Something went wrong. Try again.
sloproxy
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209package helps
import ( "context" "encoding/json" "errors" "fmt" "net/http" "strings"
"github.com/router-for-me/CLIProxyAPI/v7/internal/config" "github.com/router-for-me/CLIProxyAPI/v7/internal/home" "github.com/router-for-me/CLIProxyAPI/v7/internal/logging" cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth")
type homeStatusErr struct { code int msg string diagnostic string errorType string upstream bool}
func (e homeStatusErr) Error() string { if e.upstream { return e.msg } if e.msg != "" { return e.msg } return fmt.Sprintf("status %d", e.code)}
func (e homeStatusErr) StatusCode() int { return e.code }
func (e homeStatusErr) LogDiagnostic() string { if strings.TrimSpace(e.diagnostic) != "" { return logging.SafeDiagnosticForLog(e.diagnostic) } if e.upstream { return fmt.Sprintf("Home refresh upstream response: status=%d", e.code) } if errorType := strings.ToLower(strings.TrimSpace(e.errorType)); errorType != "" { return logging.SafeDiagnosticForLog("Home refresh failed: type=" + errorType) } return logging.SafeDiagnosticForLog(e.Error())}
func (e homeStatusErr) DirectResponse() bool { return e.upstream }
func (e homeStatusErr) ResponseBody() []byte { if !e.upstream { return nil } return []byte(e.msg)}
type homeErrorEnvelope struct { Error *homeErrorDetail `json:"error"`}
type homeRefreshAuthEnvelope struct { Auth cliproxyauth.Auth `json:"auth"` AuthIndex string `json:"auth_index"`}
type homeErrorDetail struct { Type string `json:"type"` Message string `json:"message"` Code string `json:"code,omitempty"` Diagnostic string `json:"diagnostic,omitempty"` Upstream *homeUpstreamResponse `json:"upstream,omitempty"`}
type homeUpstreamResponse struct { Status int `json:"status"` Body []byte `json:"body"`}
type homeRefreshClient interface { HeartbeatOK() bool GetRefreshAuth(ctx context.Context, authIndex string, accessTokenSHA256 string) ([]byte, error)}
var currentHomeRefreshClient = func() homeRefreshClient { return home.Current()}
// RefreshAuthViaHome replaces local refresh logic when home control plane integration is enabled.// It returns (updatedAuth, true, nil) when home refresh succeeds; (nil, true, err) when home is// enabled but refresh fails; and (nil, false, nil) when home is disabled.func RefreshAuthViaHome(ctx context.Context, cfg *config.Config, auth *cliproxyauth.Auth) (*cliproxyauth.Auth, bool, error) { if cfg == nil || !cfg.Home.Enabled { return nil, false, nil } if ctx == nil { ctx = context.Background() } if auth == nil { return nil, true, homeStatusErr{code: http.StatusInternalServerError, msg: "home refresh: auth is nil"} }
client := currentHomeRefreshClient() if client == nil || !client.HeartbeatOK() { return nil, true, homeStatusErr{code: http.StatusServiceUnavailable, msg: "home control center unavailable"} }
authIndex := strings.TrimSpace(auth.Index) if authIndex == "" { authIndex = strings.TrimSpace(auth.EnsureIndex()) } if authIndex == "" { return nil, true, homeStatusErr{code: http.StatusBadGateway, msg: "home refresh: auth_index is empty"} }
raw, err := client.GetRefreshAuth(ctx, authIndex, authAccessTokenSHA256(auth)) if err != nil { if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) { return nil, true, err } return nil, true, homeStatusErr{ code: http.StatusServiceUnavailable, msg: "home refresh temporarily unavailable", diagnostic: "Home refresh transport failed: " + logging.SafeErrorDiagnostic(err), } }
var env homeErrorEnvelope if errUnmarshal := json.Unmarshal(raw, &env); errUnmarshal == nil && env.Error != nil { code := strings.TrimSpace(env.Error.Type) if code == "" { code = strings.TrimSpace(env.Error.Code) } if env.Error.Upstream != nil { return nil, true, homeStatusErr{ code: env.Error.Upstream.Status, msg: string(env.Error.Upstream.Body), diagnostic: env.Error.Diagnostic, errorType: code, upstream: true, } } statusCode := statusFromHomeErrorCode(code) message := "credential refresh temporarily unavailable" switch statusCode { case http.StatusUnauthorized: message = "credential unauthorized" case http.StatusNotFound: message = "credential refresh target not found" } return nil, true, homeStatusErr{code: statusCode, msg: message, diagnostic: env.Error.Diagnostic, errorType: code} }
updated, returnedIndex, errParse := parseHomeRefreshAuth(raw) if errParse != nil { return nil, true, homeStatusErr{ code: http.StatusBadGateway, msg: "home returned invalid auth payload", diagnostic: "Home refresh response decode failed: " + logging.SafeErrorDiagnostic(errParse), } } if updated.Disabled || updated.Status == cliproxyauth.StatusDisabled { return nil, true, homeStatusErr{code: http.StatusUnauthorized, msg: "credential unauthorized"} } if returnedIndex != "" { authIndex = returnedIndex } updated.Index = authIndex updated.EnsureIndex() return updated, true, nil}
func authAccessTokenSHA256(auth *cliproxyauth.Auth) string { return cliproxyauth.AccessTokenSHA256(auth)}
func parseHomeRefreshAuth(raw []byte) (*cliproxyauth.Auth, string, error) { var rawObject map[string]json.RawMessage if errUnmarshal := json.Unmarshal(raw, &rawObject); errUnmarshal != nil { return nil, "", errUnmarshal } if _, ok := rawObject["auth"]; ok { var envelope homeRefreshAuthEnvelope if errUnmarshal := json.Unmarshal(raw, &envelope); errUnmarshal != nil { return nil, "", errUnmarshal } return &envelope.Auth, strings.TrimSpace(envelope.AuthIndex), nil } var updated cliproxyauth.Auth if errUnmarshal := json.Unmarshal(raw, &updated); errUnmarshal != nil { return nil, "", errUnmarshal } return &updated, "", nil}
func statusFromHomeErrorCode(code string) int { switch strings.ToLower(strings.TrimSpace(code)) { case "authentication_error", "unauthorized", "invalid_grant", "refresh_token_expired", "refresh_token_revoked", "refresh_token_reused": return http.StatusUnauthorized case "model_not_found": return http.StatusNotFound case "auth_not_found", "auth_unavailable", "refresh_temporarily_unavailable", "refresh_unsupported", "home_unavailable": return http.StatusServiceUnavailable default: return http.StatusServiceUnavailable }}