鉴权并入 Auth Broker：委派设备会话统一模型 + 四端迁移
后端（委托 Auth Broker，路径 A）： - 删自建鉴权（OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts），cdrop 不再存任何凭证；鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头（dev 旁路保留）；Claims 加 Tier() / Guest() - internal/brokerclient：mint / revoke（带 X-Broker-App）/ refresh / ListSessions（R1 列举），直连内网、吊销幂等 统一会话模型“委派设备会话”（Delegated Device Sessions）： - 每个客户端（浏览器 / 桌面 / 扫码设备）＝一条带 meta(device_id) + label 的 broker 机器会话；Broker 作设备会话唯一注册表（R1 按用户＋app 列举 + R2 按 (user,app,meta) 幂等铸造），cdrop 退化为薄覆盖层、不再自存权威会话表 - 新增代铸端点 POST /api/auth/device-session：凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话（meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流）；R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备 - 会话列表＝R1 权威 + 叠加 type（本地缓存）/ online（Hub presence，按设备名）/ current（meta 匹配本请求 X-Auth-Meta）+ 过滤 meta=""（device-authorize 引导会话残留）；devices 表降级为 type/presence 薄缓存（非会话权威），device_id 主键、upsert 按 user 限定 - 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App；扫码登录保留三密钥编排，collect 改委托 broker 铸 + 落缓存行 Web 前端： - 登录走 broker 全局 SSO 代跳（/api/auth/login 302）；bootstrap 经 /api/me 注入身份后代铸设备会话（稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造）；refresh 走 /api/auth/refresh - 设备管理按 device_id；改名＝同 device_id 重代铸（R2 原地轮换换 label、不产生重复行）；登录页反应式守卫修登录回环 - 去 OIDC PKCE / step-up（删 oauth.callback / stepUp） 桌面客户端（Wails）： - loopback PKCE（RFC 8252）改指 broker 设备授权流（/device/authorize + /device/token）拿引导令牌，再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销；身份取自代铸响应（修“显示名显示为 UUID”）；refresh 保留显示名；稳定 device_id 入桌面配置 iOS 客户端（arch A，原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥）： - 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化（此前实现，随本次落入版本库） - 鉴权＝引擎自刷（boot 注入 refresh_token）+ broker 轮换经 sessionRotated 回报原生更新 Keychain；去 cookie 同步；Session 加 refreshToken / deviceId 实时 / 健壮性： - presence 走 Hub union（设备表行 ∪ 表外实时连接，按名去重、live-only 标在线） - Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内，消除 close-vs-send 闭通道 send panic（revoke 每次 Kick 后该路径变热） 配置 / 删旧栈： - config 改 broker 接入（CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL），prod 强校验 broker 配置 + PUBLIC_URL（CSRF Origin 守卫不失效） - 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表（web_sessions / accounts / shortcut_tokens）及验证链；.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型（人机分流 + 公开端点放行 + X-Auth-Meta 透传） - 测试全重写：QR / 会话含 mock broker（R1 列举 + R2 幂等）；hub 加 close-vs-send 并发回归；config 加 prod 必填校验
This commit is contained in:
+157
-169
@@ -1,11 +1,8 @@
|
||||
package httpapi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
|
||||
@@ -13,206 +10,197 @@ import (
|
||||
"commilitia.net/cdrop/internal/jwtauth"
|
||||
)
|
||||
|
||||
// Session management (AUTH.md §1, §6): list the caller's logins with their
|
||||
// capability level, and really revoke one (delete the row → its access token can
|
||||
// no longer refresh and dies within its short TTL). Revocation is a sensitive
|
||||
// action, so it requires a recent step-up. A standalone step-up endpoint lets the
|
||||
// UI establish that re-auth once (per session/device) and reuse it across actions
|
||||
// within the window — the same session isn't re-prompted repeatedly (#3).
|
||||
// Session management. After the unified-session-model rework, every logged-in client —
|
||||
// browser, desktop, QR-paired device — is one delegated device session in the broker. The
|
||||
// broker (R1: GET /internal/sessions) is the single authoritative device list; cdrop no
|
||||
// longer keeps a parallel authoritative session table. The local `devices` rows survive only
|
||||
// as a type/presence cache: they supply each device's type for the list overlay and back the
|
||||
// real-time presence view (which is cdrop's domain, keyed by device name). Listing reads R1
|
||||
// and overlays type/online/current; revoking calls the broker (the session's source of truth)
|
||||
// then drops the local cache row.
|
||||
|
||||
type stepUpReq struct {
|
||||
Code string `json:"code"`
|
||||
Verifier string `json:"verifier"`
|
||||
}
|
||||
|
||||
// handleStepUp exchanges a fresh prompt=login code and, on success, stamps the
|
||||
// caller's session as stepped-up (per-session, cookie-keyed). Sensitive actions
|
||||
// within StepUpMaxAgeSeconds then skip re-auth. 403 on failure; 204 when step-up
|
||||
// is disabled (nothing to establish).
|
||||
func (s *Server) handleStepUp(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.cfg.StepUpEnabled {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return
|
||||
}
|
||||
claims, _ := jwtauth.ClaimsFromContext(r.Context())
|
||||
var body stepUpReq
|
||||
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 8192)).Decode(&body); err != nil {
|
||||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid json"})
|
||||
return
|
||||
}
|
||||
if !s.verifyStepUp(r, claims.UserID, body.Code, body.Verifier) {
|
||||
writeJSON(w, http.StatusForbidden, map[string]string{"error": "step_up_required"})
|
||||
return
|
||||
}
|
||||
s.recordStepUp(r)
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
// requireFullSession rejects restricted guest sessions (scan-login borrow): they can
|
||||
// transfer files but not manage devices, approve other devices, or revoke sessions.
|
||||
// A full / dev session passes (AUTH Broker scope tier — Claims.Guest reads X-Auth-Scope).
|
||||
func requireFullSession(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
claims, ok := jwtauth.ClaimsFromContext(r.Context())
|
||||
if !ok {
|
||||
writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "no session"})
|
||||
return
|
||||
}
|
||||
if claims.Guest() {
|
||||
writeJSON(w, http.StatusForbidden, map[string]string{"error": "full session required"})
|
||||
return
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
type sessionView struct {
|
||||
ID string `json:"id"`
|
||||
ID string `json:"id"` // device_id (the revoke handle exposed to the client)
|
||||
DeviceID string `json:"device_id"`
|
||||
DeviceName string `json:"device_name"`
|
||||
Kind string `json:"kind"` // oidc | self | guest | macos | windows | linux | ios
|
||||
Kind string `json:"kind"` // device type: browser | macos | windows | linux | ios
|
||||
Scope string `json:"scope"` // full | guest
|
||||
Current bool `json:"current"`
|
||||
Online bool `json:"online"` // device currently connected (SSE) — UI sorts online first
|
||||
// Native marks a device that authenticates with an IdP token and keeps no
|
||||
// web_session row (desktop / iOS). It is surfaced from the devices registry so
|
||||
// the session list covers every device; its "logout" routes to the device
|
||||
// endpoint rather than the web-session one.
|
||||
Native bool `json:"native"`
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
LastUsedAt int64 `json:"last_used_at"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
Online bool `json:"online"`
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
LastUsedAt int64 `json:"last_used_at"`
|
||||
}
|
||||
|
||||
// isNativeDeviceType reports whether a device type is a real native client (one
|
||||
// that authenticates via the IdP and keeps no web_session). browser devices are
|
||||
// expected to carry a web_session; "shortcut" tokens have their own panel.
|
||||
func isNativeDeviceType(t string) bool {
|
||||
switch t {
|
||||
case "macos", "windows", "linux", "ios":
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// handleSessionsList returns the caller's login sessions with their scope, so the
|
||||
// UI can show the permission level (完整 / 受限访客) and offer real logout. The list
|
||||
// is unified: web_sessions (browser / scan-login) PLUS native client devices
|
||||
// (desktop / iOS) that have no web_session of their own — so every logged-in
|
||||
// device appears in one place and orphaned device rows fall away (AUTH.md §4).
|
||||
// handleSessionsList returns the caller's logged-in devices with their permission level
|
||||
// (完整 / 受限访客) and live online flag, so the UI can show each and offer logout. The
|
||||
// authoritative list is the broker's delegated device sessions (R1); cdrop overlays the
|
||||
// device type (local cache), the online dot (hub presence, keyed by device name), and the
|
||||
// "current" flag (the session whose meta is this request's X-Auth-Meta).
|
||||
func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
|
||||
claims, _ := jwtauth.ClaimsFromContext(r.Context())
|
||||
now := time.Now().Unix()
|
||||
|
||||
rows, err := s.queries.ListWebSessionsByUser(r.Context(), claims.UserID)
|
||||
sessions, err := s.broker.ListSessions(r.Context(), claims.UserID)
|
||||
if err != nil {
|
||||
slog.Error("list sessions failed", "err", err, "user", claims.UserID)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "db"})
|
||||
writeJSON(w, http.StatusBadGateway, map[string]string{"error": "broker"})
|
||||
return
|
||||
}
|
||||
current := ""
|
||||
if c, err := r.Cookie(sessionCookieName); err == nil && c.Value != "" {
|
||||
current = sessionID(c.Value)
|
||||
}
|
||||
// Cookieless callers (native apps) can't match by cookie; fall back to their
|
||||
// own device name to mark the "current" row.
|
||||
callerDevice, _ := jwtauth.DeviceNameFromContext(r.Context())
|
||||
|
||||
out := make([]sessionView, 0, len(rows))
|
||||
named := make(map[string]struct{}, len(rows))
|
||||
for _, row := range rows {
|
||||
if row.ExpiresAt < now {
|
||||
continue // hide expired sessions (reaped separately)
|
||||
// device_id -> cached type, for the type overlay (a missing cache falls back to
|
||||
// "browser"). The cache is bounded by the background device sweeper (last_seen TTL); a
|
||||
// logged-out device's row is reaped there, not on this read path — this GET stays
|
||||
// side-effect-free, and the session list itself is always R1-authoritative regardless of
|
||||
// any stale cache row (the row only ever supplies a type for a device that is in R1).
|
||||
typeByID := map[string]string{}
|
||||
if devs, err := s.queries.ListDevicesByUser(r.Context(), claims.UserID); err == nil {
|
||||
for _, d := range devs {
|
||||
typeByID[d.DeviceID] = d.Type
|
||||
}
|
||||
if row.DeviceName != "" {
|
||||
named[row.DeviceName] = struct{}{}
|
||||
}
|
||||
|
||||
out := make([]sessionView, 0, len(sessions))
|
||||
for _, sess := range sessions {
|
||||
// A meta-less session is a non-cdrop-managed machine session — a desktop
|
||||
// device-authorize bootstrap that the desktop replaces via 代铸 right away. It has
|
||||
// no device_id, so it isn't a managed device and must not show as a phantom row.
|
||||
if sess.Meta == "" {
|
||||
continue
|
||||
}
|
||||
typ := typeByID[sess.Meta]
|
||||
if typ == "" {
|
||||
typ = "browser"
|
||||
}
|
||||
scope := "full"
|
||||
if jwtauth.ScopeTier(sess.Scope) == "guest" {
|
||||
scope = "guest"
|
||||
}
|
||||
out = append(out, sessionView{
|
||||
ID: row.ID,
|
||||
DeviceName: row.DeviceName,
|
||||
Kind: row.Kind,
|
||||
Scope: row.Scope,
|
||||
Current: row.ID == current || (current == "" && row.DeviceName != "" && row.DeviceName == callerDevice),
|
||||
Online: row.DeviceName != "" && s.hub.Online(claims.UserID, row.DeviceName),
|
||||
CreatedAt: row.CreatedAt,
|
||||
LastUsedAt: row.LastUsedAt,
|
||||
ExpiresAt: row.ExpiresAt,
|
||||
ID: sess.Meta,
|
||||
DeviceID: sess.Meta,
|
||||
DeviceName: sess.Label,
|
||||
Kind: typ,
|
||||
Scope: scope,
|
||||
Current: sess.Meta == claims.DeviceID,
|
||||
Online: s.hub.Online(claims.UserID, sess.Label),
|
||||
CreatedAt: sess.CreatedAt,
|
||||
LastUsedAt: sess.LastUsedAt,
|
||||
})
|
||||
}
|
||||
|
||||
// Native clients keep no web_session — surface them from the devices registry,
|
||||
// skipping any whose name already has a web_session (no double-listing).
|
||||
if devs, derr := s.queries.ListDevicesByUser(r.Context(), claims.UserID); derr == nil {
|
||||
for _, d := range devs {
|
||||
if !isNativeDeviceType(d.Type) {
|
||||
continue
|
||||
}
|
||||
if _, ok := named[d.Name]; ok {
|
||||
continue
|
||||
}
|
||||
out = append(out, sessionView{
|
||||
ID: "device:" + d.Name,
|
||||
DeviceName: d.Name,
|
||||
Kind: d.Type,
|
||||
Scope: "full",
|
||||
Native: true,
|
||||
Current: current == "" && d.Name != "" && d.Name == callerDevice,
|
||||
Online: s.hub.Online(claims.UserID, d.Name),
|
||||
CreatedAt: d.LastSeen,
|
||||
LastUsedAt: d.LastSeen,
|
||||
ExpiresAt: 0,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
writeJSON(w, http.StatusOK, map[string]any{"sessions": out})
|
||||
}
|
||||
|
||||
// deviceNameHasLiveSession reports whether the user still has a non-expired
|
||||
// web_session bound to deviceName — used to avoid deleting a device that another
|
||||
// live session (e.g. a re-login that left the old row) still depends on.
|
||||
func (s *Server) deviceNameHasLiveSession(ctx context.Context, userID, deviceName string) bool {
|
||||
rows, err := s.queries.ListWebSessionsByUser(ctx, userID)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
now := time.Now().Unix()
|
||||
for _, ws := range rows {
|
||||
if ws.DeviceName == deviceName && ws.ExpiresAt >= now {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// handleSessionRevoke deletes a session row (scoped to its owner), really
|
||||
// invalidating that login. Requires a recent step-up (403 step_up_required
|
||||
// otherwise). Kicks the device's live SSE so it drops immediately.
|
||||
// handleSessionRevoke logs out a device by id (= device_id): it resolves the device's broker
|
||||
// session, revokes it, and drops the local cache row. Full session required (route-gated).
|
||||
func (s *Server) handleSessionRevoke(w http.ResponseWriter, r *http.Request) {
|
||||
if s.cfg.StepUpEnabled && !s.sessionRecentlySteppedUp(r) {
|
||||
writeJSON(w, http.StatusForbidden, map[string]string{"error": "step_up_required"})
|
||||
return
|
||||
}
|
||||
claims, _ := jwtauth.ClaimsFromContext(r.Context())
|
||||
id := chi.URLParam(r, "id")
|
||||
if id == "" {
|
||||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "missing id"})
|
||||
return
|
||||
}
|
||||
// Read the device name before deletion so we can kick its SSE.
|
||||
deviceName := ""
|
||||
if sess, err := s.queries.GetWebSession(r.Context(), id); err == nil && sess.UserID == claims.UserID {
|
||||
deviceName = sess.DeviceName
|
||||
}
|
||||
n, err := s.queries.DeleteWebSessionForUser(r.Context(), db.DeleteWebSessionForUserParams{
|
||||
ID: id,
|
||||
UserID: claims.UserID,
|
||||
})
|
||||
if err != nil {
|
||||
slog.Error("revoke session failed", "err", err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "db"})
|
||||
status, ok := s.revokeDevice(r, claims.UserID, id)
|
||||
if !ok {
|
||||
writeJSON(w, status, map[string]string{"error": revokeErrorMsg(status)})
|
||||
return
|
||||
}
|
||||
if n == 0 {
|
||||
writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
|
||||
return
|
||||
}
|
||||
if deviceName != "" {
|
||||
// Drop the device registration too, so a revoked device disappears from the
|
||||
// device list at once (we no longer remove devices by hand) — unless another
|
||||
// live session still uses this name.
|
||||
if !s.deviceNameHasLiveSession(r.Context(), claims.UserID, deviceName) {
|
||||
if _, derr := s.queries.DeleteDevice(r.Context(), db.DeleteDeviceParams{
|
||||
UserID: claims.UserID,
|
||||
Name: deviceName,
|
||||
}); derr != nil {
|
||||
slog.Warn("delete device on session revoke failed", "err", derr)
|
||||
}
|
||||
}
|
||||
s.hub.Kick(claims.UserID, deviceName)
|
||||
s.hub.PublishPresence(r.Context(), claims.UserID)
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
// revokeDevice tears down a device's broker session and local cache row, then kicks its live
|
||||
// SSE and re-broadcasts presence. Returns the HTTP status to report and whether it succeeded;
|
||||
// the caller writes the response. Shared by device deletion, session revocation, and logout
|
||||
// (they are the same operation). The broker session id is resolved cache-first (the local row
|
||||
// holds the stable broker_sid) and falls back to R1 — the authoritative list — so a missing or
|
||||
// pruned cache row still revokes correctly and stays authorized to this user.
|
||||
func (s *Server) revokeDevice(r *http.Request, userID, deviceID string) (int, bool) {
|
||||
sid, name := "", ""
|
||||
if dev, err := s.queries.GetDevice(r.Context(), deviceID); err == nil && dev.UserID == userID {
|
||||
sid = dev.BrokerSid
|
||||
name = dev.Name
|
||||
}
|
||||
if sid == "" {
|
||||
sessions, err := s.broker.ListSessions(r.Context(), userID)
|
||||
if err != nil {
|
||||
slog.Error("revoke: list sessions failed", "err", err, "user", userID)
|
||||
return http.StatusBadGateway, false
|
||||
}
|
||||
for _, sess := range sessions {
|
||||
if sess.Meta == deviceID {
|
||||
sid = sess.SID
|
||||
name = sess.Label
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
if sid == "" {
|
||||
// Not this user's device, or already gone from both the cache and the broker.
|
||||
return http.StatusNotFound, false
|
||||
}
|
||||
// Revoke the broker session first so the device can't refresh; a 404 (already gone) is
|
||||
// idempotent success inside RevokeSession.
|
||||
if err := s.broker.RevokeSession(r.Context(), sid); err != nil {
|
||||
slog.Error("broker revoke failed", "err", err, "user", userID, "sid", sid)
|
||||
return http.StatusBadGateway, false
|
||||
}
|
||||
if _, err := s.queries.DeleteDevice(r.Context(), db.DeleteDeviceParams{
|
||||
DeviceID: deviceID,
|
||||
UserID: userID,
|
||||
}); err != nil {
|
||||
// The session is already revoked; a failed cache delete is non-fatal (the sweeper
|
||||
// and the next list-prune clean it). Report success so the client sees the logout.
|
||||
slog.Warn("delete device cache failed", "err", err, "user", userID, "device", deviceID)
|
||||
}
|
||||
if name != "" {
|
||||
s.hub.Kick(userID, name)
|
||||
}
|
||||
s.hub.PublishPresence(r.Context(), userID)
|
||||
return http.StatusNoContent, true
|
||||
}
|
||||
|
||||
// handleLogout logs out the calling device by revoking its own broker session (so it can no
|
||||
// longer refresh) and dropping its cache row. The client also discards its tokens. A caller
|
||||
// with no managed device (no X-Auth-Meta) just succeeds — there is nothing server-side to
|
||||
// revoke. Origin-checked for CSRF.
|
||||
func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.sameOrigin(r) {
|
||||
writeJSON(w, http.StatusForbidden, map[string]string{"error": "bad origin"})
|
||||
return
|
||||
}
|
||||
claims, _ := jwtauth.ClaimsFromContext(r.Context())
|
||||
if claims.DeviceID != "" {
|
||||
if status, ok := s.revokeDevice(r, claims.UserID, claims.DeviceID); !ok && status != http.StatusNotFound {
|
||||
slog.Warn("logout revoke failed", "status", status, "user", claims.UserID)
|
||||
}
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func revokeErrorMsg(status int) string {
|
||||
switch status {
|
||||
case http.StatusNotFound:
|
||||
return "device not found"
|
||||
case http.StatusBadGateway:
|
||||
return "revoke failed"
|
||||
default:
|
||||
return "db"
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user