feat: add stable OIDC authentication

2026-07-12 05:14:23 +08:00
parent 1e82253f43
commit b9c0e1a7a5
13 changed files with 861 additions and 23 deletions
@@ -0,0 +1,50 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestServerMainAPIKeyUsesSignedCurrentContract(t *testing.T) {
+	const key = "gateway-test"
+	const secret = "server-main-internal-secret"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		if request.URL.Path != "/internal/auth/verify-apikey" || request.Header.Get("X-Internal-Key") != key {
+			t.Fatalf("unexpected request %s", request.URL.Path)
+		}
+		body, _ := io.ReadAll(request.Body)
+		hash := sha256.Sum256(body)
+		text := strings.Join([]string{
+			request.Method, request.URL.RequestURI(), request.Header.Get("X-Timestamp"), request.Header.Get("X-Nonce"),
+			hex.EncodeToString(hash[:]), key,
+		}, "\n")
+		mac := hmac.New(sha256.New, []byte(secret))
+		_, _ = mac.Write([]byte(text))
+		if !hmac.Equal([]byte(request.Header.Get("X-Signature")), []byte(hex.EncodeToString(mac.Sum(nil)))) {
+			t.Fatal("invalid internal request signature")
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"success": true, "data": map[string]any{"user": map[string]any{
+			"sub": "server-user", "username": "server", "role": []string{"user"}, "tenantId": "server-tenant",
+		}}})
+	}))
+	t.Cleanup(server.Close)
+	authenticator := New("jwt", server.URL, "")
+	authenticator.ServerMainInternalKey = key
+	authenticator.ServerMainInternalSecret = secret
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
+	request.Header.Set("Authorization", "Bearer sk-server-main")
+	user, err := authenticator.Authenticate(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user.ID != "server-user" || user.Source != "server-main" || user.TenantID != "server-tenant" {
+		t.Fatalf("user = %#v", user)
+	}
+}