Kong网关(二):开启OAuth2 Plugin插件

const PROVISION_KEY="2ef290c575cc46eec61947aa9f1e67d3"
const KONG_ADMIN="http://127.0.0.1:8001"
const KONG_API="https://127.0.0.1:8443"
const API_PATH="/mock"
const SERVICE_HOST="mockbin.org"
const SCOPES=`{
    "email": "获取用户email权限",
    "address": "获取用户address权限",
    "phone": "获取用户phone权限"
}`

package main

import (
	"crypto/tls"
	"encoding/json"
	"fmt"
	"github.com/gin-gonic/gin"
	log "github.com/sirupsen/logrus"
	"net/url"
	"strings"
)
import "net/http"

//第三方APP
//kong admin RESTful api 获取
const CLIENT_ID = "oInH5MY5H0IZVPT899zn2Fq0YLKmetsv"
const CLIENT_SECRET = "1EHqpI6MENOk8YfOEnYjd9hGrOhrPVEq"

//kong 服务配置
const PROVISION_KEY = "Y1TV0sKHqtIzZ4JHtI0x420o3PZwM6gD"
const KONG_ADMIN = "http://oauth2.mojotv.cn:8001"
const KONG_API = "https://oauth2.mojotv.cn:8443" //自定义ssl 证书 需要关闭ssl-check
const API_PATH = `/mock`
const SERVICE_HOST = "mockbin.org"

// oauth 服务器
const COOKIE_AUTH = "auth1"

var SCOPE_DESCRIPTIONS = map[string]string{
	"email":   "读取用户email权限",
	"address": "读取用户address权限",
	"phone":   "读取用户phone权限",
}

func RunAuthCenter() {
	// logger and recovery (crash-free) middleware
	router := gin.Default()
	router.Use(mwPanic)
	router.LoadHTMLGlob("templates/*")

	//显示前端登陆form页面
	router.GET("login", func(c *gin.Context) {
		c.HTML(http.StatusOK, "login.html", gin.H{
			"client_id":     c.Query("client_id"),
			"response_type": c.Query("response_type"),
			"scope":         c.Query("scope"),
		})
	})
	//自己用户名体系 身份验证
	router.POST("login", func(c *gin.Context) {
		user := c.PostForm("name")
		password := c.PostForm("password")
		clientId := c.PostForm("client_id")
		responseType := c.PostForm("response_type")
		scope := c.PostForm("authorize")

		//todo::数据库比对
		if user != "admin" || password != "admin" {
			//登陆失败
			c.SetCookie(COOKIE_AUTH, "", -1, "/", "", false, true)
			loginUri := fmt.Sprintf("login?client_id=%s&response_type=%s&scope=%s", clientId, responseType, url.QueryEscape(scope))
			c.Redirect(http.StatusMovedPermanently, loginUri)
			return
		}
		//登陆成功
		c.SetCookie(COOKIE_AUTH, "001", 36000000, "/", "", false, true)
		if clientId != "" {
			authorizationUri := fmt.Sprintf("authorize?client_id=%s&response_type=%s&scope=%s", clientId, responseType, url.QueryEscape(scope))
			c.Redirect(http.StatusMovedPermanently, authorizationUri)
			return
		}
		c.JSON(http.StatusOK, "login succeed")
	})

	//显示 OAuth2 用户授权页面 可以做出github 第三方网站登陆授权页面
	router.GET("authorize", func(c *gin.Context) {
		//todo:: html 中展示用户信息
		//todo:: html 中展示权限信息
		//todo:: 模仿对象 github.com 账号登陆  https://github.com/login/oauth/authorize?client_id=30d97f7383706665c5e0&scope=user%3Aemail
		clientId := c.Query("client_id")
		responseType := c.Query("response_type")
		scope := c.Query("scope")

		authedUserId, err := c.Cookie(COOKIE_AUTH)
		if err != nil {
			log.WithError(err).Error("auth cookie", COOKIE_AUTH)
			c.Request.URL.Path = "/login"
			router.HandleContext(c)
			return
		}

		if authedUserId == "" {
			log.WithError(err).Error("auth cookie empty")
			c.Request.URL.Path = "/login"
			router.HandleContext(c)
			return
		}

		appInfo, err := kongApiGetAppName(clientId)
		if err != nil {
			c.JSON(http.StatusOK, "client id is wrong")
			return
		}

		c.HTML(http.StatusOK, "authorization.html", gin.H{
			"client_id":          clientId,
			"response_type":      responseType,
			"scope":              scope,
			"application_name":   appInfo.Data[0].Name, //todo:: render more info to html template
			"SCOPE_DESCRIPTIONS": SCOPE_DESCRIPTIONS})
	})

	//OAuth2 用户授权页面 点击授权按钮, 获取从kong api consumer/app  redirect_url(包含authorization_code)
	//第三方 app 通过 authorization_code 调用kong OAuth2接口换取 token
	//使用token 访问service 的route 接口
	router.POST("authorize", func(c *gin.Context) {

		clientId := c.PostForm("client_id")
		responseType := c.PostForm("response_type")
		scope := c.PostForm("scope")

		authedUserId, err := c.Cookie(COOKIE_AUTH)
		if err != nil {
			log.WithError(err).Error("cookie", COOKIE_AUTH)
			c.JSON(http.StatusOK, "auth cookie 为空")
			return
		}

		redirectURL := KongApiPostAuthorization(clientId, responseType, scope, authedUserId)
		if redirectURL != "" {
			c.Redirect(http.StatusMovedPermanently, redirectURL)
			return
		}
		c.JSON(http.StatusOK, "没有被授权")

	})
	router.Run(":3000")
	// router.Run(":3000") for a hard coded port
}

func main() {
	RunAuthCenter()
}

type appInfo struct {
	Next interface{} `json:"next"`
	Data []struct {
		RedirectUris []string `json:"redirect_uris"`
		CreatedAt    int      `json:"created_at"`
		Consumer     struct {
			ID string `json:"id"`
		} `json:"consumer"`
		ID           string      `json:"id"`
		Tags         interface{} `json:"tags"`
		Name         string      `json:"name"`
		ClientSecret string      `json:"client_secret"`
		ClientID     string      `json:"client_id"`
	} `json:"data"`
}

func kongApiGetAppName(clientId string) (*appInfo, error) {
	resp, err := http.Get(KONG_ADMIN + "/oauth2?client_id=" + clientId)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	data := &appInfo{}
	err = json.NewDecoder(resp.Body).Decode(data)
	if err != nil {
		return nil, err
	}
	return data, nil
}

func KongApiPostAuthorization(clientId, responseType, scope, authenticatedUserid string) string {
	// disable ssl check kong API 使用的是自己颁发的SSL 证书 post请求失败, 关闭httpClient的SSL证书校验
	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
	payload := fmt.Sprintf(`{"client_id":"%s","response_type":"%s","scope":"%s","provision_key":"%s","authenticated_userid":"%s"}`, clientId, responseType, scope, PROVISION_KEY, authenticatedUserid)
	reader := strings.NewReader(payload)
	endpoint := KONG_API + API_PATH + "/oauth2/authorize"
	req, err := http.NewRequest("POST", endpoint, reader)
	if err != nil {
		log.WithError(err).Error("new request")
		return ""
	}
	req.Host = "mockbin.org"

	req.Header.Add("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		log.WithError(err).Error("do request")
		return ""
	}

	defer res.Body.Close()
	data := struct {
		RedirectURI string `json:"redirect_uri"`
	}{}
	err = json.NewDecoder(res.Body).Decode(&data)
	if err != nil {
		log.WithError(err).Error("json decode")
		return ""
	}
	return data.RedirectURI
}

func mwPanic(c *gin.Context) {
	defer func() {
		if err := recover(); err != nil {
			switch v := err.(type) {
			case error:
				log.WithError(v).Error("gin handle all error")
				c.AbortWithStatusJSON(http.StatusOK, gin.H{"code": http.StatusNoContent, "msg": v.Error()})
				//todo:: 细分更多的panic
			default:
				log.Error(v)
			}
		}
	}()
	c.Next()
}

func handlerError(err error) {
	if err != nil {
		panic(err)
	}
}