i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 17:30:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): 添加 Turnstile 注册防护

Browse Source
This commit is contained in:
Entropy.Xu
2026-05-15 01:54:20 +08:00
parent bf511f9f8c
commit 85f48123b6
25 changed files with 1705 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/aether-gateway/src/handlers/proxy/mod.rs
View File

@@ -1054,6 +1054,10 @@ pub(crate) async fn proxy_request(
&state,
&request_context,
&parts.headers,
parts
.extensions
.get::<crate::middleware::CfConnectingIp>()
.map(|value| value.0.as_str()),
local_proxy_body.as_ref(),
)
.await

11
apps/aether-gateway/src/handlers/public/support.rs
View File

@@ -106,6 +106,7 @@ pub(crate) async fn maybe_build_local_public_support_response(
state: &AppState,
request_context: &GatewayPublicRequestContext,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
request_body: Option<&Bytes>,
) -> Option<Response<Body>> {
let decision = request_context.control_decision.as_ref()?;
@@ -114,8 +115,14 @@ pub(crate) async fn maybe_build_local_public_support_response(
}
if decision.route_family.as_deref() == Some("auth") {
return maybe_build_local_auth_response(state, request_context, headers, request_body)
.await;
return maybe_build_local_auth_response(
state,
request_context,
headers,
cf_connecting_ip,
request_body,
)
.await;
}
if decision.route_family.as_deref() == Some("oauth") {

25
apps/aether-gateway/src/handlers/public/support/auth.rs
View File

@@ -22,6 +22,10 @@ pub(crate) use auth_helpers::*;
mod auth_email;
use auth_email::*;
#[path = "auth_turnstile.rs"]
mod auth_turnstile;
use auth_turnstile::*;
#[path = "auth_ldap.rs"]
mod auth_ldap;
use auth_ldap::*;
@@ -258,6 +262,7 @@ pub(super) async fn maybe_build_local_auth_response(
state: &AppState,
request_context: &GatewayPublicRequestContext,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
request_body: Option<&axum::body::Bytes>,
) -> Option<Response<Body>> {
let decision = request_context.control_decision.as_ref()?;
@@ -269,13 +274,16 @@ pub(super) async fn maybe_build_local_auth_response(
Some("send_verification_code")
if request_context.request_path == "/api/auth/send-verification-code" =>
{
Some(handle_auth_send_verification_code(state, request_body).await)
Some(
handle_auth_send_verification_code(state, headers, cf_connecting_ip, request_body)
.await,
)
}
Some("login") if request_context.request_path == "/api/auth/login" => {
Some(handle_auth_login(state, request_context, headers, request_body).await)
}
Some("register") if request_context.request_path == "/api/auth/register" => {
Some(handle_auth_register(state, request_body).await)
Some(handle_auth_register(state, headers, cf_connecting_ip, request_body).await)
}
Some("verify_email") if request_context.request_path == "/api/auth/verify-email" => {
Some(handle_auth_verify_email(state, request_body).await)
@@ -325,10 +333,15 @@ mod tests {
async fn auth_unhandled_route_returns_local_not_implemented_response() {
let state = AppState::new().expect("gateway should build");
let request_context = request_context(Method::POST, "/api/auth/login/history", "login");
let response =
maybe_build_local_auth_response(&state, &request_context, &HeaderMap::new(), None)
.await
.expect("auth handler should return response");
let response = maybe_build_local_auth_response(
&state,
&request_context,
&HeaderMap::new(),
None,
None,
)
.await
.expect("auth handler should return response");
assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
let body = to_bytes(response.into_body(), usize::MAX)

22
apps/aether-gateway/src/handlers/public/support/auth_helpers.rs
View File

@@ -20,6 +20,12 @@ pub(crate) async fn build_auth_registration_settings_payload(
let password_policy_level_config = state
.read_system_config_json_value("password_policy_level")
.await?;
let turnstile_enabled_config = state
.read_system_config_json_value("turnstile_enabled")
.await?;
let turnstile_site_key_config = state
.read_system_config_json_value("turnstile_site_key")
.await?;
let email_configured = smtp_host
.as_ref()
@@ -40,12 +46,17 @@ pub(crate) async fn build_auth_registration_settings_payload(
Some(value) if matches!(value.as_str(), "weak" | "medium" | "strong") => value,
_ => "weak".to_string(),
};
let turnstile_enabled = system_config_bool(turnstile_enabled_config.as_ref(), false);
let turnstile_site_key = system_config_string(turnstile_site_key_config.as_ref());
Ok(json!({
"enable_registration": enable_registration,
"require_email_verification": require_email_verification,
"email_configured": email_configured,
"password_policy_level": password_policy_level,
"turnstile_enabled": turnstile_enabled,
"turnstile_site_key": turnstile_site_key,
"turnstile_required_actions": ["send_verification_code", "register"],
}))
}
@@ -290,6 +301,17 @@ pub(super) fn auth_client_ip(headers: &http::HeaderMap) -> Option<String> {
})
}
pub(super) fn auth_client_ip_with_cf(
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
) -> Option<String> {
cf_connecting_ip
.map(str::trim)
.filter(|value| !value.is_empty())
.map(|value| value.chars().take(45).collect())
.or_else(|| auth_client_ip(headers))
}
pub(super) fn normalize_auth_login_identifier(value: &str) -> String {
let normalized = value.trim();
if normalized.contains('@') {

33
apps/aether-gateway/src/handlers/public/support/auth_registration.rs
View File

@@ -5,7 +5,8 @@ use super::{
clear_auth_email_pending_code, clear_auth_email_verification, generate_auth_verification_code,
http, json, mark_auth_email_verified, read_auth_email_verification_code, read_auth_smtp_config,
send_auth_email, store_auth_email_verification_code, system_config_bool, system_config_f64,
system_config_string, system_config_string_list, AppState, Body, GatewayError, Regex, Response,
system_config_string, system_config_string_list, verify_auth_turnstile, AppState,
AuthTurnstileAction, Body, GatewayError, Regex, Response,
};
use serde::Deserialize;
@@ -16,11 +17,13 @@ struct AuthRegisterRequest {
email: Option<String>,
username: String,
password: String,
turnstile_token: Option<String>,
}
#[derive(Debug, Deserialize)]
struct AuthEmailRequest {
email: String,
turnstile_token: Option<String>,
}
#[derive(Debug, Deserialize)]
@@ -176,6 +179,8 @@ async fn validate_auth_email_suffix(
pub(super) async fn handle_auth_send_verification_code(
state: &AppState,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
request_body: Option<&axum::body::Bytes>,
) -> Response<Body> {
let Some(request_body) = request_body else {
@@ -195,6 +200,18 @@ pub(super) async fn handle_auth_send_verification_code(
return build_auth_error_response(http::StatusCode::BAD_REQUEST, "邮箱格式无效", false);
};
if let Err(response) = verify_auth_turnstile(
state,
headers,
cf_connecting_ip,
payload.turnstile_token.as_deref(),
AuthTurnstileAction::SendVerificationCode,
)
.await
{
return response;
}
if state
.find_user_auth_by_identifier(&email)
.await
@@ -316,6 +333,8 @@ pub(super) async fn handle_auth_send_verification_code(
pub(super) async fn handle_auth_register(
state: &AppState,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
request_body: Option<&axum::body::Bytes>,
) -> Response<Body> {
let Some(request_body) = request_body else {
@@ -370,6 +389,18 @@ pub(super) async fn handle_auth_register(
return build_auth_error_response(http::StatusCode::FORBIDDEN, "系统暂不开放注册", false);
}
if let Err(response) = verify_auth_turnstile(
state,
headers,
cf_connecting_ip,
payload.turnstile_token.as_deref(),
AuthTurnstileAction::Register,
)
.await
{
return response;
}
let email_configured = match auth_registration_email_configured(state).await {
Ok(value) => value,
Err(err) => {

275
apps/aether-gateway/src/handlers/public/support/auth_turnstile.rs Normal file
View File

@@ -0,0 +1,275 @@
use super::{
auth_client_ip_with_cf, build_auth_error_response, decrypt_catalog_secret_with_fallbacks, http,
system_config_bool, system_config_string, system_config_string_list, AppState, Body, Response,
};
use serde::{Deserialize, Serialize};
use std::time::Duration;
use tracing::warn;
const TURNSTILE_SITEVERIFY_URL: &str = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
const TURNSTILE_TOKEN_MAX_LEN: usize = 2048;
const TURNSTILE_SITEVERIFY_TIMEOUT: Duration = Duration::from_secs(10);
#[derive(Debug, Clone, Copy)]
pub(super) enum AuthTurnstileAction {
SendVerificationCode,
Register,
}
impl AuthTurnstileAction {
pub(super) const fn as_str(self) -> &'static str {
match self {
Self::SendVerificationCode => "send_verification_code",
Self::Register => "register",
}
}
}
#[derive(Debug)]
struct AuthTurnstileConfig {
enabled: bool,
site_key: Option<String>,
secret_key: Option<String>,
allowed_hostnames: Vec<String>,
}
#[derive(Debug, Serialize)]
struct TurnstileSiteverifyRequest<'a> {
secret: &'a str,
response: &'a str,
#[serde(skip_serializing_if = "Option::is_none")]
remoteip: Option<&'a str>,
idempotency_key: String,
}
#[derive(Debug, Deserialize)]
struct TurnstileSiteverifyResponse {
#[serde(default)]
success: bool,
#[serde(default)]
action: Option<String>,
#[serde(default)]
hostname: Option<String>,
#[serde(default, rename = "error-codes")]
error_codes: Vec<String>,
}
enum AuthTurnstileFailure {
BadRequest(&'static str),
ServiceUnavailable(&'static str),
}
impl AuthTurnstileFailure {
fn into_response(self) -> Response<Body> {
match self {
Self::BadRequest(detail) => {
build_auth_error_response(http::StatusCode::BAD_REQUEST, detail, false)
}
Self::ServiceUnavailable(detail) => {
build_auth_error_response(http::StatusCode::SERVICE_UNAVAILABLE, detail, false)
}
}
}
}
pub(super) async fn verify_auth_turnstile(
state: &AppState,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
token: Option<&str>,
action: AuthTurnstileAction,
) -> Result<(), Response<Body>> {
match verify_auth_turnstile_inner(state, headers, cf_connecting_ip, token, action).await {
Ok(()) => Ok(()),
Err(err) => Err(err.into_response()),
}
}
async fn verify_auth_turnstile_inner(
state: &AppState,
headers: &http::HeaderMap,
cf_connecting_ip: Option<&str>,
token: Option<&str>,
action: AuthTurnstileAction,
) -> Result<(), AuthTurnstileFailure> {
let config = read_auth_turnstile_config(state).await?;
if !config.enabled {
return Ok(());
}
let (Some(_site_key), Some(secret_key)) =
(config.site_key.as_deref(), config.secret_key.as_deref())
else {
warn!("turnstile is enabled but site key or secret key is missing");
return Err(AuthTurnstileFailure::ServiceUnavailable(
"人机验证服务暂不可用，请稍后重试",
));
};
let token = token
.map(str::trim)
.filter(|value| !value.is_empty())
.ok_or(AuthTurnstileFailure::BadRequest("请先完成人机验证"))?;
if token.len() > TURNSTILE_TOKEN_MAX_LEN {
warn!(
token_len = token.len(),
"turnstile token exceeds maximum length"
);
return Err(AuthTurnstileFailure::BadRequest("人机验证失败，请重试"));
}
let remoteip = auth_client_ip_with_cf(headers, cf_connecting_ip);
let siteverify_request = TurnstileSiteverifyRequest {
secret: secret_key,
response: token,
remoteip: remoteip.as_deref(),
idempotency_key: uuid::Uuid::new_v4().to_string(),
};
let siteverify_url = turnstile_siteverify_url(state);
let response = tokio::time::timeout(
turnstile_siteverify_timeout(state),
state
.client
.post(siteverify_url)
.form(&siteverify_request)
.send(),
)
.await
.map_err(|_| {
warn!("turnstile siteverify request timed out");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?
.map_err(|err| {
warn!(error = %err, "turnstile siteverify request failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
if !response.status().is_success() {
let status = response.status().as_u16();
warn!(
status,
"turnstile siteverify returned non-success HTTP status"
);
return Err(AuthTurnstileFailure::ServiceUnavailable(
"人机验证服务暂不可用，请稍后重试",
));
}
let payload = response
.json::<TurnstileSiteverifyResponse>()
.await
.map_err(|err| {
warn!(error = %err, "turnstile siteverify response decode failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
if !payload.success {
warn!(
error_codes = ?payload.error_codes,
action = ?payload.action,
hostname = ?payload.hostname,
"turnstile siteverify rejected token"
);
if turnstile_siteverify_error_is_service_unavailable(&payload.error_codes) {
return Err(AuthTurnstileFailure::ServiceUnavailable(
"人机验证服务暂不可用，请稍后重试",
));
}
return Err(AuthTurnstileFailure::BadRequest("人机验证失败，请重试"));
}
if payload.action.as_deref() != Some(action.as_str()) {
warn!(
expected_action = action.as_str(),
actual_action = ?payload.action,
"turnstile siteverify action mismatch"
);
return Err(AuthTurnstileFailure::BadRequest("人机验证失败，请重试"));
}
if !config.allowed_hostnames.is_empty() {
let Some(hostname) = payload.hostname.as_deref().map(str::to_ascii_lowercase) else {
warn!("turnstile siteverify response missing hostname");
return Err(AuthTurnstileFailure::BadRequest("人机验证失败，请重试"));
};
if !config
.allowed_hostnames
.iter()
.any(|allowed| allowed == &hostname)
{
warn!(
hostname = %hostname,
allowed_hostnames = ?config.allowed_hostnames,
"turnstile siteverify hostname mismatch"
);
return Err(AuthTurnstileFailure::BadRequest("人机验证失败，请重试"));
}
}
Ok(())
}
fn turnstile_siteverify_error_is_service_unavailable(error_codes: &[String]) -> bool {
error_codes.iter().any(|code| {
matches!(
code.trim().to_ascii_lowercase().as_str(),
"missing-input-secret" | "invalid-input-secret" | "internal-error"
)
})
}
async fn read_auth_turnstile_config(
state: &AppState,
) -> Result<AuthTurnstileConfig, AuthTurnstileFailure> {
let enabled = state
.read_system_config_json_value("turnstile_enabled")
.await
.map_err(|err| {
warn!(error = ?err, "turnstile enabled config lookup failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
let site_key = state
.read_system_config_json_value("turnstile_site_key")
.await
.map_err(|err| {
warn!(error = ?err, "turnstile site key config lookup failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
let secret_key = state
.read_system_config_json_value("turnstile_secret_key")
.await
.map_err(|err| {
warn!(error = ?err, "turnstile secret key config lookup failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
let allowed_hostnames = state
.read_system_config_json_value("turnstile_allowed_hostnames")
.await
.map_err(|err| {
warn!(error = ?err, "turnstile hostname config lookup failed");
AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
})?;
let secret_key = system_config_string(secret_key.as_ref()).map(|value| {
decrypt_catalog_secret_with_fallbacks(state.encryption_key(), &value).unwrap_or(value)
});
Ok(AuthTurnstileConfig {
enabled: system_config_bool(enabled.as_ref(), false),
site_key: system_config_string(site_key.as_ref()),
secret_key,
allowed_hostnames: system_config_string_list(allowed_hostnames.as_ref()),
})
}
fn turnstile_siteverify_url(state: &AppState) -> &str {
#[cfg(test)]
if let Some(url) = state.turnstile_siteverify_url_override.as_deref() {
return url;
}
TURNSTILE_SITEVERIFY_URL
}
fn turnstile_siteverify_timeout(state: &AppState) -> Duration {
#[cfg(test)]
if let Some(timeout) = state.turnstile_siteverify_timeout_override {
return timeout;
}
TURNSTILE_SITEVERIFY_TIMEOUT
}