基于Kong开发一个token鉴权插件

complete-plugin

├── api.lua

├── daos.lua

├── handler.lua

├── migrations

│   ├── cassandra.lua

│   └── postgres.lua

└── schema.lua

 > plugins = bundled,custom-plugin

 > lua\_package\_path = ./?.lua;./?/init.lua;/etc/?.lua;

请求包体:
     {
          "access_token":"********" 
     }
返回包体：
    {
        "errcode":0 ,
        "errmsg":"ok" ,     
        "corpid":"xxxxxx",
        "suite_id":"xxxxxx",
        "expire_time": 7200    // token剩余时间, 网关可缓存token和相关的corpid, suitie_id
    }

kong start -c kong.conf --nginx-conf custom\_nginx.template

function TokenAuthHandler:access(conf)
    -- prevent requests set suite_id or corpid by themselves
    kong.service.request.clear_header(SUITE_ID)
    kong.service.request.clear_header(CORPID)

    -- get query parameter
    local access_token = kong.request.get_query_arg(ACCESS_TOKEN)
    local suite_access_token = kong.request.get_query_arg(SUITE_ACCESS_TOKEN)

    -- check access_token
    local username
    if access_token then
        username = verify_token(conf, access_token, false)
    elseif suite_access_token then
        username = verify_token(conf, suite_access_token, true)
    else
        -- if the request does not carry a token, non-whitelist requests will return 403 in the future
        return
    end
    
   	-- rate limit logic
    ... 
   	
end

local function verify_token(conf, token, is_suite)
    local username, cache
    local data_obj, data_json, ttl
    local succ, err

    if is_suite then
        cache = shm_suite
    else
        cache = shm
    end

    data_json, err = cache:get(token)
    if err then
        kong.log.err("shm get token err:", err)
    end

    if data_json then
        kong.log.info("Hit cache:", data_json)
        data_obj = cjson.decode(data_json)
    else
        kong.log.info("No hit cache, start sending http request to verify token...")
        data_obj, ttl = http_verify(conf, token, is_suite)
        data_json = cjson.encode(data_obj)
        succ, err = cache:set(token, data_json, ttl)
        if not succ then
            kong.log.err("shm set token err:", err)
        end
    end

    username = data_obj.suite_id
    kong.service.request.add_header(SUITE_ID, data_obj.suite_id)

    if not is_suite then
        username = username .. "-" .. data_obj.corpid
        kong.service.request.add_header(CORPID, data_obj.corpid)
    end

    return username
end

local typedefs = require "kong.db.schema.typedefs"

return {
    name = "token-auth",
    fields = {
        { protocols = typedefs.protocols_http },
        { config = {
            type = "record",
            fields = {
                { access_token_endpoint = typedefs.url({ required = true }) },
                { suite_access_token_endpoint = typedefs.url({ required = true }) },
                { timeout = { type = "number", default = 5000 }, },
            },
        },
        },
    },
}

local function http_verify(conf, token, is_suite)
    -- determine the parameters of different types of tokens
    local url, body, err_msg
    if is_suite then
        url = conf.suite_access_token_endpoint
        body = cjson.encode({ suite_access_token = token, })
        err_msg = ERRORS_MASSAGE_SUITE
    else
        url = conf.access_token_endpoint
        body = cjson.encode({ access_token = token, })
        err_msg = ERRORS_MASSAGE
    end

    -- send http request
    local httpc = http.new()
    httpc:set_timeout(conf.timeout)

    -- httpc:request_uri(uri, params) will manage connection pool inside, and you can also set keepalive/keepalive_timeout/keepalive_pool in params
    local res, err = httpc:request_uri(url, {
        method = "POST",
        headers = { ["Content-Type"] = "application/json" },
        body = body
    })

    -- handle err results
    local err_resp = {}
    if err ~= nil then
        kong.log.err("send request err:", err)
        err_resp.errcode = ERRORS.INTERNAL_ERROR
        err_resp.errmsg = err_msg[err_resp.errcode]
        return kong.response.exit(403, err_resp, { ["Content-Type"] = "application/json" })
    end

    if res.status ~= 200 then
        kong.log.err("response http status err:", res.status)
        err_resp.errcode = ERRORS.HTTP_STATUS_ERROR
        err_resp.errmsg = err_msg[err_resp.errcode]
        return kong.response.exit(403, err_resp, { ["Content-Type"] = "application/json" })
    end

    local json = cjson.decode(res.body)
    if json.errcode ~= 0 then
        kong.log.err("token invalid, errcode:", json.errcode, " errmsg:", json.errmsg)
        err_resp.errcode = ERRORS.INVALID_TOKEN
        err_resp.errmsg = err_msg[err_resp.errcode]
        return kong.response.exit(403, err_resp, { ["Content-Type"] = "application/json" })
    end

    -- success result
    local data = {}
    data.suite_id = json.suite_id
    if not is_suite then
        data.corpid = json.corpid
    end

    return data, json.expires_in
end

local ERRORS = {
    INVALID_TOKEN = 1,
    INTERNAL_ERROR = 2,
    HTTP_STATUS_ERROR = 3,
    MISSING_TOKEN_PARAMETER = 4,
}

local ERRORS_MASSAGE = {
    [ERRORS.INVALID_TOKEN] = "Invalid access token",
    [ERRORS.INTERNAL_ERROR] = "Check access token internal error",
    [ERRORS.HTTP_STATUS_ERROR] = "Check access token not 200",
}

local ERRORS_MASSAGE_SUITE = {
    [ERRORS.INVALID_TOKEN] = "Invalid suite access token",
    [ERRORS.INTERNAL_ERROR] = "Check suite access token internal error",
    [ERRORS.HTTP_STATUS_ERROR] = "Check suite access token not 200",
}

        local pok, perr, err, new_ttl = xpcall(cb, traceback, ...)
        if not pok then
            return unlock_and_ret(lock, nil, "callback threw an error: " ..
                                  tostring(perr))
        end

function TokenAuthHandler:access(conf)
    -- check token logic
    ...

    -- select consumer
    local cache_key = kong.db.consumers:cache_key(username)
    local consumer = select_consumer(username, cache_key)

    -- insert consumer
    if consumer == nil then
        consumer = insert_consumer(username, cache_key)
    end

    -- set authenticated consumer for rate limiting plugin
    kong.log.info("authenticated_consumer:", consumer.username)
    ngx.ctx.authenticated_consumer = consumer

-- Select consumer from db
local function load_consumer_from_db(username)
    local consumer, err = kong.db.consumers:select_by_username(username)
    if err then
        error(err, 2)
    end

    if not consumer then
        return nil, DB_NOT_FOUND
    end
    return consumer, nil
end

-- Select consumer from cache and db
-- Order: lru -> shm -> callback
local function select_consumer(username, cache_key)
    -- if it is not retrieved in the cache, cache:get performs the callback function and sets the result to the cache (if the callback function does not return an error)
    -- to avoid caching negative results(nil), if not found in db, an error should be returned
    local consumer, err = kong.cache:get(cache_key, nil, load_consumer_from_db, username)
    if err then
        kong.log.err(err)
    end
    return consumer
end

-- Handle concurrent write conflicts
local function handle_error(err_t, username, cache_key)
    if type(err_t) ~= "table" then
        kong.log.err(err_t)
        return nil
    end

    if err_t.code == Errors.codes.UNIQUE_VIOLATION then
        return select_consumer(username, cache_key)
    end
    return nil
end

-- Insert consumer
local function insert_consumer(username, cache_key)
    local consumer, err, err_t
    local dao = kong.db["consumers"]
    local args = { username = username }
    consumer, err, err_t = dao["insert"](dao, args, nil)
    if consumer == nil and err_t ~= nil then
        kong.log.err(err_t)
        consumer = handle_error(err_t, username, cache_key)
    end
    return consumer
end