mac
281 lines
8.0 KiB
Go
281 lines
8.0 KiB
Go
package handler
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/1024XEngineer/xinfra/server/internal/config"
|
|
"github.com/1024XEngineer/xinfra/server/internal/service"
|
|
gmsm2 "github.com/tjfoc/gmsm/sm2"
|
|
gmx509 "github.com/tjfoc/gmsm/x509"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type CloudDMHandler struct {
|
|
cfg config.Config
|
|
audit *service.AuditService
|
|
}
|
|
|
|
func NewCloudDMHandler(cfg config.Config, audit *service.AuditService) *CloudDMHandler {
|
|
return &CloudDMHandler{cfg: cfg, audit: audit}
|
|
}
|
|
|
|
func (h *CloudDMHandler) Login(c *gin.Context) {
|
|
claims, ok := CurrentClaims(c)
|
|
if !ok {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
|
|
return
|
|
}
|
|
|
|
targetURL := strings.TrimSpace(h.cfg.CloudDMTargetURL)
|
|
if targetURL == "" {
|
|
h.writeAudit(c, claims.UserID, claims.Username, "deny", "clouddm target url is not configured")
|
|
c.JSON(http.StatusServiceUnavailable, gin.H{"error": "clouddm target url is not configured"})
|
|
return
|
|
}
|
|
|
|
if claims.IsAdmin {
|
|
targetURL, err := h.adminLogin(c, targetURL)
|
|
if err != nil {
|
|
h.writeAudit(c, claims.UserID, claims.Username, "deny", err.Error())
|
|
c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
h.writeAudit(c, claims.UserID, claims.Username, "allow", "platform admin uses clouddm admin account")
|
|
if strings.Contains(c.GetHeader("Accept"), "application/json") {
|
|
c.JSON(http.StatusOK, gin.H{"target_url": targetURL})
|
|
return
|
|
}
|
|
c.Redirect(http.StatusFound, targetURL)
|
|
return
|
|
}
|
|
|
|
jumpURL, err := h.loginJumpURL(targetURL)
|
|
if err != nil {
|
|
h.writeAudit(c, claims.UserID, claims.Username, "deny", err.Error())
|
|
c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
|
|
h.writeAudit(c, claims.UserID, claims.Username, "allow", "")
|
|
if strings.Contains(c.GetHeader("Accept"), "application/json") {
|
|
c.JSON(http.StatusOK, gin.H{"target_url": jumpURL})
|
|
return
|
|
}
|
|
c.Redirect(http.StatusFound, jumpURL)
|
|
}
|
|
|
|
func (h *CloudDMHandler) loginJumpURL(targetURL string) (string, error) {
|
|
requestURL := strings.TrimRight(targetURL, "/") + "/requestJumpUrl"
|
|
body, _ := json.Marshal(gin.H{"type": "OIDC"})
|
|
req, err := http.NewRequest(http.MethodPost, requestURL, bytes.NewReader(body))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Accept", "application/json")
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
raw, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
return "", fmt.Errorf("clouddm requestJumpUrl failed: status %d: %s", resp.StatusCode, strings.TrimSpace(string(raw)))
|
|
}
|
|
|
|
var result struct {
|
|
Success bool `json:"success"`
|
|
Data string `json:"data"`
|
|
Msg string `json:"msg"`
|
|
MsgContent string `json:"msgContent"`
|
|
}
|
|
if err := json.Unmarshal(raw, &result); err != nil {
|
|
return "", err
|
|
}
|
|
if !result.Success || strings.TrimSpace(result.Data) == "" {
|
|
reason := strings.TrimSpace(result.MsgContent)
|
|
if reason == "" {
|
|
reason = strings.TrimSpace(result.Msg)
|
|
}
|
|
if reason == "" {
|
|
reason = "empty clouddm jump url"
|
|
}
|
|
return "", fmt.Errorf("clouddm requestJumpUrl failed: %s", reason)
|
|
}
|
|
return result.Data, nil
|
|
}
|
|
|
|
func (h *CloudDMHandler) adminLogin(c *gin.Context, targetURL string) (string, error) {
|
|
username := strings.TrimSpace(h.cfg.CloudDMAdminUsername)
|
|
password := h.cfg.CloudDMAdminPassword
|
|
if username == "" || password == "" {
|
|
return "", fmt.Errorf("clouddm admin account is not configured")
|
|
}
|
|
|
|
publicKey, err := h.fetchPublicKey(targetURL)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
encryptedPassword, err := encryptCloudDMPassword(publicKey, password)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
loginURL := strings.TrimSpace(h.cfg.CloudDMLoginURL)
|
|
if loginURL == "" {
|
|
loginURL = strings.TrimRight(targetURL, "/") + "/login"
|
|
}
|
|
body, _ := json.Marshal(gin.H{
|
|
"accountType": "SUB_ACCOUNT",
|
|
"loginType": "PASSWORD",
|
|
"account": username,
|
|
"password": encryptedPassword,
|
|
})
|
|
req, err := http.NewRequest(http.MethodPost, loginURL, bytes.NewReader(body))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Accept", "application/json")
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
raw, _ := io.ReadAll(io.LimitReader(resp.Body, 8192))
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
return "", fmt.Errorf("clouddm admin login failed: status %d: %s", resp.StatusCode, strings.TrimSpace(string(raw)))
|
|
}
|
|
|
|
var result struct {
|
|
Success bool `json:"success"`
|
|
Data struct {
|
|
NeedMore bool `json:"needMore"`
|
|
NeedMfa bool `json:"needMfa"`
|
|
} `json:"data"`
|
|
Msg string `json:"msg"`
|
|
MsgContent string `json:"msgContent"`
|
|
}
|
|
if err := json.Unmarshal(raw, &result); err != nil {
|
|
return "", err
|
|
}
|
|
if !result.Success || result.Data.NeedMore || result.Data.NeedMfa {
|
|
reason := strings.TrimSpace(result.MsgContent)
|
|
if reason == "" {
|
|
reason = strings.TrimSpace(result.Msg)
|
|
}
|
|
if reason == "" {
|
|
reason = "admin login did not complete"
|
|
}
|
|
return "", fmt.Errorf("clouddm admin login failed: %s", reason)
|
|
}
|
|
|
|
for _, cookie := range resp.Header.Values("Set-Cookie") {
|
|
c.Writer.Header().Add("Set-Cookie", cookie)
|
|
}
|
|
return h.publicSQLURL(), nil
|
|
}
|
|
|
|
func (h *CloudDMHandler) fetchPublicKey(targetURL string) (string, error) {
|
|
requestURL := strings.TrimRight(targetURL, "/") + "/api/entry/dmGlobalSettings"
|
|
req, err := http.NewRequest(http.MethodPost, requestURL, bytes.NewReader([]byte("{}")))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Accept", "application/json")
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
raw, _ := io.ReadAll(io.LimitReader(resp.Body, 8192))
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
return "", fmt.Errorf("clouddm dmGlobalSettings failed: status %d: %s", resp.StatusCode, strings.TrimSpace(string(raw)))
|
|
}
|
|
|
|
var result struct {
|
|
Success bool `json:"success"`
|
|
Data struct {
|
|
PublicKey string `json:"publicKey"`
|
|
} `json:"data"`
|
|
Msg string `json:"msg"`
|
|
MsgContent string `json:"msgContent"`
|
|
}
|
|
if err := json.Unmarshal(raw, &result); err != nil {
|
|
return "", err
|
|
}
|
|
if !result.Success || strings.TrimSpace(result.Data.PublicKey) == "" {
|
|
reason := strings.TrimSpace(result.MsgContent)
|
|
if reason == "" {
|
|
reason = strings.TrimSpace(result.Msg)
|
|
}
|
|
if reason == "" {
|
|
reason = "empty public key"
|
|
}
|
|
return "", fmt.Errorf("clouddm dmGlobalSettings failed: %s", reason)
|
|
}
|
|
return result.Data.PublicKey, nil
|
|
}
|
|
|
|
func encryptCloudDMPassword(publicKey, password string) (string, error) {
|
|
pub, err := gmx509.ReadPublicKeyFromHex(strings.TrimSpace(publicKey))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
ciphertext, err := gmsm2.Encrypt(pub, []byte(password), rand.Reader, gmsm2.C1C3C2)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return hex.EncodeToString(ciphertext), nil
|
|
}
|
|
|
|
func (h *CloudDMHandler) publicSQLURL() string {
|
|
base := strings.TrimSpace(h.cfg.CloudDMPublicURL)
|
|
if base == "" {
|
|
if redirectURI, err := url.Parse(strings.TrimSpace(h.cfg.CloudDMRedirectURI)); err == nil && redirectURI.Scheme != "" && redirectURI.Host != "" {
|
|
base = redirectURI.Scheme + "://" + redirectURI.Host
|
|
}
|
|
}
|
|
if base == "" {
|
|
base = strings.TrimSpace(h.cfg.CloudDMTargetURL)
|
|
}
|
|
base = strings.TrimRight(base, "/")
|
|
if strings.Contains(base, "#") {
|
|
return base
|
|
}
|
|
return base + "/#/sql"
|
|
}
|
|
|
|
func (h *CloudDMHandler) writeAudit(c *gin.Context, userID uint64, username, decision, reason string) {
|
|
h.audit.Write(service.AuditEntry{
|
|
ActorUserID: userID,
|
|
ActorUsername: username,
|
|
ClientIP: c.ClientIP(),
|
|
UserAgent: c.Request.UserAgent(),
|
|
Action: "clouddm.login",
|
|
ResourceType: "clouddm",
|
|
Decision: decision,
|
|
Reason: reason,
|
|
})
|
|
}
|