112 lines
4.2 KiB
Lua
112 lines
4.2 KiB
Lua
local core = require("apisix.core")
|
|
local redis = require("resty.redis")
|
|
local _M = {}
|
|
|
|
function _M.access(conf, ctx)
|
|
if not ngx or not ngx.var then
|
|
core.log.warn("Not in request context, skipping auth check")
|
|
return
|
|
end
|
|
local request_uri = ngx.var.uri
|
|
core.log.info("REQUEST_DEBUG: uri = "..request_uri)
|
|
|
|
local white_list = {
|
|
["/api/v3/login"] = true,
|
|
["/admin/v3/login"] = true,
|
|
["/admin/v3/refresh"] = true,
|
|
}
|
|
|
|
local user_key = core.request.header(ctx, "authorization")
|
|
local service_code = core.request.header(ctx, "authorization-type")
|
|
local req_auth = core.request.header(ctx, "authorization-auth")
|
|
local refresh = core.request.header(ctx, "refresh")
|
|
|
|
local skip_auth = white_list[request_uri]
|
|
if skip_auth then
|
|
core.log.info("WHITE_LIST_DEBUG: hit white list "..request_uri)
|
|
-- 白名单只标记，不return，不再此处set_header
|
|
else
|
|
-- 非白名单完整鉴权逻辑
|
|
if not user_key or user_key == "" then
|
|
return core.response.exit(200, {code = 10003, message = "未登录"})
|
|
end
|
|
if not service_code or service_code == "" then
|
|
return core.response.exit(200, {code = 10003, message = "未登录"})
|
|
end
|
|
|
|
local redis_config = core.config.local_conf().redis or {}
|
|
local redis_host = redis_config.host or "127.0.0.1"
|
|
local redis_port = redis_config.port or 6379
|
|
local redis_password = redis_config.password or ""
|
|
local redis_db = redis_config.db or 0
|
|
|
|
local redis_key = "login:service:" .. service_code .. ":token:" .. user_key
|
|
local red = redis:new()
|
|
red:set_timeouts(1000, 1000, 1000)
|
|
local ok, err = red:connect(redis_host, redis_port)
|
|
if not ok then
|
|
red:set_keepalive(10000, 100)
|
|
return core.response.exit(200, {code = 10003, message = "系统错误，请稍后重试"})
|
|
end
|
|
if redis_password ~= "" then
|
|
local auth_ok, auth_err = red:auth(redis_password)
|
|
if not auth_ok then
|
|
red:set_keepalive(10000, 100)
|
|
return core.response.exit(200, {code = 10003, message = "系统错误，请稍后重试"})
|
|
end
|
|
end
|
|
if redis_db > 0 then
|
|
red:select(redis_db)
|
|
end
|
|
|
|
local res, err = red:get(redis_key)
|
|
red:set_keepalive(10000, 100)
|
|
if err or res == ngx.null then
|
|
return core.response.exit(200, {code = 10003, message = "未登录或登录已过期"})
|
|
end
|
|
local json, decode_err = core.json.decode(res)
|
|
if not json then
|
|
return core.response.exit(200, {code = 10003, message = "数据解析错误"})
|
|
end
|
|
|
|
if service_code == "admin1" then
|
|
if not req_auth or req_auth == "" then
|
|
return core.response.exit(200, {code = 10008, message = "没有权限访问该资源"})
|
|
end
|
|
local roles = json.roles or {}
|
|
local expect_path = roles[req_auth]
|
|
if not expect_path then
|
|
return core.response.exit(200, {code = 10008, message = "没有权限访问该资源"})
|
|
end
|
|
local full_expect_uri = "/" .. expect_path
|
|
local match = false
|
|
if expect_path:sub(-1) == "*" then
|
|
local base = expect_path:sub(1, -2)
|
|
if request_uri:find(base, 1, true) == 1 then
|
|
match = true
|
|
end
|
|
end
|
|
if request_uri ~= full_expect_uri and not match then
|
|
return core.response.exit(200, {code = 10008, message = "没有权限访问该资源"})
|
|
end
|
|
end
|
|
|
|
if json.id then
|
|
ngx.req.set_header("X-User-Id", tostring(json.id))
|
|
end
|
|
if json.name then
|
|
ngx.req.set_header("X-User-Name", json.name)
|
|
end
|
|
if json.username then
|
|
ngx.req.set_header("X-Username", json.username)
|
|
end
|
|
end
|
|
|
|
ngx.req.set_header("X-Refresh", refresh or "")
|
|
ngx.req.set_header("X-Service-Code", service_code or "")
|
|
core.log.info("FINAL_SET_HEADER: X-Refresh=["..(refresh or "").."]")
|
|
|
|
return
|
|
end
|
|
|
|
return _M |