feat: add stable OIDC authentication

2026-07-12 05:14:23 +08:00
parent 1e82253f43
commit b9c0e1a7a5
13 changed files with 861 additions and 23 deletions
@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"strings"
 	"sync"
+	"time"

 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
@@ -36,6 +37,20 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 		runner: runner.New(cfg, db, logger),
 		logger: logger,
 	}
+	server.auth.LegacyJWTEnabled = !cfg.OIDCEnabled || cfg.OIDCAcceptLegacyHS256
+	server.auth.ServerMainInternalKey = cfg.ServerMainInternalKey
+	server.auth.ServerMainInternalSecret = cfg.ServerMainInternalSecret
+	if cfg.OIDCEnabled {
+		verifier, err := auth.NewOIDCVerifier(auth.OIDCConfig{
+			Issuer: cfg.OIDCIssuer, Audience: cfg.OIDCAudience, TenantID: cfg.OIDCTenantID,
+			RolePrefix: cfg.OIDCRolePrefix, RequiredScopes: cfg.OIDCRequiredScopes,
+			JWKSCacheTTL: time.Duration(cfg.OIDCJWKSCacheTTLSeconds) * time.Second,
+		})
+		if err != nil {
+			panic("invalid OIDC configuration: " + err.Error())
+		}
+		server.auth.OIDCVerifier = verifier
+	}
 	server.auth.LocalAPIKeyVerifier = db.VerifyLocalAPIKey
 	server.runner.StartAsyncQueueWorker(ctx)
 	server.startLocalTempAssetCleanup(ctx)