34 lines
1.1 KiB
Go
34 lines
1.1 KiB
Go
|
package httpapi
|
||
|
|
|
||
|
|
import (
|
||
|
|
"errors"
|
||
|
|
"net/http"
|
||
|
|
|
||
|
|
"data-terminal-cloud/internal/deviceauth"
|
||
|
|
)
|
||
|
|
|
||
|
|
type DeviceRequestVerifier interface {
|
||
|
|
Verify(*http.Request) (deviceauth.Identity, error)
|
||
|
|
}
|
||
|
|
|
||
|
|
func DeviceAuth(verifier DeviceRequestVerifier, next http.Handler) http.Handler {
|
||
|
|
return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
|
||
|
|
identity, err := verifier.Verify(request)
|
||
|
|
if err != nil {
|
||
|
|
if errors.Is(err, deviceauth.ErrCredentialsMissing) ||
|
||
|
|
errors.Is(err, deviceauth.ErrCredentialInvalid) ||
|
||
|
|
errors.Is(err, deviceauth.ErrDeviceInactive) ||
|
||
|
|
errors.Is(err, deviceauth.ErrRequestExpired) ||
|
||
|
|
errors.Is(err, deviceauth.ErrReplayDetected) {
|
||
|
|
WriteError(writer, request, http.StatusUnauthorized, "DEVICE_AUTHENTICATION_FAILED", "设备身份验证失败")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
WriteAPIError(writer, request, http.StatusServiceUnavailable, Error{
|
||
|
|
Code: "DEVICE_AUTHENTICATION_UNAVAILABLE", Message: "设备身份服务暂时不可用", Retryable: true,
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
next.ServeHTTP(writer, request.WithContext(deviceauth.WithIdentity(request.Context(), identity)))
|
||
|
|
})
|
||
|
|
}
|