main
//! auth.v1 的 SSH 公钥解析。
//!
//! 调用方：ssh（连接认证，并对长连接的每条 exec 复验一次）。
use chrono::{DateTime, Utc};
use internal::Gate;
use internal::server::InternalRouter;
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
use tonic::{Request, Response, Status};
use crate::models::users::user_ssh_keys::PublicKeyType;
use crate::models::users::{user_ssh_keys, users};
use crate::protos::auth::common::v1::{AuthMethod, Principal, SshKeyAlgorithm, SshKeyInfo};
use crate::protos::auth::v1::ssh_key_service_server::{
SshKeyService as SshKeyTrait, SshKeyServiceServer,
};
use crate::protos::auth::v1::{
AddSshKeyRequest, AddSshKeyResponse, ListUserSshKeysRequest, ListUserSshKeysResponse,
LookupSshKeyRequest, LookupSshKeyResponse, RevokeSshKeyRequest, RevokeSshKeyResponse,
};
use crate::services::AuthService;
pub fn register(router: InternalRouter, service: &AuthService, gate: Gate) -> InternalRouter {
router.add_service(SshKeyServiceServer::with_interceptor(
SshKeyRpc {
service: service.clone(),
},
gate,
))
}
#[derive(Clone)]
struct SshKeyRpc {
service: AuthService,
}
#[tonic::async_trait]
impl SshKeyTrait for SshKeyRpc {
async fn lookup_ssh_key(
&self,
request: Request<LookupSshKeyRequest>,
) -> Result<Response<LookupSshKeyResponse>, Status> {
let _meta = internal::interceptor::meta(&request)?;
let request = request.into_inner();
let fingerprint = request.fingerprint.trim();
let public_key = request.public_key.trim();
if fingerprint.is_empty() && public_key.is_empty() {
return Err(Status::invalid_argument(
"fingerprint or public_key is required",
));
}
let db = self.service.db().read();
let mut query = user_ssh_keys::Entity::find();
query = if fingerprint.is_empty() {
query.filter(user_ssh_keys::Column::PublicKey.eq(public_key))
} else {
query.filter(user_ssh_keys::Column::Fingerprint.eq(fingerprint))
};
let key = query.one(db).await.map_err(|error| {
tracing::error!(%error, "ssh key lookup failed");
Status::internal("ssh key lookup failed")
})?;
let Some(key) = key else {
return Ok(Response::new(missed()));
};
if request.require_active
&& (key.revoked_at.is_some()
|| key.expires_at.is_some_and(|expiry| expiry <= Utc::now()))
{
return Ok(Response::new(missed()));
}
let user = users::Entity::find_by_id(key.user_id)
.one(db)
.await
.map_err(|error| {
tracing::error!(%error, "ssh key owner lookup failed");
Status::internal("ssh key owner lookup failed")
})?;
let Some(user) = user else {
return Ok(Response::new(missed()));
};
if user.deleted_at.is_some() || !user.allow_use || user.forbid_login {
return Ok(Response::new(missed()));
}
Ok(Response::new(LookupSshKeyResponse {
found: true,
key: Some(SshKeyInfo {
key_id: key.id.to_string(),
user_id: key.user_id,
name: key.name.clone(),
description: key.description.clone().unwrap_or_default(),
algorithm: algorithm(key.algorithm) as i32,
public_key: key.public_key.clone(),
fingerprint: key.fingerprint.clone(),
created_at: Some(timestamp(key.created_at)),
expires_at: key.expires_at.map(timestamp),
last_used_at: key.last_used_at.map(timestamp),
revoked_at: key.revoked_at.map(timestamp),
}),
principal: Some(Principal {
user_id: user.id,
username: user.username.clone(),
displayname: user.displayname.clone().unwrap_or_default(),
is_admin: user.is_admin,
security_version: user.security_version,
method: AuthMethod::SshKey as i32,
authenticated_at: Some(timestamp(Utc::now())),
bot: user.bot,
system: user.system,
..Default::default()
}),
current_security_version: user.security_version,
}))
}
async fn add_ssh_key(
&self,
_request: Request<AddSshKeyRequest>,
) -> Result<Response<AddSshKeyResponse>, Status> {
Err(Status::unimplemented(
"ssh key registration is not exposed by this service",
))
}
async fn list_user_ssh_keys(
&self,
_request: Request<ListUserSshKeysRequest>,
) -> Result<Response<ListUserSshKeysResponse>, Status> {
Err(Status::unimplemented(
"ssh key listing is not exposed by this service",
))
}
async fn revoke_ssh_key(
&self,
_request: Request<RevokeSshKeyRequest>,
) -> Result<Response<RevokeSshKeyResponse>, Status> {
Err(Status::unimplemented(
"ssh key revocation is not exposed by this service",
))
}
}
/// 未命中一律返回空响应，不区分「不存在」与「不可用」，避免成为探测接口。
fn missed() -> LookupSshKeyResponse {
LookupSshKeyResponse {
found: false,
..Default::default()
}
}
fn algorithm(value: PublicKeyType) -> SshKeyAlgorithm {
match value {
PublicKeyType::RSA => SshKeyAlgorithm::Rsa,
PublicKeyType::ED25519 => SshKeyAlgorithm::Ed25519,
PublicKeyType::ECDSA => SshKeyAlgorithm::Ecdsa,
}
}
fn timestamp(value: DateTime<Utc>) -> prost_types::Timestamp {
prost_types::Timestamp {
seconds: value.timestamp(),
nanos: value.timestamp_subsec_nanos() as i32,
}
}