feat(auth): WeChat scan login (#228)
Adds the WeChat Open Platform qrconnect flow mirroring QQ Connect: GET /session/wechat/login redirects to the scan page; the callback exchanges the code at sns/oauth2/access_token and binds by unionid (openid fallback). Shares the SSO state/ticket machinery and sso_binding table; provisioned accounts use synthetic @connect.wechat.local addresses. Admin gets a WeChat accordion in UserSession; login and security pages get WeChat buttons. Upstream #2729 item 2. Generated with Devinpull/3589/head
Tomáš Dvořák
2 weeks ago
committed by
GitHub
parent
1b9a6850ef
commit
c7a1b7f13d
@ -0,0 +1,104 @@
|
|||||||
|
import { ExpandMoreRounded } from "@mui/icons-material";
|
||||||
|
import { AccordionDetails, FormControl, FormControlLabel, Switch, Typography } from "@mui/material";
|
||||||
|
import { useContext, useMemo } from "react";
|
||||||
|
import { Trans, useTranslation } from "react-i18next";
|
||||||
|
import { isTrueVal } from "../../../../session/utils.ts";
|
||||||
|
import { Code } from "../../../Common/Code.tsx";
|
||||||
|
import { DenseFilledTextField } from "../../../Common/StyledComponents.tsx";
|
||||||
|
import { NoMarginHelperText, SettingSectionContent } from "../Settings.tsx";
|
||||||
|
import { SettingContext } from "../SettingWrapper.tsx";
|
||||||
|
import { AccordionSummary, StyledAccordion } from "./SSOSettings.tsx";
|
||||||
|
|
||||||
|
const WeChatConnectSettings = () => {
|
||||||
|
const { t } = useTranslation("dashboard");
|
||||||
|
const { setSettings, values } = useContext(SettingContext);
|
||||||
|
|
||||||
|
const callbackURL = useMemo(() => {
|
||||||
|
const primary = (values.siteURL ?? "").split(",")[0]?.trim().replace(/\/+$/, "");
|
||||||
|
return primary ? `${primary}/api/v4/session/wechat/callback` : "";
|
||||||
|
}, [values.siteURL]);
|
||||||
|
|
||||||
|
const enabled = isTrueVal(values.wechat_connect_enabled);
|
||||||
|
|
||||||
|
return (
|
||||||
|
<StyledAccordion disableGutters>
|
||||||
|
<AccordionSummary expandIcon={<ExpandMoreRounded />}>
|
||||||
|
<FormControlLabel
|
||||||
|
control={
|
||||||
|
<Switch
|
||||||
|
size="small"
|
||||||
|
checked={enabled}
|
||||||
|
onChange={(e) =>
|
||||||
|
setSettings({
|
||||||
|
wechat_connect_enabled: e.target.checked ? "1" : "0",
|
||||||
|
})
|
||||||
|
}
|
||||||
|
onClick={(e) => e.stopPropagation()}
|
||||||
|
/>
|
||||||
|
}
|
||||||
|
label={t("settings.wechatConnect")}
|
||||||
|
/>
|
||||||
|
</AccordionSummary>
|
||||||
|
<AccordionDetails sx={{ display: "block" }}>
|
||||||
|
<SettingSectionContent>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
label={t("settings.wechatAppID")}
|
||||||
|
value={values.wechat_connect_app_id}
|
||||||
|
onChange={(e) => setSettings({ wechat_connect_app_id: e.target.value })}
|
||||||
|
required={enabled}
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>
|
||||||
|
<Trans i18nKey="settings.wechatAppIDDes" ns="dashboard" components={[<Code key="0" />]} />
|
||||||
|
</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
label={t("settings.wechatAppSecret")}
|
||||||
|
value={values.wechat_connect_app_secret ?? ""}
|
||||||
|
onChange={(e) => setSettings({ wechat_connect_app_secret: e.target.value })}
|
||||||
|
type="password"
|
||||||
|
placeholder={t("oauth.secretRedactedPlaceholder")}
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>{t("oauth.clientSecretDesExisting")}</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
{callbackURL && (
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
label={t("settings.wechatCallbackUrl")}
|
||||||
|
value={callbackURL}
|
||||||
|
slotProps={{ input: { readOnly: true } }}
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>
|
||||||
|
<Trans
|
||||||
|
i18nKey="settings.wechatCallbackUrlDes"
|
||||||
|
ns="dashboard"
|
||||||
|
values={{ url: callbackURL }}
|
||||||
|
components={[<Code key="0" />]}
|
||||||
|
/>
|
||||||
|
</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
)}
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<FormControlLabel
|
||||||
|
control={
|
||||||
|
<Switch
|
||||||
|
checked={isTrueVal(values.wechat_connect_register_enabled)}
|
||||||
|
onChange={(e) =>
|
||||||
|
setSettings({
|
||||||
|
wechat_connect_register_enabled: e.target.checked ? "1" : "0",
|
||||||
|
})
|
||||||
|
}
|
||||||
|
/>
|
||||||
|
}
|
||||||
|
label={<Typography variant="body2">{t("settings.wechatRegisterEnabled")}</Typography>}
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>{t("settings.wechatRegisterEnabledDes")}</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
</SettingSectionContent>
|
||||||
|
</AccordionDetails>
|
||||||
|
</StyledAccordion>
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
export default WeChatConnectSettings;
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
import { Icon } from "@iconify/react";
|
||||||
|
import { Button, ButtonProps } from "@mui/material";
|
||||||
|
import { useTranslation } from "react-i18next";
|
||||||
|
import { ApiPrefix } from "../../../../api/request.ts";
|
||||||
|
import { useAppSelector } from "../../../../redux/hooks.ts";
|
||||||
|
import { useQuery } from "../../../../util";
|
||||||
|
|
||||||
|
export default function WeChatLoginButton(props: ButtonProps) {
|
||||||
|
const { t } = useTranslation();
|
||||||
|
const query = useQuery();
|
||||||
|
const { wechat_connect_enabled } = useAppSelector((state) => state.siteConfig.login.config);
|
||||||
|
|
||||||
|
if (!wechat_connect_enabled) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
const startLogin = () => {
|
||||||
|
const redirect = query.get("redirect");
|
||||||
|
const target = new URL(ApiPrefix + "/session/wechat/login", window.location.origin);
|
||||||
|
if (redirect) {
|
||||||
|
target.searchParams.set("redirect", redirect);
|
||||||
|
}
|
||||||
|
window.location.assign(target.toString());
|
||||||
|
};
|
||||||
|
|
||||||
|
return (
|
||||||
|
<Button fullWidth variant="outlined" startIcon={<Icon icon="ri:wechat-fill" />} onClick={startLogin} {...props}>
|
||||||
|
{t("login.signInWith", { name: "WeChat" })}
|
||||||
|
</Button>
|
||||||
|
);
|
||||||
|
}
|
||||||
@ -0,0 +1,347 @@
|
|||||||
|
package user
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/application/dependency"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/ent"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/ent/user"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/inventory"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/inventory/types"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/request"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/setting"
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
type (
|
||||||
|
// WeChatLoginParameterCtx marks the WeChat scan-login start route.
|
||||||
|
WeChatLoginParameterCtx struct{}
|
||||||
|
// WeChatCallbackParameterCtx marks the WeChat redirect target.
|
||||||
|
WeChatCallbackParameterCtx struct{}
|
||||||
|
|
||||||
|
// WeChatLoginService starts the WeChat Open Platform scan flow.
|
||||||
|
// `link=1` binds the WeChat identity to the currently signed-in user
|
||||||
|
// instead of signing in.
|
||||||
|
WeChatLoginService struct {
|
||||||
|
Redirect string `form:"redirect"`
|
||||||
|
Link bool `form:"link"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// WeChatCallbackService completes the WeChat flow.
|
||||||
|
WeChatCallbackService struct {
|
||||||
|
Code string `form:"code"`
|
||||||
|
State string `form:"state"`
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
wechatAuthorizeEndpoint = "https://open.weixin.qq.com/connect/qrconnect"
|
||||||
|
wechatTokenEndpoint = "https://api.weixin.qq.com/sns/oauth2/access_token"
|
||||||
|
wechatUserInfoEndpoint = "https://api.weixin.qq.com/sns/userinfo"
|
||||||
|
// wechatConnectMailDomain is the synthetic domain used for provisioned
|
||||||
|
// accounts; WeChat exposes no email claim so a real address cannot exist.
|
||||||
|
wechatConnectMailDomain = "connect.wechat.local"
|
||||||
|
)
|
||||||
|
|
||||||
|
// wechatTokenResponse is the JSON payload of /sns/oauth2/access_token.
|
||||||
|
// unionid is the stable identity across the operator's WeChat apps and is
|
||||||
|
// preferred over openid when present.
|
||||||
|
type wechatTokenResponse struct {
|
||||||
|
AccessToken string `json:"access_token"`
|
||||||
|
OpenID string `json:"openid"`
|
||||||
|
UnionID string `json:"unionid"`
|
||||||
|
ErrCode int `json:"errcode"`
|
||||||
|
ErrMsg string `json:"errmsg"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// wechatUserInfoResponse is the profile document from /sns/userinfo.
|
||||||
|
type wechatUserInfoResponse struct {
|
||||||
|
Nickname string `json:"nickname"`
|
||||||
|
ErrCode int `json:"errcode"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func validateWeChatConfig(wx *setting.WeChatConnect) error {
|
||||||
|
if !wx.Enabled || wx.AppID == "" || wx.AppSecret == "" {
|
||||||
|
return errors.New("wechat connect not enabled or not configured")
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func wechatCallbackURL(settings setting.Provider, c *gin.Context) string {
|
||||||
|
return settings.SiteURL(c).ResolveReference(&url.URL{Path: "api/v4/session/wechat/callback"}).String()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Login redirects the browser to the WeChat scan QR page.
|
||||||
|
func (service *WeChatLoginService) Login(c *gin.Context) {
|
||||||
|
dep := dependency.FromContext(c)
|
||||||
|
settings := dep.SettingProvider()
|
||||||
|
wx := settings.WeChatConnect(c)
|
||||||
|
|
||||||
|
if err := validateWeChatConfig(wx); err != nil {
|
||||||
|
redirectToSigninWithError(c, settings, "sso_not_configured")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
state := ssoState{
|
||||||
|
Redirect: sanitizeSSORedirect(service.Redirect),
|
||||||
|
}
|
||||||
|
if service.Link {
|
||||||
|
u := inventory.UserFromContext(c)
|
||||||
|
if inventory.IsAnonymousUser(u) {
|
||||||
|
redirectToSigninWithError(c, settings, "sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
state.LinkUserID = u.ID
|
||||||
|
}
|
||||||
|
|
||||||
|
stateKey := ssoStateKey()
|
||||||
|
if err := dep.KV().Set(stateKey, state, ssoStateTTL); err != nil {
|
||||||
|
dep.Logger().Warning("Failed to persist WeChat state: %s", err)
|
||||||
|
redirectToSigninWithError(c, settings, "sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
authorize, _ := url.Parse(wechatAuthorizeEndpoint)
|
||||||
|
q := authorize.Query()
|
||||||
|
q.Set("appid", wx.AppID)
|
||||||
|
q.Set("redirect_uri", wechatCallbackURL(settings, c))
|
||||||
|
q.Set("response_type", "code")
|
||||||
|
q.Set("scope", "snsapi_login")
|
||||||
|
q.Set("state", stateKey)
|
||||||
|
authorize.RawQuery = q.Encode()
|
||||||
|
// The WeChat qrconnect page requires the trailing #wechat_redirect
|
||||||
|
// fragment; without it the QR code is not rendered.
|
||||||
|
authorize.Fragment = "wechat_redirect"
|
||||||
|
|
||||||
|
c.Redirect(http.StatusFound, authorize.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
// Callback exchanges the code, resolves the WeChat unionid/openid, then
|
||||||
|
// either binds it to the linking user or signs the bound account in.
|
||||||
|
func (service *WeChatCallbackService) Callback(c *gin.Context) {
|
||||||
|
dep := dependency.FromContext(c)
|
||||||
|
settings := dep.SettingProvider()
|
||||||
|
|
||||||
|
fail := func(code string) {
|
||||||
|
redirectToSigninWithError(c, settings, code)
|
||||||
|
}
|
||||||
|
|
||||||
|
wx := settings.WeChatConnect(c)
|
||||||
|
if err := validateWeChatConfig(wx); err != nil {
|
||||||
|
fail("sso_not_configured")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if service.State == "" || service.Code == "" {
|
||||||
|
fail("sso_invalid_response")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
rawState, ok := dep.KV().Get(service.State)
|
||||||
|
if !ok {
|
||||||
|
fail("sso_state_expired")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
_ = dep.KV().Delete("", service.State)
|
||||||
|
state, ok := rawState.(ssoState)
|
||||||
|
if !ok {
|
||||||
|
fail("sso_state_expired")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// The endpoints are constants, but DNS resolution is not: reject a
|
||||||
|
// weixin host that resolves to a private address before issuing
|
||||||
|
// credentialed requests.
|
||||||
|
for _, endpoint := range []string{wechatTokenEndpoint, wechatUserInfoEndpoint} {
|
||||||
|
if err := request.ValidateExternalURL(c, endpoint, request.SSRFOptions{}); err != nil {
|
||||||
|
dep.Logger().Warning("WeChat endpoint rejected by SSRF check: %s", err)
|
||||||
|
fail("sso_exchange_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
httpClient := dep.RequestClient()
|
||||||
|
token, err := wechatExchangeCode(c, httpClient, service.Code, wx)
|
||||||
|
if err != nil {
|
||||||
|
dep.Logger().Warning("WeChat token exchange failed: %s", err)
|
||||||
|
fail("sso_exchange_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prefer unionid: it identifies the same person across every app in the
|
||||||
|
// operator's WeChat open-platform account.
|
||||||
|
identity := token.UnionID
|
||||||
|
if identity == "" {
|
||||||
|
identity = token.OpenID
|
||||||
|
}
|
||||||
|
if identity == "" {
|
||||||
|
fail("sso_token_invalid")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
bindings := dep.SsoBindingClient()
|
||||||
|
|
||||||
|
// Link mode: attach the identity to the signed-in user and return to the
|
||||||
|
// security settings tab.
|
||||||
|
if state.LinkUserID != 0 {
|
||||||
|
if _, err := bindings.Bind(c, state.LinkUserID, inventory.SsoProviderWeChat, identity); err != nil {
|
||||||
|
dep.Logger().Info("WeChat link rejected: %s", err)
|
||||||
|
if errors.Is(err, inventory.ErrSsoBindingConflict) {
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
fail("sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
recordUserEvent(c, dep, state.LinkUserID, types.EventLinkAccount, map[string]any{"provider": inventory.SsoProviderWeChat})
|
||||||
|
dest := settings.SiteURL(c).ResolveReference(&url.URL{Path: "settings", RawQuery: "tab=security"})
|
||||||
|
c.Redirect(http.StatusFound, dest.String())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var targetUser *ent.User
|
||||||
|
binding, err := bindings.Get(c, inventory.SsoProviderWeChat, identity)
|
||||||
|
switch {
|
||||||
|
case err == nil:
|
||||||
|
ctx := context.WithValue(c, inventory.LoadUserGroup{}, true)
|
||||||
|
targetUser, err = dep.UserClient().GetByID(ctx, binding.UserID)
|
||||||
|
if err != nil {
|
||||||
|
dep.Logger().Warning("WeChat binding resolved to missing user %d: %s", binding.UserID, err)
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
case ent.IsNotFound(err):
|
||||||
|
if !wx.RegisterEnabled {
|
||||||
|
dep.Logger().Info("WeChat login rejected: provisioning disabled")
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
targetUser, err = wechatProvisionUser(c, dep, httpClient, token, wx)
|
||||||
|
if err != nil {
|
||||||
|
dep.Logger().Warning("WeChat provisioning failed: %s", err)
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if _, err := bindings.Bind(c, targetUser.ID, inventory.SsoProviderWeChat, identity); err != nil {
|
||||||
|
dep.Logger().Warning("WeChat binding failed: %s", err)
|
||||||
|
fail("sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
dep.Logger().Warning("WeChat binding lookup failed: %s", err)
|
||||||
|
fail("sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if targetUser, err = dep.UserClient().LiftExpiredBan(c, targetUser); err != nil {
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err := checkUserStatus(c, targetUser); err != nil {
|
||||||
|
dep.Logger().Info("WeChat login rejected: %s", err)
|
||||||
|
fail("sso_account_unavailable")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
ticket := ssoTicketKey()
|
||||||
|
if err := dep.KV().Set(ticket, targetUser.ID, ssoTicketTTL); err != nil {
|
||||||
|
fail("sso_state_failed")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
callback := settings.SiteURL(c).ResolveReference(&url.URL{Path: "callback/sso"})
|
||||||
|
q := callback.Query()
|
||||||
|
q.Set("ticket", ticket)
|
||||||
|
if state.Redirect != "" {
|
||||||
|
q.Set("redirect", state.Redirect)
|
||||||
|
}
|
||||||
|
callback.RawQuery = q.Encode()
|
||||||
|
c.Redirect(http.StatusFound, callback.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
// wechatExchangeCode trades the authorization code for an access token.
|
||||||
|
// Unlike QQ, WeChat answers with JSON; the token response already carries
|
||||||
|
// openid and unionid.
|
||||||
|
func wechatExchangeCode(c *gin.Context, client request.Client, code string, wx *setting.WeChatConnect) (*wechatTokenResponse, error) {
|
||||||
|
endpoint, _ := url.Parse(wechatTokenEndpoint)
|
||||||
|
q := endpoint.Query()
|
||||||
|
q.Set("appid", wx.AppID)
|
||||||
|
q.Set("secret", wx.AppSecret)
|
||||||
|
q.Set("code", code)
|
||||||
|
q.Set("grant_type", "authorization_code")
|
||||||
|
endpoint.RawQuery = q.Encode()
|
||||||
|
|
||||||
|
resp, err := client.
|
||||||
|
Request(http.MethodGet, endpoint.String(), nil,
|
||||||
|
request.WithContext(c),
|
||||||
|
request.WithTimeout(15*time.Second),
|
||||||
|
).
|
||||||
|
CheckHTTPResponse(http.StatusOK).
|
||||||
|
GetResponse()
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("token request failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return parseWeChatToken(resp)
|
||||||
|
}
|
||||||
|
|
||||||
|
// parseWeChatToken unwraps the JSON token reply. WeChat reports failures as
|
||||||
|
// HTTP 200 with a nonzero errcode, so both paths must be checked.
|
||||||
|
func parseWeChatToken(body string) (*wechatTokenResponse, error) {
|
||||||
|
var token wechatTokenResponse
|
||||||
|
if err := json.Unmarshal([]byte(body), &token); err != nil {
|
||||||
|
return nil, fmt.Errorf("malformed token response: %w", err)
|
||||||
|
}
|
||||||
|
if token.ErrCode != 0 || token.AccessToken == "" {
|
||||||
|
return nil, fmt.Errorf("token error %d: %s", token.ErrCode, token.ErrMsg)
|
||||||
|
}
|
||||||
|
return &token, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// wechatProvisionUser creates the local account for a new WeChat identity.
|
||||||
|
// WeChat has no email claim, so a synthetic address under
|
||||||
|
// connect.wechat.local is used; the nickname comes from userinfo and falls
|
||||||
|
// back to an openid suffix.
|
||||||
|
func wechatProvisionUser(c *gin.Context, dep dependency.Dep, client request.Client, token *wechatTokenResponse, wx *setting.WeChatConnect) (*ent.User, error) {
|
||||||
|
nick := ""
|
||||||
|
endpoint, _ := url.Parse(wechatUserInfoEndpoint)
|
||||||
|
q := endpoint.Query()
|
||||||
|
q.Set("access_token", token.AccessToken)
|
||||||
|
q.Set("openid", token.OpenID)
|
||||||
|
endpoint.RawQuery = q.Encode()
|
||||||
|
|
||||||
|
if resp, err := client.
|
||||||
|
Request(http.MethodGet, endpoint.String(), nil,
|
||||||
|
request.WithContext(c),
|
||||||
|
request.WithTimeout(10*time.Second),
|
||||||
|
).
|
||||||
|
CheckHTTPResponse(http.StatusOK).
|
||||||
|
GetResponse(); err == nil {
|
||||||
|
var info wechatUserInfoResponse
|
||||||
|
if err := json.Unmarshal([]byte(resp), &info); err == nil && info.ErrCode == 0 {
|
||||||
|
nick = strings.TrimSpace(info.Nickname)
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
dep.Logger().Warning("WeChat userinfo request failed: %s", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if nick == "" {
|
||||||
|
nick = "WeChat user " + token.OpenID[len(token.OpenID)-min(6, len(token.OpenID)):]
|
||||||
|
}
|
||||||
|
if len(nick) > 100 {
|
||||||
|
nick = nick[:100]
|
||||||
|
}
|
||||||
|
|
||||||
|
return dep.UserClient().Create(c, &inventory.NewUserArgs{
|
||||||
|
Email: fmt.Sprintf("wx_%s@%s", token.OpenID, wechatConnectMailDomain),
|
||||||
|
Nick: nick,
|
||||||
|
Status: user.StatusActive,
|
||||||
|
GroupID: dep.SettingProvider().DefaultGroup(c),
|
||||||
|
})
|
||||||
|
}
|
||||||
@ -0,0 +1,23 @@
|
|||||||
|
package user
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestParseWeChatToken(t *testing.T) {
|
||||||
|
token, err := parseWeChatToken(`{"access_token":"AT","openid":"o","unionid":"u"}`)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, "AT", token.AccessToken)
|
||||||
|
require.Equal(t, "u", token.UnionID)
|
||||||
|
|
||||||
|
_, err = parseWeChatToken(`{"errcode":40029,"errmsg":"invalid code"}`)
|
||||||
|
require.Error(t, err)
|
||||||
|
|
||||||
|
_, err = parseWeChatToken(`{"openid":"o"}`) // no access_token
|
||||||
|
require.Error(t, err)
|
||||||
|
|
||||||
|
_, err = parseWeChatToken(`not json`)
|
||||||
|
require.Error(t, err)
|
||||||
|
}
|
||||||
Loading…
Reference in new issue