用户信息传到service

deploy/apisix/lua/auth.lua

@@ -0,0 +1,185 @@
+local core = require("apisix.core")
+local redis = require("resty.redis")
+
+local _M = {}
+
+function _M.access(conf, ctx)
+    -- 确保在请求阶段执行
+    if not ngx or not ngx.var then
+        core.log.warn("Not in request context, skipping auth check")
+        return
+    end
+
+    -- ========== 获取请求头 ==========
+    local headers = ngx.req.get_headers()
+    local user_key = headers["Authorization"]
+    local service_code = headers["Authorization-Type"]
+    local req_auth = headers["Authorization-Auth"]
+    local refresh = headers["Refresh"]
+    local request_uri = ngx.var.uri
+
+    -- ========== 获取 Redis 配置 ==========
+    local redis_config = core.config.local_conf().redis or {}
+    local redis_host = redis_config.host or "127.0.0.1"
+    local redis_port = redis_config.port or 6379
+    local redis_password = redis_config.password or ""
+    local redis_db = redis_config.db or 0
+
+    -- ========== 参数校验 ==========
+    if not user_key or user_key == "" then
+        core.log.warn("Missing Authorization header")
+        return core.response.exit(401, {
+            code = 10003,
+            message = "未登录",
+            data = nil
+        })
+    end
+
+    if not service_code or service_code == "" then
+        core.log.warn("Missing Authorization-Type header")
+        return core.response.exit(401, {
+            code = 10003,
+            message = "未登录",
+            data = nil
+        })
+    end
+
+    -- ========== 构建Redis Key ==========
+    local redis_key = "login:service:" .. service_code .. ":" .. user_key
+
+    -- ========== Redis连接 ==========
+    local red = redis:new()
+    red:set_timeouts(1000, 1000, 1000)
+
+    local ok, err = red:connect(redis_host, redis_port)
+    if not ok then
+        core.log.error("Redis connect error: ", err)
+        red:set_keepalive(10000, 100)
+        return core.response.exit(500, {
+            code = 10003,
+            message = "系统错误，请稍后重试",
+            data = nil
+        })
+    end
+
+    -- Redis认证
+    if redis_password and redis_password ~= "" then
+        local auth_ok, auth_err = red:auth(redis_password)
+        if not auth_ok then
+            core.log.error("Redis auth error: ", auth_err)
+            red:set_keepalive(10000, 100)
+            return core.response.exit(500, {
+                code = 10003,
+                message = "系统错误，请稍后重试",
+                data = nil
+            })
+        end
+    end
+
+    -- 选择数据库
+    if redis_db and redis_db > 0 then
+        red:select(redis_db)
+    end
+
+    -- ========== 获取用户信息 ==========
+    local res, err = red:get(redis_key)
+    red:set_keepalive(10000, 100)
+
+    if err then
+        core.log.error("Redis get error: ", err)
+        return core.response.exit(500, {
+            code = 10003,
+            message = "系统错误，请稍后重试",
+            data = nil
+        })
+    end
+
+    if not res or res == ngx.null then
+        core.log.warn("User not found in redis, key: ", redis_key)
+        return core.response.exit(401, {
+            code = 10003,
+            message = "未登录或登录已过期",
+            data = nil
+        })
+    end
+
+    -- ========== 解析用户信息 ==========
+    local json, decode_err = core.json.decode(res)
+    if not json then
+        core.log.error("JSON decode error: ", decode_err, " data: ", res)
+        return core.response.exit(500, {
+            code = 10003,
+            message = "数据解析错误",
+            data = nil
+        })
+    end
+
+    -- ========== Admin路径权限校验 ==========
+    if service_code == "admin1" then
+        if not req_auth or req_auth == "" then
+            core.log.warn("Missing Authorization-Auth header for admin")
+            return core.response.exit(403, {
+                code = 10008,
+                message = "没有权限访问该资源",
+                data = nil
+            })
+        end
+
+        local roles = json.roles or {}
+        local expect_path = roles[req_auth]
+
+        if not expect_path or expect_path == "" then
+            core.log.error("Permission not found for auth: ", req_auth,
+                          " user_id: ", json.id, " roles: ", core.json.encode(roles))
+            return core.response.exit(403, {
+                code = 10008,
+                message = "没有权限访问该资源",
+                data = nil
+            })
+        end
+
+        local full_expect_uri = "/" .. expect_path
+
+        if request_uri ~= full_expect_uri then
+            local is_prefix_match = false
+            if expect_path:sub(-1) == "*" then
+                local base_path = expect_path:sub(1, -2)
+                if request_uri:find(base_path, 1, true) == 1 then
+                    is_prefix_match = true
+                end
+            end
+
+            if not is_prefix_match then
+                core.log.error("URI mismatch - request: ", request_uri,
+                              " expected: ", full_expect_uri,
+                              " auth: ", req_auth,
+                              " user_id: ", json.id)
+                return core.response.exit(403, {
+                    code = 10008,
+                    message = "没有权限访问该资源",
+                    data = nil
+                })
+            end
+        end
+    end
+
+    -- ========== 向下游透传用户信息 ==========
+    if json.id then
+        ngx.req.set_header("X-User-Id", tostring(json.id))
+    end
+
+    if json.name then
+        ngx.req.set_header("X-User-Name", json.name)
+    end
+
+    if json.username then
+        ngx.req.set_header("X-Username", json.username)
+    end
+    ngx.req.set_header("X-Refresh", refresh )
+
+    ngx.req.set_header("X-Service-Code", service_code)
+
+    return
+end
+
+return _M