130 lines
4.1 KiB
Go
130 lines
4.1 KiB
Go
package listing
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"hfb_sys/backend/pkg/response"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func (h *Handler) ImportExternalUpload(c *gin.Context) {
|
|
c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxExternalUploadBodyBytes)
|
|
raw, err := io.ReadAll(c.Request.Body)
|
|
if err != nil {
|
|
response.BadRequest(c, "上传内容过大或读取失败")
|
|
return
|
|
}
|
|
if err := h.verifyExternalUpload(c, raw); err != nil {
|
|
writeExternalUploadAuthError(c, err)
|
|
return
|
|
}
|
|
var req ExternalUploadRequest
|
|
if err := json.Unmarshal(raw, &req); err != nil {
|
|
response.BadRequest(c, "上传 JSON 格式不正确")
|
|
return
|
|
}
|
|
result, err := h.service.ImportExternalUpload(c.Request.Context(), req, ExternalUploadMeta{
|
|
IP: c.ClientIP(),
|
|
UserAgent: c.GetHeader("User-Agent"),
|
|
RawPayload: raw,
|
|
})
|
|
if err != nil {
|
|
writeListingError(c, err)
|
|
return
|
|
}
|
|
response.Created(c, result)
|
|
}
|
|
|
|
var (
|
|
errExternalUploadSecretMissing = errors.New("external upload secret missing")
|
|
errExternalUploadForbiddenIP = errors.New("external upload forbidden ip")
|
|
errExternalUploadTimestamp = errors.New("external upload timestamp invalid")
|
|
errExternalUploadSignature = errors.New("external upload signature invalid")
|
|
)
|
|
|
|
const externalUploadMaxClockSkew = 5 * time.Minute
|
|
|
|
func (h *Handler) verifyExternalUpload(c *gin.Context, raw []byte) error {
|
|
secret := strings.TrimSpace(h.externalUploadSecret)
|
|
if secret == "" {
|
|
return errExternalUploadSecretMissing
|
|
}
|
|
if !externalUploadIPAllowed(c.ClientIP(), h.externalUploadAllowedIPs) {
|
|
return errExternalUploadForbiddenIP
|
|
}
|
|
timestamp := strings.TrimSpace(c.GetHeader("X-HFB-Timestamp"))
|
|
signature := strings.TrimSpace(c.GetHeader("X-HFB-Signature"))
|
|
if timestamp == "" || signature == "" {
|
|
return errExternalUploadSignature
|
|
}
|
|
ts, err := strconv.ParseInt(timestamp, 10, 64)
|
|
if err != nil {
|
|
return errExternalUploadTimestamp
|
|
}
|
|
requestTime := time.Unix(ts, 0)
|
|
if time.Since(requestTime) > externalUploadMaxClockSkew || time.Until(requestTime) > externalUploadMaxClockSkew {
|
|
return errExternalUploadTimestamp
|
|
}
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write([]byte(timestamp))
|
|
mac.Write([]byte("."))
|
|
mac.Write(raw)
|
|
expected := hex.EncodeToString(mac.Sum(nil))
|
|
if !hmac.Equal([]byte(strings.ToLower(signature)), []byte(expected)) {
|
|
return errExternalUploadSignature
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func externalUploadIPAllowed(clientIP string, allowed []string) bool {
|
|
if len(allowed) == 0 {
|
|
return true
|
|
}
|
|
parsedIP := net.ParseIP(clientIP)
|
|
for _, raw := range allowed {
|
|
item := strings.TrimSpace(raw)
|
|
if item == "" {
|
|
continue
|
|
}
|
|
if parsedIP != nil {
|
|
if _, network, err := net.ParseCIDR(item); err == nil && network.Contains(parsedIP) {
|
|
return true
|
|
}
|
|
}
|
|
if item == clientIP {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func writeExternalUploadAuthError(c *gin.Context, err error) {
|
|
switch err {
|
|
case errExternalUploadSecretMissing:
|
|
response.ServiceUnavailable(c, "开放导入签名密钥未配置")
|
|
case errExternalUploadForbiddenIP:
|
|
response.Error(c, http.StatusForbidden, "forbidden", "来源 IP 不允许访问")
|
|
case errExternalUploadTimestamp:
|
|
response.Error(c, http.StatusUnauthorized, "invalid_timestamp", "请求时间戳无效")
|
|
default:
|
|
response.Error(c, http.StatusUnauthorized, "invalid_signature", "请求签名无效")
|
|
}
|
|
}
|
|
|
|
func (h *Handler) DefaultUploadScreenshot(c *gin.Context) {
|
|
c.Header("Content-Type", "image/svg+xml; charset=utf-8")
|
|
c.Header("Cache-Control", "public, max-age=86400")
|
|
c.String(http.StatusOK, `<svg xmlns="http://www.w3.org/2000/svg" width="960" height="540" viewBox="0 0 960 540"><rect width="960" height="540" fill="#f3f4f6"/><rect x="72" y="72" width="816" height="396" rx="24" fill="#ffffff" stroke="#d1d5db" stroke-width="4"/><text x="480" y="248" text-anchor="middle" font-family="Arial, sans-serif" font-size="42" font-weight="700" fill="#374151">账号资料默认图</text><text x="480" y="310" text-anchor="middle" font-family="Arial, sans-serif" font-size="28" fill="#6b7280">开放接口上传，待后台补充审核</text></svg>`)
|
|
}
|