270 lines
9.1 KiB
Go
270 lines
9.1 KiB
Go
// 声明式协议插件的鉴权：Bearer/Header/Query、AWS SigV4 与腾讯云 TC3 签名。
|
||
|
||
package app
|
||
|
||
import (
|
||
"bytes"
|
||
"crypto/hmac"
|
||
"crypto/sha256"
|
||
"encoding/hex"
|
||
"errors"
|
||
"fmt"
|
||
"io"
|
||
"net/http"
|
||
"net/url"
|
||
"sort"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/volcengine/volc-sdk-golang/base"
|
||
"yingce/backend/internal/protocol"
|
||
)
|
||
|
||
func applyProtocolAuth(req *http.Request, config providerConfig, auth protocol.ManifestAuth) error {
|
||
typeName := strings.ToLower(strings.TrimSpace(auth.Type))
|
||
if typeName == "" {
|
||
applyProviderAuth(req, config)
|
||
return nil
|
||
}
|
||
credential := protocolCredentialField(config, auth.Field)
|
||
switch typeName {
|
||
case "none":
|
||
return nil
|
||
case "bearer":
|
||
header := defaultString(strings.TrimSpace(auth.Header), "Authorization")
|
||
prefix := auth.Prefix
|
||
if prefix == "" {
|
||
prefix = "Bearer "
|
||
}
|
||
req.Header.Set(header, prefix+credential)
|
||
return nil
|
||
case "header", "api-key", "apikey":
|
||
header := strings.TrimSpace(auth.Header)
|
||
if header == "" {
|
||
return errors.New("插件 header 鉴权缺少 header 名称")
|
||
}
|
||
req.Header.Set(header, auth.Prefix+credential)
|
||
return nil
|
||
case "query":
|
||
name := defaultString(strings.TrimSpace(auth.Query), strings.TrimSpace(auth.Field))
|
||
if name == "" {
|
||
return errors.New("插件 query 鉴权缺少参数名")
|
||
}
|
||
query := req.URL.Query()
|
||
query.Set(name, auth.Prefix+credential)
|
||
req.URL.RawQuery = query.Encode()
|
||
return nil
|
||
case "basic":
|
||
username := auth.Username
|
||
if username == "" {
|
||
username = credential
|
||
}
|
||
password := protocolCredentialField(config, auth.SecretField)
|
||
req.SetBasicAuth(username, password)
|
||
return nil
|
||
case "anthropic":
|
||
req.Header.Set(defaultString(auth.Header, "x-api-key"), credential)
|
||
if req.Header.Get("anthropic-version") == "" {
|
||
req.Header.Set("anthropic-version", "2023-06-01")
|
||
}
|
||
return nil
|
||
case "google-api-key", "gemini":
|
||
req.Header.Set(defaultString(auth.Header, "x-goog-api-key"), credential)
|
||
return nil
|
||
case "volcengine-v4":
|
||
secret := protocolCredentialField(config, auth.SecretField)
|
||
if credential == "" || secret == "" {
|
||
return errors.New("火山引擎 V4 鉴权需要 Access Key 和 Secret Key")
|
||
}
|
||
credentials := base.Credentials{
|
||
AccessKeyID: credential, SecretAccessKey: secret,
|
||
Region: defaultString(strings.TrimSpace(auth.Region), "cn-north-1"),
|
||
Service: strings.TrimSpace(auth.Service),
|
||
}
|
||
if credentials.Service == "" {
|
||
return errors.New("火山引擎 V4 鉴权缺少 service")
|
||
}
|
||
signed := credentials.Sign(req)
|
||
*req = *signed
|
||
return nil
|
||
case "aws-sigv4":
|
||
secret := protocolCredentialField(config, auth.SecretField)
|
||
return signProtocolAWSV4(req, credential, secret, auth)
|
||
case "tc3":
|
||
secret := protocolCredentialField(config, auth.SecretField)
|
||
return signProtocolTC3(req, credential, secret, auth)
|
||
default:
|
||
return fmt.Errorf("插件声明了尚未启用的鉴权驱动 %s", auth.Type)
|
||
}
|
||
}
|
||
|
||
func signProtocolAWSV4(req *http.Request, accessKey, secretKey string, auth protocol.ManifestAuth) error {
|
||
if strings.TrimSpace(accessKey) == "" || strings.TrimSpace(secretKey) == "" {
|
||
return errors.New("AWS SigV4 鉴权需要 Access Key ID 和 Secret Access Key")
|
||
}
|
||
serviceName := defaultString(strings.TrimSpace(auth.Service), "bedrock")
|
||
region := strings.TrimSpace(auth.Region)
|
||
if region == "" {
|
||
parts := strings.Split(strings.ToLower(req.URL.Hostname()), ".")
|
||
for index, part := range parts {
|
||
if strings.HasPrefix(part, serviceName) && index+1 < len(parts) {
|
||
region = parts[index+1]
|
||
break
|
||
}
|
||
}
|
||
}
|
||
if region == "" {
|
||
return errors.New("AWS SigV4 鉴权无法从 Base URL 推断 region，请使用包含区域的 Bedrock Runtime 地址")
|
||
}
|
||
payload, err := protocolRequestPayload(req)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
now := time.Now().UTC()
|
||
amzDate := now.Format("20060102T150405Z")
|
||
dateStamp := now.Format("20060102")
|
||
payloadHash := sha256Hex(payload)
|
||
req.Header.Set("X-Amz-Date", amzDate)
|
||
req.Header.Set("X-Amz-Content-Sha256", payloadHash)
|
||
canonicalHeaders, signedHeaders := protocolCanonicalHeaders(req)
|
||
canonicalRequest := strings.Join([]string{
|
||
req.Method,
|
||
defaultString(req.URL.EscapedPath(), "/"),
|
||
req.URL.Query().Encode(),
|
||
canonicalHeaders,
|
||
signedHeaders,
|
||
payloadHash,
|
||
}, "\n")
|
||
scope := strings.Join([]string{dateStamp, region, serviceName, "aws4_request"}, "/")
|
||
stringToSign := strings.Join([]string{"AWS4-HMAC-SHA256", amzDate, scope, sha256Hex([]byte(canonicalRequest))}, "\n")
|
||
dateKey := protocolHMAC([]byte("AWS4"+secretKey), dateStamp)
|
||
regionKey := protocolHMAC(dateKey, region)
|
||
serviceKey := protocolHMAC(regionKey, serviceName)
|
||
signingKey := protocolHMAC(serviceKey, "aws4_request")
|
||
signature := hex.EncodeToString(protocolHMAC(signingKey, stringToSign))
|
||
req.Header.Set("Authorization", fmt.Sprintf("AWS4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s", accessKey, scope, signedHeaders, signature))
|
||
return nil
|
||
}
|
||
|
||
func signProtocolTC3(req *http.Request, secretID, secretKey string, auth protocol.ManifestAuth) error {
|
||
if strings.TrimSpace(secretID) == "" || strings.TrimSpace(secretKey) == "" {
|
||
return errors.New("腾讯云 TC3 鉴权需要 SecretId 和 SecretKey")
|
||
}
|
||
serviceName := defaultString(strings.TrimSpace(auth.Service), "hunyuan")
|
||
payload, err := protocolRequestPayload(req)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
now := time.Now().UTC()
|
||
timestamp := now.Unix()
|
||
dateStamp := now.Format("2006-01-02")
|
||
contentType := defaultString(req.Header.Get("Content-Type"), "application/json")
|
||
req.Header.Set("Content-Type", contentType)
|
||
req.Header.Set("X-TC-Timestamp", strconv.FormatInt(timestamp, 10))
|
||
if region := strings.TrimSpace(auth.Region); region != "" {
|
||
req.Header.Set("X-TC-Region", region)
|
||
}
|
||
canonicalHeaders := "content-type:" + strings.ToLower(strings.TrimSpace(contentType)) + "\n" + "host:" + strings.ToLower(req.URL.Host) + "\n"
|
||
signedHeaders := "content-type;host"
|
||
canonicalRequest := strings.Join([]string{req.Method, defaultString(req.URL.EscapedPath(), "/"), req.URL.Query().Encode(), canonicalHeaders, signedHeaders, sha256Hex(payload)}, "\n")
|
||
scope := dateStamp + "/" + serviceName + "/tc3_request"
|
||
stringToSign := strings.Join([]string{"TC3-HMAC-SHA256", strconv.FormatInt(timestamp, 10), scope, sha256Hex([]byte(canonicalRequest))}, "\n")
|
||
secretDate := protocolHMAC([]byte("TC3"+secretKey), dateStamp)
|
||
secretService := protocolHMAC(secretDate, serviceName)
|
||
secretSigning := protocolHMAC(secretService, "tc3_request")
|
||
signature := hex.EncodeToString(protocolHMAC(secretSigning, stringToSign))
|
||
req.Header.Set("Authorization", fmt.Sprintf("TC3-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s", secretID, scope, signedHeaders, signature))
|
||
return nil
|
||
}
|
||
|
||
func protocolRequestPayload(req *http.Request) ([]byte, error) {
|
||
if req.Body == nil {
|
||
return nil, nil
|
||
}
|
||
var reader io.ReadCloser
|
||
var err error
|
||
if req.GetBody != nil {
|
||
reader, err = req.GetBody()
|
||
} else {
|
||
reader = req.Body
|
||
}
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
data, err := io.ReadAll(reader)
|
||
if req.GetBody != nil {
|
||
_ = reader.Close()
|
||
} else {
|
||
req.Body = io.NopCloser(bytes.NewReader(data))
|
||
}
|
||
return data, err
|
||
}
|
||
|
||
func protocolCanonicalHeaders(req *http.Request) (string, string) {
|
||
values := map[string]string{"host": strings.ToLower(req.URL.Host)}
|
||
for name, entries := range req.Header {
|
||
lower := strings.ToLower(strings.TrimSpace(name))
|
||
if lower == "authorization" || lower == "user-agent" || lower == "content-length" || lower == "expect" {
|
||
continue
|
||
}
|
||
cleaned := make([]string, 0, len(entries))
|
||
for _, entry := range entries {
|
||
cleaned = append(cleaned, strings.Join(strings.Fields(entry), " "))
|
||
}
|
||
values[lower] = strings.Join(cleaned, ",")
|
||
}
|
||
keys := make([]string, 0, len(values))
|
||
for key := range values {
|
||
keys = append(keys, key)
|
||
}
|
||
sort.Strings(keys)
|
||
var canonical strings.Builder
|
||
for _, key := range keys {
|
||
canonical.WriteString(key)
|
||
canonical.WriteByte(':')
|
||
canonical.WriteString(values[key])
|
||
canonical.WriteByte('\n')
|
||
}
|
||
return canonical.String(), strings.Join(keys, ";")
|
||
}
|
||
|
||
func protocolHMAC(key []byte, value string) []byte {
|
||
mac := hmac.New(sha256.New, key)
|
||
_, _ = mac.Write([]byte(value))
|
||
return mac.Sum(nil)
|
||
}
|
||
|
||
func sha256Hex(value []byte) string {
|
||
hash := sha256.Sum256(value)
|
||
return hex.EncodeToString(hash[:])
|
||
}
|
||
|
||
func protocolCredentialField(config providerConfig, field string) string {
|
||
switch strings.ToLower(strings.TrimSpace(field)) {
|
||
case "secretkey", "secret_key", "secret":
|
||
return strings.TrimSpace(config.SecretKey)
|
||
default:
|
||
return strings.TrimSpace(config.APIKey)
|
||
}
|
||
}
|
||
|
||
func protocolRequestURL(baseURL string, spec protocol.RequestSpec) (string, error) {
|
||
if !spec.OriginPath {
|
||
return appendProtocolQuery(apiURL(baseURL, spec.Path), spec.Query)
|
||
}
|
||
base, err := url.Parse(strings.TrimSpace(baseURL))
|
||
if err != nil || base.Scheme == "" || base.Host == "" {
|
||
return "", fmt.Errorf("协议根路径请求的 Base URL 无效")
|
||
}
|
||
requestPath, err := url.Parse(spec.Path)
|
||
if err != nil || !strings.HasPrefix(requestPath.Path, "/") {
|
||
return "", fmt.Errorf("协议根路径请求必须使用绝对路径")
|
||
}
|
||
base.Path = requestPath.Path
|
||
base.RawPath = requestPath.RawPath
|
||
base.RawQuery = requestPath.RawQuery
|
||
base.Fragment = ""
|
||
return appendProtocolQuery(base.String(), spec.Query)
|
||
}
|