feat: 建立商品目录接入基础 (#132)

admin/handler/integration/auth.go

@@ -0,0 +1,60 @@
+// Package integration 提供给受信任第三方脚本的 JSON 接口。
+// 它与网页登录和 /api/v1/client 完全隔离，不能复用 Cookie 或 X-Client-Id。
+package integration
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"cmautobuy/admin/config"
+)
+
+const sourceContextKey = "catalog_integration_source"
+
+// RequireCatalogToken 校验商品目录接口的专用 Bearer Token。
+func RequireCatalogToken(cfg config.CatalogIntegrationConfig) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !cfg.Enabled() {
+			integrationError(c, http.StatusServiceUnavailable, "INTEGRATION_DISABLED",
+				"商品目录接口尚未配置", true, nil)
+			c.Abort()
+			return
+		}
+		provided, ok := bearerToken(c.GetHeader("Authorization"))
+		if !ok || subtle.ConstantTimeCompare([]byte(provided), []byte(cfg.Token)) != 1 {
+			integrationError(c, http.StatusUnauthorized, "UNAUTHORIZED",
+				"接口凭据无效", false, nil)
+			c.Abort()
+			return
+		}
+		c.Set(sourceContextKey, cfg.Source)
+		c.Next()
+	}
+}
+
+func bearerToken(header string) (string, bool) {
+	parts := strings.Fields(header)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || parts[1] == "" {
+		return "", false
+	}
+	return parts[1], true
+}
+
+func integrationSource(c *gin.Context) string {
+	value, _ := c.Get(sourceContextKey)
+	source, _ := value.(string)
+	return source
+}
+
+func integrationError(c *gin.Context, status int, code, message string, retryable bool, details any) {
+	if details == nil {
+		details = gin.H{}
+	}
+	c.JSON(status, gin.H{"error": gin.H{
+		"code": code, "message": message, "retryable": retryable,
+		"request_id": c.GetHeader("X-Request-Id"), "details": details,
+	}})
+}