LLMGuardX Dev
e31cc54b8e
- 门户通用聊天:选择已批准模型直接对话,审批通过后自动开通用户级运行时 API Key(加密落库,限额取批准值),聊天经受管网关统一认证/限流/配额/审计; 会话哈希链完整性 + busy 租约防并发,失败不落库。 - 扫码登录:identity_providers 扩展 wecom/dingtalk/feishu,管理端配置 (AppID/AppSecret/AgentID/回调/自动开户/默认部门),登录页自动展示; one-time state 防 CSRF,provider_uid 全局唯一防多账号绑定,平台端点 固定公网 URL 复用 public-only 拨号。 - 个人安全策略:账号安全页(登录设备管理/吊销非当前会话/登录提醒开关/ 扫码绑定解绑),登录成功发布 security.login_detected 事件按偏好落站内信 (新增 security 类别),会话索引只存令牌摘要并惰性清理。 - 迁移 000038-000041;修复 social update 参数越界/凭据回读/路由挂载缺失; 全量测试 25 包通过,前端 admin/portal 构建通过,端到端验证完成。
389 lines
13 KiB
Go
389 lines
13 KiB
Go
package identity
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/redis/go-redis/v9"
|
|
)
|
|
|
|
var ErrInvalidSession = errors.New("invalid or expired session")
|
|
|
|
type Principal struct {
|
|
Kind Kind `json:"kind"`
|
|
SubjectID string `json:"subject_id"`
|
|
Login string `json:"login"`
|
|
DisplayName string `json:"display_name"`
|
|
Role string `json:"role,omitempty"`
|
|
Purpose string `json:"purpose"`
|
|
IssuedAt int64 `json:"issued_at"`
|
|
// IP 与 UserAgent 记录签发时的登录环境,供"我的登录设备"展示与登录提醒。
|
|
IP string `json:"ip,omitempty"`
|
|
UserAgent string `json:"user_agent,omitempty"`
|
|
// AuthVersion 是签发会话时账号的凭据版本;凭据变更(改密/2FA 变更)会
|
|
// 递增该版本,旧版本会话在 Authenticate 时被拒绝,被盗会话无法在
|
|
// 凭据轮换后继续存活。
|
|
AuthVersion int64 `json:"auth_version,omitempty"`
|
|
}
|
|
|
|
// authVersionTTL 必须严格大于会话 TTL(上限 7 天,由 config 校验保证):
|
|
// 版本键过期时所有旧会话已自然过期,凭据变更后旧会话不会复活。
|
|
const authVersionTTL = 14 * 24 * time.Hour
|
|
|
|
func authVersionKey(kind Kind, subjectID string) string {
|
|
return "gateway:auth-version:" + string(kind) + ":" + subjectID
|
|
}
|
|
|
|
// AuthVersion 返回账号当前凭据版本;从未变更过则为 0。
|
|
func (s *SessionStore) AuthVersion(ctx context.Context, kind Kind, subjectID string) int64 {
|
|
if s.client == nil {
|
|
return 0
|
|
}
|
|
value, err := s.client.Get(ctx, authVersionKey(kind, subjectID)).Int64()
|
|
if err != nil {
|
|
return 0
|
|
}
|
|
return value
|
|
}
|
|
|
|
// BumpAuthVersion 使账号的全部既有会话失效(改密、2FA 启用/停用等凭据变更后调用)。
|
|
// Redis 不可用时静默失败:会话仍按 TTL 自然过期,凭据变更的即时失效降级为延迟生效。
|
|
func (s *SessionStore) BumpAuthVersion(ctx context.Context, kind Kind, subjectID string) {
|
|
if s.client == nil {
|
|
return
|
|
}
|
|
key := authVersionKey(kind, subjectID)
|
|
_ = s.client.Incr(ctx, key).Err()
|
|
_ = s.client.Expire(ctx, key, authVersionTTL).Err()
|
|
}
|
|
|
|
type SessionStore struct {
|
|
client *redis.Client
|
|
ttl time.Duration
|
|
}
|
|
|
|
func NewSessionStore(client *redis.Client, ttl time.Duration) *SessionStore {
|
|
return &SessionStore{client: client, ttl: ttl}
|
|
}
|
|
|
|
func (s *SessionStore) Create(ctx context.Context, principal Principal) (string, error) {
|
|
principal.Purpose = "session"
|
|
return s.create(ctx, principal, s.ttl)
|
|
}
|
|
|
|
// CreateWithMeta 签发会话并记录登录环境(IP/UA),供设备管理与登录提醒使用。
|
|
func (s *SessionStore) CreateWithMeta(ctx context.Context, principal Principal, ip, userAgent string) (string, error) {
|
|
principal.Purpose = "session"
|
|
principal.IP = truncate(strings.TrimSpace(ip), 64)
|
|
principal.UserAgent = truncate(strings.TrimSpace(userAgent), 256)
|
|
return s.create(ctx, principal, s.ttl)
|
|
}
|
|
|
|
func (s *SessionStore) CreatePending(ctx context.Context, principal Principal, ttl time.Duration) (string, error) {
|
|
principal.Purpose = "totp_pending"
|
|
return s.create(ctx, principal, ttl)
|
|
}
|
|
|
|
func (s *SessionStore) create(ctx context.Context, principal Principal, ttl time.Duration) (string, error) {
|
|
if s.client == nil {
|
|
return "", ErrUnavailable
|
|
}
|
|
random := make([]byte, 32)
|
|
if _, err := rand.Read(random); err != nil {
|
|
return "", err
|
|
}
|
|
token := base64.RawURLEncoding.EncodeToString(random)
|
|
principal.IssuedAt = time.Now().Unix()
|
|
principal.AuthVersion = s.AuthVersion(ctx, principal.Kind, principal.SubjectID)
|
|
payload, err := json.Marshal(principal)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if err := s.client.Set(ctx, sessionKey(token), payload, ttl).Err(); err != nil {
|
|
return "", fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
// 维护账号的会话索引(仅正式会话,不含 TOTP 挑战令牌),供
|
|
// "我的登录设备"列出与吊销。索引不做 TTL 管理,列出时惰性清理过期项。
|
|
if principal.Purpose == "session" {
|
|
_ = s.client.SAdd(ctx, sessionIndexKey(principal.Kind, principal.SubjectID), sessionHex(token)).Err()
|
|
}
|
|
return token, nil
|
|
}
|
|
|
|
func (s *SessionStore) Authenticate(ctx context.Context, authorization string, expected Kind) (Principal, error) {
|
|
if s.client == nil {
|
|
return Principal{}, ErrUnavailable
|
|
}
|
|
token, ok := bearerToken(authorization)
|
|
if !ok {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
payload, err := s.client.Get(ctx, sessionKey(token)).Bytes()
|
|
if errors.Is(err, redis.Nil) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
if err != nil {
|
|
return Principal{}, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
var principal Principal
|
|
if err := json.Unmarshal(payload, &principal); err != nil || principal.Kind != expected || principal.SubjectID == "" || principal.Purpose != "session" {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
// 凭据版本不匹配:改密/2FA 变更后旧会话一律失效。
|
|
if principal.AuthVersion != s.AuthVersion(ctx, principal.Kind, principal.SubjectID) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
return principal, nil
|
|
}
|
|
|
|
// AuthenticatePending 只读取(不消费)挑战令牌,供 CompleteTOTPLogin 在
|
|
// 验证前解析 principal;验证码输错时令牌保留可重试。
|
|
func (s *SessionStore) AuthenticatePending(ctx context.Context, token string, expected Kind) (Principal, error) {
|
|
if s.client == nil {
|
|
return Principal{}, ErrUnavailable
|
|
}
|
|
payload, err := s.client.Get(ctx, sessionKey(strings.TrimSpace(token))).Bytes()
|
|
if errors.Is(err, redis.Nil) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
if err != nil {
|
|
return Principal{}, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
var principal Principal
|
|
if err := json.Unmarshal(payload, &principal); err != nil || principal.Kind != expected || principal.SubjectID == "" || principal.Purpose != "totp_pending" {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
if principal.AuthVersion != s.AuthVersion(ctx, principal.Kind, principal.SubjectID) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
return principal, nil
|
|
}
|
|
|
|
// ConsumePending 原子消费挑战令牌(GetDel):验证通过后调用,并发请求用同一
|
|
// 令牌时只有一个能成功,防止一次 2FA 挑战铸出两个会话。
|
|
func (s *SessionStore) ConsumePending(ctx context.Context, token string, expected Kind) (Principal, error) {
|
|
if s.client == nil {
|
|
return Principal{}, ErrUnavailable
|
|
}
|
|
payload, err := s.client.GetDel(ctx, sessionKey(strings.TrimSpace(token))).Bytes()
|
|
if errors.Is(err, redis.Nil) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
if err != nil {
|
|
return Principal{}, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
var principal Principal
|
|
if err := json.Unmarshal(payload, &principal); err != nil || principal.Kind != expected || principal.SubjectID == "" || principal.Purpose != "totp_pending" {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
if principal.AuthVersion != s.AuthVersion(ctx, principal.Kind, principal.SubjectID) {
|
|
return Principal{}, ErrInvalidSession
|
|
}
|
|
return principal, nil
|
|
}
|
|
|
|
func (s *SessionStore) DeleteToken(ctx context.Context, token string) error {
|
|
if s.client == nil {
|
|
return ErrUnavailable
|
|
}
|
|
if err := s.client.Del(ctx, sessionKey(strings.TrimSpace(token))).Err(); err != nil {
|
|
return fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *SessionStore) Delete(ctx context.Context, authorization string) error {
|
|
if s.client == nil {
|
|
return ErrUnavailable
|
|
}
|
|
token, ok := bearerToken(authorization)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
if err := s.client.Del(ctx, sessionKey(token)).Err(); err != nil {
|
|
return fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// SessionView 是"我的登录设备"视图。
|
|
type SessionView struct {
|
|
ID string `json:"id"`
|
|
IP string `json:"ip"`
|
|
UserAgent string `json:"user_agent"`
|
|
IssuedAt int64 `json:"issued_at"`
|
|
Current bool `json:"current"`
|
|
}
|
|
|
|
// ListSessions 列出账号的全部有效会话并惰性清理已过期项。
|
|
// currentToken 为当前请求的会话,标记 current=true。
|
|
func (s *SessionStore) ListSessions(ctx context.Context, kind Kind, subjectID, currentAuthorization string) ([]SessionView, error) {
|
|
if s.client == nil {
|
|
return nil, ErrUnavailable
|
|
}
|
|
hexes, err := s.client.SMembers(ctx, sessionIndexKey(kind, subjectID)).Result()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
items := []SessionView{}
|
|
for _, hex := range hexes {
|
|
payload, err := s.client.Get(ctx, sessionKeyFromHex(hex)).Bytes()
|
|
if errors.Is(err, redis.Nil) {
|
|
_ = s.client.SRem(ctx, sessionIndexKey(kind, subjectID), hex).Err()
|
|
continue
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
var principal Principal
|
|
if json.Unmarshal(payload, &principal) != nil || principal.Kind != kind || principal.SubjectID != subjectID || principal.Purpose != "session" {
|
|
_ = s.client.SRem(ctx, sessionIndexKey(kind, subjectID), hex).Err()
|
|
continue
|
|
}
|
|
items = append(items, SessionView{ID: hex, IP: principal.IP, UserAgent: principal.UserAgent, IssuedAt: principal.IssuedAt,
|
|
Current: s.sessionHexMatches(currentAuthorization, hex)})
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
// ErrRevokeCurrentSession 表示试图吊销当前登录的会话。
|
|
var ErrRevokeCurrentSession = errors.New("不能吊销当前登录的会话")
|
|
|
|
// RevokeSession 吊销指定会话(hex ID);当前会话不得吊销。
|
|
func (s *SessionStore) RevokeSession(ctx context.Context, kind Kind, subjectID, sessionID, currentAuthorization string) error {
|
|
if s.client == nil {
|
|
return ErrUnavailable
|
|
}
|
|
sessionID = strings.TrimSpace(sessionID)
|
|
if len(sessionID) != 64 || !isHex(sessionID) {
|
|
return errors.New("会话标识无效")
|
|
}
|
|
if s.sessionHexMatches(currentAuthorization, sessionID) {
|
|
return ErrRevokeCurrentSession
|
|
}
|
|
removed, err := s.client.SRem(ctx, sessionIndexKey(kind, subjectID), sessionID).Result()
|
|
if err != nil {
|
|
return fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
if removed == 0 {
|
|
return ErrInvalidSession
|
|
}
|
|
if err := s.client.Del(ctx, sessionKeyFromHex(sessionID)).Err(); err != nil {
|
|
return fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *SessionStore) sessionHexMatches(authorization, hex string) bool {
|
|
token, ok := bearerToken(authorization)
|
|
if !ok {
|
|
return false
|
|
}
|
|
return sessionHex(token) == hex
|
|
}
|
|
|
|
func sessionIndexKey(kind Kind, subjectID string) string {
|
|
return "gateway:session-index:" + string(kind) + ":" + subjectID
|
|
}
|
|
|
|
func sessionHex(token string) string {
|
|
digest := sha256.Sum256([]byte(token))
|
|
return hex.EncodeToString(digest[:])
|
|
}
|
|
|
|
func sessionKeyFromHex(value string) string {
|
|
return "gateway:session:v1:" + value
|
|
}
|
|
|
|
func isHex(value string) bool {
|
|
if value == "" {
|
|
return false
|
|
}
|
|
for _, r := range value {
|
|
if !(r >= '0' && r <= '9' || r >= 'a' && r <= 'f') {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
func (s *SessionStore) StoreOneTime(ctx context.Context, namespace string, value any, ttl time.Duration) (string, error) {
|
|
if s.client == nil {
|
|
return "", ErrUnavailable
|
|
}
|
|
random := make([]byte, 32)
|
|
if _, err := rand.Read(random); err != nil {
|
|
return "", err
|
|
}
|
|
token := base64.RawURLEncoding.EncodeToString(random)
|
|
payload, err := json.Marshal(value)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if err := s.client.Set(ctx, oneTimeKey(namespace, token), payload, ttl).Err(); err != nil {
|
|
return "", fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
return token, nil
|
|
}
|
|
|
|
func (s *SessionStore) ConsumeOneTime(ctx context.Context, namespace, token string, target any) error {
|
|
if s.client == nil {
|
|
return ErrUnavailable
|
|
}
|
|
payload, err := s.client.GetDel(ctx, oneTimeKey(namespace, strings.TrimSpace(token))).Bytes()
|
|
if errors.Is(err, redis.Nil) {
|
|
return ErrInvalidSession
|
|
}
|
|
if err != nil {
|
|
return fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
if err := json.Unmarshal(payload, target); err != nil {
|
|
return ErrInvalidSession
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ClaimIdentifier atomically claims a caller-provided replay identifier for
|
|
// the TTL. It is used for signed protocol message IDs, not bearer secrets.
|
|
func (s *SessionStore) ClaimIdentifier(ctx context.Context, namespace, identifier string, ttl time.Duration) (bool, error) {
|
|
if s.client == nil {
|
|
return false, ErrUnavailable
|
|
}
|
|
identifier = strings.TrimSpace(identifier)
|
|
if identifier == "" || len(identifier) > 512 {
|
|
return false, ErrInvalidSession
|
|
}
|
|
claimed, err := s.client.SetNX(ctx, oneTimeKey(namespace, identifier), "1", ttl).Result()
|
|
if err != nil {
|
|
return false, fmt.Errorf("%w: %v", ErrUnavailable, err)
|
|
}
|
|
return claimed, nil
|
|
}
|
|
|
|
func bearerToken(authorization string) (string, bool) {
|
|
authorization = strings.TrimSpace(authorization)
|
|
if len(authorization) <= len("Bearer ") || !strings.EqualFold(authorization[:len("Bearer ")], "Bearer ") {
|
|
return "", false
|
|
}
|
|
token := strings.TrimSpace(authorization[len("Bearer "):])
|
|
return token, token != ""
|
|
}
|
|
|
|
func sessionKey(token string) string {
|
|
digest := sha256.Sum256([]byte(token))
|
|
return "gateway:session:v1:" + hex.EncodeToString(digest[:])
|
|
}
|
|
|
|
func oneTimeKey(namespace, token string) string {
|
|
digest := sha256.Sum256([]byte(token))
|
|
return "gateway:one-time:" + namespace + ":" + hex.EncodeToString(digest[:])
|
|
}
|