Aska
518bd0a230
批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。
批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。
第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。
实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。
106 lines
3.5 KiB
Go
106 lines
3.5 KiB
Go
// Package auth provides authentication and authorization primitives for the
|
|
// Cyrene v2 gateway: JWT signing/verification (HS256), an RBAC middleware built
|
|
// on an owner>admin>viewer role hierarchy, in-memory API keys, and salted
|
|
// password hashing. All APIs are self-contained and use only the standard
|
|
// library, so the package compiles without adding dependencies to the module.
|
|
//
|
|
// Identity is carried as strong-typed actor metadata and decided by policy (see
|
|
// DevDocs/design/11): it is never inferred by an LLM. This package supplies the
|
|
// credential layer that such policies rely on.
|
|
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
// Role is an authorization role in the owner>admin>viewer hierarchy.
|
|
type Role string
|
|
|
|
const (
|
|
// RoleOwner has full authority, including security/key/system settings.
|
|
RoleOwner Role = "owner"
|
|
// RoleAdmin manages modules but no sensitive security items.
|
|
RoleAdmin Role = "admin"
|
|
// RoleViewer is read-only (dashboard/logs/monitoring).
|
|
RoleViewer Role = "viewer"
|
|
)
|
|
|
|
// Sentinel errors returned by the auth package.
|
|
var (
|
|
// ErrInvalidSecret reports a JWTSecret shorter than the required minimum.
|
|
ErrInvalidSecret = errors.New("auth: JWTSecret must be at least 32 characters")
|
|
// ErrInvalidRole reports an unknown or unparseable role name.
|
|
ErrInvalidRole = errors.New("auth: invalid role")
|
|
// ErrMalformedToken reports a token that is not well-formed.
|
|
ErrMalformedToken = errors.New("auth: malformed token")
|
|
// ErrInvalidSignature reports a token whose HMAC signature does not verify.
|
|
ErrInvalidSignature = errors.New("auth: invalid signature")
|
|
// ErrTokenExpired reports a token whose exp is in the past.
|
|
ErrTokenExpired = errors.New("auth: token expired")
|
|
// ErrUnsupportedAlg reports a token declaring an algorithm other than HS256.
|
|
ErrUnsupportedAlg = errors.New("auth: unsupported algorithm")
|
|
// ErrUnauthorized reports a missing/invalid/unexpired-failed credential.
|
|
ErrUnauthorized = errors.New("auth: unauthorized")
|
|
// ErrForbidden reports a valid credential with insufficient privilege.
|
|
ErrForbidden = errors.New("auth: forbidden")
|
|
)
|
|
|
|
// Package-wide constants. `source` is the log provenance tag used by every
|
|
// logger.WithSource call in this package (no bare logs are emitted).
|
|
const (
|
|
source = "auth"
|
|
minSecretLen = 32
|
|
keyLength = 32
|
|
passwordScheme = "sha256"
|
|
saltLength = 16
|
|
passwordIterations = 100000
|
|
)
|
|
|
|
// ParseRole converts a string into a Role, erroring on unknown values.
|
|
func ParseRole(s string) (Role, error) {
|
|
r := Role(s)
|
|
if !r.Valid() {
|
|
return "", fmt.Errorf("%w: %q", ErrInvalidRole, s)
|
|
}
|
|
return r, nil
|
|
}
|
|
|
|
// Valid reports whether r is one of owner, admin, or viewer.
|
|
func (r Role) Valid() bool {
|
|
return r.rank() > 0
|
|
}
|
|
|
|
// rank returns the privilege rank of r. Invalid roles rank below viewer.
|
|
func (r Role) rank() int {
|
|
switch r {
|
|
case RoleOwner:
|
|
return 3
|
|
case RoleAdmin:
|
|
return 2
|
|
case RoleViewer:
|
|
return 1
|
|
default:
|
|
return 0
|
|
}
|
|
}
|
|
|
|
// HasRole reports whether role holds at least the privilege of required, where
|
|
// owner>admin>viewer. Owner satisfies admin and viewer, admin satisfies viewer,
|
|
// and viewer satisfies only viewer.
|
|
func HasRole(role, required Role) bool {
|
|
return role.rank() >= required.rank()
|
|
}
|
|
|
|
// UserSummary is the read-only shape of an account or API key visible to the
|
|
// admin panel (GET /api/v1/admin/users). CreatedAt is nil when the source does
|
|
// not track a creation time (the configured admin account and in-memory keys
|
|
// both omit it).
|
|
type UserSummary struct {
|
|
ID string
|
|
Username string
|
|
Role Role
|
|
CreatedAt *time.Time
|
|
}
|