
	req := new(TokenReq)
	if err := c.BodyParser(req); err != nil {
		return sendError(c, ErrAuthorizeInvalidRequest, "无法解析请求参数")
	}
	if req.GrantType == "" {
		return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: grant_type")
	}

	switch req.GrantType {
	// 授权码模式
	case GrantAuthorizationCode:
		if req.Code == "" {
			return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: code")
		}
	// 刷新令牌模式
	case GrantRefreshToken:
		if req.RefreshToken == "" {
			return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: refresh_token")
		}
	// 密码模式
	case GrantPassword:
		if req.LoginType == "" {
			return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: password_type")
		}
		if req.Username == "" {
			return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: username")
		}
		if req.Password == "" {
			return sendError(c, ErrAuthorizeInvalidRequest, "缺少必要参数: password")
		}
	}

	// 验证客户端身份
	authCtx := GetAuthCtx(c)
	if authCtx == nil {
		authCtx = &AuthCtx{}
	}
	if authCtx.Client == nil {
		client, err := authClient(req.ClientID, req.ClientSecret)
		if err != nil {
			return sendError(c, err)
		}
		authCtx.Client = client
	}

	// 处理授权
	var session *m.Session
	var err error
	switch req.GrantType {
	// 授权码模式
	case GrantAuthorizationCode:
		session, err = authAuthorizationCode(c, authCtx, req, now)
	// 客户端凭证模式
	case GrantClientCredentials:
		session, err = authClientCredential(c, authCtx, req, now)
	// 刷新令牌模式
	case GrantRefreshToken:
		session, err = authRefreshToken(c, authCtx, req, now)
	// 密码模式
	case GrantPassword:
		session, err = authPassword(c, authCtx, req, now)
	default:
		return sendError(c, ErrAuthorizeUnsupportedGrantType)
	}
	if err != nil {
		return sendError(c, err)
	}

	// 返回响应
	return c.JSON(&TokenResp{
		TokenType:    "Bearer",
		AccessToken:  session.AccessToken,
		RefreshToken: u.Z(session.RefreshToken),
		ExpiresIn:    int(time.Time(session.AccessTokenExpires).Sub(now).Seconds()),
		Scope:        u.Z(session.Scopes),
	})
}

type TokenReq struct {
	GrantType    GrantType `json:"grant_type" form:"grant_type"`
	ClientID     string    `json:"client_id" form:"client_id"`
	ClientSecret string    `json:"client_secret" form:"client_secret"`
	Scope        string    `json:"scope" form:"scope"`
	GrantCodeData
	GrantClientData
	GrantRefreshData
	GrantPasswordData
}

type GrantCodeData struct {
	Code         string `json:"code" form:"code"`
	RedirectURI  string `json:"redirect_uri" form:"redirect_uri"`
	CodeVerifier string `json:"code_verifier" form:"code_verifier"`
}

type GrantClientData struct {
}

type GrantRefreshData struct {
	RefreshToken string `json:"refresh_token" form:"refresh_token"`
}

type GrantPasswordData struct {
	LoginType PwdLoginType `json:"login_type" form:"login_type"`
	LoginPool PwdLoginPool `json:"login_pool" form:"login_pool"`
	Username  string       `json:"username" form:"username"`
	Password  string       `json:"password" form:"password"`
	Remember  bool         `json:"remember" form:"remember"`
}

type GrantType string

const (
	GrantAuthorizationCode = GrantType("authorization_code") // 授权码模式
	GrantClientCredentials = GrantType("client_credentials") // 客户端凭证模式
	GrantRefreshToken      = GrantType("refresh_token")      // 刷新令牌模式
	GrantPassword          = GrantType("password")           // 密码模式（私有扩展）
)

type PwdLoginType string

const (
	PwdLoginByPassword = PwdLoginType("password")   // 账号密码
	PwdLoginByPhone    = PwdLoginType("phone_code") // 手机验证码
	PwdLoginByEmail    = PwdLoginType("email_code") // 邮箱验证码
)

type PwdLoginPool string

const (
	PwdLoginAsUser  = PwdLoginPool("user")  // 用户池
	PwdLoginAsAdmin = PwdLoginPool("admin") // 管理员池
)

type TokenResp struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token,omitempty"`
	ExpiresIn    int    `json:"expires_in"`
	TokenType    string `json:"token_type"`
	Scope        string `json:"scope,omitempty"`
}

type TokenErrResp struct {
	Error       string `json:"error"`
	Description string `json:"error_description,omitempty"`
}

func authAuthorizationCode(c *fiber.Ctx, auth *AuthCtx, req *TokenReq, now time.Time) (*m.Session, error) {

	// 检查 code 获取用户授权信息
	data, err := g.Redis.Get(context.Background(), req.Code).Result()
	if err != nil {
		return nil, err
	}
	var codeCtx CodeContext
	if err := json.Unmarshal([]byte(data), &codeCtx); err != nil {
		return nil, err
	}

	// 检查 PKCE
	if codeCtx.CodeChallengeMethod != "" {
		if req.CodeVerifier == "" {
			return nil, ErrAuthorizeInvalidPKCE
		}

		switch codeCtx.CodeChallengeMethod {
		case "plain":
			if req.CodeVerifier != codeCtx.CodeChallenge {
				return nil, ErrAuthorizeInvalidPKCE
			}
		case "S256":
			hash := sha256.Sum256([]byte(req.CodeVerifier))
			verifier := base64.RawURLEncoding.EncodeToString(hash[:])
			if verifier != codeCtx.CodeChallenge {
				return nil, ErrAuthorizeInvalidPKCE
			}
		default:
			return nil, ErrAuthorizeInvalidPKCE
		}
	}

	user, err := q.User.Where(
		q.User.ID.Eq(codeCtx.UserID),
		q.User.Status.Eq(int(m.UserStatusEnabled)),
	).First()
	if err != nil {
		return nil, err
	}

	// todo 检查 scope

	// 生成会话
	ip, _ := orm.ParseInet(c.IP()) // 可空字段，忽略异常
	ua := u.X(c.Get(fiber.HeaderUserAgent))
	session := &m.Session{
		IP:                 ip,
		UA:                 ua,
		UserID:             &user.ID,
		ClientID:           &auth.Client.ID,
		Scopes:             u.P(strings.Join(codeCtx.Scopes, " ")),
		AccessToken:        uuid.NewString(),
		AccessTokenExpires: now.Add(time.Duration(env.SessionAccessExpire) * time.Second),
	}
	if codeCtx.Remember {
		session.RefreshToken = u.P(uuid.NewString())
		session.RefreshTokenExpires = u.P(now.Add(time.Duration(env.SessionRefreshExpire) * time.Second))
	}

	err = SaveSession(q.Q, session)
	if err != nil {
		return nil, err
	}

	return session, nil
}

func authClientCredential(c *fiber.Ctx, auth *AuthCtx, _ *TokenReq, now time.Time) (*m.Session, error) {
	// todo 检查 scope
	scopes := strings.Join(auth.Scopes, " ")

	// 生成会话
	ip, _ := orm.ParseInet(c.IP()) // 可空字段，忽略异常
	ua := u.X(c.Get(fiber.HeaderUserAgent))
	session := &m.Session{
		IP:                 ip,
		UA:                 ua,
		ClientID:           &auth.Client.ID,
		AccessToken:        uuid.NewString(),
		AccessTokenExpires: now.Add(time.Duration(env.SessionAccessExpire) * time.Second),
		Scopes:             &scopes,
	}

	// 保存会话
	err := SaveSession(q.Q, session)
	if err != nil {
		return nil, err
	}

	return session, nil
}

func authPassword(c *fiber.Ctx, auth *AuthCtx, req *TokenReq, now time.Time) (*m.Session, error) {
	ip, _ := orm.ParseInet(c.IP()) // 可空字段，忽略异常
	ua := u.X(c.Get(fiber.HeaderUserAgent))

	// 分池认证
	var err error
	var user *m.User
	var admin *m.Admin

	var scopes []string

	pool := req.LoginPool
	if pool == "" {
		pool = PwdLoginAsUser
	}
	switch pool {
	case PwdLoginAsUser:
		user, err = authUser(req.LoginType, req.Username, req.Password)
		if err != nil {
			if req.LoginType != PwdLoginByPhone || !errors.Is(err, gorm.ErrRecordNotFound) {
				return nil, err
			}

			// 手机号首次登录的自动创建用户
			user = &m.User{
				Phone:  req.Username,
				Status: m.UserStatusEnabled,
			}
		}

		// 更新用户的登录时间
		user.LastLogin = u.P(time.Now())
		user.LastLoginIP = ip
		user.LastLoginUA = ua

	case PwdLoginAsAdmin:
		admin, err = authAdmin(req.LoginType, req.Username, req.Password)
		if err != nil {
			return nil, err
		}
		scopes, err = adminScopes(admin)
		if err != nil {
			return nil, err
		}

		// 非锁定管理员，不允许为空权限
		if !admin.Lock && (len(scopes) == 0) {
			return nil, ErrAuthorizeInvalidScope // 没有配置权限
		}

		// 更新管理员登录时间
		admin.LastLogin = u.P(time.Now())
		admin.LastLoginIP = ip
		admin.LastLoginUA = ua

	default:
		return nil, ErrAuthorizeInvalidRequest
	}

	// 生成会话
	session := &m.Session{
		IP:                 ip,
		UA:                 ua,
		ClientID:           &auth.Client.ID,
		Scopes:             u.X(strings.Join(scopes, " ")),
		AccessToken:        uuid.NewString(),
		AccessTokenExpires: now.Add(time.Duration(env.SessionAccessExpire) * time.Second),
	}

	if req.Remember {
		session.RefreshToken = u.P(uuid.NewString())
		session.RefreshTokenExpires = u.P(now.Add(time.Duration(env.SessionRefreshExpire) * time.Second))
	}

	// 保存用户更新和会话
	err = q.Q.Transaction(func(tx *q.Query) error {
		if user != nil {
			if err := tx.User.Save(user); err != nil {
				return err
			}
			session.UserID = &user.ID
		}
		if admin != nil {
			if err := tx.Admin.Save(admin); err != nil {
				return err
			}
			session.AdminID = &admin.ID
		}
		if err := SaveSession(tx, session); err != nil {
			return err
		}
		return nil
	})
	if err != nil {
		return nil, err
	}

	return session, nil
}

func authRefreshToken(_ *fiber.Ctx, _ *AuthCtx, req *TokenReq, now time.Time) (*m.Session, error) {
	session, err := FindSessionByRefresh(req.RefreshToken, now)
	if err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, ErrAuthorizeInvalidGrant
		}
		return nil, err
	}

	// todo 检查权限

	// 生成令牌
	session.AccessToken = uuid.NewString()
	session.AccessTokenExpires = now.Add(time.Duration(env.SessionAccessExpire) * time.Second)
	if session.RefreshToken != nil {
		session.RefreshToken = u.P(uuid.NewString())
		session.RefreshTokenExpires = u.P(now.Add(time.Duration(env.SessionRefreshExpire) * time.Second))
	}

	// 保存令牌
	err = SaveSession(q.Q, session)
	if err != nil {
		return nil, err
	}

	return session, nil
}

func sendError(c *fiber.Ctx, err error, description ...string) error {
	var sErr AuthErr
	if errors.As(err, &sErr) {
		status := fiber.StatusBadRequest
		var desc string
		switch {
		case errors.Is(sErr, ErrAuthorizeInvalidRequest):
			desc = "无效的请求"
		case errors.Is(sErr, ErrAuthorizeInvalidClient):
			status = fiber.StatusUnauthorized
			desc = "无效的客户端凭证"
		case errors.Is(sErr, ErrAuthorizeInvalidGrant):
			desc = "无效的授权凭证"
		case errors.Is(sErr, ErrAuthorizeInvalidScope):
			desc = "无效的授权范围"
		case errors.Is(sErr, ErrAuthorizeUnauthorizedClient):
			desc = "未授权的客户端"
		case errors.Is(sErr, ErrAuthorizeUnsupportedGrantType):
			desc = "不支持的授权类型"
		}
		if len(description) > 0 {
			desc = description[0]
		}

		return c.Status(status).JSON(TokenErrResp{
			Error:       string(sErr),
			Description: desc,
		})
	}

	return err
}

// Revoke 令牌撤销端点
func Revoke(ctx *fiber.Ctx) error {
	_, err := GetAuthCtx(ctx).PermitUser()
	if err != nil {
		// 用户未登录
		return nil
	}

	// 解析请求参数
	req := new(RevokeReq)
	if err := ctx.BodyParser(req); err != nil {
		return err
	}

	// 删除会话
	err = RemoveSession(ctx.Context(), req.AccessToken, req.RefreshToken)
	if err != nil {
		return err
	}

	return nil
}

type RevokeReq struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
}

// Introspect 令牌检查端点
func Introspect(ctx *fiber.Ctx) error {
	authCtx := GetAuthCtx(ctx)

	// 尝试验证用户权限
	if _, err := authCtx.PermitUser(); err == nil {
		return introspectUser(ctx, authCtx)
	}

	// 尝试验证管理员权限
	if _, err := authCtx.PermitAdmin(); err == nil {
		return introspectAdmin(ctx, authCtx)
	}

	return ErrAuthenticateForbidden
}

// introspectUser 获取并返回用户信息
func introspectUser(ctx *fiber.Ctx, authCtx *AuthCtx) error {
	// 获取用户信息
	profile, err := q.User.
		Where(q.User.ID.Eq(authCtx.User.ID)).
		Omit(q.User.DeletedAt).
		Take()
	if err != nil {
		return err
	}

	// 检查用户是否设置了密码
	hasPassword := false
	if profile.Password != nil && *profile.Password != "" {
		hasPassword = true
		profile.Password = nil // 不返回密码
	}

	// 掩码敏感信息
	if profile.Phone != "" {
		profile.Phone = u.MaskPhone(profile.Phone)
	}
	if profile.IDNo != nil && *profile.IDNo != "" {
		profile.IDNo = u.P(u.MaskIdNo(*profile.IDNo))
	}

	return ctx.JSON(struct {
		m.User
		HasPassword bool `json:"has_password"` // 是否设置了密码
	}{*profile, hasPassword})
}

// introspectAdmin 获取并返回管理员信息
func introspectAdmin(ctx *fiber.Ctx, authCtx *AuthCtx) error {
	// 获取管理员信息
	profile, err := q.Admin.
		Preload(q.Admin.Roles, q.Admin.Roles.Permissions).
		Where(q.Admin.ID.Eq(authCtx.Admin.ID)).
		Omit(q.Admin.DeletedAt, q.Admin.Password).
		Take()
	if err != nil {
		return err
	}

	// 整理权限列表
	scopes := make(map[string]struct{}, 0)
	for _, role := range profile.Roles {
		for _, permission := range role.Permissions {
			scopes[permission.Name] = struct{}{}
		}
	}
	list := make([]string, 0, len(scopes))
	for scope := range scopes {
		list = append(list, scope)
	}

	return ctx.JSON(struct {
		*m.Admin
		Scopes []string `json:"scopes"`
	}{profile, list})
}

type CodeContext struct {
	UserID              int32    `json:"user_id"`
	ClientID            int32    `json:"client_id"`
	Scopes              []string `json:"scopes"`
	Remember            bool     `json:"remember"`
	CodeChallenge       string   `json:"code_challenge"`
	CodeChallengeMethod string   `json:"code_challenge_method"`
}