179 lines
8.4 KiB
Java
179 lines
8.4 KiB
Java
package com.iot.gateway.oauth;
|
|
|
|
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
|
|
import com.fasterxml.jackson.databind.JsonNode;
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
import com.iot.gateway.common.IpUtils;
|
|
import com.iot.gateway.entity.OpenClient;
|
|
import com.iot.gateway.mapper.OpenClientMapper;
|
|
import io.swagger.v3.oas.annotations.Operation;
|
|
import io.swagger.v3.oas.annotations.tags.Tag;
|
|
import java.time.LocalDateTime;
|
|
import java.util.Arrays;
|
|
import java.util.Collections;
|
|
import java.util.HashMap;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
import lombok.extern.slf4j.Slf4j;
|
|
import org.springframework.beans.factory.annotation.Autowired;
|
|
import org.springframework.http.HttpStatus;
|
|
import org.springframework.http.ResponseEntity;
|
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
|
import org.springframework.util.StringUtils;
|
|
import org.springframework.web.bind.annotation.PostMapping;
|
|
import org.springframework.web.bind.annotation.RequestMapping;
|
|
import org.springframework.web.bind.annotation.RequestParam;
|
|
import org.springframework.web.bind.annotation.RestController;
|
|
|
|
@Slf4j
|
|
@Tag(name = "OAuth 2.0 授权中心")
|
|
@RestController
|
|
@RequestMapping("/oauth2")
|
|
public class OAuth2TokenController {
|
|
|
|
@Autowired
|
|
private OpenClientMapper clientMapper;
|
|
|
|
@Autowired
|
|
private JwtTokenProvider jwtTokenProvider;
|
|
|
|
@Autowired
|
|
private PasswordEncoder passwordEncoder;
|
|
|
|
private final ObjectMapper objectMapper = new ObjectMapper();
|
|
|
|
@Operation(summary = "客户端凭据模式换取访问令牌 (支持 form-urlencoded 与 application/json)")
|
|
@PostMapping(value = "/token")
|
|
public ResponseEntity<Map<String, Object>> issueToken(
|
|
@RequestParam(value = "grant_type", required = false) String formGrantType,
|
|
@RequestParam(value = "client_id", required = false) String formClientId,
|
|
@RequestParam(value = "client_secret", required = false) String formClientSecret,
|
|
@RequestParam(value = "scope", required = false) String formScope,
|
|
jakarta.servlet.http.HttpServletRequest request) {
|
|
|
|
String grantType = formGrantType;
|
|
String clientId = formClientId;
|
|
String clientSecret = formClientSecret;
|
|
String scope = formScope;
|
|
|
|
// 兼容自适应解析 application/json 请求载荷
|
|
String contentType = request.getContentType();
|
|
if ((!StringUtils.hasText(clientId) || !StringUtils.hasText(clientSecret))
|
|
&& contentType != null && contentType.toLowerCase().contains("application/json")) {
|
|
try {
|
|
JsonNode root = objectMapper.readTree(request.getInputStream());
|
|
if (root != null) {
|
|
if (grantType == null && root.has("grant_type")) grantType = root.get("grant_type").asText();
|
|
if (clientId == null && root.has("client_id")) clientId = root.get("client_id").asText();
|
|
if (clientSecret == null && root.has("client_secret")) clientSecret = root.get("client_secret").asText();
|
|
if (scope == null && root.has("scope")) scope = root.get("scope").asText();
|
|
}
|
|
} catch (Exception e) {
|
|
log.warn("解析 JSON 格式 OAuth 请求体异常: {}", e.getMessage());
|
|
}
|
|
}
|
|
|
|
Map<String, Object> error = new HashMap<>();
|
|
|
|
if (!"client_credentials".equalsIgnoreCase(grantType)) {
|
|
error.put("error", "unsupported_grant_type");
|
|
error.put("error_description", "仅支持 client_credentials 客户端凭据授权模式");
|
|
return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(error);
|
|
}
|
|
|
|
if (!StringUtils.hasText(clientId) || !StringUtils.hasText(clientSecret)) {
|
|
error.put("error", "invalid_client");
|
|
error.put("error_description", "client_id 或 client_secret 不能为空");
|
|
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
|
|
}
|
|
|
|
OpenClient client = clientMapper.selectOne(new LambdaQueryWrapper<OpenClient>()
|
|
.eq(OpenClient::getClientId, clientId.trim()));
|
|
|
|
if (client == null) {
|
|
error.put("error", "invalid_client");
|
|
error.put("error_description", "客户端标识或密钥错误");
|
|
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
|
|
}
|
|
|
|
// 密钥比对：优先支持 BCrypt 哈希比对；兼顾历史明文并自动平滑升级为 BCrypt 哈希
|
|
boolean secretMatch = false;
|
|
String storedSecret = client.getClientSecret();
|
|
if (storedSecret != null) {
|
|
if (storedSecret.startsWith("$2a$") || storedSecret.startsWith("$2b$")) {
|
|
secretMatch = passwordEncoder.matches(clientSecret, storedSecret);
|
|
} else if (storedSecret.equals(clientSecret)) {
|
|
secretMatch = true;
|
|
client.setClientSecret(passwordEncoder.encode(clientSecret));
|
|
clientMapper.updateById(client);
|
|
log.info("检测到明文密钥成功验证，已自动无感升级为 BCrypt 哈希: clientId={}", clientId);
|
|
}
|
|
}
|
|
|
|
if (!secretMatch) {
|
|
error.put("error", "invalid_client");
|
|
error.put("error_description", "客户端标识或密钥错误");
|
|
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
|
|
}
|
|
|
|
if (client.getStatus() == null || client.getStatus() != 1) {
|
|
error.put("error", "unauthorized_client");
|
|
error.put("error_description", "客户端已被禁用，无法申请令牌");
|
|
return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
|
|
}
|
|
|
|
if (client.getExpireTime() != null && client.getExpireTime().isBefore(LocalDateTime.now())) {
|
|
error.put("error", "expired_token");
|
|
error.put("error_description", "客户端凭证已过期");
|
|
return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
|
|
}
|
|
|
|
// 校验客户端来源 IP 白名单（基于可信反向代理验证）
|
|
String clientIp = IpUtils.getClientIp(request);
|
|
if (!IpUtils.isAllowed(clientIp, client.getIpWhitelist())) {
|
|
log.warn("OAuth 2.0 客户端 IP 白名单拦截: clientId={}, clientIp={}, whitelist={}",
|
|
clientId, clientIp, client.getIpWhitelist());
|
|
error.put("error", "unauthorized_client");
|
|
error.put("error_description", "客户端来源 IP [" + clientIp + "] 不在允许的白名单范围内");
|
|
return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
|
|
}
|
|
|
|
// 验证 Scope 并支持合法收窄 (Scope Narrowing)
|
|
String effectiveScopes = client.getScopes();
|
|
if (StringUtils.hasText(scope)) {
|
|
List<String> clientAllowed = StringUtils.hasText(client.getScopes())
|
|
? Arrays.asList(client.getScopes().split("[,;\\s]+"))
|
|
: Collections.emptyList();
|
|
List<String> requested = Arrays.asList(scope.split("[,;\\s]+"));
|
|
|
|
for (String reqScope : requested) {
|
|
String reqNorm = reqScope.trim().replace(":", ".");
|
|
boolean allowed = clientAllowed.stream().anyMatch(ca -> {
|
|
String caNorm = ca.trim().replace(":", ".");
|
|
return caNorm.equals(reqNorm) || caNorm.equals("all") || caNorm.equals("*");
|
|
});
|
|
if (!allowed) {
|
|
error.put("error", "invalid_scope");
|
|
error.put("error_description", "请求的作用域 [" + reqScope + "] 超出该客户端的允许授权范围");
|
|
return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(error);
|
|
}
|
|
}
|
|
effectiveScopes = String.join(",", requested);
|
|
}
|
|
|
|
String accessToken = jwtTokenProvider.generateToken(client, effectiveScopes);
|
|
log.info("OAuth 2.0 成功颁发令牌: clientId={}, clientIp={}, tenantId={}, scopes={}",
|
|
clientId, clientIp, client.getTenantId(), effectiveScopes);
|
|
|
|
Map<String, Object> response = new HashMap<>();
|
|
response.put("access_token", accessToken);
|
|
response.put("token_type", "Bearer");
|
|
response.put("expires_in", jwtTokenProvider.getTokenExpireSeconds());
|
|
response.put("scope", effectiveScopes);
|
|
response.put("tenant_id", client.getTenantId());
|
|
response.put("client_name", client.getClientName());
|
|
|
|
return ResponseEntity.ok(response);
|
|
}
|
|
}
|