Something went wrong. Try again.
sloproxy
Something went wrong. Try again.
18 kB · 599 lines
Go
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600package pluginhost
import ( "bytes" "context" "encoding/json" "fmt" "os" "path/filepath" "reflect" "runtime" "strings" "time"
"github.com/router-for-me/CLIProxyAPI/v7/internal/config" coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth" "github.com/router-for-me/CLIProxyAPI/v7/sdk/pluginapi")
func (h *Host) hostConfigSummaryLocked() pluginapi.HostConfigSummary { if h == nil || h.runtimeConfig == nil { return pluginapi.HostConfigSummary{} } cfg := h.runtimeConfig return pluginapi.HostConfigSummary{ AuthDir: strings.TrimSpace(cfg.AuthDir), ProxyURL: strings.TrimSpace(cfg.ProxyURL), ForceModelPrefix: cfg.ForceModelPrefix, OAuthModelAlias: pluginOAuthModelAliases(cfg.OAuthModelAlias), ExcludedModels: cloneStringSliceMap(cfg.OAuthExcludedModels), }}
func (h *Host) hostConfigSummary() pluginapi.HostConfigSummary { if h == nil { return pluginapi.HostConfigSummary{} } h.mu.Lock() defer h.mu.Unlock() return h.hostConfigSummaryLocked()}
func pluginOAuthModelAliases(in map[string][]config.OAuthModelAlias) map[string][]pluginapi.ModelAlias { if len(in) == 0 { return nil } out := make(map[string][]pluginapi.ModelAlias, len(in)) for provider, aliases := range in { key := normalizeProviderID(provider) if key == "" { continue } for _, alias := range aliases { name := strings.TrimSpace(alias.Name) value := strings.TrimSpace(alias.Alias) if name == "" || value == "" { continue } out[key] = append(out[key], pluginapi.ModelAlias{Name: name, Alias: value}) } } if len(out) == 0 { return nil } return out}
func cloneStringSliceMap(in map[string][]string) map[string][]string { if len(in) == 0 { return nil } out := make(map[string][]string, len(in)) for key, values := range in { cleanKey := normalizeProviderID(key) if cleanKey == "" { continue } out[cleanKey] = cloneStringSlice(values) } if len(out) == 0 { return nil } return out}
func normalizeProviderID(provider string) string { return strings.ToLower(strings.TrimSpace(provider))}
func authIDForPath(path, authDir string) string { path = strings.TrimSpace(path) if path == "" { return "" } id := path if authDir = strings.TrimSpace(authDir); authDir != "" { if rel, errRel := filepath.Rel(authDir, path); errRel == nil && rel != "" && !strings.HasPrefix(rel, "..") { id = rel } } id = filepath.ToSlash(filepath.Clean(id)) if runtime.GOOS == "windows" { id = strings.ToLower(id) } return id}
func (h *Host) AuthProviderIdentifiers() []string { if h == nil { return nil } out := make([]string, 0) for _, record := range h.activeRecords() { provider := record.plugin.Capabilities.AuthProvider if provider == nil || h.isPluginFused(record.id) { continue } identifier, okIdentifier := h.callAuthProviderIdentifier(record.id, provider) if okIdentifier && identifier != "" { out = append(out, identifier) } } return out}
func (h *Host) HasAuthProvider(provider string) bool { return h.authProviderRecord(provider) != nil}
func (h *Host) authProviderRecord(provider string) *capabilityRecord { provider = normalizeProviderID(provider) if h == nil || provider == "" { return nil } for _, record := range h.activeRecords() { authProvider := record.plugin.Capabilities.AuthProvider if authProvider == nil || h.isPluginFused(record.id) { continue } identifier, okIdentifier := h.callAuthProviderIdentifier(record.id, authProvider) if okIdentifier && identifier == provider { copyRecord := record return ©Record } } return nil}
func (h *Host) callAuthProviderIdentifier(pluginID string, provider pluginapi.AuthProvider) (identifier string, ok bool) { if h == nil || provider == nil || h.isPluginFused(pluginID) { return "", false } defer func() { if recovered := recover(); recovered != nil { h.fusePlugin(pluginID, "AuthProvider.Identifier", recovered) identifier = "" ok = false } }() return normalizeProviderID(provider.Identifier()), true}
func (h *Host) ParseAuth(ctx context.Context, req pluginapi.AuthParseRequest) (*coreauth.Auth, bool, error) { auths, handled, errParseAuths := h.ParseAuths(ctx, req) if errParseAuths != nil || !handled || len(auths) == 0 { return nil, handled, errParseAuths } return auths[0], true, nil}
func (h *Host) ParseAuths(ctx context.Context, req pluginapi.AuthParseRequest) ([]*coreauth.Auth, bool, error) { if h == nil { return nil, false, nil } if strings.TrimSpace(req.Provider) != "" { record := h.authProviderRecord(req.Provider) if record == nil { return nil, false, nil } return h.callParseAuths(ctx, *record, req) } for _, record := range h.activeRecords() { if record.plugin.Capabilities.AuthProvider == nil || h.isPluginFused(record.id) { continue } auths, handled, errParse := h.callParseAuths(ctx, record, req) if errParse != nil || handled { return auths, handled, errParse } } return nil, false, nil}
func (h *Host) callParseAuth(ctx context.Context, record capabilityRecord, req pluginapi.AuthParseRequest) (auth *coreauth.Auth, handled bool, err error) { auths, handled, errParseAuths := h.callParseAuths(ctx, record, req) if errParseAuths != nil || !handled || len(auths) == 0 { return nil, handled, errParseAuths } return auths[0], true, nil}
func (h *Host) callParseAuths(ctx context.Context, record capabilityRecord, req pluginapi.AuthParseRequest) (auths []*coreauth.Auth, handled bool, err error) { provider := record.plugin.Capabilities.AuthProvider if h == nil || provider == nil || h.isPluginFused(record.id) || !h.recordCurrent(record) { return nil, false, nil } defer func() { if recovered := recover(); recovered != nil { h.fusePlugin(record.id, "AuthProvider.ParseAuth", recovered) auths = nil handled = false err = fmt.Errorf("auth provider panic: %v", recovered) } }() if req.Host.AuthDir == "" { req.Host = h.hostConfigSummary() } req.Provider = normalizeProviderID(req.Provider) if req.Provider == "" { req.Provider = normalizeProviderID(provider.Identifier()) } req.RawJSON = bytes.Clone(req.RawJSON) resp, errParse := provider.ParseAuth(ctx, req) if errParse != nil { return nil, false, errParse } if !resp.Handled { return nil, false, nil } datas := pluginAuthParseResponseAuths(resp) auths = make([]*coreauth.Auth, 0, len(datas)) for _, data := range datas { if strings.TrimSpace(data.Provider) == "" { data.Provider = req.Provider } if strings.TrimSpace(data.Provider) == "" { data.Provider = normalizeProviderID(provider.Identifier()) } if normalizeProviderID(data.Provider) == "" { return nil, true, fmt.Errorf("auth provider %s returned auth without provider", record.id) } parsed := h.AuthDataToCoreAuth(data, req.Path, req.FileName) if parsed == nil { return nil, true, fmt.Errorf("auth provider %s returned invalid auth data", record.id) } auths = append(auths, parsed) } return auths, true, nil}
func pluginAuthParseResponseAuths(resp pluginapi.AuthParseResponse) []pluginapi.AuthData { if len(resp.Auths) > 0 { return append([]pluginapi.AuthData(nil), resp.Auths...) } return []pluginapi.AuthData{resp.Auth}}
func (h *Host) StartLogin(ctx context.Context, provider string, baseURL string) (pluginapi.AuthLoginStartResponse, bool, error) { record := h.authProviderRecord(provider) if record == nil { return pluginapi.AuthLoginStartResponse{}, false, nil } return h.callStartLogin(ctx, *record, provider, baseURL)}
func (h *Host) callStartLogin(ctx context.Context, record capabilityRecord, provider string, baseURL string) (resp pluginapi.AuthLoginStartResponse, handled bool, err error) { authProvider := record.plugin.Capabilities.AuthProvider if h == nil || authProvider == nil || h.isPluginFused(record.id) || !h.recordCurrent(record) { return pluginapi.AuthLoginStartResponse{}, false, nil } defer func() { if recovered := recover(); recovered != nil { h.fusePlugin(record.id, "AuthProvider.StartLogin", recovered) resp = pluginapi.AuthLoginStartResponse{} handled = false err = fmt.Errorf("auth provider start login panic: %v", recovered) } }() req := pluginapi.AuthLoginStartRequest{ Provider: normalizeProviderID(provider), BaseURL: strings.TrimSpace(baseURL), Host: h.hostConfigSummary(), HTTPClient: h.newHTTPClient(nil), } resp, errStart := authProvider.StartLogin(ctx, req) if errStart != nil { return pluginapi.AuthLoginStartResponse{}, true, errStart } return resp, true, nil}
func (h *Host) PollLogin(ctx context.Context, provider, state string, metadata ...map[string]any) (pluginapi.AuthLoginPollResponse, bool, error) { record := h.authProviderRecord(provider) if record == nil { return pluginapi.AuthLoginPollResponse{}, false, nil } var pollMetadata map[string]any if len(metadata) > 0 { pollMetadata = metadata[0] } return h.callPollLogin(ctx, *record, provider, state, pollMetadata)}
func (h *Host) callPollLogin(ctx context.Context, record capabilityRecord, provider, state string, metadata map[string]any) (resp pluginapi.AuthLoginPollResponse, handled bool, err error) { authProvider := record.plugin.Capabilities.AuthProvider if h == nil || authProvider == nil || h.isPluginFused(record.id) || !h.recordCurrent(record) { return pluginapi.AuthLoginPollResponse{}, false, nil } defer func() { if recovered := recover(); recovered != nil { h.fusePlugin(record.id, "AuthProvider.PollLogin", recovered) resp = pluginapi.AuthLoginPollResponse{} handled = false err = fmt.Errorf("auth provider poll login panic: %v", recovered) } }() req := pluginapi.AuthLoginPollRequest{ Provider: normalizeProviderID(provider), State: strings.TrimSpace(state), Host: h.hostConfigSummary(), HTTPClient: h.newHTTPClient(nil), Metadata: cloneAnyMap(metadata), } resp, errPoll := authProvider.PollLogin(ctx, req) if errPoll != nil { return pluginapi.AuthLoginPollResponse{}, true, errPoll } return resp, true, nil}
func (h *Host) RefreshAuth(ctx context.Context, auth *coreauth.Auth) (refreshed *coreauth.Auth, handled bool, err error) { if h == nil || auth == nil { return nil, false, nil } record := h.authProviderRecord(authProvider(auth)) if record == nil || record.plugin.Capabilities.AuthProvider == nil { return nil, false, nil } if !h.recordCurrent(*record) { return nil, false, nil } defer func() { if recovered := recover(); recovered != nil { h.fusePlugin(record.id, "AuthProvider.RefreshAuth", recovered) refreshed = nil handled = true err = fmt.Errorf("auth provider refresh panic: %v", recovered) } }()
pluginResp, errRefresh := record.plugin.Capabilities.AuthProvider.RefreshAuth(ctx, pluginapi.AuthRefreshRequest{ AuthID: authID(auth), AuthProvider: authProvider(auth), StorageJSON: storageJSONFromAuth(auth), Metadata: cloneAnyMap(authMetadata(auth)), Attributes: authAttributes(auth), Host: h.hostConfigSummary(), HTTPClient: h.newHTTPClient(auth), }) if errRefresh != nil { return nil, true, errRefresh } data := pluginResp.Auth if strings.TrimSpace(data.Provider) == "" { data.Provider = authProvider(auth) } if strings.TrimSpace(data.ID) == "" { data.ID = authID(auth) } if strings.TrimSpace(data.FileName) == "" { data.FileName = auth.FileName } if strings.TrimSpace(data.Label) == "" { data.Label = auth.Label } if strings.TrimSpace(data.Prefix) == "" { data.Prefix = auth.Prefix } if strings.TrimSpace(data.ProxyURL) == "" { data.ProxyURL = auth.ProxyURL } if len(data.Metadata) == 0 { data.Metadata = cloneAnyMap(auth.Metadata) } if len(data.Attributes) == 0 { data.Attributes = cloneStringMap(auth.Attributes) } if len(data.StorageJSON) == 0 { data.StorageJSON = storageJSONFromAuth(auth) } if pluginResp.NextRefreshAfter.IsZero() { data.NextRefreshAfter = auth.NextRefreshAfter } else { data.NextRefreshAfter = pluginResp.NextRefreshAfter } next := h.AuthDataToCoreAuth(data, "", data.FileName) if next == nil { return nil, true, fmt.Errorf("auth provider refresh returned invalid auth data") } next.Index = auth.Index next.CreatedAt = auth.CreatedAt next.UpdatedAt = auth.UpdatedAt return next, true, nil}
func (h *Host) AuthDataToCoreAuth(data pluginapi.AuthData, path, fileName string) *coreauth.Auth { authDir := "" if h != nil { authDir = h.hostConfigSummary().AuthDir } return pluginAuthDataToCoreAuth(data, path, fileName, authDir)}
type pluginTokenStorage struct { provider string rawJSON []byte meta map[string]any}
func (s *pluginTokenStorage) SetMetadata(meta map[string]any) { if s == nil { return } s.meta = cloneAnyMap(meta)}
func (s *pluginTokenStorage) RawJSON() []byte { if s == nil { return nil } payload, errPayload := mergedStorageJSON(s.rawJSON, s.meta, s.provider) if errPayload != nil { return nil } return payload}
func (s *pluginTokenStorage) SaveTokenToFile(path string) error { if s == nil { return fmt.Errorf("plugin token storage is nil") } payload, errPayload := mergedStorageJSON(s.rawJSON, s.meta, s.provider) if errPayload != nil { return errPayload } if len(bytes.TrimSpace(payload)) == 0 { return fmt.Errorf("plugin token storage payload is empty") } if pluginTokenStorageFileCurrent(path, payload) { return nil } return atomicWriteFile(path, payload)}
func pluginTokenStorageFileCurrent(path string, payload []byte) bool { if strings.TrimSpace(path) == "" || len(bytes.TrimSpace(payload)) == 0 { return false } current, errRead := os.ReadFile(path) if errRead != nil { return false } return jsonPayloadEqual(current, payload)}
func jsonPayloadEqual(left, right []byte) bool { var leftValue any if errUnmarshalLeft := json.Unmarshal(left, &leftValue); errUnmarshalLeft != nil { return false } var rightValue any if errUnmarshalRight := json.Unmarshal(right, &rightValue); errUnmarshalRight != nil { return false } return reflect.DeepEqual(leftValue, rightValue)}
func mergedStorageJSON(raw []byte, metadata map[string]any, provider string) ([]byte, error) { out := make(map[string]any) if len(bytes.TrimSpace(raw)) > 0 { if errUnmarshal := json.Unmarshal(raw, &out); errUnmarshal != nil { return nil, fmt.Errorf("decode plugin token storage: %w", errUnmarshal) } if out == nil { out = make(map[string]any) } } for key, value := range metadata { out[key] = value } provider = normalizeProviderID(provider) if provider != "" { out["type"] = provider } coreauth.NormalizeCredentialMetadata(out) if len(out) == 0 { return nil, fmt.Errorf("plugin token storage payload is empty") } payload, errMarshal := json.Marshal(out) if errMarshal != nil { return nil, fmt.Errorf("encode plugin token storage: %w", errMarshal) } return payload, nil}
func atomicWriteFile(path string, data []byte) error { path = strings.TrimSpace(path) if path == "" { return fmt.Errorf("path is empty") } dir := filepath.Dir(path) if errMkdir := os.MkdirAll(dir, 0o700); errMkdir != nil { return fmt.Errorf("create auth directory: %w", errMkdir) } tmp, errCreate := os.CreateTemp(dir, ".plugin-auth-*.tmp") if errCreate != nil { return fmt.Errorf("create temp auth file: %w", errCreate) } tmpPath := tmp.Name() defer func() { _ = os.Remove(tmpPath) }() if _, errWrite := tmp.Write(data); errWrite != nil { if errClose := tmp.Close(); errClose != nil { errWrite = fmt.Errorf("%w; close temp auth file: %v", errWrite, errClose) } return fmt.Errorf("write temp auth file: %w", errWrite) } if errClose := tmp.Close(); errClose != nil { return fmt.Errorf("close temp auth file: %w", errClose) } if errRename := os.Rename(tmpPath, path); errRename != nil { return fmt.Errorf("rename temp auth file: %w", errRename) } return nil}
func pluginAuthDataToCoreAuth(data pluginapi.AuthData, path, fileName string, authDir string) *coreauth.Auth { provider := normalizeProviderID(data.Provider) if provider == "" { return nil } metadata := cloneAnyMap(data.Metadata) if metadata == nil { metadata = make(map[string]any) } if provider != "" { metadata["type"] = provider } attributes := cloneStringMap(data.Attributes) if attributes == nil { attributes = make(map[string]string) } path = strings.TrimSpace(path) if path != "" { attributes[coreauth.AttributePath] = path attributes[coreauth.AttributeSource] = path attributes[coreauth.AttributeSourceBackend] = coreauth.AuthSourceFile } fileName = strings.TrimSpace(firstNonEmpty(data.FileName, fileName)) if fileName != "" && attributes[coreauth.AttributeSource] == "" { attributes[coreauth.AttributeSource] = fileName } id := strings.TrimSpace(data.ID) if id == "" { id = authIDForPath(firstNonEmpty(path, fileName), authDir) } status := coreauth.StatusActive if data.Disabled { status = coreauth.StatusDisabled } now := time.Now().UTC() auth := &coreauth.Auth{ Provider: provider, ID: id, FileName: fileName, Label: strings.TrimSpace(data.Label), Prefix: strings.TrimSpace(data.Prefix), ProxyURL: strings.TrimSpace(data.ProxyURL), Disabled: data.Disabled, Status: status, Storage: &pluginTokenStorage{provider: provider, rawJSON: bytes.Clone(data.StorageJSON), meta: metadata}, Metadata: metadata, Attributes: attributes, CreatedAt: now, UpdatedAt: now, NextRefreshAfter: data.NextRefreshAfter, } return auth}
func firstNonEmpty(values ...string) string { for _, value := range values { if trimmed := strings.TrimSpace(value); trimmed != "" { return trimmed } } return ""}