318 lines
9.4 KiB
Go
318 lines
9.4 KiB
Go
package service
|
||
|
||
import (
|
||
"encoding/base64"
|
||
"fmt"
|
||
"net/http"
|
||
"opencatd-open/internal/model"
|
||
"opencatd-open/pkg/config"
|
||
"opencatd-open/pkg/store"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/go-webauthn/webauthn/protocol"
|
||
"github.com/go-webauthn/webauthn/webauthn"
|
||
"github.com/mileusna/useragent"
|
||
"gorm.io/gorm"
|
||
)
|
||
|
||
var _ webauthn.User = (*WebAuthnUser)(nil)
|
||
|
||
// WebAuthnUser 实现webauthn.User接口的结构体
|
||
type WebAuthnUser struct {
|
||
User *model.User
|
||
// ID int64
|
||
// Name string
|
||
// DisplayName string
|
||
Credentials []webauthn.Credential
|
||
}
|
||
|
||
// WebAuthnID 返回用户ID
|
||
func (u *WebAuthnUser) WebAuthnID() []byte {
|
||
return []byte(strconv.Itoa(int(u.User.ID)))
|
||
}
|
||
|
||
// WebAuthnName 返回用户名
|
||
func (u *WebAuthnUser) WebAuthnName() string {
|
||
return u.User.Username
|
||
}
|
||
|
||
// WebAuthnDisplayName 返回用户显示名
|
||
func (u *WebAuthnUser) WebAuthnDisplayName() string {
|
||
return u.User.Name
|
||
}
|
||
|
||
// WebAuthnCredentials 返回用户所有凭证
|
||
func (u *WebAuthnUser) WebAuthnCredentials() []webauthn.Credential {
|
||
return u.Credentials
|
||
}
|
||
|
||
func (u *WebAuthnUser) WebAuthnCredentialDescriptors() (descriptors []protocol.CredentialDescriptor) {
|
||
credentials := u.WebAuthnCredentials()
|
||
|
||
descriptors = make([]protocol.CredentialDescriptor, len(credentials))
|
||
|
||
for i, credential := range credentials {
|
||
descriptors[i] = credential.Descriptor()
|
||
}
|
||
|
||
return descriptors
|
||
}
|
||
|
||
// WebAuthnService 提供WebAuthn相关功能
|
||
type WebAuthnService struct {
|
||
cfg *config.Config
|
||
DB *gorm.DB
|
||
WebAuthn *webauthn.WebAuthn
|
||
// Sessions map[string]webauthn.SessionData // 用于存储注册和认证过程中的会话数据
|
||
Sessions *store.WebAuthnSessionStore
|
||
}
|
||
|
||
// NewWebAuthnService 创建新的WebAuthn服务
|
||
func NewWebAuthnService(cfg *config.Config, db *gorm.DB) (*WebAuthnService, error) {
|
||
// 创建WebAuthn配置
|
||
wconfig := &webauthn.Config{
|
||
RPDisplayName: cfg.AppName, // 依赖方(Relying Party)显示名称
|
||
RPID: cfg.RPID, // 依赖方ID(通常为域名)
|
||
RPOrigins: cfg.RPOrigins, // 依赖方源(URL)
|
||
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
||
RequireResidentKey: protocol.ResidentKeyRequired(), // 要求认证器存储用户 ID (resident key)
|
||
ResidentKey: protocol.ResidentKeyRequirementRequired, // 使用 Discoverable 模式
|
||
UserVerification: protocol.VerificationPreferred, // 推荐用户验证
|
||
AuthenticatorAttachment: "", // 允许任何认证器 (平台或跨平台)
|
||
},
|
||
// EncodeUserIDAsString: true, // 将用户ID编码为字符串
|
||
}
|
||
|
||
wa, err := webauthn.New(wconfig)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
return &WebAuthnService{
|
||
cfg: cfg,
|
||
DB: db,
|
||
WebAuthn: wa,
|
||
// Sessions: make(map[string]webauthn.SessionData),
|
||
Sessions: store.NewWebAuthnSessionStore(),
|
||
}, nil
|
||
}
|
||
|
||
// GetUserWithCredentials 获取用户及其凭证
|
||
func (s *WebAuthnService) GetUserWithCredentials(userID int64) (*WebAuthnUser, error) {
|
||
var user model.User
|
||
if err := s.DB.Model(&model.User{}).Preload("Passkeys").First(&user, userID).Error; err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 获取用户的所有Passkey
|
||
passkeys := user.Passkeys
|
||
|
||
// 将Passkey转换为webauthn.Credential
|
||
credentials := make([]webauthn.Credential, len(passkeys))
|
||
for i, pk := range passkeys {
|
||
credentialIDBytes, err := base64.StdEncoding.DecodeString(pk.CredentialID)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to decode CredentialID: %w", err)
|
||
}
|
||
publicKeyBytes, err := base64.StdEncoding.DecodeString(pk.PublicKey)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to decode PublicKey: %w", err)
|
||
}
|
||
aaguidBytes, err := base64.StdEncoding.DecodeString(pk.AAGUID)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to decode AAGUID: %w", err)
|
||
}
|
||
|
||
var transport []protocol.AuthenticatorTransport
|
||
if pk.Transport != "" {
|
||
transport = []protocol.AuthenticatorTransport{protocol.AuthenticatorTransport(pk.Transport)}
|
||
}
|
||
|
||
credentials[i] = webauthn.Credential{
|
||
ID: credentialIDBytes,
|
||
PublicKey: publicKeyBytes,
|
||
AttestationType: pk.AttestationType,
|
||
Transport: transport,
|
||
Flags: webauthn.CredentialFlags{
|
||
UserPresent: true,
|
||
UserVerified: true,
|
||
BackupEligible: pk.BackupEligible,
|
||
BackupState: pk.BackupState,
|
||
},
|
||
Authenticator: webauthn.Authenticator{
|
||
AAGUID: aaguidBytes,
|
||
SignCount: pk.SignCount,
|
||
CloneWarning: false,
|
||
},
|
||
}
|
||
}
|
||
|
||
// 创建WebAuthnUser
|
||
return &WebAuthnUser{
|
||
User: &user,
|
||
Credentials: credentials,
|
||
}, nil
|
||
}
|
||
|
||
// BeginRegistration 开始注册过程
|
||
func (s *WebAuthnService) BeginRegistration(userID int64) (*protocol.CredentialCreation, error) {
|
||
user, err := s.GetUserWithCredentials(userID)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 获取注册选项
|
||
options, sessionData, err := s.WebAuthn.BeginRegistration(user)
|
||
// webauthn.WithResidentKeyRequirement(protocol.ResidentKeyRequirementRequired),
|
||
// webauthn.WithExclusions(user.WebAuthnCredentialDescriptors()), // 排除已存在的凭证
|
||
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 保存会话数据
|
||
userid := strconv.Itoa(int(userID))
|
||
s.Sessions.SaveWebauthnSession(userid, sessionData)
|
||
|
||
return options, nil
|
||
}
|
||
|
||
// FinishRegistration 完成注册过程
|
||
func (s *WebAuthnService) FinishRegistration(userID int64, response *http.Request, deviceName string) (*model.Passkey, error) {
|
||
user, err := s.GetUserWithCredentials(userID)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
userid := strconv.Itoa(int(userID))
|
||
// 获取并清除会话数据
|
||
sessionData, err := s.Sessions.GetWebauthnSession(userid)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
s.Sessions.DeleteWebauthnSession(userid)
|
||
|
||
// 完成注册
|
||
credential, err := s.WebAuthn.FinishRegistration(user, *sessionData, response)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
ua := useragent.Parse(response.UserAgent())
|
||
|
||
var transport string
|
||
if len(credential.Transport) > 0 {
|
||
transport = string(credential.Transport[0]) // 通常只取第一个传输方式
|
||
}
|
||
// 创建Passkey记录
|
||
passkey := &model.Passkey{
|
||
UserID: userID,
|
||
CredentialID: base64.StdEncoding.EncodeToString(credential.ID),
|
||
PublicKey: base64.StdEncoding.EncodeToString(credential.PublicKey),
|
||
AttestationType: string(credential.AttestationType),
|
||
AAGUID: base64.StdEncoding.EncodeToString(credential.Authenticator.AAGUID),
|
||
SignCount: credential.Authenticator.SignCount,
|
||
Name: deviceName,
|
||
DeviceType: strings.TrimSpace(fmt.Sprintf("%s %s %s %s %s", ua.Device, ua.OS, ua.OSVersionNoFull(), ua.Name, ua.VersionNoFull())),
|
||
LastUsedAt: time.Now().Unix(),
|
||
BackupEligible: credential.Flags.BackupEligible,
|
||
BackupState: credential.Flags.BackupState,
|
||
Transport: transport,
|
||
}
|
||
|
||
// 保存Passkey
|
||
if err := s.DB.Create(passkey).Error; err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
return passkey, nil
|
||
}
|
||
|
||
// BeginLogin 开始登录过程 (无需用户ID，针对未认证用户)
|
||
func (s *WebAuthnService) BeginLogin() (*protocol.CredentialAssertion, error) {
|
||
// 不指定用户ID，让客户端决定使用哪个凭证
|
||
options, session, err := s.WebAuthn.BeginDiscoverableLogin(
|
||
webauthn.WithUserVerification(protocol.VerificationPreferred), // 推荐用户验证
|
||
)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
s.Sessions.SaveWebauthnSession(session.Challenge, session)
|
||
|
||
return options, nil
|
||
}
|
||
|
||
// FinishLogin 完成登录过程
|
||
func (s *WebAuthnService) FinishLogin(challenge string, response *http.Request) (*WebAuthnUser, error) {
|
||
// 获取并清除会话数据
|
||
sessionData, err := s.Sessions.GetWebauthnSession(challenge)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
s.Sessions.DeleteWebauthnSession(challenge)
|
||
|
||
// 获取相应的用户
|
||
// var user model.User
|
||
// if err := s.DB.First(&user, passkey.UserID).Error; err != nil {
|
||
// return nil, err
|
||
// }
|
||
|
||
// 创建WebAuthnUser
|
||
// webAuthnUser, err := s.GetUserWithCredentials(user.ID)
|
||
// if err != nil {
|
||
// return nil, err
|
||
// }
|
||
|
||
// 完成登录
|
||
// _, err = s.WebAuthn.FinishLogin(webAuthnUser, sessionData, response)
|
||
// if err != nil {
|
||
// return nil, err
|
||
// }
|
||
var user *WebAuthnUser
|
||
wc, err := s.WebAuthn.FinishDiscoverableLogin(s.GetWebAuthnUser(&user), *sessionData, response)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
// 更新Passkey 这里SignCount应该是由验证器上传，但可能为0，手动+1
|
||
var pk model.Passkey
|
||
if err := s.DB.Model(&model.Passkey{}).Where("credential_id = ?", base64.StdEncoding.EncodeToString(wc.ID)).First(&pk).Error; err == nil {
|
||
if err := s.DB.Model(&model.Passkey{}).Where("id = ?", pk.ID, time.Now().Unix()).Updates(map[string]interface{}{
|
||
"sign_count": pk.SignCount + 1,
|
||
"last_used_at": time.Now().Unix(),
|
||
}).Error; err != nil {
|
||
fmt.Println(err)
|
||
}
|
||
|
||
}
|
||
|
||
return user, nil
|
||
}
|
||
|
||
func (s *WebAuthnService) GetWebAuthnUser(wau **WebAuthnUser) webauthn.DiscoverableUserHandler {
|
||
return func(rawID, userHandle []byte) (webauthn.User, error) {
|
||
userid, err := strconv.ParseInt(string(userHandle), 10, 64)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
*wau, err = s.GetUserWithCredentials(userid)
|
||
return *wau, err
|
||
}
|
||
}
|
||
|
||
// ListPasskeys 列出用户所有Passkey
|
||
func (s *WebAuthnService) ListPasskeys(userID int64) ([]model.Passkey, error) {
|
||
var passkeys []model.Passkey
|
||
if err := s.DB.Where("user_id = ?", userID).Find(&passkeys).Error; err != nil {
|
||
return nil, err
|
||
}
|
||
return passkeys, nil
|
||
}
|
||
|
||
// DeletePasskey 删除用户Passkey
|
||
func (s *WebAuthnService) DeletePasskey(userID int64, passkeyID int64) error {
|
||
return s.DB.Where("id = ? AND user_id = ?", passkeyID, userID).Delete(&model.Passkey{}).Error
|
||
}
|