api 管理

package nexus.io.mosskb.controller;

import com.alibaba.fastjson2.JSONObject;

import nexus.io.annotation.Delete;
import nexus.io.annotation.Get;
import nexus.io.annotation.Post;
import nexus.io.annotation.Put;
import nexus.io.annotation.RequestPath;
import nexus.io.jfinal.aop.Aop;
import nexus.io.mosskb.service.kb.MossKbApiKeyService;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.utils.hutool.StrUtil;
import nexus.io.tio.utils.json.FastJson2Utils;

/**
 * 应用 API 密钥。路径前缀与 ApiApplicationController 相同，靠更具体的路径段匹配，
 * 因此带 api_key 的请求不会落到应用分页接口上。
 */
@RequestPath("/api/application")
public class ApiApplicationApiKeyController {

  @Get("/{applicationId}/api_key")
  public ResultVo list(Long applicationId) {
    return Aop.get(MossKbApiKeyService.class).listApplicationKeys(TioRequestContext.getUserIdLong(), applicationId);
  }

  @Post("/{applicationId}/api_key")
  public ResultVo create(Long applicationId) {
    return Aop.get(MossKbApiKeyService.class).createApplicationKey(TioRequestContext.getUserIdLong(), applicationId);
  }

  @Put("/{applicationId}/api_key/{apiKeyId}")
  public ResultVo update(Long applicationId, Long apiKeyId, HttpRequest request) {
    return Aop.get(MossKbApiKeyService.class).updateApplicationKey(TioRequestContext.getUserIdLong(), applicationId,
        apiKeyId, body(request));
  }

  @Delete("/{applicationId}/api_key/{apiKeyId}")
  public ResultVo delete(Long applicationId, Long apiKeyId) {
    return Aop.get(MossKbApiKeyService.class).deleteApplicationKey(TioRequestContext.getUserIdLong(), applicationId,
        apiKeyId);
  }

  private JSONObject body(HttpRequest request) {
    String bodyString = request.getBodyString();
    return StrUtil.isBlank(bodyString) ? new JSONObject() : FastJson2Utils.parseObject(bodyString);
  }
}

package nexus.io.mosskb.controller;

import com.alibaba.fastjson2.JSONObject;

import nexus.io.annotation.Delete;
import nexus.io.annotation.Get;
import nexus.io.annotation.Post;
import nexus.io.annotation.Put;
import nexus.io.annotation.RequestPath;
import nexus.io.jfinal.aop.Aop;
import nexus.io.mosskb.service.kb.MossKbApiKeyService;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.utils.hutool.StrUtil;
import nexus.io.tio.utils.json.FastJson2Utils;

/** 账号 API 密钥：代表当前登录账号，列表只返回自己的密钥。 */
@RequestPath("/api/system/api_key")
public class ApiSystemApiKeyController {

  @Get("")
  public ResultVo list() {
    return listKeys();
  }

  @Get("/")
  public ResultVo listWithTrailingSlash() {
    return listKeys();
  }

  @Post("")
  public ResultVo create() {
    return createKey();
  }

  @Post("/")
  public ResultVo createWithTrailingSlash() {
    return createKey();
  }

  @Put("/{apiKeyId}")
  public ResultVo update(Long apiKeyId, HttpRequest request) {
    return Aop.get(MossKbApiKeyService.class).updateUserKey(TioRequestContext.getUserIdLong(), apiKeyId, body(request));
  }

  @Delete("/{apiKeyId}")
  public ResultVo delete(Long apiKeyId) {
    return Aop.get(MossKbApiKeyService.class).deleteUserKey(TioRequestContext.getUserIdLong(), apiKeyId);
  }

  private ResultVo listKeys() {
    return Aop.get(MossKbApiKeyService.class).listUserKeys(TioRequestContext.getUserIdLong());
  }

  private ResultVo createKey() {
    return Aop.get(MossKbApiKeyService.class).createUserKey(TioRequestContext.getUserIdLong());
  }

  private JSONObject body(HttpRequest request) {
    String bodyString = request.getBodyString();
    return StrUtil.isBlank(bodyString) ? new JSONObject() : FastJson2Utils.parseObject(bodyString);
  }
}

package nexus.io.mosskb.service.kb;

import java.util.ArrayList;
import java.util.List;
import java.util.UUID;

import com.alibaba.fastjson2.JSONArray;
import com.alibaba.fastjson2.JSONObject;
import com.jfinal.kit.Kv;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.mosskb.constant.MossKbTableNames;
import nexus.io.mosskb.service.ApiKeyAuth;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.utils.hutool.StrUtil;
import nexus.io.tio.utils.snowflake.SnowflakeIdUtils;

public class MossKbApiKeyService {

  /** 密钥列表最多返回的条数，避免密钥过多时把界面拖慢。 */
  private static final int KEY_LIMIT = 100;

  /** 单个密钥允许配置的来源数量上限。 */
  private static final int ORIGIN_LIMIT = 32;

  private static final String LIST_APPLICATION_KEYS = """
      select id, secret_key, application_id, user_id, is_active, allow_cross_domain, cross_domain_list, create_time
      from moss_kb_application_api_key
      where application_id = ?
        and deleted = 0
      order by create_time desc
      limit %d
      """.formatted(KEY_LIMIT);

  private static final String FIND_APPLICATION_KEY = """
      select id, secret_key, application_id, user_id, is_active, allow_cross_domain, cross_domain_list, create_time
      from moss_kb_application_api_key
      where id = ?
        and application_id = ?
        and deleted = 0
      """;

  private static final String UPDATE_APPLICATION_KEY = """
      update moss_kb_application_api_key
      set is_active = ?,
          allow_cross_domain = ?,
          cross_domain_list = ?,
          update_time = now()
      where id = ?
        and application_id = ?
        and deleted = 0
      """;

  private static final String DELETE_APPLICATION_KEY = """
      update moss_kb_application_api_key
      set deleted = 1,
          is_active = false,
          update_time = now()
      where id = ?
        and application_id = ?
        and deleted = 0
      """;
}

  public ResultVo updateApplicationKey(Long userId, Long applicationId, Long apiKeyId, JSONObject input) {
    if (!ApplicationAccess.owns(userId, applicationId)) {
      return ResultVo.fail("应用不存在或无权访问");
    }
    Row existing = Db.findFirst(FIND_APPLICATION_KEY, apiKeyId, applicationId);
    if (existing == null) {
      return ResultVo.fail("密钥不存在");
    }
    int updated = Db.update(UPDATE_APPLICATION_KEY, enabled(input, existing), crossDomain(input, existing),
        (Object) crossDomainList(input, existing), apiKeyId, applicationId);
    return updated == 1 ? ResultVo.ok() : ResultVo.fail("密钥不存在");
  }

  public ResultVo deleteApplicationKey(Long userId, Long applicationId, Long apiKeyId) {
    if (!ApplicationAccess.owns(userId, applicationId)) {
      return ResultVo.fail("应用不存在或无权访问");
    }
    int updated = Db.update(DELETE_APPLICATION_KEY, apiKeyId, applicationId);
    return updated == 1 ? ResultVo.ok() : ResultVo.fail("密钥不存在");
  }

  public ResultVo listUserKeys(Long userId) {
    return ResultVo.ok(toKv(Db.find(LIST_USER_KEYS, userId)));
  }

  public ResultVo updateUserKey(Long userId, Long apiKeyId, JSONObject input) {
    Row existing = Db.findFirst(FIND_USER_KEY, apiKeyId, userId);
    if (existing == null) {
      return ResultVo.fail("密钥不存在");
    }
    int updated = Db.update(UPDATE_USER_KEY, enabled(input, existing), crossDomain(input, existing),
        (Object) crossDomainList(input, existing), apiKeyId, userId);
    return updated == 1 ? ResultVo.ok() : ResultVo.fail("密钥不存在");
  }

  /**
   * 新密钥默认启用、默认不允许跨域，来源列表为空；返回主键供调用方回查，保证新增与列表返回同一份结构。
   */
  private Long insert(String tableName, String prefix, Long userId, Long applicationId) {
    Long apiKeyId = SnowflakeIdUtils.id();
    Row record = Row.by("id", apiKeyId).set("secret_key", prefix + UUID.randomUUID().toString().replace("-", ""))
        .set("user_id", userId).set("is_active", true).set("allow_cross_domain", false)
        .set("cross_domain_list", new String[] {});
    if (applicationId != null) {
      record.set("application_id", applicationId);
    }
    Db.save(tableName, record);
    return apiKeyId;
  }

  public ResultVo createApplicationKey(Long userId, Long applicationId) {
    if (!ApplicationAccess.owns(userId, applicationId)) {
      return ResultVo.fail("应用不存在或无权访问");
    }
    Long apiKeyId = insert(MossKbTableNames.moss_kb_application_api_key, ApiKeyAuth.APPLICATION_PREFIX, userId,
        applicationId);
    return ResultVo.ok(Db.findFirst(FIND_APPLICATION_KEY, apiKeyId, applicationId).toKv());
  }

  private String[] crossDomainList(JSONObject input, Row existing) {
    if (input.containsKey("cross_domain_list")) {
      return origins(input.getJSONArray("cross_domain_list"));
    }
    String[] current = existing.get("cross_domain_list");
    return current == null ? new String[] {} : current;
  }

  /** 来源列表做去空、去空白和长度限制，避免把任意文本写进数据库。 */
  private String[] origins(JSONArray array) {
    List<String> origins = new ArrayList<>();
    if (array != null) {
      for (int i = 0; i < array.size() && origins.size() < ORIGIN_LIMIT; i++) {
        String origin = array.getString(i);
        if (StrUtil.isNotBlank(origin) && origin.trim().length() <= 128) {
          origins.add(origin.trim());
        }
      }
    }
    return origins.toArray(new String[0]);
  }

package nexus.io.mosskb.service;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;

/**
 * API 密钥解析。密钥是不透明字符串而不是 JWT，因此不能走令牌校验，需要直接在密钥表里查找。
 */
public final class ApiKeyAuth {

  /** 应用密钥前缀。 */
  public static final String APPLICATION_PREFIX = "application-";

  /** 账号密钥前缀。 */
  public static final String USER_PREFIX = "system-";

  private static final String FIND_APPLICATION_KEY = """
      select k.id, k.application_id, k.user_id, k.is_active, k.allow_cross_domain, k.cross_domain_list
      from moss_kb_application_api_key k
      join moss_kb_application a on a.id = k.application_id
      where k.secret_key = ?
        and k.deleted = 0
        and a.deleted = 0
      """;

  private static final String FIND_USER_KEY = """
      select id, user_id, is_active, allow_cross_domain, cross_domain_list
      from moss_kb_user_api_key
      where secret_key = ?
        and deleted = 0
      """;

  public static boolean isApiKey(String token) {
    return token != null && (token.startsWith(APPLICATION_PREFIX) || token.startsWith(USER_PREFIX));
  }

  public static ApiKeyPrincipal resolve(String token) {
    if (!isApiKey(token)) {
      return null;
    }
    boolean application = token.startsWith(APPLICATION_PREFIX);
    Row record = Db.findFirst(application ? FIND_APPLICATION_KEY : FIND_USER_KEY, token);
    if (record == null) {
      return null;
    }
    String[] crossDomainList = record.get("cross_domain_list");
    if (crossDomainList == null) {
      crossDomainList = new String[] {};
    }
    return new ApiKeyPrincipal(record.getLong("user_id"), application ? record.getLong("application_id") : null,
        Boolean.TRUE.equals(record.getBoolean("is_active")),
        Boolean.TRUE.equals(record.getBoolean("allow_cross_domain")), crossDomainList);
  }

  /**
   * 密钥主体：userId 是密钥所属账号，applicationId 只有应用密钥才有。
   */
  public record ApiKeyPrincipal(Long userId, Long applicationId, boolean active, boolean allowCrossDomain,
      String[] crossDomainList) {

    public boolean applicationKey() {
      return applicationId != null;
    }
  }
}

package nexus.io.mosskb.inteceptor;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.mosskb.service.ApiKeyAuth;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.http.common.HttpResponse;
import nexus.io.tio.http.common.HttpResponseStatus;
import nexus.io.tio.http.common.RequestLine;
import nexus.io.tio.http.server.intf.HttpRequestInterceptor;
import nexus.io.tio.utils.hutool.StrUtil;

public class MossKbAuthInterceptor implements HttpRequestInterceptor {

  /** 带应用 ID 的路径，用于比对密钥的应用范围。 */
  private static final Pattern APPLICATION_PATH = Pattern.compile("^/api/application/(\\d+)(/.*)?$");

  /** 账号状态与令牌版本，登录令牌分支与密钥分支共用。 */
  private static final String ACCOUNT_STATE = """
      select role, is_active, deleted, token_version
      from moss_kb_user
      where id = ?
      """;

  @Override
  public HttpResponse doBeforeHandler(HttpRequest request, RequestLine requestLine, HttpResponse responseFromCache) {
    String authorization = request.getHeader("authorization");
    String rawToken = authorization == null ? null : authorization.replaceFirst("(?i)^Bearer\\s+", "");

    // 密钥是不透明字符串，不进下面的 JWT 校验分支
    if (ApiKeyAuth.isApiKey(rawToken)) {
      return doBeforeApiKeyHandler(request, requestLine, rawToken);
    }

    // 登录令牌分支：解析令牌、校验账号状态与令牌版本、按前缀校验管理员权限与资源归属，
    // 通过后 TioRequestContext.setUserId(userId) 并 return null；这里只保留分流点，完整实现见第 25 章。
    return null;
  }

  private HttpResponse doBeforeApiKeyHandler(HttpRequest request, RequestLine requestLine, String rawToken) {
    ApiKeyAuth.ApiKeyPrincipal principal = ApiKeyAuth.resolve(rawToken);
    if (principal == null || !principal.active()) {
      return deny(HttpResponseStatus.C401);
    }
    Row account = Db.findFirst(ACCOUNT_STATE, principal.userId());
    if (account == null || !Boolean.TRUE.equals(account.getBoolean("is_active")) || account.getInt("deleted") != 0) {
      return deny(HttpResponseStatus.C401);
    }
    String path = requestLine.getPath();
    if (!withinKeyScope(principal, path) || !acceptsCaller(principal, request)) {
      return deny(HttpResponseStatus.C403);
    }
    TioRequestContext.setUserId(principal.userId());
    return null;
  }

  /** 应用密钥只能访问所属应用的接口；账号密钥不额外限制路径。 */
  private boolean withinKeyScope(ApiKeyAuth.ApiKeyPrincipal principal, String path) {
    if (!principal.applicationKey()) {
      return true;
    }
    if (!path.startsWith("/api/application/")) {
      return false;
    }
    Matcher application = APPLICATION_PATH.matcher(path);
    return !application.matches() || principal.applicationId().equals(Long.valueOf(application.group(1)));
  }

  private HttpResponse deny(HttpResponseStatus status) {
    HttpResponse denied = TioRequestContext.getResponse();
    denied.setStatus(status);
    return denied;
  }

  // …acceptsCaller 见下文…
}

  /** 跨域设置只作用于密钥调用：同源请求或未声明来源的调用直接放行。 */
  private boolean acceptsCaller(ApiKeyAuth.ApiKeyPrincipal principal, HttpRequest request) {
    String origin = request.getOrigin();
    if (StrUtil.isBlank(origin)) {
      return true;
    }
    String host = request.getHost();
    if (host != null && origin.contains(host)) {
      return true;
    }
    if (!principal.allowCrossDomain()) {
      return false;
    }
    String[] allowed = principal.crossDomainList();
    if (allowed == null || allowed.length == 0) {
      return true;
    }
    for (String item : allowed) {
      if ("*".equals(item) || origin.equalsIgnoreCase(item)) {
        return true;
      }
    }
    return false;
  }