mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-16 12:27:53 +08:00
2d04ce92ef
Hashed API-key auth (SHA-256, plaintext shown once), per-key sliding-window rate limit, and a fail-closed filter + scope/KB-binding interceptor enforcing empty-binding=zero-access. Admin CRUD for key lifecycle. Migration V164 across h2/mysql/kingbase.
40 lines
1.3 KiB
Java
40 lines
1.3 KiB
Java
package vip.mate.kbopen.auth;
|
|
|
|
import java.util.Set;
|
|
|
|
/**
|
|
* Authentication context injected by {@code KbOpenApiAuthFilter} into each
|
|
* request's attributes. Carries the resolved API key identity (keyId,
|
|
* workspace, bound KBs, scopes) so that Controller-layer authorization
|
|
* (via {@code @RequireKbScope}) can check access without re-querying the DB.
|
|
*
|
|
* <p>This is intentionally <strong>not</strong> a Spring Security
|
|
* {@code Authentication} — KB API Keys do not represent a user identity and
|
|
* must not inherit user-level permissions. The filter writes to a request
|
|
* attribute instead of the {@code SecurityContextHolder}.
|
|
*/
|
|
public record KbApiKeyContext(
|
|
Long keyId,
|
|
Long workspaceId,
|
|
Set<Long> kbIds,
|
|
Set<String> scopes,
|
|
int rateLimitPerMin
|
|
) {
|
|
|
|
/** Request attribute key under which the context is stored. */
|
|
public static final String ATTR = "kbOpenApiKeyContext";
|
|
|
|
/** Check whether the key grants the given scope (or the wildcard). */
|
|
public boolean hasScope(String scope) {
|
|
return scopes.contains("kb:*") || scopes.contains(scope);
|
|
}
|
|
|
|
/**
|
|
* Check whether the key is authorized to access the given KB. An empty
|
|
* {@code kbIds} set means zero access (R3).
|
|
*/
|
|
public boolean canAccessKb(Long kbId) {
|
|
return kbId != null && kbIds.contains(kbId);
|
|
}
|
|
}
|