mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-13 03:13:41 +08:00
03a6d61131
* feat(sso): feishu OAuth2 single sign-on (ISSUE #405 P0) Implements the SSO design (ISSUE #405) with feishu as the first IdP and a generic OAuth2 provider abstraction for future dingtalk/wecom extensions. SSO is disabled by default — existing deployments are unaffected until mateclaw.sso.enabled=true. Backend: - SsoProvider interface + SsoUserInfo record: generic IdP abstraction - FeishuSsoProvider: OAuth2 authorization-code flow (app_access_token with Caffeine cache → user_access_token → user info). apiBase switches between feishu.cn / larksuite.com by domain config. - SsoProviderRegistry: conditional registration, lists enabled providers - SsoStateService: HMAC-signed OAuth2 state + self-contained bind_token JWT, both persisted to sso_state DB table for multi-node correctness. State is one-time-consumable (conditional UPDATE), bind_token jti anti-replay via PK insert. Hourly ShedLock purge (LambdaQuery + Java time, works on all 3 dialects). - SsoService: authorize/callback/bind, user mapping (union_id first → external_id fallback), auto-create with concurrent idempotency (DuplicateKeyException → rollback orphan user → re-query), link-only mode issues bind_token for existing-account binding. - SsoController: 4 endpoints (/providers, /authorize, /callback, /bind) all permitAll. - V159 migration (h2/mysql/kingbase): mate_user_external_identity, sso_state, ALTER mate_user.password NULL (SSO-only users). - AuthService: generateToken promoted to public; login() guards password=null (SSO-only users cannot password-login). - SecurityConfig: /auth/sso/** added to permitAll whitelist. - LoginRateLimitFilter: expanded to cover /auth/sso/bind (brute-force surface equivalent to /auth/login). - application.yml: mateclaw.sso.* config block (all env-var driven). Frontend: - Login.vue: dynamic SSO buttons (only shown when providers configured), OAuth2 callback detection (?sso=callback), link-only bind dialog, shared applyLogin flow (localStorage + workspace + route). - api/index.ts: ssoApi (providers, authorize, callback, bind). Tests: SsoStateServiceTest (11) — state issue/verify/replay/tamper, bind_token issue/verify/anti-replay/garbage. Regression: PAT (23) + Approval resolve (13) all green. Not in scope (P1/P2): link-only bind/unbind management endpoints, user enable/disable endpoint, dingtalk/wecom providers, admin SSO config page. Workspace assignment for auto-created users remains a product decision (design doc §12 item 2). * fix(sso): self-review fixes — P0 security + P1 quality P0-1 BindRequired serialization: replaced the R.fail(200, Map.toString()) hack with a structured SsoCallbackResponse record. Controller no longer catches an exception for a non-error path; frontend reads bindRequired flag directly instead of regex-parsing a stringified map. P0-2 createSsoUser unbounded recursion: added a retry flag — second DuplicateKeyException (extreme race where identity was concurrently deleted) now throws a 503 instead of recursing to stack overflow. P0-3 state TTL not enforced: verifyState's conditional UPDATE now includes created_at > cutoff, so a state unused for 5+ min is rejected at consumption time, not just at the 1h purge. Without this the 5-min window was advisory only. P1-5 SsoStateService unused ObjectMapper: removed dead injection. P1-6 audit JSON string concat: replaced with ObjectMapper serialization (provider/externalId no longer risk breaking the JSON structure). P1-7 LoginRateLimitFilter shared counter: documented the intentional decision that login + bind share a per-IP counter (same brute-force surface) with guidance on switching to per-path if finer isolation is needed.
34 lines
1.3 KiB
Java
34 lines
1.3 KiB
Java
package vip.mate.auth.sso;
|
|
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
|
|
import org.springframework.boot.context.properties.EnableConfigurationProperties;
|
|
import org.springframework.context.annotation.Bean;
|
|
import org.springframework.context.annotation.Configuration;
|
|
import org.springframework.scheduling.annotation.EnableScheduling;
|
|
import vip.mate.auth.sso.provider.FeishuSsoProvider;
|
|
|
|
/**
|
|
* SSO 配置。启用 {@link SsoProperties} 绑定 + 按需注册飞书 Provider。
|
|
* <p>
|
|
* 仅当 {@code mateclaw.sso.enabled=true} 时此配置生效。飞书 Provider 进一步要求
|
|
* {@code mateclaw.sso.feishu.enabled=true}。
|
|
*
|
|
* @author MateClaw Team
|
|
*/
|
|
@Configuration
|
|
@EnableScheduling
|
|
@EnableConfigurationProperties(SsoProperties.class)
|
|
@ConditionalOnProperty(name = "mateclaw.sso.enabled", havingValue = "true")
|
|
public class SsoAutoConfiguration {
|
|
|
|
/**
|
|
* 飞书 SSO Provider。仅当飞书 SSO 启用时注册。
|
|
*/
|
|
@Bean
|
|
@ConditionalOnProperty(name = "mateclaw.sso.feishu.enabled", havingValue = "true")
|
|
public FeishuSsoProvider feishuSsoProvider(SsoProperties ssoProperties, ObjectMapper objectMapper) {
|
|
return new FeishuSsoProvider(ssoProperties.getFeishu(), objectMapper);
|
|
}
|
|
}
|