273bd1b
use http_body_util::Full;
use hyper::body::{Bytes, Incoming};
use hyper::header::{self, HeaderValue};
use hyper::{HeaderMap, Request, Response, StatusCode};
use serde_json::Value;
use crate::SocketError;
use super::SocketHub;
pub(super) type HttpRequest = Request<Incoming>;
pub(super) type HttpResponse = Response<Full<Bytes>>;
pub(super) async fn authenticate(
request: &HttpRequest,
hub: &SocketHub,
) -> Result<(i64, String), HttpResponse> {
// 三条来源，按可信度排序：
// 1. `Authorization: Bearer`（服务端/Node 客户端）；
// 2. 会话 cookie（浏览器握手拿不到自定义头，这是唯一可用的带 token 方式）；
// 3. 都不带 → 返回 0，等客户端在 Socket.IO CONNECT 包里用 `auth.token` 补交
// （有 `socket.auth_timeout` 兜底）。
let token = bearer_token(request)
.map(str::to_owned)
.or_else(|| session_token(request, &hub.options().session_cookie));
let Some(token) = token else {
if request.headers().contains_key(header::AUTHORIZATION) {
return Err(unauthorized("missing bearer token"));
}
return Ok((0, String::new()));
};
hub.authenticate_token(&token)
.await
.map(|user| (user, token.clone()))
.map_err(auth_error_response)
}
/// 从 `Cookie` 头里取会话 token（名字由 `socket.session_cookie` 指定）。
fn session_token(request: &HttpRequest, cookie: &str) -> Option<String> {
if cookie.trim().is_empty() {
return None;
}
let header = request.headers().get(header::COOKIE)?.to_str().ok()?;
header
.split(';')
.filter_map(|pair| pair.split_once('='))
.find_map(|(name, value)| {
(name.trim() == cookie && !value.trim().is_empty())
.then(|| value.trim().trim_matches('"').to_string())
})
}
pub(super) fn empty_response(status: StatusCode) -> HttpResponse {
let mut response = Response::new(Full::new(Bytes::new()));
*response.status_mut() = status;
response
}
pub(super) fn json_response(status: StatusCode, body: Value) -> HttpResponse {
let mut response = Response::new(Full::new(Bytes::from(body.to_string())));
*response.status_mut() = status;
response.headers_mut().insert(
header::CONTENT_TYPE,
HeaderValue::from_static("application/json"),
);
response
.headers_mut()
.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
response
}
pub(super) fn engine_error(code: u16, message: &str) -> HttpResponse {
json_response(
StatusCode::BAD_REQUEST,
serde_json::json!({
"code": code,
"message": message,
}),
)
}
pub(super) fn text_response(body: String) -> HttpResponse {
let mut response = Response::new(Full::new(Bytes::from(body)));
response.headers_mut().insert(
header::CONTENT_TYPE,
HeaderValue::from_static("text/plain; charset=utf-8"),
);
response
.headers_mut()
.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
response
}
fn unauthorized(message: &str) -> HttpResponse {
json_response(
StatusCode::UNAUTHORIZED,
serde_json::json!({
"code": "UNAUTHENTICATED",
"message": message,
}),
)
}
fn auth_error_response(error: SocketError) -> HttpResponse {
match error {
SocketError::Rejected(message) => unauthorized(&message),
SocketError::Unavailable(message) => json_response(
StatusCode::SERVICE_UNAVAILABLE,
serde_json::json!({
"code": "UNAVAILABLE",
"message": message,
}),
),
SocketError::Config(message) => json_response(
StatusCode::INTERNAL_SERVER_ERROR,
serde_json::json!({
"code": "INTERNAL",
"message": message,
}),
),
}
}
pub(super) fn cors(headers: &HeaderMap, mut response: HttpResponse) -> HttpResponse {
let origin = headers
.get(header::ORIGIN)
.and_then(|value| value.to_str().ok())
.unwrap_or("*");
if let Ok(value) = HeaderValue::from_str(origin) {
response
.headers_mut()
.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, value);
if origin != "*" {
response.headers_mut().insert(
header::ACCESS_CONTROL_ALLOW_CREDENTIALS,
HeaderValue::from_static("true"),
);
}
}
response
.headers_mut()
.insert(header::VARY, HeaderValue::from_static("Origin"));
response.headers_mut().insert(
header::ACCESS_CONTROL_ALLOW_METHODS,
HeaderValue::from_static("GET, POST, OPTIONS"),
);
response.headers_mut().insert(
header::ACCESS_CONTROL_ALLOW_HEADERS,
HeaderValue::from_static("authorization, content-type"),
);
response
}
fn bearer_token(request: &HttpRequest) -> Option<&str> {
let value = request
.headers()
.get(header::AUTHORIZATION)?
.to_str()
.ok()?;
let (scheme, token) = value.split_once(' ')?;
if !scheme.eq_ignore_ascii_case("bearer") {
return None;
}
let token = token.trim();
(!token.is_empty()).then_some(token)
}