759ae5e
use axum::extract::{Query, State};
use serde::{Deserialize, Serialize};
use utoipa::ToSchema;
use crate::errors::ApiError;
use export::rest::{AppResponseData, NoData};
use crate::services::AuthService;
use jwt::Session;
use jwt::share::session::require_uid;
#[derive(Debug, Deserialize, utoipa::ToSchema, utoipa::IntoParams)]
pub struct JwtRequestQuery {
pub appid: String,
}
#[derive(Debug, Serialize, ToSchema)]
pub struct JwtRequestResp {
pub jwt: String,
pub expires_in_secs: i64,
}
#[utoipa::path(
get,
path = "/auth/jwt-request",
tag = "auth",
description = "为站内实时连接签发短期服务令牌。",
params(JwtRequestQuery),
responses(
(status = 200, description = "jwt issued", body = AppResponseData<JwtRequestResp>),
(status = 400, description = "request failed validation", body = AppResponseData<NoData>),
(status = 401, description = "authentication required", body = AppResponseData<NoData>)
)
)]
pub async fn jwt_request(
State(service): State<AuthService>,
session: Session,
Query(query): Query<JwtRequestQuery>,
) -> Result<AppResponseData<JwtRequestResp>, ApiError> {
let uid = require_uid(&session)?;
if query.appid != "chat" {
return Err(ApiError::bad_request("unsupported appid"));
}
let client = service
.state
.kenauth
.as_ref()
.ok_or_else(|| ApiError::internal("kenoauth client is not configured"))?;
let issued = client
.issue_service_token(
uid,
2,
vec![8, 9],
900,
&uuid::Uuid::now_v7().to_string(),
)
.await
.map_err(|error| ApiError::internal(error.to_string()))?;
Ok(AppResponseData::ok(JwtRequestResp {
jwt: issued.service_token,
expires_in_secs: 900,
}))
}