|
|
import type { Permission, ServiceTokenEntry } from "@/lib/constants/auth";
|
|
|
import { forbidden, unauthorized } from "@/modules/auth/errors";
|
|
|
|
|
|
export type VerifiedServiceToken = {
|
|
|
customerId: string;
|
|
|
permissions: Permission[];
|
|
|
};
|
|
|
|
|
|
let cachedEnvTokenMap: Map<string, ServiceTokenEntry> | null = null;
|
|
|
|
|
|
function loadEnvTokenMap(): Map<string, ServiceTokenEntry> {
|
|
|
if (cachedEnvTokenMap) {
|
|
|
return cachedEnvTokenMap;
|
|
|
}
|
|
|
|
|
|
const raw = process.env.HOST_SERVICE_TOKENS;
|
|
|
if (!raw) {
|
|
|
cachedEnvTokenMap = new Map();
|
|
|
return cachedEnvTokenMap;
|
|
|
}
|
|
|
|
|
|
let parsed: Record<string, ServiceTokenEntry>;
|
|
|
try {
|
|
|
parsed = JSON.parse(raw) as Record<string, ServiceTokenEntry>;
|
|
|
} catch {
|
|
|
throw new Error("HOST_SERVICE_TOKENS 配置无效");
|
|
|
}
|
|
|
|
|
|
cachedEnvTokenMap = new Map(Object.entries(parsed));
|
|
|
return cachedEnvTokenMap;
|
|
|
}
|
|
|
|
|
|
/** 测试专用：重置 env 缓存 */
|
|
|
export function resetServiceTokenEnvCache(): void {
|
|
|
cachedEnvTokenMap = null;
|
|
|
}
|
|
|
|
|
|
function verifyFromEnvMap(
|
|
|
token: string,
|
|
|
customerId?: string,
|
|
|
): VerifiedServiceToken | null {
|
|
|
const entry = loadEnvTokenMap().get(token);
|
|
|
if (!entry) {
|
|
|
return null;
|
|
|
}
|
|
|
if (customerId && entry.customerId !== customerId) {
|
|
|
throw forbidden("customer_id 与令牌租户不匹配");
|
|
|
}
|
|
|
return {
|
|
|
customerId: entry.customerId,
|
|
|
permissions: entry.permissions ?? [],
|
|
|
};
|
|
|
}
|
|
|
|
|
|
/** env 命中则返回，未命中返回 null（不抛错） */
|
|
|
export function resolveEnvServiceToken(
|
|
|
token: string,
|
|
|
customerId?: string,
|
|
|
): VerifiedServiceToken | null {
|
|
|
return verifyFromEnvMap(token, customerId);
|
|
|
}
|
|
|
|
|
|
/** env 中的客户 ID（同步） */
|
|
|
export function listEnvCustomerIds(): string[] {
|
|
|
const ids = new Set<string>();
|
|
|
for (const entry of loadEnvTokenMap().values()) {
|
|
|
ids.add(entry.customerId);
|
|
|
}
|
|
|
const registry = process.env.CUSTOMER_REGISTRY;
|
|
|
if (registry) {
|
|
|
for (const part of registry.split(",")) {
|
|
|
const id = part.trim();
|
|
|
if (id) {
|
|
|
ids.add(id);
|
|
|
}
|
|
|
}
|
|
|
}
|
|
|
return [...ids].sort();
|
|
|
}
|
|
|
|
|
|
/** 同步：仅 env + CUSTOMER_REGISTRY */
|
|
|
export function listRegisteredCustomerIds(): string[] {
|
|
|
return listEnvCustomerIds();
|
|
|
}
|
|
|
|
|
|
export function isKnownCustomer(customerId: string): boolean {
|
|
|
return listEnvCustomerIds().includes(customerId);
|
|
|
}
|
|
|
|
|
|
/** 同步：仅校验 env 中配置的 Token（middleware 快路径） */
|
|
|
export function verifyServiceTokenFromEnv(
|
|
|
token: string,
|
|
|
customerId: string,
|
|
|
): VerifiedServiceToken {
|
|
|
const verified = verifyFromEnvMap(token, customerId);
|
|
|
if (!verified) {
|
|
|
throw unauthorized("Service Token 无效");
|
|
|
}
|
|
|
return verified;
|
|
|
}
|
|
|
|
|
|
/** 同步：env token 解析（无 customer_id 头时） */
|
|
|
export function parseServiceTokenFromEnv(
|
|
|
token: string,
|
|
|
): VerifiedServiceToken | null {
|
|
|
return verifyFromEnvMap(token);
|
|
|
}
|
|
|
|
|
|
/** @deprecated 使用 verifyServiceTokenFromEnv */
|
|
|
export function verifyServiceToken(
|
|
|
token: string,
|
|
|
customerId: string,
|
|
|
): VerifiedServiceToken {
|
|
|
return verifyServiceTokenFromEnv(token, customerId);
|
|
|
}
|
|
|
|
|
|
/** @deprecated 使用 parseServiceTokenFromEnv */
|
|
|
export function parseServiceToken(token: string): VerifiedServiceToken | null {
|
|
|
return parseServiceTokenFromEnv(token);
|
|
|
}
|
