鉴权并入 Auth Broker：委派设备会话统一模型 + 四端迁移
后端（委托 Auth Broker，路径 A）： - 删自建鉴权（OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts），cdrop 不再存任何凭证；鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头（dev 旁路保留）；Claims 加 Tier() / Guest() - internal/brokerclient：mint / revoke（带 X-Broker-App）/ refresh / ListSessions（R1 列举），直连内网、吊销幂等 统一会话模型“委派设备会话”（Delegated Device Sessions）： - 每个客户端（浏览器 / 桌面 / 扫码设备）＝一条带 meta(device_id) + label 的 broker 机器会话；Broker 作设备会话唯一注册表（R1 按用户＋app 列举 + R2 按 (user,app,meta) 幂等铸造），cdrop 退化为薄覆盖层、不再自存权威会话表 - 新增代铸端点 POST /api/auth/device-session：凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话（meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流）；R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备 - 会话列表＝R1 权威 + 叠加 type（本地缓存）/ online（Hub presence，按设备名）/ current（meta 匹配本请求 X-Auth-Meta）+ 过滤 meta=""（device-authorize 引导会话残留）；devices 表降级为 type/presence 薄缓存（非会话权威），device_id 主键、upsert 按 user 限定 - 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App；扫码登录保留三密钥编排，collect 改委托 broker 铸 + 落缓存行 Web 前端： - 登录走 broker 全局 SSO 代跳（/api/auth/login 302）；bootstrap 经 /api/me 注入身份后代铸设备会话（稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造）；refresh 走 /api/auth/refresh - 设备管理按 device_id；改名＝同 device_id 重代铸（R2 原地轮换换 label、不产生重复行）；登录页反应式守卫修登录回环 - 去 OIDC PKCE / step-up（删 oauth.callback / stepUp） 桌面客户端（Wails）： - loopback PKCE（RFC 8252）改指 broker 设备授权流（/device/authorize + /device/token）拿引导令牌，再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销；身份取自代铸响应（修“显示名显示为 UUID”）；refresh 保留显示名；稳定 device_id 入桌面配置 iOS 客户端（arch A，原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥）： - 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化（此前实现，随本次落入版本库） - 鉴权＝引擎自刷（boot 注入 refresh_token）+ broker 轮换经 sessionRotated 回报原生更新 Keychain；去 cookie 同步；Session 加 refreshToken / deviceId 实时 / 健壮性： - presence 走 Hub union（设备表行 ∪ 表外实时连接，按名去重、live-only 标在线） - Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内，消除 close-vs-send 闭通道 send panic（revoke 每次 Kick 后该路径变热） 配置 / 删旧栈： - config 改 broker 接入（CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL），prod 强校验 broker 配置 + PUBLIC_URL（CSRF Origin 守卫不失效） - 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表（web_sessions / accounts / shortcut_tokens）及验证链；.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型（人机分流 + 公开端点放行 + X-Auth-Meta 透传） - 测试全重写：QR / 会话含 mock broker（R1 列举 + R2 幂等）；hub 加 close-vs-send 并发回归；config 加 prod 必填校验
This commit is contained in:
+69
-68
@@ -1,10 +1,12 @@
|
||||
// Package platform implements cdrop desktop's native capabilities — the Go
|
||||
// shell that the shared web UI drives over Wails bindings.
|
||||
//
|
||||
// This file owns the OAuth login flow: an RFC 8252 loopback redirect against
|
||||
// Casdoor with PKCE as a public client (no secret). The authorization code
|
||||
// exchange happens here in Go on purpose, so the PKCE verifier and the
|
||||
// resulting tokens never enter the WebView / JS context.
|
||||
// This file owns the login flow: the Auth Broker device-authorization flow (RFC
|
||||
// 8252 loopback redirect with PKCE, as a public client — no secret). The desktop
|
||||
// opens the system browser at the broker's consent page; on approval the broker
|
||||
// redirects to the loopback /callback with a one-time code, which Go exchanges
|
||||
// (with the PKCE verifier) for a broker machine token. The verifier and the
|
||||
// resulting tokens never enter the WebView / JS context — refresh is Go-driven.
|
||||
package platform
|
||||
|
||||
import (
|
||||
@@ -22,29 +24,25 @@ import (
|
||||
"time"
|
||||
)
|
||||
|
||||
// OAuthConfig carries the provider coordinates. For Casdoor the token endpoint
|
||||
// is /api/login/oauth/access_token (non-standard) and authorize is
|
||||
// /login/oauth/authorize; the desktop registers as its own public client.
|
||||
// OAuthConfig carries the Auth Broker coordinates. BrokerURL is the broker's PUBLIC
|
||||
// origin (e.g. https://sso.commilitia.net); App is this app's key in the broker apps
|
||||
// registry ("cdrop"). The app's loopback redirect must be registered in the broker's
|
||||
// apps.json (redirect_uris) for the device flow to accept it.
|
||||
type OAuthConfig struct {
|
||||
AuthorizeURL string
|
||||
TokenURL string
|
||||
ClientID string
|
||||
Scopes string // space-separated; empty defaults to "openid profile groups"
|
||||
BrokerURL string
|
||||
App string
|
||||
}
|
||||
|
||||
// TokenResult is the subset of the token response the shell keeps. IDToken is
|
||||
// captured so the identity can be decoded from the richer id_token claims (it's
|
||||
// present when the openid scope is granted — our default scopes include it).
|
||||
// TokenResult is the subset of the broker token response the shell keeps. ExpiresIn
|
||||
// is derived from the broker's access_expires (unix) at parse time.
|
||||
type TokenResult struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
IDToken string `json:"id_token"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
TokenType string `json:"token_type"`
|
||||
AccessToken string
|
||||
RefreshToken string
|
||||
ExpiresIn int
|
||||
}
|
||||
|
||||
// Flow runs one interactive login. openURL is injected so production uses
|
||||
// Wails' runtime.BrowserOpenURL while tests substitute a fake user-agent.
|
||||
// Flow runs one interactive login. openURL is injected so production uses Wails'
|
||||
// runtime.BrowserOpenURL while tests substitute a fake user-agent.
|
||||
type Flow struct {
|
||||
cfg OAuthConfig
|
||||
openURL func(string)
|
||||
@@ -63,15 +61,17 @@ func NewFlow(cfg OAuthConfig, openURL func(string)) *Flow {
|
||||
}
|
||||
}
|
||||
|
||||
// Login performs the loopback PKCE flow and returns the exchanged tokens.
|
||||
// Login performs the broker device-authorization loopback PKCE flow and returns the
|
||||
// minted machine token.
|
||||
//
|
||||
// Steps: generate verifier/challenge/state → bind an ephemeral 127.0.0.1
|
||||
// listener → open the system browser at the authorize URL → wait for the
|
||||
// browser to hit the loopback /callback with the code → validate state →
|
||||
// exchange code+verifier at the token endpoint. The verifier never leaves Go.
|
||||
// Steps: generate verifier/challenge/state → bind an ephemeral 127.0.0.1 listener →
|
||||
// open the system browser at the broker's /device/authorize (which sends the user
|
||||
// through broker SSO if needed, then shows a consent page) → wait for the browser to
|
||||
// hit the loopback /callback with the code → validate state → exchange code+verifier
|
||||
// at /device/token. The verifier never leaves Go.
|
||||
func (f *Flow) Login(ctx context.Context) (*TokenResult, error) {
|
||||
if f.cfg.AuthorizeURL == "" || f.cfg.TokenURL == "" || f.cfg.ClientID == "" {
|
||||
return nil, errors.New("oauth: incomplete config (authorize_url / token_url / client_id)")
|
||||
if f.cfg.BrokerURL == "" || f.cfg.App == "" {
|
||||
return nil, errors.New("oauth: incomplete config (broker_url / app)")
|
||||
}
|
||||
|
||||
verifier, challenge, err := newPKCE()
|
||||
@@ -132,14 +132,13 @@ func (f *Flow) Login(ctx context.Context) (*TokenResult, error) {
|
||||
go func() { _ = srv.Serve(ln) }()
|
||||
defer srv.Close()
|
||||
|
||||
authURL := f.cfg.AuthorizeURL + "?" + url.Values{
|
||||
"response_type": {"code"},
|
||||
"client_id": {f.cfg.ClientID},
|
||||
authURL := strings.TrimRight(f.cfg.BrokerURL, "/") + "/device/authorize?" + url.Values{
|
||||
"app": {f.cfg.App},
|
||||
"redirect_uri": {redirectURI},
|
||||
"scope": {f.scopes()},
|
||||
"state": {state},
|
||||
"code_challenge": {challenge},
|
||||
"code_challenge_method": {"S256"},
|
||||
"description": {"cdrop 桌面客户端"},
|
||||
}.Encode()
|
||||
f.openURL(authURL)
|
||||
|
||||
@@ -156,52 +155,50 @@ func (f *Flow) Login(ctx context.Context) (*TokenResult, error) {
|
||||
}
|
||||
}
|
||||
|
||||
func (f *Flow) scopes() string {
|
||||
if s := strings.TrimSpace(f.cfg.Scopes); s != "" {
|
||||
return s
|
||||
}
|
||||
return "openid profile groups"
|
||||
}
|
||||
|
||||
// exchange trades the authorization code + PKCE verifier for tokens. Casdoor
|
||||
// accepts form-encoded public-client requests (no client_secret). authorize and
|
||||
// token must carry the identical redirect_uri, so we pass the same value.
|
||||
// exchange trades the authorization code + PKCE verifier (+ the same redirect_uri)
|
||||
// for the broker machine token at /device/token.
|
||||
func (f *Flow) exchange(ctx context.Context, code, verifier, redirectURI string) (*TokenResult, error) {
|
||||
return f.postToken(ctx, url.Values{
|
||||
"grant_type": {"authorization_code"},
|
||||
"code": {code},
|
||||
"code_verifier": {verifier},
|
||||
"client_id": {f.cfg.ClientID},
|
||||
"redirect_uri": {redirectURI},
|
||||
return f.postJSON(ctx, strings.TrimRight(f.cfg.BrokerURL, "/")+"/device/token", map[string]string{
|
||||
"code": code,
|
||||
"code_verifier": verifier,
|
||||
"redirect_uri": redirectURI,
|
||||
})
|
||||
}
|
||||
|
||||
// Refresh exchanges a refresh_token for a fresh token (public client, no
|
||||
// secret). Call it when the access token nears expiry; the access token never
|
||||
// leaves Go, so refresh is driven from the shell, not the WebView.
|
||||
// Refresh exchanges a refresh credential for a fresh access token (+ rotated refresh)
|
||||
// at the broker's /refresh. Call it when the access token nears expiry; the refresh
|
||||
// credential never leaves Go, so refresh is driven from the shell, not the WebView.
|
||||
func (f *Flow) Refresh(ctx context.Context, refreshToken string) (*TokenResult, error) {
|
||||
if f.cfg.TokenURL == "" || f.cfg.ClientID == "" {
|
||||
return nil, errors.New("oauth: incomplete config (token_url / client_id)")
|
||||
if f.cfg.BrokerURL == "" {
|
||||
return nil, errors.New("oauth: incomplete config (broker_url)")
|
||||
}
|
||||
if refreshToken == "" {
|
||||
return nil, errors.New("oauth: empty refresh token")
|
||||
}
|
||||
return f.postToken(ctx, url.Values{
|
||||
"grant_type": {"refresh_token"},
|
||||
"refresh_token": {refreshToken},
|
||||
"client_id": {f.cfg.ClientID},
|
||||
"scope": {f.scopes()},
|
||||
return f.postJSON(ctx, strings.TrimRight(f.cfg.BrokerURL, "/")+"/refresh", map[string]string{
|
||||
"refresh": refreshToken,
|
||||
})
|
||||
}
|
||||
|
||||
// postToken POSTs a form-encoded request to the token endpoint and decodes the
|
||||
// response. Shared by the authorization-code exchange and refresh.
|
||||
func (f *Flow) postToken(ctx context.Context, form url.Values) (*TokenResult, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, f.cfg.TokenURL, strings.NewReader(form.Encode()))
|
||||
// brokerTokenResp is the broker's response shape for /device/token and /refresh.
|
||||
type brokerTokenResp struct {
|
||||
Access string `json:"access"`
|
||||
Refresh string `json:"refresh"`
|
||||
AccessExpires int64 `json:"access_expires"`
|
||||
}
|
||||
|
||||
// postJSON POSTs a JSON body to a broker token endpoint and decodes the response.
|
||||
// Shared by the device-token exchange and refresh.
|
||||
func (f *Flow) postJSON(ctx context.Context, endpoint string, body map[string]string) (*TokenResult, error) {
|
||||
buf, err := json.Marshal(body)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oauth: marshal token request: %w", err)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(string(buf)))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oauth: build token request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
resp, err := f.client.Do(req)
|
||||
@@ -212,14 +209,18 @@ func (f *Flow) postToken(ctx context.Context, form url.Values) (*TokenResult, er
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("oauth: token endpoint status %d", resp.StatusCode)
|
||||
}
|
||||
var tok TokenResult
|
||||
if err := json.NewDecoder(resp.Body).Decode(&tok); err != nil {
|
||||
var tr brokerTokenResp
|
||||
if err := json.NewDecoder(resp.Body).Decode(&tr); err != nil {
|
||||
return nil, fmt.Errorf("oauth: decode token: %w", err)
|
||||
}
|
||||
if tok.AccessToken == "" {
|
||||
return nil, errors.New("oauth: token response missing access_token")
|
||||
if tr.Access == "" {
|
||||
return nil, errors.New("oauth: token response missing access")
|
||||
}
|
||||
return &tok, nil
|
||||
expiresIn := int(tr.AccessExpires - time.Now().Unix())
|
||||
if expiresIn < 0 {
|
||||
expiresIn = 0
|
||||
}
|
||||
return &TokenResult{AccessToken: tr.Access, RefreshToken: tr.Refresh, ExpiresIn: expiresIn}, nil
|
||||
}
|
||||
|
||||
// --- PKCE (RFC 7636) ---
|
||||
|
||||
Reference in New Issue
Block a user