mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zeekayandHanzo Dev
70371d4941
visor required github.com/hanzoai/iam-v1 DIRECTLY (go.mod, 6 import sites)
while ALSO linking github.com/hanzoai/iam through cloud. One binary, both
implementations of the same idea.
iam-v1 is ARCHIVED. Its description says "no longer in any graph"; go list -deps
said otherwise. An archived repo cannot take a push, so it cannot take a
security fix — which disqualifies it as a dependency of a deployed service no
matter how good the code inside is.
The code inside is, in fact, the same code. iam-v1's ROOT package is a copy of
the Casdoor Go SDK that also lives, extracted and maintained, at
github.com/hanzoai/iamsdk/v2/iamsdk: 67 of 73 non-test files byte-identical
once the package clause is normalised. Same shape, same bounded context, same
semantics — a genuine duplicate, not a name collision, so it collapses.
Measured before landing this, so the swap drops nothing:
- ParseJwtToken + publicKeyFromPEM: byte-identical. Signature verification,
the JWKS-then-cert-PEM fallback, the algorithm allowlist — unchanged.
- jwks.go: byte-identical. Key fetch unchanged.
- iamsdk's User is a strict superset of iam-v1's.
- Zero exported symbols exist there and not here.
- What iam-v1 had and iamsdk lacked — Claims.Orgs and Claims.BillingAccount,
both signed and both minted by live IAM — went into iamsdk v2.2.1 first,
with tests. Nothing was dropped to make the merge fit.
- iam-v1's root errors.go sentinels are NOT ported: nothing in that module
ever returns them. (teamrole.ErrCrossOrg is a different package's live
guard, and visor never imported that subpackage.) Dead names, not guards.
No shim, no alias: the import is plain `iamsdk`, spelled once. The old
`iam "…/iam-v1"` alias is what let two lineages wear one name at the call site.
visor's own guards are untouched — GetBearerUser still fails closed on an empty
owner and still refuses a sibling brand's issuer; authz.IsAllowed is unchanged.
deps_test.go stops the archived module coming back, reading go.mod rather than
imports so a TRANSITIVE reintroduction fails too, and TestRetiredInDetects
proves the detector fires on the exact require line this commit deletes.
Gate: go build ./... + go vet ./... + go test ./... green before and after.
go list -deps ./... | grep hanzoai/iam-v1 → 1 package before, 0 after; go.sum
references → 0.
Co-authored-by: Hanzo Dev <[email protected]>
94 lines
2.4 KiB
Go
94 lines
2.4 KiB
Go
// Copyright 2023 Hanzo Industries Inc. All Rights Reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package controllers
|
|
|
|
import (
|
|
_ "embed"
|
|
"encoding/base64"
|
|
|
|
"github.com/hanzoai/iamsdk/v2/iamsdk"
|
|
|
|
"github.com/hanzoai/visor/conf"
|
|
)
|
|
|
|
//go:embed token_jwt_key.pem
|
|
var JwtPublicKey string
|
|
|
|
func init() {
|
|
InitAuthConfig()
|
|
}
|
|
|
|
func InitAuthConfig() {
|
|
iamEndpoint := conf.GetConfigString("iamEndpoint")
|
|
clientId := conf.GetConfigString("clientId")
|
|
clientSecret := conf.GetConfigString("clientSecret")
|
|
iamOrganization := conf.GetConfigString("iamOrganization")
|
|
iamApplication := conf.GetConfigString("iamApplication")
|
|
|
|
// The JWT verification cert is config-driven (KMS-synced) so a deployment
|
|
// verifies its own org's tokens (e.g. cert-hanzo) rather than the embedded
|
|
// upstream default. Delivered base64 to stay single-line-safe in the
|
|
// app.conf ini; falls back to the embedded PEM when unset.
|
|
jwtPublicKey := conf.GetConfigString("jwtPublicKey")
|
|
if b64 := conf.GetConfigString("jwtPublicKeyBase64"); b64 != "" {
|
|
if dec, err := base64.StdEncoding.DecodeString(b64); err == nil {
|
|
jwtPublicKey = string(dec)
|
|
}
|
|
}
|
|
if jwtPublicKey == "" {
|
|
jwtPublicKey = JwtPublicKey
|
|
}
|
|
|
|
iamsdk.InitConfig(iamEndpoint, clientId, clientSecret, jwtPublicKey, iamOrganization, iamApplication)
|
|
}
|
|
|
|
func (c *ApiController) Signin() {
|
|
code := c.Ctx.Query("code")
|
|
state := c.Ctx.Query("state")
|
|
|
|
token, err := iamsdk.GetOAuthToken(code, state)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
claims, err := iamsdk.ParseJwtToken(token.AccessToken)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
claims.AccessToken = token.AccessToken
|
|
c.SetSessionClaims(claims)
|
|
userId := claims.User.Owner + "/" + claims.User.Name
|
|
c.Ctx.Locals("recordUserId", userId)
|
|
|
|
c.ResponseOk(claims)
|
|
}
|
|
|
|
func (c *ApiController) Signout() {
|
|
c.SetSessionClaims(nil)
|
|
|
|
c.ResponseOk()
|
|
}
|
|
|
|
func (c *ApiController) GetAccount() {
|
|
if c.RequireSignedIn() {
|
|
return
|
|
}
|
|
|
|
claims := c.GetSessionClaims()
|
|
|
|
c.ResponseOk(claims)
|
|
}
|