ob/agent/api/secure_handler.go - master - zhendosina/obshell

ob/agent/api/secure_handler.go
121 строка4 KB
Junkrat77
PullRequest: 780 sso token
03 апр 2026, 07:06
03 апр 2026, 07:065309832
/*
 * Copyright (c) 2024 OceanBase.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package api

import (
	"github.com/gin-gonic/gin"

	"github.com/oceanbase/obshell/ob/agent/api/common"
	"github.com/oceanbase/obshell/ob/agent/executor/session"
	"github.com/oceanbase/obshell/ob/agent/secure"
	"github.com/oceanbase/obshell/ob/param"
)

// @ID getSecret
// @Summary get secret
// @Description get secret
// @Tags v1
// @Accept application/json
// @Produce application/json
// @Success 200 object http.OcsAgentResponse{data=meta.AgentSecret}
// @Router /api/v1/secret [get]
func secretHandler(c *gin.Context) {
	ctx := common.NewContextWithTraceId(c)
	data := secure.GetSecret(ctx)
	common.SendResponse(c, data, nil)
}

// @ID login
// @Summary login
// @Description login
// @Tags v1
// @Accept application/json
// @Produce application/json
// @Success 200 object http.OcsAgentResponse
// @Failure 400 object http.OcsAgentResponse
// @Failure 401 object http.OcsAgentResponse
// @Failure 500 object http.OcsAgentResponse
// @Router /api/v1/login [post]
func loginHandler(c *gin.Context) {
	data, err := session.Login(c)
	if err != nil {
		common.SendResponse(c, nil, err)
		return
	}
	common.SendResponse(c, data, nil)
}

// @ID logout
// @Summary logout
// @Description logout
// @Tags v1
// @Accept application/json
// @Produce application/json
// @Success 200 object http.OcsAgentResponse
// @Failure 400 object http.OcsAgentResponse
// @Failure 401 object http.OcsAgentResponse
// @Failure 500 object http.OcsAgentResponse
// @Param body body param.LogoutSessionParam true "logout session param"
// @Router /api/v1/logout [post]
func logoutHandler(c *gin.Context) {
	var param param.LogoutSessionParam
	if err := c.BindJSON(&param); err != nil {
		common.SendResponse(c, nil, err)
		return
	}
	err := session.Logout(c, param.SessionID)
	if err != nil {
		common.SendResponse(c, nil, err)
		return
	}
	common.SendResponse(c, nil, nil)
}

// @ID ssoToken
// @Summary create SSO token
// @Description create one-time SSO token for passwordless jump, returns AES encrypted token (same format as login)
// @Tags v1
// @Accept application/json
// @Produce application/json
// @Success 200 object http.OcsAgentResponse{data=string}
// @Router /api/v1/sso/token [post]
func ssoTokenHandler(c *gin.Context) {
	encryptedToken, err := session.CreateSSOToken(c)
	if err != nil {
		common.SendResponse(c, nil, err)
		return
	}
	common.SendResponse(c, encryptedToken, nil)
}

// @ID ssoExchange
// @Summary exchange SSO token for session
// @Description exchange SSO token from header for session_id, returns AES encrypted session_id (auth via ROUTE_SSO_EXCHANGE: ssotoken and Keys in header)
// @Tags v1
// @Accept application/json
// @Produce application/json
// @Param X-OCS-Header header string true "encrypted header with ssotoken and Keys"
// @Success 200 object http.OcsAgentResponse{data=string}
// @Router /api/v1/sso/exchange [get]
func ssoExchangeHandler(c *gin.Context) {
	encryptedSessionID, err := session.ExchangeSSOToken(c)
	if err != nil {
		common.SendResponse(c, nil, err)
		return
	}
	common.SendResponse(c, encryptedSessionID, nil)
}