|
| 1 | +-- |
| 2 | +-- TencentBlueKing is pleased to support the open source community by making |
| 3 | +-- 蓝鲸智云 - API 网关(BlueKing - APIGateway) available. |
| 4 | +-- Copyright (C) 2017 THL A29 Limited, a Tencent company. All rights reserved. |
| 5 | +-- Licensed under the MIT License (the "License"); you may not use this file except |
| 6 | +-- in compliance with the License. You may obtain a copy of the License at |
| 7 | +-- |
| 8 | +-- http://opensource.org/licenses/MIT |
| 9 | +-- |
| 10 | +-- Unless required by applicable law or agreed to in writing, software distributed under |
| 11 | +-- the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, |
| 12 | +-- either express or implied. See the License for the specific language governing permissions and |
| 13 | +-- limitations under the License. |
| 14 | +-- |
| 15 | +-- We undertake not to change the open source license (MIT license) applicable |
| 16 | +-- to the current version of the project delivered to anyone in the future. |
| 17 | +-- |
| 18 | + |
| 19 | + |
| 20 | +-- verified the inner jwt token signed by bk-apigateway |
| 21 | +-- X-Bkapi-Authorization: {"inner_jwt": ""} |
| 22 | +-- currently it only be used in the mcp-proxy, which will proxy the request from agent to the real apigateway api |
| 23 | +-- so, after the bk-apigateway verified the app and user, it generate the inner_jwt and call the real apigateway api |
| 24 | +-- the app_code in inner_jwt is not the real app_code, but a virtual app_code(like v_mcp_{mcp_service_id}_{app_code}) |
| 25 | +-- so the permission can be controlled by the virtual app_code, |
| 26 | +-- which not exists in the real PaaS, so no security concern. |
| 27 | +-- NOTE: the design of verifier is not so good, so here we parse_bk_jwt_token twice |
| 28 | +-- only refactor it if the performance is a problem |
| 29 | + |
| 30 | +local bk_app_define = require("apisix.plugins.bk-define.app") |
| 31 | +local bk_user_define = require("apisix.plugins.bk-define.user") |
| 32 | +local jwt_utils = require("apisix.plugins.bk-auth-verify.jwt-utils") |
| 33 | +local string_format = string.format |
| 34 | +local setmetatable = setmetatable |
| 35 | + |
| 36 | +local _M = { |
| 37 | + name = "inner-jwt", |
| 38 | +} |
| 39 | + |
| 40 | +local mt = { |
| 41 | + __index = _M, |
| 42 | +} |
| 43 | + |
| 44 | +function _M.new(inner_jwt_token) |
| 45 | + return setmetatable( |
| 46 | + { |
| 47 | + jwt_token = inner_jwt_token, |
| 48 | + }, mt |
| 49 | + ) |
| 50 | +end |
| 51 | + |
| 52 | +function _M.verify_app(self) |
| 53 | + local jwt_obj, err = jwt_utils.parse_bk_jwt_token(self.jwt_token) |
| 54 | + if jwt_obj == nil then |
| 55 | + return nil, string_format("parameter jwt is invalid: %s", err) |
| 56 | + end |
| 57 | + |
| 58 | + if jwt_obj.header.kid ~= "bk-apigateway" then |
| 59 | + return nil, "invalid kid, only bk-apigateway is supported" |
| 60 | + end |
| 61 | + |
| 62 | + local app_info = jwt_obj.payload.app |
| 63 | + if app_info == nil then |
| 64 | + return nil, "parameter jwt does not indicate app information" |
| 65 | + end |
| 66 | + if app_info.verified ~= true then |
| 67 | + return nil, "the app indicated by jwt is not verified" |
| 68 | + end |
| 69 | + |
| 70 | + return bk_app_define.new_app( |
| 71 | + { |
| 72 | + app_code = app_info.app_code, |
| 73 | + exists = true, |
| 74 | + verified = true, |
| 75 | + } |
| 76 | + ) |
| 77 | +end |
| 78 | + |
| 79 | +function _M.verify_user(self) |
| 80 | + local jwt_obj, err = jwt_utils.parse_bk_jwt_token(self.jwt_token) |
| 81 | + if jwt_obj == nil then |
| 82 | + return nil, string_format("parameter jwt is invalid: %s", err) |
| 83 | + end |
| 84 | + |
| 85 | + if jwt_obj.header.kid ~= "bk-apigateway" then |
| 86 | + return nil, "invalid kid, only bk-apigateway is supported" |
| 87 | + end |
| 88 | + |
| 89 | + local user_info = jwt_obj.payload.user |
| 90 | + if user_info == nil then |
| 91 | + return bk_user_define.new_anonymous_user( |
| 92 | + "auth parameter does not indicate user information, verified by inner-jwt-verifier" |
| 93 | + ) |
| 94 | + end |
| 95 | + |
| 96 | + if user_info.verified ~= true then |
| 97 | + return bk_user_define.new_anonymous_user( |
| 98 | + "the user indicated by auth parameter is not verified, verified by inner-jwt-verifier" |
| 99 | + ) |
| 100 | + end |
| 101 | + |
| 102 | + return bk_user_define.new_user( |
| 103 | + { |
| 104 | + username = user_info.username, |
| 105 | + verified = true, |
| 106 | + source_type = "inner_jwt", |
| 107 | + } |
| 108 | + ) |
| 109 | +end |
| 110 | + |
| 111 | +return _M |
0 commit comments