113 lines
3.4 KiB
Go
113 lines
3.4 KiB
Go
package classes
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"slices"
|
|
"strings"
|
|
"time"
|
|
|
|
"git.golem15.com/golem15/sm-user-plugin/models"
|
|
"git.golem15.com/golem15/summercms/modules/backpack"
|
|
"git.golem15.com/golem15/summercms/modules/lagoon"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
const DefaultAPITokenPrefix = "usr_"
|
|
|
|
var (
|
|
DefaultAPITokenScopes = []string{"read"}
|
|
AllowedAPITokenScopes = []string{"read", "write", "ai"}
|
|
)
|
|
|
|
// APITokenPrefix returns the configured on-wire prefix. Applications may keep
|
|
// a legacy prefix while every plugin still consumes the same token table.
|
|
func APITokenPrefix(app *backpack.App) (string, error) {
|
|
prefix := DefaultAPITokenPrefix
|
|
if app != nil && app.Config != nil {
|
|
if configured := strings.TrimSpace(app.Config.String("golem15.user.api_tokens.prefix")); configured != "" {
|
|
prefix = configured
|
|
}
|
|
}
|
|
if len(prefix) < 2 || len(prefix) > 16 {
|
|
return "", fmt.Errorf("golem15.user: api_tokens.prefix must contain 2 to 16 safe characters")
|
|
}
|
|
for _, r := range prefix {
|
|
if !(r == '_' || r == '-' || r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9') {
|
|
return "", fmt.Errorf("golem15.user: api_tokens.prefix contains an unsafe character")
|
|
}
|
|
}
|
|
return prefix, nil
|
|
}
|
|
|
|
// MintAPIToken builds a token record and returns its one-time clear-text
|
|
// secret. A nil scopes slice receives DefaultAPITokenScopes.
|
|
func MintAPIToken(prefix string, userID uint, name string, scopes []string, expiresAt *time.Time, collectionIDs []uint) (string, *models.APIToken, error) {
|
|
name = strings.TrimSpace(name)
|
|
if userID == 0 || name == "" || len(name) > 255 {
|
|
return "", nil, fmt.Errorf("a user and token name of 1 to 255 characters are required")
|
|
}
|
|
if prefix == "" {
|
|
prefix = DefaultAPITokenPrefix
|
|
}
|
|
if scopes == nil {
|
|
scopes = slices.Clone(DefaultAPITokenScopes)
|
|
} else {
|
|
scopes = slices.Clone(scopes)
|
|
}
|
|
for _, scope := range scopes {
|
|
if !slices.Contains(AllowedAPITokenScopes, scope) {
|
|
return "", nil, fmt.Errorf("scope %q is not allowed", scope)
|
|
}
|
|
}
|
|
seenScopes := make(map[string]bool, len(scopes))
|
|
uniqueScopes := make([]string, 0, len(scopes))
|
|
for _, scope := range scopes {
|
|
if !seenScopes[scope] {
|
|
seenScopes[scope] = true
|
|
uniqueScopes = append(uniqueScopes, scope)
|
|
}
|
|
}
|
|
scopes = uniqueScopes
|
|
raw := make([]byte, 32)
|
|
if _, err := rand.Read(raw); err != nil {
|
|
return "", nil, err
|
|
}
|
|
secret := prefix + base64.RawURLEncoding.EncodeToString(raw)
|
|
token := &models.APIToken{
|
|
UserID: userID,
|
|
Name: &name,
|
|
TokenHash: HashAPIToken(secret),
|
|
Scopes: lagoon.Jsonable[[]string]{Data: scopes, Valid: true},
|
|
ExpiresAt: expiresAt,
|
|
}
|
|
if len(collectionIDs) > 0 {
|
|
collectionIDs = slices.Compact(slices.Sorted(slices.Values(collectionIDs)))
|
|
token.CollectionIDs = lagoon.Jsonable[[]uint]{Data: collectionIDs, Valid: true}
|
|
}
|
|
return secret, token, nil
|
|
}
|
|
|
|
// HashAPIToken returns the only representation of a token secret stored in
|
|
// the database.
|
|
func HashAPIToken(secret string) string {
|
|
sum := sha256.Sum256([]byte(secret))
|
|
return hex.EncodeToString(sum[:])
|
|
}
|
|
|
|
// RevokeAPIToken invalidates token immediately.
|
|
func RevokeAPIToken(db *gorm.DB, token *models.APIToken) error {
|
|
if db == nil || token == nil {
|
|
return fmt.Errorf("golem15.user: token is missing")
|
|
}
|
|
now := time.Now()
|
|
if err := db.Model(token).Update("revoked_at", now).Error; err != nil {
|
|
return err
|
|
}
|
|
token.RevokedAt = &now
|
|
return nil
|
|
}
|