zhenyi
dbbfb747a4
- Replace InternalAuthService with TokenService using JWT tokens - Add support for token issuance, refresh, verification and revocation - Implement automatic signing key rotation with Redis storage - Add database migration checks for indexes and foreign key constraints - Update gRPC endpoints to use token-based authentication - Remove deprecated API key based authentication system - Add JSON Web Token support with HMAC-SHA256 signing - Implement refresh token handling with automatic rotation - Add token revocation by JTI and user ID - Update build configuration to include core proto files - Migrate database schema to handle token-based authentication - Add comprehensive token validation and verification logic
66 lines
1.8 KiB
Rust
66 lines
1.8 KiB
Rust
use actix_web::{HttpResponse, web};
|
|
use serde::{Deserialize, Serialize};
|
|
use std::collections::HashMap;
|
|
|
|
use crate::api::response::ApiResponse;
|
|
use crate::error::AppError;
|
|
use crate::service::AppService;
|
|
use crate::session::Session;
|
|
|
|
#[derive(Debug, Deserialize, utoipa::ToSchema)]
|
|
pub struct IssueTokenRequest {
|
|
pub user_id: String,
|
|
pub scopes: Vec<String>,
|
|
pub ttl_hours: Option<i64>,
|
|
#[serde(default)]
|
|
pub extra: HashMap<String, String>,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, utoipa::ToSchema)]
|
|
pub struct IssueTokenResponse {
|
|
pub access_token: String,
|
|
pub refresh_token: String,
|
|
pub expires_at: i64,
|
|
pub key_id: String,
|
|
}
|
|
|
|
#[utoipa::path(
|
|
post,
|
|
path = "/api/v1/internal/tokens",
|
|
tag = "Internal",
|
|
operation_id = "internalIssueToken",
|
|
request_body = IssueTokenRequest,
|
|
responses(
|
|
(status = 200, description = "JWT token issued", body = ApiResponse<IssueTokenResponse>),
|
|
(status = 401, description = "Authentication required"),
|
|
(status = 403, description = "Admin permission required"),
|
|
),
|
|
security(("session_cookie" = []))
|
|
)]
|
|
pub async fn issue_token(
|
|
session: Session,
|
|
service: web::Data<AppService>,
|
|
body: web::Json<IssueTokenRequest>,
|
|
) -> Result<HttpResponse, AppError> {
|
|
let _user_uid = session.user().ok_or(AppError::Unauthorized)?;
|
|
|
|
let ttl_secs = body.ttl_hours.unwrap_or(1) * 3600;
|
|
|
|
let tokens = service
|
|
.internal_auth
|
|
.issue_token(
|
|
&body.user_id,
|
|
ttl_secs,
|
|
body.scopes.clone(),
|
|
body.extra.clone(),
|
|
)
|
|
.await?;
|
|
|
|
Ok(HttpResponse::Ok().json(ApiResponse::new(IssueTokenResponse {
|
|
access_token: tokens.access_token,
|
|
refresh_token: tokens.refresh_token,
|
|
expires_at: tokens.expires_at,
|
|
key_id: tokens.key_id,
|
|
})))
|
|
}
|