⚠️ 应用类型约束:当前实现仅支持「钉钉登录-企业内部应用」(DingTalk 开放平台
internal_app 类型)。第三方个人应用、第三方企业应用类型暂不支持——OAuth 流程
相同但 corp 校验、跨企业行为不同。backend 通过 DingTalkAppKind 校验对非
internal_app 类型 fail-closed(硬约束)。
钉钉 OAuth 登录主链
- 4 步 OAuth 链:ExchangeCodeForUserToken / GetUnionIdByUserToken /
GetUserIdByUnionId / GetStaffInfoByUserId;app token 缓存
- pending session 机制持久化 OAuth 中间态;cookie-only token 持久化
- 三种分流:bind_login_required / email_completion / choose_account_action
- corp_restriction_policy 支持 none + internal_only;stale "whitelist" 在
加载层与写入层均静默 coerce 为 none + slog.Warn
- bypass_registration 开关:企业内部模式豁免全局 REGISTRATION_DISABLED
- isReservedEmail / signup_source / canUnbindProvider / OAuth pending flow
等横切点支持 dingtalk provider
- migration 136:4 表 CHECK 约束加入 'dingtalk' provider 值
internal_only 模式同步企业邮箱/姓名/部门到用户属性
- SyncCorpEmail / SyncDisplayName / SyncDept 三个独立开关 + 对应
SyncXxxAttrKey 目标属性 key(默认 dingtalk_email / dingtalk_name /
dingtalk_department);非 internal_only policy 在写入层与加载层均
coerce 为 false,admin handler 与 setting_service 双层兜底
- 同步语义:首次注册写 users.username(昵称优先 → 企业姓名 fallback),
之后每次登录刷新 3 个属性;空值也写入以覆盖旧值
- 邮箱三级 fallback:org_email > email > extension["企业邮箱"]
(钉钉自定义字段 JSON)
- 部门路径递归向上拼接,跳过 dept_id=1 选首个真实子部门,剥离根组织名
- GetUnionIdByUserToken 同时返回 OIDC /contact/users/me 的 nick 字段;
新增 GetDeptInfo 调用 OAPI /topapi/v2/department/get
- AuthHandler 注入 UserAttributeService;OAuth pending flow 在
createPendingOAuthAccount / bindPendingOAuthLogin 分别派发到
AfterRegistration(syncUsername=true)/ AfterLogin
- migration 137 seed dingtalk_email/name/department 三个用户属性定义
附带修复(同集成路径暴露的两个 OAuth 注册回归)
- LoginOrRegisterOAuthWithTokenPair 新建用户分支用 inferLegacySignupSource
覆写 caller 显式传入的 signupSource,导致 dingtalk/linuxdo/oidc/wechat
渠道授权按 email 渠道读取;改为只在 caller 未显式传入时回退邮箱推断
- mergeProviderDefaultGrantSettings 把 parse fallback 默认值
(Concurrency=5 / Balance=0) 当作"未配置"哨兵,admin 显式设 5 时被误判
退回全局默认(复现:全局默认 1 + 渠道默认并发 5 + grant_on_signup → 新
用户实际 concurrency=1);去掉哨兵,admin 任何 >=0 值都覆盖 globalDefaults
前端
- DingTalk Login / Callback / EmailCompletion / ChoiceAccount / Error
视图;router + auth API client
- admin SettingsView:corp policy radio(none / internal_only)+ bypass
注册开关 + i18n;internal_only 下展示三同步开关 + 目标 attr key 下拉
(拉取 user attribute definitions),展示 fieldEmail /
qyapi_get_department_list 钉钉权限申请提示
- Profile:S1 主动绑定 / S5 解绑钉钉按钮 + 合成邮箱防自锁
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
329 lines
8.8 KiB
Go
329 lines
8.8 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
|
|
infraerrors "github.com/Wei-Shaw/sub2api/internal/pkg/errors"
|
|
)
|
|
|
|
// UserAttributeService handles attribute management
|
|
type UserAttributeService struct {
|
|
defRepo UserAttributeDefinitionRepository
|
|
valueRepo UserAttributeValueRepository
|
|
}
|
|
|
|
// NewUserAttributeService creates a new service instance
|
|
func NewUserAttributeService(
|
|
defRepo UserAttributeDefinitionRepository,
|
|
valueRepo UserAttributeValueRepository,
|
|
) *UserAttributeService {
|
|
return &UserAttributeService{
|
|
defRepo: defRepo,
|
|
valueRepo: valueRepo,
|
|
}
|
|
}
|
|
|
|
// CreateDefinition creates a new attribute definition
|
|
func (s *UserAttributeService) CreateDefinition(ctx context.Context, input CreateAttributeDefinitionInput) (*UserAttributeDefinition, error) {
|
|
// Validate type
|
|
if !isValidAttributeType(input.Type) {
|
|
return nil, ErrInvalidAttributeType
|
|
}
|
|
|
|
// Check if key exists
|
|
exists, err := s.defRepo.ExistsByKey(ctx, input.Key)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("check key exists: %w", err)
|
|
}
|
|
if exists {
|
|
return nil, ErrAttributeKeyExists
|
|
}
|
|
|
|
def := &UserAttributeDefinition{
|
|
Key: input.Key,
|
|
Name: input.Name,
|
|
Description: input.Description,
|
|
Type: input.Type,
|
|
Options: input.Options,
|
|
Required: input.Required,
|
|
Validation: input.Validation,
|
|
Placeholder: input.Placeholder,
|
|
Enabled: input.Enabled,
|
|
}
|
|
|
|
if err := validateDefinitionPattern(def); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := s.defRepo.Create(ctx, def); err != nil {
|
|
return nil, fmt.Errorf("create definition: %w", err)
|
|
}
|
|
|
|
return def, nil
|
|
}
|
|
|
|
// GetDefinition retrieves a definition by ID
|
|
func (s *UserAttributeService) GetDefinition(ctx context.Context, id int64) (*UserAttributeDefinition, error) {
|
|
return s.defRepo.GetByID(ctx, id)
|
|
}
|
|
|
|
// GetDefinitionByKey retrieves a definition by its unique key
|
|
func (s *UserAttributeService) GetDefinitionByKey(ctx context.Context, key string) (*UserAttributeDefinition, error) {
|
|
return s.defRepo.GetByKey(ctx, key)
|
|
}
|
|
|
|
// ListDefinitions lists all definitions
|
|
func (s *UserAttributeService) ListDefinitions(ctx context.Context, enabledOnly bool) ([]UserAttributeDefinition, error) {
|
|
return s.defRepo.List(ctx, enabledOnly)
|
|
}
|
|
|
|
// UpdateDefinition updates an existing definition
|
|
func (s *UserAttributeService) UpdateDefinition(ctx context.Context, id int64, input UpdateAttributeDefinitionInput) (*UserAttributeDefinition, error) {
|
|
def, err := s.defRepo.GetByID(ctx, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if input.Name != nil {
|
|
def.Name = *input.Name
|
|
}
|
|
if input.Description != nil {
|
|
def.Description = *input.Description
|
|
}
|
|
if input.Type != nil {
|
|
if !isValidAttributeType(*input.Type) {
|
|
return nil, ErrInvalidAttributeType
|
|
}
|
|
def.Type = *input.Type
|
|
}
|
|
if input.Options != nil {
|
|
def.Options = *input.Options
|
|
}
|
|
if input.Required != nil {
|
|
def.Required = *input.Required
|
|
}
|
|
if input.Validation != nil {
|
|
def.Validation = *input.Validation
|
|
}
|
|
if input.Placeholder != nil {
|
|
def.Placeholder = *input.Placeholder
|
|
}
|
|
if input.Enabled != nil {
|
|
def.Enabled = *input.Enabled
|
|
}
|
|
|
|
if err := validateDefinitionPattern(def); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := s.defRepo.Update(ctx, def); err != nil {
|
|
return nil, fmt.Errorf("update definition: %w", err)
|
|
}
|
|
|
|
return def, nil
|
|
}
|
|
|
|
// DeleteDefinition soft-deletes a definition and hard-deletes associated values
|
|
func (s *UserAttributeService) DeleteDefinition(ctx context.Context, id int64) error {
|
|
// Check if definition exists
|
|
_, err := s.defRepo.GetByID(ctx, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// First delete all values (hard delete)
|
|
if err := s.valueRepo.DeleteByAttributeID(ctx, id); err != nil {
|
|
return fmt.Errorf("delete values: %w", err)
|
|
}
|
|
|
|
// Then soft-delete the definition
|
|
if err := s.defRepo.Delete(ctx, id); err != nil {
|
|
return fmt.Errorf("delete definition: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ReorderDefinitions updates display order for multiple definitions
|
|
func (s *UserAttributeService) ReorderDefinitions(ctx context.Context, orders map[int64]int) error {
|
|
return s.defRepo.UpdateDisplayOrders(ctx, orders)
|
|
}
|
|
|
|
// GetUserAttributes retrieves all attribute values for a user
|
|
func (s *UserAttributeService) GetUserAttributes(ctx context.Context, userID int64) ([]UserAttributeValue, error) {
|
|
return s.valueRepo.GetByUserID(ctx, userID)
|
|
}
|
|
|
|
// GetBatchUserAttributes retrieves attribute values for multiple users
|
|
// Returns a map of userID -> map of attributeID -> value
|
|
func (s *UserAttributeService) GetBatchUserAttributes(ctx context.Context, userIDs []int64) (map[int64]map[int64]string, error) {
|
|
values, err := s.valueRepo.GetByUserIDs(ctx, userIDs)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
result := make(map[int64]map[int64]string)
|
|
for _, v := range values {
|
|
if result[v.UserID] == nil {
|
|
result[v.UserID] = make(map[int64]string)
|
|
}
|
|
result[v.UserID][v.AttributeID] = v.Value
|
|
}
|
|
|
|
return result, nil
|
|
}
|
|
|
|
// UpdateUserAttributes batch updates attribute values for a user
|
|
func (s *UserAttributeService) UpdateUserAttributes(ctx context.Context, userID int64, inputs []UpdateUserAttributeInput) error {
|
|
// Validate all values before updating
|
|
defs, err := s.defRepo.List(ctx, true)
|
|
if err != nil {
|
|
return fmt.Errorf("list definitions: %w", err)
|
|
}
|
|
|
|
defMap := make(map[int64]*UserAttributeDefinition, len(defs))
|
|
for i := range defs {
|
|
defMap[defs[i].ID] = &defs[i]
|
|
}
|
|
|
|
for _, input := range inputs {
|
|
def, ok := defMap[input.AttributeID]
|
|
if !ok {
|
|
return ErrAttributeDefinitionNotFound
|
|
}
|
|
|
|
if err := s.validateValue(def, input.Value); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
return s.valueRepo.UpsertBatch(ctx, userID, inputs)
|
|
}
|
|
|
|
// validateValue validates a value against its definition
|
|
func (s *UserAttributeService) validateValue(def *UserAttributeDefinition, value string) error {
|
|
// Skip validation for empty non-required fields
|
|
if value == "" && !def.Required {
|
|
return nil
|
|
}
|
|
|
|
// Required check
|
|
if def.Required && value == "" {
|
|
return validationError(fmt.Sprintf("%s is required", def.Name))
|
|
}
|
|
|
|
v := def.Validation
|
|
|
|
// String length validation
|
|
if v.MinLength != nil && len(value) < *v.MinLength {
|
|
return validationError(fmt.Sprintf("%s must be at least %d characters", def.Name, *v.MinLength))
|
|
}
|
|
if v.MaxLength != nil && len(value) > *v.MaxLength {
|
|
return validationError(fmt.Sprintf("%s must be at most %d characters", def.Name, *v.MaxLength))
|
|
}
|
|
|
|
// Number validation
|
|
if def.Type == AttributeTypeNumber && value != "" {
|
|
num, err := strconv.Atoi(value)
|
|
if err != nil {
|
|
return validationError(fmt.Sprintf("%s must be a number", def.Name))
|
|
}
|
|
if v.Min != nil && num < *v.Min {
|
|
return validationError(fmt.Sprintf("%s must be at least %d", def.Name, *v.Min))
|
|
}
|
|
if v.Max != nil && num > *v.Max {
|
|
return validationError(fmt.Sprintf("%s must be at most %d", def.Name, *v.Max))
|
|
}
|
|
}
|
|
|
|
// Pattern validation
|
|
if v.Pattern != nil && *v.Pattern != "" && value != "" {
|
|
re, err := regexp.Compile(*v.Pattern)
|
|
if err != nil {
|
|
return validationError(def.Name + " has an invalid pattern")
|
|
}
|
|
if !re.MatchString(value) {
|
|
msg := def.Name + " format is invalid"
|
|
if v.Message != nil && *v.Message != "" {
|
|
msg = *v.Message
|
|
}
|
|
return validationError(msg)
|
|
}
|
|
}
|
|
|
|
// Select validation
|
|
if def.Type == AttributeTypeSelect && value != "" {
|
|
found := false
|
|
for _, opt := range def.Options {
|
|
if opt.Value == value {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
return validationError(fmt.Sprintf("%s: invalid option", def.Name))
|
|
}
|
|
}
|
|
|
|
// Multi-select validation (stored as JSON array)
|
|
if def.Type == AttributeTypeMultiSelect && value != "" {
|
|
var values []string
|
|
if err := json.Unmarshal([]byte(value), &values); err != nil {
|
|
// Try comma-separated fallback
|
|
values = strings.Split(value, ",")
|
|
}
|
|
for _, val := range values {
|
|
val = strings.TrimSpace(val)
|
|
found := false
|
|
for _, opt := range def.Options {
|
|
if opt.Value == val {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
return validationError(fmt.Sprintf("%s: invalid option %s", def.Name, val))
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// validationError creates a validation error with a custom message
|
|
func validationError(msg string) error {
|
|
return infraerrors.BadRequest("ATTRIBUTE_VALIDATION_FAILED", msg)
|
|
}
|
|
|
|
func isValidAttributeType(t UserAttributeType) bool {
|
|
switch t {
|
|
case AttributeTypeText, AttributeTypeTextarea, AttributeTypeNumber,
|
|
AttributeTypeEmail, AttributeTypeURL, AttributeTypeDate,
|
|
AttributeTypeSelect, AttributeTypeMultiSelect:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func validateDefinitionPattern(def *UserAttributeDefinition) error {
|
|
if def == nil {
|
|
return nil
|
|
}
|
|
if def.Validation.Pattern == nil {
|
|
return nil
|
|
}
|
|
pattern := strings.TrimSpace(*def.Validation.Pattern)
|
|
if pattern == "" {
|
|
return nil
|
|
}
|
|
if _, err := regexp.Compile(pattern); err != nil {
|
|
return infraerrors.BadRequest("INVALID_ATTRIBUTE_PATTERN", fmt.Sprintf("invalid pattern for %s: %v", def.Name, err))
|
|
}
|
|
return nil
|
|
}
|