wonder/xinfra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): support local username login mode

Browse Source
This commit is contained in:
mac
2026-07-16 16:19:25 +08:00
parent d5c7cab8bb
commit cafa8bc840
10 changed files with 304 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/config/config.go
+2
View File
@@ -19,6 +19,7 @@ type Config struct {
PublicBaseURL string
MySQLDSN string
AutoMigrate bool
SSOEnabled bool
JWTSecret string
JWTIssuer string
JWTTTLMinutes int
@@ -68,6 +69,7 @@ func Load() Config {
PublicBaseURL: publicBaseURL,
MySQLDSN: env("MYSQL_DSN", "auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local"),
AutoMigrate: envBool("AUTO_MIGRATE", true),
SSOEnabled: envBool("SSO_ENABLED", true),
JWTSecret: env("JWT_SECRET", "change-this-secret"),
JWTIssuer: env("JWT_ISSUER", "authserver"),
JWTTTLMinutes: envInt("JWT_TTL_MINUTES", 120),
server/internal/handler/auth.go
+78
View File
@@ -0,0 +1,78 @@
package handler
import (
"errors"
"net/http"
"strings"
"time"
"github.com/1024XEngineer/xinfra/server/internal/config"
"github.com/1024XEngineer/xinfra/server/internal/service"
"github.com/gin-gonic/gin"
)
type AuthHandler struct {
cfg config.Config
auth *service.AuthService
}
type localLoginRequest struct {
Username string `json:"username"`
}
func NewAuthHandler(cfg config.Config, authService *service.AuthService) *AuthHandler {
return &AuthHandler{cfg: cfg, auth: authService}
}
func (h *AuthHandler) Config(c *gin.Context) {
c.JSON(http.StatusOK, gin.H{
"sso_enabled": h.cfg.SSOEnabled,
})
}
func (h *AuthHandler) LocalLogin(c *gin.Context) {
if h.cfg.SSOEnabled {
c.JSON(http.StatusForbidden, gin.H{"error": "local login is disabled when sso is enabled"})
return
}
var req localLoginRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
result, err := h.auth.LocalLogin(strings.TrimSpace(req.Username), c.ClientIP(), c.Request.UserAgent())
if err != nil {
switch {
case errors.Is(err, service.ErrInvalidCredential):
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
case errors.Is(err, service.ErrUserDisabled):
c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
default:
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
}
return
}
http.SetCookie(c.Writer, &http.Cookie{
Name: AuthSessionCookieName,
Value: result.Token,
Path: "/auth/",
HttpOnly: true,
SameSite: http.SameSiteLaxMode,
MaxAge: int(time.Until(result.ExpiresAt).Seconds()),
})
c.JSON(http.StatusOK, gin.H{
"token": result.Token,
"expires_in": int(h.cfg.JWTTTL().Seconds()),
"user": gin.H{
"id": result.User.ID,
"username": result.User.Username,
"display_name": result.User.DisplayName,
"email": result.User.Email,
"business_line": "",
"is_admin": result.User.IsAdmin,
},
})
}
server/internal/router/router.go
+3
View File
@@ -72,6 +72,7 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
wayneRoleBindingService := service.NewWayneRoleBindingService(deps.Config)
healthHandler := handler.NewHealthHandler(deps.DB)
authHandler := handler.NewAuthHandler(deps.Config, authService)
userHandler := handler.NewUserHandler()
wayenHandler := handler.NewWayenHandler(deps.DB, wayenService, auditService)
wayneRoleBindingHandler := handler.NewWayneRoleBindingHandler(wayneRoleBindingService, auditService)
@@ -89,6 +90,8 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
v1 := r.Group("/auth/api/v1")
{
v1.GET("/config", authHandler.Config)
v1.POST("/login", authHandler.LocalLogin)
v1.GET("/login/internal-sso", samlHandler.Login)
v1.POST("/logout", samlHandler.Logout)
v1.GET("/saml/metadata", samlHandler.Metadata)
server/internal/service/auth.go
+84
View File
@@ -39,6 +39,55 @@ func NewAuthService(cfg config.Config, db *gorm.DB, audit *AuditService) *AuthSe
return &AuthService{cfg: cfg, db: db, audit: audit}
}
func (s *AuthService) LocalLogin(username, clientIP, userAgent string) (*LoginResult, error) {
username = strings.TrimSpace(username)
if username == "" {
return nil, ErrInvalidCredential
}
var result *LoginResult
err := s.db.Transaction(func(tx *gorm.DB) error {
user, err := findOrCreateLocalUser(tx, username)
if err != nil {
return err
}
if user.Status != "active" {
s.audit.Write(AuditEntry{ActorUserID: user.ID, ActorUsername: user.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.failed", Decision: "deny", Reason: "user_disabled"})
return ErrUserDisabled
}
token, tokenID, expiresAt, err := auth.Sign(s.cfg.JWTSecret, s.cfg.JWTIssuer, s.cfg.JWTTTL(), user.ID, user.Username, user.Email, user.IsAdmin)
if err != nil {
return err
}
now := time.Now()
if err := tx.Model(&model.User{}).Where("id = ?", user.ID).Update("last_login_at", now).Error; err != nil {
return err
}
if err := tx.Create(&model.AccessToken{
UserID: user.ID,
TokenID: tokenID,
TokenType: "access",
ClientIP: clientIP,
UserAgent: userAgent,
ExpiresAt: expiresAt,
}).Error; err != nil {
return err
}
user.LastLoginAt = &now
result = &LoginResult{Token: token, TokenID: tokenID, ExpiresAt: expiresAt, User: user}
return nil
})
if err != nil {
return nil, err
}
s.audit.Write(AuditEntry{ActorUserID: result.User.ID, ActorUsername: result.User.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.success", Decision: "allow"})
return result, nil
}
func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent string) (*LoginResult, error) {
subject := strings.TrimSpace(info.NameID)
email := firstSAMLAttribute(info.Attributes,
@@ -119,6 +168,41 @@ func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent str
return result, nil
}
func findOrCreateLocalUser(tx *gorm.DB, username string) (model.User, error) {
email := ""
if looksLikeEmail(username) {
email = username
}
var user model.User
query := tx.Where("username = ? AND deleted_at IS NULL", username)
if email != "" {
query = query.Or("email = ? AND deleted_at IS NULL", email)
}
if err := query.First(&user).Error; err == nil {
return user, nil
} else if !errors.Is(err, gorm.ErrRecordNotFound) {
return model.User{}, err
}
var count int64
if err := tx.Model(&model.User{}).Where("deleted_at IS NULL").Count(&count).Error; err != nil {
return model.User{}, err
}
user = model.User{
Username: username,
DisplayName: username,
Email: email,
Source: "local",
Status: "active",
IsAdmin: count == 0,
}
if err := tx.Create(&user).Error; err != nil {
return user, err
}
return user, nil
}
func findOrCreateSAMLUser(tx *gorm.DB, subject, email, displayName string) (model.User, error) {
username := samlUsername(email, subject)
if displayName == "" {