402 lines
18 KiB
Swift
402 lines
18 KiB
Swift
import AuthenticationServices
|
||
import Foundation
|
||
import Observation
|
||
#if canImport(UIKit)
|
||
import UIKit
|
||
#endif
|
||
|
||
// 扫码登录（新设备侧）+ 会话持有。iOS 显示二维码，已登录的 web / 桌面设备用“扫码登录”
|
||
// 扫码批准，本端轮询 /api/auth/qr/status 拿到自签会话。字段 / 流程见后端 internal/httpapi/
|
||
// qr.go。登录是纯 REST（不经引擎 WebView），故 engine.html 未部署也能登录。
|
||
//
|
||
// 续期（Auth Broker 路径 A）：access_token 默认 900s；引擎（WebView）持注入的 refresh_token，
|
||
// 到期经 POST /api/auth/refresh {refresh_token} 自刷（cdrop 代理 broker，见 refresh.go），broker
|
||
// 轮换 refresh 后经桥 sessionRotated 回报本端更新 Keychain；refresh 过期 / 吊销则经 authExpired
|
||
// 回登录页重扫。本端不再依赖 cdrop_session cookie。
|
||
@MainActor
|
||
@Observable
|
||
final class AuthManager
|
||
{
|
||
struct User: Codable
|
||
{
|
||
let id: String
|
||
let name: String
|
||
let avatar: String?
|
||
}
|
||
|
||
struct Session: Codable
|
||
{
|
||
let accessToken: String
|
||
// refreshToken：broker 委托会话的续期凭证，随 access 一并注入引擎自刷用；轮换后更新。
|
||
let refreshToken: String
|
||
let user: User
|
||
let deviceName: String
|
||
// deviceId：cdrop 生成的稳定不透明设备 id（= broker meta，回显 X-Auth-Meta）。
|
||
let deviceId: String
|
||
let scope: String
|
||
}
|
||
|
||
var session: Session?
|
||
var qrPayload: String?
|
||
// 空初值：登录页以 broker 账号登录为主，无操作时不显状态文案；各登录流程开始时自行设置。
|
||
var statusText: String = ""
|
||
// 二维码已失效（denied/expired/失败）→ 登录页据此提示并高亮「刷新二维码」。
|
||
var qrExpired = false
|
||
|
||
// 登录代次：每次 startQRLogin / startBrokerLogin 自增，旧流程据此识别自己已被取代、丢弃
|
||
// 结果，避免两条登录流程并发改 statusText / session 打架。
|
||
private var loginGeneration = 0
|
||
|
||
// Broker 登录期间强持 ASWebAuthenticationSession 封装（其 presentationContextProvider 为 weak、
|
||
// session 自身亦须保活至回调），完成 / 失败后置空。
|
||
private var brokerFlow: BrokerAuthFlow?
|
||
|
||
// Keychain 持久化坐标（单 app 私有，见 Keychain.swift）。
|
||
private static let keychainService = "net.commilitia.cdrop.session"
|
||
private static let keychainAccount = "session"
|
||
|
||
// 启动即尝试恢复持久会话：命中则 app 直接进主界面，免反复扫码（迭代 / 重装友好）。
|
||
// 恢复的令牌可能已过期（guest 1h 上限）——此时引擎鉴权 401，用户经设置页登出重扫即可。
|
||
init()
|
||
{
|
||
if let data = Keychain.load(service: Self.keychainService, account: Self.keychainAccount),
|
||
let restored = try? JSONDecoder().decode(Session.self, from: data)
|
||
{
|
||
// 仅恢复完整权限会话；陈旧 guest（旧版本落地的）丢弃、强制重登为 full。
|
||
if restored.scope == "full" { session = restored }
|
||
else { Keychain.delete(service: Self.keychainService, account: Self.keychainAccount) }
|
||
}
|
||
}
|
||
|
||
// 后端基址：默认线上，可经 CDROP_API_BASE 覆盖（本机测试）。
|
||
private var apiBase: String
|
||
{
|
||
ProcessInfo.processInfo.environment["CDROP_API_BASE"] ?? "https://drop.commilitia.net"
|
||
}
|
||
|
||
private struct QRStart: Decodable
|
||
{
|
||
let request_id: String
|
||
let poll_secret: String
|
||
let qr_payload: String
|
||
let expires_at: Int64
|
||
}
|
||
|
||
private struct QRStatus: Decodable
|
||
{
|
||
let status: String
|
||
let access_token: String?
|
||
let refresh_token: String?
|
||
let device_id: String?
|
||
let expires_in: Int?
|
||
let user: User?
|
||
let device_name: String?
|
||
}
|
||
|
||
// startQRLogin：发起二维码 + 轮询直到批准 / 失效。可重复调用（刷新二维码）：自增代次，
|
||
// 旧轮询识别到代次变更即弃。
|
||
func startQRLogin() async
|
||
{
|
||
loginGeneration += 1
|
||
let gen = loginGeneration
|
||
qrExpired = false
|
||
qrPayload = nil
|
||
statusText = t("ios.login.generating")
|
||
do
|
||
{
|
||
let start = try await qrStart()
|
||
if gen != loginGeneration { return }
|
||
qrPayload = start.qr_payload
|
||
statusText = t("ios.login.waiting")
|
||
try await poll(requestID: start.request_id, pollSecret: start.poll_secret, gen: gen)
|
||
}
|
||
catch
|
||
{
|
||
if gen != loginGeneration { return }
|
||
statusText = t("ios.login.failed")
|
||
qrExpired = true
|
||
}
|
||
}
|
||
|
||
// 应用内 Broker 登录（device-authorization + PKCE，见 BrokerLogin.swift）：手机直接输账号登录，
|
||
// 无需另一台设备扫码。流程＝拉 broker 配置 → ASWebAuthenticationSession 授权拿 code → 换 bootstrap
|
||
// 令牌 → 代铸成 cdrop 设备会话（带真名 / 稳定 device_id）→ 落 full 会话 + Keychain。
|
||
func startBrokerLogin() async
|
||
{
|
||
loginGeneration += 1
|
||
let gen = loginGeneration
|
||
qrExpired = false
|
||
statusText = t("ios.login.brokerStarting")
|
||
do
|
||
{
|
||
let cfg = try await fetchAuthConfig()
|
||
guard !cfg.brokerURL.isEmpty, !cfg.brokerApp.isEmpty else { throw BrokerLoginError.incompleteConfig }
|
||
|
||
let verifier = PKCE.randomToken(64)
|
||
let challenge = PKCE.challenge(for: verifier)
|
||
let state = PKCE.randomToken(24)
|
||
let redirectURI = "commilitia-drop://auth-callback"
|
||
|
||
var comp = URLComponents(string: cfg.brokerURL.trimmingTrailingSlash() + "/device/authorize")!
|
||
comp.queryItems = [
|
||
URLQueryItem(name: "app", value: cfg.brokerApp),
|
||
URLQueryItem(name: "redirect_uri", value: redirectURI),
|
||
URLQueryItem(name: "state", value: state),
|
||
URLQueryItem(name: "code_challenge", value: challenge),
|
||
URLQueryItem(name: "code_challenge_method", value: "S256"),
|
||
URLQueryItem(name: "description", value: "Commilitia Drop"),
|
||
]
|
||
guard let authURL = comp.url else { throw BrokerLoginError.incompleteConfig }
|
||
|
||
let flow = BrokerAuthFlow()
|
||
brokerFlow = flow
|
||
let callback = try await flow.run(url: authURL, callbackScheme: "commilitia-drop")
|
||
brokerFlow = nil
|
||
if gen != loginGeneration { return }
|
||
|
||
let items = URLComponents(url: callback, resolvingAgainstBaseURL: false)?.queryItems ?? []
|
||
guard items.first(where: { $0.name == "state" })?.value == state
|
||
else { throw BrokerLoginError.stateMismatch }
|
||
guard let code = items.first(where: { $0.name == "code" })?.value, !code.isEmpty
|
||
else { throw BrokerLoginError.missingCode }
|
||
|
||
let bootstrap = try await exchangeDeviceToken(
|
||
brokerURL: cfg.brokerURL, code: code, verifier: verifier, redirectURI: redirectURI)
|
||
let ds = try await mintDeviceSession(bootstrap: bootstrap)
|
||
if gen != loginGeneration { return }
|
||
|
||
DeviceIDStore.value = ds.device_id
|
||
let realName = (ds.name?.isEmpty == false) ? ds.name! : ds.user_id
|
||
session = Session(accessToken: ds.access_token,
|
||
refreshToken: ds.refresh_token,
|
||
user: User(id: ds.user_id, name: realName, avatar: ds.avatar),
|
||
deviceName: ds.device_name ?? DeviceNameStore.value,
|
||
deviceId: ds.device_id,
|
||
scope: "full")
|
||
persist()
|
||
}
|
||
catch
|
||
{
|
||
brokerFlow = nil
|
||
if gen != loginGeneration { return }
|
||
// 用户主动取消（关闭授权页）不算失败：静默回到登录页等待再次操作。
|
||
if let asErr = error as? ASWebAuthenticationSessionError, asErr.code == .canceledLogin
|
||
{
|
||
statusText = t("ios.login.waiting")
|
||
return
|
||
}
|
||
statusText = t("ios.login.failed")
|
||
}
|
||
}
|
||
|
||
func logout()
|
||
{
|
||
session = nil
|
||
qrPayload = nil
|
||
statusText = ""
|
||
Keychain.delete(service: Self.keychainService, account: Self.keychainAccount)
|
||
}
|
||
|
||
// 静态清除持久会话：被其他设备登出的后台推送到达时（AppDelegate）无 live AuthManager 实例可调
|
||
// logout()，故提供静态版只清 Keychain——下次启动 init 读不到会话即为登出态。前台另经
|
||
// .cdropSessionRevoked 通知走实例 logout() 即时回登录页。
|
||
static func clearPersistedSession()
|
||
{
|
||
Keychain.delete(service: keychainService, account: keychainAccount)
|
||
}
|
||
|
||
// ---- Broker 登录辅助：配置拉取 / 令牌交换 / 代铸 ----
|
||
|
||
private struct AuthConfig { let brokerURL: String; let brokerApp: String }
|
||
|
||
private struct DeviceTokenResp: Decodable
|
||
{
|
||
let access: String
|
||
let refresh: String
|
||
let access_expires: Int64
|
||
}
|
||
|
||
// 代铸响应：access/refresh + 稳定 device_id + 经边缘核验的真实身份（user_id/name/avatar）。
|
||
private struct DeviceSessionResp: Decodable
|
||
{
|
||
let access_token: String
|
||
let refresh_token: String
|
||
let device_id: String
|
||
let device_name: String?
|
||
let user_id: String
|
||
let name: String?
|
||
let avatar: String?
|
||
}
|
||
|
||
private func fetchAuthConfig() async throws -> AuthConfig
|
||
{
|
||
let (data, _) = try await URLSession.shared.data(from: URL(string: "\(apiBase)/api/auth/config")!)
|
||
let obj = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any] ?? [:]
|
||
return AuthConfig(brokerURL: obj["broker_url"] as? String ?? "",
|
||
brokerApp: obj["broker_app"] as? String ?? "")
|
||
}
|
||
|
||
private func exchangeDeviceToken(
|
||
brokerURL: String, code: String, verifier: String, redirectURI: String) async throws -> String
|
||
{
|
||
var req = URLRequest(url: URL(string: brokerURL.trimmingTrailingSlash() + "/device/token")!)
|
||
req.httpMethod = "POST"
|
||
req.setValue("application/json", forHTTPHeaderField: "Content-Type")
|
||
req.setValue("application/json", forHTTPHeaderField: "Accept")
|
||
req.httpBody = try JSONSerialization.data(withJSONObject: [
|
||
"code": code, "code_verifier": verifier, "redirect_uri": redirectURI,
|
||
])
|
||
let (data, resp) = try await URLSession.shared.data(for: req)
|
||
let status = (resp as? HTTPURLResponse)?.statusCode ?? 0
|
||
guard status == 200 else { throw BrokerLoginError.tokenFailed(status) }
|
||
let tr = try JSONDecoder().decode(DeviceTokenResp.self, from: data)
|
||
guard !tr.access.isEmpty else { throw BrokerLoginError.badResponse }
|
||
return tr.access
|
||
}
|
||
|
||
private func mintDeviceSession(bootstrap: String) async throws -> DeviceSessionResp
|
||
{
|
||
var req = URLRequest(url: URL(string: "\(apiBase)/api/auth/device-session")!)
|
||
req.httpMethod = "POST"
|
||
req.setValue("Bearer \(bootstrap)", forHTTPHeaderField: "Authorization")
|
||
req.setValue("application/json", forHTTPHeaderField: "Content-Type")
|
||
req.setValue("ios", forHTTPHeaderField: "X-Device-Type")
|
||
req.httpBody = try JSONSerialization.data(withJSONObject: [
|
||
"device_id": DeviceIDStore.value,
|
||
"device_name": DeviceNameStore.value,
|
||
"device_type": "ios",
|
||
])
|
||
let (data, resp) = try await URLSession.shared.data(for: req)
|
||
let status = (resp as? HTTPURLResponse)?.statusCode ?? 0
|
||
guard status == 200 else { throw BrokerLoginError.deviceSessionFailed(status) }
|
||
return try JSONDecoder().decode(DeviceSessionResp.self, from: data)
|
||
}
|
||
|
||
// 持久化当前会话到 Keychain（扫码批准后调用）。
|
||
private func persist()
|
||
{
|
||
guard let session, let data = try? JSONEncoder().encode(session) else { return }
|
||
Keychain.save(data, service: Self.keychainService, account: Self.keychainAccount)
|
||
}
|
||
|
||
// updateSession：引擎自刷致 broker 轮换后，经桥 sessionRotated 回报的新令牌对 → 更新
|
||
// 内存会话 + Keychain，使重启后不再用已失效的旧 refresh。仅换令牌，身份 / 设备名不变。
|
||
func updateSession(accessToken: String, refreshToken: String)
|
||
{
|
||
guard let cur = session else { return }
|
||
session = Session(accessToken: accessToken, refreshToken: refreshToken,
|
||
user: cur.user, deviceName: cur.deviceName,
|
||
deviceId: cur.deviceId, scope: cur.scope)
|
||
persist()
|
||
}
|
||
|
||
// updateIdentity：引擎据 /api/me 取到真实显示名（QR 登录注入的是 subject UUID 名）→ 经桥
|
||
// identityUpdated 回报，更新会话身份 + Keychain，使设置页显示真名而非 UUID（#12）。仅换
|
||
// 显示身份，令牌 / 设备名不变。
|
||
func updateIdentity(name: String, avatar: String?)
|
||
{
|
||
guard let cur = session else { return }
|
||
let av = (avatar?.isEmpty == false) ? avatar : cur.user.avatar
|
||
session = Session(accessToken: cur.accessToken, refreshToken: cur.refreshToken,
|
||
user: User(id: cur.user.id, name: name, avatar: av),
|
||
deviceName: cur.deviceName, deviceId: cur.deviceId, scope: cur.scope)
|
||
persist()
|
||
}
|
||
|
||
// updateDeviceName：本机即时改名成功（PATCH /api/devices/{device_id}）后经桥 renamed 回报，
|
||
// 更新会话里的设备名 + Keychain，使重启后 boot 注入新名。令牌 / 身份不变——设备名与令牌解耦。
|
||
func updateDeviceName(_ name: String)
|
||
{
|
||
guard let cur = session else { return }
|
||
session = Session(accessToken: cur.accessToken, refreshToken: cur.refreshToken,
|
||
user: cur.user, deviceName: name,
|
||
deviceId: cur.deviceId, scope: cur.scope)
|
||
persist()
|
||
}
|
||
|
||
// 仅供本机模拟器联调（CDROP_DEBUG_SESSION=1）：注入占位会话跳过扫码，用于验证引擎从
|
||
// prod 加载 + 桥往返。令牌无效、鉴权会 401，但能证 engine.html 在 WKWebView 里加载运行。
|
||
func debugSession()
|
||
{
|
||
session = Session(accessToken: "debug", refreshToken: "",
|
||
user: User(id: "debug", name: "Simulator", avatar: nil),
|
||
deviceName: "Simulator", deviceId: "", scope: "guest")
|
||
}
|
||
|
||
private func qrStart() async throws -> QRStart
|
||
{
|
||
var req = URLRequest(url: URL(string: "\(apiBase)/api/auth/qr/start")!)
|
||
req.httpMethod = "POST"
|
||
req.setValue("application/json", forHTTPHeaderField: "Content-Type")
|
||
req.setValue("ios", forHTTPHeaderField: "X-Device-Type")
|
||
req.httpBody = try JSONSerialization.data(
|
||
withJSONObject: [ "device_name": deviceName(), "device_type": "ios" ])
|
||
let (data, _) = try await URLSession.shared.data(for: req)
|
||
return try JSONDecoder().decode(QRStart.self, from: data)
|
||
}
|
||
|
||
private func poll(requestID: String, pollSecret: String, gen: Int) async throws
|
||
{
|
||
while session == nil && gen == loginGeneration
|
||
{
|
||
var comp = URLComponents(string: "\(apiBase)/api/auth/qr/status")!
|
||
comp.queryItems = [ URLQueryItem(name: "request_id", value: requestID) ]
|
||
var req = URLRequest(url: comp.url!)
|
||
req.setValue(pollSecret, forHTTPHeaderField: "X-Poll-Secret")
|
||
let (data, _) = try await URLSession.shared.data(for: req)
|
||
if gen != loginGeneration { return } // 已被刷新取代，丢弃本轮结果
|
||
let st = try JSONDecoder().decode(QRStatus.self, from: data)
|
||
switch st.status
|
||
{
|
||
case "approved":
|
||
if let token = st.access_token, let user = st.user
|
||
{
|
||
// 原生 App 仅允许完整权限（用户原则：iOS/桌面只接受 full，受限访客是 Web/PWA
|
||
// 的权宜）。批准方若按「仅此次」授予 guest，这里据 /api/me 的真实 scope 拒绝、
|
||
// 提示改选「信任此设备」，并让二维码可刷新重扫——不落地 guest 会话。
|
||
let scope = await fetchScope(token: token)
|
||
if gen != loginGeneration { return }
|
||
if scope != "full"
|
||
{
|
||
statusText = t("ios.login.needFull")
|
||
qrExpired = true
|
||
return
|
||
}
|
||
session = Session(accessToken: token,
|
||
refreshToken: st.refresh_token ?? "",
|
||
user: user,
|
||
deviceName: st.device_name ?? deviceName(),
|
||
deviceId: st.device_id ?? "",
|
||
scope: "full")
|
||
persist()
|
||
}
|
||
return
|
||
case "denied", "expired":
|
||
statusText = t("ios.login.expired")
|
||
qrExpired = true
|
||
return
|
||
default:
|
||
continue // pending → 立即下一轮（服务端长轮询最多挂 25s）
|
||
}
|
||
}
|
||
}
|
||
|
||
// 据刚发的 access token 拉 /api/me 取真实会话级别（full / guest）。失败回空串（按非 full
|
||
// 处理，保守拒绝）。
|
||
private func fetchScope(token: String) async -> String
|
||
{
|
||
var req = URLRequest(url: URL(string: "\(apiBase)/api/me")!)
|
||
req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
|
||
guard let (data, _) = try? await URLSession.shared.data(for: req),
|
||
let obj = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
|
||
let scope = obj["scope"] as? String
|
||
else { return "" }
|
||
return scope
|
||
}
|
||
|
||
private func deviceName() -> String
|
||
{
|
||
return DeviceNameStore.value
|
||
}
|
||
}
|