feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

internal/auth/apikey.go

@@ -0,0 +1,73 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"log/slog"
+	"sync"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
+)
+
+// APIKey manages a bounded, in-memory constant table of API keys, each bound to
+// a Role so keys can be minted for admin/owner to reach administrative
+// endpoints. Keys are generated with crypto/rand and stored by their string
+// form. This suits the current single-binary milestone; production should
+// persist keys (e.g. hashed) and support revocation.
+type APIKey struct {
+	mu   sync.RWMutex
+	cfg  config.AuthConfig
+	keys map[string]Role
+	log  *slog.Logger
+}
+
+// NewAPIKey returns an empty key manager. cfg is accepted for constructor
+// parity and future persistence settings; keys are runtime-generated.
+func NewAPIKey(cfg config.AuthConfig) *APIKey {
+	return &APIKey{
+		cfg:  cfg,
+		keys: make(map[string]Role),
+		log:  logger.WithSource(slog.Default(), source),
+	}
+}
+
+// Generate mints a new random key bound to role and stores it. Returns the
+// plaintext key exactly once; it must not be logged.
+func (k *APIKey) Generate(role Role) (string, error) {
+	if !role.Valid() {
+		return "", fmt.Errorf("%w: %q", ErrInvalidRole, role)
+	}
+	raw := make([]byte, keyLength)
+	if _, err := rand.Read(raw); err != nil {
+		return "", fmt.Errorf("auth: generate api key: %w", err)
+	}
+	key := base64.RawURLEncoding.EncodeToString(raw)
+
+	k.mu.Lock()
+	k.keys[key] = role
+	k.mu.Unlock()
+	return key, nil
+}
+
+// Verify reports whether key is a known, unrevoked API key.
+func (k *APIKey) Verify(key string) bool {
+	_, ok := k.Lookup(key)
+	return ok
+}
+
+// Lookup returns the role bound to key.
+func (k *APIKey) Lookup(key string) (Role, bool) {
+	k.mu.RLock()
+	defer k.mu.RUnlock()
+	role, ok := k.keys[key]
+	return role, ok
+}
+
+// Revoke removes key from the constant table.
+func (k *APIKey) Revoke(key string) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	delete(k.keys, key)
+}