- auth/refresh.go: RefreshStore(Issue/Rotate/Revoke/RevokeAll/RevokeByUser), SHA-256哈希256-bit随机串, 单次旋转事务(并发重放fail-closed) - 迁移0008_refresh_tokens(id/user_id/role/token_hash UNIQUE/expires_at/revoked_at + 索引) - gateway: POST /v1/auth/refresh(旋转/续期) + /v1/auth/logout(单/全设备); login响应增refreshToken - config: AUTH_REFRESH_TTL(720h)/AUTH_REFRESH_ROTATE_DISABLED; decode.go 支持time.Duration - rotate-jwt成功后RevokeAll(响应refreshTokensRevoked), revoke-keys不动refresh - 14测试+真实二进制e2e, build/vet/test绿+交叉编译 - Docs/api-client v0.25 + api-reference §2.3/2.4 同步
164 lines
3.9 KiB
Go
164 lines
3.9 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"reflect"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// decodeValue populates the struct pointed to by v. Precedence, highest first:
|
|
// process environment variable, the parsed .env file, then the default tag.
|
|
func decodeValue(v reflect.Value, fromEnv map[string]string) error {
|
|
if v.Kind() != reflect.Ptr || v.Elem().Kind() != reflect.Struct {
|
|
return fmt.Errorf("config: decode expects a pointer to a struct")
|
|
}
|
|
return decodeStruct(v.Elem(), fromEnv)
|
|
}
|
|
|
|
func decodeStruct(sv reflect.Value, fromEnv map[string]string) error {
|
|
st := sv.Type()
|
|
for i := 0; i < st.NumField(); i++ {
|
|
field := st.Field(i)
|
|
if !field.IsExported() {
|
|
continue
|
|
}
|
|
fv := sv.Field(i)
|
|
|
|
envTag, hasEnv := field.Tag.Lookup("env")
|
|
if !hasEnv {
|
|
// Untagged struct fields are nested config groups.
|
|
if fv.Kind() == reflect.Struct {
|
|
if err := decodeStruct(fv, fromEnv); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
continue
|
|
}
|
|
|
|
name := envTagName(envTag)
|
|
raw := lookupRaw(name, field.Tag.Get("default"), fromEnv)
|
|
if err := setField(fv, raw); err != nil {
|
|
return fmt.Errorf("config: %s: %w", name, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// envTagName extracts the variable name from an env tag (dropping any
|
|
// comma-separated options that may be added later).
|
|
func envTagName(tag string) string {
|
|
name, _, _ := strings.Cut(tag, ",")
|
|
return strings.TrimSpace(name)
|
|
}
|
|
|
|
// lookupRaw returns the effective raw value for key: process env, then .env,
|
|
// then default.
|
|
func lookupRaw(key, def string, fromEnv map[string]string) string {
|
|
if v, ok := os.LookupEnv(key); ok {
|
|
return v
|
|
}
|
|
if v, ok := fromEnv[key]; ok {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
func setField(fv reflect.Value, raw string) error {
|
|
switch fv.Kind() {
|
|
case reflect.String:
|
|
fv.SetString(raw)
|
|
return nil
|
|
case reflect.Bool:
|
|
return setBool(fv, raw)
|
|
case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
|
|
// time.Duration is an int64 kind but is configured as a Go duration
|
|
// string (e.g. "720h"), so it must be parsed before the integer path.
|
|
if fv.Type() == reflect.TypeOf(time.Duration(0)) {
|
|
return setDuration(fv, raw)
|
|
}
|
|
return setInt(fv, raw)
|
|
case reflect.Float32, reflect.Float64:
|
|
return setFloat(fv, raw)
|
|
case reflect.Slice:
|
|
return setStringSlice(fv, raw)
|
|
default:
|
|
return fmt.Errorf("unsupported kind %s", fv.Kind())
|
|
}
|
|
}
|
|
|
|
func setBool(fv reflect.Value, raw string) error {
|
|
if raw == "" {
|
|
fv.SetBool(false)
|
|
return nil
|
|
}
|
|
b, err := strconv.ParseBool(strings.ToLower(raw))
|
|
if err != nil {
|
|
return fmt.Errorf("invalid boolean %q", raw)
|
|
}
|
|
fv.SetBool(b)
|
|
return nil
|
|
}
|
|
|
|
func setInt(fv reflect.Value, raw string) error {
|
|
if raw == "" {
|
|
fv.SetInt(0)
|
|
return nil
|
|
}
|
|
n, err := strconv.ParseInt(raw, 10, 64)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid integer %q", raw)
|
|
}
|
|
fv.SetInt(n)
|
|
return nil
|
|
}
|
|
|
|
func setFloat(fv reflect.Value, raw string) error {
|
|
if raw == "" {
|
|
fv.SetFloat(0)
|
|
return nil
|
|
}
|
|
n, err := strconv.ParseFloat(raw, 64)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid float %q", raw)
|
|
}
|
|
fv.SetFloat(n)
|
|
return nil
|
|
}
|
|
|
|
// setDuration parses a Go duration string (e.g. "720h", "30m") into a
|
|
// time.Duration field. An empty value sets the zero duration.
|
|
func setDuration(fv reflect.Value, raw string) error {
|
|
if strings.TrimSpace(raw) == "" {
|
|
fv.SetInt(0)
|
|
return nil
|
|
}
|
|
d, err := time.ParseDuration(raw)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid duration %q", raw)
|
|
}
|
|
fv.SetInt(int64(d))
|
|
return nil
|
|
}
|
|
|
|
func setStringSlice(fv reflect.Value, raw string) error {
|
|
if fv.Type().Elem().Kind() != reflect.String {
|
|
return fmt.Errorf("unsupported slice element kind %s", fv.Type().Elem().Kind())
|
|
}
|
|
if strings.TrimSpace(raw) == "" {
|
|
fv.Set(reflect.MakeSlice(fv.Type(), 0, 0))
|
|
return nil
|
|
}
|
|
parts := strings.Split(raw, ",")
|
|
out := make([]string, 0, len(parts))
|
|
for _, p := range parts {
|
|
if t := strings.TrimSpace(p); t != "" {
|
|
out = append(out, t)
|
|
}
|
|
}
|
|
fv.Set(reflect.ValueOf(out))
|
|
return nil
|
|
}
|