Skip to content

Commit ca7ec36

Browse files
anny1021anny1021
authored
Merge pull request #611 from actiontech/feature/sqle-ee-2265
[feature](base/Oauth2): update OAuth2 configuration and refresh token mechanism
2 parents 560288b + b8ab7e5 commit ca7ec36

File tree

18 files changed

+1179
-68
lines changed

18 files changed

+1179
-68
lines changed

‎packages/base/src/locale/zh-CN/dmsSystem.ts

+5-1
Original file line numberDiff line numberDiff line change
@@ -144,11 +144,15 @@ export default {
144144
skipStateCheckTips:
145145
'跳过对请求发送来源的验证，可能会使您的账户面临安全风险，建议仅在可信环境下启用此选项。启用后，SQLE将不再验证回调中的state参数。',
146146
layoutUrl: '注销跳转地址',
147+
backChannelLogoutUri: 'OIDC后端通道注销接口',
147148
layoutUrlTips:
148149
'用户登出时，系统自动将浏览器重定向至此地址进行注销操作，以关闭第三方平台的会话信息。格式示例：http://localhost:8080/logout?id_token_hint=${id_token}&post_logout_redirect_uri=${sqle_url}',
149150
userPassword: '默认登录密码',
150151
userPasswordTips:
151-
'系统自动创建的新用户将使用此密码作为初始登录密码，请妥善保存。此外，为保证账户安全，建议用户首次登录后及时修改密码。如果之前配置过该项，更新时不填写该项代表不更新密钥。'
152+
'系统自动创建的新用户将使用此密码作为初始登录密码，请妥善保存。此外，为保证账户安全，建议用户首次登录后及时修改密码。如果之前配置过该项，更新时不填写该项代表不更新密钥。',
153+
loginPermissionQueryGJsonExpression: '登录权限查询GJSON表达式',
154+
loginPermissionQueryGJsonExpressionTips:
155+
'通过该表达式查询AccessToken载荷json，存在查询结果即有登录权限，不填默认有登录权限'
152156
},
153157

154158
loginBasic: {

‎packages/base/src/page/System/LoginConnection/Oauth/__snapshots__/index.test.tsx.snap

+392
Large diffs are not rendered by default.

‎packages/base/src/page/System/LoginConnection/Oauth/components/ConfigField.tsx

+16
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,22 @@ const ConfigField = () => {
285285
})}
286286
/>
287287
</FormItemLabel>
288+
<FormItemLabel
289+
className="has-label-tip"
290+
label={
291+
<CustomLabelContent
292+
title={t('dmsSystem.oauth.loginPermissionQueryGJsonExpression')}
293+
tips={t('dmsSystem.oauth.loginPermissionQueryGJsonExpressionTips')}
294+
/>
295+
}
296+
name="loginPermissionQueryGJsonExpression"
297+
>
298+
<BasicInput
299+
placeholder={t('common.form.placeholder.input', {
300+
name: t('dmsSystem.oauth.loginPermissionQueryGJsonExpression')
301+
})}
302+
/>
303+
</FormItemLabel>
288304
<FormItemLabel
289305
className="has-label-tip"
290306
label={

‎packages/base/src/page/System/LoginConnection/Oauth/components/__snapshots__/ConfigField.test.tsx.snap

+49
Original file line numberDiff line numberDiff line change
@@ -650,6 +650,55 @@ exports[`base/System/LoginConnection/Oauth/ConfigField render snap 1`] = `
650650
</div>
651651
</div>
652652
</div>
653+
<div
654+
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
655+
>
656+
<div
657+
class="ant-row ant-form-item-row css-dev-only-do-not-override-txh9fw"
658+
>
659+
<div
660+
class="ant-col ant-form-item-label css-dev-only-do-not-override-txh9fw"
661+
>
662+
<label
663+
class=""
664+
for="loginPermissionQueryGJsonExpression"
665+
title=""
666+
>
667+
<div
668+
class="label-cont-custom"
669+
>
670+
<div>
671+
登录权限查询GJSON表达式
672+
</div>
673+
<div
674+
class="tip-content-box"
675+
>
676+
通过该表达式查询AccessToken载荷json，存在查询结果即有登录权限，不填默认有登录权限
677+
</div>
678+
</div>
679+
</label>
680+
</div>
681+
<div
682+
class="ant-col ant-form-item-control css-dev-only-do-not-override-txh9fw"
683+
>
684+
<div
685+
class="ant-form-item-control-input"
686+
>
687+
<div
688+
class="ant-form-item-control-input-content"
689+
>
690+
<input
691+
class="ant-input css-dev-only-do-not-override-ywkr0o basic-input-wrapper css-1pd1cd5"
692+
id="loginPermissionQueryGJsonExpression"
693+
placeholder="请输入登录权限查询GJSON表达式"
694+
type="text"
695+
value=""
696+
/>
697+
</div>
698+
</div>
699+
</div>
700+
</div>
701+
</div>
653702
<div
654703
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
655704
>

‎packages/base/src/page/System/LoginConnection/Oauth/index.test.tsx

+16-2
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,11 @@ describe('base/System/LoginConnection/Oauth', () => {
118118

119119
expect(requestUpdateOauth2Configuration).toHaveBeenCalledTimes(1);
120120
expect(requestUpdateOauth2Configuration).toHaveBeenNthCalledWith(1, {
121-
oauth2: { ...oauthConfig, enable_oauth2: true }
121+
oauth2: {
122+
...oauthConfig,
123+
enable_oauth2: true,
124+
back_channel_logout_uri: undefined
125+
}
122126
});
123127
await act(async () => jest.advanceTimersByTime(3000));
124128
expect(requestGetOauth2Configuration).toHaveBeenCalledTimes(2);
@@ -215,6 +219,15 @@ describe('base/System/LoginConnection/Oauth', () => {
215219
}
216220
});
217221

222+
fireEvent.change(
223+
getBySelector('#loginPermissionQueryGJsonExpression', baseElement),
224+
{
225+
target: {
226+
value: 'resource_access.sqle.roles.#(=="logout")'
227+
}
228+
}
229+
);
230+
218231
fireEvent.click(getBySelector('#autoCreateUser', baseElement));
219232
await act(async () => jest.advanceTimersByTime(0));
220233

@@ -251,7 +264,8 @@ describe('base/System/LoginConnection/Oauth', () => {
251264
auto_create_user: true,
252265
skip_check_state: true,
253266
server_logout_url: 'server layout url',
254-
auto_create_user_pwd: '123'
267+
auto_create_user_pwd: '123',
268+
login_perm_expr: 'resource_access.sqle.roles.#(=="logout")'
255269
}
256270
});
257271
await act(async () => jest.advanceTimersByTime(3000));

‎packages/base/src/page/System/LoginConnection/Oauth/index.tsx

+31-2
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,8 @@ const Oauth = () => {
109109
user_wechat_tag: value.userWechatTag,
110110
auto_create_user: value.autoCreateUser,
111111
auto_create_user_pwd: value.userPassword,
112-
skip_check_state: value.skipCheckState
112+
skip_check_state: value.skipCheckState,
113+
login_perm_expr: value.loginPermissionQueryGJsonExpression
113114
};
114115

115116
if (!!value.scopes) {
@@ -149,7 +150,8 @@ const Oauth = () => {
149150
userWechatTag: oauthConfig?.user_wechat_tag,
150151
autoCreateUser: oauthConfig?.auto_create_user,
151152
// userPassword: oauthConfig?.auto_create_user_pwd,
152-
skipCheckState: oauthConfig?.skip_check_state
153+
skipCheckState: oauthConfig?.skip_check_state,
154+
loginPermissionQueryGJsonExpression: oauthConfig?.login_perm_expr
153155
});
154156
}, [form, oauthConfig]);
155157

@@ -250,6 +252,12 @@ const Oauth = () => {
250252
dataIndex: 'server_logout_url',
251253
hidden: !oauthConfig?.enable_oauth2
252254
},
255+
{
256+
label: t('dmsSystem.oauth.backChannelLogoutUri'),
257+
span: 3,
258+
dataIndex: 'back_channel_logout_uri',
259+
hidden: !oauthConfig?.enable_oauth2
260+
},
253261
{
254262
label: t('dmsSystem.oauth.scopes'),
255263
span: 3,
@@ -343,6 +351,27 @@ const Oauth = () => {
343351
dataIndex: 'user_wechat_tag',
344352
hidden: !oauthConfig?.enable_oauth2
345353
},
354+
{
355+
label: (
356+
<BasicToolTip
357+
title={t(
358+
'dmsSystem.oauth.loginPermissionQueryGJsonExpressionTips'
359+
)}
360+
suffixIcon={
361+
<InfoCircleOutlined
362+
width={14}
363+
height={14}
364+
color={baseTheme.icon.system.basicTitleTips}
365+
/>
366+
}
367+
>
368+
{t('dmsSystem.oauth.loginPermissionQueryGJsonExpression')}
369+
</BasicToolTip>
370+
),
371+
span: 3,
372+
dataIndex: 'login_perm_expr',
373+
hidden: !oauthConfig?.enable_oauth2
374+
},
346375
{
347376
label: (
348377
<BasicToolTip

‎packages/base/src/page/System/LoginConnection/Oauth/index.type.ts

+1
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,5 @@ export type OauthFormField = {
1616
userPassword?: string;
1717
skipCheckState: boolean;
1818
oauth2ButtonText: string;
19+
loginPermissionQueryGJsonExpression: string;
1920
};

‎packages/base/src/page/System/LoginConnection/__snapshots__/index.test.tsx.snap

+98
Original file line numberDiff line numberDiff line change
@@ -1452,6 +1452,55 @@ exports[`base/System/LoginConnection render snap 1`] = `
14521452
</div>
14531453
</div>
14541454
</div>
1455+
<div
1456+
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
1457+
>
1458+
<div
1459+
class="ant-row ant-form-item-row css-dev-only-do-not-override-txh9fw"
1460+
>
1461+
<div
1462+
class="ant-col ant-col-11 ant-form-item-label ant-form-item-label-left css-dev-only-do-not-override-txh9fw"
1463+
>
1464+
<label
1465+
class="ant-form-item-no-colon"
1466+
for="loginPermissionQueryGJsonExpression"
1467+
title=""
1468+
>
1469+
<div
1470+
class="label-cont-custom"
1471+
>
1472+
<div>
1473+
登录权限查询GJSON表达式
1474+
</div>
1475+
<div
1476+
class="tip-content-box"
1477+
>
1478+
通过该表达式查询AccessToken载荷json，存在查询结果即有登录权限，不填默认有登录权限
1479+
</div>
1480+
</div>
1481+
</label>
1482+
</div>
1483+
<div
1484+
class="ant-col ant-col-11 ant-col-push-2 ant-form-item-control css-dev-only-do-not-override-txh9fw"
1485+
>
1486+
<div
1487+
class="ant-form-item-control-input"
1488+
>
1489+
<div
1490+
class="ant-form-item-control-input-content"
1491+
>
1492+
<input
1493+
class="ant-input css-dev-only-do-not-override-ywkr0o basic-input-wrapper css-1pd1cd5"
1494+
id="loginPermissionQueryGJsonExpression"
1495+
placeholder="请输入登录权限查询GJSON表达式"
1496+
type="text"
1497+
value=""
1498+
/>
1499+
</div>
1500+
</div>
1501+
</div>
1502+
</div>
1503+
</div>
14551504
<div
14561505
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
14571506
>
@@ -3201,6 +3250,55 @@ exports[`base/System/LoginConnection render snap 2`] = `
32013250
</div>
32023251
</div>
32033252
</div>
3253+
<div
3254+
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
3255+
>
3256+
<div
3257+
class="ant-row ant-form-item-row css-dev-only-do-not-override-txh9fw"
3258+
>
3259+
<div
3260+
class="ant-col ant-col-11 ant-form-item-label ant-form-item-label-left css-dev-only-do-not-override-txh9fw"
3261+
>
3262+
<label
3263+
class="ant-form-item-no-colon"
3264+
for="loginPermissionQueryGJsonExpression"
3265+
title=""
3266+
>
3267+
<div
3268+
class="label-cont-custom"
3269+
>
3270+
<div>
3271+
登录权限查询GJSON表达式
3272+
</div>
3273+
<div
3274+
class="tip-content-box"
3275+
>
3276+
通过该表达式查询AccessToken载荷json，存在查询结果即有登录权限，不填默认有登录权限
3277+
</div>
3278+
</div>
3279+
</label>
3280+
</div>
3281+
<div
3282+
class="ant-col ant-col-11 ant-col-push-2 ant-form-item-control css-dev-only-do-not-override-txh9fw"
3283+
>
3284+
<div
3285+
class="ant-form-item-control-input"
3286+
>
3287+
<div
3288+
class="ant-form-item-control-input-content"
3289+
>
3290+
<input
3291+
class="ant-input css-dev-only-do-not-override-ywkr0o basic-input-wrapper css-1pd1cd5"
3292+
id="loginPermissionQueryGJsonExpression"
3293+
placeholder="请输入登录权限查询GJSON表达式"
3294+
type="text"
3295+
value=""
3296+
/>
3297+
</div>
3298+
</div>
3299+
</div>
3300+
</div>
3301+
</div>
32043302
<div
32053303
class="ant-form-item has-label-tip css-1jlm9cy css-dev-only-do-not-override-txh9fw"
32063304
>

‎packages/base/src/testUtils/mockApi/system/data.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ export const oauthConfig = {
3333
server_logout_url: 'http://10.186.59.87:8080/realms/test/',
3434
user_id_tag: 'NFkVxY[4Xv^UFU&x&t5y',
3535
auto_create_user: false,
36-
skip_check_state: false
36+
skip_check_state: false,
37+
login_perm_expr: 'resource_access.sqle.roles.#(=="login")',
38+
back_channel_logout_uri: '/v1/dms/oauth2/backchannel_logout'
3739
};
3840

3941
export const SMTPConfig: ISMTPConfigurationResData = {

‎packages/shared/lib/api/base/service/Session/index.d.ts

+2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ export interface IAddSessionReturn extends IAddSessionReply {}
1111

1212
export interface IDelSessionReturn extends IDelSessionReply {}
1313

14+
export interface IRefreshSessionReturn extends IAddSessionReply {}
15+
1416
export interface IGetUserBySessionParams {
1517
user_uid?: string;
1618
}

‎packages/shared/lib/api/base/service/Session/index.ts

+9
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import {
1010
IAddSessionParams,
1111
IAddSessionReturn,
1212
IDelSessionReturn,
13+
IRefreshSessionReturn,
1314
IGetUserBySessionParams,
1415
IGetUserBySessionReturn
1516
} from './index.d';
@@ -32,6 +33,14 @@ class SessionService extends ServiceBase {
3233
);
3334
}
3435

36+
public RefreshSession(options?: AxiosRequestConfig) {
37+
return this.post<IRefreshSessionReturn>(
38+
'/v1/dms/sessions/refresh',
39+
undefined,
40+
options
41+
);
42+
}
43+
3544
public GetUserBySession(
3645
params: IGetUserBySessionParams,
3746
options?: AxiosRequestConfig

‎packages/shared/lib/api/base/service/common.d.ts

+6
Original file line numberDiff line numberDiff line change
@@ -767,12 +767,16 @@ export interface IGetOauth2ConfigurationResData {
767767

768768
auto_create_user?: boolean;
769769

770+
back_channel_logout_uri?: string;
771+
770772
client_host?: string;
771773

772774
client_id?: string;
773775

774776
enable_oauth2?: boolean;
775777

778+
login_perm_expr?: string;
779+
776780
login_tip?: string;
777781

778782
scopes?: string[];
@@ -1645,6 +1649,8 @@ export interface IOauth2Configuration {
16451649

16461650
enable_oauth2?: boolean;
16471651

1652+
login_perm_expr?: string;
1653+
16481654
login_tip?: string;
16491655

16501656
scopes?: string[];

0 commit comments

Comments
 (0)