gengx
This commit is contained in:
Your Name
@@ -0,0 +1,577 @@
|
||||
package app
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const maskedSecret = "••••••••"
|
||||
|
||||
type integrationFieldSpec struct {
|
||||
Key string
|
||||
Label string
|
||||
Input string
|
||||
Required bool
|
||||
Options []string
|
||||
Providers []string
|
||||
Description string
|
||||
}
|
||||
|
||||
type integrationFieldView struct {
|
||||
Key string `json:"key"`
|
||||
Label string `json:"label"`
|
||||
Value string `json:"value"`
|
||||
Input string `json:"input"`
|
||||
Secret bool `json:"secret"`
|
||||
HasValue bool `json:"hasValue"`
|
||||
Required bool `json:"required"`
|
||||
Options []string `json:"options,omitempty"`
|
||||
Providers []string `json:"providers,omitempty"`
|
||||
Description string `json:"description"`
|
||||
}
|
||||
|
||||
var integrationSpecs = map[string][]integrationFieldSpec{
|
||||
"oauth": {
|
||||
{Key: "oauth.admin.frontend_callback_url", Label: "管理端登录结果页", Input: "text", Required: true, Description: "第三方授权完成后返回的管理端页面；生产环境必须使用 HTTPS"},
|
||||
{Key: "oauth.user.frontend_callback_url", Label: "客户端 H5 登录结果页", Input: "text", Required: true, Description: "第三方授权完成后返回的 uni-app H5 页面；生产环境必须使用 HTTPS"},
|
||||
|
||||
{Key: "oauth.wechat.enabled", Label: "管理端启用微信登录", Input: "boolean", Required: true, Providers: []string{"wechat"}, Description: "开启后且必填参数完整时，管理端登录页显示微信入口"},
|
||||
{Key: "oauth.user.wechat.enabled", Label: "客户端启用微信登录", Input: "boolean", Required: true, Providers: []string{"wechat"}, Description: "开启后且必填参数完整时，uni-app H5 登录页显示微信入口"},
|
||||
{Key: "oauth.wechat.client_id", Label: "微信 AppID", Input: "text", Providers: []string{"wechat"}, Description: "微信开放平台网站应用 AppID"},
|
||||
{Key: "oauth.wechat.client_secret", Label: "微信 AppSecret", Input: "secret", Providers: []string{"wechat"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "oauth.wechat.authorization_url", Label: "微信授权地址", Input: "text", Providers: []string{"wechat"}, Description: "默认使用微信开放平台 qrconnect 地址"},
|
||||
{Key: "oauth.wechat.token_url", Label: "微信令牌地址", Input: "text", Providers: []string{"wechat"}, Description: "授权码换取 access_token 的地址"},
|
||||
{Key: "oauth.wechat.userinfo_url", Label: "微信用户信息地址", Input: "text", Providers: []string{"wechat"}, Description: "获取登录用户 OpenID 与资料的地址"},
|
||||
{Key: "oauth.wechat.scope", Label: "微信授权范围", Input: "text", Providers: []string{"wechat"}, Description: "网站扫码登录通常为 snsapi_login"},
|
||||
{Key: "oauth.wechat.redirect_uri", Label: "微信回调地址", Input: "text", Providers: []string{"wechat"}, Description: "必须与微信开放平台登记值完全一致"},
|
||||
|
||||
{Key: "oauth.qq.enabled", Label: "管理端启用 QQ 登录", Input: "boolean", Required: true, Providers: []string{"qq"}, Description: "开启后且必填参数完整时，管理端登录页显示 QQ 入口"},
|
||||
{Key: "oauth.user.qq.enabled", Label: "客户端启用 QQ 登录", Input: "boolean", Required: true, Providers: []string{"qq"}, Description: "开启后且必填参数完整时，uni-app H5 登录页显示 QQ 入口"},
|
||||
{Key: "oauth.qq.client_id", Label: "QQ AppID", Input: "text", Providers: []string{"qq"}, Description: "QQ 互联应用 AppID"},
|
||||
{Key: "oauth.qq.client_secret", Label: "QQ AppKey", Input: "secret", Providers: []string{"qq"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "oauth.qq.authorization_url", Label: "QQ 授权地址", Input: "text", Providers: []string{"qq"}, Description: "QQ OAuth 2.0 authorize 地址"},
|
||||
{Key: "oauth.qq.token_url", Label: "QQ 令牌地址", Input: "text", Providers: []string{"qq"}, Description: "授权码换取 access_token 的地址"},
|
||||
{Key: "oauth.qq.openid_url", Label: "QQ OpenID 地址", Input: "text", Providers: []string{"qq"}, Description: "使用 access_token 获取 QQ OpenID"},
|
||||
{Key: "oauth.qq.userinfo_url", Label: "QQ 用户信息地址", Input: "text", Providers: []string{"qq"}, Description: "获取昵称和头像"},
|
||||
{Key: "oauth.qq.scope", Label: "QQ 授权范围", Input: "text", Providers: []string{"qq"}, Description: "默认 get_user_info"},
|
||||
{Key: "oauth.qq.redirect_uri", Label: "QQ 回调地址", Input: "text", Providers: []string{"qq"}, Description: "必须与 QQ 互联登记值完全一致"},
|
||||
|
||||
{Key: "oauth.github.enabled", Label: "管理端启用 GitHub 登录", Input: "boolean", Required: true, Providers: []string{"github"}, Description: "开启后且必填参数完整时，管理端登录页显示 GitHub 入口"},
|
||||
{Key: "oauth.user.github.enabled", Label: "客户端启用 GitHub 登录", Input: "boolean", Required: true, Providers: []string{"github"}, Description: "开启后且必填参数完整时，uni-app H5 登录页显示 GitHub 入口"},
|
||||
{Key: "oauth.github.client_id", Label: "GitHub Client ID", Input: "text", Providers: []string{"github"}, Description: "GitHub OAuth App Client ID"},
|
||||
{Key: "oauth.github.client_secret", Label: "GitHub Client Secret", Input: "secret", Providers: []string{"github"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "oauth.github.authorization_url", Label: "GitHub 授权地址", Input: "text", Providers: []string{"github"}, Description: "GitHub OAuth authorize 地址"},
|
||||
{Key: "oauth.github.token_url", Label: "GitHub 令牌地址", Input: "text", Providers: []string{"github"}, Description: "授权码换取 access_token 的地址"},
|
||||
{Key: "oauth.github.userinfo_url", Label: "GitHub 用户信息地址", Input: "text", Providers: []string{"github"}, Description: "默认使用 /user 接口"},
|
||||
{Key: "oauth.github.scope", Label: "GitHub 授权范围", Input: "text", Providers: []string{"github"}, Description: "建议仅 read:user user:email"},
|
||||
{Key: "oauth.github.redirect_uri", Label: "GitHub 回调地址", Input: "text", Providers: []string{"github"}, Description: "必须与 OAuth App 的 callback URL 完全一致"},
|
||||
|
||||
{Key: "oauth.google.enabled", Label: "管理端启用 Google 登录", Input: "boolean", Required: true, Providers: []string{"google"}, Description: "开启后且必填参数完整时，管理端登录页显示 Google 入口"},
|
||||
{Key: "oauth.user.google.enabled", Label: "客户端启用 Google 登录", Input: "boolean", Required: true, Providers: []string{"google"}, Description: "开启后且必填参数完整时，uni-app H5 登录页显示 Google 入口"},
|
||||
{Key: "oauth.google.client_id", Label: "Google Client ID", Input: "text", Providers: []string{"google"}, Description: "Google OAuth 2.0 Client ID"},
|
||||
{Key: "oauth.google.client_secret", Label: "Google Client Secret", Input: "secret", Providers: []string{"google"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "oauth.google.authorization_url", Label: "Google 授权地址", Input: "text", Providers: []string{"google"}, Description: "Google OAuth authorization endpoint"},
|
||||
{Key: "oauth.google.token_url", Label: "Google 令牌地址", Input: "text", Providers: []string{"google"}, Description: "Google OAuth token endpoint"},
|
||||
{Key: "oauth.google.userinfo_url", Label: "Google UserInfo 地址", Input: "text", Providers: []string{"google"}, Description: "OpenID Connect UserInfo endpoint"},
|
||||
{Key: "oauth.google.scope", Label: "Google 授权范围", Input: "text", Providers: []string{"google"}, Description: "至少包含 openid profile email"},
|
||||
{Key: "oauth.google.redirect_uri", Label: "Google 回调地址", Input: "text", Providers: []string{"google"}, Description: "必须与 Google Cloud Console 登记值完全一致"},
|
||||
},
|
||||
"storage": {
|
||||
{Key: "storage.provider", Label: "当前存储厂商", Input: "select", Required: true, Options: []string{"local", "aliyun_oss", "tencent_cos", "qiniu", "huawei_obs", "huawei_flexus"}, Description: "保存后所有新上传文件立即切换到所选存储；历史文件地址不受影响"},
|
||||
{Key: "storage.object_prefix", Label: "云端对象前缀", Input: "text", Required: true, Description: "仅允许字母、数字、斜杠、下划线和短横线，例如 media"},
|
||||
|
||||
{Key: "storage.local.directory", Label: "本地存储目录", Input: "text", Required: true, Providers: []string{"local"}, Description: "相对路径基于后端运行目录；禁止配置为磁盘根目录"},
|
||||
{Key: "storage.local.public_base_url", Label: "本地公开访问地址", Input: "text", Providers: []string{"local"}, Description: "可选，例如 https://api.example.com/uploads；留空时根据当前请求生成"},
|
||||
|
||||
{Key: "storage.aliyun_oss.endpoint", Label: "阿里云 OSS Endpoint", Input: "text", Required: true, Providers: []string{"aliyun_oss"}, Description: "例如 https://oss-cn-hangzhou.aliyuncs.com"},
|
||||
{Key: "storage.aliyun_oss.region", Label: "阿里云 OSS Region", Input: "text", Required: true, Providers: []string{"aliyun_oss"}, Description: "例如 cn-hangzhou"},
|
||||
{Key: "storage.aliyun_oss.bucket", Label: "阿里云 OSS Bucket", Input: "text", Required: true, Providers: []string{"aliyun_oss"}, Description: "需要 oss:PutObject 权限"},
|
||||
{Key: "storage.aliyun_oss.access_key_id", Label: "阿里云 AccessKey ID", Input: "secret", Required: true, Providers: []string{"aliyun_oss"}, Description: "建议使用最小权限 RAM 用户，AES-GCM 加密保存"},
|
||||
{Key: "storage.aliyun_oss.access_key_secret", Label: "阿里云 AccessKey Secret", Input: "secret", Required: true, Providers: []string{"aliyun_oss"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "storage.aliyun_oss.public_base_url", Label: "阿里云文件访问域名", Input: "text", Required: true, Providers: []string{"aliyun_oss"}, Description: "Bucket 公网域名或已配置的 CDN/自定义域名，必须使用 HTTPS"},
|
||||
|
||||
{Key: "storage.tencent_cos.endpoint", Label: "腾讯云 COS Bucket URL", Input: "text", Required: true, Providers: []string{"tencent_cos"}, Description: "例如 https://bucket-appid.cos.ap-guangzhou.myqcloud.com"},
|
||||
{Key: "storage.tencent_cos.bucket", Label: "腾讯云 COS Bucket", Input: "text", Required: true, Providers: []string{"tencent_cos"}, Description: "完整名称需包含 APPID，需要 cos:PutObject 权限"},
|
||||
{Key: "storage.tencent_cos.secret_id", Label: "腾讯云 SecretId", Input: "secret", Required: true, Providers: []string{"tencent_cos"}, Description: "建议使用最小权限 CAM 子账号密钥，AES-GCM 加密保存"},
|
||||
{Key: "storage.tencent_cos.secret_key", Label: "腾讯云 SecretKey", Input: "secret", Required: true, Providers: []string{"tencent_cos"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "storage.tencent_cos.public_base_url", Label: "腾讯云文件访问域名", Input: "text", Required: true, Providers: []string{"tencent_cos"}, Description: "Bucket 公网域名或 CDN 域名，必须使用 HTTPS"},
|
||||
|
||||
{Key: "storage.qiniu.bucket", Label: "七牛云空间名称", Input: "text", Required: true, Providers: []string{"qiniu"}, Description: "Kodo Bucket 名称，SDK 自动发现上传区域"},
|
||||
{Key: "storage.qiniu.access_key", Label: "七牛云 AccessKey", Input: "secret", Required: true, Providers: []string{"qiniu"}, Description: "建议使用仅具备目标空间上传权限的密钥，AES-GCM 加密保存"},
|
||||
{Key: "storage.qiniu.secret_key", Label: "七牛云 SecretKey", Input: "secret", Required: true, Providers: []string{"qiniu"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "storage.qiniu.public_base_url", Label: "七牛云文件访问域名", Input: "text", Required: true, Providers: []string{"qiniu"}, Description: "空间绑定域名或 CDN 域名，必须使用 HTTPS"},
|
||||
|
||||
{Key: "storage.huawei_obs.endpoint", Label: "华为云 OBS Endpoint", Input: "text", Required: true, Providers: []string{"huawei_obs"}, Description: "例如 https://obs.cn-north-4.myhuaweicloud.com"},
|
||||
{Key: "storage.huawei_obs.bucket", Label: "华为云 OBS Bucket", Input: "text", Required: true, Providers: []string{"huawei_obs"}, Description: "需要 obs:object:PutObject 权限"},
|
||||
{Key: "storage.huawei_obs.access_key", Label: "华为云 OBS Access Key", Input: "secret", Required: true, Providers: []string{"huawei_obs"}, Description: "IAM 用户 AK，AES-GCM 加密保存"},
|
||||
{Key: "storage.huawei_obs.secret_key", Label: "华为云 OBS Secret Key", Input: "secret", Required: true, Providers: []string{"huawei_obs"}, Description: "IAM 用户 SK，AES-GCM 加密保存"},
|
||||
{Key: "storage.huawei_obs.public_base_url", Label: "华为云 OBS 文件访问域名", Input: "text", Required: true, Providers: []string{"huawei_obs"}, Description: "Bucket 公网域名或 CDN 域名，必须使用 HTTPS"},
|
||||
|
||||
{Key: "storage.huawei_flexus.endpoint", Label: "Flexus 对象存储 Endpoint", Input: "text", Required: true, Providers: []string{"huawei_flexus"}, Description: "Flexus 对象存储控制台提供的 OBS 兼容 Endpoint"},
|
||||
{Key: "storage.huawei_flexus.bucket", Label: "Flexus Bucket", Input: "text", Required: true, Providers: []string{"huawei_flexus"}, Description: "Flexus 对象存储桶名称"},
|
||||
{Key: "storage.huawei_flexus.access_key", Label: "Flexus Access Key", Input: "secret", Required: true, Providers: []string{"huawei_flexus"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "storage.huawei_flexus.secret_key", Label: "Flexus Secret Key", Input: "secret", Required: true, Providers: []string{"huawei_flexus"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "storage.huawei_flexus.public_base_url", Label: "Flexus 文件访问域名", Input: "text", Required: true, Providers: []string{"huawei_flexus"}, Description: "Bucket 公网域名或 CDN 域名，必须使用 HTTPS"},
|
||||
},
|
||||
"sms": {
|
||||
{Key: "sms.enabled", Label: "启用短信服务", Input: "boolean", Required: true, Description: "关闭后将拒绝发送验证码"},
|
||||
{Key: "sms.provider", Label: "当前短信厂商", Input: "select", Required: true, Options: []string{"aliyun", "tencent", "huawei", "webhook", "debug"}, Description: "保存后新验证码立即切换到所选厂商；debug 仅限本地开发"},
|
||||
{Key: "sms.expire_seconds", Label: "有效期（秒）", Input: "number", Required: true, Description: "建议 120 至 600 秒"},
|
||||
{Key: "sms.debug_code", Label: "调试验证码", Input: "secret", Required: true, Providers: []string{"debug"}, Description: "仅 debug 模式返回给客户端"},
|
||||
|
||||
{Key: "sms.aliyun.endpoint", Label: "阿里云 API 地址", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "国内短信默认 https://dysmsapi.aliyuncs.com"},
|
||||
{Key: "sms.aliyun.access_key_id", Label: "阿里云 AccessKey ID", Input: "secret", Required: true, Providers: []string{"aliyun"}, Description: "建议使用仅授予短信发送权限的 RAM 用户"},
|
||||
{Key: "sms.aliyun.access_key_secret", Label: "阿里云 AccessKey Secret", Input: "secret", Required: true, Providers: []string{"aliyun"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "sms.aliyun.sign_name", Label: "阿里云短信签名", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "必须是审核通过的签名名称"},
|
||||
{Key: "sms.aliyun.template_register", Label: "阿里云注册模板 Code", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "注册验证码模板，例如 SMS_123456789"},
|
||||
{Key: "sms.aliyun.template_login", Label: "阿里云登录模板 Code", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "短信登录验证码模板"},
|
||||
{Key: "sms.aliyun.template_reset", Label: "阿里云重置密码模板 Code", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "找回密码验证码模板"},
|
||||
{Key: "sms.aliyun.template_params", Label: "阿里云模板变量 JSON", Input: "text", Required: true, Providers: []string{"aliyun"}, Description: "支持 {{code}} 与 {{minutes}}，例如 {\"code\":\"{{code}}\"}"},
|
||||
|
||||
{Key: "sms.tencent.endpoint", Label: "腾讯云 API 地址", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "国内短信默认 https://sms.tencentcloudapi.com"},
|
||||
{Key: "sms.tencent.secret_id", Label: "腾讯云 SecretId", Input: "secret", Required: true, Providers: []string{"tencent"}, Description: "建议使用最小权限 CAM 子账号密钥"},
|
||||
{Key: "sms.tencent.secret_key", Label: "腾讯云 SecretKey", Input: "secret", Required: true, Providers: []string{"tencent"}, Description: "AES-GCM 加密保存"},
|
||||
{Key: "sms.tencent.sdk_app_id", Label: "腾讯云短信 SdkAppId", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "短信控制台应用 ID"},
|
||||
{Key: "sms.tencent.region", Label: "腾讯云地域", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "国内短信建议 ap-guangzhou"},
|
||||
{Key: "sms.tencent.sign_name", Label: "腾讯云短信签名", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "必须是审核通过的签名内容"},
|
||||
{Key: "sms.tencent.template_register", Label: "腾讯云注册模板 ID", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "注册验证码模板 ID"},
|
||||
{Key: "sms.tencent.template_login", Label: "腾讯云登录模板 ID", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "短信登录验证码模板 ID"},
|
||||
{Key: "sms.tencent.template_reset", Label: "腾讯云重置密码模板 ID", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "找回密码验证码模板 ID"},
|
||||
{Key: "sms.tencent.template_params", Label: "腾讯云模板参数 JSON", Input: "text", Required: true, Providers: []string{"tencent"}, Description: "参数按模板变量顺序排列，例如 [\"{{code}}\"]"},
|
||||
|
||||
{Key: "sms.huawei.endpoint", Label: "华为云 APP 接入地址", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "填写控制台提供的 HTTPS 地址，包含 /sms/batchSendSms/v1"},
|
||||
{Key: "sms.huawei.app_key", Label: "华为云 Application Key", Input: "secret", Required: true, Providers: []string{"huawei"}, Description: "短信应用的 APP_Key"},
|
||||
{Key: "sms.huawei.app_secret", Label: "华为云 Application Secret", Input: "secret", Required: true, Providers: []string{"huawei"}, Description: "短信应用的 APP_Secret，AES-GCM 加密保存"},
|
||||
{Key: "sms.huawei.sender", Label: "华为云签名通道号", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "国内短信签名审核后分配的通道号"},
|
||||
{Key: "sms.huawei.signature", Label: "华为云签名名称", Input: "text", Providers: []string{"huawei"}, Description: "通用模板需要填写已审核签名；非通用模板可留空"},
|
||||
{Key: "sms.huawei.template_register", Label: "华为云注册模板 ID", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "注册验证码模板 ID"},
|
||||
{Key: "sms.huawei.template_login", Label: "华为云登录模板 ID", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "短信登录验证码模板 ID"},
|
||||
{Key: "sms.huawei.template_reset", Label: "华为云重置密码模板 ID", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "找回密码验证码模板 ID"},
|
||||
{Key: "sms.huawei.template_params", Label: "华为云模板参数 JSON", Input: "text", Required: true, Providers: []string{"huawei"}, Description: "参数按模板变量顺序排列，例如 [\"{{code}}\"]"},
|
||||
{Key: "sms.huawei.status_callback", Label: "华为云状态回调地址", Input: "text", Providers: []string{"huawei"}, Description: "可选，接收运营商最终送达状态"},
|
||||
|
||||
{Key: "sms.sign_name", Label: "Webhook 短信签名", Input: "text", Required: true, Providers: []string{"webhook"}, Description: "发送给自建网关的签名名称"},
|
||||
{Key: "sms.template_register", Label: "Webhook 注册模板 ID", Input: "text", Required: true, Providers: []string{"webhook"}, Description: "注册场景模板"},
|
||||
{Key: "sms.template_login", Label: "Webhook 登录模板 ID", Input: "text", Required: true, Providers: []string{"webhook"}, Description: "验证码登录场景模板"},
|
||||
{Key: "sms.template_reset", Label: "Webhook 找回密码模板 ID", Input: "text", Required: true, Providers: []string{"webhook"}, Description: "重置密码场景模板"},
|
||||
{Key: "sms.webhook_url", Label: "Webhook 地址", Input: "text", Required: true, Providers: []string{"webhook"}, Description: "接收 JSON POST；生产环境必须使用 HTTPS"},
|
||||
{Key: "sms.webhook_token", Label: "Webhook Token", Input: "secret", Providers: []string{"webhook"}, Description: "以 Bearer Token 发送，仅显示保存状态"},
|
||||
},
|
||||
"payment": {
|
||||
{Key: "payment.mode", Label: "支付模式", Input: "select", Required: true, Options: []string{"sandbox", "live"}, Description: "sandbox 可直接完成本地支付闭环"},
|
||||
{Key: "payment.gateway.create_url", Label: "支付网关下单地址", Input: "text", Description: "live 模式必填，生产环境必须使用 HTTPS"},
|
||||
{Key: "payment.gateway.refund_url", Label: "支付网关退款地址", Input: "text", Description: "live 模式退款必填，生产环境必须使用 HTTPS"},
|
||||
{Key: "payment.gateway.token", Label: "支付网关访问令牌", Input: "secret", Description: "live 模式必填，以 Bearer Token 调用统一支付网关"},
|
||||
{Key: "payment.gateway.notify_secret", Label: "支付回调签名密钥", Input: "secret", Description: "live 模式必填，至少 32 位随机字符串，用于 HMAC-SHA256 验签"},
|
||||
{Key: "payment.gateway.notify_url", Label: "支付异步回调地址", Input: "text", Description: "live 模式必填，例如 https://api.example.com/api/v1/payment/notify"},
|
||||
{Key: "payment.gateway.return_url", Label: "支付完成返回地址", Input: "text", Description: "H5 支付完成后返回的客户端地址"},
|
||||
{Key: "payment.gateway.timeout_seconds", Label: "网关超时（秒）", Input: "number", Description: "建议 5 至 30 秒"},
|
||||
{Key: "payment.alipay.enabled", Label: "启用支付宝", Input: "boolean", Required: true, Description: "控制客户端支付宝入口"},
|
||||
{Key: "payment.alipay.app_id", Label: "支付宝 APPID", Input: "text", Description: "开放平台应用 APPID"},
|
||||
{Key: "payment.alipay.private_key", Label: "支付宝应用私钥", Input: "secret", Description: "敏感字段加密存储"},
|
||||
{Key: "payment.alipay.public_key", Label: "支付宝公钥", Input: "secret", Description: "用于验签"},
|
||||
{Key: "payment.alipay.notify_url", Label: "支付宝通知地址", Input: "text", Description: "必须是公网 HTTPS 地址"},
|
||||
{Key: "payment.wechat.enabled", Label: "启用微信支付", Input: "boolean", Required: true, Description: "控制客户端微信支付入口"},
|
||||
{Key: "payment.wechat.app_id", Label: "微信 AppID", Input: "text", Description: "移动应用或小程序 AppID"},
|
||||
{Key: "payment.wechat.mch_id", Label: "微信商户号", Input: "text", Description: "微信支付商户号"},
|
||||
{Key: "payment.wechat.api_v3_key", Label: "APIv3 密钥", Input: "secret", Description: "敏感字段加密存储"},
|
||||
{Key: "payment.wechat.private_key", Label: "商户私钥", Input: "secret", Description: "PEM 内容，敏感字段加密存储"},
|
||||
{Key: "payment.wechat.serial_no", Label: "证书序列号", Input: "text", Description: "商户 API 证书序列号"},
|
||||
{Key: "payment.wechat.notify_url", Label: "微信通知地址", Input: "text", Description: "必须是公网 HTTPS 地址"},
|
||||
},
|
||||
}
|
||||
|
||||
func (a *App) configPlain(ctx context.Context, key, fallback string) string {
|
||||
var value, valueType string
|
||||
if err := a.db.QueryRowContext(ctx, `SELECT config_value,value_type FROM system_configs WHERE config_key=?`, key).Scan(&value, &valueType); err != nil {
|
||||
return fallback
|
||||
}
|
||||
if valueType == "secret" && value != "" {
|
||||
plain, err := a.decryptSecret(value)
|
||||
if err != nil {
|
||||
return fallback
|
||||
}
|
||||
return plain
|
||||
}
|
||||
return value
|
||||
}
|
||||
|
||||
func (a *App) configBool(ctx context.Context, key string, fallback bool) bool {
|
||||
value := strings.ToLower(a.configPlain(ctx, key, strconv.FormatBool(fallback)))
|
||||
return value == "1" || value == "true" || value == "yes" || value == "on"
|
||||
}
|
||||
|
||||
func (a *App) encryptSecret(plain string) (string, error) {
|
||||
if plain == "" {
|
||||
return "", nil
|
||||
}
|
||||
key := sha256.Sum256([]byte(a.integrationEncryptionKey()))
|
||||
block, err := aes.NewCipher(key[:])
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return "", err
|
||||
}
|
||||
sealed := gcm.Seal(nonce, nonce, []byte(plain), nil)
|
||||
return "enc:v1:" + base64.RawStdEncoding.EncodeToString(sealed), nil
|
||||
}
|
||||
|
||||
func (a *App) decryptSecret(value string) (string, error) {
|
||||
if value == "" {
|
||||
return "", nil
|
||||
}
|
||||
if !strings.HasPrefix(value, "enc:v1:") {
|
||||
return value, nil
|
||||
}
|
||||
encoded := strings.TrimPrefix(value, "enc:v1:")
|
||||
payload, err := base64.RawStdEncoding.DecodeString(encoded)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
key := sha256.Sum256([]byte(a.integrationEncryptionKey()))
|
||||
block, err := aes.NewCipher(key[:])
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil || len(payload) < gcm.NonceSize() {
|
||||
return "", fmt.Errorf("invalid encrypted secret")
|
||||
}
|
||||
returnValue, err := gcm.Open(nil, payload[:gcm.NonceSize()], payload[gcm.NonceSize():], nil)
|
||||
if err == nil {
|
||||
return string(returnValue), nil
|
||||
}
|
||||
if a.config.ConfigEncryptionKey != "" {
|
||||
legacyKey := sha256.Sum256([]byte(a.config.JWTSecret + ":integration-config"))
|
||||
legacyBlock, legacyErr := aes.NewCipher(legacyKey[:])
|
||||
if legacyErr == nil {
|
||||
legacyGCM, legacyErr := cipher.NewGCM(legacyBlock)
|
||||
if legacyErr == nil && len(payload) >= legacyGCM.NonceSize() {
|
||||
returnValue, legacyErr = legacyGCM.Open(nil, payload[:legacyGCM.NonceSize()], payload[legacyGCM.NonceSize():], nil)
|
||||
if legacyErr == nil {
|
||||
return string(returnValue), nil
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return "", err
|
||||
}
|
||||
|
||||
func (a *App) integrationEncryptionKey() string {
|
||||
if a.config.ConfigEncryptionKey != "" {
|
||||
return a.config.ConfigEncryptionKey
|
||||
}
|
||||
// Development-only compatibility for databases created before the dedicated key existed.
|
||||
return a.config.JWTSecret + ":integration-config"
|
||||
}
|
||||
|
||||
func integrationGroup(r *http.Request) string {
|
||||
parts := strings.Split(strings.Trim(r.URL.Path, "/"), "/")
|
||||
for index, part := range parts {
|
||||
if part == "integrations" && index+1 < len(parts) {
|
||||
return parts[index+1]
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (a *App) adminIntegration(w http.ResponseWriter, r *http.Request) {
|
||||
group := integrationGroup(r)
|
||||
specs, ok := integrationSpecs[group]
|
||||
if !ok {
|
||||
fail(w, http.StatusNotFound, 30001, "配置分组不存在")
|
||||
return
|
||||
}
|
||||
fields := make([]integrationFieldView, 0, len(specs))
|
||||
configured := true
|
||||
activeProvider := ""
|
||||
if group == "sms" {
|
||||
activeProvider = a.configPlain(r.Context(), "sms.provider", "debug")
|
||||
configured = a.configBool(r.Context(), "sms.enabled", false)
|
||||
} else if group == "storage" {
|
||||
activeProvider = a.configPlain(r.Context(), "storage.provider", "local")
|
||||
} else if group == "oauth" {
|
||||
configured = a.oauthConfigurationReady(r.Context())
|
||||
}
|
||||
for _, spec := range specs {
|
||||
var value, valueType string
|
||||
_ = a.db.QueryRowContext(r.Context(), `SELECT config_value,value_type FROM system_configs WHERE config_key=?`, spec.Key).Scan(&value, &valueType)
|
||||
secret := valueType == "secret" || spec.Input == "secret"
|
||||
hasValue := value != ""
|
||||
displayValue := value
|
||||
if secret {
|
||||
displayValue = ""
|
||||
}
|
||||
applies := len(spec.Providers) == 0 || containsString(spec.Providers, activeProvider)
|
||||
if group == "oauth" {
|
||||
applies = false // OAuth 必填项由各渠道的启用状态独立校验。
|
||||
}
|
||||
if applies && spec.Required && !hasValue {
|
||||
configured = false
|
||||
}
|
||||
fields = append(fields, integrationFieldView{Key: spec.Key, Label: spec.Label, Value: displayValue, Input: spec.Input, Secret: secret, HasValue: hasValue, Required: spec.Required, Options: spec.Options, Providers: spec.Providers, Description: spec.Description})
|
||||
}
|
||||
reply(w, map[string]any{"group": group, "configured": configured, "fields": fields, "secretMask": maskedSecret})
|
||||
}
|
||||
|
||||
func containsString(values []string, target string) bool {
|
||||
for _, value := range values {
|
||||
if value == target {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (a *App) adminUpdateIntegration(w http.ResponseWriter, r *http.Request) {
|
||||
group := integrationGroup(r)
|
||||
specs, ok := integrationSpecs[group]
|
||||
if !ok {
|
||||
fail(w, http.StatusNotFound, 30001, "配置分组不存在")
|
||||
return
|
||||
}
|
||||
var req struct {
|
||||
Values map[string]string `json:"values"`
|
||||
ClearSecrets []string `json:"clearSecrets"`
|
||||
}
|
||||
if decode(r, &req) != nil || req.Values == nil {
|
||||
fail(w, http.StatusBadRequest, 20001, "配置格式错误")
|
||||
return
|
||||
}
|
||||
allowed := map[string]integrationFieldSpec{}
|
||||
for _, spec := range specs {
|
||||
allowed[spec.Key] = spec
|
||||
}
|
||||
for key, value := range req.Values {
|
||||
spec, exists := allowed[key]
|
||||
if !exists {
|
||||
fail(w, http.StatusBadRequest, 20001, "配置项不允许修改")
|
||||
return
|
||||
}
|
||||
switch spec.Input {
|
||||
case "select":
|
||||
if !containsString(spec.Options, value) {
|
||||
fail(w, http.StatusBadRequest, 20001, spec.Label+"选项无效")
|
||||
return
|
||||
}
|
||||
case "boolean":
|
||||
if value != "true" && value != "false" {
|
||||
fail(w, http.StatusBadRequest, 20001, spec.Label+"必须为 true 或 false")
|
||||
return
|
||||
}
|
||||
case "number":
|
||||
number, parseErr := strconv.Atoi(value)
|
||||
if parseErr != nil {
|
||||
fail(w, http.StatusBadRequest, 20001, spec.Label+"必须是数字")
|
||||
return
|
||||
}
|
||||
if key == "sms.expire_seconds" && (number < 60 || number > 1800) {
|
||||
fail(w, http.StatusBadRequest, 20001, "短信有效期必须在 60 到 1800 秒之间")
|
||||
return
|
||||
}
|
||||
if key == "payment.gateway.timeout_seconds" && (number < 3 || number > 30) {
|
||||
fail(w, http.StatusBadRequest, 20001, "支付网关超时必须在 3 到 30 秒之间")
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
clearSet := map[string]bool{}
|
||||
for _, key := range req.ClearSecrets {
|
||||
spec, exists := allowed[key]
|
||||
if !exists || spec.Input != "secret" {
|
||||
fail(w, http.StatusBadRequest, 20001, "清除的配置项不是允许的密钥字段")
|
||||
return
|
||||
}
|
||||
clearSet[key] = true
|
||||
}
|
||||
if group == "oauth" {
|
||||
if err := a.validateAdminOAuthConfigValues(r.Context(), req.Values, clearSet); err != nil {
|
||||
fail(w, http.StatusBadRequest, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
}
|
||||
tx, err := a.db.BeginTx(r.Context(), nil)
|
||||
if err != nil {
|
||||
fail(w, 500, 50001, "保存失败")
|
||||
return
|
||||
}
|
||||
defer func() { _ = tx.Rollback() }()
|
||||
changed := []string{}
|
||||
for key, value := range req.Values {
|
||||
spec, exists := allowed[key]
|
||||
if !exists {
|
||||
continue
|
||||
}
|
||||
isSecret := spec.Input == "secret"
|
||||
if isSecret && value == "" && !clearSet[key] {
|
||||
continue
|
||||
}
|
||||
if isSecret && !clearSet[key] {
|
||||
value, err = a.encryptSecret(value)
|
||||
if err != nil {
|
||||
fail(w, 500, 50001, "加密敏感配置失败")
|
||||
return
|
||||
}
|
||||
}
|
||||
if clearSet[key] {
|
||||
value = ""
|
||||
}
|
||||
if _, err = tx.ExecContext(r.Context(), `UPDATE system_configs SET config_value=? WHERE config_key=?`, value, key); err != nil {
|
||||
fail(w, 500, 50001, "保存失败")
|
||||
return
|
||||
}
|
||||
changed = append(changed, key)
|
||||
}
|
||||
if err = tx.Commit(); err != nil {
|
||||
fail(w, 500, 50001, "保存失败")
|
||||
return
|
||||
}
|
||||
a.audit(r, "update", group+"_integration", 0, map[string]any{"changedKeys": changed})
|
||||
reply(w, map[string]any{"success": true, "changedKeys": changed})
|
||||
}
|
||||
|
||||
func (a *App) adminTestIntegration(w http.ResponseWriter, r *http.Request) {
|
||||
group := integrationGroup(r)
|
||||
switch group {
|
||||
case "sms":
|
||||
if !a.configBool(r.Context(), "sms.enabled", false) {
|
||||
fail(w, 400, 20001, "短信服务当前未启用")
|
||||
return
|
||||
}
|
||||
provider := a.configPlain(r.Context(), "sms.provider", "debug")
|
||||
if err := a.validateSMSProviderConfig(r.Context()); err != nil {
|
||||
fail(w, 400, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
reply(w, map[string]any{"success": true, "message": cloudSMSProviderName(provider) + "短信配置校验通过", "provider": provider})
|
||||
case "payment":
|
||||
mode := a.configPlain(r.Context(), "payment.mode", "sandbox")
|
||||
if a.config.Environment == "production" && mode != "live" {
|
||||
fail(w, 400, 20001, "生产环境必须使用 live 支付模式")
|
||||
return
|
||||
}
|
||||
if mode == "live" && !a.paymentGatewayConfigured(r.Context()) {
|
||||
fail(w, 400, 20001, "统一支付网关配置不完整，请检查下单/退款/回调 HTTPS 地址、令牌和至少 32 位回调密钥")
|
||||
return
|
||||
}
|
||||
channels := a.availablePaymentChannels(r.Context())
|
||||
if len(channels) == 0 {
|
||||
fail(w, 400, 20001, "至少启用一个支付渠道")
|
||||
return
|
||||
}
|
||||
if mode == "live" {
|
||||
for _, channel := range channels {
|
||||
if channel["configured"] != true {
|
||||
fail(w, 400, 20001, fmt.Sprintf("%s 的生产参数不完整", channel["name"]))
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
reply(w, map[string]any{"success": true, "message": "支付配置校验通过", "mode": mode, "channels": channels})
|
||||
case "storage":
|
||||
provider := a.configPlain(r.Context(), "storage.provider", "local")
|
||||
if err := a.validateStorageProviderConfig(r.Context()); err != nil {
|
||||
fail(w, 400, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
reply(w, map[string]any{"success": true, "message": storageProviderName(provider) + "配置校验通过", "provider": provider})
|
||||
case "oauth":
|
||||
adminProviders, err := a.enabledAdminOAuthProviders(r.Context())
|
||||
if err != nil {
|
||||
fail(w, http.StatusBadRequest, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
userProviders, err := a.enabledUserOAuthProviders(r.Context())
|
||||
if err != nil {
|
||||
fail(w, http.StatusBadRequest, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
if _, err = a.userOAuthFrontendURL(r.Context()); err != nil {
|
||||
fail(w, http.StatusBadRequest, 20001, err.Error())
|
||||
return
|
||||
}
|
||||
if len(adminProviders) == 0 && len(userProviders) == 0 {
|
||||
reply(w, map[string]any{"success": true, "message": "当前未启用第三方登录，登录页不会显示第三方入口", "providers": []any{}})
|
||||
return
|
||||
}
|
||||
items := make([]map[string]string, 0, len(adminProviders)+len(userProviders))
|
||||
for _, provider := range adminProviders {
|
||||
items = append(items, map[string]string{"audience": "admin", "code": provider.Code, "name": provider.Name})
|
||||
}
|
||||
for _, provider := range userProviders {
|
||||
items = append(items, map[string]string{"audience": "user", "code": provider.Code, "name": provider.Name})
|
||||
}
|
||||
reply(w, map[string]any{"success": true, "message": "第三方登录配置校验通过", "providers": items})
|
||||
default:
|
||||
fail(w, http.StatusNotFound, 30001, "配置分组不存在")
|
||||
}
|
||||
}
|
||||
|
||||
func (a *App) dispatchSMS(ctx context.Context, phone, scene, code string) error {
|
||||
provider := a.configPlain(ctx, "sms.provider", "debug")
|
||||
if err := a.validateSMSProviderConfig(ctx); err != nil {
|
||||
return err
|
||||
}
|
||||
switch provider {
|
||||
case "debug":
|
||||
return nil
|
||||
case "aliyun":
|
||||
_, err := a.sendAliyunSMS(ctx, phone, scene, code)
|
||||
return err
|
||||
case "tencent":
|
||||
_, err := a.sendTencentSMS(ctx, phone, scene, code)
|
||||
return err
|
||||
case "huawei":
|
||||
_, err := a.sendHuaweiSMS(ctx, phone, scene, code)
|
||||
return err
|
||||
case "webhook":
|
||||
return a.sendWebhookSMS(ctx, phone, scene, code)
|
||||
default:
|
||||
return fmt.Errorf("不支持的短信提供商")
|
||||
}
|
||||
}
|
||||
|
||||
func (a *App) sendWebhookSMS(ctx context.Context, phone, scene, code string) error {
|
||||
endpoint := a.configPlain(ctx, "sms.webhook_url", "")
|
||||
if endpoint == "" {
|
||||
return fmt.Errorf("短信 Webhook 未配置")
|
||||
}
|
||||
templateID, err := a.smsTemplateID(ctx, "webhook", scene)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
payload, _ := json.Marshal(map[string]any{"phone": phone, "scene": scene, "code": code, "signName": a.configPlain(ctx, "sms.sign_name", "星遇社交"), "templateId": templateID})
|
||||
request, _ := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(payload))
|
||||
request.Header.Set("Content-Type", "application/json")
|
||||
if token := a.configPlain(ctx, "sms.webhook_token", ""); token != "" {
|
||||
request.Header.Set("Authorization", "Bearer "+token)
|
||||
}
|
||||
client := &http.Client{Timeout: 8 * time.Second}
|
||||
response, err := client.Do(request)
|
||||
if err != nil {
|
||||
return fmt.Errorf("短信网关连接失败: %w", err)
|
||||
}
|
||||
defer response.Body.Close()
|
||||
if response.StatusCode < 200 || response.StatusCode >= 300 {
|
||||
return fmt.Errorf("短信网关返回 HTTP %d", response.StatusCode)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user