mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-15 20:08:18 +08:00
2d04ce92ef
Hashed API-key auth (SHA-256, plaintext shown once), per-key sliding-window rate limit, and a fail-closed filter + scope/KB-binding interceptor enforcing empty-binding=zero-access. Admin CRUD for key lifecycle. Migration V164 across h2/mysql/kingbase.
30 lines
1.0 KiB
Java
30 lines
1.0 KiB
Java
package vip.mate.kbopen.auth;
|
|
|
|
import java.lang.annotation.ElementType;
|
|
import java.lang.annotation.Retention;
|
|
import java.lang.annotation.RetentionPolicy;
|
|
import java.lang.annotation.Target;
|
|
|
|
/**
|
|
* Declares the minimum scope required by a KB Open API endpoint.
|
|
*
|
|
* <p>Processed by {@code KbScopeInterceptor} which checks, in order:
|
|
* <ol>
|
|
* <li>A {@link KbApiKeyContext} exists on the request (filter ran).</li>
|
|
* <li>The context's scopes include the annotation value or {@code kb:*}.</li>
|
|
* <li>The path's {@code kbId} variable is in the context's bound KB set.</li>
|
|
* </ol>
|
|
*
|
|
* <p>This mirrors the existing {@code @RequireWorkspaceRole} +
|
|
* {@code WorkspaceAccessInterceptor} pattern, centralizing authorization so
|
|
* it is not hand-written per endpoint (A1 — avoids repeating the #438/#439
|
|
* Wiki IDOR pattern on the outward-facing API).
|
|
*/
|
|
@Target(ElementType.METHOD)
|
|
@Retention(RetentionPolicy.RUNTIME)
|
|
public @interface RequireKbScope {
|
|
|
|
/** Required scope, e.g. {@code "kb:search"}, {@code "kb:read"}. */
|
|
String value();
|
|
}
|