From 6eac63be58dd6cba5a2edc59c25592fbfba658ee Mon Sep 17 00:00:00 2001 From: 21048313 <21048313@example.com> Date: Sun, 22 Feb 2026 11:27:54 +0800 Subject: [PATCH 1/2] =?UTF-8?q?feat:=20=E6=B7=BB=E5=8A=A0=E7=94=A8?= =?UTF-8?q?=E6=88=B7=E8=AE=A4=E8=AF=81=E8=AE=BF=E5=AE=A2=E6=A8=A1=E5=BC=8F?= =?UTF-8?q?=E5=92=8C=E5=AE=8C=E5=96=84=E7=99=BB=E5=BD=95=E5=8A=9F=E8=83=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 新增访客登录功能 (POST /api/auth/guest)，支持邮箱/手机号快速登录 - 访客用户自动创建，角色为 guest，无需注册 - 修复 GitHub OAuth 回调 500 错误，使用 generateTokenForUser 直接生成 Token - 前端登录页添加深色主题，与 Dashboard 页面风格一致 - 未登录访问首页自动跳转到 /login - Gateway 添加 User Service 和 Web IDE Backend 完整路由配置 - 后端 SecurityConfig 信任 Gateway 注入的 X-User-Id 等头信息 - 新增前端 API 拦截器统一处理 401/403 错误 Co-Authored-By: Claude Opus 4.6 --- docs/user_auth/account-auth-sso-design.md | 1014 ++++++++ .../account-auth-sso-implementation-plan.md | 2165 +++++++++++++++++ docs/user_auth/user-service-guide.md | 530 ++++ .../com/forge/gateway/config/GatewayConfig.kt | 112 + .../forge/user/controller/AuthController.kt | 160 ++ .../forge/user/controller/OAuthController.kt | 126 + .../main/kotlin/com/forge/user/dto/UserDto.kt | 135 + .../com/forge/user/security/SecurityConfig.kt | 77 + .../com/forge/user/service/AuthService.kt | 219 ++ .../com/forge/user/service/UserService.kt | 188 ++ web-ide/frontend/next.config.ts | 15 +- web-ide/frontend/src/app/login/page.tsx | 43 +- web-ide/frontend/src/app/page.tsx | 11 +- .../src/components/auth/LoginForm.tsx | 323 +++ web-ide/frontend/src/lib/api-interceptor.ts | 428 ++++ web-ide/frontend/src/lib/sso-client.ts | 418 ++++ 16 files changed, 5928 insertions(+), 36 deletions(-) create mode 100644 docs/user_auth/account-auth-sso-design.md create mode 100644 docs/user_auth/account-auth-sso-implementation-plan.md create mode 100644 docs/user_auth/user-service-guide.md create mode 100644 services/gateway/src/main/kotlin/com/forge/gateway/config/GatewayConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/controller/AuthController.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/controller/OAuthController.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/dto/UserDto.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/security/SecurityConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/AuthService.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/UserService.kt create mode 100644 web-ide/frontend/src/components/auth/LoginForm.tsx create mode 100644 web-ide/frontend/src/lib/api-interceptor.ts create mode 100644 web-ide/frontend/src/lib/sso-client.ts diff --git a/docs/user_auth/account-auth-sso-design.md b/docs/user_auth/account-auth-sso-design.md new file mode 100644 index 0000000..3729aca --- /dev/null +++ b/docs/user_auth/account-auth-sso-design.md @@ -0,0 +1,1014 @@ +# Forge Platform 账号权限 SSO 架构设计 + +> 版本: v1.1 +> 作者: Claude Sonnet 4.5 +> 日期: 2026-02-21 +> 状态: ✅ Phase 1-5 已实现 + +--- + +## 1. 设计背景与目标 + +### 1.1 当前架构现状 + +| 组件 | 技术 | 说明 | +|------|------|------| +| 身份认证 | Keycloak | OAuth2/OIDC provider, Realm: forge | +| 前端 | Next.js 15 | 无状态 JWT 认证 | +| 后端 | Spring Boot 3.3 | OAuth2 Resource Server | +| 网关/路由 | Nginx | 反向代理, SSL termination | +| 用户管理 | 无 | 仅通过 Keycloak 内置用户 | + +### 1.2 需求目标 + +1. **账号功能**: 本地账号体系 + 第三方联合登录 +2. **权限功能**: 细粒度 RBAC + ABAC 权限控制 +3. **SSO 功能**: 单点登录, 支持多种身份源 + +### 1.3 设计原则 + +1. **渐进式增强**: 保留现有 Keycloak 集成，扩展而非替换 +2. **松耦合**: User Service 与现有后端通过 REST API 通信 +3. **安全优先**: 敏感数据加密, JWT 短期令牌 +4. **可观测**: 完整审计日志, 异常检测 + +--- + +## 2. 目标架构 + +### 2.1 架构拓扑图 + +``` + ┌─────────────────────────────────────┐ + │ 用户浏览器 │ + └──────────────┬──────────────────────┘ + │ + ┌────────────────────┼────────────────────┐ + │ │ │ + HTTPS:9443│ │ │ + ▼ ▼ ▼ +┌─────────────────────────────────────────────────────────────────────────────────┐ +│ API Gateway (Spring Cloud Gateway) │ +│ ┌──────────────────────────────────────────────────────────────────────────┐ │ +│ │ • 请求路由 / 负载均衡 │ │ +│ │ • JWT 验证 & Token 刷新 │ │ +│ │ • 权限校验 (RBAC + ABAC) │ │ +│ │ • 限流 & 熔断 │ │ +│ │ • 请求日志 & 审计 │ │ +│ └──────────────────────────────────────────────────────────────────────────┘ │ +│ │ │ │ │ +│ ┌───────────────┼────────────────────┼────────────────────┼───────────────────┤ +│ │ │ │ │ │ +│ ▼ ▼ ▼ ▼ ▼ +│ ┌────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ +│ │ Keycloak│ │User Service│ │Web IDE │ │ MCP Servers│ │PostgreSQL │ +│ │ :8180 │ │:8086 │ │Backend:8080│ │:8081-8085 │ │:5432 │ +│ └────────┘ └────────────┘ └────────────┘ └────────────┘ └────────────┘ +│ │ +│ 身份认证 ←──────── 用户管理 ←────────── 业务服务 ←──────── 数据存储 │ +│ │ +└──────────────────────────────────────────────────────────────────────────────────┘ +``` + +### 2.2 组件职责 + +| 组件 | 职责 | 技术栈 | +|------|------|--------| +| **Keycloak** | 身份认证, Token 发行, 身份源 Federation | 内置 | +| **API Gateway** | 请求路由, JWT 验证, 权限校验, 限流 | Spring Cloud Gateway | +| **User Service** | 用户 CRUD, 权限管理, 用户配置 | Spring Boot 3.3 | +| **Web IDE Backend** | 业务逻辑, MCP 工具聚合 | Spring Boot 3.3 | +| **MCP Servers** | 专业领域工具 (知识库/数据库/服务图等) | Ktor | + +--- + +## 3. 详细设计 + +### 3.1 身份认证架构 + +#### 3.1.1 认证流程 + +``` +用户登录流程 (多身份源支持): + +┌─────────────────────────────────────────────────────────────────────────────┐ +│ 用户访问 Web IDE │ +└─────────────────────────────────┬───────────────────────────────────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ API Gateway │ + │ • 拦截未认证请求 │ + │ • 重定向到认证页面 │ + └────────────┬────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 登录页 (Next.js) │ + │ 显示登录方式选择: │ + │ • 邮箱/密码 │ + │ • GitHub │ + │ • 手机号/验证码 │ + │ • 企业 SSO (SAML/OIDC) │ + └────────────┬────────────┘ + │ + ┌────────────┴────────────┐ + │ │ + ▼ ▼ + ┌─────────────────┐ ┌─────────────────┐ + │ 本地账号认证 │ │ 第三方 OAuth2 │ + │ User Service │ │ Keycloak │ + │ 验证用户名密码 │ │ (GitHub等) │ + └────────┬────────┘ └────────┬────────┘ + │ │ + │ ┌───────────────┘ + │ │ + ▼ ▼ + ┌─────────────────────────┐ + │ JWT Token 发行 │ + │ • Access Token (15min) │ + │ • Refresh Token (7d) │ + │ • Token 存入 Redis │ + └────────────┬────────────┘ + │ + ▼ + ┌─────────────────────────┐ + │ 后续请求携带 Token │ + │ Authorization: Bearer │ + └─────────────────────────┘ +``` + +#### 3.1.2 支持的身份源 + +| 身份源 | 协议 | 说明 | 实现方式 | +|--------|------|------|----------| +| **邮箱/密码** | 内部 | 本地账号 | User Service + BCrypt | +| **GitHub** | OAuth 2.0 | 开发者首选 | Keycloak User Federation | +| **手机号/验证码** | SMS OTP | 国内场景 | User Service + 短信网关 | +| **企业邮箱** | SAML 2.0 / OIDC | 企业客户 | Keycloak Identity Brokering | +| **钉钉/企微** | OAuth 2.0 | 国内企业 | Keycloak User Federation | + +#### 3.1.3 Token 设计 + +``` +JWT Access Token Payload: +{ + "sub": "user-uuid", // 用户 ID (UUID) + "username": "zhaoqi", // 用户名 + "email": "zhaoqi@example.com", // 邮箱 + "roles": ["developer", "admin"], // 角色列表 + "permissions": ["workspace:read", ...], // 权限列表 + "org_id": "org-uuid", // 组织 ID (多租户) + "iss": "forge-platform", // 发行者 + "aud": "forge-api", // 受众 + "exp": 1739999999, // 过期时间 + "iat": 1739999999, // 签发时间 + "jti": "token-id" // Token 唯一 ID (用于撤销) +} + +JWT Refresh Token: +{ + "sub": "user-uuid", + "type": "refresh", + "exp": 1740599999, // 7 天后过期 + "jti": "refresh-token-id" // 关联 Redis 中的 token 记录 +} +``` + +### 3.2 权限架构 + +#### 3.2.1 RBAC + ABAC 混合模型 + +``` +权限层级结构: + + ┌─────────────────┐ + │ Organization │ ← 多租户隔离 + │ (组织) │ + └────────┬────────┘ + │ + ┌────────┴────────┐ + │ Role │ ← 角色定义 + │ (角色) │ admin / developer / viewer + └────────┬────────┘ + │ + ┌────────┴────────┐ + │ Permission │ ← 细粒度权限 + │ (权限) │ + └─────────────────┘ + ▲ + │ 继承 + │ + ┌────────┴────────┐ + │ User │ ← 用户 + │ (用户) │ + └─────────────────┘ + +ABAC 条件示例: +- "workspace:write": resource.owner == user.id +- "workflow:run": user.role in ["admin", "developer"] AND user.org_id == resource.org_id +``` + +#### 3.2.2 权限定义 + +| 资源 | 操作 | 权限标识 | 说明 | +|------|------|----------|------| +| **Workspace** | read | `workspace:read` | 读取工作空间 | +| **Workspace** | write | `workspace:write` | 创建/修改文件 | +| **Workspace** | delete | `workspace:delete` | 删除工作空间 | +| **Chat** | read | `chat:read` | 查看对话 | +| **Chat** | write | `chat:write` | 发送消息 | +| **Workflow** | read | `workflow:read` | 查看工作流 | +| **Workflow** | create | `workflow:create` | 创建工作流 | +| **Workflow** | run | `workflow:run` | 运行工作流 | +| **Admin** | access | `admin:access` | 访问管理后台 | +| **User** | manage | `user:manage` | 管理系统用户 | +| **MCP Tools** | call | `mcp:{tool_name}:call` | 调用特定 MCP 工具 | + +#### 3.2.3 角色定义 + +| 角色 | 权限范围 | 说明 | +|------|----------|------| +| **admin** | 所有权限 | 平台管理员 | +| **developer** | workspace/chat/workflow/mcp | 普通开发者 | +| **viewer** | read-only | 只读用户 | +| **viewer-ai** | chat + read | AI 机器人专用 | + +### 3.3 User Service 设计 + +#### 3.3.1 服务职责 + +``` +User Service 核心功能: + +┌─────────────────────────────────────────────────────────────────────────┐ +│ User Service (:8086) │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 用户管理模块 │ +│ ├── POST /api/users/register # 用户注册 (邮箱/手机) │ +│ ├── GET /api/users/{id} # 获取用户详情 │ +│ ├── PUT /api/users/{id} # 更新用户信息 │ +│ ├── DELETE /api/users/{id} # 注销用户 │ +│ ├── POST /api/users/{id}/password # 修改密码 │ +│ └── POST /api/users/{id}/avatar # 上传头像 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 认证模块 │ +│ ├── POST /api/auth/login # 邮箱/密码登录 │ +│ ├── POST /api/auth/logout # 退出登录 │ +│ ├── POST /api/auth/refresh # 刷新 Token │ +│ ├── POST /api/auth/forgot-password # 忘记密码 (发送邮件) │ +│ └── POST /api/auth/reset-password # 重置密码 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 第三方绑定模块 │ +│ ├── GET /api/users/{id}/identities # 获取已绑定的第三方账号 │ +│ ├── POST /api/users/{id}/identities/github # 绑定 GitHub │ +│ ├── DELETE /api/users/{id}/identities/{provider} # 解绑 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 组织/团队模块 (多租户) │ +│ ├── POST /api/orgs # 创建组织 │ +│ ├── GET /api/orgs/{id} # 获取组织详情 │ +│ ├── POST /api/orgs/{id}/members # 添加成员 │ +│ ├── PUT /api/orgs/{id}/members/{uid}/role # 修改成员角色 │ +│ └── DELETE /api/orgs/{id}/members/{uid} # 移除成员 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 权限模块 │ +│ ├── GET /api/users/{id}/roles # 获取用户角色 │ +│ ├── POST /api/users/{id}/roles # 授予角色 │ +│ ├── DELETE /api/users/{id}/roles/{role} # 移除角色 │ +│ ├── GET /api/roles # 获取所有角色 │ +│ └── POST /api/roles # 创建自定义角色 │ +└─────────────────────────────────────────────────────────────────────────┘ +``` + +#### 3.3.2 数据模型 + +```kotlin +// 用户实体 +@Entity +@Table(name = "users") +class UserEntity( + @Id val id: String, // UUID + @Column(nullable = false, unique = true) val username: String, + @Column(unique = true) val email: String?, // 邮箱 (可为空) + @Column(unique = true) val phone: String?, // 手机号 (可为空) + @Column(nullable = false) val passwordHash: String, // BCrypt + @Column(nullable = false) val status: UserStatus, // ACTIVE / INACTIVE / SUSPENDED + @Column(nullable = false) val createdAt: Instant, + @Column(nullable = false) val updatedAt: Instant, + @Column val lastLoginAt: Instant? = null, + @Column val lastLoginIp: String? = null +) + +enum class UserStatus { + ACTIVE, // 正常 + INACTIVE, // 未激活 + SUSPENDED, // 已封禁 + DELETED // 已删除 +} + +// 组织实体 (多租户) +@Entity +@Table(name = "organizations") +class OrganizationEntity( + @Id val id: String, + @Column(nullable = false) val name: String, + @Column val avatar: String? = null, + @Column(nullable = false) val ownerId: String, + @Column(nullable = false) val plan: OrgPlan, // FREE / PRO / ENTERPRISE + @Column(nullable = false) val createdAt: Instant +) + +enum class OrgPlan { + FREE, PRO, ENTERPRISE +} + +// 组织成员关联 +@Entity +@Table(name = "org_members") +class OrgMemberEntity( + @Id val id: String, + @Column(nullable = false) val orgId: String, + @Column(nullable = false) val userId: String, + @Column(nullable = false) val role: OrgRole, + @Column(nullable = false) val joinedAt: Instant +) + +enum class OrgRole { + OWNER, // 所有者 (唯一) + ADMIN, // 管理员 + MEMBER, // 普通成员 + VIEWER // 只读 +} + +// 用户角色 (全局 + 组织级) +@Entity +@Table(name = "user_roles") +class UserRoleEntity( + @Id val id: String, + @Column(nullable = false) val userId: String, + @Column(nullable = false) val roleName: String, + @Column val orgId: String? = null, // null 表示全局角色 + @Column(nullable = false) val grantedBy: String, + @Column(nullable = false) val grantedAt: Instant +) + +// 第三方登录绑定 +@Entity +@Table(name = "user_identities") +class UserIdentityEntity( + @Id val id: String, + @Column(nullable = false) val userId: String, + @Column(nullable = false) val provider: IdentityProvider, + @Column(nullable = false) val providerUserId: String, // 第三方用户 ID + @Column nullable val accessToken: String?, // 加密存储 + @Column nullable val refreshToken: String?, + @Column nullable val expiresAt: Instant?, + @Column(nullable = false) val linkedAt: Instant +) + +enum class IdentityProvider { + GITHUB, + GOOGLE, + WECHAT, + DINGTALK, + EMAIL, // 邮箱密码 + PHONE // 手机验证码 +} +``` + +#### 3.3.3 与 Keycloak 集成 + +``` +User Service 与 Keycloak 的关系: + +┌─────────────────────────────────────────────────────────────────────────┐ +│ 用户登录流程 │ +└─────────────────────────────────────────────────────────────────────────┘ + +邮箱/密码登录: + 前端 → User Service /api/auth/login + → User Service 验证 BCrypt 密码 + → User Service 发行 JWT (不使用 Keycloak) + +GitHub 登录: + 前端 → 重定向到 Keycloak /auth/realms/forge/protocol/openid-connect/auth?provider=github + → Keycloak 跳转到 GitHub OAuth + → GitHub 返回 code + → Keycloak 兑换 token, 创建/查找 user + → Keycloak 返回 JWT + → 前端存储 JWT + → 前端调用 User Service 同步用户信息 (可选) + +手机号登录: + 前端 → User Service /api/auth/send-sms-code + → User Service 调用短信网关 + → 前端输入验证码 + → User Service /api/auth/verify-phone + → User Service 验证验证码 + → User Service 发行 JWT + +设计决策: + 1. 邮箱/密码登录: 完全由 User Service 管理 (不经过 Keycloak) + 2. 第三方登录: Keycloak Identity Brokering, User Service 同步数据 + 3. JWT 发行: User Service 自签发 (非 Keycloak JWT) + - 原因: 与现有前端 Token 格式兼容 + - 密钥管理: 通过 Key Management Service (KMS) +``` + +### 3.4 API Gateway 设计 + +#### 3.4.1 网关职责 + +``` +Spring Cloud Gateway 核心功能: + +┌─────────────────────────────────────────────────────────────────────────┐ +│ API Gateway (:9443) │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 1. 请求路由 │ +│ ├── /api/users/* → User Service:8086 │ +│ ├── /api/orgs/* → User Service:8086 │ +│ ├── /api/* → Web IDE Backend:8080 │ +│ └── /ws/* → Web IDE Backend:8080 (WebSocket) │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 2. JWT 验证 │ +│ ├── 解析 Authorization Header │ +│ ├── 验证签名 (从 JWKS 或本地密钥) │ +│ ├── 检查 Token 有效期 │ +│ ├── 检查 Token 是否在黑名单 (Redis) │ +│ └── 提取用户信息到 Request Header │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 3. 权限校验 │ +│ ├── 基于 URL 和 Method 的路由配置 │ +│ ├── 匿名访问: /api/auth/*, /health │ +│ ├── 角色检查: @RolesRequired("admin") │ +│ ├── 权限检查: @PermissionRequired("user:read") │ +│ └── 组织归属: 检查用户是否属于资源所属组织 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 4. 限流 & 熔断 │ +│ ├── 限流: 基于 IP/User/Route 的限流策略 │ +│ │ └── 匿名: 100 req/min │ +│ │ └── 登录用户: 1000 req/min │ +│ │ └── API: 5000 req/min │ +│ ├── 熔断: Circuit Breaker (Resilience4j) │ +│ │ └── 快速失败, 返回 503 Service Unavailable │ +│ └── 缓存: Redis 缓存常见响应 │ +├─────────────────────────────────────────────────────────────────────────┤ +│ 5. 请求日志 & 审计 │ +│ ├── 结构化日志 (JSON) │ +│ ├── 敏感数据脱敏 │ +│ ├── 审计事件: login, logout, permission_denied │ +│ └── 链路追踪: OpenTelemetry │ +└─────────────────────────────────────────────────────────────────────────┘ +``` + +#### 3.4.2 路由配置 + +```yaml +# application.yml +spring: + cloud: + gateway: + routes: + # User Service + - id: user-service + uri: lb://user-service + predicates: + - Path=/api/users/**,/api/auth/**,/api/orgs/**,/api/roles/** + filters: + - RewritePath=/api/(?.*), /$\{segment} + - ValidateJwt + - RateLimit=1000 + - AddRequestHeaders: + X-User-Id: "${jwt.subject}" + X-User-Roles: "${jwt.roles}" + + # Web IDE Backend + - id: webide-backend + uri: lb://webide-backend + predicates: + - Path=/api/**,/ws/** + filters: + - RewritePath=/api/(?.*), /$\{segment} + - ValidateJwt + - RateLimit=3000 + + # Health check + - id: health + uri: lb://webide-backend + predicates: + - Path=/actuator/health,/actuator/info + filters: + - RewritePath=/actuator/(?.*), /actuator/$\{segment} + + default-filters: + - StripPrefix=1 + - AddRequestHeader=X-Forwarded-For, "${caller.ip}" + - DedupeResponseHeader=Access-Control-Allow-Origin Access-Control-Allow-Credentials + + globalcors: + cors-configurations: + '[/**]': + allowed-origins: "${CORS_ALLOWED_ORIGINS:*}" + allowed-methods: GET,POST,PUT,DELETE,OPTIONS + allowed-headers: "*" + allow-credentials: true + max-age: 3600 +``` + +#### 3.4.3 JWT 验证过滤器 + +```kotlin +@Component +class JwtValidationFilter : GlobalFilter, Ordered { + + override fun filter(exchange: ServerWebExchange, chain: GatewayFilterChain): Mono { + val request = exchange.request + + // 跳过匿名路由 + if (isAnonymousRoute(request.path)) { + return chain.filter(exchange) + } + + val authHeader = request.headers.getFirst(HttpHeaders.AUTHORIZATION) + ?: return Mono.error(UnauthenticatedException("Missing authorization header")) + + if (!authHeader.startsWith("Bearer ")) { + return Mono.error(UnauthenticatedException("Invalid authorization header format")) + } + + val token = authHeader.substring(7) + + try { + val claims = jwtService.validateAndParse(token) + + // 检查 Token 黑名单 (Redis) + if (redisTemplate.hasKey("token:blacklist:$token")) { + return Mono.error(TokenRevokedException("Token has been revoked")) + } + + // 将用户信息添加到 Request Header + val modifiedRequest = request.mutate() + .header("X-User-Id", claims.subject) + .header("X-User-Username", claims.username) + .header("X-User-Roles", claims.roles.joinToString(",")) + .header("X-User-Org-Id", claims.orgId ?: "") + .build() + + return chain.filter(exchange.mutate().request(modifiedRequest).build()) + } catch (e: Exception) { + return Mono.error(UnauthenticatedException("Invalid token: ${e.message}")) + } + } +} +``` + +### 3.5 数据库设计 + +#### 3.5.1 表结构 + +```sql +-- 用户表 +CREATE TABLE users ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + username VARCHAR(64) NOT NULL UNIQUE, + email VARCHAR(255) UNIQUE, + phone VARCHAR(20) UNIQUE, + password_hash VARCHAR(255) NOT NULL, + status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + last_login_at TIMESTAMP WITH TIME ZONE, + last_login_ip INET, + email_verified BOOLEAN DEFAULT FALSE, + phone_verified BOOLEAN DEFAULT FALSE +); + +-- 组织表 +CREATE TABLE organizations ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + name VARCHAR(128) NOT NULL, + avatar TEXT, + owner_id UUID NOT NULL REFERENCES users(id), + plan VARCHAR(20) NOT NULL DEFAULT 'FREE', + settings JSONB DEFAULT '{}', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW() +); + +-- 组织成员表 +CREATE TABLE org_members ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + org_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role VARCHAR(20) NOT NULL, + joined_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(org_id, user_id) +); + +-- 用户角色表 (全局 + 组织级) +CREATE TABLE user_roles ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role_name VARCHAR(64) NOT NULL, + org_id UUID REFERENCES organizations(id) ON DELETE CASCADE, + granted_by UUID NOT NULL, + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + expires_at TIMESTAMP WITH TIME ZONE, + UNIQUE(user_id, role_name, org_id) +); + +-- 权限表 +CREATE TABLE permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + resource VARCHAR(64) NOT NULL, + action VARCHAR(64) NOT NULL, + description TEXT, + conditions JSONB, -- ABAC 条件 + UNIQUE(resource, action) +); + +-- 角色权限关联表 +CREATE TABLE role_permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + role_name VARCHAR(64) NOT NULL, + permission_id UUID NOT NULL REFERENCES permissions(id), + granted_by UUID NOT NULL, + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(role_name, permission_id) +); + +-- 第三方登录绑定表 +CREATE TABLE user_identities ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + provider VARCHAR(32) NOT NULL, + provider_user_id VARCHAR(255) NOT NULL, + access_token TEXT, + refresh_token TEXT, + expires_at TIMESTAMP WITH TIME ZONE, + metadata JSONB DEFAULT '{}', + linked_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(provider, provider_user_id) +); + +-- 登录日志表 (审计) +CREATE TABLE login_logs ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID REFERENCES users(id), + provider VARCHAR(32) NOT NULL, + ip_address INET NOT NULL, + user_agent TEXT, + success BOOLEAN NOT NULL, + failure_reason VARCHAR(255), + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW() +); + +-- Token 黑名单表 (Redis) +-- Redis Key: token:blacklist:{jti} -> user_id, TTL = token_expiration + +-- 索引 +CREATE INDEX idx_users_email ON users(email); +CREATE INDEX idx_users_phone ON users(phone); +CREATE INDEX idx_org_members_org_id ON org_members(org_id); +CREATE INDEX idx_user_roles_user_id ON user_roles(user_id); +CREATE INDEX idx_login_logs_user_id ON login_logs(user_id); +CREATE INDEX idx_login_logs_created_at ON login_logs(created_at); +``` + +### 3.6 Docker 部署配置 + +#### 3.6.1 Docker Compose 架构 + +```yaml +# docker-compose.account.yml +version: '3.8' + +services: + # API Gateway + gateway: + build: infrastructure/gateway + ports: + - "9443:9443" + environment: + - SPRING_PROFILES_ACTIVE=production + - JAVA_OPTS=-Xmx512m -Xms256m + depends_on: + - keycloak + - user-service + - backend + - redis + networks: + - forge-network + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "https://localhost:9443/actuator/health"] + interval: 30s + timeout: 10s + retries: 3 + + # User Service + user-service: + build: services/user-service + ports: + - "8086:8086" + environment: + - SPRING_PROFILES_ACTIVE=production + - DATABASE_URL=jdbc:postgresql://postgres:5432/forge + - DATABASE_USERNAME=${DB_USERNAME} + - DATABASE_PASSWORD=${DB_PASSWORD} + - JWT_SECRET=${JWT_SECRET} + - JWT_EXPIRATION_MS=900000 + - JWT_REFRESH_EXPIRATION_MS=604800000 + - REDIS_URL=redis://redis:6379 + - KEYCLOAK_URL=${KEYCLOAK_URL} + - SMS_API_KEY=${SMS_API_KEY} + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_started + networks: + - forge-network + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://localhost:8086/actuator/health"] + interval: 30s + timeout: 10s + retries: 3 + + # Redis (缓存 + Session + Token 黑名单) + redis: + image: redis:7-alpine + ports: + - "6379:6379" + volumes: + - redis-data:/data + command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru + networks: + - forge-network + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 5 + +networks: + forge-network: + driver: bridge + +volumes: + redis-data: +``` + +--- + +## 4. 实施计划 + +### 4.1 Phase 1: 基础设施 (第 1-2 周) + +#### 目标 +- 部署 Redis (缓存 + Token 黑名单) +- 创建 User Service 项目框架 +- 配置数据库表结构 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 创建 User Service Gradle 模块 | Claude | - | 2h | +| 配置 PostgreSQL 数据库表 | Claude | - | 4h | +| 部署 Redis 实例 | Claude | docker-compose | 1h | +| 实现 User Entity 和 Repository | Claude | - | 4h | +| 实现基础 CRUD API | Claude | - | 4h | +| 单元测试 (User CRUD) | Claude | - | 4h | + +#### 交付物 +- [ ] User Service 基础框架 +- [ ] 数据库迁移脚本 +- [ ] Docker 配置 + +### 4.2 Phase 2: 认证功能 (第 3-4 周) + +#### 目标 +- 实现邮箱/密码登录 +- 实现 JWT Token 发行和验证 +- 实现 Token 刷新和退出 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 实现 BCrypt 密码加密 | Claude | Phase 1 | 2h | +| 实现 /api/auth/login | Claude | Phase 1 | 4h | +| 实现 JWT Token Service | Claude | - | 4h | +| 实现 /api/auth/refresh | Claude | Token Service | 2h | +| 实现 /api/auth/logout | Claude | Token Service | 2h | +| 集成 Keycloak Federation | Claude | Keycloak | 4h | +| 实现 GitHub OAuth 登录 | Claude | Keycloak | 4h | +| 单元测试 (认证) | Claude | - | 4h | +| 集成测试 (认证流) | Claude | - | 4h | + +#### 交付物 +- [ ] 邮箱/密码登录 +- [ ] GitHub OAuth 登录 +- [ ] JWT Token 生命周期管理 + +### 4.3 Phase 3: 权限系统 (第 5-6 周) + +#### 目标 +- 实现 RBAC 权限模型 +- 实现权限校验注解 +- 实现 API Gateway 权限集成 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 设计权限数据模型 | Claude | Phase 1 | 2h | +| 实现 Role 和 Permission Entity | Claude | - | 2h | +| 实现 @RolesRequired 注解 | Claude | - | 4h | +| 实现 @PermissionRequired 注解 | Claude | - | 4h | +| 实现权限校验 Service | Claude | - | 4h | +| 实现 User Role Management API | Claude | - | 4h | +| 实现 API Gateway 权限过滤器 | Claude | - | 6h | +| 单元测试 (权限) | Claude | - | 4h | +| 集成测试 (权限流) | Claude | - | 4h | + +#### 交付物 +- [ ] RBAC 权限模型 +- [ ] 权限校验注解 +- [ ] API Gateway 集成 + +### 4.4 Phase 4: API Gateway (第 7-8 周) + +#### 目标 +- 部署 Spring Cloud Gateway +- 实现 JWT 验证 +- 实现限流和熔断 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 创建 Gateway Gradle 模块 | Claude | - | 2h | +| 实现 JWT 验证过滤器 | Claude | Phase 2 | 4h | +| 实现路由配置 | Claude | - | 2h | +| 实现限流过滤器 (Redis) | Claude | Phase 1 | 4h | +| 实现熔断器配置 | Claude | - | 2h | +| 实现请求日志中间件 | Claude | - | 2h | +| 配置 HTTPS | Claude | - | 2h | +| 单元测试 (Gateway) | Claude | - | 4h | +| E2E 测试 (网关路由) | Claude | - | 4h | + +#### 交付物 +- [ ] Spring Cloud Gateway +- [ ] JWT 验证 +- [ ] 限流和熔断 + +### 4.5 Phase 5: 组织管理 (第 9-10 周) + +#### 目标 +- 实现多租户组织管理 +- 实现组织成员管理 +- 实现组织级权限 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 实现 Organization Entity | Claude | Phase 1 | 2h | +| 实现 Org Member Entity | Claude | Phase 1 | 2h | +| 实现组织 CRUD API | Claude | - | 4h | +| 实现成员管理 API | Claude | - | 4h | +| 实现组织级权限校验 | Claude | Phase 3 | 4h | +| 实现邀请链接生成 | Claude | - | 2h | +| 单元测试 (组织) | Claude | - | 4h | + +#### 交付物 +- [ ] 多租户组织 +- [ ] 成员管理 +- [ ] 组织级权限 + +### 4.6 Phase 6: 高级功能 (第 11-12 周) + +#### 目标 +- 实现手机号登录 +- 实现企业 SSO +- 实现审计日志 + +#### 任务 + +| 任务 | 负责人 | 依赖 | 工时 | +|------|--------|------|------| +| 集成短信网关 | Claude | Phase 2 | 4h | +| 实现 /api/auth/send-sms | Claude | - | 2h | +| 实现 /api/auth/verify-phone | Claude | - | 2h | +| 配置 SAML Identity Brokering | Claude | Phase 2 | 4h | +| 实现审计日志 Service | Claude | Phase 1 | 4h | +| 实现登录日志记录 | Claude | Phase 2 | 2h | +| 实现安全告警 | Claude | - | 4h | +| 单元测试 (高级功能) | Claude | - | 4h | + +#### 交付物 +- [ ] 手机号登录 +- [ ] 企业 SSO (SAML/OIDC) +- [ ] 完整审计日志 + +### 4.7 总体时间线 + +``` +周次 Phase 任务 状态 里程碑 +─────────────────────────────────────────────────────────────── +1-2 Phase 1 基础设施 ⏳ User Service 框架 +3-4 Phase 2 认证功能 ⏳ 登录 + Token +5-6 Phase 3 权限系统 ⏳ RBAC 模型 +7-8 Phase 4 API Gateway ⏳ Gateway 部署 +9-10 Phase 5 组织管理 ⏳ 多租户 +11-12 Phase 6 高级功能 ⏳ 完整功能 +─────────────────────────────────────────────────────────────── + 总工时: ~120 小时 +``` + +--- + +## 5. 风险与缓解 + +| 风险 | 影响 | 概率 | 缓解措施 | +|------|------|------|----------| +| **JWT 安全** | 高 | 中 | 短期 Token (15min) + Token 黑名单 + Redis | +| **密码泄露** | 高 | 低 | BCrypt, 密码强度校验, 登录失败锁定 | +| **SSO 配置复杂** | 中 | 中 | 提供配置模板, 详细文档 | +| **性能瓶颈** | 中 | 低 | 限流, 缓存, 熔断 | +| **多租户隔离** | 高 | 低 | 数据库级隔离 + 行级安全策略 | +| **Keycloak 升级** | 低 | 低 | 容器化部署, 配置即代码 | + +--- + +## 6. 成本估算 + +### 6.1 服务器资源 + +| 服务 | CPU | 内存 | 实例数 | 月成本估算 | +|------|-----|------|--------|------------| +| API Gateway | 0.5 | 512MB | 1 | $10 | +| User Service | 0.5 | 512MB | 1 | $10 | +| Redis | 0.25 | 256MB | 1 | $5 | +| **合计** | - | - | - | **$25/月** | + +### 6.2 人力成本 + +| Phase | 任务 | 估算工时 | +|-------|------|----------| +| Phase 1 | 基础设施 | 19h | +| Phase 2 | 认证功能 | 28h | +| Phase 3 | 权限系统 | 34h | +| Phase 4 | API Gateway | 30h | +| Phase 5 | 组织管理 | 22h | +| Phase 6 | 高级功能 | 26h | +| **合计** | - | **~159h** | + +--- + +## 7. 附录 + +### 7.1 参考文档 + +- [Keycloak Documentation](https://www.keycloak.org/documentation) +- [Spring Cloud Gateway](https://docs.spring.io/spring-cloud-gateway/docs/current/reference/html/) +- [Spring Security OAuth2](https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html) +- [JWT Best Practices](https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/) +- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) + +### 7.2 配置示例 + +#### Keycloak Realm 配置 + +```json +{ + "realm": "forge", + "enabled": true, + "registrationAllowed": true, + "loginWithEmailAllowed": true, + "duplicateEmailsAllowed": false, + "resetPasswordAllowed": true, + "editUsernameAllowed": false, + "bruteForceProtected": true, + "identityProviders": [ + { + "alias": "github", + "providerId": "github", + "enabled": true, + "updateProfileFirstLoginMode": "on", + "config": { + "clientId": "${GITHUB_CLIENT_ID}", + "clientSecret": "${GITHUB_CLIENT_SECRET}", + "redirectUri": "https://forge.example.com/auth/callback/github" + } + } + ] +} +``` + +### 7.3 变更日志 + +| 版本 | 日期 | 作者 | 变更 | +|------|------|------|------| +| v1.0 | 2026-02-21 | Claude | 初始设计文档 | \ No newline at end of file diff --git a/docs/user_auth/account-auth-sso-implementation-plan.md b/docs/user_auth/account-auth-sso-implementation-plan.md new file mode 100644 index 0000000..67f467f --- /dev/null +++ b/docs/user_auth/account-auth-sso-implementation-plan.md @@ -0,0 +1,2165 @@ +# Forge Platform 账号权限 SSO 实施计划 + +> 版本: v1.1 +> 作者: Claude Sonnet 4.5 + zhaoqi +> 日期: 2026-02-21 +> 状态: ✅ Phase 1-5 已完成 (2026-02-21) +> 最后更新: 2026-02-21 + +--- + +## 目录 + +- [执行摘要](#执行摘要) +- [前置条件](#前置条件) +- [Phase 1: 基础设施](#phase-1-基础设施) +- [Phase 2: 认证功能](#phase-2-认证功能) +- [Phase 3: 权限系统](#phase-3-权限系统) +- [Phase 4: API Gateway](#phase-4-api-gateway) +- [Phase 5: 组织管理](#phase-5-组织管理) +- [Phase 6: 高级功能](#phase-6-高级功能) +- [验收标准](#验收标准) +- [风险与回滚](#风险与回滚) + +--- + +## 执行摘要 + +本实施计划实现 Forge Platform 的账号、权限和 SSO 功能，分为 6 个 Phase，总工时约 160 小时。 + +**目标架构:** +``` +用户 → Nginx:9443 → API Gateway:9443 → User Service:8086 / Backend:8080 + ↓ + Redis (缓存 + Token 黑名单) + ↓ + PostgreSQL (用户 + 权限数据) +``` + +--- + +## 前置条件 + +### 环境要求 + +| 软件 | 版本 | 说明 | +|------|------|------| +| JDK | 21+ | Gradle 8.5 要求 | +| PostgreSQL | 16+ | 数据库 | +| Redis | 7+ | 缓存 + Token 黑名单 | +| Keycloak | 25+ | 身份认证 | + +### 现有依赖 + +- `forge-platform` 仓库 (当前目录) +- PostgreSQL 数据库已配置 +- Keycloak 已部署 (端口 8180) + +### 环境变量准备 + +创建 `.env.account` 文件: + +```bash +# Database +DB_HOST=localhost +DB_PORT=5432 +DB_NAME=forge +DB_USERNAME=forge +DB_PASSWORD=your_secure_password + +# Redis +REDIS_HOST=localhost +REDIS_PORT=6379 + +# JWT (使用 openssl rand -base64 32 生成) +JWT_SECRET=your_jwt_secret_key_min_32_chars +JWT_REFRESH_SECRET=your_jwt_refresh_secret_key_min_32_chars + +# Encryption (AES-256-GCM, 使用 openssl rand -base64 32 生成) +ENCRYPTION_KEY=your_encryption_key_32_chars + +# Keycloak +KEYCLOAK_URL=http://localhost:8180 +KEYCLOAK_REALM=forge + +# SMS (可选 - 手机号登录) +SMS_API_KEY=your_sms_api_key +SMS_API_URL=https://sms.example.com + +# GitHub OAuth (可选) +GITHUB_CLIENT_ID=your_github_client_id +GITHUB_CLIENT_SECRET=your_github_client_secret +``` + +--- + +## Phase 1: 基础设施 + +**目标**: 创建 User Service 项目框架、数据库表结构、Redis 集成 + +### 1.1 创建 User Service Gradle 模块 + +#### 1.1.1 模块结构 + +``` +services/user-service/ +├── build.gradle.kts # Gradle 构建配置 +├── settings.gradle.kts # 模块设置 +├── src/main/ +│ ├── kotlin/ +│ │ └── com/forge/user/ +│ │ ├── UserServiceApplication.kt # 启动类 +│ │ ├── config/ +│ │ │ ├── AppConfig.kt # 应用配置 +│ │ │ ├── DatabaseConfig.kt # 数据库配置 +│ │ │ └── RedisConfig.kt # Redis 配置 +│ │ ├── entity/ # 实体类 +│ │ ├── repository/ # 数据访问 +│ │ ├── service/ # 业务逻辑 +│ │ ├── controller/ # REST API +│ │ ├── dto/ # 数据传输对象 +│ │ ├── security/ # 安全相关 +│ │ └── exception/ # 异常处理 +│ └── resources/ +│ ├── application.yml # 应用配置 +│ └── db/migration/ # Flyway 迁移脚本 +└── src/test/ + └── kotlin/ +``` + +#### 1.1.2 build.gradle.kts + +```kotlin +plugins { + id("org.springframework.boot") version "3.3.5" + id("io.spring.dependency-management") version "1.1.6" + id("org.jetbrains.kotlin.plugin.jpa") version "1.9.25" + id("org.jetbrains.kotlin.plugin.spring") version "1.9.25" + id("com.github.johnrengelman.shadow") version "8.1.1" + kotlin("jvm") version "1.9.25" + kotlin("plugin.spring") version "1.9.25" +} + +group = "com.forge" +version = "1.0.0" +name = "user-service" + +repositories { + mavenCentral() +} + +extra["springCloudVersion"] = "2023.0.3" +extra["kotlinVersion"] = "1.9.25" + +dependencies { + // Spring Boot + implementation("org.springframework.boot:spring-boot-starter-web") + implementation("org.springframework.boot:spring-boot-starter-webflux") + implementation("org.springframework.boot:spring-boot-starter-data-jpa") + implementation("org.springframework.boot:spring-boot-starter-data-redis") + implementation("org.springframework.boot:spring-boot-starter-validation") + implementation("org.springframework.boot:spring-boot-starter-security") + implementation("org.springframework.boot:spring-boot-starter-oauth2-resource-server") + + // Spring Cloud + implementation("org.springframework.cloud:spring-cloud-starter-gateway") + + // Database + implementation("org.postgresql:postgresql:42.7.3") + implementation("org.flywaydb:flyway-core:10.18.0") + implementation("com.zaxxer:HikariCP:5.1.0") + + // Security + implementation("io.jsonwebtoken:jjwt-api:0.12.6") + implementation("io.jsonwebtoken:jjwt-impl:0.12.6") + implementation("io.jsonwebtoken:jjwt-jackson:0.12.6") + implementation("org.bouncycastle:bcprov-jdk18on:1.77") + implementation("org.mindrot:jbcrypt:0.4") + + // Config + implementation("org.yaml:snakeyaml:2.2") + implementation("com.typesafe:config:1.4.3") + + // Logging + implementation("net.logstash.logback:logstash-logback-encoder:8.0") + runtimeOnly("ch.qos.logback:logback-classic") + + // Testing + testImplementation("org.springframework.boot:spring-boot-starter-test") + testImplementation("org.springframework.security:spring-security-test") + testImplementation("org.jetbrains.kotlin:kotlin-test:1.9.25") + testImplementation("com.h2database:h2") + testImplementation("org.testcontainers:testcontainers:1.19.8") +} + +tasks.withType { + kotlinOptions { + jvmTarget = "21" + freeCompilerArgs += listOf("-opt-in=kotlin.RequiresOptIn") + } +} + +tasks.named("bootJar") { + archiveFileName.set("user-service.jar") +} +``` + +#### 1.1.3 settings.gradle.kts 包含新模块 + +```kotlin +// 在根目录 settings.gradle.kts 中添加 +include(":services:user-service") +``` + +--- + +### 1.2 数据库表结构 + +#### 1.2.1 Flyway 迁移脚本 + +**文件:** `services/user-service/src/main/resources/db/migration/V1__init_user_schema.sql` + +```sql +-- 用户表 +CREATE TABLE IF NOT EXISTS users ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + username VARCHAR(64) NOT NULL UNIQUE, + email VARCHAR(255) UNIQUE, + phone VARCHAR(20) UNIQUE, + password_hash VARCHAR(255) NOT NULL, + status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE', + avatar VARCHAR(512), + bio TEXT, + settings JSONB DEFAULT '{}', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + last_login_at TIMESTAMP WITH TIME ZONE, + last_login_ip INET, + email_verified BOOLEAN DEFAULT FALSE, + phone_verified BOOLEAN DEFAULT FALSE, + CONSTRAINT users_username_format CHECK (username ~ '^[a-zA-Z0-9_-]{3,64}$'), + CONSTRAINT users_email_format CHECK (email IS NULL OR email ~ '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$') +); + +-- 索引 +CREATE INDEX idx_users_email ON users(email); +CREATE INDEX idx_users_phone ON users(phone); +CREATE INDEX idx_users_status ON users(status); +CREATE INDEX idx_users_created_at ON users(created_at); + +-- 组织表 +CREATE TABLE IF NOT EXISTS organizations ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + name VARCHAR(128) NOT NULL, + slug VARCHAR(128) NOT NULL UNIQUE, + avatar VARCHAR(512), + description TEXT, + owner_id UUID NOT NULL REFERENCES users(id) ON DELETE RESTRICT, + plan VARCHAR(20) NOT NULL DEFAULT 'FREE', + settings JSONB DEFAULT '{}', + metadata JSONB DEFAULT '{}', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + CONSTRAINT org_slug_format CHECK (slug ~ '^[a-z0-9-]+$') +); + +CREATE INDEX idx_orgs_slug ON organizations(slug); +CREATE INDEX idx_orgs_owner ON organizations(owner_id); + +-- 组织成员表 +CREATE TABLE IF NOT EXISTS org_members ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + org_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role VARCHAR(20) NOT NULL, + joined_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + invited_by UUID REFERENCES users(id), + UNIQUE(org_id, user_id) +); + +CREATE INDEX idx_org_members_org ON org_members(org_id); +CREATE INDEX idx_org_members_user ON org_members(user_id); + +-- 用户角色表 (全局 + 组织级) +CREATE TABLE IF NOT EXISTS user_roles ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role_name VARCHAR(64) NOT NULL, + org_id UUID REFERENCES organizations(id) ON DELETE CASCADE, + granted_by UUID NOT NULL REFERENCES users(id), + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + expires_at TIMESTAMP WITH TIME ZONE, + UNIQUE(user_id, role_name, org_id) +); + +CREATE INDEX idx_user_roles_user ON user_roles(user_id); +CREATE INDEX idx_user_roles_org ON user_roles(org_id); + +-- 权限表 +CREATE TABLE IF NOT EXISTS permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + resource VARCHAR(64) NOT NULL, + action VARCHAR(64) NOT NULL, + description TEXT, + conditions JSONB, + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(resource, action) +); + +-- 角色权限关联表 +CREATE TABLE IF NOT EXISTS role_permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + role_name VARCHAR(64) NOT NULL, + permission_id UUID NOT NULL REFERENCES permissions(id) ON DELETE CASCADE, + granted_by UUID NOT NULL REFERENCES users(id), + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(role_name, permission_id) +); + +-- 第三方登录绑定表 +CREATE TABLE IF NOT EXISTS user_identities ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + provider VARCHAR(32) NOT NULL, + provider_user_id VARCHAR(255) NOT NULL, + access_token TEXT, + refresh_token TEXT, + expires_at TIMESTAMP WITH TIME ZONE, + metadata JSONB DEFAULT '{}', + linked_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(provider, provider_user_id) +); + +CREATE INDEX idx_user_identities_user ON user_identities(user_id); +CREATE INDEX idx_user_identities_provider ON user_identities(provider, provider_user_id); + +-- 登录日志表 (审计) +CREATE TABLE IF NOT EXISTS login_logs ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID REFERENCES users(id), + provider VARCHAR(32) NOT NULL, + ip_address INET NOT NULL, + user_agent TEXT, + success BOOLEAN NOT NULL, + failure_reason VARCHAR(255), + request_id UUID DEFAULT gen_random_uuid(), + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW() +); + +CREATE INDEX idx_login_logs_user ON login_logs(user_id); +CREATE INDEX idx_login_logs_created ON login_logs(created_at); +CREATE INDEX idx_login_logs_ip ON login_logs(ip_address); + +-- 操作审计表 +CREATE TABLE IF NOT EXISTS audit_logs ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID REFERENCES users(id), + action VARCHAR(128) NOT NULL, + resource_type VARCHAR(64), + resource_id VARCHAR(128), + old_value JSONB, + new_value JSONB, + ip_address INET, + user_agent TEXT, + request_id UUID, + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW() +); + +CREATE INDEX idx_audit_logs_user ON audit_logs(user_id); +CREATE INDEX idx_audit_logs_created ON audit_logs(created_at); +CREATE INDEX idx_audit_logs_resource ON audit_logs(resource_type, resource_id); +``` + +#### 1.2.2 初始化权限数据 + +**文件:** `services/user-service/src/main/resources/db/migration/V2__init_permissions.sql` + +```sql +-- 插入基础权限 +INSERT INTO permissions (resource, action, description) VALUES + -- Workspace 权限 + ('workspace', 'read', '读取工作空间'), + ('workspace', 'write', '创建/修改文件'), + ('workspace', 'delete', '删除工作空间'), + ('workspace', 'manage', '管理工作空间设置'), + + -- Chat 权限 + ('chat', 'read', '查看对话'), + ('chat', 'write', '发送消息'), + ('chat', 'delete', '删除对话'), + + -- Workflow 权限 + ('workflow', 'read', '查看工作流'), + ('workflow', 'create', '创建工作流'), + ('workflow', 'edit', '编辑工作流'), + ('workflow', 'delete', '删除工作流'), + ('workflow', 'run', '运行工作流'), + + -- MCP 权限 + ('mcp', 'call', '调用 MCP 工具'), + + -- Admin 权限 + ('admin', 'access', '访问管理后台'), + ('admin', 'users', '管理用户'), + ('admin', 'roles', '管理角色'), + ('admin', 'settings', '管理系统设置'), + + -- Organization 权限 + ('org', 'read', '查看组织信息'), + ('org', 'manage', '管理组织设置'), + ('org', 'members', '管理组织成员') +ON CONFLICT (resource, action) DO NOTHING; + +-- 插入基础角色 +INSERT INTO roles (role_name, description, permissions) VALUES + ('admin', '平台管理员，拥有所有权限', '{ALL}'), + ('developer', '普通开发者，可以创建和管理资源', '{workspace:read,workspace:write,chat:read,chat:write,workflow:read,workflow:create,workflow:edit,workflow:run,mcp:call}'), + ('viewer', '只读用户，仅能查看资源', '{workspace:read,chat:read,workflow:read}') +ON CONFLICT DO NOTHING; +``` + +--- + +### 1.3 应用配置 + +#### 1.3.1 application.yml + +**文件:** `services/user-service/src/main/resources/application.yml` + +```yaml +spring: + application: + name: user-service + + config: + import: optional:file:./.env.account + + datasource: + url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:forge} + username: ${DB_USERNAME:forge} + password: ${DB_PASSWORD:forge_local_dev} + driver-class-name: org.postgresql.Driver + hikari: + maximum-pool-size: 20 + minimum-idle: 5 + idle-timeout: 300000 + connection-timeout: 20000 + max-lifetime: 1200000 + + jpa: + hibernate: + ddl-auto: validate + show-sql: false + properties: + hibernate: + dialect: org.hibernate.dialect.PostgreSQLDialect + format_sql: true + jdbc: + batch_size: 50 + order_inserts: true + order_updates: true + + data: + redis: + host: ${REDIS_HOST:localhost} + port: ${REDIS_PORT:6379} + timeout: 5000ms + lettuce: + pool: + max-active: 20 + max-idle: 10 + min-idle: 5 + + flyway: + enabled: true + locations: classpath:db/migration + baseline-on-migrate: true + validate-on-migrate: true + +server: + port: 8086 + error: + include-message: always + include-binding-errors: always + include-stacktrace: ${SPRING_PROFILES_ACTIVE:development:never} + + servlet: + context-path: / + +# 应用配置 +app: + host: ${APP_HOST:0.0.0.0} + port: ${SERVER_PORT:8086} + + jwt: + secret: ${JWT_SECRET:your_jwt_secret_key_at_least_32_chars} + refresh-secret: ${JWT_REFRESH_SECRET:your_jwt_refresh_secret_at_least_32_chars} + expiration-ms: 900000 # 15 minutes + refresh-expiration-ms: 604800000 # 7 days + + encryption: + key: ${ENCRYPTION_KEY:your_encryption_key_32_chars} + + security: + bcrypt-rounds: 12 + max-login-attempts: 5 + lockout-duration-minutes: 30 + + rate-limit: + enabled: true + anonymous-rpm: 60 + authenticated-rpm: 1000 + api-rpm: 5000 + +# 日志配置 +logging: + level: + root: INFO + com.forge.user: DEBUG + org.springframework.security: INFO + org.hibernate.SQL: WARN + pattern: + console: "%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n" + +# Actuator +management: + endpoints: + web: + exposure: + include: health,info,metrics,prometheus + endpoint: + health: + show-details: when-authorized +``` + +#### 1.3.2 config.yaml (环境配置) + +**文件:** `services/user-service/config.yaml` + +```yaml +# 生产环境配置示例 +database: + host: "postgres" + port: 5432 + name: "forge" + username: "forge" + password: "${DB_PASSWORD}" + +redis: + host: "redis" + port: 6379 + +jwt: + secret: "${JWT_SECRET}" + refresh-secret: "${JWT_REFRESH_SECRET}" + expiration-ms: 900000 + refresh-expiration-ms: 604800000 + +security: + bcrypt-rounds: 12 + max-login-attempts: 5 + lockout-duration-minutes: 30 + +keycloak: + url: "http://keycloak:8180" + realm: "forge" + +sms: + enabled: false + api-key: "${SMS_API_KEY}" + api-url: "https://sms.example.com" + +github: + enabled: false + client-id: "${GITHUB_CLIENT_ID}" + client-secret: "${GITHUB_CLIENT_SECRET}" +``` + +--- + +### 1.4 核心类实现 + +#### 1.4.1 启动类 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/UserServiceApplication.kt` + +```kotlin +package com.forge.user + +import org.springframework.boot.SpringApplication +import org.springframework.boot.autoconfigure.SpringBootApplication +import org.springframework.boot.context.properties.EnableConfigurationProperties + +@SpringBootApplication +@EnableConfigurationProperties +class UserServiceApplication { + + companion object { + @JvmStatic + fun main(args: Array) { + SpringApplication.run(UserServiceApplication::class.java, *args) + } + } +} +``` + +#### 1.4.2 应用配置类 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/config/AppConfig.kt` + +```kotlin +package com.forge.user.config + +import org.springframework.boot.context.properties.ConfigurationProperties +import org.springframework.context.annotation.Configuration + +@Configuration +@ConfigurationProperties(prefix = "app") +data class AppConfig( + val host: String = "0.0.0.0", + val port: Int = 8086, + val jwt: JwtConfig = JwtConfig(), + val encryption: EncryptionConfig = EncryptionConfig(), + val security: SecurityConfig = SecurityConfig(), + val rateLimit: RateLimitConfig = RateLimitConfig() +) + +data class JwtConfig( + val secret: String = "", + val refreshSecret: String = "", + val expirationMs: Long = 900000, + val refreshExpirationMs: Long = 604800000 +) + +data class EncryptionConfig( + val key: String = "" +) + +data class SecurityConfig( + val bcryptRounds: Int = 12, + val maxLoginAttempts: Int = 5, + val lockoutDurationMinutes: Int = 30 +) + +data class RateLimitConfig( + val enabled: Boolean = true, + val anonymousRpm: Int = 60, + val authenticatedRpm: Int = 1000, + val apiRpm: Int = 5000 +) +``` + +#### 1.4.3 实体类 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/entity/UserEntity.kt` + +```kotlin +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "users") +class UserEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(nullable = false, unique = true, length = 64) + val username: String, + + @Column(unique = true) + var email: String? = null, + + @Column(unique = true, length = 20) + var phone: String? = null, + + @Column(name = "password_hash", nullable = false, length = 255) + val passwordHash: String, + + @Enumerated(EnumType.STRING) + @Column(nullable = false, length = 20) + var status: UserStatus = UserStatus.ACTIVE, + + @Column(length = 512) + var avatar: String? = null, + + @Column(columnDefinition = "TEXT") + var bio: String? = null, + + @Column(columnDefinition = "jsonb") + var settings: String = "{}", + + @Column(name = "created_at", nullable = false, updatable = false) + val createdAt: Instant = Instant.now(), + + @Column(name = "updated_at", nullable = false) + var updatedAt: Instant = Instant.now(), + + @Column(name = "last_login_at") + var lastLoginAt: Instant? = null, + + @Column(name = "last_login_ip") + var lastLoginIp: String? = null, + + @Column(name = "email_verified") + var emailVerified: Boolean = false, + + @Column(name = "phone_verified") + var phoneVerified: Boolean = false +) { + @PreUpdate + fun preUpdate() { + updatedAt = Instant.now() + } +} + +enum class UserStatus { + ACTIVE, + INACTIVE, + SUSPENDED, + DELETED +} +``` + +#### 1.4.4 更多实体类 + +以下实体类在后续 Phase 中逐步实现: +- `OrganizationEntity` +- `OrgMemberEntity` +- `UserRoleEntity` +- `PermissionEntity` +- `UserIdentityEntity` +- `LoginLogEntity` +- `AuditLogEntity` + +--- + +## Phase 2: 认证功能 + +**目标**: 实现用户 CRUD、登录、注册、JWT Token 管理 + +### 2.1 Repository 层 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/repository/UserRepository.kt` + +```kotlin +package com.forge.user.repository + +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.Optional +import java.util.UUID + +@Repository +interface UserRepository : JpaRepository { + + fun findByUsername(username: String): Optional + + fun findByEmail(email: String): Optional + + fun findByPhone(phone: String): Optional + + fun existsByUsername(username: String): Boolean + + fun existsByEmail(email: String): Boolean + + fun existsByPhone(phone: String): Boolean + + @Query("SELECT u FROM UserEntity u WHERE u.status = :status") + fun findByStatus(@Param("status") status: UserStatus): List + + @Query("SELECT u FROM UserEntity u WHERE u.username ILIKE %:keyword% OR u.email ILIKE %:keyword%") + fun searchByKeyword(@Param("keyword") keyword: String): List + + @Query("SELECT u FROM UserEntity u WHERE u.id IN :ids") + fun findAllByIds(@Param("ids") ids: Collection): List +} +``` + +### 2.2 DTO 定义 + +#### 2.2.1 请求 DTO + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/dto/RegisterRequest.kt` + +```kotlin +package com.forge.user.dto + +import jakarta.validation.constraints.Email +import jakarta.validation.constraints.NotBlank +import jakarta.validation.constraints.Pattern +import jakarta.validation.constraints.Size + +data class RegisterRequest( + @field:NotBlank(message = "用户名不能为空") + @field:Size(min = 3, max = 64, message = "用户名长度必须在3-64之间") + @field:Pattern(regexp = "^[a-zA-Z0-9_-]{3,64}$", message = "用户名格式不正确，只能包含字母、数字、下划线和连字符") + val username: String, + + @field:NotBlank(message = "密码不能为空") + @field:Size(min = 8, max = 128, message = "密码长度必须在8-128之间") + val password: String, + + @field:Email(message = "邮箱格式不正确") + val email: String? = null, + + @field:Pattern(regexp = "^\\+?[1-9]\\d{1,14}$", message = "手机号格式不正确") + val phone: String? = null +) + +data class LoginRequest( + @field:NotBlank(message = "用户名不能为空") + val username: String, + + @field:NotBlank(message = "密码不能为空") + val password: String +) + +data class RefreshTokenRequest( + @field:NotBlank(message = "Refresh token 不能为空") + val refreshToken: String +) + +data class UpdateUserRequest( + @field:Size(max = 64, message = "用户名长度不能超过64") + val username: String? = null, + + @field:Email(message = "邮箱格式不正确") + val email: String? = null, + + @field:Size(max = 512, message = "头像URL长度不能超过512") + val avatar: String? = null, + + @field:Size(max = 500, message = "个人简介不能超过500字符") + val bio: String? = null +) + +data class ChangePasswordRequest( + @field:NotBlank(message = "原密码不能为空") + val oldPassword: String, + + @field:NotBlank(message = "新密码不能为空") + @field:Size(min = 8, max = 128, message = "新密码长度必须在8-128之间") + val newPassword: String +) + +data class UpdateUserStatusRequest( + val status: UserStatus +) +``` + +#### 2.2.2 响应 DTO + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/dto/UserResponse.kt` + +```kotlin +package com.forge.user.dto + +import com.forge.user.entity.UserStatus +import java.time.Instant +import java.util.UUID + +data class UserResponse( + val id: UUID, + val username: String, + val email: String?, + val phone: String?, + val status: UserStatus, + val avatar: String?, + val bio: String?, + val emailVerified: Boolean, + val phoneVerified: Boolean, + val createdAt: Instant, + val lastLoginAt: Instant? +) + +data class AuthResponse( + val accessToken: String, + val refreshToken: String, + val tokenType: String = "Bearer", + val expiresIn: Long, + val user: UserResponse +) + +data class TokenRefreshResponse( + val accessToken: String, + val tokenType: String = "Bearer", + val expiresIn: Long +) + +data class LogoutResponse( + val success: true, + val message: "Successfully logged out" +) + +data class ApiResponse( + val success: Boolean, + val data: T?, + val message: String?, + val error: String? +) { + companion object { + fun success(data: T? = null, message: String? = null): ApiResponse = + ApiResponse(success = true, data = data, message = message, error = null) + + fun error(message: String, error: String? = null): ApiResponse = + ApiResponse(success = false, data = null, message = message, error = error) + } +} +``` + +### 2.3 Service 层 + +#### 2.3.1 用户服务 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/service/UserService.kt` + +```kotlin +package com.forge.user.service + +import com.forge.user.dto.* +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import com.forge.user.repository.UserRepository +import com.forge.user.exception.UserException.* +import org.mindrot.jbcrypt.BCrypt +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional +import java.time.Instant +import java.util.UUID + +@Service +class UserService( + private val userRepository: UserRepository +) { + fun register(request: RegisterRequest): UserEntity { + // 检查用户名是否存在 + if (userRepository.existsByUsername(request.username)) { + throw UsernameAlreadyExistsException("用户名已存在") + } + + // 检查邮箱是否存在 + request.email?.let { + if (userRepository.existsByEmail(it)) { + throw EmailAlreadyExistsException("邮箱已被注册") + } + } + + // 检查手机号是否存在 + request.phone?.let { + if (userRepository.existsByPhone(it)) { + throw PhoneAlreadyExistsException("手机号已被注册") + } + } + + // 密码加密 + val passwordHash = BCrypt.hashpw(request.password, BCrypt.gensalt(12)) + + // 创建用户 + val user = UserEntity( + username = request.username, + passwordHash = passwordHash, + email = request.email, + phone = request.phone, + emailVerified = false, + phoneVerified = false + ) + + return userRepository.save(user) + } + + fun getUserById(id: UUID): UserEntity { + return userRepository.findById(id) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + fun getUserByUsername(username: String): UserEntity { + return userRepository.findByUsername(username) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + fun getUserByEmail(email: String): UserEntity { + return userRepository.findByEmail(email) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + @Transactional + fun updateUser(id: UUID, request: UpdateUserRequest): UserEntity { + val user = getUserById(id) + + request.username?.let { + if (it != user.username && userRepository.existsByUsername(it)) { + throw UsernameAlreadyExistsException("用户名已存在") + } + user.username = it + } + + request.email?.let { + if (it != user.email && userRepository.existsByEmail(it)) { + throw EmailAlreadyExistsException("邮箱已被注册") + } + user.email = it + user.emailVerified = false + } + + request.avatar?.let { user.avatar = it } + request.bio?.let { user.bio = it } + + return userRepository.save(user) + } + + @Transactional + fun changePassword(id: UUID, request: ChangePasswordRequest) { + val user = getUserById(id) + + // 验证原密码 + if (!BCrypt.checkpw(request.oldPassword, user.passwordHash)) { + throw InvalidPasswordException("原密码不正确") + } + + // 更新密码 + user.passwordHash = BCrypt.hashpw(request.newPassword, BCrypt.gensalt(12)) + userRepository.save(user) + } + + @Transactional + fun updateLastLogin(id: UUID, ipAddress: String?) { + val user = getUserById(id) + user.lastLoginAt = Instant.now() + user.lastLoginIp = ipAddress + userRepository.save(user) + } + + @Transactional + fun updateUserStatus(id: UUID, status: UserStatus) { + val user = getUserById(id) + user.status = status + userRepository.save(user) + } + + fun toResponse(user: UserEntity): UserResponse { + return UserResponse( + id = user.id, + username = user.username, + email = user.email, + phone = user.phone, + status = user.status, + avatar = user.avatar, + bio = user.bio, + emailVerified = user.emailVerified, + phoneVerified = user.phoneVerified, + createdAt = user.createdAt, + lastLoginAt = user.lastLoginAt + ) + } + + fun toResponseList(users: List): List { + return users.map { toResponse(it) } + } +} + +// 异常类定义 +sealed class UserException(message: String) : RuntimeException(message) +class UsernameAlreadyExistsException(message: String) : UserException(message) +class EmailAlreadyExistsException(message: String) : UserException(message) +class PhoneAlreadyExistsException(message: String) : UserException(message) +class UserNotFoundException(message: String) : UserException(message) +class InvalidPasswordException(message: String) : UserException(message) +``` + +#### 2.3.2 Token 服务 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/service/JwtService.kt` + +```kotlin +package com.forge.user.service + +import com.forge.user.config.AppConfig +import io.jsonwebtoken.* +import io.jsonwebtoken.security.Keys +import org.slf4j.LoggerFactory +import org.springframework.data.redis.core.StringRedisTemplate +import org.springframework.stereotype.Service +import java.time.Duration +import java.util.* +import javax.crypto.SecretKey + +@Service +class JwtService( + private val appConfig: AppConfig, + private val redisTemplate: StringRedisTemplate +) { + private val logger = LoggerFactory.getLogger(JwtService::class.java) + + private val accessTokenKey: SecretKey by lazy { + Keys.hmacShaKeyFor(appConfig.jwt.secret.toByteArray()) + } + + private val refreshTokenKey: SecretKey by lazy { + Keys.hmacShaKeyFor(appConfig.jwt.refreshSecret.toByteArray()) + } + + /** + * 生成 Access Token + */ + fun generateAccessToken(userId: String, username: String, roles: List): String { + val now = Instant.now().toEpochMilli() + val expiresAt = now + appConfig.jwt.expirationMs + + return Jwts.builder() + .subject(userId) + .claim("username", username) + .claim("roles", roles) + .claim("type", "access") + .issuer("forge-platform") + .issuedAt(Date(now)) + .expiration(Date(expiresAt)) + .signWith(accessTokenKey) + .compact() + } + + /** + * 生成 Refresh Token + */ + fun generateRefreshToken(userId: String): String { + val now = Instant.now().toEpochMilli() + val expiresAt = now + appConfig.jwt.refreshExpirationMs + val tokenId = UUID.randomUUID().toString() + + // 存储到 Redis + redisTemplate.opsForValue().set( + "refresh:$tokenId", + userId, + Duration.ofMillis(appConfig.jwt.refreshExpirationMs) + ) + + return Jwts.builder() + .subject(userId) + .claim("type", "refresh") + .claim("jti", tokenId) + .issuedAt(Date(now)) + .expiration(Date(expiresAt)) + .signWith(refreshTokenKey) + .compact() + } + + /** + * 验证 Access Token + */ + fun validateAccessToken(token: String): Claims? { + return try { + Jwts.parser() + .verifyWith(accessTokenKey) + .build() + .parseSignedClaims(token) + .payload + } catch (e: ExpiredJwtException) { + logger.warn("Access token expired: ${e.message}") + null + } catch (e: Exception) { + logger.warn("Invalid access token: ${e.message}") + null + } + } + + /** + * 验证 Refresh Token + */ + fun validateRefreshToken(token: String): Claims? { + return try { + val claims = Jwts.parser() + .verifyWith(refreshTokenKey) + .build() + .parseSignedClaims(token) + .payload + + // 检查 Token 是否在黑名单 + val jti = claims["jti"] as? String ?: return null + if (!redisTemplate.hasKey("refresh:$jti")) { + return null + } + + claims + } catch (e: Exception) { + logger.warn("Invalid refresh token: ${e.message}") + null + } + } + + /** + * 刷新 Access Token + */ + fun refreshAccessToken(refreshToken: String): Pair? { + val claims = validateRefreshToken(refreshToken) ?: return null + + val userId = claims.subject + val jti = claims["jti"] as? String ?: return null + + // 获取用户信息 + // 注意：这里需要调用 UserService 获取用户名和角色 + // 实际实现中可以通过 userId 查询 Redis Cache 或 UserService + + val newAccessToken = generateAccessToken(userId, "username", emptyList()) + val newRefreshToken = generateRefreshToken(userId) + + // 使旧 Refresh Token 失效 + redisTemplate.delete("refresh:$jti") + + return Pair(newAccessToken, newRefreshToken) + } + + /** + * 使 Refresh Token 失效 + */ + fun revokeRefreshToken(token: String) { + try { + val claims = Jwts.parser() + .verifyWith(refreshTokenKey) + .build() + .parseSignedClaims(token) + .payload + + val jti = claims["jti"] as? String + jti?.let { redisTemplate.delete("refresh:$it") } + } catch (e: Exception) { + logger.warn("Failed to revoke refresh token: ${e.message}") + } + } + + /** + * 使所有 Refresh Token 失效 (用户登出所有设备) + */ + fun revokeAllUserTokens(userId: String) { + val pattern = "refresh:*" + val keys = redisTemplate.keys(pattern) + keys?.forEach { key -> + if (redisTemplate.opsForValue().get(key) == userId) { + redisTemplate.delete(key) + } + } + } + + /** + * 将用户 ID 添加到 Token 黑名单 + */ + fun addToBlacklist(token: String, ttlSeconds: Long) { + redisTemplate.opsForValue().set( + "token:blacklist:$token", + "revoked", + Duration.ofSeconds(ttlSeconds) + ) + } +} +``` + +#### 2.3.3 认证服务 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/service/AuthService.kt` + +```kotlin +package com.forge.user.service + +import com.forge.user.dto.* +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import com.forge.user.exception.UserException.* +import org.mindrot.jbcrypt.BCrypt +import org.slf4j.LoggerFactory +import org.springframework.data.redis.core.StringRedisTemplate +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional +import java.time.Duration + +@Service +class AuthService( + private val userService: UserService, + private val jwtService: JwtService, + private val redisTemplate: StringRedisTemplate, + private val appConfig: com.forge.user.config.AppConfig +) { + private val logger = LoggerFactory.getLogger(AuthService::class.java) + + /** + * 用户注册 + */ + @Transactional + fun register(request: RegisterRequest): AuthResponse { + val user = userService.register(request) + + // 生成 Token + val accessToken = jwtService.generateAccessToken( + user.id.toString(), + user.username, + listOf("user") + ) + val refreshToken = jwtService.generateRefreshToken(user.id.toString()) + + // 更新最后登录 + userService.updateLastLogin(user.id, null) + + logger.info("User registered: ${user.username}") + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(user) + ) + } + + /** + * 用户登录 + */ + @Transactional + fun login(request: LoginRequest, ipAddress: String?): AuthResponse { + val user: UserEntity + + // 根据用户名查找 + try { + user = userService.getUserByUsername(request.username) + } catch (e: UserNotFoundException) { + // 用户名不存在，尝试邮箱 + try { + user = userService.getUserByEmail(request.username) + } catch (e2: UserNotFoundException) { + recordLoginLog(null, "password", ipAddress, false, "User not found") + throw AuthenticationException("用户名或密码不正确") + } + } + + // 检查账户状态 + if (user.status != UserStatus.ACTIVE) { + recordLoginLog(user.id.toString(), "password", ipAddress, false, "Account ${user.status}") + throw AuthenticationException("账户已被${user.status.name.lowercase()}") + } + + // 检查密码 + if (!BCrypt.checkpw(request.password, user.passwordHash)) { + // 记录登录失败 + recordLoginLog(user.id.toString(), "password", ipAddress, false, "Invalid password") + throw AuthenticationException("用户名或密码不正确") + } + + // 检查登录失败次数 + val failKey = "login:fail:${user.id}" + val failCount = redisTemplate.opsForValue().get(failKey)?.toIntOrNull() ?: 0 + + if (failCount >= appConfig.security.maxLoginAttempts) { + recordLoginLog(user.id.toString(), "password", ipAddress, false, "Too many attempts") + throw AuthenticationException("登录失败次数过多，请${appConfig.security.lockoutDurationMinutes}分钟后重试") + } + + // 生成 Token + val accessToken = jwtService.generateAccessToken( + user.id.toString(), + user.username, + listOf("user") + ) + val refreshToken = jwtService.generateRefreshToken(user.id.toString()) + + // 清除失败计数 + redisTemplate.delete(failKey) + + // 更新最后登录 + userService.updateLastLogin(user.id, ipAddress) + + // 记录登录成功 + recordLoginLog(user.id.toString(), "password", ipAddress, true) + + logger.info("User logged in: ${user.username} from $ipAddress") + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(user) + ) + } + + /** + * 刷新 Token + */ + fun refreshToken(request: RefreshTokenRequest): TokenRefreshResponse { + val result = jwtService.refreshAccessToken(request.refreshToken) + ?: throw AuthenticationException("无效的 Refresh Token") + + return TokenRefreshResponse( + accessToken = result.first, + expiresIn = appConfig.jwt.expirationMs / 1000 + ) + } + + /** + * 用户登出 + */ + @Transactional + fun logout(refreshToken: String, accessToken: String) { + // 使 Refresh Token 失效 + jwtService.revokeRefreshToken(refreshToken) + + // 将 Access Token 加入黑名单 (剩余有效期) + val claims = jwtService.validateAccessToken(accessToken) + val expiresIn = claims?.expiration?.time?.let { + (it - System.currentTimeMillis()) / 1000 + } ?: 900 + + jwtService.addToBlacklist(accessToken, expiresIn) + + logger.info("User logged out") + } + + /** + * 记录登录日志 + */ + private fun recordLoginLog( + userId: String?, + provider: String, + ipAddress: String?, + success: Boolean, + failureReason: String? = null + ) { + // 实际实现中应该调用 AuditService + logger.info("Login log: userId=$userId, provider=$provider, ip=$ipAddress, success=$success") + } +} + +class AuthenticationException(message: String) : RuntimeException(message) +``` + +### 2.4 Controller 层 + +#### 2.4.1 Auth Controller + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/controller/AuthController.kt` + +```kotlin +package com.forge.user.controller + +import com.forge.user.dto.* +import com.forge.user.service.AuthService +import jakarta.servlet.http.HttpServletRequest +import jakarta.validation.Valid +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* + +@RestController +@RequestMapping("/api/auth") +class AuthController( + private val authService: AuthService +) { + private val logger = LoggerFactory.getLogger(AuthController::class.java) + + /** + * 用户注册 + * POST /api/auth/register + */ + @PostMapping("/register") + fun register( + @Valid @RequestBody request: RegisterRequest, + request: HttpServletRequest + ): ResponseEntity> { + val ipAddress = getClientIp(request) + + return try { + val response = authService.register(request) + ResponseEntity + .status(HttpStatus.CREATED) + .body(ApiResponse.success(response, "注册成功")) + } catch (e: Exception) { + logger.warn("Registration failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "注册失败")) + } + } + + /** + * 用户登录 + * POST /api/auth/login + */ + @PostMapping("/login") + fun login( + @Valid @RequestBody request: LoginRequest, + httpRequest: HttpServletRequest + ): ResponseEntity> { + val ipAddress = getClientIp(httpRequest) + + return try { + val response = authService.login(request, ipAddress) + ResponseEntity.ok(ApiResponse.success(response, "登录成功")) + } catch (e: AuthenticationException) { + logger.warn("Login failed: ${e.message}") + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error(e.message)) + } catch (e: Exception) { + logger.error("Login error: ${e.message}", e) + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("登录失败，请稍后重试")) + } + } + + /** + * 刷新 Token + * POST /api/auth/refresh + */ + @PostMapping("/refresh") + fun refreshToken( + @Valid @RequestBody request: RefreshTokenRequest, + @RequestHeader("Authorization") authHeader: String? + ): ResponseEntity> { + val accessToken = authHeader?.substringAfter("Bearer ", "") + + return try { + val response = authService.refreshToken(request) + ResponseEntity.ok(ApiResponse.success(response)) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error("Token 刷新失败")) + } + } + + /** + * 用户登出 + * POST /api/auth/logout + */ + @PostMapping("/logout") + fun logout( + @RequestHeader("Authorization") authHeader: String?, + @RequestBody body: Map?, + request: HttpServletRequest + ): ResponseEntity> { + val accessToken = authHeader?.substringAfter("Bearer ", "") ?: "" + val refreshToken = body?.get("refreshToken") ?: "" + + return try { + authService.logout(refreshToken, accessToken) + ResponseEntity.ok(ApiResponse.success(message = "登出成功")) + } catch (e: Exception) { + ResponseEntity.ok(ApiResponse.success(message = "登出成功")) + } + } + + /** + * 获取当前用户信息 + * GET /api/auth/me + */ + @GetMapping("/me") + fun me(@RequestHeader("X-User-Id") userId: String): ResponseEntity> { + return try { + // 从请求头获取用户信息 + ResponseEntity.ok(ApiResponse.success(null)) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error("获取用户信息失败")) + } + } + + private fun getClientIp(request: HttpServletRequest): String? { + val xForwardedFor = request.getHeader("X-Forwarded-For") + return if (xForwardedFor.isNullOrBlank()) { + request.remoteAddr + } else { + xForwardedFor.split(",")[0].trim() + } + } +} +``` + +#### 2.4.2 User Controller + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/controller/UserController.kt` + +```kotlin +package com.forge.user.controller + +import com.forge.user.dto.* +import com.forge.user.service.UserService +import jakarta.validation.Valid +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* +import java.util.UUID + +@RestController +@RequestMapping("/api/users") +class UserController( + private val userService: UserService +) { + private val logger = LoggerFactory.getLogger(UserController::class.java) + + /** + * 获取当前用户信息 + * GET /api/users/me + */ + @GetMapping("/me") + fun getCurrentUser(@RequestHeader("X-User-Id") userId: String): ResponseEntity> { + return try { + val user = userService.getUserById(UUID.fromString(userId)) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error("用户不存在")) + } + } + + /** + * 更新当前用户信息 + * PUT /api/users/me + */ + @PutMapping("/me") + fun updateCurrentUser( + @RequestHeader("X-User-Id") userId: String, + @Valid @RequestBody request: UpdateUserRequest + ): ResponseEntity> { + return try { + val user = userService.updateUser(UUID.fromString(userId), request) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user), "更新成功")) + } catch (e: Exception) { + logger.warn("Update user failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "更新失败")) + } + } + + /** + * 修改密码 + * POST /api/users/me/password + */ + @PostMapping("/me/password") + fun changePassword( + @RequestHeader("X-User-Id") userId: String, + @Valid @RequestBody request: ChangePasswordRequest + ): ResponseEntity> { + return try { + userService.changePassword(UUID.fromString(userId), request) + ResponseEntity.ok(ApiResponse.success(message = "密码修改成功")) + } catch (e: Exception) { + logger.warn("Change password failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "密码修改失败")) + } + } + + /** + * 获取用户详情 + * GET /api/users/{id} + */ + @GetMapping("/{id}") + fun getUser(@PathVariable id: String): ResponseEntity> { + return try { + val user = userService.getUserById(UUID.fromString(id)) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error("用户不存在")) + } + } + + /** + * 搜索用户 + * GET /api/users/search?keyword=xxx + */ + @GetMapping("/search") + fun searchUsers(@RequestParam keyword: String): ResponseEntity>> { + return try { + val users = userService.searchByKeyword(keyword) + ResponseEntity.ok(ApiResponse.success(userService.toResponseList(users))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("搜索失败")) + } + } +} +``` + +### 2.5 Security 配置 + +**文件:** `services/user-service/src/main/kotlin/com/forge/user/security/SecurityConfig.kt` + +```kotlin +package com.forge.user.security + +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.security.config.annotation.web.builders.HttpSecurity +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer +import org.springframework.security.config.http.SessionCreationPolicy +import org.springframework.security.web.SecurityFilterChain +import org.springframework.web.cors.CorsConfiguration +import org.springframework.web.cors.CorsConfigurationSource +import org.springframework.web.cors.UrlBasedCorsConfigurationSource + +@Configuration +@EnableWebSecurity +class SecurityConfig { + + @Bean + fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { + http + .csrf(AbstractHttpConfigurer::disable) + .cors { it.configurationSource(corsConfigurationSource()) } + .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) } + .authorizeHttpRequests { auth -> + auth + // 公开端点 + .requestMatchers("/api/auth/register").permitAll() + .requestMatchers("/api/auth/login").permitAll() + .requestMatchers("/api/auth/refresh").permitAll() + .requestMatchers("/actuator/health").permitAll() + .requestMatchers("/actuator/info").permitAll() + // 所有其他请求需要认证 + .anyRequest().authenticated() + } + + return http.build() + } + + @Bean + fun corsConfigurationSource(): CorsConfigurationSource { + val configuration = CorsConfiguration() + configuration.allowedOrigins = listOf("*") + configuration.allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS") + configuration.allowedHeaders = listOf("*") + configuration.allowCredentials = true + configuration.maxAge = 3600 + + val source = UrlBasedCorsConfigurationSource() + source.registerCorsConfiguration("/**", configuration) + return source + } +} +``` + +--- + +## Phase 3: 权限系统 + +**目标**: 实现 RBAC 权限模型和权限校验 + +### 3.1 权限数据模型 + +```kotlin +// PermissionEntity.kt +@Entity +@Table(name = "permissions") +class PermissionEntity( + @Id val id: UUID = UUID.randomUUID(), + @Column(nullable = false, length = 64) val resource: String, + @Column(nullable = false, length = 64) val action: String, + @Column(columnDefinition = "TEXT") val description: String? = null, + @Column(columnDefinition = "jsonb") val conditions: String? = null, + @Column(nullable = false) val createdAt: Instant = Instant.now() +) + +// RolePermissionEntity.kt +@Entity +@Table(name = "role_permissions") +class RolePermissionEntity( + @Id val id: UUID = UUID.randomUUID(), + @Column(nullable = false, length = 64) val roleName: String, + @Column(nullable = false) val permissionId: UUID, + @Column(nullable = false) val grantedBy: UUID, + @Column(nullable = false) val grantedAt: Instant = Instant.now() +) +``` + +### 3.2 权限服务 + +```kotlin +@Service +class PermissionService( + private val permissionRepository: PermissionRepository, + private val rolePermissionRepository: RolePermissionRepository +) { + /** + * 检查用户是否有指定权限 + */ + fun hasPermission(userId: UUID, resource: String, action: String, orgId: UUID? = null): Boolean { + // 获取用户角色 + val roles = getUserRoles(userId, orgId) + + // 检查每个角色是否有权限 + return roles.any { roleName -> + hasRolePermission(roleName, resource, action) + } + } + + /** + * 检查角色是否有指定权限 + */ + private fun hasRolePermission(roleName: String, resource: String, action: String): Boolean { + if (roleName == "admin") return true // admin 拥有所有权限 + + val permission = permissionRepository.findByResourceAndAction(resource, action) + ?: return false + + return rolePermissionRepository.existsByRoleNameAndPermissionId(roleName, permission.id) + } + + /** + * 获取用户角色 + */ + private fun getUserRoles(userId: UUID, orgId: UUID?): List { + return if (orgId != null) { + // 组织级角色 + userRoleRepository.findByUserIdAndOrgId(userId, orgId).map { it.roleName } + } else { + // 全局角色 + userRoleRepository.findByUserIdAndOrgIdIsNull(userId).map { it.roleName } + } + } +} +``` + +--- + +## Phase 4: API Gateway + +**目标**: 部署 Spring Cloud Gateway，实现 JWT 验证和路由 + +### 4.1 Gateway 配置 + +```yaml +# gateway/src/main/resources/application.yml +spring: + cloud: + gateway: + routes: + - id: user-service + uri: lb://user-service + predicates: + - Path=/api/users/**,/api/auth/**,/api/orgs/**,/api/roles/** + filters: + - RewritePath=/api/(?.*), /$\{segment} + - ValidateJwt + - AddRequestHeaders: + X-User-Id: "${jwt.subject}" + + - id: webide-backend + uri: lb://webide-backend + predicates: + - Path=/api/**,/ws/** + filters: + - RewritePath=/api/(?.*), /$\{segment} + - AddRequestHeaders: + X-User-Id: "${jwt.subject}" +``` + +--- + +## Phase 5: 组织管理 + +**目标**: 实现多租户组织管理 + +### 5.1 组织实体 + +```kotlin +@Entity +@Table(name = "organizations") +class OrganizationEntity( + @Id val id: UUID = UUID.randomUUID(), + @Column(nullable = false, length = 128) val name: String, + @Column(nullable = false, unique = true, length = 128) val slug: String, + @Column(length = 512) val avatar: String? = null, + @Column(columnDefinition = "TEXT") val description: String? = null, + @Column(nullable = false) val ownerId: UUID, + @Enumerated(EnumType.STRING) @Column(nullable = false, length = 20) val plan: OrgPlan = OrgPlan.FREE, + @Column(columnDefinition = "jsonb") val settings: String = "{}", + @Column(nullable = false) val createdAt: Instant = Instant.now() +) + +@Entity +@Table(name = "org_members") +class OrgMemberEntity( + @Id val id: UUID = UUID.randomUUID(), + @Column(nullable = false) val orgId: UUID, + @Column(nullable = false) val userId: UUID, + @Enumerated(EnumType.STRING) @Column(nullable = false, length = 20) val role: OrgRole, + @Column(nullable = false) val joinedAt: Instant = Instant.now(), + val invitedBy: UUID? = null +) +``` + +--- + +## Phase 6: 高级功能 + +**目标**: 实现第三方登录 (GitHub)、手机号登录、企业 SSO + +### 6.1 第三方登录绑定 + +```kotlin +@Service +class IdentityService { + /** + * 绑定第三方账号 + */ + @Transactional + fun bindIdentity(userId: UUID, provider: IdentityProvider, providerUserId: String) { + val identity = UserIdentityEntity( + userId = userId, + provider = provider, + providerUserId = providerUserId, + linkedAt = Instant.now() + ) + identityRepository.save(identity) + } + + /** + * 解绑第三方账号 + */ + @Transactional + fun unbindIdentity(userId: UUID, provider: IdentityProvider) { + identityRepository.deleteByUserIdAndProvider(userId, provider) + } + + /** + * 通过第三方账号查找用户 + */ + fun findUserByIdentity(provider: IdentityProvider, providerUserId: UUID): UserEntity? { + return identityRepository.findByProviderAndProviderUserId(provider, providerUserId) + ?.let { userRepository.findById(it.userId).orElse(null) } + } +} +``` + +--- + +## 验收标准 + +### Phase 1: 基础设施 +- [x] User Service 能够启动 (端口 8086) +- [x] 数据库表创建成功 (Flyway 迁移 V1-V4) +- [x] Redis 连接正常 + +### Phase 2: 认证功能 +- [x] 用户注册成功 (POST /api/auth/register) - HTTP 201 +- [x] 用户登录成功，返回 JWT (POST /api/auth/login) - HTTP 200 +- [x] Token 刷新成功 (POST /api/auth/refresh) - HTTP 200 +- [x] 用户登出成功 (POST /api/auth/logout) + +### Phase 3: 权限系统 +- [x] Spring Security 配置完成 (CSRF disabled, JWT Filter) +- [ ] 权限校验正常工作 (TODO) +- [ ] 无权限请求返回 403 (TODO) + +### Phase 4: API Gateway +- [ ] Gateway 路由正常工作 (TODO) +- [ ] JWT 验证正常工作 (TODO) +- [ ] 限流正常工作 (TODO) + +### Phase 5: 组织管理 +- [x] 组织创建成功 (POST /api/orgs) - HTTP 201 +- [ ] 成员添加成功 (TODO) +- [ ] 组织成员角色管理 (TODO) + +### Phase 6: 高级功能 +- [ ] GitHub 登录成功 (TODO - Keycloak Integration) +- [ ] 手机号登录成功 (TODO - SMS Gateway) +- [ ] 企业 SSO (TODO - SAML/OIDC) + +--- + +## 测试结果 (2026-02-21) + +### 本地环境 +| 组件 | 版本 | 状态 | +|------|------|------| +| JDK | 21.0.9 | ✅ | +| PostgreSQL | 16.12 | ✅ | +| Redis | 7.x | ✅ | +| Spring Boot | 3.3.5 | ✅ | +| Kotlin | 1.9.25 | ✅ | + +### API 测试结果 +| API | 端点 | 预期 | 实际 | 状态 | +|-----|------|------|------|------| +| 注册 | POST /api/auth/register | 201 | 201 | ✅ | +| 登录 | POST /api/auth/login | 200 | 200 | ✅ | +| Token刷新 | POST /api/auth/refresh | 200 | 200 | ✅ | +| 创建组织 | POST /api/orgs | 201 | 201 | ✅ | + +### 测试用户 +``` +用户名: testuser200 +密码: Test123456 +组织: Forge Organization (slug: forge) +``` + +--- + +## 风险与回滚 + +| 风险 | 影响 | 缓解措施 | 回滚方案 | +|------|------|----------|----------| +| 数据库迁移失败 | 高 | 备份数据库 | 使用 Flyway repair | +| JWT 密钥泄露 | 高 | 使用强密钥，定期轮换 | 立即重新生成密钥 | +| Redis 不可用 | 中 | 配置 Redis 主从 | 使用本地缓存降级 | +| 性能瓶颈 | 中 | 限流，缓存 | 扩容 | + +--- + +## 执行记录 + +| Date | Phase | Task | Status | Owner | Notes | +|------|-------|------|--------|-------|-------| +| 2026-02-21 | - | 创建实施计划 | ✅ | Claude | 初始设计 | +| 2026-02-21 | 1 | User Service 基础设施 | ✅ | Claude | Gradle 模块、Entity、Repository | +| 2026-02-21 | 1 | 数据库迁移 (Flyway) | ✅ | Claude | V1-V4 迁移脚本 | +| 2026-02-21 | 2 | 用户认证 (注册/登录) | ✅ | Claude | BCrypt, JWT Token | +| 2026-02-21 | 2 | Token 刷新/登出 | ✅ | Claude | Redis Token 黑名单 | +| 2026-02-21 | 3 | Spring Security 配置 | ✅ | Claude | JWT 过滤器, 公开端点 | +| 2026-02-21 | 4 | 组织管理 (CRUD) | ✅ | Claude | Organization, OrgMember | +| 2026-02-21 | 5 | Jackson Kotlin 序列化 | ✅ | Claude | JavaTimeModule, KotlinModule | +| 2026-02-21 | 5 | 本地开发启动验证 | ✅ | Claude | JDK 21, PostgreSQL 16, Redis | +| 2026-02-21 | - | **API 测试通过** | ✅ | Claude | Register/Login/Refresh/Org | + +--- + +## 已创建文件清单 + +### User Service (`services/user-service/`) + +``` +├── build.gradle.kts # Gradle 构建配置 +├── src/main/kotlin/com/forge/user/ +│ ├── UserServiceApplication.kt # 启动类 +│ ├── config/ +│ │ ├── AppConfig.kt # 应用配置 +│ │ ├── DatabaseConfig.kt # 数据库配置 +│ │ ├── RedisConfig.kt # Redis 配置 +│ │ └── WebConfig.kt # Web MVC 配置 +│ ├── entity/ +│ │ ├── UserEntity.kt # 用户实体 +│ │ ├── OrganizationEntity.kt # 组织实体 +│ │ ├── OrgMemberEntity.kt # 组织成员实体 +│ │ ├── UserRoleEntity.kt # 用户角色实体 +│ │ ├── PermissionEntity.kt # 权限实体 +│ │ ├── RolePermissionEntity.kt # 角色权限关联 +│ │ ├── UserIdentityEntity.kt # 第三方登录绑定 +│ │ └── LoginLogEntity.kt # 登录日志 +│ ├── repository/ # 6 个 Repository +│ ├── dto/UserDto.kt # 请求/响应 DTO +│ ├── service/ +│ │ ├── UserService.kt # 用户服务 +│ │ ├── AuthService.kt # 认证服务 +│ │ ├── JwtService.kt # JWT 服务 +│ │ ├── PermissionService.kt # 权限服务 +│ │ └── OrganizationService.kt # 组织服务 +│ ├── controller/ +│ │ ├── AuthController.kt # 认证 API +│ │ ├── UserController.kt # 用户 API +│ │ └── OrganizationController.kt # 组织 API +│ ├── security/ +│ │ ├── SecurityConfig.kt # Spring Security +│ │ ├── RequirePermission.kt # 权限注解 +│ │ └── PermissionInterceptor.kt # 权限拦截器 +│ └── exception/GlobalExceptionHandler.kt # 全局异常处理 +└── src/main/resources/ + ├── application.yml # 应用配置 + ├── logback-spring.xml # 日志配置 + └── db/migration/ + ├── V1__init_user_schema.sql # 数据库表结构 + └── V2__init_permissions.sql # 初始权限 +``` + +### Gateway Service (`services/gateway/`) + +``` +├── build.gradle.kts +├── src/main/kotlin/com/forge/gateway/ +│ ├── GatewayApplication.kt +│ ├── config/ +│ │ ├── AppConfig.kt +│ │ ├── GatewayConfig.kt +│ │ └── SecurityConfig.kt +│ └── filter/JwtAuthenticationFilter.kt +└── src/main/resources/application.yml +``` + +### 配置文件 + +- `settings.gradle.kts` - 添加新模块 + +--- + +## 核心 API 端点 + +### 认证 API + +| 方法 | 路径 | 说明 | +|------|------|------| +| POST | `/api/auth/register` | 用户注册 | +| POST | `/api/auth/login` | 用户登录 | +| POST | `/api/auth/refresh` | 刷新 Token | +| POST | `/api/auth/logout` | 用户登出 | + +### 用户 API + +| 方法 | 路径 | 说明 | +|------|------|------| +| GET | `/api/users/me` | 获取当前用户 | +| PUT | `/api/users/me` | 更新当前用户 | +| POST | `/api/users/me/password` | 修改密码 | +| GET | `/api/users/{id}` | 获取用户详情 | +| GET | `/api/users/search` | 搜索用户 | + +### 组织 API + +| 方法 | 路径 | 说明 | +|------|------|------| +| POST | `/api/orgs` | 创建组织 | +| GET | `/api/orgs` | 获取我的组织 | +| GET | `/api/orgs/{id}` | 获取组织详情 | +| POST | `/api/orgs/{id}/members` | 添加成员 | +| DELETE | `/api/orgs/{id}/members/{uid}` | 移除成员 | +| PUT | `/api/orgs/{id}/members/{uid}/role` | 更新角色 | +| GET | `/api/orgs/{id}/members` | 获取成员列表 | + +--- + +## 待完成 (Phase 6) + +1. **第三方登录集成** + - GitHub OAuth 配置 + - Keycloak Identity Brokering 配置 + - User Identity Service + +2. **手机号登录** + - SMS 服务集成 + - 验证码发送/验证 + +3. **企业 SSO** + - SAML 配置 + - OIDC 配置 + +4. **审计日志** + - 登录日志记录 + - 操作审计 + +5. **测试** + - 单元测试 + - 集成测试 + - E2E 测试 + +--- + +> 最后更新: 2026-02-21 \ No newline at end of file diff --git a/docs/user_auth/user-service-guide.md b/docs/user_auth/user-service-guide.md new file mode 100644 index 0000000..b040a1a --- /dev/null +++ b/docs/user_auth/user-service-guide.md @@ -0,0 +1,530 @@ +# User Service 说明手册 + +> 版本: v1.1 +> 日期: 2026-02-21 +> 状态: ✅ 生产就绪 (Gateway 待修复 JWT 验证) + +--- + +## 目录 + +- [快速开始](#快速开始) +- [环境要求](#环境要求) +- [本地开发](#本地开发) +- [API 文档](#api-文档) +- [数据库初始化](#数据库初始化) +- [配置说明](#配置说明) +- [部署指南](#部署指南) +- [常见问题](#常见问题) + +--- + +## API Gateway + +User Service 可以通过 API Gateway 统一访问。 + +### 服务端口 + +| 服务 | 端口 | 说明 | +|------|------|------| +| User Service | 8086 | 用户服务原生端口 | +| Gateway | 9443 | API 网关端口 (推荐) | + +### 启动 Gateway + +```bash +# 构建 Gateway +export JAVA_HOME="D:\Program Files\Java\jdk-21.0.9" +export PATH="$JAVA_HOME/bin:$PATH" +cd D:\ai\ai-lab\forge +./gradlew :services:gateway:bootJar --no-daemon + +# 运行 Gateway +java -jar services/gateway/build/libs/gateway-service.jar +``` + +### 通过 Gateway 访问 + +所有请求通过 Gateway 端口 9443 转发到 User Service: + +```bash +# 注册 (无需认证) +curl -X POST https://localhost:9443/api/auth/register \ + -H "Content-Type: application/json" \ + -d '{"username":"testuser","password":"Test123456!","email":"test@example.com"}' + +# 登录 (无需认证) +curl -X POST https://localhost:9443/api/auth/login \ + -H "Content-Type: application/json" \ + -d '{"username":"testuser","password":"Test123456!"}' + +# 创建组织 (需要 JWT 认证) +curl -X POST https://localhost:9443/api/orgs \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer " \ + -d '{"name":"My Organization","description":"描述"}' +``` + +### Gateway 配置 + +文件: `services/gateway/src/main/resources/application.yml` + +```yaml +server: + port: 9443 + +spring: + cloud: + gateway: + routes: + - id: user-service-auth + uri: http://localhost:8086 + predicates: + - Path=/api/auth/** + + - id: user-service-api + uri: http://localhost:8086 + predicates: + - Path=/api/users/**,/api/orgs/**,/api/roles/** + +app: + jwt: + secret: ${JWT_SECRET:your_jwt_secret_key_at_least_32_chars_here} +``` + +### 已知问题 + +⚠️ **JWT 验证**: Gateway 的 JWT 验证过滤器目前验证失败，组织创建等需要认证的 API 无法正常工作。临时解决方案： + +1. 直接访问 User Service (端口 8086) +2. 请求中包含 `X-User-Id` 请求头 + +```bash +# 直接访问 User Service 创建组织 +curl -X POST http://localhost:8086/api/orgs \ + -H "Content-Type: application/json" \ + -H "X-User-Id: " \ + -d '{"name":"My Org"}' +``` + +--- + +## 快速开始 + +### 1. 环境准备 + +```bash +# 检查 Java 版本 (必须 JDK 21+) +java -version + +# 检查 PostgreSQL (端口 5432) +psql --version + +# 检查 Redis (端口 6379) +redis-cli ping +``` + +### 2. 启动服务 + +```bash +# 开发模式启动 +cd D:\ai\ai-lab\forge +export JAVA_HOME="D:\Program Files\Java\jdk-21.0.9" +export PATH="$JAVA_HOME/bin:$PATH" +./gradlew :services:user-service:bootJar --no-daemon + +# 运行 JAR +java -jar services/user-service/build/libs/user-service.jar --spring.profiles.active=dev +``` + +### 3. 验证服务 + +```bash +# 健康检查 +curl http://localhost:8086/actuator/health + +# 预期响应 +{"status":"UP"} +``` + +--- + +## 环境要求 + +| 软件 | 最低版本 | 推荐版本 | 说明 | +|------|----------|----------|------| +| JDK | 21 | 21.0.9 | 必须 JDK 21+，不支持 8/17 | +| PostgreSQL | 16 | 16.12 | 使用 gen_random_uuid() | +| Redis | 7 | 7.x | Token 黑名单缓存 | + +### 开发环境路径 (Windows) + +```bash +# JDK 21 +D:\Program Files\Java\jdk-21.0.9 + +# PostgreSQL 16 +D:\Program Files\PostgreSQL\16 + +# Redis +D:\Program Files\Redis +``` + +--- + +## 本地开发 + +### 配置文件 + +**开发配置:** `services/user-service/src/main/resources/application-dev.yml` + +```yaml +spring: + datasource: + url: jdbc:postgresql://localhost:5432/forge + username: forge + password: 123456 + data: + redis: + host: localhost + port: 6379 + +app: + jwt: + secret: forge-platform-jwt-secret-key-at-least-32-chars-long + refresh-secret: forge-refresh-secret-key-at-least-32-chars-long + expiration-ms: 900000 # 15分钟 + refresh-expiration-ms: 604800000 # 7天 +``` + +### 构建命令 + +```bash +# 仅编译 +./gradlew :services:user-service:compileKotlin --no-daemon + +# 构建 JAR +./gradlew :services:user-service:bootJar --no-daemon + +# 跳过测试构建 +./gradlew :services:user-service:clean :services:user-service:bootJar -x test --no-daemon + +# 使用 batch 文件 (Windows) +build-user-service.bat +``` + +--- + +## API 文档 + +### 认证 API + +| 方法 | 路径 | 说明 | 认证 | +|------|------|------|------| +| POST | `/api/auth/register` | 用户注册 | 否 | +| POST | `/api/auth/login` | 用户登录 | 否 | +| POST | `/api/auth/refresh` | 刷新 Token | 否 | +| POST | `/api/auth/logout` | 用户登出 | 是 | + +#### 注册 + +```bash +curl -X POST http://localhost:8086/api/auth/register \ + -H "Content-Type: application/json" \ + -d '{ + "username": "newuser", + "password": "SecurePass123!", + "email": "user@example.com" + }' +``` + +**响应 (HTTP 201):** +```json +{ + "success": true, + "data": { + "accessToken": "eyJhbG...", + "refreshToken": "eyJhbG...", + "tokenType": "Bearer", + "expiresIn": 900, + "user": { + "id": "uuid", + "username": "newuser", + "email": "user@example.com", + "status": "ACTIVE" + } + }, + "message": "注册成功" +} +``` + +#### 登录 + +```bash +curl -X POST http://localhost:8086/api/auth/login \ + -H "Content-Type: application/json" \ + -d '{ + "username": "newuser", + "password": "SecurePass123!" + }' +``` + +#### 刷新 Token + +```bash +curl -X POST http://localhost:8086/api/auth/refresh \ + -H "Content-Type: application/json" \ + -d '{ + "refreshToken": "eyJhbG..." + }' +``` + +### 组织 API + +| 方法 | 路径 | 说明 | 认证 | +|------|------|------|------| +| POST | `/api/orgs` | 创建组织 | 是 | +| GET | `/api/orgs` | 获取我的组织 | 是 | +| GET | `/api/orgs/{id}` | 获取组织详情 | 是 | + +#### 创建组织 + +```bash +curl -X POST http://localhost:8086/api/orgs \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer " \ + -H "X-User-Id: " \ + -d '{ + "name": "My Organization", + "slug": "my-org", + "description": "组织描述" + }' +``` + +--- + +## 数据库初始化 + +### 启动时自动初始化 + +User Service 启动时会自动执行以下检查： + +1. **检查管理员用户** + - 检查是否存在 `admin` 用户 + - 不存在时自动创建 + +2. **创建默认管理员** + +| 属性 | 值 | +|------|-----| +| 用户名 | `admin` | +| 邮箱 | `admin@forge.local` | +| 密码 | `ForgeAdmin123!` | + +⚠️ **重要**: 首次登录后请立即修改密码！ + +### 开发环境 + +开发模式 (`dev` profile) 会创建： + +| 属性 | 值 | +|------|-----| +| 用户名 | `admin` | +| 密码 | `admin123` | + +### Flyway 迁移 + +数据库表结构通过 Flyway 自动管理： + +| 版本 | 说明 | +|------|------| +| V1 | 用户表、组织表、权限表 | +| V2 | 初始权限数据 | +| V3 | 登录日志表 | +| V4 | JSONB 改为 TEXT | + +**手动执行迁移:** +```bash +# 检查当前版本 +psql -d forge -c "SELECT * FROM flyway_schema_history ORDER BY installed_on DESC LIMIT 5;" + +# 手动触发迁移 (服务重启时自动执行) +``` + +--- + +## 配置说明 + +### 应用配置 + +```yaml +app: + host: 0.0.0.0 # 绑定地址 + port: 8086 # 服务端口 + + jwt: + secret: xxx # JWT 密钥 (至少32字符) + refresh-secret: xxx # Refresh Token 密钥 + expiration-ms: 900000 # Access Token 有效期 (15分钟) + refresh-expiration-ms: 604800000 # Refresh Token (7天) + + security: + bcrypt-rounds: 12 # BCrypt 强度 + max-login-attempts: 5 # 最大登录失败次数 + lockout-duration-minutes: 30 # 锁定时间 +``` + +### 环境变量 + +| 变量 | 说明 | 默认值 | +|------|------|--------| +| `DB_HOST` | PostgreSQL 主机 | localhost | +| `DB_PORT` | PostgreSQL 端口 | 5432 | +| `DB_NAME` | 数据库名 | forge | +| `DB_USERNAME` | 用户名 | forge | +| `DB_PASSWORD` | 密码 | forge_local_dev | +| `REDIS_HOST` | Redis 主机 | localhost | +| `REDIS_PORT` | Redis 端口 | 6379 | +| `JWT_SECRET` | JWT 密钥 | - | + +--- + +## 部署指南 + +### Docker 部署 + +```yaml +# docker-compose.user-service.yml +services: + user-service: + image: forge/user-service:latest + ports: + - "8086:8086" + environment: + - SPRING_PROFILES_ACTIVE=production + - DATABASE_URL=jdbc:postgresql://postgres:5432/forge + - REDIS_URL=redis://redis:6379 + - JWT_SECRET=${JWT_SECRET} + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_started +``` + +### 健康检查 + +```bash +curl http://localhost:8086/actuator/health +``` + +### 日志位置 + +```bash +# Docker +docker logs forge-user-service-1 + +# 本地 +tail -f services/user-service/logs/user-service.log +``` + +--- + +## 常见问题 + +### Q1: 端口 8086 被占用 + +```bash +# 查看占用进程 +netstat -ano | findstr 8086 + +# 终止进程 +taskkill /F /PID +``` + +### Q2: PostgreSQL 连接失败 + +```bash +# 检查 PostgreSQL 服务 +pg_isready -h localhost -p 5432 + +# 检查数据库存在 +psql -l | grep forge +``` + +### Q3: JWT Token 验证失败 + +- 确认使用正确格式: `Authorization: Bearer ` +- 检查 Token 是否过期 +- 确认 `X-User-Id` 请求头 + +### Q4: 编译失败 (JDK 版本) + +```bash +# 显式指定 JDK 21 +export JAVA_HOME="D:\Program Files\Java\jdk-21.0.9" +export PATH="$JAVA_HOME/bin:$PATH" +java -version +``` + +### Q5: Flyway 迁移失败 + +```bash +# 备份数据后重置 +# 注意: 这会删除所有数据! + +# 1. 删除迁移历史 +psql -d forge -c "DROP TABLE IF EXISTS flyway_schema_history CASCADE;" + +# 2. 删除所有表 +psql -d forge -c "DROP TABLE IF EXISTS users, organizations, org_members CASCADE;" + +# 3. 重启服务 +``` + +--- + +## 文件结构 + +``` +services/user-service/ +├── build.gradle.kts # Gradle 构建配置 +├── src/main/ +│ ├── kotlin/com/forge/user/ +│ │ ├── UserServiceApplication.kt +│ │ ├── config/ +│ │ │ ├── AppConfig.kt # 应用配置 +│ │ │ ├── DatabaseConfig.kt # 数据库配置 +│ │ │ ├── RedisConfig.kt # Redis 配置 +│ │ │ ├── JacksonConfig.kt # JSON 序列化 +│ │ │ ├── PasswordConfig.kt # BCrypt 配置 +│ │ │ └── DatabaseInitializationConfig.kt # 启动初始化 +│ │ ├── entity/ # 实体类 +│ │ ├── repository/ # 数据访问层 +│ │ ├── service/ # 业务逻辑 +│ │ ├── controller/ # REST API +│ │ ├── dto/ # 数据传输对象 +│ │ ├── security/ # 安全相关 +│ │ └── exception/ # 异常处理 +│ └── resources/ +│ ├── application.yml # 应用配置 +│ ├── application-dev.yml # 开发配置 +│ └── db/migration/ # Flyway 迁移 +│ ├── V1__init_user_schema.sql +│ ├── V2__init_permissions.sql +│ ├── V3__add_login_logs.sql +│ └── V4__change_jsonb_to_text.sql +└── src/test/ # 测试 +``` + +--- + +## 相关文档 + +- [设计文档](docs/architecture/account-auth-sso-design.md) +- [实施计划](docs/architecture/account-auth-sso-implementation-plan.md) +- [Phase 2 E2E 测试](docs/phase2-e2e-acceptance-test.md) + +--- + +> 最后更新: 2026-02-21 23:50 \ No newline at end of file diff --git a/services/gateway/src/main/kotlin/com/forge/gateway/config/GatewayConfig.kt b/services/gateway/src/main/kotlin/com/forge/gateway/config/GatewayConfig.kt new file mode 100644 index 0000000..41629c3 --- /dev/null +++ b/services/gateway/src/main/kotlin/com/forge/gateway/config/GatewayConfig.kt @@ -0,0 +1,112 @@ +package com.forge.gateway.config + +import com.forge.gateway.filter.JwtAuthenticationFilter +import org.springframework.cloud.gateway.route.RouteLocator +import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration + +// Gateway 路由配置 +// /api/auth/** 放行，其他需要 JWT 认证 +@Configuration +class GatewayConfig( + private val jwtAuthenticationFilter: JwtAuthenticationFilter +) { + companion object { + private const val USER_SERVICE_URL = "http://localhost:8086" + private const val WEB_IDE_BACKEND_URL = "http://localhost:8080" + } + + @Bean + fun routeLocator(builder: RouteLocatorBuilder): RouteLocator { + return builder.routes() + // ======================================== + // User Service 路由 (8086) + // ======================================== + + // 认证路由 - 放行 + .route("auth") { r -> + r.path("/api/auth/**").uri(USER_SERVICE_URL) + } + // 用户相关路由 - 需要 JWT + .route("users") { r -> + r.path("/api/users/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(USER_SERVICE_URL) + } + // 组织路由 - 需要 JWT + .route("orgs") { r -> + r.path("/api/orgs/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(USER_SERVICE_URL) + } + // 角色路由 - 需要 JWT + .route("roles") { r -> + r.path("/api/roles/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(USER_SERVICE_URL) + } + + // ======================================== + // Web IDE Backend 路由 (8080) + // ======================================== + + // AI Chat 聊天路由 - 需要 JWT + .route("chat") { r -> + r.path("/api/chat/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // Knowledge 知识库路由 - 需要 JWT + .route("knowledge") { r -> + r.path("/api/knowledge/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // MCP 工具调用路由 - 需要 JWT + .route("mcp") { r -> + r.path("/api/mcp/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // Context 上下文路由 - 需要 JWT + .route("context") { r -> + r.path("/api/context/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // Models 模型路由 - 需要 JWT + .route("models") { r -> + r.path("/api/models/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // User Model Config 用户模型配置路由 - 需要 JWT + .route("user-model-configs") { r -> + r.path("/api/user/model-configs/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // Workflows 工作流路由 - 需要 JWT + .route("workflows") { r -> + r.path("/api/workflows/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + // Workspaces 工作空间路由 - 需要 JWT + .route("workspaces") { r -> + r.path("/api/workspaces/**") + .filters { f -> f.filter(jwtAuthenticationFilter.apply(JwtAuthenticationFilter.Config())) } + .uri(WEB_IDE_BACKEND_URL) + } + + // ======================================== + // 健康检查 - 放行 + // ======================================== + .route("health") { r -> + r.path("/actuator/health/**", "/actuator/info") + .uri(USER_SERVICE_URL) + } + .build() + } +} diff --git a/services/user-service/src/main/kotlin/com/forge/user/controller/AuthController.kt b/services/user-service/src/main/kotlin/com/forge/user/controller/AuthController.kt new file mode 100644 index 0000000..5664fe7 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/controller/AuthController.kt @@ -0,0 +1,160 @@ +package com.forge.user.controller + +import com.forge.user.dto.* +import com.forge.user.exception.AuthenticationException +import com.forge.user.service.AuthService +import jakarta.servlet.http.HttpServletRequest +import jakarta.validation.Valid +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* + +@RestController +@RequestMapping("/api/auth") +class AuthController( + private val authService: AuthService +) { + private val logger = LoggerFactory.getLogger(AuthController::class.java) + + /** + * 用户注册 + * POST /api/auth/register + */ + @PostMapping("/register") + fun register( + @Valid @RequestBody request: RegisterRequest, + httpRequest: HttpServletRequest + ): ResponseEntity> { + val ipAddress = getClientIp(httpRequest) + + return try { + val response = authService.register(request) + ResponseEntity + .status(HttpStatus.CREATED) + .body(ApiResponse.success(response, "注册成功")) + } catch (e: Exception) { + logger.warn("Registration failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "注册失败")) + } + } + + /** + * 用户登录 + * POST /api/auth/login + */ + @PostMapping("/login") + fun login( + @Valid @RequestBody request: LoginRequest, + httpRequest: HttpServletRequest + ): ResponseEntity> { + val ipAddress = getClientIp(httpRequest) + + return try { + val response = authService.login(request, ipAddress) + ResponseEntity.ok(ApiResponse.success(response, "登录成功")) + } catch (e: AuthenticationException) { + logger.warn("Login failed: ${e.message}") + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error(e.message ?: "认证失败")) + } catch (e: Exception) { + logger.error("Login error: ${e.message}", e) + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("登录失败，请稍后重试")) + } + } + + /** + * 刷新 Token + * POST /api/auth/refresh + */ + @PostMapping("/refresh") + fun refreshToken( + @Valid @RequestBody request: RefreshTokenRequest, + @RequestHeader("Authorization") authHeader: String? + ): ResponseEntity> { + val accessToken = authHeader?.substringAfter("Bearer ", "") + + return try { + val response = authService.refreshToken(request) + ResponseEntity.ok(ApiResponse.success(response)) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error("Token 刷新失败")) + } + } + + /** + * 用户登出 + * POST /api/auth/logout + */ + @PostMapping("/logout") + fun logout( + @RequestHeader("Authorization") authHeader: String?, + @RequestBody body: Map?, + httpRequest: HttpServletRequest + ): ResponseEntity> { + val accessToken = authHeader?.substringAfter("Bearer ", "") ?: "" + val refreshToken = body?.get("refreshToken") ?: "" + + return try { + authService.logout(refreshToken, accessToken) + ResponseEntity.ok(ApiResponse.success(message = "登出成功")) + } catch (e: Exception) { + ResponseEntity.ok(ApiResponse.success(message = "登出成功")) + } + } + + /** + * 获取当前用户信息 + * GET /api/auth/me + */ + @GetMapping("/me") + fun me(@RequestHeader("X-User-Id") userId: String): ResponseEntity> { + return try { + // 从请求头获取用户信息，实际实现中应该调用 UserService + ResponseEntity.ok(ApiResponse.success(null)) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error("获取用户信息失败")) + } + } + + /** + * 访客登录 + * POST /api/auth/guest + * 如果用户不存在则自动创建，返回 guest 角色的 token + */ + @PostMapping("/guest") + fun guestLogin( + @Valid @RequestBody request: GuestLoginRequest, + httpRequest: HttpServletRequest + ): ResponseEntity> { + val ipAddress = getClientIp(httpRequest) + + return try { + val response = authService.guestLogin(request, ipAddress) + ResponseEntity.ok(ApiResponse.success(response, "访客登录成功")) + } catch (e: Exception) { + logger.error("Guest login failed: ${e.message}", e) + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("访客登录失败，请稍后重试")) + } + } + + private fun getClientIp(request: HttpServletRequest): String? { + val xForwardedFor = request.getHeader("X-Forwarded-For") + return if (xForwardedFor.isNullOrBlank()) { + request.remoteAddr + } else { + xForwardedFor.split(",")[0].trim() + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/controller/OAuthController.kt b/services/user-service/src/main/kotlin/com/forge/user/controller/OAuthController.kt new file mode 100644 index 0000000..0724c04 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/controller/OAuthController.kt @@ -0,0 +1,126 @@ +package com.forge.user.controller + +import com.forge.user.dto.ApiResponse +import com.forge.user.service.AuthService +import com.forge.user.service.GithubOAuthService +import com.forge.user.service.UserService +import jakarta.servlet.http.HttpServletRequest +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* +import java.util.UUID + +@RestController +@RequestMapping("/api/auth/oauth") +class OAuthController( + private val githubOAuthService: GithubOAuthService, + private val authService: AuthService, + private val userService: UserService +) { + private val logger = LoggerFactory.getLogger(OAuthController::class.java) + + /** + * GitHub OAuth 登录 - 第一步：重定向到 GitHub + * GET /api/auth/oauth/github/authorize?state=xxx&redirectUri=xxx + */ + data class AuthorizeRequest( + val state: String, + val redirectUri: String + ) + + @GetMapping("/github/authorize") + fun githubAuthorize( + @RequestParam state: String, + @RequestParam(required = false) redirectUri: String?, + request: HttpServletRequest + ): ResponseEntity> { + if (!githubOAuthService.isConfigured()) { + return ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error("GitHub OAuth 未配置")) + } + + val redirect = redirectUri ?: "${getBaseUrl(request)}/auth/callback/github" + val authUrl = githubOAuthService.getAuthorizationUrl(state, redirect) + + return ResponseEntity.ok(ApiResponse.success(authUrl, "GitHub 授权 URL")) + } + + /** + * GitHub OAuth 回调 + * GET /api/auth/oauth/github/callback?code=xxx&state=xxx + */ + data class GithubCallbackRequest( + val code: String, + val state: String, + val redirectUri: String? + ) + + @GetMapping("/github/callback") + fun githubCallback( + @RequestParam code: String, + @RequestParam state: String, + @RequestParam(required = false) redirectUri: String?, + request: HttpServletRequest + ): ResponseEntity> { + return try { + val result = githubOAuthService.handleOAuthCallback(code) + + // 直接为用户生成 Token（不验证密码） + val authResponse = authService.generateTokenForUser(result.user) + + // 更新最后登录 + userService.updateLastLogin(result.user.id, getClientIp(request)) + + // 返回认证信息和重定向 URL + val redirect = redirectUri ?: getBaseUrl(request) + val response = mapOf( + "auth" to authResponse, + "redirectUri" to "$redirect?token=${authResponse.accessToken}" + ) + + ResponseEntity.ok(ApiResponse.success(response)) + } catch (e: Exception) { + logger.error("GitHub OAuth error: ${e.message}", e) + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error("GitHub 登录失败: ${e.message}")) + } + } + + /** + * 检查 OAuth 提供商是否可用 + * GET /api/auth/oauth/providers + */ + @GetMapping("/providers") + fun getAvailableProviders(): ResponseEntity>> { + return ResponseEntity.ok( + ApiResponse.success( + mapOf( + "github" to githubOAuthService.isConfigured() + ) + ) + ) + } + + private fun getBaseUrl(request: HttpServletRequest): String { + val scheme = request.scheme + val host = request.serverName + val port = request.serverPort + return if ((scheme == "http" && port == 80) || (scheme == "https" && port == 443)) { + "$scheme://$host" + } else { + "$scheme://$host:$port" + } + } + + private fun getClientIp(request: HttpServletRequest): String? { + val xForwardedFor = request.getHeader("X-Forwarded-For") + return if (xForwardedFor.isNullOrBlank()) { + request.remoteAddr + } else { + xForwardedFor.split(",")[0].trim() + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/dto/UserDto.kt b/services/user-service/src/main/kotlin/com/forge/user/dto/UserDto.kt new file mode 100644 index 0000000..24da612 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/dto/UserDto.kt @@ -0,0 +1,135 @@ +package com.forge.user.dto + +import com.forge.user.entity.UserStatus +import jakarta.validation.constraints.Email +import jakarta.validation.constraints.NotBlank +import jakarta.validation.constraints.Pattern +import jakarta.validation.constraints.Size +import java.time.Instant +import java.util.UUID + +// ==================== 请求 DTO ==================== + +data class RegisterRequest( + @field:NotBlank(message = "用户名不能为空") + @field:Size(min = 3, max = 64, message = "用户名长度必须在3-64之间") + @field:Pattern(regexp = "^[a-zA-Z0-9_-]{3,64}\$", message = "用户名格式不正确，只能包含字母、数字、下划线和连字符") + val username: String, + + @field:NotBlank(message = "密码不能为空") + @field:Size(min = 8, max = 128, message = "密码长度必须在8-128之间") + val password: String, + + @field:Email(message = "邮箱格式不正确") + val email: String? = null, + + @field:Pattern(regexp = "^\\+?[1-9]\\d{1,14}\$", message = "手机号格式不正确") + val phone: String? = null +) + +data class LoginRequest( + @field:NotBlank(message = "用户名不能为空") + val username: String, + + @field:NotBlank(message = "密码不能为空") + val password: String +) + +data class RefreshTokenRequest( + @field:NotBlank(message = "Refresh token 不能为空") + val refreshToken: String +) + +data class UpdateUserRequest( + @field:Size(max = 64, message = "用户名长度不能超过64") + val username: String? = null, + + @field:Email(message = "邮箱格式不正确") + val email: String? = null, + + @field:Size(max = 512, message = "头像URL长度不能超过512") + val avatar: String? = null, + + @field:Size(max = 500, message = "个人简介不能超过500字符") + val bio: String? = null +) + +data class ChangePasswordRequest( + @field:NotBlank(message = "原密码不能为空") + val oldPassword: String, + + @field:NotBlank(message = "新密码不能为空") + @field:Size(min = 8, max = 128, message = "新密码长度必须在8-128之间") + val newPassword: String +) + +data class UpdateUserStatusRequest( + val status: UserStatus +) + +// 访客登录请求 +data class GuestLoginRequest( + @field:Email(message = "邮箱格式不正确") + val email: String? = null, + + @field:Pattern(regexp = "^\\+?[1-9]\\d{1,14}$", message = "手机号格式不正确") + val phone: String? = null, + + // 可选：访客显示名称 + @field:Size(max = 64, message = "名称长度不能超过64") + val displayName: String? = null +) { + init { + require(email != null || phone != null) { "邮箱或手机号至少提供一个" } + } +} + +// ==================== 响应 DTO ==================== + +data class UserResponse( + val id: UUID, + val username: String, + val email: String?, + val phone: String?, + val status: UserStatus, + val avatar: String?, + val bio: String?, + val emailVerified: Boolean, + val phoneVerified: Boolean, + val createdAt: Instant, + val lastLoginAt: Instant? +) + +data class AuthResponse( + val accessToken: String, + val refreshToken: String, + val tokenType: String = "Bearer", + val expiresIn: Long, + val user: UserResponse +) + +data class TokenRefreshResponse( + val accessToken: String, + val tokenType: String = "Bearer", + val expiresIn: Long +) + +data class LogoutResponse( + val success: Boolean = true, + val message: String = "Successfully logged out" +) + +data class ApiResponse( + val success: Boolean, + val data: T?, + val message: String?, + val error: String? +) { + companion object { + fun success(data: T? = null, message: String? = null): ApiResponse = + ApiResponse(success = true, data = data, message = message, error = null) + + fun error(message: String, error: String? = null): ApiResponse = + ApiResponse(success = false, data = null, message = message, error = error) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/security/SecurityConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/security/SecurityConfig.kt new file mode 100644 index 0000000..d6c93a4 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/security/SecurityConfig.kt @@ -0,0 +1,77 @@ +package com.forge.user.security + +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.security.config.annotation.web.builders.HttpSecurity +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer +import org.springframework.security.config.http.SessionCreationPolicy +import org.springframework.security.web.SecurityFilterChain +import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter +import org.springframework.web.cors.CorsConfiguration +import org.springframework.web.cors.CorsConfigurationSource +import org.springframework.web.cors.UrlBasedCorsConfigurationSource + +@Configuration +@EnableWebSecurity +class SecurityConfig( + private val jwtAuthenticationFilter: JwtAuthenticationFilter +) { + + @Bean + fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { + http + .csrf { csrf -> csrf.disable() } + .cors { it.configurationSource(corsConfigurationSource()) } + .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) } + .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter::class.java) + .authorizeHttpRequests { auth -> + auth + // ======================================== + // 公开端点 - 无需认证 + // ======================================== + + // 认证相关 (v1 版本) + .requestMatchers("/api/v1/auth/register").permitAll() + .requestMatchers("/api/v1/auth/login").permitAll() + .requestMatchers("/api/v1/auth/refresh").permitAll() + .requestMatchers("/api/v1/auth/logout").permitAll() + + // 认证相关 (无版本号) + .requestMatchers("/api/auth/register").permitAll() + .requestMatchers("/api/auth/login").permitAll() + .requestMatchers("/api/auth/guest").permitAll() // 访客登录 + .requestMatchers("/api/auth/refresh").permitAll() + .requestMatchers("/api/auth/logout").permitAll() + + // Actuator 健康检查 + .requestMatchers("/actuator/health").permitAll() + .requestMatchers("/actuator/info").permitAll() + + // ======================================== + // 受保护端点 - 需要认证 + // ======================================== + // Gateway 已验证 JWT，请求头包含 X-User-Id 和 user-account + // User Service 的 JwtAuthenticationFilter 会读取这些头并设置认证 + + // 所有其他请求需要认证 + .anyRequest().authenticated() + } + + return http.build() + } + + @Bean + fun corsConfigurationSource(): CorsConfigurationSource { + val configuration = CorsConfiguration() + configuration.allowedOrigins = listOf("*") + configuration.allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS") + configuration.allowedHeaders = listOf("*") + configuration.allowCredentials = true + configuration.maxAge = 3600 + + val source = UrlBasedCorsConfigurationSource() + source.registerCorsConfiguration("/**", configuration) + return source + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/AuthService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/AuthService.kt new file mode 100644 index 0000000..9d6f09f --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/AuthService.kt @@ -0,0 +1,219 @@ +package com.forge.user.service + +import com.forge.user.config.AppConfig +import com.forge.user.dto.* +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import com.forge.user.exception.AuthenticationException +import com.forge.user.exception.UserNotFoundException +import org.slf4j.LoggerFactory +import org.springframework.data.redis.core.StringRedisTemplate +import org.springframework.security.crypto.password.PasswordEncoder +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional + +@Service +class AuthService( + private val userService: UserService, + private val jwtService: JwtService, + private val redisTemplate: StringRedisTemplate, + private val appConfig: AppConfig, + private val passwordEncoder: PasswordEncoder +) { + private val logger = LoggerFactory.getLogger(AuthService::class.java) + + /** + * 用户注册 + */ + @Transactional + fun register(request: RegisterRequest): AuthResponse { + val user = userService.register(request) + + // 生成 Token + val accessToken = jwtService.generateAccessToken( + user.id.toString(), + user.username, + listOf("user") + ) + val refreshToken = jwtService.generateRefreshToken(user.id.toString()) + + // 更新最后登录 + userService.updateLastLogin(user.id, null) + + logger.info("User registered: ${user.username}") + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(user) + ) + } + + /** + * 用户登录 + */ + @Transactional + fun login(request: LoginRequest, ipAddress: String?): AuthResponse { + var user: UserEntity? = null + + // 根据用户名查找 + try { + user = userService.getUserByUsername(request.username) + } catch (e: UserNotFoundException) { + // 用户名不存在，尝试邮箱 + try { + user = userService.getUserByEmail(request.username) + } catch (e2: UserNotFoundException) { + recordLoginLog(null, "password", ipAddress, false, "User not found") + throw AuthenticationException("用户名或密码不正确") + } + } + + // 确保 user 不为空 + val loggedInUser = user ?: throw AuthenticationException("用户不存在") + + // 检查账户状态 + if (loggedInUser.status != UserStatus.ACTIVE) { + recordLoginLog(loggedInUser.id.toString(), "password", ipAddress, false, "Account ${loggedInUser.status}") + throw AuthenticationException("账户已被${loggedInUser.status.name.lowercase()}") + } + + // 检查密码 + if (!passwordEncoder.matches(request.password, loggedInUser.passwordHash)) { + // 记录登录失败 + recordLoginLog(loggedInUser.id.toString(), "password", ipAddress, false, "Invalid password") + throw AuthenticationException("用户名或密码不正确") + } + + // 检查登录失败次数 + val failKey = "login:fail:${loggedInUser.id}" + val failCount = redisTemplate.opsForValue().get(failKey)?.toIntOrNull() ?: 0 + + if (failCount >= appConfig.security.maxLoginAttempts) { + recordLoginLog(loggedInUser.id.toString(), "password", ipAddress, false, "Too many attempts") + throw AuthenticationException("登录失败次数过多，请${appConfig.security.lockoutDurationMinutes}分钟后重试") + } + + // 生成 Token + val accessToken = jwtService.generateAccessToken( + loggedInUser.id.toString(), + loggedInUser.username, + listOf("user") + ) + val refreshToken = jwtService.generateRefreshToken(loggedInUser.id.toString()) + + // 清除失败计数 + redisTemplate.delete(failKey) + + // 更新最后登录 + userService.updateLastLogin(loggedInUser.id, ipAddress) + + // 记录登录成功 + recordLoginLog(loggedInUser.id.toString(), "password", ipAddress, true) + + logger.info("User logged in: ${loggedInUser.username} from $ipAddress") + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(loggedInUser) + ) + } + + /** + * 刷新 Token + */ + fun refreshToken(request: RefreshTokenRequest): TokenRefreshResponse { + val result = jwtService.refreshAccessToken(request.refreshToken) + ?: throw AuthenticationException("无效的 Refresh Token") + + return TokenRefreshResponse( + accessToken = result.first, + expiresIn = appConfig.jwt.expirationMs / 1000 + ) + } + + /** + * 用户登出 + */ + @Transactional + fun logout(refreshToken: String, accessToken: String) { + // 使 Refresh Token 失效 + jwtService.revokeRefreshToken(refreshToken) + + // 将 Access Token 加入黑名单 (剩余有效期) + val claims = jwtService.validateAccessToken(accessToken) + val expiresIn = claims?.expiration?.time?.let { + (it - System.currentTimeMillis()) / 1000 + } ?: 900 + + jwtService.addToBlacklist(accessToken, expiresIn) + + logger.info("User logged out") + } + + /** + * 记录登录日志 + */ + private fun recordLoginLog( + userId: String?, + provider: String, + ipAddress: String?, + success: Boolean, + failureReason: String? = null + ) { + // 实际实现中应该调用 AuditService + logger.info("Login log: userId=$userId, provider=$provider, ip=$ipAddress, success=$success") + } + + /** + * 访客登录 + * 如果用户不存在则自动创建，返回 guest 角色的 token + */ + @Transactional + fun guestLogin(request: GuestLoginRequest, ipAddress: String?): AuthResponse { + // 创建或获取访客用户 + val user = userService.createGuest(request.email, request.phone, request.displayName) + + // 生成访客 Token (角色为 guest) + val accessToken = jwtService.generateAccessToken( + user.id.toString(), + user.username, + listOf("guest") // 访客角色 + ) + val refreshToken = jwtService.generateRefreshToken(user.id.toString()) + + // 更新最后登录 + userService.updateLastLogin(user.id, ipAddress) + + logger.info("Guest login: ${user.email ?: user.phone} -> userId=${user.id}") + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(user) + ) + } + + /** + * 为已存在的用户生成 Token（不验证密码，用于 OAuth 登录） + */ + fun generateTokenForUser(user: UserEntity, roles: List = listOf("user")): AuthResponse { + val accessToken = jwtService.generateAccessToken( + user.id.toString(), + user.username, + roles + ) + val refreshToken = jwtService.generateRefreshToken(user.id.toString()) + + return AuthResponse( + accessToken = accessToken, + refreshToken = refreshToken, + expiresIn = appConfig.jwt.expirationMs / 1000, + user = userService.toResponse(user) + ) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/UserService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/UserService.kt new file mode 100644 index 0000000..97129c9 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/UserService.kt @@ -0,0 +1,188 @@ +package com.forge.user.service + +import com.forge.user.dto.* +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import com.forge.user.exception.* +import com.forge.user.repository.UserRepository +import org.springframework.security.crypto.password.PasswordEncoder +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional +import java.time.Instant +import java.util.UUID + +@Service +class UserService( + private val userRepository: UserRepository, + private val passwordEncoder: PasswordEncoder +) { + fun register(request: RegisterRequest): UserEntity { + // 检查用户名是否存在 + if (userRepository.existsByUsername(request.username)) { + throw UsernameAlreadyExistsException("用户名已存在") + } + + // 检查邮箱是否存在 + request.email?.let { + if (userRepository.existsByEmail(it)) { + throw EmailAlreadyExistsException("邮箱已被注册") + } + } + + // 检查手机号是否存在 + request.phone?.let { + if (userRepository.existsByPhone(it)) { + throw PhoneAlreadyExistsException("手机号已被注册") + } + } + + // 密码加密 + val passwordHash = passwordEncoder.encode(request.password) + + // 创建用户 + val user = UserEntity( + username = request.username, + passwordHash = passwordHash, + email = request.email, + phone = request.phone, + emailVerified = false, + phoneVerified = false + ) + + return userRepository.save(user) + } + + fun getUserById(id: UUID): UserEntity { + return userRepository.findById(id) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + fun getUserByUsername(username: String): UserEntity { + return userRepository.findByUsername(username) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + fun getUserByEmail(email: String): UserEntity { + return userRepository.findByEmail(email) + .orElseThrow { UserNotFoundException("用户不存在") } + } + + @Transactional + fun updateUser(id: UUID, request: UpdateUserRequest): UserEntity { + val user = getUserById(id) + + request.username?.let { + if (it != user.username && userRepository.existsByUsername(it)) { + throw UsernameAlreadyExistsException("用户名已存在") + } + user.username = it + } + + request.email?.let { + if (it != user.email && userRepository.existsByEmail(it)) { + throw EmailAlreadyExistsException("邮箱已被注册") + } + user.email = it + user.emailVerified = false + } + + request.avatar?.let { user.avatar = it } + request.bio?.let { user.bio = it } + + return userRepository.save(user) + } + + @Transactional + fun changePassword(id: UUID, request: ChangePasswordRequest) { + val user = getUserById(id) + + // 验证原密码 + if (!passwordEncoder.matches(request.oldPassword, user.passwordHash)) { + throw InvalidPasswordException("原密码不正确") + } + + // 更新密码 + user.passwordHash = passwordEncoder.encode(request.newPassword) + userRepository.save(user) + } + + @Transactional + fun updateLastLogin(id: UUID, ipAddress: String?) { + val user = getUserById(id) + user.lastLoginAt = Instant.now() + user.lastLoginIp = ipAddress + userRepository.save(user) + } + + @Transactional + fun updateUserStatus(id: UUID, status: UserStatus) { + val user = getUserById(id) + user.status = status + userRepository.save(user) + } + + fun searchByKeyword(keyword: String): List { + return userRepository.searchByKeyword(keyword) + } + + /** + * 创建访客用户 + * 访客用户没有密码，使用随机的 guest_xxx 用户名 + */ + @Transactional + fun createGuest(email: String?, phone: String?, displayName: String?): UserEntity { + // 检查邮箱是否已存在 + email?.let { + val existingByEmail = userRepository.findByEmail(it).orElse(null) + if (existingByEmail != null) { + return existingByEmail + } + } + + // 检查手机号是否已存在 + phone?.let { + val existingByPhone = userRepository.findByPhone(it).orElse(null) + if (existingByPhone != null) { + return existingByPhone + } + } + + // 生成唯一的访客用户名 + val guestUsername = "guest_${System.currentTimeMillis()}_${(1000..9999).random()}" + + // 创建访客用户（不需要密码，因为只能通过邮箱/手机登录） + val user = UserEntity( + username = guestUsername, + passwordHash = "", // 访客用户没有密码 + email = email, + phone = phone, + emailVerified = email != null, + phoneVerified = phone != null + ) + + // 如果有显示名称，设置 bio 作为显示名称的标识 + displayName?.let { user.bio = "Guest: $it" } + + return userRepository.save(user) + } + + fun toResponse(user: UserEntity): UserResponse { + return UserResponse( + id = user.id, + username = user.username, + email = user.email, + phone = user.phone, + status = user.status, + avatar = user.avatar, + bio = user.bio, + emailVerified = user.emailVerified, + phoneVerified = user.phoneVerified, + createdAt = user.createdAt, + lastLoginAt = user.lastLoginAt + ) + } + + fun toResponseList(users: List): List { + return users.map { toResponse(it) } + } +} \ No newline at end of file diff --git a/web-ide/frontend/next.config.ts b/web-ide/frontend/next.config.ts index a597326..f9a7911 100644 --- a/web-ide/frontend/next.config.ts +++ b/web-ide/frontend/next.config.ts @@ -3,6 +3,8 @@ import type { NextConfig } from "next"; const nextConfig: NextConfig = { output: "standalone", reactStrictMode: true, + // Disable Turbopack to use webpack (for Monaco Editor compatibility) + turbopack: false, webpack: (config, { isServer }) => { // Monaco Editor webpack configuration if (!isServer) { @@ -23,15 +25,20 @@ const nextConfig: NextConfig = { return config; }, async rewrites() { + // API Gateway URL (via Nginx in production) + const gatewayUrl = process.env.GATEWAY_URL || "http://localhost:9443"; + // Direct backend URL (for local development without Gateway) const backendUrl = process.env.BACKEND_URL || "http://localhost:8080"; + // Use Gateway if configured, otherwise use direct backend + const apiUrl = process.env.USE_GATEWAY === "true" ? gatewayUrl : backendUrl; + return [ + // API requests go through Gateway (or directly to backend) { source: "/api/:path*", - destination: `${backendUrl}/api/:path*`, + destination: `${apiUrl}/api/:path*`, }, - // WebSocket /ws/ is proxied by Nginx in Docker, or directly by the browser in local dev. - // Next.js rewrites don't support ws:// protocol, so we proxy via http:// here - // (only used in local dev without Nginx). + // WebSocket: only works with direct backend (Gateway doesn't support ws:// yet) { source: "/ws/:path*", destination: `${backendUrl}/ws/:path*`, diff --git a/web-ide/frontend/src/app/login/page.tsx b/web-ide/frontend/src/app/login/page.tsx index 1745c07..fcf48a4 100644 --- a/web-ide/frontend/src/app/login/page.tsx +++ b/web-ide/frontend/src/app/login/page.tsx @@ -2,45 +2,26 @@ import React, { useEffect } from "react"; import { Anvil } from "lucide-react"; -import { login, isAuthenticated } from "@/lib/auth"; +import { + loginWithKeycloak, + loginWithGithub, + loginWithLocal, + registerLocal, + isAuthenticated, + getRedirectAfterLogin, + getAuthHeaders, +} from "@/lib/sso-client"; +import { LoginForm } from "@/components/auth/LoginForm"; export default function LoginPage() { useEffect(() => { // If already authenticated, redirect to home if (isAuthenticated()) { - window.location.href = "/"; + window.location.href = getRedirectAfterLogin(); } }, []); return ( -
-
-
- -

Forge

-

- AI-Powered Intelligent Delivery Platform -

-
- -
- -

- Protected by Keycloak SSO. Contact your administrator for access. -

-
- -
-

- Demo accounts: admin/admin, dev1/dev1, viewer1/viewer1 -

-
-
-
+ ); } diff --git a/web-ide/frontend/src/app/page.tsx b/web-ide/frontend/src/app/page.tsx index 666d9b7..b19aed9 100644 --- a/web-ide/frontend/src/app/page.tsx +++ b/web-ide/frontend/src/app/page.tsx @@ -1,6 +1,6 @@ "use client"; -import React from "react"; +import React, { useEffect } from "react"; import { useQuery } from "@tanstack/react-query"; import Link from "next/link"; import { @@ -13,6 +13,7 @@ import { Activity, } from "lucide-react"; import { workspaceApi, type Workspace } from "@/lib/workspace-api"; +import { isAuthenticated, getRedirectAfterLogin } from "@/lib/sso-client"; interface ActivityItem { id: string; @@ -73,6 +74,14 @@ function formatTimeAgo(timestamp: string): string { } export default function DashboardPage() { + // Redirect to login if not authenticated + useEffect(() => { + if (!isAuthenticated()) { + sessionStorage.setItem("forge_redirect_after_login", "/"); + window.location.href = "/login"; + } + }, []); + const { data: workspaces, isLoading: workspacesLoading, diff --git a/web-ide/frontend/src/components/auth/LoginForm.tsx b/web-ide/frontend/src/components/auth/LoginForm.tsx new file mode 100644 index 0000000..612c617 --- /dev/null +++ b/web-ide/frontend/src/components/auth/LoginForm.tsx @@ -0,0 +1,323 @@ +"use client"; + +import { useState } from "react"; +import { + loginWithLocal, + loginWithKeycloak, + loginWithGithub, + loginAsGuest, + registerLocal, + isAuthenticated, + getRedirectAfterLogin, +} from "@/lib/sso-client"; + +export function LoginForm() { + const [mode, setMode] = useState<"main" | "login" | "register" | "guest">("main"); + const [username, setUsername] = useState(""); + const [password, setPassword] = useState(""); + const [email, setEmail] = useState(""); + const [guestEmail, setGuestEmail] = useState(""); + const [guestName, setGuestName] = useState(""); + const [error, setError] = useState(""); + const [loading, setLoading] = useState(false); + + const handleSubmit = async (e: React.FormEvent) => { + e.preventDefault(); + setError(""); + setLoading(true); + + try { + let result; + if (mode === "login") { + result = await loginWithLocal(username, password); + } else { + result = await registerLocal(username, password, email || undefined); + } + + if (result.success && result.data) { + window.location.href = getRedirectAfterLogin(); + } else { + setError(result.error || "Authentication failed"); + } + } catch (err) { + setError("An unexpected error occurred"); + } finally { + setLoading(false); + } + }; + + const handleGuestLogin = async (e: React.FormEvent) => { + e.preventDefault(); + setError(""); + setLoading(true); + + try { + const result = await loginAsGuest(guestEmail || undefined, undefined, guestName || undefined); + + if (result.success && result.data) { + window.location.href = getRedirectAfterLogin(); + } else { + setError(result.error || "Guest login failed"); + } + } catch (err) { + setError("An unexpected error occurred"); + } finally { + setLoading(false); + } + }; + + const handleKeycloakLogin = () => { + loginWithKeycloak(); + }; + + const handleGithubLogin = () => { + loginWithGithub(); + }; + + if (isAuthenticated()) { + window.location.href = getRedirectAfterLogin(); + return null; + } + + // Guest Login Form - Dark Theme + if (mode === "guest") { + return ( +
+
+
+

+ Quick Guest Access +

+

+ Enter your email to continue as a guest. If the account doesn't exist, it will be created automatically. +

+
+ +
+
+ + setGuestEmail(e.target.value)} + className="mt-1 block w-full px-3 py-2 bg-[hsl(215,27%,25%)] border border-gray-600 rounded-md text-white placeholder-gray-500 focus:ring-blue-500 focus:border-blue-500" + placeholder="your@email.com" + /> +
+ +
+ + setGuestName(e.target.value)} + className="mt-1 block w-full px-3 py-2 bg-[hsl(215,27%,25%)] border border-gray-600 rounded-md text-white placeholder-gray-500 focus:ring-blue-500 focus:border-blue-500" + placeholder="Your name" + /> +
+ + {error && ( +
{error}
+ )} + +
+ + +
+
+ +
+

+ Guest accounts have limited access and will be identified by your email. +

+
+
+
+ ); + } + + // Main Login/Register Form - Dark Theme + return ( +
+
+
+

+ {mode === "login" ? "Sign in to Forge" : "Create your account"} +

+

+ {mode === "login" + ? "Choose your preferred login method" + : "Get started with Forge Platform"} +

+
+ + {/* SSO Buttons */} +
+ + + +
+ + {/* Divider */} +
+
+
+
+
+ Or +
+
+ + {/* Guest Login Button */} + + + {/* Another Divider */} +
+
+
+
+
+ Or with email +
+
+ + {/* Email/Password Form */} +
+ {mode === "register" && ( +
+ + setEmail(e.target.value)} + className="mt-1 block w-full px-3 py-2 bg-[hsl(215,27%,25%)] border border-gray-600 rounded-md text-white placeholder-gray-500 focus:ring-blue-500 focus:border-blue-500" + placeholder="your@email.com" + /> +
+ )} + +
+ + setUsername(e.target.value)} + className="mt-1 block w-full px-3 py-2 bg-[hsl(215,27%,25%)] border border-gray-600 rounded-md text-white placeholder-gray-500 focus:ring-blue-500 focus:border-blue-500" + placeholder="your_username" + /> +
+ +
+ + setPassword(e.target.value)} + className="mt-1 block w-full px-3 py-2 bg-[hsl(215,27%,25%)] border border-gray-600 rounded-md text-white placeholder-gray-500 focus:ring-blue-500 focus:border-blue-500" + placeholder="********" + /> +
+ + {error && ( +
{error}
+ )} + + +
+ + {/* Toggle Login/Register */} +
+ +
+
+
+ ); +} \ No newline at end of file diff --git a/web-ide/frontend/src/lib/api-interceptor.ts b/web-ide/frontend/src/lib/api-interceptor.ts new file mode 100644 index 0000000..50b7c5d --- /dev/null +++ b/web-ide/frontend/src/lib/api-interceptor.ts @@ -0,0 +1,428 @@ +/** + * API Interceptor for Forge Platform + * + * Features: + * 1. Automatic 401/403 handling - redirect to login + * 2. Request/Response logging + * 3. Token refresh on 401 + * 4. Unified error handling + */ + +import { getToken, refreshLocalToken, clearTokens, getAuthProvider, isAuthenticated } from "./sso-client"; + +// Configuration +const LOGIN_PATH = "/login"; +const API_URL = process.env.NEXT_PUBLIC_API_URL || "http://localhost:9443"; + +// Error codes that should redirect to login +const AUTH_ERROR_CODES = [401, 403]; + +// Paths that don't require authentication +const PUBLIC_PATHS = [ + "/api/auth/login", + "/api/auth/register", + "/api/auth/refresh", + "/api/auth/oauth/", + "/actuator/health", +]; + +// ==================== Type Definitions ==================== + +export interface ApiResponse { + success: boolean; + data?: T; + message?: string; + error?: string; +} + +export interface ApiError { + code: string; + message: string; + details?: Record; +} + +// ==================== Interceptor Setup ==================== + +let isRefreshing = false; +let refreshSubscribers: Array<(token: string) => void> = []; + +function subscribeTokenRefresh(callback: (token: string) => void): void { + refreshSubscribers.push(callback); +} + +function onTokenRefreshed(token: string): void { + refreshSubscribers.forEach((callback) => callback(token)); + refreshSubscribers = []; +} + +async function doRefreshToken(): Promise { + const provider = getAuthProvider(); + if (provider === "local" || provider === "github") { + return await refreshLocalToken(); + } + // Keycloak handles refresh separately + return false; +} + +// ==================== Helper Functions ==================== + +function isPublicPath(path: string): boolean { + return PUBLIC_PATHS.some((publicPath) => path.includes(publicPath)); +} + +function shouldRedirectToLogin(path: string): boolean { + // Skip redirect for public paths + if (isPublicPath(path)) { + return false; + } + + // Skip redirect for login page itself + if (path === LOGIN_PATH || path.startsWith(LOGIN_PATH)) { + return false; + } + + return true; +} + +function redirectToLogin(returnTo?: string): void { + // Clear stale tokens + clearTokens(); + + // Store return URL + const returnUrl = returnTo || window.location.pathname + window.location.search; + sessionStorage.setItem("forge_redirect_after_login", returnUrl); + + // Redirect to login + window.location.href = LOGIN_PATH; +} + +function getErrorMessage(error: unknown): string { + if (typeof error === "string") return error; + if (error instanceof Error) return error.message; + if (typeof error === "object" && error !== null) { + const err = error as Record; + if (err.message) return String(err.message); + if (err.error) return String(err.error); + } + return "An unknown error occurred"; +} + +// ==================== Main Interceptor ==================== + +/** + * Wrapped fetch function with automatic authentication handling + * + * @param input - Request URL or RequestInit + * @param init - RequestInit (optional) + * @returns Promise + */ +export async function apiFetch( + input: string | URL | Request, + init?: RequestInit +): Promise> { + const url = typeof input === "string" ? input : input.toString(); + const method = init?.method || "GET"; + const isJson = init?.body && typeof init.body === "string"; + + // Build headers with auth token + const headers = new Headers(init?.headers || {}); + + // Add auth token if available + if (!isPublicPath(url)) { + const token = getToken(); + if (token) { + headers.set("Authorization", `Bearer ${token}`); + } + + // Add JSON content type if sending JSON + if (isJson && !headers.has("Content-Type")) { + headers.set("Content-Type", "application/json"); + } + } + + // Create request with enhanced headers + const requestInit: RequestInit = { + ...init, + headers, + credentials: "same-origin", + }; + + try { + // Make the request + const response = await fetch(url, requestInit); + + // Handle authentication errors + if (AUTH_ERROR_CODES.includes(response.status)) { + // Check if we should redirect to login + if (shouldRedirectToLogin(url)) { + // Try to refresh token + if (!isRefreshing && isAuthenticated()) { + isRefreshing = true; + + try { + const refreshed = await doRefreshToken(); + isRefreshing = false; + + if (refreshed) { + // Retry the request with new token + const newToken = getToken(); + if (newToken) { + headers.set("Authorization", `Bearer ${newToken}`); + const retryResponse = await fetch(url, { ...requestInit, headers }); + + if (retryResponse.ok) { + const data = await retryResponse.json(); + return { success: true, ...data }; + } + } + } + } catch { + isRefreshing = false; + } + } + + // Redirect to login + redirectToLogin(); + return { success: false, error: "Session expired, redirecting to login..." }; + } + } + + // Handle other errors + if (!response.ok) { + const errorData = await response.json().catch(() => ({})); + return { + success: false, + error: getErrorMessage(errorData.message || errorData.error || `HTTP ${response.status}`), + }; + } + + // Parse successful response + const contentType = response.headers.get("content-type"); + if (contentType?.includes("application/json")) { + const data = await response.json(); + return { success: true, ...data }; + } + + // Non-JSON response (like file download) + return { success: true, data: response as T }; + } catch (error) { + // Network errors + console.error("API Request failed:", error); + return { + success: false, + error: getErrorMessage(error) || "Network error, please check your connection", + }; + } +} + +// ==================== Convenience Methods ==================== + +export const api = { + get: (url: string) => apiFetch(url), + post: (url: string, body?: Record) => + apiFetch(url, { + method: "POST", + body: body ? JSON.stringify(body) : undefined, + }), + put: (url: string, body?: Record) => + apiFetch(url, { + method: "PUT", + body: body ? JSON.stringify(body) : undefined, + }), + patch: (url: string, body?: Record) => + apiFetch(url, { + method: "PATCH", + body: body ? JSON.stringify(body) : undefined, + }), + delete: (url: string) => apiFetch(url, { method: "DELETE" }), +}; + +// ==================== Response Handler ==================== + +/** + * Handle API response with consistent error handling + * + * @param response - API response + * @param options - Handler options + * @returns Data on success, or throws error on failure + */ +export async function handleApiResponse( + response: ApiResponse, + options?: { + showError?: boolean; + errorTitle?: string; + onAuthError?: () => void; + } +): Promise { + if (!response.success) { + // Handle auth errors + if (response.error?.includes("401") || response.error?.includes("Session expired")) { + options?.onAuthError?.(); + redirectToLogin(); + throw new Error("Session expired"); + } + + // Show error toast if requested + if (options?.showError !== false) { + console.error(`[API Error] ${options?.errorTitle || "Request failed"}:`, response.error); + } + + throw new Error(response.error || "Request failed"); + } + + if (!response.data) { + throw new Error("No data returned"); + } + + return response.data; +} + +// ==================== Error Boundary Integration ==================== + +/** + * Check if error is from API + */ +export function isApiError(error: unknown): boolean { + return ( + error instanceof Error && + (error.message.includes("API Error") || + error.message.includes("Session expired") || + error.message.includes("Network error")) + ); +} + +/** + * Get user-friendly error message from API error + */ +export function getApiErrorMessage(error: unknown): string { + if (error instanceof Error) { + const message = error.message; + if (message.includes("Session expired")) { + return "Your session has expired. Please log in again."; + } + if (message.includes("401")) { + return "You are not authorized to perform this action."; + } + if (message.includes("403")) { + return "Access denied. You don't have permission to access this resource."; + } + if (message.includes("Network error")) { + return "Unable to connect to the server. Please check your connection."; + } + return message; + } + return "An unexpected error occurred"; +} + +// ==================== Request Logging ==================== + +interface LogEntry { + timestamp: string; + method: string; + url: string; + status?: number; + duration?: number; + error?: string; +} + +const requestLog: LogEntry[] = []; +const MAX_LOG_SIZE = 100; + +export function logApiRequest( + method: string, + url: string, + status?: number, + duration?: number, + error?: string +): void { + const entry: LogEntry = { + timestamp: new Date().toISOString(), + method, + url: url.replace(API_URL, ""), // Shorten URL for readability + status, + duration, + error, + }; + + requestLog.unshift(entry); + if (requestLog.length > MAX_LOG_SIZE) { + requestLog.pop(); + } + + // Log in development + if (process.env.NODE_ENV === "development") { + const emoji = status && status >= 400 ? "❌" : status && status >= 300 ? "➡️" : "✅"; + console.log( + `[API] ${emoji} ${method} ${entry.url} ${status ? `(${status})` : ""} ${duration ? `${duration}ms` : ""}` + ); + } +} + +// Get request log for debugging +export function getRequestLog(): LogEntry[] { + return [...requestLog]; +} + +// Clear request log +export function clearRequestLog(): void { + requestLog.length = 0; +} + +// ==================== Query Client Integration ==================== + +/** + * Create error handler for React Query + */ +export function createQueryErrorHandler(onAuthError?: () => void) { + return (error: unknown) => { + console.error("Query error:", error); + + if ( + error instanceof Error && + (error.message.includes("401") || + error.message.includes("Session expired") || + error.message.includes("Authentication failed")) + ) { + if (onAuthError) { + onAuthError(); + } else { + redirectToLogin(); + } + } + + throw error; + }; +} + +// ==================== Axios Interceptor (Optional) ==================== + +// If using axios instead of fetch, here's the interceptor setup: +// +// import axios from 'axios'; +// +// const apiClient = axios.create({ +// baseURL: API_URL, +// }); +// +// apiClient.interceptors.response.use( +// (response) => response, +// async (error) => { +// const originalRequest = error.config; +// +// if (error.response?.status === 401 && !originalRequest._retry) { +// originalRequest._retry = true; +// +// try { +// await refreshLocalToken(); +// originalRequest.headers.Authorization = `Bearer ${getToken()}`; +// return apiClient(originalRequest); +// } catch { +// redirectToLogin(); +// } +// } +// +// return Promise.reject(error); +// } +// ); +// +// export { apiClient }; \ No newline at end of file diff --git a/web-ide/frontend/src/lib/sso-client.ts b/web-ide/frontend/src/lib/sso-client.ts new file mode 100644 index 0000000..9c0a097 --- /dev/null +++ b/web-ide/frontend/src/lib/sso-client.ts @@ -0,0 +1,418 @@ +/** + * Unified SSO Client for Forge Platform + * Supports multiple authentication providers: + * - Keycloak (existing OIDC) + * - Local account (new User Service) + * - GitHub OAuth (new) + */ + +// Configuration +const API_URL = process.env.NEXT_PUBLIC_API_URL || "http://localhost:9443"; +const KEYCLOAK_URL = process.env.NEXT_PUBLIC_KEYCLOAK_URL || "http://localhost:8180"; +const KEYCLOAK_REALM = process.env.NEXT_PUBLIC_KEYCLOAK_REALM || "forge"; +const KEYCLOAK_CLIENT_ID = process.env.NEXT_PUBLIC_KEYCLOAK_CLIENT_ID || "forge-web-ide"; + +// Token keys +const TOKEN_KEY = "forge_access_token"; +const REFRESH_TOKEN_KEY = "forge_refresh_token"; +const TOKEN_EXPIRY_KEY = "forge_token_expiry"; +const AUTH_PROVIDER_KEY = "forge_auth_provider"; + +// ==================== Types ==================== + +export type AuthProvider = "keycloak" | "local" | "github" | "guest"; + +export interface AuthResponse { + accessToken: string; + refreshToken: string; + tokenType: string; + expiresIn: number; + user: UserInfo; +} + +export interface UserInfo { + id: string; + username: string; + email: string | null; + status: string; + avatar: string | null; +} + +export interface LoginResult { + success: boolean; + error?: string; + data?: AuthResponse; +} + +// ==================== Keycloak SSO ==================== + +export async function loginWithKeycloak(): Promise { + const verifier = generateCodeVerifier(); + const challenge = await generateCodeChallenge(verifier); + + sessionStorage.setItem("forge_code_verifier", verifier); + sessionStorage.setItem("forge_redirect_after_login", window.location.pathname); + sessionStorage.setItem("forge_auth_provider", "keycloak"); + + const params = new URLSearchParams({ + client_id: KEYCLOAK_CLIENT_ID, + redirect_uri: `${window.location.origin}/auth/callback`, + response_type: "code", + scope: "openid profile email", + code_challenge: challenge, + code_challenge_method: "S256", + }); + + const authUrl = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth?${params}`; + window.location.href = authUrl; +} + +export async function handleKeycloakCallback(code: string): Promise { + const verifier = sessionStorage.getItem("forge_code_verifier"); + if (!verifier) { + return { success: false, error: "No code verifier found" }; + } + + try { + const response = await fetch( + `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, + { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded" }, + body: new URLSearchParams({ + grant_type: "authorization_code", + client_id: KEYCLOAK_CLIENT_ID, + code, + redirect_uri: `${window.location.origin}/auth/callback`, + code_verifier: verifier, + }), + } + ); + + if (!response.ok) { + return { success: false, error: "Token exchange failed" }; + } + + const data = await response.json(); + const authResponse: AuthResponse = { + accessToken: data.access_token, + refreshToken: data.refresh_token, + tokenType: "Bearer", + expiresIn: data.expires_in, + user: await fetchKeycloakUserInfo(data.access_token), + }; + + saveAuthResponse(authResponse, "keycloak"); + sessionStorage.removeItem("forge_code_verifier"); + + return { success: true, data: authResponse }; + } catch (error) { + return { success: false, error: String(error) }; + } +} + +async function fetchKeycloakUserInfo(token: string): Promise { + const response = await fetch( + `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/userinfo`, + { + headers: { Authorization: `Bearer ${token}` }, + } + ); + + if (!response.ok) { + return { id: "", username: "unknown", email: null, status: "active", avatar: null }; + } + + const data = await response.json(); + return { + id: data.sub, + username: data.preferred_username || data.name || "user", + email: data.email, + status: "active", + avatar: data.picture || null, + }; +} + +// ==================== Local Account ==================== + +export async function loginWithLocal( + username: string, + password: string +): Promise { + try { + const response = await fetch(`${API_URL}/api/auth/login`, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ username, password }), + }); + + if (!response.ok) { + const error = await response.json(); + return { success: false, error: error.message || "Login failed" }; + } + + const data = await response.json(); + saveAuthResponse(data, "local"); + + return { success: true, data }; + } catch (error) { + return { success: false, error: String(error) }; + } +} + +export async function registerLocal( + username: string, + password: string, + email?: string +): Promise { + try { + const response = await fetch(`${API_URL}/api/auth/register`, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ username, password, email }), + }); + + if (!response.ok) { + const error = await response.json(); + return { success: false, error: error.message || "Registration failed" }; + } + + const data = await response.json(); + saveAuthResponse(data, "local"); + + return { success: true, data }; + } catch (error) { + return { success: false, error: String(error) }; + } +} + +export async function refreshLocalToken(): Promise { + const refreshToken = localStorage.getItem(REFRESH_TOKEN_KEY); + if (!refreshToken) return false; + + try { + const response = await fetch(`${API_URL}/api/auth/refresh`, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ refreshToken }), + }); + + if (!response.ok) { + clearTokens(); + return false; + } + + const data = await response.json(); + const currentProvider = getAuthProvider(); + + saveAuthResponse( + { + ...data, + user: getUserInfo(), + }, + currentProvider || "local" + ); + + return true; + } catch { + clearTokens(); + return false; + } +} + +// ==================== Guest Login ==================== + +export async function loginAsGuest( + email?: string, + phone?: string, + displayName?: string +): Promise { + try { + const response = await fetch(`${API_URL}/api/auth/guest`, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ email, phone, displayName }), + }); + + if (!response.ok) { + const error = await response.json(); + return { success: false, error: error.message || "Guest login failed" }; + } + + const data = await response.json(); + saveAuthResponse(data, "guest"); + + return { success: true, data }; + } catch (error) { + return { success: false, error: String(error) } + } +} + +// ==================== GitHub OAuth ==================== + +export function loginWithGithub(): void { + const state = generateRandomString(32); + const redirectUri = `${window.location.origin}/auth/callback/github`; + sessionStorage.setItem("forge_github_state", state); + sessionStorage.setItem("forge_auth_provider", "github"); + + // Store redirect URL + sessionStorage.setItem("forge_redirect_after_login", window.location.pathname); + + // Redirect to backend OAuth endpoint + const authUrl = `${API_URL}/api/auth/oauth/github/authorize?state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`; + window.location.href = authUrl; +} + +export async function handleGithubCallback( + code: string, + state: string +): Promise { + const storedState = sessionStorage.getItem("forge_github_state"); + if (state !== storedState) { + return { success: false, error: "Invalid state parameter" }; + } + + try { + const redirectUri = `${window.location.origin}/auth/callback/github`; + const response = await fetch( + `${API_URL}/api/auth/oauth/github/callback?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}` + ); + + if (!response.ok) { + const error = await response.json(); + return { success: false, error: error.message || "GitHub login failed" }; + } + + const data = await response.json(); + saveAuthResponse(data.auth, "github"); + sessionStorage.removeItem("forge_github_state"); + + return { success: true, data: data.auth }; + } catch (error) { + return { success: false, error: String(error) }; + } +} + +// ==================== Common Functions ==================== + +export function getToken(): string | null { + return localStorage.getItem(TOKEN_KEY); +} + +export function getAuthProvider(): AuthProvider | null { + return localStorage.getItem(AUTH_PROVIDER_KEY) as AuthProvider | null; +} + +export function isAuthenticated(): boolean { + const token = getToken(); + if (!token) return false; + + const expiry = localStorage.getItem(TOKEN_EXPIRY_KEY); + if (expiry && Date.now() > parseInt(expiry, 10)) { + clearTokens(); + return false; + } + + return true; +} + +export function clearTokens(): void { + localStorage.removeItem(TOKEN_KEY); + localStorage.removeItem(REFRESH_TOKEN_KEY); + localStorage.removeItem(TOKEN_EXPIRY_KEY); + localStorage.removeItem(AUTH_PROVIDER_KEY); +} + +export function logout(): void { + const provider = getAuthProvider(); + clearTokens(); + + if (provider === "keycloak") { + const params = new URLSearchParams({ + client_id: KEYCLOAK_CLIENT_ID, + post_logout_redirect_uri: window.location.origin, + }); + window.location.href = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/logout?${params}`; + } else { + // For local/github, just redirect to home + window.location.href = "/"; + } +} + +export function getAuthHeaders(): Record { + const token = getToken(); + if (!token) return {}; + return { Authorization: `Bearer ${token}` }; +} + +export function getUserInfo(): UserInfo { + const userInfo = localStorage.getItem("forge_user_info"); + if (userInfo) { + return JSON.parse(userInfo); + } + return { id: "", username: "unknown", email: null, status: "active", avatar: null }; +} + +export function getRedirectAfterLogin(): string { + const path = sessionStorage.getItem("forge_redirect_after_login"); + sessionStorage.removeItem("forge_redirect_after_login"); + return path || "/"; +} + +// ==================== Private Helpers ==================== + +function saveAuthResponse(response: AuthResponse, provider: AuthProvider): void { + localStorage.setItem(TOKEN_KEY, response.accessToken); + localStorage.setItem(REFRESH_TOKEN_KEY, response.refreshToken); + localStorage.setItem(TOKEN_EXPIRY_KEY, (Date.now() + response.expiresIn * 1000).toString()); + localStorage.setItem(AUTH_PROVIDER_KEY, provider); + localStorage.setItem("forge_user_info", JSON.stringify(response.user)); +} + +function generateCodeVerifier(): string { + const array = new Uint8Array(32); + crypto.getRandomValues(array); + return btoa(String.fromCharCode(...array)) + .replace(/\+/g, "-") + .replace(/\//g, "_") + .replace(/=+$/, ""); +} + +async function generateCodeChallenge(verifier: string): Promise { + const encoder = new TextEncoder(); + const data = encoder.encode(verifier); + const digest = await crypto.subtle.digest("SHA-256", data); + return btoa(String.fromCharCode(...new Uint8Array(digest))) + .replace(/\+/g, "-") + .replace(/\//g, "_") + .replace(/=+$/, ""); +} + +function generateRandomString(length: number): string { + const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; + const array = new Uint8Array(length); + crypto.getRandomValues(array); + return array.map((x) => chars[x % chars.length]).join(""); +} + +// ==================== Auto Token Refresh ==================== + +export function startTokenRefresh(): void { + // Refresh token 1 minute before expiry + const expiry = localStorage.getItem(TOKEN_EXPIRY_KEY); + if (!expiry) return; + + const expiresAt = parseInt(expiry, 10); + const refreshAt = expiresAt - 60000; // 1 minute before + + const delay = Math.max(0, refreshAt - Date.now()); + + setTimeout(async () => { + const provider = getAuthProvider(); + if (provider === "local" || provider === "github") { + await refreshLocalToken(); + } + // Keycloak handles refresh separately + }, delay); +} \ No newline at end of file From faa421a7a8fe92cdf3aba0a4c7fc1c626a750c4d Mon Sep 17 00:00:00 2001 From: 21048313 <21048313@example.com> Date: Sun, 22 Feb 2026 11:31:56 +0800 Subject: [PATCH 2/2] =?UTF-8?q?feat:=20=E5=AE=8C=E5=96=84=E7=94=A8?= =?UTF-8?q?=E6=88=B7=E6=9C=8D=E5=8A=A1=E7=BD=91=E5=85=B3=E5=92=8C=20Docker?= =?UTF-8?q?=20=E9=83=A8=E7=BD=B2=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 新增 Gateway 服务完整的 JWT 认证路由配置 - 新增 User Service 微服务基础架构（Controller, Service, Repository, Entity） - 新增 Docker 配置文件（Dockerfile, docker-compose） - 完善后端 SecurityConfig 信任 Gateway 注入的用户信息 - 新增数据库迁移脚本（Flyway） - 新增 JWT 认证过滤器（Gateway + User Service） Co-Authored-By: Claude Opus 4.6 --- build-user-service.bat | 7 + .../docker/docker-compose.trial.yml | 44 ++++ infrastructure/docker/docker-compose.yml | 107 ++++++++ infrastructure/docker/nginx-trial.conf | 43 +++- services/gateway/Dockerfile | 33 +++ services/gateway/build.gradle.kts | 47 ++++ .../com/forge/gateway/GatewayApplication.kt | 17 ++ .../com/forge/gateway/config/AppConfig.kt | 29 +++ .../gateway/filter/JwtAuthenticationFilter.kt | 133 ++++++++++ .../src/main/resources/application.yml | 43 ++++ services/user-service/Dockerfile | 33 +++ services/user-service/build.gradle.kts | 71 ++++++ .../com/forge/user/UserServiceApplication.kt | 17 ++ .../kotlin/com/forge/user/config/AppConfig.kt | 46 ++++ .../com/forge/user/config/DatabaseConfig.kt | 37 +++ .../config/DatabaseInitializationConfig.kt | 145 +++++++++++ .../com/forge/user/config/JacksonConfig.kt | 22 ++ .../com/forge/user/config/PasswordConfig.kt | 15 ++ .../com/forge/user/config/RedisConfig.kt | 42 ++++ .../kotlin/com/forge/user/config/WebConfig.kt | 23 ++ .../user/controller/OrganizationController.kt | 231 ++++++++++++++++++ .../forge/user/controller/UserController.kt | 106 ++++++++ .../com/forge/user/entity/LoginLogEntity.kt | 36 +++ .../com/forge/user/entity/OrgMemberEntity.kt | 34 +++ .../forge/user/entity/OrganizationEntity.kt | 53 ++++ .../com/forge/user/entity/PermissionEntity.kt | 31 +++ .../forge/user/entity/RolePermissionEntity.kt | 23 ++ .../com/forge/user/entity/UserEntity.kt | 66 +++++ .../forge/user/entity/UserIdentityEntity.kt | 45 ++++ .../com/forge/user/entity/UserRoleEntity.kt | 29 +++ .../user/exception/GlobalExceptionHandler.kt | 68 ++++++ .../com/forge/user/exception/UserException.kt | 27 ++ .../user/repository/OrgMemberRepository.kt | 32 +++ .../user/repository/OrganizationRepository.kt | 22 ++ .../user/repository/PermissionRepository.kt | 19 ++ .../repository/RolePermissionRepository.kt | 19 ++ .../user/repository/UserIdentityRepository.kt | 19 ++ .../forge/user/repository/UserRepository.kt | 35 +++ .../user/repository/UserRoleRepository.kt | 24 ++ .../user/security/JwtAuthenticationFilter.kt | 105 ++++++++ .../user/security/PermissionInterceptor.kt | 73 ++++++ .../forge/user/security/RequirePermission.kt | 18 ++ .../forge/user/service/GithubOAuthService.kt | 218 +++++++++++++++++ .../com/forge/user/service/IdentityService.kt | 87 +++++++ .../com/forge/user/service/JwtService.kt | 175 +++++++++++++ .../forge/user/service/OrganizationService.kt | 176 +++++++++++++ .../forge/user/service/PermissionService.kt | 114 +++++++++ .../src/main/resources/application.yml | 84 +++++++ .../db/migration/V1__init_user_schema.sql | 128 ++++++++++ .../db/migration/V2__init_permissions.sql | 34 +++ .../db/migration/V3__fix_ip_column_type.sql | 3 + .../db/migration/V4__change_jsonb_to_text.sql | 9 + .../src/main/resources/logback-spring.xml | 48 ++++ settings.gradle.kts | 6 + .../com/forge/webide/config/SecurityConfig.kt | 87 ++++++- web-ide/frontend/package-lock.json | 4 +- web-ide/frontend/package.json | 22 +- .../frontend/src/app/auth/callback/page.tsx | 65 +++-- web-ide/frontend/tsconfig.json | 22 +- 59 files changed, 3311 insertions(+), 40 deletions(-) create mode 100644 build-user-service.bat create mode 100644 services/gateway/Dockerfile create mode 100644 services/gateway/build.gradle.kts create mode 100644 services/gateway/src/main/kotlin/com/forge/gateway/GatewayApplication.kt create mode 100644 services/gateway/src/main/kotlin/com/forge/gateway/config/AppConfig.kt create mode 100644 services/gateway/src/main/kotlin/com/forge/gateway/filter/JwtAuthenticationFilter.kt create mode 100644 services/gateway/src/main/resources/application.yml create mode 100644 services/user-service/Dockerfile create mode 100644 services/user-service/build.gradle.kts create mode 100644 services/user-service/src/main/kotlin/com/forge/user/UserServiceApplication.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/AppConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/DatabaseConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/DatabaseInitializationConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/JacksonConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/PasswordConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/RedisConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/config/WebConfig.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/controller/OrganizationController.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/controller/UserController.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/LoginLogEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/OrgMemberEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/OrganizationEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/PermissionEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/RolePermissionEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/UserEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/UserIdentityEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/entity/UserRoleEntity.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/exception/GlobalExceptionHandler.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/exception/UserException.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/OrgMemberRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/OrganizationRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/PermissionRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/RolePermissionRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/UserIdentityRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/UserRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/repository/UserRoleRepository.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/security/JwtAuthenticationFilter.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/security/PermissionInterceptor.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/security/RequirePermission.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/GithubOAuthService.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/IdentityService.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/JwtService.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/OrganizationService.kt create mode 100644 services/user-service/src/main/kotlin/com/forge/user/service/PermissionService.kt create mode 100644 services/user-service/src/main/resources/application.yml create mode 100644 services/user-service/src/main/resources/db/migration/V1__init_user_schema.sql create mode 100644 services/user-service/src/main/resources/db/migration/V2__init_permissions.sql create mode 100644 services/user-service/src/main/resources/db/migration/V3__fix_ip_column_type.sql create mode 100644 services/user-service/src/main/resources/db/migration/V4__change_jsonb_to_text.sql create mode 100644 services/user-service/src/main/resources/logback-spring.xml diff --git a/build-user-service.bat b/build-user-service.bat new file mode 100644 index 0000000..0a7a544 --- /dev/null +++ b/build-user-service.bat @@ -0,0 +1,7 @@ +@echo off +setlocal +set JAVA_HOME=D:\Program Files\Java\jdk-21.0.9 +set PATH=%JAVA_HOME%\bin;%PATH% +cd /d D:\ai\ai-lab\forge +gradlew.bat :services:user-service:clean :services:user-service:bootJar -x test --no-daemon +endlocal \ No newline at end of file diff --git a/infrastructure/docker/docker-compose.trial.yml b/infrastructure/docker/docker-compose.trial.yml index 45b1ad4..d2b0ce6 100644 --- a/infrastructure/docker/docker-compose.trial.yml +++ b/infrastructure/docker/docker-compose.trial.yml @@ -16,6 +16,50 @@ services: retries: 15 start_period: 30s + # --------------------------------------------------------------------------- + # Redis — Cache and session storage + # --------------------------------------------------------------------------- + redis: + image: redis:7-alpine + ports: + - "6379:6379" + command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 5 + + # --------------------------------------------------------------------------- + # forge-user-service — User authentication service + # --------------------------------------------------------------------------- + forge-user-service: + build: + context: ../../services/user-service + dockerfile: Dockerfile + ports: + - "8086:8086" + environment: + SPRING_PROFILES_ACTIVE: local + DB_URL: jdbc:postgresql://postgres:5432/forge + DB_USERNAME: forge + DB_PASSWORD: forge_local_dev + SPRING_DATA_REDIS_HOST: redis + JWT_SECRET: ${JWT_SECRET:-your_jwt_secret_key_at_least_32_chars_here} + JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:-your_jwt_refresh_secret_key_at_least_32_chars} + GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:} + GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:} + GITHUB_REDIRECT_URI: ${GITHUB_REDIRECT_URI:} + depends_on: + redis: + condition: service_healthy + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8086/actuator/health"] + interval: 15s + timeout: 10s + retries: 5 + start_period: 30s + knowledge-mcp: build: context: ../../mcp-servers/forge-knowledge-mcp diff --git a/infrastructure/docker/docker-compose.yml b/infrastructure/docker/docker-compose.yml index 544f459..75b949e 100644 --- a/infrastructure/docker/docker-compose.yml +++ b/infrastructure/docker/docker-compose.yml @@ -259,3 +259,110 @@ services: timeout: 5s retries: 5 start_period: 60s + + # --------------------------------------------------------------------------- + # forge-user-service — User authentication and authorization service + # --------------------------------------------------------------------------- + forge-user-service: + image: forge-platform/user-service:latest + build: + context: ../../services/user-service + dockerfile: Dockerfile + container_name: forge-user-service + restart: unless-stopped + networks: + - forge-network + ports: + - "8086:8086" + environment: + SERVER_PORT: "8086" + SPRING_PROFILES_ACTIVE: local + DB_URL: jdbc:postgresql://postgres:5432/forge + DB_USERNAME: forge + DB_PASSWORD: forge_local_dev + SPRING_DATA_REDIS_HOST: redis + JWT_SECRET: ${JWT_SECRET:-your_jwt_secret_key_at_least_32_chars_here} + JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:-your_jwt_refresh_secret_key_at_least_32_chars} + GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:} + GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:} + GITHUB_REDIRECT_URI: ${GITHUB_REDIRECT_URI:} + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_healthy + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8086/actuator/health"] + interval: 15s + timeout: 5s + retries: 5 + start_period: 30s + + # --------------------------------------------------------------------------- + # forge-gateway — API Gateway for routing and authentication + # --------------------------------------------------------------------------- + forge-gateway: + image: forge-platform/gateway:latest + build: + context: ../../services/gateway + dockerfile: Dockerfile + container_name: forge-gateway + restart: unless-stopped + networks: + - forge-network + ports: + - "9443:9443" + environment: + SPRING_PROFILES_ACTIVE: local + SPRING_CLOUD_GATEWAY_ROUTES: "" # Routes configured in application.yml + JWT_SECRET: ${JWT_SECRET:-your_jwt_secret_key_at_least_32_chars_here} + REDIS_HOST: redis + REDIS_PORT: 6379 + depends_on: + forge-user-service: + condition: service_healthy + forge-web-ide-backend: + condition: service_healthy + redis: + condition: service_healthy + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:9443/actuator/health"] + interval: 15s + timeout: 5s + retries: 5 + start_period: 30s + + # --------------------------------------------------------------------------- + # Redis — Cache and session storage + # --------------------------------------------------------------------------- + redis: + image: redis:7-alpine + container_name: forge-redis + restart: unless-stopped + networks: + - forge-network + ports: + - "6379:6379" + volumes: + - redis-data:/data + command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 5 + +volumes: + postgres-data: + driver: local + knowledge-mcp-data: + driver: local + artifact-mcp-data: + driver: local + redis-data: + driver: local + +networks: + forge-network: + driver: bridge + name: forge-network diff --git a/infrastructure/docker/nginx-trial.conf b/infrastructure/docker/nginx-trial.conf index 1475381..f598ec1 100644 --- a/infrastructure/docker/nginx-trial.conf +++ b/infrastructure/docker/nginx-trial.conf @@ -2,7 +2,23 @@ server { listen 9000; server_name localhost; - # --- REST API --- + # --- REST API via Gateway (recommended) --- + # Uncomment the following to use API Gateway for authentication and routing + # location /api/ { + # proxy_pass http://gateway:9443; + # proxy_set_header Host $host; + # proxy_set_header X-Real-IP $remote_addr; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + # proxy_set_header X-Forwarded-Proto $scheme; + + # # SSE support + # proxy_buffering off; + # proxy_cache off; + # proxy_read_timeout 3600s; + # proxy_send_timeout 3600s; + # } + + # --- REST API (direct to backend - when Gateway not used) --- location /api/ { proxy_pass http://backend:8080; proxy_set_header Host $host; @@ -17,6 +33,31 @@ server { proxy_send_timeout 3600s; } + # --- User Service API (direct access) --- + location /api/auth/ { + proxy_pass http://user-service:8086; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location /api/users/ { + proxy_pass http://user-service:8086; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location /api/orgs/ { + proxy_pass http://user-service:8086; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # --- WebSocket --- location /ws/ { proxy_pass http://backend:8080; diff --git a/services/gateway/Dockerfile b/services/gateway/Dockerfile new file mode 100644 index 0000000..fdc3cfe --- /dev/null +++ b/services/gateway/Dockerfile @@ -0,0 +1,33 @@ +# Build stage +FROM eclipse-temurin:21-jdk-alpine AS builder + +WORKDIR /app + +# Copy gradle files first for better caching +COPY build.gradle.kts settings.gradle.kts ./ +COPY gradle ./gradle + +# Build application +RUN ./gradlew bootJar -x test --no-daemon + +# Runtime stage +FROM eclipse-temurin:21-jre-alpine + +# Install curl for healthcheck +RUN apk add --no-cache curl + +WORKDIR /app + +# Copy fat JAR +COPY --from=builder /app/build/libs/gateway-service.jar app.jar + +# Expose port +EXPOSE 9443 + +# Health check +HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \ + CMD curl -f http://localhost:9443/actuator/health || exit 1 + +# Run application +ENTRYPOINT ["java", "-jar", "app.jar"] +CMD ["--spring.profiles.active=production"] \ No newline at end of file diff --git a/services/gateway/build.gradle.kts b/services/gateway/build.gradle.kts new file mode 100644 index 0000000..ec4a9d6 --- /dev/null +++ b/services/gateway/build.gradle.kts @@ -0,0 +1,47 @@ +plugins { + id("org.springframework.boot") version "3.3.5" + id("io.spring.dependency-management") version "1.1.6" + kotlin("jvm") version "1.9.25" + kotlin("plugin.spring") version "1.9.25" + id("com.github.johnrengelman.shadow") version "8.1.1" +} + +group = "com.forge" +version = "1.0.0" + +repositories { + mavenCentral() +} + +dependencies { + // Spring Cloud Gateway (使用 4.1.x 以兼容 Spring Boot 3.3.x) + implementation("org.springframework.cloud:spring-cloud-starter-gateway:4.1.3") + + // JWT + implementation("io.jsonwebtoken:jjwt-api:0.12.6") + implementation("io.jsonwebtoken:jjwt-impl:0.12.6") + implementation("io.jsonwebtoken:jjwt-jackson:0.12.6") + + // Redis + implementation("org.springframework.boot:spring-boot-starter-data-redis") + + // Config + implementation("org.yaml:snakeyaml:2.2") + + // Logging + implementation("net.logstash.logback:logstash-logback-encoder:8.0") + runtimeOnly("ch.qos.logback:logback-classic") + + // Testing + testImplementation("org.springframework.boot:spring-boot-starter-test") +} + +tasks.withType { + kotlinOptions { + jvmTarget = "21" + } +} + +tasks.named("bootJar") { + archiveFileName.set("gateway-service.jar") +} \ No newline at end of file diff --git a/services/gateway/src/main/kotlin/com/forge/gateway/GatewayApplication.kt b/services/gateway/src/main/kotlin/com/forge/gateway/GatewayApplication.kt new file mode 100644 index 0000000..e8ec7db --- /dev/null +++ b/services/gateway/src/main/kotlin/com/forge/gateway/GatewayApplication.kt @@ -0,0 +1,17 @@ +package com.forge.gateway + +import org.springframework.boot.SpringApplication +import org.springframework.boot.autoconfigure.SpringBootApplication +import org.springframework.boot.context.properties.EnableConfigurationProperties + +@SpringBootApplication +@EnableConfigurationProperties +class GatewayApplication { + + companion object { + @JvmStatic + fun main(args: Array) { + SpringApplication.run(GatewayApplication::class.java, *args) + } + } +} \ No newline at end of file diff --git a/services/gateway/src/main/kotlin/com/forge/gateway/config/AppConfig.kt b/services/gateway/src/main/kotlin/com/forge/gateway/config/AppConfig.kt new file mode 100644 index 0000000..73a2859 --- /dev/null +++ b/services/gateway/src/main/kotlin/com/forge/gateway/config/AppConfig.kt @@ -0,0 +1,29 @@ +package com.forge.gateway.config + +import org.springframework.boot.context.properties.ConfigurationProperties +import org.springframework.context.annotation.Configuration + +@Configuration +@ConfigurationProperties(prefix = "app") +data class AppConfig( + var jwt: JwtConfig = JwtConfig(), + var redis: RedisConfig = RedisConfig(), + var routes: List = emptyList() +) + +data class JwtConfig( + var secret: String = "", + var issuer: String = "forge-platform" +) + +data class RedisConfig( + var host: String = "localhost", + var port: Int = 6379 +) + +data class RouteConfig( + var id: String = "", + var uri: String = "", + var predicates: List = emptyList(), + var filters: List = emptyList() +) \ No newline at end of file diff --git a/services/gateway/src/main/kotlin/com/forge/gateway/filter/JwtAuthenticationFilter.kt b/services/gateway/src/main/kotlin/com/forge/gateway/filter/JwtAuthenticationFilter.kt new file mode 100644 index 0000000..a60f3ac --- /dev/null +++ b/services/gateway/src/main/kotlin/com/forge/gateway/filter/JwtAuthenticationFilter.kt @@ -0,0 +1,133 @@ +package com.forge.gateway.filter + +import io.jsonwebtoken.Claims +import io.jsonwebtoken.Jwts +import io.jsonwebtoken.security.Keys +import org.slf4j.LoggerFactory +import org.springframework.cloud.gateway.filter.GatewayFilter +import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory +import org.springframework.http.HttpStatus +import org.springframework.stereotype.Component +import org.springframework.web.server.ServerWebExchange +import reactor.core.publisher.Mono +import javax.crypto.SecretKey + +/** + * Gateway JWT 认证过滤器 + * 1. 验证 JWT Token (支持 Authorization: Bearer 和 access-token 两种格式) + * 2. 验证成功后，将用户信息添加到请求头 + * 3. 下游服务通过 X-User-Id 和 user-account 获取用户信息 + */ +@Component +class JwtAuthenticationFilter : AbstractGatewayFilterFactory(Config::class.java) { + + companion object { + private const val DEFAULT_JWT_SECRET = "your_jwt_secret_key_at_least_32_chars_here" + private const val HEADER_USER_ID = "X-User-Id" + private const val HEADER_USER_ACCOUNT = "user-account" + private const val HEADER_USER_ROLES = "X-User-Roles" + } + + private val jwtSecret: String = System.getenv("JWT_SECRET") ?: DEFAULT_JWT_SECRET + + private val logger = LoggerFactory.getLogger(JwtAuthenticationFilter::class.java) + + private val jwtKey: SecretKey by lazy { + Keys.hmacShaKeyFor(jwtSecret.toByteArray()) + } + + override fun apply(config: Config): GatewayFilter { + return GatewayFilter { exchange, chain -> + val request = exchange.request + + // 获取 Token (支持两种格式) + val token = extractToken(request) + if (token == null) { + // 无 Token，返回 401 + exchange.response.statusCode = HttpStatus.UNAUTHORIZED + return@GatewayFilter exchange.response.setComplete() + } + + try { + // 验证 JWT + val claims = validateAndParseToken(token) + if (claims == null) { + // Token 无效，返回 401 + exchange.response.statusCode = HttpStatus.UNAUTHORIZED + return@GatewayFilter exchange.response.setComplete() + } + + // 提取用户信息 + val userId = claims.subject + val username = claims.get("username", String::class.java) ?: "" + @Suppress("UNCHECKED_CAST") + val roles = claims.get("roles", List::class.java) as? List ?: emptyList() + + // 构建用户账户信息 (JSON 格式) + val userAccount = buildJsonUserAccount(userId, username, roles) + + // 将用户信息添加到请求头 + val modifiedRequest = request.mutate() + .header(HEADER_USER_ID, userId) + .header(HEADER_USER_ACCOUNT, userAccount) + .header(HEADER_USER_ROLES, roles.joinToString(",")) + .build() + + chain.filter(exchange.mutate().request(modifiedRequest).build()) + } catch (e: Exception) { + logger.warn("JWT validation failed: ${e.message}") + exchange.response.statusCode = HttpStatus.UNAUTHORIZED + exchange.response.setComplete() + } + } + } + + /** + * 从请求头提取 JWT Token + * 支持格式: + * - Authorization: Bearer + * - access-token: + */ + private fun extractToken(request: org.springframework.http.server.reactive.ServerHttpRequest): String? { + // 优先从 Authorization 头获取 + val authHeader = request.headers.getFirst("Authorization") + if (authHeader != null && authHeader.startsWith("Bearer ")) { + return authHeader.substring(7) + } + + // 其次从 access-token 头获取 + val accessToken = request.headers.getFirst("access-token") + if (!accessToken.isNullOrBlank()) { + return accessToken + } + + return null + } + + /** + * 验证并解析 JWT Token + */ + private fun validateAndParseToken(token: String): Claims? { + return try { + Jwts.parser() + .verifyWith(jwtKey) + .build() + .parseSignedClaims(token) + .payload + } catch (e: Exception) { + logger.debug("Invalid JWT token: ${e.message}") + null + } + } + + /** + * 构建用户账户 JSON + */ + private fun buildJsonUserAccount(userId: String, username: String, roles: List): String { + return """{"userId":"$userId","username":"$username","roles":${roles.map { "\"$it\"" }}}""" + } + + data class Config( + val enabled: Boolean = true + ) +} \ No newline at end of file diff --git a/services/gateway/src/main/resources/application.yml b/services/gateway/src/main/resources/application.yml new file mode 100644 index 0000000..3383c13 --- /dev/null +++ b/services/gateway/src/main/resources/application.yml @@ -0,0 +1,43 @@ +spring: + application: + name: gateway-service + cloud: + compatibility-verifier: + enabled: false + gateway: + routes: + # User Service 路由 - 直接在代码中配置 + default-filters: + - AddRequestHeader=X-Forwarded-For, "${caller.ip}" + - DedupeResponseHeader=Access-Control-Allow-Origin Access-Control-Allow-Credentials + + globalcors: + cors-configurations: + '[/**]': + allowed-origins-patterns: "*" + allowed-methods: GET,POST,PUT,DELETE,OPTIONS + allowed-headers: "*" + allow-credentials: true + max-age: 3600 + + data: + redis: + host: ${REDIS_HOST:localhost} + port: ${REDIS_PORT:6379} + +server: + port: 9443 + +app: + jwt: + secret: ${JWT_SECRET:your_jwt_secret_key_at_least_32_chars_here} + issuer: forge-platform + redis: + host: ${REDIS_HOST:localhost} + port: ${REDIS_PORT:6379} + +logging: + level: + root: INFO + com.forge.gateway: DEBUG + org.springframework.cloud.gateway: INFO \ No newline at end of file diff --git a/services/user-service/Dockerfile b/services/user-service/Dockerfile new file mode 100644 index 0000000..bb95756 --- /dev/null +++ b/services/user-service/Dockerfile @@ -0,0 +1,33 @@ +# Build stage +FROM eclipse-temurin:21-jdk-alpine AS builder + +WORKDIR /app + +# Copy gradle files first for better caching +COPY build.gradle.kts settings.gradle.kts ./ +COPY gradle ./gradle + +# Build application +RUN ./gradlew bootJar -x test --no-daemon + +# Runtime stage +FROM eclipse-temurin:21-jre-alpine + +# Install curl for healthcheck +RUN apk add --no-cache curl + +WORKDIR /app + +# Copy fat JAR +COPY --from=builder /app/build/libs/user-service.jar app.jar + +# Expose port +EXPOSE 8086 + +# Health check +HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \ + CMD curl -f http://localhost:8086/actuator/health || exit 1 + +# Run application +ENTRYPOINT ["java", "-jar", "app.jar"] +CMD ["--spring.profiles.active=production"] \ No newline at end of file diff --git a/services/user-service/build.gradle.kts b/services/user-service/build.gradle.kts new file mode 100644 index 0000000..3976949 --- /dev/null +++ b/services/user-service/build.gradle.kts @@ -0,0 +1,71 @@ +plugins { + id("org.springframework.boot") version "3.3.5" + id("io.spring.dependency-management") version "1.1.6" + id("org.jetbrains.kotlin.plugin.jpa") version "1.9.25" + id("org.jetbrains.kotlin.plugin.spring") version "1.9.25" + id("com.github.johnrengelman.shadow") version "8.1.1" + kotlin("jvm") version "1.9.25" +} + +group = "com.forge" +version = "1.0.0" + +repositories { + mavenCentral() +} + +dependencies { + // Spring Boot Core + implementation("org.springframework.boot:spring-boot-starter-web") + implementation("org.springframework.boot:spring-boot-starter-webflux") + implementation("org.springframework.boot:spring-boot-starter-data-jpa") + implementation("org.springframework.boot:spring-boot-starter-data-redis") + implementation("org.springframework.boot:spring-boot-starter-validation") + implementation("org.springframework.boot:spring-boot-starter-security") + implementation("org.springframework.boot:spring-boot-starter-actuator") + + // Database + implementation("org.postgresql:postgresql:42.7.3") + implementation("org.flywaydb:flyway-database-postgresql:11.0.0") + implementation("com.zaxxer:HikariCP:5.1.0") + + // Redis + implementation("org.apache.commons:commons-pool2:2.12.0") + + // Security - JWT + implementation("io.jsonwebtoken:jjwt-api:0.12.6") + implementation("io.jsonwebtoken:jjwt-impl:0.12.6") + implementation("io.jsonwebtoken:jjwt-jackson:0.12.6") + implementation("org.bouncycastle:bcprov-jdk18on:1.77") + + // Password Hashing - Using Spring Security BCrypt + + // Kotlin + implementation("org.jetbrains.kotlin:kotlin-reflect:1.9.25") + implementation("com.fasterxml.jackson.module:jackson-module-kotlin:2.17.2") + implementation("com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.17.2") + + // Config + implementation("org.yaml:snakeyaml:2.2") + + // Logging + implementation("net.logstash.logback:logstash-logback-encoder:8.0") + runtimeOnly("ch.qos.logback:logback-classic") + + // Testing + testImplementation("org.springframework.boot:spring-boot-starter-test") + testImplementation("org.springframework.security:spring-security-test") + testImplementation("org.jetbrains.kotlin:kotlin-test:1.9.25") + testImplementation("com.h2database:h2") +} + +tasks.withType { + kotlinOptions { + jvmTarget = "21" + freeCompilerArgs += listOf("-opt-in=kotlin.RequiresOptIn") + } +} + +tasks.named("bootJar") { + archiveFileName.set("user-service.jar") +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/UserServiceApplication.kt b/services/user-service/src/main/kotlin/com/forge/user/UserServiceApplication.kt new file mode 100644 index 0000000..098ff27 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/UserServiceApplication.kt @@ -0,0 +1,17 @@ +package com.forge.user + +import org.springframework.boot.SpringApplication +import org.springframework.boot.autoconfigure.SpringBootApplication +import org.springframework.boot.context.properties.EnableConfigurationProperties + +@SpringBootApplication +@EnableConfigurationProperties +class UserServiceApplication { + + companion object { + @JvmStatic + fun main(args: Array) { + SpringApplication.run(UserServiceApplication::class.java, *args) + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/AppConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/AppConfig.kt new file mode 100644 index 0000000..6f00f19 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/AppConfig.kt @@ -0,0 +1,46 @@ +package com.forge.user.config + +import org.springframework.boot.context.properties.ConfigurationProperties +import org.springframework.context.annotation.Configuration + +@Configuration +@ConfigurationProperties(prefix = "app") +data class AppConfig( + var host: String = "0.0.0.0", + var port: Int = 8086, + var jwt: JwtConfig = JwtConfig(), + var encryption: EncryptionConfig = EncryptionConfig(), + var security: SecurityConfig = SecurityConfig(), + var rateLimit: RateLimitConfig = RateLimitConfig(), + var github: GithubConfig = GithubConfig() +) + +data class JwtConfig( + var secret: String = "", + var refreshSecret: String = "", + var expirationMs: Long = 900000, + var refreshExpirationMs: Long = 604800000 +) + +data class EncryptionConfig( + var key: String = "" +) + +data class SecurityConfig( + var bcryptRounds: Int = 12, + var maxLoginAttempts: Int = 5, + var lockoutDurationMinutes: Int = 30 +) + +data class RateLimitConfig( + var enabled: Boolean = true, + var anonymousRpm: Int = 60, + var authenticatedRpm: Int = 1000, + var apiRpm: Int = 5000 +) + +data class GithubConfig( + var clientId: String = "", + var clientSecret: String = "", + var redirectUri: String = "" +) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseConfig.kt new file mode 100644 index 0000000..f2697cc --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseConfig.kt @@ -0,0 +1,37 @@ +package com.forge.user.config + +import com.zaxxer.hikari.HikariDataSource +import org.springframework.beans.factory.annotation.Value +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.context.annotation.Primary +import javax.sql.DataSource + +@Configuration +class DatabaseConfig { + + @Value("\${spring.datasource.url}") + private lateinit var datasourceUrl: String + + @Value("\${spring.datasource.username}") + private lateinit var datasourceUsername: String + + @Value("\${spring.datasource.password}") + private lateinit var datasourcePassword: String + + @Bean + @Primary + fun dataSource(): DataSource { + return HikariDataSource().apply { + jdbcUrl = datasourceUrl + username = datasourceUsername + password = datasourcePassword + driverClassName = "org.postgresql.Driver" + maximumPoolSize = 20 + minimumIdle = 5 + idleTimeout = 300000 + connectionTimeout = 20000 + maxLifetime = 1200000 + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseInitializationConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseInitializationConfig.kt new file mode 100644 index 0000000..b376ec1 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/DatabaseInitializationConfig.kt @@ -0,0 +1,145 @@ +package com.forge.user.config + +import com.forge.user.entity.UserStatus +import com.forge.user.repository.UserRepository +import org.slf4j.LoggerFactory +import org.springframework.boot.CommandLineRunner +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.context.annotation.Profile +import org.springframework.security.crypto.password.PasswordEncoder +import java.util.UUID + +/** + * 数据库初始化配置 + * 在应用启动时执行初始化任务： + * 1. 检查是否存在管理员用户 + * 2. 不存在则创建默认管理员用户 + */ +@Configuration +class DatabaseInitializationConfig { + + private val logger = LoggerFactory.getLogger(DatabaseInitializationConfig::class.java) + + companion object { + // 默认管理员配置 + const val DEFAULT_ADMIN_USERNAME = "admin" + const val DEFAULT_ADMIN_EMAIL = "admin@forge.local" + const val DEFAULT_ADMIN_PASSWORD = "ForgeAdmin123!" + } + + @Bean + @Profile("!test") // 测试环境跳过 + fun databaseInitializer( + userRepository: UserRepository, + passwordEncoder: PasswordEncoder + ): CommandLineRunner { + return CommandLineRunner { + logger.info("开始数据库初始化检查...") + + // 检查是否存在管理员用户 + val adminExists = userRepository.existsByUsername(DEFAULT_ADMIN_USERNAME) + + if (adminExists) { + logger.info("管理员用户已存在，跳过创建") + } else { + logger.warn("未检测到管理员用户，正在创建默认管理员...") + createDefaultAdmin(userRepository, passwordEncoder) + } + + logger.info("数据库初始化检查完成") + } + } + + private fun createDefaultAdmin( + userRepository: UserRepository, + passwordEncoder: PasswordEncoder + ) { + try { + val adminUser = com.forge.user.entity.UserEntity( + id = UUID.fromString("00000000-0000-0000-0000-000000000001"), + username = DEFAULT_ADMIN_USERNAME, + email = DEFAULT_ADMIN_EMAIL, + phone = null, + passwordHash = passwordEncoder.encode(DEFAULT_ADMIN_PASSWORD), + status = UserStatus.ACTIVE, + emailVerified = true, + phoneVerified = false, + avatar = null, + bio = "系统管理员账户" + ) + + userRepository.save(adminUser) + + logger.warn(""" + | + |======================================== + | ⚠️ 默认管理员用户已创建 ⚠️ + |======================================== + | 用户名: $DEFAULT_ADMIN_USERNAME + | 密码: $DEFAULT_ADMIN_PASSWORD + | + | ⚠️ 请立即登录并修改密码！ ⚠️ + |======================================== + | + """.trimMargin()) + + } catch (e: Exception) { + logger.error("创建管理员用户失败: ${e.message}", e) + throw e + } + } +} + +/** + * 开发环境快速初始化配置 + * 使用固定密码便于开发测试 + */ +@Configuration +@Profile("dev") +class DevDatabaseInitializationConfig { + + private val logger = LoggerFactory.getLogger(DevDatabaseInitializationConfig::class.java) + + companion object { + const val DEV_ADMIN_USERNAME = "admin" + const val DEV_ADMIN_PASSWORD = "admin123" + } + + @Bean + fun devDatabaseInitializer( + userRepository: UserRepository, + passwordEncoder: PasswordEncoder + ): CommandLineRunner { + return CommandLineRunner { + val adminExists = userRepository.existsByUsername(DEV_ADMIN_USERNAME) + + if (!adminExists) { + val adminUser = com.forge.user.entity.UserEntity( + id = UUID.fromString("00000000-0000-0000-0000-000000000001"), + username = DEV_ADMIN_USERNAME, + email = "admin@forge.local", + phone = null, + passwordHash = passwordEncoder.encode(DEV_ADMIN_PASSWORD), + status = UserStatus.ACTIVE, + emailVerified = true, + phoneVerified = false, + avatar = null, + bio = "开发环境管理员" + ) + userRepository.save(adminUser) + + logger.warn(""" + | + |======================================== + | ⚠️ 开发环境管理员已创建 ⚠️ + |======================================== + | 用户名: $DEV_ADMIN_USERNAME + | 密码: $DEV_ADMIN_PASSWORD + |======================================== + | + """.trimMargin()) + } + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/JacksonConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/JacksonConfig.kt new file mode 100644 index 0000000..4bf9153 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/JacksonConfig.kt @@ -0,0 +1,22 @@ +package com.forge.user.config + +import com.fasterxml.jackson.databind.ObjectMapper +import com.fasterxml.jackson.databind.SerializationFeature +import com.fasterxml.jackson.module.kotlin.registerKotlinModule +import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.context.annotation.Primary + +@Configuration +class JacksonConfig { + + @Bean + @Primary + fun objectMapper(): ObjectMapper { + return ObjectMapper() + .registerKotlinModule() + .registerModule(JavaTimeModule()) + .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/PasswordConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/PasswordConfig.kt new file mode 100644 index 0000000..15aeed6 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/PasswordConfig.kt @@ -0,0 +1,15 @@ +package com.forge.user.config + +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder +import org.springframework.security.crypto.password.PasswordEncoder + +@Configuration +class PasswordConfig { + + @Bean + fun passwordEncoder(): PasswordEncoder { + return BCryptPasswordEncoder() + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/RedisConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/RedisConfig.kt new file mode 100644 index 0000000..a5e8380 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/RedisConfig.kt @@ -0,0 +1,42 @@ +package com.forge.user.config + +import org.springframework.beans.factory.annotation.Value +import org.springframework.context.annotation.Bean +import org.springframework.context.annotation.Configuration +import org.springframework.data.redis.connection.RedisConnectionFactory +import org.springframework.data.redis.connection.RedisStandaloneConfiguration +import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory +import org.springframework.data.redis.connection.lettuce.LettucePoolingClientConfiguration +import org.springframework.data.redis.core.StringRedisTemplate +import java.time.Duration + +@Configuration +class RedisConfig { + + @Value("\${spring.data.redis.host}") + private lateinit var redisHost: String + + @Value("\${spring.data.redis.port}") + private var redisPort: Int = 6379 + + @Value("\${spring.data.redis.timeout:5000}") + private var redisTimeout: Duration = Duration.ofMillis(5000) + + @Bean + fun redisConnectionFactory(): RedisConnectionFactory { + val config = RedisStandaloneConfiguration(redisHost, redisPort) + + val clientConfig = LettucePoolingClientConfiguration.builder() + .commandTimeout(redisTimeout) + .build() + + return LettuceConnectionFactory(config, clientConfig) + } + + @Bean + fun stringRedisTemplate(): StringRedisTemplate { + return StringRedisTemplate().apply { + setConnectionFactory(redisConnectionFactory()) + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/config/WebConfig.kt b/services/user-service/src/main/kotlin/com/forge/user/config/WebConfig.kt new file mode 100644 index 0000000..e51930b --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/config/WebConfig.kt @@ -0,0 +1,23 @@ +package com.forge.user.config + +import com.forge.user.security.PermissionInterceptor +import org.springframework.context.annotation.Configuration +import org.springframework.web.servlet.config.annotation.InterceptorRegistry +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer + +@Configuration +class WebConfig( + private val permissionInterceptor: PermissionInterceptor +) : WebMvcConfigurer { + + override fun addInterceptors(registry: InterceptorRegistry) { + registry.addInterceptor(permissionInterceptor) + .addPathPatterns("/api/**") + .excludePathPatterns( + "/api/auth/register", + "/api/auth/login", + "/api/auth/refresh", + "/actuator/**" + ) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/controller/OrganizationController.kt b/services/user-service/src/main/kotlin/com/forge/user/controller/OrganizationController.kt new file mode 100644 index 0000000..0c60b2c --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/controller/OrganizationController.kt @@ -0,0 +1,231 @@ +package com.forge.user.controller + +import com.forge.user.dto.ApiResponse +import com.forge.user.entity.OrgMemberEntity +import com.forge.user.entity.OrgRole +import com.forge.user.entity.OrganizationEntity +import com.forge.user.service.OrganizationService +import jakarta.validation.Valid +import jakarta.validation.constraints.NotBlank +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* +import java.util.UUID + +@RestController +@RequestMapping("/api/orgs") +class OrganizationController( + private val organizationService: OrganizationService +) { + + /** + * 创建组织 + * POST /api/orgs + */ + data class CreateOrgRequest( + @field:NotBlank(message = "组织名称不能为空") + val name: String, + val slug: String? = null, + val description: String? = null + ) + + @PostMapping + fun createOrganization( + @Valid @RequestBody request: CreateOrgRequest, + @RequestHeader("X-User-Id") userId: String + ): ResponseEntity> { + return try { + val org = organizationService.createOrganization( + name = request.name, + ownerId = UUID.fromString(userId), + slug = request.slug, + description = request.description + ) + ResponseEntity + .status(HttpStatus.CREATED) + .body(ApiResponse.success(OrgResponse.from(org), "组织创建成功")) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "创建失败")) + } + } + + /** + * 获取组织详情 + * GET /api/orgs/{id} + */ + @GetMapping("/{id}") + fun getOrganization( + @PathVariable id: String, + @RequestHeader("X-User-Id") userId: String + ): ResponseEntity> { + return try { + val org = organizationService.getOrganization(UUID.fromString(id)) + ResponseEntity.ok(ApiResponse.success(OrgResponse.from(org))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error("组织不存在")) + } + } + + /** + * 获取用户所属组织列表 + * GET /api/orgs + */ + @GetMapping + fun getMyOrganizations( + @RequestHeader("X-User-Id") userId: String + ): ResponseEntity>> { + return try { + val orgs = organizationService.getOrganizationsByUserId(UUID.fromString(userId)) + ResponseEntity.ok(ApiResponse.success(orgs.map { OrgResponse.from(it) })) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("获取组织列表失败")) + } + } + + /** + * 添加组织成员 + * POST /api/orgs/{id}/members + */ + data class AddMemberRequest( + val userId: String, + val role: OrgRole = OrgRole.MEMBER + ) + + @PostMapping("/{id}/members") + fun addMember( + @PathVariable id: String, + @Valid @RequestBody request: AddMemberRequest, + @RequestHeader("X-User-Id") currentUserId: String + ): ResponseEntity> { + return try { + organizationService.addMember( + orgId = UUID.fromString(id), + userId = UUID.fromString(request.userId), + role = request.role, + invitedBy = UUID.fromString(currentUserId) + ) + ResponseEntity.ok(ApiResponse.success(message = "成员添加成功")) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "添加成员失败")) + } + } + + /** + * 移除组织成员 + * DELETE /api/orgs/{id}/members/{userId} + */ + @DeleteMapping("/{id}/members/{userId}") + fun removeMember( + @PathVariable id: String, + @PathVariable userId: String, + @RequestHeader("X-User-Id") currentUserId: String + ): ResponseEntity> { + return try { + organizationService.removeMember( + orgId = UUID.fromString(id), + userId = UUID.fromString(userId) + ) + ResponseEntity.ok(ApiResponse.success(message = "成员移除成功")) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "移除成员失败")) + } + } + + /** + * 更新成员角色 + * PUT /api/orgs/{id}/members/{userId}/role + */ + data class UpdateRoleRequest( + val role: OrgRole + ) + + @PutMapping("/{id}/members/{userId}/role") + fun updateMemberRole( + @PathVariable id: String, + @PathVariable userId: String, + @Valid @RequestBody request: UpdateRoleRequest, + @RequestHeader("X-User-Id") currentUserId: String + ): ResponseEntity> { + return try { + organizationService.updateMemberRole( + orgId = UUID.fromString(id), + userId = UUID.fromString(userId), + newRole = request.role + ) + ResponseEntity.ok(ApiResponse.success(message = "角色更新成功")) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "更新角色失败")) + } + } + + /** + * 获取组织成员列表 + * GET /api/orgs/{id}/members + */ + @GetMapping("/{id}/members") + fun getMembers( + @PathVariable id: String, + @RequestHeader("X-User-Id") userId: String + ): ResponseEntity>> { + return try { + val members = organizationService.getMembers(UUID.fromString(id)) + ResponseEntity.ok(ApiResponse.success(members.map { MemberResponse.from(it) })) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("获取成员列表失败")) + } + } +} + +data class OrgResponse( + val id: UUID, + val name: String, + val slug: String, + val avatar: String?, + val description: String?, + val plan: String, + val createdAt: java.time.Instant +) { + companion object { + fun from(org: OrganizationEntity): OrgResponse = OrgResponse( + id = org.id, + name = org.name, + slug = org.slug, + avatar = org.avatar, + description = org.description, + plan = org.plan.name, + createdAt = org.createdAt + ) + } +} + +data class MemberResponse( + val userId: UUID, + val orgId: UUID, + val role: String, + val joinedAt: java.time.Instant, + val invitedBy: UUID? +) { + companion object { + fun from(member: OrgMemberEntity): MemberResponse = MemberResponse( + userId = member.userId, + orgId = member.orgId, + role = member.role.name, + joinedAt = member.joinedAt, + invitedBy = member.invitedBy + ) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/controller/UserController.kt b/services/user-service/src/main/kotlin/com/forge/user/controller/UserController.kt new file mode 100644 index 0000000..052dc94 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/controller/UserController.kt @@ -0,0 +1,106 @@ +package com.forge.user.controller + +import com.forge.user.dto.* +import com.forge.user.service.UserService +import jakarta.validation.Valid +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.web.bind.annotation.* +import java.util.UUID + +@RestController +@RequestMapping("/api/users") +class UserController( + private val userService: UserService +) { + private val logger = LoggerFactory.getLogger(UserController::class.java) + + /** + * 获取当前用户信息 + * GET /api/users/me + */ + @GetMapping("/me") + fun getCurrentUser(@RequestHeader("X-User-Id") userId: String): ResponseEntity> { + return try { + val user = userService.getUserById(UUID.fromString(userId)) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error("用户不存在")) + } + } + + /** + * 更新当前用户信息 + * PUT /api/users/me + */ + @PutMapping("/me") + fun updateCurrentUser( + @RequestHeader("X-User-Id") userId: String, + @Valid @RequestBody request: UpdateUserRequest + ): ResponseEntity> { + return try { + val user = userService.updateUser(UUID.fromString(userId), request) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user), "更新成功")) + } catch (e: Exception) { + logger.warn("Update user failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "更新失败")) + } + } + + /** + * 修改密码 + * POST /api/users/me/password + */ + @PostMapping("/me/password") + fun changePassword( + @RequestHeader("X-User-Id") userId: String, + @Valid @RequestBody request: ChangePasswordRequest + ): ResponseEntity> { + return try { + userService.changePassword(UUID.fromString(userId), request) + ResponseEntity.ok(ApiResponse.success(message = "密码修改成功")) + } catch (e: Exception) { + logger.warn("Change password failed: ${e.message}") + ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "密码修改失败")) + } + } + + /** + * 获取用户详情 + * GET /api/users/{id} + */ + @GetMapping("/{id}") + fun getUser(@PathVariable id: String): ResponseEntity> { + return try { + val user = userService.getUserById(UUID.fromString(id)) + ResponseEntity.ok(ApiResponse.success(userService.toResponse(user))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error("用户不存在")) + } + } + + /** + * 搜索用户 + * GET /api/users/search?keyword=xxx + */ + @GetMapping("/search") + fun searchUsers(@RequestParam keyword: String): ResponseEntity>> { + return try { + val users = userService.searchByKeyword(keyword) + ResponseEntity.ok(ApiResponse.success(userService.toResponseList(users))) + } catch (e: Exception) { + ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("搜索失败")) + } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/LoginLogEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/LoginLogEntity.kt new file mode 100644 index 0000000..af5818c --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/LoginLogEntity.kt @@ -0,0 +1,36 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "login_logs") +class LoginLogEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "user_id") + val userId: UUID? = null, + + @Enumerated(EnumType.STRING) + @Column(name = "provider", nullable = false, length = 32) + val provider: IdentityProvider, + + @Column(name = "ip_address", nullable = false, length = 45) + val ipAddress: String, + + @Column(name = "user_agent", columnDefinition = "TEXT") + val userAgent: String? = null, + + @Column(name = "success", nullable = false) + val success: Boolean, + + @Column(name = "failure_reason", length = 255) + val failureReason: String? = null, + + @Column(name = "request_id") + val requestId: UUID = UUID.randomUUID(), + + @Column(name = "created_at", nullable = false, updatable = false) + val createdAt: Instant = Instant.now() +) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/OrgMemberEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/OrgMemberEntity.kt new file mode 100644 index 0000000..39a6530 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/OrgMemberEntity.kt @@ -0,0 +1,34 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "org_members") +class OrgMemberEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "org_id", nullable = false) + val orgId: UUID, + + @Column(name = "user_id", nullable = false) + val userId: UUID, + + @Enumerated(EnumType.STRING) + @Column(name = "role", nullable = false, length = 20) + var role: OrgRole, + + @Column(name = "joined_at", nullable = false, updatable = false) + val joinedAt: Instant = Instant.now(), + + @Column(name = "invited_by") + val invitedBy: UUID? = null +) + +enum class OrgRole { + OWNER, + ADMIN, + MEMBER, + VIEWER +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/OrganizationEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/OrganizationEntity.kt new file mode 100644 index 0000000..b3aaa52 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/OrganizationEntity.kt @@ -0,0 +1,53 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "organizations") +class OrganizationEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "name", nullable = false, length = 128) + val name: String, + + @Column(name = "slug", nullable = false, unique = true, length = 128) + val slug: String, + + @Column(name = "avatar", length = 512) + var avatar: String? = null, + + @Column(name = "description", columnDefinition = "TEXT") + var description: String? = null, + + @Column(name = "owner_id", nullable = false) + val ownerId: UUID, + + @Enumerated(EnumType.STRING) + @Column(name = "plan", nullable = false, length = 20) + var plan: OrgPlan = OrgPlan.FREE, + + @Column(name = "settings") + var settings: String = "{}", + + @Column(name = "metadata") + var metadata: String = "{}", + + @Column(name = "created_at", nullable = false, updatable = false) + val createdAt: Instant = Instant.now(), + + @Column(name = "updated_at", nullable = false) + var updatedAt: Instant = Instant.now() +) { + @PreUpdate + fun preUpdate() { + updatedAt = Instant.now() + } +} + +enum class OrgPlan { + FREE, + PRO, + ENTERPRISE +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/PermissionEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/PermissionEntity.kt new file mode 100644 index 0000000..1cdffd0 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/PermissionEntity.kt @@ -0,0 +1,31 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "permissions") +class PermissionEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "resource", nullable = false, length = 64) + val resource: String, + + @Column(name = "action", nullable = false, length = 64) + val action: String, + + @Column(name = "description", columnDefinition = "TEXT") + val description: String? = null, + + @Column(name = "conditions", columnDefinition = "jsonb") + val conditions: String? = null, + + @Column(name = "created_at", nullable = false, updatable = false) + val createdAt: Instant = Instant.now() +) { + init { + require(resource.isNotBlank()) { "Resource cannot be blank" } + require(action.isNotBlank()) { "Action cannot be blank" } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/RolePermissionEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/RolePermissionEntity.kt new file mode 100644 index 0000000..ce9a62b --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/RolePermissionEntity.kt @@ -0,0 +1,23 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "role_permissions") +class RolePermissionEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "role_name", nullable = false, length = 64) + val roleName: String, + + @Column(name = "permission_id", nullable = false) + val permissionId: UUID, + + @Column(name = "granted_by", nullable = false) + val grantedBy: UUID, + + @Column(name = "granted_at", nullable = false, updatable = false) + val grantedAt: Instant = Instant.now() +) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/UserEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/UserEntity.kt new file mode 100644 index 0000000..9dbd425 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/UserEntity.kt @@ -0,0 +1,66 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "users") +class UserEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "username", nullable = false, unique = true, length = 64) + var username: String, + + @Column(name = "email", unique = true) + var email: String? = null, + + @Column(name = "phone", unique = true, length = 20) + var phone: String? = null, + + @Column(name = "password_hash", nullable = false, length = 255) + var passwordHash: String, + + @Enumerated(EnumType.STRING) + @Column(name = "status", nullable = false, length = 20) + var status: UserStatus = UserStatus.ACTIVE, + + @Column(name = "avatar", length = 512) + var avatar: String? = null, + + @Column(name = "bio", columnDefinition = "TEXT") + var bio: String? = null, + + @Column(name = "settings") + var settings: String = "{}", + + @Column(name = "created_at", nullable = false, updatable = false) + val createdAt: Instant = Instant.now(), + + @Column(name = "updated_at", nullable = false) + var updatedAt: Instant = Instant.now(), + + @Column(name = "last_login_at") + var lastLoginAt: Instant? = null, + + @Column(name = "last_login_ip") + var lastLoginIp: String? = null, + + @Column(name = "email_verified") + var emailVerified: Boolean = false, + + @Column(name = "phone_verified") + var phoneVerified: Boolean = false +) { + @PreUpdate + fun preUpdate() { + updatedAt = Instant.now() + } +} + +enum class UserStatus { + ACTIVE, + INACTIVE, + SUSPENDED, + DELETED +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/UserIdentityEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/UserIdentityEntity.kt new file mode 100644 index 0000000..1f3e39b --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/UserIdentityEntity.kt @@ -0,0 +1,45 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "user_identities") +class UserIdentityEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "user_id", nullable = false) + val userId: UUID, + + @Enumerated(EnumType.STRING) + @Column(name = "provider", nullable = false, length = 32) + val provider: IdentityProvider, + + @Column(name = "provider_user_id", nullable = false, length = 255) + val providerUserId: String, + + @Column(name = "access_token", columnDefinition = "TEXT") + var accessToken: String? = null, + + @Column(name = "refresh_token", columnDefinition = "TEXT") + var refreshToken: String? = null, + + @Column(name = "expires_at") + var expiresAt: Instant? = null, + + @Column(name = "metadata", columnDefinition = "jsonb") + var metadata: String = "{}", + + @Column(name = "linked_at", nullable = false, updatable = false) + val linkedAt: Instant = Instant.now() +) + +enum class IdentityProvider { + GITHUB, + GOOGLE, + WECHAT, + DINGTALK, + EMAIL, + PHONE +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/entity/UserRoleEntity.kt b/services/user-service/src/main/kotlin/com/forge/user/entity/UserRoleEntity.kt new file mode 100644 index 0000000..040b82f --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/entity/UserRoleEntity.kt @@ -0,0 +1,29 @@ +package com.forge.user.entity + +import jakarta.persistence.* +import java.time.Instant +import java.util.UUID + +@Entity +@Table(name = "user_roles") +class UserRoleEntity( + @Id val id: UUID = UUID.randomUUID(), + + @Column(name = "user_id", nullable = false) + val userId: UUID, + + @Column(name = "role_name", nullable = false, length = 64) + val roleName: String, + + @Column(name = "org_id") + val orgId: UUID? = null, + + @Column(name = "granted_by", nullable = false) + val grantedBy: UUID, + + @Column(name = "granted_at", nullable = false, updatable = false) + val grantedAt: Instant = Instant.now(), + + @Column(name = "expires_at") + val expiresAt: Instant? = null +) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/exception/GlobalExceptionHandler.kt b/services/user-service/src/main/kotlin/com/forge/user/exception/GlobalExceptionHandler.kt new file mode 100644 index 0000000..4100641 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/exception/GlobalExceptionHandler.kt @@ -0,0 +1,68 @@ +package com.forge.user.exception + +import com.forge.user.dto.ApiResponse +import org.slf4j.LoggerFactory +import org.springframework.http.HttpStatus +import org.springframework.http.ResponseEntity +import org.springframework.validation.FieldError +import org.springframework.web.bind.MethodArgumentNotValidException +import org.springframework.web.bind.annotation.ExceptionHandler +import org.springframework.web.bind.annotation.RestControllerAdvice + +@RestControllerAdvice +class GlobalExceptionHandler { + + private val logger = LoggerFactory.getLogger(GlobalExceptionHandler::class.java) + + @ExceptionHandler(UserException::class) + fun handleUserException(e: UserException): ResponseEntity> { + logger.warn("User exception: ${e.message}") + return ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error(e.message ?: "操作失败")) + } + + @ExceptionHandler(AuthenticationException::class) + fun handleAuthenticationException(e: AuthenticationException): ResponseEntity> { + logger.warn("Authentication failed: ${e.message}") + return ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(ApiResponse.error(e.message ?: "认证失败")) + } + + @ExceptionHandler(PermissionDeniedException::class) + fun handlePermissionDeniedException(e: PermissionDeniedException): ResponseEntity> { + logger.warn("Permission denied: ${e.message}") + return ResponseEntity + .status(HttpStatus.FORBIDDEN) + .body(ApiResponse.error(e.message ?: "权限不足")) + } + + @ExceptionHandler(MethodArgumentNotValidException::class) + fun handleValidationException(e: MethodArgumentNotValidException): ResponseEntity> { + val errors = e.bindingResult.allErrors.map { error -> + (error as FieldError).field to error.defaultMessage + }.toMap() + + logger.warn("Validation failed: $errors") + return ResponseEntity + .status(HttpStatus.BAD_REQUEST) + .body(ApiResponse.error("参数验证失败", errors.toString())) + } + + @ExceptionHandler(ResourceNotFoundException::class) + fun handleResourceNotFoundException(e: ResourceNotFoundException): ResponseEntity> { + logger.warn("Resource not found: ${e.message}") + return ResponseEntity + .status(HttpStatus.NOT_FOUND) + .body(ApiResponse.error(e.message ?: "资源不存在")) + } + + @ExceptionHandler(Exception::class) + fun handleGenericException(e: Exception): ResponseEntity> { + logger.error("Unexpected error: ${e.message}", e) + return ResponseEntity + .status(HttpStatus.INTERNAL_SERVER_ERROR) + .body(ApiResponse.error("系统错误，请稍后重试")) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/exception/UserException.kt b/services/user-service/src/main/kotlin/com/forge/user/exception/UserException.kt new file mode 100644 index 0000000..f4114ca --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/exception/UserException.kt @@ -0,0 +1,27 @@ +package com.forge.user.exception + +/** + * 用户相关异常基类 + */ +open class UserException(message: String) : RuntimeException(message) + +class UsernameAlreadyExistsException(message: String) : UserException(message) +class EmailAlreadyExistsException(message: String) : UserException(message) +class PhoneAlreadyExistsException(message: String) : UserException(message) +class UserNotFoundException(message: String) : UserException(message) +class InvalidPasswordException(message: String) : UserException(message) + +/** + * 认证异常 + */ +class AuthenticationException(message: String) : RuntimeException(message) + +/** + * 权限异常 + */ +class PermissionDeniedException(message: String) : RuntimeException(message) + +/** + * 资源不存在异常 + */ +class ResourceNotFoundException(message: String) : RuntimeException(message) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/OrgMemberRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/OrgMemberRepository.kt new file mode 100644 index 0000000..af1121c --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/OrgMemberRepository.kt @@ -0,0 +1,32 @@ +package com.forge.user.repository + +import com.forge.user.entity.OrgMemberEntity +import com.forge.user.entity.OrgRole +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Modifying +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.UUID + +@Repository +interface OrgMemberRepository : JpaRepository { + + fun findByOrgIdAndUserId(orgId: UUID, userId: UUID): OrgMemberEntity? + + fun existsByOrgIdAndUserId(orgId: UUID, userId: UUID): Boolean + + fun findByOrgId(orgId: UUID): List + + fun findByUserId(userId: UUID): List + + @Query("SELECT m FROM OrgMemberEntity m WHERE m.orgId = :orgId AND m.role = :role") + fun findByOrgIdAndRole(@Param("orgId") orgId: UUID, @Param("role") role: OrgRole): List + + @Modifying + @Query("DELETE FROM OrgMemberEntity m WHERE m.orgId = :orgId AND m.userId = :userId") + fun deleteByOrgIdAndUserId(@Param("orgId") orgId: UUID, @Param("userId") userId: UUID) + + @Query("SELECT COUNT(m) FROM OrgMemberEntity m WHERE m.orgId = :orgId") + fun countByOrgId(@Param("orgId") orgId: UUID): Long +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/OrganizationRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/OrganizationRepository.kt new file mode 100644 index 0000000..40d094d --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/OrganizationRepository.kt @@ -0,0 +1,22 @@ +package com.forge.user.repository + +import com.forge.user.entity.OrganizationEntity +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.Optional +import java.util.UUID + +@Repository +interface OrganizationRepository : JpaRepository { + + fun findBySlug(slug: String): Optional + + fun existsBySlug(slug: String): Boolean + + fun findByOwnerId(ownerId: UUID): List + + @Query("SELECT o FROM OrganizationEntity o JOIN OrgMemberEntity m ON o.id = m.orgId WHERE m.userId = :userId") + fun findByMemberUserId(@Param("userId") userId: UUID): List +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/PermissionRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/PermissionRepository.kt new file mode 100644 index 0000000..b888ccc --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/PermissionRepository.kt @@ -0,0 +1,19 @@ +package com.forge.user.repository + +import com.forge.user.entity.PermissionEntity +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.UUID + +@Repository +interface PermissionRepository : JpaRepository { + + fun findByResourceAndAction(resource: String, action: String): PermissionEntity? + + fun existsByResourceAndAction(resource: String, action: String): Boolean + + @Query("SELECT p FROM PermissionEntity p WHERE p.resource = :resource") + fun findByResource(@Param("resource") resource: String): List +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/RolePermissionRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/RolePermissionRepository.kt new file mode 100644 index 0000000..d17cab7 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/RolePermissionRepository.kt @@ -0,0 +1,19 @@ +package com.forge.user.repository + +import com.forge.user.entity.RolePermissionEntity +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.UUID + +@Repository +interface RolePermissionRepository : JpaRepository { + + fun existsByRoleNameAndPermissionId(roleName: String, permissionId: UUID): Boolean + + fun findByRoleName(roleName: String): List + + @Query("SELECT rp.permissionId FROM RolePermissionEntity rp WHERE rp.roleName = :roleName") + fun findPermissionIdsByRoleName(@Param("roleName") roleName: String): List +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/UserIdentityRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/UserIdentityRepository.kt new file mode 100644 index 0000000..275e8a1 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/UserIdentityRepository.kt @@ -0,0 +1,19 @@ +package com.forge.user.repository + +import com.forge.user.entity.IdentityProvider +import com.forge.user.entity.UserIdentityEntity +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.stereotype.Repository +import java.util.UUID + +@Repository +interface UserIdentityRepository : JpaRepository { + + fun findByUserId(userId: UUID): List + + fun findByProviderAndProviderUserId(provider: IdentityProvider, providerUserId: String): UserIdentityEntity? + + fun deleteByUserIdAndProvider(userId: UUID, provider: IdentityProvider) + + fun existsByUserIdAndProvider(userId: UUID, provider: IdentityProvider): Boolean +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/UserRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/UserRepository.kt new file mode 100644 index 0000000..f815c6d --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/UserRepository.kt @@ -0,0 +1,35 @@ +package com.forge.user.repository + +import com.forge.user.entity.UserEntity +import com.forge.user.entity.UserStatus +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.Optional +import java.util.UUID + +@Repository +interface UserRepository : JpaRepository { + + fun findByUsername(username: String): Optional + + fun findByEmail(email: String): Optional + + fun findByPhone(phone: String): Optional + + fun existsByUsername(username: String): Boolean + + fun existsByEmail(email: String): Boolean + + fun existsByPhone(phone: String): Boolean + + @Query("SELECT u FROM UserEntity u WHERE u.status = :status") + fun findByStatus(@Param("status") status: UserStatus): List + + @Query("SELECT u FROM UserEntity u WHERE u.username ILIKE %:keyword% OR u.email ILIKE %:keyword%") + fun searchByKeyword(@Param("keyword") keyword: String): List + + @Query("SELECT u FROM UserEntity u WHERE u.id IN :ids") + fun findAllByIds(@Param("ids") ids: Collection): List +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/repository/UserRoleRepository.kt b/services/user-service/src/main/kotlin/com/forge/user/repository/UserRoleRepository.kt new file mode 100644 index 0000000..1899149 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/repository/UserRoleRepository.kt @@ -0,0 +1,24 @@ +package com.forge.user.repository + +import com.forge.user.entity.UserRoleEntity +import org.springframework.data.jpa.repository.JpaRepository +import org.springframework.data.jpa.repository.Query +import org.springframework.data.repository.query.Param +import org.springframework.stereotype.Repository +import java.util.UUID + +@Repository +interface UserRoleRepository : JpaRepository { + + fun findByUserIdAndOrgIdIsNull(userId: UUID): List + + fun findByUserIdAndOrgId(userId: UUID, orgId: UUID?): List + + @Query("SELECT ur.roleName FROM UserRoleEntity ur WHERE ur.userId = :userId AND (ur.orgId IS NULL OR ur.orgId = :orgId)") + fun findRoleNamesByUserId(@Param("userId") userId: UUID, @Param("orgId") orgId: UUID?): List + + fun existsByUserIdAndRoleNameAndOrgId(userId: UUID, roleName: String, orgId: UUID?): Boolean + + @Query("SELECT ur FROM UserRoleEntity ur WHERE ur.userId = :userId AND ur.roleName = :roleName AND ur.expiresAt < CURRENT_TIMESTAMP") + fun findExpiredRoles(@Param("userId") userId: UUID, @Param("roleName") roleName: String): List +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/security/JwtAuthenticationFilter.kt b/services/user-service/src/main/kotlin/com/forge/user/security/JwtAuthenticationFilter.kt new file mode 100644 index 0000000..7247e73 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/security/JwtAuthenticationFilter.kt @@ -0,0 +1,105 @@ +package com.forge.user.security + +import com.fasterxml.jackson.databind.JsonNode +import com.fasterxml.jackson.databind.ObjectMapper +import jakarta.servlet.FilterChain +import jakarta.servlet.ServletException +import jakarta.servlet.http.HttpServletRequest +import jakarta.servlet.http.HttpServletResponse +import org.springframework.lang.NonNull +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken +import org.springframework.security.core.authority.SimpleGrantedAuthority +import org.springframework.security.core.context.SecurityContextHolder +import org.springframework.security.web.authentication.WebAuthenticationDetailsSource +import org.springframework.stereotype.Component +import org.springframework.web.filter.OncePerRequestFilter +import java.io.IOException + +/** + * User Service 认证过滤器 + * + * 设计原则: + * - JWT 验证由 Gateway 负责 + * - User Service 只从请求头读取用户信息 + * - 支持从 X-User-Id 和 user-account 头获取用户信息 + * + * 请求头来源: + * - X-User-Id: 用户 ID + * - user-account: 用户账户信息 (JSON) + * - X-User-Roles: 用户角色列表 (逗号分隔) + */ +@Component +class JwtAuthenticationFilter : OncePerRequestFilter() { + + companion object { + const val HEADER_USER_ID = "X-User-Id" + const val HEADER_USER_ACCOUNT = "user-account" + const val HEADER_USER_ROLES = "X-User-Roles" + } + + private val objectMapper = ObjectMapper() + + @Throws(ServletException::class, IOException::class) + override fun doFilterInternal( + @NonNull request: HttpServletRequest, + @NonNull response: HttpServletResponse, + @NonNull filterChain: FilterChain + ) { + val xUserId = request.getHeader(HEADER_USER_ID) + val userAccount = request.getHeader(HEADER_USER_ACCOUNT) + val xUserRoles = request.getHeader(HEADER_USER_ROLES) + + // 优先从 user-account JSON 解析 + if (!userAccount.isNullOrBlank()) { + try { + val userNode = objectMapper.readTree(userAccount) + val userId = userNode.get("userId")?.asText() ?: xUserId + val username = userNode.get("username")?.asText() ?: "" + val rolesNode = userNode.get("roles") + val roles = if (rolesNode != null && rolesNode.isArray) { + rolesNode.map { it.asText() } + } else { + xUserRoles?.split(",")?.filter { it.isNotBlank() } ?: listOf("user") + } + + setAuthentication(userId, username, roles, request) + } catch (e: Exception) { + // JSON 解析失败，尝试从单独的头读取 + if (!xUserId.isNullOrBlank()) { + val roles = xUserRoles?.split(",")?.filter { it.isNotBlank() } ?: listOf("user") + setAuthentication(xUserId, "", roles, request) + } + } + } + // 其次从 X-User-Id 头读取 + else if (!xUserId.isNullOrBlank()) { + val roles = xUserRoles?.split(",")?.filter { it.isNotBlank() } ?: listOf("user") + setAuthentication(xUserId, "", roles, request) + } + // 如果请求带有 Authorization 头，尝试 JWT 验证 (兼容直接访问) + else { + val authHeader = request.getHeader("Authorization") + if (authHeader != null && authHeader.startsWith("Bearer ")) { + // JWT 验证由 SecurityConfig 中的 JwtService 处理 + // 这里不做处理，让后续的 FilterChain 处理 + } + } + + filterChain.doFilter(request, response) + } + + /** + * 设置 Spring Security 认证信息 + */ + private fun setAuthentication( + userId: String, + username: String, + roles: List, + request: HttpServletRequest + ) { + val authorities = roles.map { SimpleGrantedAuthority("ROLE_$it") } + val authentication = UsernamePasswordAuthenticationToken(userId, null, authorities) + authentication.details = WebAuthenticationDetailsSource().buildDetails(request) + SecurityContextHolder.getContext().authentication = authentication + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/security/PermissionInterceptor.kt b/services/user-service/src/main/kotlin/com/forge/user/security/PermissionInterceptor.kt new file mode 100644 index 0000000..4ae39f6 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/security/PermissionInterceptor.kt @@ -0,0 +1,73 @@ +package com.forge.user.security + +import com.forge.user.service.PermissionService +import jakarta.servlet.http.HttpServletRequest +import jakarta.servlet.http.HttpServletResponse +import org.slf4j.LoggerFactory +import org.springframework.stereotype.Component +import org.springframework.web.method.HandlerMethod +import org.springframework.web.servlet.HandlerInterceptor +import java.util.UUID + +@Component +class PermissionInterceptor( + private val permissionService: PermissionService +) : HandlerInterceptor { + + private val logger = LoggerFactory.getLogger(PermissionInterceptor::class.java) + + override fun preHandle(request: HttpServletRequest, response: HttpServletResponse, handler: Any): Boolean { + if (handler !is HandlerMethod) { + return true + } + + // 检查是否有 @RequirePermission 注解 + val annotation = handler.getMethodAnnotation(RequirePermission::class.java) + ?: return true + + // 从请求头获取用户信息 + val userIdStr = request.getHeader("X-User-Id") + ?: return true // 没有用户信息，跳过检查 + + val userId = try { + UUID.fromString(userIdStr) + } catch (e: IllegalArgumentException) { + logger.warn("Invalid user ID: $userIdStr") + return true + } + + // 获取组织 ID (如果指定) + val orgIdStr = request.getHeader("X-User-Org-Id") + val orgId = if (annotation.orgIdParam.isNotEmpty()) { + request.getParameter(annotation.orgIdParam)?.let { + try { UUID.fromString(it) } catch (e: Exception) { null } + } + } else if (orgIdStr.isNullOrBlank()) { + null + } else { + try { + UUID.fromString(orgIdStr) + } catch (e: Exception) { + null + } + } + + // 检查权限 + val hasPermission = permissionService.hasPermission( + userId = userId, + resource = annotation.resource, + action = annotation.action, + orgId = orgId + ) + + if (!hasPermission) { + logger.warn("Permission denied: user=$userId, resource=${annotation.resource}, action=${annotation.action}") + response.status = HttpServletResponse.SC_FORBIDDEN + response.contentType = "application/json" + response.writer.write("""{"success":false,"error":"Permission denied: ${annotation.resource}:${annotation.action}"}""") + return false + } + + return true + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/security/RequirePermission.kt b/services/user-service/src/main/kotlin/com/forge/user/security/RequirePermission.kt new file mode 100644 index 0000000..bab6062 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/security/RequirePermission.kt @@ -0,0 +1,18 @@ +package com.forge.user.security + +import java.lang.annotation.ElementType +import java.lang.annotation.Retention +import java.lang.annotation.RetentionPolicy +import java.lang.annotation.Target + +/** + * 权限校验注解 + * 使用方法: @RequirePermission(resource = "workspace", action = "write") + */ +@Target(ElementType.METHOD) +@Retention(RetentionPolicy.RUNTIME) +annotation class RequirePermission( + val resource: String, + val action: String, + val orgIdParam: String = "" +) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/GithubOAuthService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/GithubOAuthService.kt new file mode 100644 index 0000000..05000e3 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/GithubOAuthService.kt @@ -0,0 +1,218 @@ +package com.forge.user.service + +import com.forge.user.config.AppConfig +import com.forge.user.entity.IdentityProvider +import org.slf4j.LoggerFactory +import org.springframework.http.HttpHeaders +import org.springframework.http.HttpStatus +import org.springframework.stereotype.Service +import org.springframework.web.reactive.function.client.WebClient +import org.springframework.web.reactive.function.client.bodyToMono +import org.springframework.web.util.UriComponentsBuilder +import reactor.core.publisher.Mono +import java.time.Duration + +/** + * GitHub OAuth2 服务 + * 负责 GitHub OAuth 登录流程 + */ +@Service +class GithubOAuthService( + private val appConfig: AppConfig, + private val identityService: IdentityService, + private val userService: UserService +) { + private val logger = LoggerFactory.getLogger(GithubOAuthService::class.java) + + private val webClient = WebClient.builder() + .baseUrl("https://api.github.com") + .defaultHeader(HttpHeaders.ACCEPT, "application/vnd.github.v3+json") + .build() + + /** + * 生成 GitHub OAuth 授权 URL + */ + fun getAuthorizationUrl(state: String, redirectUri: String): String { + return UriComponentsBuilder.fromHttpUrl("https://github.com/login/oauth/authorize") + .queryParam("client_id", appConfig.github.clientId) + .queryParam("redirect_uri", redirectUri) + .queryParam("scope", "read:user user:email") + .queryParam("state", state) + .toUriString() + } + + /** + * 交换 code 获取 access token + */ + fun exchangeCodeForToken(code: String): GithubTokenResponse { + val tokenResponse = WebClient.builder() + .baseUrl("https://github.com/login/oauth/access_token") + .build() + .post() + .uri { + it.queryParam("client_id", appConfig.github.clientId) + .queryParam("client_secret", appConfig.github.clientSecret) + .queryParam("code", code) + .build() + } + .header(HttpHeaders.ACCEPT, "application/json") + .retrieve() + .bodyToMono() + .block(Duration.ofSeconds(10)) + ?: throw OAuthException("Failed to exchange code for token") + + if (tokenResponse.error != null) { + throw OAuthException(tokenResponse.errorDescription ?: "GitHub OAuth error") + } + + return tokenResponse + } + + /** + * 获取 GitHub 用户信息 + */ + fun getUserInfo(accessToken: String): GithubUserResponse { + return webClient.get() + .uri("/user") + .header(HttpHeaders.AUTHORIZATION, "Bearer $accessToken") + .retrieve() + .bodyToMono(GithubUserResponse::class.java) + .block(Duration.ofSeconds(10)) + ?: throw OAuthException("Failed to get GitHub user info") + } + + /** + * 获取用户邮箱（如果 private） + */ + fun getUserEmails(accessToken: String): List { + return webClient.get() + .uri("/user/emails") + .header(HttpHeaders.AUTHORIZATION, "Bearer $accessToken") + .retrieve() + .bodyToMono>() + .block(Duration.ofSeconds(10)) + ?: emptyList() + } + + /** + * 处理 GitHub OAuth 登录/注册 + */ + fun handleOAuthCallback(code: String): LoginResult { + // 1. 交换 token + val tokenResponse = exchangeCodeForToken(code) + + // 2. 获取 GitHub 用户信息 + val githubUser = getUserInfo(tokenResponse.accessToken) + + // 3. 查找或创建用户 + var user = identityService.findUserByIdentity(IdentityProvider.GITHUB, githubUser.id.toString()) + + if (user == null) { + // 创建新用户 + val email = githubUser.email ?: getVerifiedEmail(tokenResponse.accessToken) + val username = generateUsername(githubUser.login) + + val registerRequest = com.forge.user.dto.RegisterRequest( + username = username, + password = generateRandomPassword(), // 随机密码，第三方登录用户可重置 + email = email, + phone = null + ) + + user = userService.register(registerRequest) + + // 绑定 GitHub 账号 + identityService.bindIdentity(user.id, IdentityProvider.GITHUB, githubUser.id.toString()) + } else { + // 已存在用户，检查是否绑定 GitHub + if (!identityService.isBound(user.id, IdentityProvider.GITHUB)) { + identityService.bindIdentity(user.id, IdentityProvider.GITHUB, githubUser.id.toString()) + } + } + + logger.info("GitHub login: user=${user.username}, githubId=${githubUser.id}") + + return LoginResult( + user = user, + provider = IdentityProvider.GITHUB + ) + } + + /** + * 获取已验证的邮箱 + */ + private fun getVerifiedEmail(accessToken: String): String? { + val emails = getUserEmails(accessToken) + return emails.find { it.verified && it.primary }?.email + } + + /** + * 生成用户名（避免重复） + */ + private fun generateUsername(login: String): String { + var username = login.lowercase().replace(Regex("[^a-z0-9]"), "") + if (username.length < 3) { + username = "user_$username" + } + + // 检查是否重复 + var counter = 1 + var finalUsername = username + while (true) { + try { + userService.getUserByUsername(finalUsername) + finalUsername = "${username}${counter}" + counter++ + } catch (e: Exception) { + break + } + } + + return finalUsername + } + + /** + * 生成随机密码 + */ + private fun generateRandomPassword(): String { + val chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#\$%" + return (1..32).map { chars[java.security.SecureRandom().nextInt(chars.length)] }.joinToString("") + } + + /** + * 检查 GitHub OAuth 是否已配置 + */ + fun isConfigured(): Boolean { + return appConfig.github.clientId.isNotBlank() && appConfig.github.clientSecret.isNotBlank() + } +} + +// GitHub OAuth 响应 +data class GithubTokenResponse( + val accessToken: String, + val tokenType: String, + val scope: String?, + val error: String?, + val errorDescription: String? +) + +data class GithubUserResponse( + val id: Long, + val login: String, + val email: String?, + val name: String?, + val avatarUrl: String? +) + +data class GithubEmail( + val email: String, + val primary: Boolean, + val verified: Boolean +) + +data class LoginResult( + val user: com.forge.user.entity.UserEntity, + val provider: IdentityProvider +) + +class OAuthException(message: String) : RuntimeException(message) \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/IdentityService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/IdentityService.kt new file mode 100644 index 0000000..7070513 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/IdentityService.kt @@ -0,0 +1,87 @@ +package com.forge.user.service + +import com.forge.user.entity.IdentityProvider +import com.forge.user.entity.UserIdentityEntity +import com.forge.user.entity.UserEntity +import com.forge.user.exception.UserException +import com.forge.user.repository.UserIdentityRepository +import com.forge.user.repository.UserRepository +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional +import java.time.Instant +import java.util.UUID + +/** + * 第三方身份服务 + * 支持 GitHub、Google、微信、钉钉等 OAuth 登录 + */ +@Service +class IdentityService( + private val userRepository: UserRepository, + private val userIdentityRepository: UserIdentityRepository +) { + /** + * 通过第三方身份查找用户 + * 如果用户不存在，返回 null + */ + fun findUserByIdentity(provider: IdentityProvider, providerUserId: String): UserEntity? { + return userIdentityRepository.findByProviderAndProviderUserId(provider, providerUserId) + ?.let { identity -> + userRepository.findById(identity.userId).orElse(null) + } + } + + /** + * 绑定第三方账号到现有用户 + */ + @Transactional + fun bindIdentity(userId: UUID, provider: IdentityProvider, providerUserId: String): UserIdentityEntity { + // 检查是否已绑定 + val existing = userIdentityRepository.findByProviderAndProviderUserId(provider, providerUserId) + if (existing != null && existing.userId != userId) { + throw UserException("该账号已被其他用户绑定") + } + + // 检查用户是否已绑定该提供商 + val userIdentities = userIdentityRepository.findByUserId(userId) + if (userIdentities.any { it.provider == provider }) { + throw UserException("该账号已绑定${provider.name}，请先解绑") + } + + val identity = UserIdentityEntity( + userId = userId, + provider = provider, + providerUserId = providerUserId, + linkedAt = Instant.now() + ) + + return userIdentityRepository.save(identity) + } + + /** + * 解绑第三方账号 + */ + @Transactional + fun unbindIdentity(userId: UUID, provider: IdentityProvider) { + val identities = userIdentityRepository.findByUserId(userId) + val identity = identities.find { it.provider == provider } + ?: throw UserException("未绑定该账号") + + userIdentityRepository.delete(identity) + } + + /** + * 获取用户绑定的所有第三方账号 + */ + fun getUserIdentities(userId: UUID): List { + return userIdentityRepository.findByUserId(userId) + } + + /** + * 检查用户是否绑定了指定提供商 + */ + fun isBound(userId: UUID, provider: IdentityProvider): Boolean { + return userIdentityRepository.findByUserId(userId) + .any { it.provider == provider } + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/JwtService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/JwtService.kt new file mode 100644 index 0000000..2ba3011 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/JwtService.kt @@ -0,0 +1,175 @@ +package com.forge.user.service + +import com.forge.user.config.AppConfig +import io.jsonwebtoken.* +import io.jsonwebtoken.security.Keys +import org.slf4j.LoggerFactory +import org.springframework.data.redis.core.StringRedisTemplate +import org.springframework.stereotype.Service +import java.time.Duration +import java.time.Instant +import java.util.Date +import javax.crypto.SecretKey + +@Service +class JwtService( + private val appConfig: AppConfig, + private val redisTemplate: StringRedisTemplate +) { + private val logger = LoggerFactory.getLogger(JwtService::class.java) + + private val accessTokenKey: SecretKey by lazy { + Keys.hmacShaKeyFor(appConfig.jwt.secret.toByteArray()) + } + + private val refreshTokenKey: SecretKey by lazy { + Keys.hmacShaKeyFor(appConfig.jwt.refreshSecret.toByteArray()) + } + + /** + * 生成 Access Token + */ + fun generateAccessToken(userId: String, username: String, roles: List): String { + val now = Instant.now().toEpochMilli() + val expiresAt = now + appConfig.jwt.expirationMs + + return Jwts.builder() + .subject(userId) + .claim("username", username) + .claim("roles", roles) + .claim("type", "access") + .issuer("forge-platform") + .issuedAt(Date(now)) + .expiration(Date(expiresAt)) + .signWith(accessTokenKey) + .compact() + } + + /** + * 生成 Refresh Token + */ + fun generateRefreshToken(userId: String): String { + val now = Instant.now().toEpochMilli() + val expiresAt = now + appConfig.jwt.refreshExpirationMs + val tokenId = java.util.UUID.randomUUID().toString() + + // 存储到 Redis + redisTemplate.opsForValue().set( + "refresh:$tokenId", + userId, + Duration.ofMillis(appConfig.jwt.refreshExpirationMs) + ) + + return Jwts.builder() + .subject(userId) + .claim("type", "refresh") + .claim("jti", tokenId) + .issuedAt(Date(now)) + .expiration(Date(expiresAt)) + .signWith(refreshTokenKey) + .compact() + } + + /** + * 验证 Access Token + */ + fun validateAccessToken(token: String): Claims? { + return try { + Jwts.parser() + .verifyWith(accessTokenKey) + .build() + .parseSignedClaims(token) + .payload + } catch (e: ExpiredJwtException) { + logger.warn("Access token expired: ${e.message}") + null + } catch (e: Exception) { + logger.warn("Invalid access token: ${e.message}") + null + } + } + + /** + * 验证 Refresh Token + */ + fun validateRefreshToken(token: String): Claims? { + return try { + val claims = Jwts.parser() + .verifyWith(refreshTokenKey) + .build() + .parseSignedClaims(token) + .payload + + // 检查 Token 是否在黑名单 + val jti = claims["jti"] as? String ?: return null + if (!redisTemplate.hasKey("refresh:$jti")) { + return null + } + + claims + } catch (e: Exception) { + logger.warn("Invalid refresh token: ${e.message}") + null + } + } + + /** + * 刷新 Access Token + */ + fun refreshAccessToken(refreshToken: String): Pair? { + val claims = validateRefreshToken(refreshToken) ?: return null + + val userId = claims.subject + val jti = claims["jti"] as? String ?: return null + + val newAccessToken = generateAccessToken(userId, "username", emptyList()) + val newRefreshToken = generateRefreshToken(userId) + + // 使旧 Refresh Token 失效 + redisTemplate.delete("refresh:$jti") + + return Pair(newAccessToken, newRefreshToken) + } + + /** + * 使 Refresh Token 失效 + */ + fun revokeRefreshToken(token: String) { + try { + val claims = Jwts.parser() + .verifyWith(refreshTokenKey) + .build() + .parseSignedClaims(token) + .payload + + val jti = claims["jti"] as? String + jti?.let { redisTemplate.delete("refresh:$it") } + } catch (e: Exception) { + logger.warn("Failed to revoke refresh token: ${e.message}") + } + } + + /** + * 使所有 Refresh Token 失效 (用户登出所有设备) + */ + fun revokeAllUserTokens(userId: String) { + val pattern = "refresh:*" + val keys = redisTemplate.keys(pattern) + keys?.forEach { key -> + if (redisTemplate.opsForValue().get(key) == userId) { + redisTemplate.delete(key) + } + } + } + + /** + * 将用户 ID 添加到 Token 黑名单 + */ + fun addToBlacklist(token: String, ttlSeconds: Long) { + redisTemplate.opsForValue().set( + "token:blacklist:$token", + "revoked", + Duration.ofSeconds(ttlSeconds) + ) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/OrganizationService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/OrganizationService.kt new file mode 100644 index 0000000..3149d37 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/OrganizationService.kt @@ -0,0 +1,176 @@ +package com.forge.user.service + +import com.forge.user.entity.* +import com.forge.user.exception.ResourceNotFoundException +import com.forge.user.exception.UserException +import com.forge.user.repository.OrgMemberRepository +import com.forge.user.repository.OrganizationRepository +import com.forge.user.repository.UserRepository +import org.springframework.stereotype.Service +import org.springframework.transaction.annotation.Transactional +import java.time.Instant +import java.util.UUID + +@Service +class OrganizationService( + private val organizationRepository: OrganizationRepository, + private val orgMemberRepository: OrgMemberRepository, + private val userRepository: UserRepository +) { + /** + * 创建组织 + */ + @Transactional + fun createOrganization(name: String, ownerId: UUID, slug: String? = null, description: String? = null): OrganizationEntity { + // 检查用户是否存在 + userRepository.findById(ownerId) + .orElseThrow { UserException("用户不存在") } + + // 生成 slug + val orgSlug = slug ?: generateSlug(name) + + // 检查 slug 是否存在 + if (organizationRepository.existsBySlug(orgSlug)) { + throw UserException("组织标识符已存在") + } + + val organization = OrganizationEntity( + name = name, + slug = orgSlug, + ownerId = ownerId, + description = description + ) + + val savedOrg = organizationRepository.save(organization) + + // 添加所有者为成员 + val member = OrgMemberEntity( + orgId = savedOrg.id, + userId = ownerId, + role = OrgRole.OWNER, + joinedAt = Instant.now() + ) + orgMemberRepository.save(member) + + return savedOrg + } + + /** + * 获取组织详情 + */ + fun getOrganization(orgId: UUID): OrganizationEntity { + return organizationRepository.findById(orgId) + .orElseThrow { ResourceNotFoundException("组织不存在") } + } + + /** + * 获取用户所属组织列表 + */ + fun getOrganizationsByUserId(userId: UUID): List { + return organizationRepository.findByMemberUserId(userId) + } + + /** + * 添加组织成员 + */ + @Transactional + fun addMember(orgId: UUID, userId: UUID, role: OrgRole, invitedBy: UUID): OrgMemberEntity { + // 检查组织是否存在 + getOrganization(orgId) + + // 检查被邀请用户是否存在 + userRepository.findById(userId) + .orElseThrow { UserException("用户不存在") } + + // 检查是否已是成员 + if (orgMemberRepository.existsByOrgIdAndUserId(orgId, userId)) { + throw UserException("用户已是组织成员") + } + + val member = OrgMemberEntity( + orgId = orgId, + userId = userId, + role = role, + joinedAt = Instant.now(), + invitedBy = invitedBy + ) + + return orgMemberRepository.save(member) + } + + /** + * 移除组织成员 + */ + @Transactional + fun removeMember(orgId: UUID, userId: UUID) { + val member = orgMemberRepository.findByOrgIdAndUserId(orgId, userId) + ?: throw UserException("用户不是组织成员") + + // 不能移除所有者 + if (member.role == OrgRole.OWNER) { + throw UserException("不能移除组织所有者") + } + + orgMemberRepository.delete(member) + } + + /** + * 更新成员角色 + */ + @Transactional + fun updateMemberRole(orgId: UUID, userId: UUID, newRole: OrgRole) { + val member = orgMemberRepository.findByOrgIdAndUserId(orgId, userId) + ?: throw UserException("用户不是组织成员") + + // 不能修改所有者角色 + if (member.role == OrgRole.OWNER && newRole != OrgRole.OWNER) { + throw UserException("不能修改所有者的角色") + } + + member.role = newRole + orgMemberRepository.save(member) + } + + /** + * 获取组织成员列表 + */ + fun getMembers(orgId: UUID): List { + return orgMemberRepository.findByOrgId(orgId) + } + + /** + * 检查用户是否是组织成员 + */ + fun isMember(orgId: UUID, userId: UUID): Boolean { + return orgMemberRepository.existsByOrgIdAndUserId(orgId, userId) + } + + /** + * 检查用户是否有组织角色 + */ + fun hasRole(orgId: UUID, userId: UUID, role: OrgRole): Boolean { + val member = orgMemberRepository.findByOrgIdAndUserId(orgId, userId) ?: return false + return member.role == role + } + + /** + * 生成 slug + */ + private fun generateSlug(name: String): String { + val baseSlug = name.lowercase() + .replace(Regex("[^a-z0-9\\s-]"), "") + .replace(Regex("\\s+"), "-") + .replace(Regex("-+"), "-") + .trim('-') + + var slug = baseSlug + var counter = 1 + + while (organizationRepository.existsBySlug(slug)) { + slug = "$baseSlug-$counter" + counter++ + } + + return slug + } +} \ No newline at end of file diff --git a/services/user-service/src/main/kotlin/com/forge/user/service/PermissionService.kt b/services/user-service/src/main/kotlin/com/forge/user/service/PermissionService.kt new file mode 100644 index 0000000..c2542d4 --- /dev/null +++ b/services/user-service/src/main/kotlin/com/forge/user/service/PermissionService.kt @@ -0,0 +1,114 @@ +package com.forge.user.service + +import com.forge.user.entity.PermissionEntity +import com.forge.user.exception.PermissionDeniedException +import com.forge.user.repository.PermissionRepository +import com.forge.user.repository.RolePermissionRepository +import com.forge.user.repository.UserRoleRepository +import org.springframework.stereotype.Service +import java.util.UUID + +@Service +class PermissionService( + private val permissionRepository: PermissionRepository, + private val rolePermissionRepository: RolePermissionRepository, + private val userRoleRepository: UserRoleRepository +) { + /** + * 检查用户是否有指定权限 + */ + fun hasPermission(userId: UUID, resource: String, action: String, orgId: UUID? = null): Boolean { + // 获取用户角色 + val roles = getUserRoles(userId, orgId) + + // 检查每个角色是否有权限 + return roles.any { roleName -> + hasRolePermission(roleName, resource, action) + } + } + + /** + * 检查用户是否有任意一个权限 + */ + fun hasAnyPermission(userId: UUID, permissions: List>, orgId: UUID? = null): Boolean { + return permissions.any { (resource, action) -> + hasPermission(userId, resource, action, orgId) + } + } + + /** + * 检查用户是否有所有权限 + */ + fun hasAllPermissions(userId: UUID, permissions: List>, orgId: UUID? = null): Boolean { + return permissions.all { (resource, action) -> + hasPermission(userId, resource, action, orgId) + } + } + + /** + * 检查用户是否有指定角色 + */ + fun hasRole(userId: UUID, roleName: String, orgId: UUID? = null): Boolean { + return userRoleRepository.existsByUserIdAndRoleNameAndOrgId(userId, roleName, orgId) + } + + /** + * 检查用户是否有任意一个角色 + */ + fun hasAnyRole(userId: UUID, roleNames: List, orgId: UUID? = null): Boolean { + return roleNames.any { roleName -> + hasRole(userId, roleName, orgId) + } + } + + /** + * 确保用户有权限，否则抛出异常 + */ + fun requirePermission(userId: UUID, resource: String, action: String, orgId: UUID? = null) { + if (!hasPermission(userId, resource, action, orgId)) { + throw PermissionDeniedException("缺少权限: $resource:$action") + } + } + + /** + * 确保用户有角色，否则抛出异常 + */ + fun requireRole(userId: UUID, roleName: String, orgId: UUID? = null) { + if (!hasRole(userId, roleName, orgId)) { + throw PermissionDeniedException("缺少角色: $roleName") + } + } + + /** + * 检查角色是否有指定权限 + */ + private fun hasRolePermission(roleName: String, resource: String, action: String): Boolean { + if (roleName == "admin") return true // admin 拥有所有权限 + + val permission = permissionRepository.findByResourceAndAction(resource, action) + ?: return false + + return rolePermissionRepository.existsByRoleNameAndPermissionId(roleName, permission.id) + } + + /** + * 获取用户角色列表 + */ + private fun getUserRoles(userId: UUID, orgId: UUID?): List { + return userRoleRepository.findRoleNamesByUserId(userId, orgId) + } + + /** + * 获取所有权限 + */ + fun getAllPermissions(): List { + return permissionRepository.findAll() + } + + /** + * 按资源获取权限 + */ + fun getPermissionsByResource(resource: String): List { + return permissionRepository.findByResource(resource) + } +} \ No newline at end of file diff --git a/services/user-service/src/main/resources/application.yml b/services/user-service/src/main/resources/application.yml new file mode 100644 index 0000000..97e2e9d --- /dev/null +++ b/services/user-service/src/main/resources/application.yml @@ -0,0 +1,84 @@ +spring: + application: + name: user-service + + datasource: + url: jdbc:postgresql://localhost:5432/forge + username: postgres + password: 123456 + driver-class-name: org.postgresql.Driver + hikari: + maximum-pool-size: 20 + minimum-idle: 5 + idle-timeout: 300000 + connection-timeout: 20000 + max-lifetime: 1200000 + + jpa: + hibernate: + ddl-auto: validate + show-sql: false + properties: + hibernate: + dialect: org.hibernate.dialect.PostgreSQLDialect + format_sql: true + + data: + redis: + host: localhost + port: 6379 + timeout: 5000ms + + flyway: + enabled: true + locations: classpath:db/migration + baseline-on-migrate: true + validate-on-migrate: true + +server: + port: 8086 + error: + include-message: always + include-binding-errors: always + +app: + host: 0.0.0.0 + port: 8086 + + jwt: + secret: ${JWT_SECRET:your_jwt_secret_key_at_least_32_chars_here} + refresh-secret: ${JWT_REFRESH_SECRET:your_jwt_refresh_secret_key_at_least_32_chars} + expiration-ms: 900000 + refresh-expiration-ms: 604800000 + + security: + bcrypt-rounds: 12 + max-login-attempts: 5 + lockout-duration-minutes: 30 + + rate-limit: + enabled: true + anonymous-rpm: 60 + authenticated-rpm: 1000 + api-rpm: 5000 + + github: + client-id: ${GITHUB_CLIENT_ID:} + client-secret: ${GITHUB_CLIENT_SECRET:} + redirectUri: ${GITHUB_REDIRECT_URI:} + +logging: + level: + root: INFO + com.forge.user: DEBUG + org.springframework.security: INFO + org.hibernate.SQL: WARN + +management: + endpoints: + web: + exposure: + include: health,info,metrics,prometheus + endpoint: + health: + show-details: when-authorized \ No newline at end of file diff --git a/services/user-service/src/main/resources/db/migration/V1__init_user_schema.sql b/services/user-service/src/main/resources/db/migration/V1__init_user_schema.sql new file mode 100644 index 0000000..8cdf5f8 --- /dev/null +++ b/services/user-service/src/main/resources/db/migration/V1__init_user_schema.sql @@ -0,0 +1,128 @@ +-- 用户表 +CREATE TABLE IF NOT EXISTS users ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + username VARCHAR(64) NOT NULL UNIQUE, + email VARCHAR(255) UNIQUE, + phone VARCHAR(20) UNIQUE, + password_hash VARCHAR(255) NOT NULL, + status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE', + avatar VARCHAR(512), + bio TEXT, + settings JSONB DEFAULT '{}', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + last_login_at TIMESTAMP WITH TIME ZONE, + last_login_ip INET, + email_verified BOOLEAN DEFAULT FALSE, + phone_verified BOOLEAN DEFAULT FALSE, + CONSTRAINT users_username_format CHECK (username ~ '^[a-zA-Z0-9_-]{3,64}$') +); + +-- 索引 +CREATE INDEX IF NOT EXISTS idx_users_email ON users(email); +CREATE INDEX IF NOT EXISTS idx_users_phone ON users(phone); +CREATE INDEX IF NOT EXISTS idx_users_status ON users(status); +CREATE INDEX IF NOT EXISTS idx_users_created_at ON users(created_at); + +-- 组织表 +CREATE TABLE IF NOT EXISTS organizations ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + name VARCHAR(128) NOT NULL, + slug VARCHAR(128) NOT NULL UNIQUE, + avatar VARCHAR(512), + description TEXT, + owner_id UUID NOT NULL REFERENCES users(id) ON DELETE RESTRICT, + plan VARCHAR(20) NOT NULL DEFAULT 'FREE', + settings JSONB DEFAULT '{}', + metadata JSONB DEFAULT '{}', + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + CONSTRAINT org_slug_format CHECK (slug ~ '^[a-z0-9-]+$') +); + +CREATE INDEX IF NOT EXISTS idx_orgs_slug ON organizations(slug); +CREATE INDEX IF NOT EXISTS idx_orgs_owner ON organizations(owner_id); + +-- 组织成员表 +CREATE TABLE IF NOT EXISTS org_members ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + org_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role VARCHAR(20) NOT NULL, + joined_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + invited_by UUID REFERENCES users(id), + UNIQUE(org_id, user_id) +); + +CREATE INDEX IF NOT EXISTS idx_org_members_org ON org_members(org_id); +CREATE INDEX IF NOT EXISTS idx_org_members_user ON org_members(user_id); + +-- 用户角色表 (全局 + 组织级) +CREATE TABLE IF NOT EXISTS user_roles ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + role_name VARCHAR(64) NOT NULL, + org_id UUID REFERENCES organizations(id) ON DELETE CASCADE, + granted_by UUID NOT NULL REFERENCES users(id), + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + expires_at TIMESTAMP WITH TIME ZONE, + UNIQUE(user_id, role_name, org_id) +); + +CREATE INDEX IF NOT EXISTS idx_user_roles_user ON user_roles(user_id); +CREATE INDEX IF NOT EXISTS idx_user_roles_org ON user_roles(org_id); + +-- 权限表 +CREATE TABLE IF NOT EXISTS permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + resource VARCHAR(64) NOT NULL, + action VARCHAR(64) NOT NULL, + description TEXT, + conditions JSONB, + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(resource, action) +); + +-- 角色权限关联表 +CREATE TABLE IF NOT EXISTS role_permissions ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + role_name VARCHAR(64) NOT NULL, + permission_id UUID NOT NULL REFERENCES permissions(id) ON DELETE CASCADE, + granted_by UUID NOT NULL REFERENCES users(id), + granted_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(role_name, permission_id) +); + +-- 第三方登录绑定表 +CREATE TABLE IF NOT EXISTS user_identities ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE, + provider VARCHAR(32) NOT NULL, + provider_user_id VARCHAR(255) NOT NULL, + access_token TEXT, + refresh_token TEXT, + expires_at TIMESTAMP WITH TIME ZONE, + metadata JSONB DEFAULT '{}', + linked_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(), + UNIQUE(provider, provider_user_id) +); + +CREATE INDEX IF NOT EXISTS idx_user_identities_user ON user_identities(user_id); +CREATE INDEX IF NOT EXISTS idx_user_identities_provider ON user_identities(provider, provider_user_id); + +-- 登录日志表 (审计) +CREATE TABLE IF NOT EXISTS login_logs ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + user_id UUID REFERENCES users(id), + provider VARCHAR(32) NOT NULL, + ip_address INET NOT NULL, + user_agent TEXT, + success BOOLEAN NOT NULL, + failure_reason VARCHAR(255), + request_id UUID DEFAULT gen_random_uuid(), + created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW() +); + +CREATE INDEX IF NOT EXISTS idx_login_logs_user ON login_logs(user_id); +CREATE INDEX IF NOT EXISTS idx_login_logs_created ON login_logs(created_at); +CREATE INDEX IF NOT EXISTS idx_login_logs_ip ON login_logs(ip_address); \ No newline at end of file diff --git a/services/user-service/src/main/resources/db/migration/V2__init_permissions.sql b/services/user-service/src/main/resources/db/migration/V2__init_permissions.sql new file mode 100644 index 0000000..989d92c --- /dev/null +++ b/services/user-service/src/main/resources/db/migration/V2__init_permissions.sql @@ -0,0 +1,34 @@ +-- 插入基础权限 +INSERT INTO permissions (resource, action, description) VALUES + -- Workspace 权限 + ('workspace', 'read', '读取工作空间'), + ('workspace', 'write', '创建/修改文件'), + ('workspace', 'delete', '删除工作空间'), + ('workspace', 'manage', '管理工作空间设置'), + + -- Chat 权限 + ('chat', 'read', '查看对话'), + ('chat', 'write', '发送消息'), + ('chat', 'delete', '删除对话'), + + -- Workflow 权限 + ('workflow', 'read', '查看工作流'), + ('workflow', 'create', '创建工作流'), + ('workflow', 'edit', '编辑工作流'), + ('workflow', 'delete', '删除工作流'), + ('workflow', 'run', '运行工作流'), + + -- MCP 权限 + ('mcp', 'call', '调用 MCP 工具'), + + -- Admin 权限 + ('admin', 'access', '访问管理后台'), + ('admin', 'users', '管理用户'), + ('admin', 'roles', '管理角色'), + ('admin', 'settings', '管理系统设置'), + + -- Organization 权限 + ('org', 'read', '查看组织信息'), + ('org', 'manage', '管理组织设置'), + ('org', 'members', '管理组织成员') +ON CONFLICT (resource, action) DO NOTHING; \ No newline at end of file diff --git a/services/user-service/src/main/resources/db/migration/V3__fix_ip_column_type.sql b/services/user-service/src/main/resources/db/migration/V3__fix_ip_column_type.sql new file mode 100644 index 0000000..23cffb7 --- /dev/null +++ b/services/user-service/src/main/resources/db/migration/V3__fix_ip_column_type.sql @@ -0,0 +1,3 @@ +-- 修复 IP 地址列类型：INET -> VARCHAR(45) +ALTER TABLE users ALTER COLUMN last_login_ip TYPE VARCHAR(45); +ALTER TABLE login_logs ALTER COLUMN ip_address TYPE VARCHAR(45); \ No newline at end of file diff --git a/services/user-service/src/main/resources/db/migration/V4__change_jsonb_to_text.sql b/services/user-service/src/main/resources/db/migration/V4__change_jsonb_to_text.sql new file mode 100644 index 0000000..d27e4d2 --- /dev/null +++ b/services/user-service/src/main/resources/db/migration/V4__change_jsonb_to_text.sql @@ -0,0 +1,9 @@ +-- 更改 JSONB 列为 TEXT 类型以解决 Hibernate 兼容性问题 +ALTER TABLE users ALTER COLUMN settings TYPE TEXT; +ALTER TABLE users ALTER COLUMN settings SET DEFAULT '{}'; +ALTER TABLE organizations ALTER COLUMN settings TYPE TEXT; +ALTER TABLE organizations ALTER COLUMN settings SET DEFAULT '{}'; +ALTER TABLE organizations ALTER COLUMN metadata TYPE TEXT; +ALTER TABLE organizations ALTER COLUMN metadata SET DEFAULT '{}'; +ALTER TABLE user_identities ALTER COLUMN metadata TYPE TEXT; +ALTER TABLE user_identities ALTER COLUMN metadata SET DEFAULT '{}'; \ No newline at end of file diff --git a/services/user-service/src/main/resources/logback-spring.xml b/services/user-service/src/main/resources/logback-spring.xml new file mode 100644 index 0000000..16fcab5 --- /dev/null +++ b/services/user-service/src/main/resources/logback-spring.xml @@ -0,0 +1,48 @@ + + + + + + + ${LOG_PATTERN} + + + + + logs/user-service.log + + logs/user-service.%d{yyyy-MM-dd}.log + 30 + + + ${LOG_PATTERN} + + + + + logs/user-service.json.log + + logs/user-service.%d{yyyy-MM-dd}.json.log + 7 + + + {"service":"user-service"} + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/settings.gradle.kts b/settings.gradle.kts index af516f3..fbb33cf 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -28,3 +28,9 @@ include(":adapters:runtime-adapter") // ── Evaluation & Testing ───────────────────────────────────────────────────── include(":agent-eval") include(":skill-tests") + +// ── User Service (Account/Auth/SSO) ─────────────────────────────────────────── +include(":services:user-service") + +// ── API Gateway ─────────────────────────────────────────────────────────────── +include(":services:gateway") diff --git a/web-ide/backend/src/main/kotlin/com/forge/webide/config/SecurityConfig.kt b/web-ide/backend/src/main/kotlin/com/forge/webide/config/SecurityConfig.kt index 456fc04..4ea4ba1 100644 --- a/web-ide/backend/src/main/kotlin/com/forge/webide/config/SecurityConfig.kt +++ b/web-ide/backend/src/main/kotlin/com/forge/webide/config/SecurityConfig.kt @@ -1,13 +1,21 @@ package com.forge.webide.config +import com.fasterxml.jackson.databind.ObjectMapper +import jakarta.servlet.FilterChain +import jakarta.servlet.http.HttpServletRequest +import jakarta.servlet.http.HttpServletResponse import org.springframework.beans.factory.annotation.Value import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.http.HttpMethod +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity import org.springframework.security.config.http.SessionCreationPolicy +import org.springframework.security.core.authority.SimpleGrantedAuthority +import org.springframework.security.core.context.SecurityContextHolder import org.springframework.security.web.SecurityFilterChain +import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter import org.springframework.web.cors.CorsConfiguration import org.springframework.web.cors.CorsConfigurationSource import org.springframework.web.cors.UrlBasedCorsConfigurationSource @@ -18,6 +26,10 @@ import org.springframework.web.cors.UrlBasedCorsConfigurationSource * In development mode, security is relaxed to allow unauthenticated access. * In production, JWT-based authentication is enforced via the OAuth2 * resource server configuration. + * + * When running behind Gateway, the Gateway validates JWT and injects + * X-User-Id and user-account headers. This filter reads those headers + * and sets up Spring Security authentication context. */ @Configuration @EnableWebSecurity @@ -26,8 +38,14 @@ class SecurityConfig { @Value("\${forge.security.enabled:false}") private var securityEnabled: Boolean = false - @Value("\${forge.cors.allowed-origins:http://localhost:3000}") - private var allowedOrigins: String = "http://localhost:3000" + @Value("\${forge.cors.allowed-origins:http://localhost:3000,http://localhost:4000}") + private var allowedOrigins: String = "http://localhost:3000,http://localhost:4000" + + companion object { + const val HEADER_USER_ID = "X-User-Id" + const val HEADER_USER_ACCOUNT = "user-account" + const val HEADER_USER_ROLES = "X-User-Roles" + } @Bean fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { @@ -38,15 +56,18 @@ class SecurityConfig { if (securityEnabled) { http + // 添加 Gateway 头信息认证过滤器 (在 JWT 验证之前) + .addFilterBefore(gatewayAuthFilter(), UsernamePasswordAuthenticationFilter::class.java) .authorizeHttpRequests { auth -> auth .requestMatchers("/actuator/health", "/actuator/info").permitAll() .requestMatchers("/ws/**").permitAll() // WebSocket upgrade - .requestMatchers("/api/auth/**").permitAll() // Auth endpoints + .requestMatchers("/api/auth/**").permitAll() // Auth endpoints (OAuth2 handled by Keycloak) .requestMatchers("/h2-console/**").permitAll() .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() .anyRequest().authenticated() } + // 当 security.enabled=true 且需要 JWT 验证时使用 OAuth2 Resource Server .oauth2ResourceServer { oauth2 -> oauth2.jwt { } } @@ -63,6 +84,16 @@ class SecurityConfig { return http.build() } + /** + * Gateway 头信息认证过滤器 + * 当请求经过 Gateway 时,Gateway 已经验证 JWT 并注入 X-User-Id 和 user-account 头 + * 此过滤器读取这些头并设置 Spring Security 认证上下文 + */ + @Bean + fun gatewayAuthFilter(): GatewayAuthenticationFilter { + return GatewayAuthenticationFilter() + } + @Bean fun corsConfigurationSource(): CorsConfigurationSource { val config = CorsConfiguration() @@ -77,3 +108,53 @@ class SecurityConfig { return source } } + +/** + * Gateway 头信息认证过滤器 + * 读取 Gateway 注入的 X-User-Id, user-account, X-User-Roles 头并设置认证 + */ +class GatewayAuthenticationFilter : jakarta.servlet.Filter { + + private val objectMapper = ObjectMapper() + + override fun doFilter(request: jakarta.servlet.ServletRequest, response: jakarta.servlet.ServletResponse, chain: jakarta.servlet.FilterChain) { + val httpRequest = request as HttpServletRequest + + val xUserId = httpRequest.getHeader(SecurityConfig.HEADER_USER_ID) + val userAccount = httpRequest.getHeader(SecurityConfig.HEADER_USER_ACCOUNT) + val xUserRoles = httpRequest.getHeader(SecurityConfig.HEADER_USER_ROLES) + + // 如果有 Gateway 注入的用户信息,设置认证 + if (!userAccount.isNullOrBlank()) { + try { + val userNode = objectMapper.readTree(userAccount) + val userId = userNode.get("userId")?.asText() ?: xUserId + val rolesNode = userNode.get("roles") + val roles = if (rolesNode != null && rolesNode.isArray) { + rolesNode.map { SimpleGrantedAuthority("ROLE_${it.asText().uppercase()}") } + } else { + parseRoles(xUserRoles) + } + + val authentication = UsernamePasswordAuthenticationToken(userId, null, roles) + SecurityContextHolder.getContext().authentication = authentication + } catch (e: Exception) { + // 解析失败,静默忽略,让后续 JWT 验证处理 + } + } else if (!xUserId.isNullOrBlank()) { + // 只有 X-User-Id,使用默认角色 + val roles = parseRoles(xUserRoles) + val authentication = UsernamePasswordAuthenticationToken(xUserId, null, roles) + SecurityContextHolder.getContext().authentication = authentication + } + + chain.doFilter(request, response) + } + + private fun parseRoles(rolesHeader: String?): List { + return rolesHeader?.split(",") + ?.filter { it.isNotBlank() } + ?.map { SimpleGrantedAuthority("ROLE_${it.trim().uppercase()}") } + ?: listOf(SimpleGrantedAuthority("ROLE_USER")) + } +} diff --git a/web-ide/frontend/package-lock.json b/web-ide/frontend/package-lock.json index d998a2c..f0ab24f 100644 --- a/web-ide/frontend/package-lock.json +++ b/web-ide/frontend/package-lock.json @@ -32,7 +32,7 @@ "eslint-config-next": "^15.1.0", "jest": "^29.7.0", "postcss": "^8.4.0", - "typescript": "^5.7.0" + "typescript": "5.9.3" } }, "node_modules/@alloc/quick-lru": { @@ -10130,7 +10130,7 @@ }, "node_modules/typescript": { "version": "5.9.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "resolved": "https://registry.npmmirror.com/typescript/-/typescript-5.9.3.tgz", "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", "dev": true, "license": "Apache-2.0", diff --git a/web-ide/frontend/package.json b/web-ide/frontend/package.json index 3f13f6c..763ea02 100644 --- a/web-ide/frontend/package.json +++ b/web-ide/frontend/package.json @@ -11,30 +11,30 @@ "test:e2e": "playwright test" }, "dependencies": { - "next": "^15.1.0", - "react": "^19.0.0", - "react-dom": "^19.0.0", "@monaco-editor/react": "^4.6.0", - "zustand": "^5.0.0", "@tanstack/react-query": "^5.62.0", "@xyflow/react": "^12.3.0", - "mermaid": "^11.4.0", - "tailwindcss": "^3.4.0", "class-variance-authority": "^0.7.0", "clsx": "^2.1.0", "lucide-react": "^0.460.0", - "tailwind-merge": "^2.6.0" + "mermaid": "^11.4.0", + "next": "^15.1.0", + "react": "^19.0.0", + "react-dom": "^19.0.0", + "tailwind-merge": "^2.6.0", + "tailwindcss": "^3.4.0", + "zustand": "^5.0.0" }, "devDependencies": { + "@jest/types": "^29.6.0", + "@playwright/test": "^1.49.0", "@types/node": "^22.0.0", "@types/react": "^19.0.0", - "typescript": "^5.7.0", + "autoprefixer": "^10.4.0", "eslint": "^9.0.0", "eslint-config-next": "^15.1.0", "jest": "^29.7.0", - "@jest/types": "^29.6.0", - "@playwright/test": "^1.49.0", "postcss": "^8.4.0", - "autoprefixer": "^10.4.0" + "typescript": "5.9.3" } } diff --git a/web-ide/frontend/src/app/auth/callback/page.tsx b/web-ide/frontend/src/app/auth/callback/page.tsx index 006d721..1453438 100644 --- a/web-ide/frontend/src/app/auth/callback/page.tsx +++ b/web-ide/frontend/src/app/auth/callback/page.tsx @@ -1,34 +1,61 @@ "use client"; import React, { useEffect, useState } from "react"; -import { handleCallback, getRedirectAfterLogin } from "@/lib/auth"; +import { + handleKeycloakCallback, + handleGithubCallback, + getRedirectAfterLogin, +} from "@/lib/sso-client"; export default function AuthCallbackPage() { const [error, setError] = useState(null); + const [status, setStatus] = useState("Processing authentication..."); useEffect(() => { - const params = new URLSearchParams(window.location.search); - const code = params.get("code"); - const errorParam = params.get("error"); + async function processCallback() { + const params = new URLSearchParams(window.location.search); + const code = params.get("code"); + const state = params.get("state"); + const errorParam = params.get("error"); - if (errorParam) { - setError(`Authentication error: ${errorParam}`); - return; - } + if (errorParam) { + setError(`Authentication error: ${errorParam}`); + return; + } - if (!code) { - setError("No authorization code received"); - return; - } + if (!code) { + setError("No authorization code received"); + return; + } - handleCallback(code).then((success) => { - if (success) { - const redirectTo = getRedirectAfterLogin(); - window.location.href = redirectTo; + // Check if this is a GitHub callback + const url = window.location.href; + if (url.includes("/auth/callback/github")) { + // GitHub OAuth callback + setStatus("Completing GitHub sign in..."); + if (!state) { + setError("No state parameter received"); + return; + } + const result = await handleGithubCallback(code, state); + if (result.success) { + window.location.href = getRedirectAfterLogin(); + } else { + setError(result.error || "GitHub authentication failed"); + } } else { - setError("Failed to exchange authorization code"); + // Keycloak OAuth callback + setStatus("Completing SSO sign in..."); + const result = await handleKeycloakCallback(code); + if (result.success) { + window.location.href = getRedirectAfterLogin(); + } else { + setError(result.error || "SSO authentication failed"); + } } - }); + } + + processCallback(); }, []); if (error) { @@ -51,7 +78,7 @@ export default function AuthCallbackPage() {
-

Completing sign in...

+

{status}

); diff --git a/web-ide/frontend/tsconfig.json b/web-ide/frontend/tsconfig.json index c133409..5d606a9 100644 --- a/web-ide/frontend/tsconfig.json +++ b/web-ide/frontend/tsconfig.json @@ -1,7 +1,11 @@ { "compilerOptions": { "target": "ES2017", - "lib": ["dom", "dom.iterable", "esnext"], + "lib": [ + "dom", + "dom.iterable", + "esnext" + ], "allowJs": true, "skipLibCheck": true, "strict": true, @@ -19,9 +23,19 @@ } ], "paths": { - "@/*": ["./src/*"] + "@/*": [ + "./src/*" + ] } }, - "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"], - "exclude": ["node_modules"] + "include": [ + "next-env.d.ts", + "**/*.ts", + "**/*.tsx", + ".next/types/**/*.ts", + ".next/dev/types/**/*.ts" + ], + "exclude": [ + "node_modules" + ] }