ReachableCEO
54cc5f7308
- Implements Apache APISIX packaging for Cloudron platform. - Includes Dockerfile, CloudronManifest.json, and start.sh. - Configured to use Cloudron's etcd addon. 🤖 Generated with Gemini CLI Co-Authored-By: Gemini <noreply@google.com>
788 lines
22 KiB
Lua
788 lines
22 KiB
Lua
--
|
|
-- Licensed to the Apache Software Foundation (ASF) under one or more
|
|
-- contributor license agreements. See the NOTICE file distributed with
|
|
-- this work for additional information regarding copyright ownership.
|
|
-- The ASF licenses this file to You under the Apache License, Version 2.0
|
|
-- (the "License"); you may not use this file except in compliance with
|
|
-- the License. You may obtain a copy of the License at
|
|
--
|
|
-- http://www.apache.org/licenses/LICENSE-2.0
|
|
--
|
|
-- Unless required by applicable law or agreed to in writing, software
|
|
-- distributed under the License is distributed on an "AS IS" BASIS,
|
|
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
-- See the License for the specific language governing permissions and
|
|
-- limitations under the License.
|
|
--
|
|
local json_decode = require("toolkit.json").decode
|
|
local json_encode = require("toolkit.json").encode
|
|
|
|
local rsa_public_key = [[
|
|
-----BEGIN PUBLIC KEY-----
|
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw86xcJwNxL2MkWnjIGiw
|
|
94QY78Sq89dLqMdV/Ku2GIX9lYkbS0VDGtmxDGJLBOYW4cKTX+pigJyzglLgE+nD
|
|
z3VJf2oCqSV74gTyEdi7sw9e1rCyR6dR8VA7LEpIHwmhnDhhjXy1IYSKRdiVHLS5
|
|
sYmaAGckpUo3MLqUrgydGj5tFzvK/R/ELuZBdlZM+XuWxYry05r860E3uL+VdVCO
|
|
oU4RJQknlJnTRd7ht8KKcZb6uM14C057i26zX/xnOJpaVflA4EyEo99hKQAdr8Sh
|
|
G70MOLYvGCZxl1o8S3q4X67MxcPlfJaXnbog2AOOGRaFar88XiLFWTbXMCLuz7xD
|
|
zQIDAQAB
|
|
-----END PUBLIC KEY-----]]
|
|
|
|
local rsa_private_key = [[
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDDzrFwnA3EvYyR
|
|
aeMgaLD3hBjvxKrz10uox1X8q7YYhf2ViRtLRUMa2bEMYksE5hbhwpNf6mKAnLOC
|
|
UuAT6cPPdUl/agKpJXviBPIR2LuzD17WsLJHp1HxUDssSkgfCaGcOGGNfLUhhIpF
|
|
2JUctLmxiZoAZySlSjcwupSuDJ0aPm0XO8r9H8Qu5kF2Vkz5e5bFivLTmvzrQTe4
|
|
v5V1UI6hThElCSeUmdNF3uG3wopxlvq4zXgLTnuLbrNf/Gc4mlpV+UDgTISj32Ep
|
|
AB2vxKEbvQw4ti8YJnGXWjxLerhfrszFw+V8lpeduiDYA44ZFoVqvzxeIsVZNtcw
|
|
Iu7PvEPNAgMBAAECggEAVpyN9m7A1F631/aLheFpLgMbeKt4puV7zQtnaJ2XrZ9P
|
|
PR7pmNDpTu4uF3k/D8qrIm+L+uhVa+hkquf3wDct6w1JVnfQ93riImbnoKdK13ic
|
|
DcEZCwLjByfjFMNCxZ/gAZca55fbExlqhFy6EHmMjhB8s2LsXcTHRuGxNI/Vyi49
|
|
sxECibe0U53aqdJbVWrphIS67cpwl4TUkN6mrHsNuDYNJ9dgkpapoqp4FTFQsBqC
|
|
afOK5qgJ68dWZ47FBUng+AZjdCncqAIuJxxItGVQP6YPsFs+OXcivIVHJr363TpC
|
|
l85FfdvqWV5OGBbwSKhNwiTNUVvfSQVmtURGWG/HbQKBgQD4gZ1z9+Lx19kT9WTz
|
|
lw93lxso++uhAPDTKviyWSRoEe5aN3LCd4My+/Aj+sk4ON/s2BV3ska5Im93j+vC
|
|
rCv3uPn1n2jUhWuJ3bDqipeTW4n/CQA2m/8vd26TMk22yOkkqw2MIA8sjJ//SD7g
|
|
tdG7up6DgGMP4hgbO89uGU7DAwKBgQDJtkKd0grh3u52Foeh9YaiAgYRwc65IE16
|
|
UyD1OJxIuX/dYQDLlo5KyyngFa1ZhWIs7qC7r3xXH+10kfJY+Q+5YMjmZjlL8SR1
|
|
Ujqd02R9F2//6OeswyReachJZbZdtiEw3lPa4jVFYfhSe0M2ZPxMwvoXb25eyCNI
|
|
1lYjSKq87wKBgHnLTNghjeDp4UKe6rNYPgRm0rDrhziJtX5JeUov1mALKb6dnmkh
|
|
GfRK9g8sQqKDfXwfC6Z2gaMK9YaryujGaWYoCpoPXtmJ6oLPXH4XHuLh4mhUiP46
|
|
xn8FEfSimuQS4/FMxH8A128GHQSI7AhGFFzlwfrBWcvXC+mNDsTvMmLxAoGARc+4
|
|
upppfccETQZ7JsitMgD1TMwA2f2eEwoWTAitvlXFNT9PYSbYVHaAJbga6PLLCbYF
|
|
FzAjHpxEOKYSdEyu7n/ayDL0/Z2V+qzc8KarDsg/0RgwppBbU/nUgeKb/U79qcYo
|
|
y4ai3UKNCS70Ei1dTMvmdpnwXwlxfNIBufB6dy0CgYBMYq9Lc31GkC6PcGEEbx6W
|
|
vjImOadWZbuOVnvEQjb5XCdcOsWsMcg96PtoeuyyHmhnEF1GsMzcIdQv/PHrvYpK
|
|
Yp8D0aqsLEgwGrJQER26FPpKmyIwvcL+nm6q5W31PnU9AOC/WEkB6Zs58hsMzD2S
|
|
kEJQcmfVew5mFXyxuEn3zA==
|
|
-----END PRIVATE KEY-----]]
|
|
|
|
local _M = {}
|
|
|
|
|
|
local function inject_headers()
|
|
local hdrs = ngx.req.get_headers()
|
|
for k, v in pairs(hdrs) do
|
|
if k:sub(1, 5) == "resp-" then
|
|
ngx.header[k:sub(6)] = v
|
|
end
|
|
end
|
|
end
|
|
|
|
|
|
function _M.hello()
|
|
ngx.req.read_body()
|
|
local s = "hello world"
|
|
ngx.header['Content-Length'] = #s + 1
|
|
ngx.say(s)
|
|
end
|
|
|
|
|
|
function _M.hello_chunked()
|
|
ngx.print("hell")
|
|
ngx.flush(true)
|
|
ngx.print("o w")
|
|
ngx.flush(true)
|
|
ngx.say("orld")
|
|
end
|
|
|
|
|
|
function _M.hello1()
|
|
ngx.say("hello1 world")
|
|
end
|
|
|
|
|
|
-- Fake endpoint, needed for testing authz-keycloak plugin.
|
|
function _M.course_foo()
|
|
ngx.say("course foo")
|
|
end
|
|
|
|
|
|
function _M.server_port()
|
|
ngx.print(ngx.var.server_port)
|
|
end
|
|
_M.server_port_route2 = _M.server_port
|
|
_M.server_port_hello = _M.server_port
|
|
_M.server_port_aa = _M.server_port
|
|
|
|
|
|
function _M.limit_conn()
|
|
ngx.sleep(0.3)
|
|
ngx.say("hello world")
|
|
end
|
|
|
|
|
|
function _M.plugin_proxy_rewrite()
|
|
ngx.say("uri: ", ngx.var.uri)
|
|
ngx.say("host: ", ngx.var.host)
|
|
ngx.say("scheme: ", ngx.var.scheme)
|
|
ngx.log(ngx.WARN, "plugin_proxy_rewrite get method: ", ngx.req.get_method())
|
|
end
|
|
|
|
|
|
function _M.plugin_proxy_rewrite_args()
|
|
ngx.say("uri: ", ngx.var.uri)
|
|
local args = ngx.req.get_uri_args()
|
|
|
|
local keys = {}
|
|
for k, _ in pairs(args) do
|
|
table.insert(keys, k)
|
|
end
|
|
table.sort(keys)
|
|
|
|
for _, key in ipairs(keys) do
|
|
if type(args[key]) == "table" then
|
|
ngx.say(key, ": ", table.concat(args[key], ','))
|
|
else
|
|
ngx.say(key, ": ", args[key])
|
|
end
|
|
end
|
|
end
|
|
|
|
|
|
function _M.specific_status()
|
|
local status = ngx.var.http_x_test_upstream_status
|
|
if status ~= nil then
|
|
ngx.status = status
|
|
ngx.say("upstream status: ", status)
|
|
end
|
|
end
|
|
|
|
|
|
function _M.status()
|
|
ngx.log(ngx.WARN, "client request host: ", ngx.var.http_host)
|
|
ngx.say("ok")
|
|
end
|
|
|
|
|
|
function _M.ewma()
|
|
if ngx.var.server_port == "1981"
|
|
or ngx.var.server_port == "1982" then
|
|
ngx.sleep(0.2)
|
|
else
|
|
ngx.sleep(0.1)
|
|
end
|
|
ngx.print(ngx.var.server_port)
|
|
end
|
|
|
|
|
|
local builtin_hdr_ignore_list = {
|
|
["x-forwarded-for"] = true,
|
|
["x-forwarded-proto"] = true,
|
|
["x-forwarded-host"] = true,
|
|
["x-forwarded-port"] = true,
|
|
}
|
|
|
|
function _M.uri()
|
|
ngx.say("uri: ", ngx.var.uri)
|
|
local headers = ngx.req.get_headers()
|
|
|
|
local keys = {}
|
|
for k in pairs(headers) do
|
|
if not builtin_hdr_ignore_list[k] then
|
|
table.insert(keys, k)
|
|
end
|
|
end
|
|
table.sort(keys)
|
|
|
|
for _, key in ipairs(keys) do
|
|
ngx.say(key, ": ", headers[key])
|
|
end
|
|
end
|
|
_M.uri_plugin_proxy_rewrite = _M.uri
|
|
_M.uri_plugin_proxy_rewrite_args = _M.uri
|
|
|
|
|
|
function _M.old_uri()
|
|
ngx.say("uri: ", ngx.var.uri)
|
|
local headers = ngx.req.get_headers()
|
|
|
|
local keys = {}
|
|
for k in pairs(headers) do
|
|
table.insert(keys, k)
|
|
end
|
|
table.sort(keys)
|
|
|
|
for _, key in ipairs(keys) do
|
|
ngx.say(key, ": ", headers[key])
|
|
end
|
|
end
|
|
|
|
|
|
function _M.opentracing()
|
|
ngx.say("opentracing")
|
|
end
|
|
|
|
|
|
function _M.with_header()
|
|
--split into multiple chunk
|
|
ngx.say("hello")
|
|
ngx.say("world")
|
|
ngx.say("!")
|
|
end
|
|
|
|
|
|
function _M.mock_zipkin()
|
|
ngx.req.read_body()
|
|
local data = ngx.req.get_body_data()
|
|
ngx.log(ngx.NOTICE, data)
|
|
|
|
local spans = json_decode(data)
|
|
local ver = ngx.req.get_uri_args()['span_version']
|
|
if ver == "1" then
|
|
if #spans ~= 5 then
|
|
ngx.log(ngx.ERR, "wrong number of spans: ", #spans)
|
|
ngx.exit(400)
|
|
end
|
|
else
|
|
if #spans ~= 3 then
|
|
-- request/proxy/response
|
|
ngx.log(ngx.ERR, "wrong number of spans: ", #spans)
|
|
ngx.exit(400)
|
|
end
|
|
end
|
|
|
|
for _, span in pairs(spans) do
|
|
local prefix = string.sub(span.name, 1, 6)
|
|
if prefix ~= 'apisix' then
|
|
ngx.log(ngx.ERR, "wrong prefix of name", prefix)
|
|
ngx.exit(400)
|
|
end
|
|
if not span.traceId then
|
|
ngx.log(ngx.ERR, "missing trace id")
|
|
ngx.exit(400)
|
|
end
|
|
|
|
if not span.localEndpoint then
|
|
ngx.log(ngx.ERR, "missing local endpoint")
|
|
ngx.exit(400)
|
|
end
|
|
|
|
if span.localEndpoint.serviceName ~= 'APISIX'
|
|
and span.localEndpoint.serviceName ~= 'apisix' then
|
|
ngx.log(ngx.ERR, "wrong serviceName: ", span.localEndpoint.serviceName)
|
|
ngx.exit(400)
|
|
end
|
|
|
|
if span.localEndpoint.port ~= 1984 then
|
|
ngx.log(ngx.ERR, "wrong port: ", span.localEndpoint.port)
|
|
ngx.exit(400)
|
|
end
|
|
|
|
local server_addr = ngx.req.get_uri_args()['server_addr']
|
|
if server_addr then
|
|
if span.localEndpoint.ipv4 ~= server_addr then
|
|
ngx.log(ngx.ERR, "server_addr mismatched")
|
|
ngx.exit(400)
|
|
end
|
|
end
|
|
|
|
end
|
|
end
|
|
|
|
|
|
function _M.wolf_rbac_login_rest()
|
|
ngx.req.read_body()
|
|
local data = ngx.req.get_body_data()
|
|
local args = json_decode(data)
|
|
if not args.username then
|
|
ngx.say(json_encode({ok=false, reason="ERR_USERNAME_MISSING"}))
|
|
ngx.exit(0)
|
|
end
|
|
if not args.password then
|
|
ngx.say(json_encode({ok=false, reason="ERR_PASSWORD_MISSING"}))
|
|
ngx.exit(0)
|
|
end
|
|
if args.username ~= "admin" then
|
|
ngx.say(json_encode({ok=false, reason="ERR_USER_NOT_FOUND"}))
|
|
ngx.exit(0)
|
|
end
|
|
if args.password ~= "123456" then
|
|
ngx.say(json_encode({ok=false, reason="ERR_PASSWORD_ERROR"}))
|
|
ngx.exit(0)
|
|
end
|
|
|
|
ngx.say(json_encode({ok=true, data={token="wolf-rbac-token",
|
|
userInfo={nickname="administrator",username="admin", id="100"}}}))
|
|
end
|
|
|
|
|
|
function _M.wolf_rbac_access_check()
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers['x-rbac-token']
|
|
if token ~= 'wolf-rbac-token' then
|
|
ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"}))
|
|
ngx.exit(0)
|
|
end
|
|
|
|
local args = ngx.req.get_uri_args()
|
|
local resName = args.resName
|
|
if resName == '/hello' or resName == '/wolf/rbac/custom/headers' then
|
|
ngx.say(json_encode({ok=true,
|
|
data={ userInfo={nickname="administrator",
|
|
username="admin", id="100"} }}))
|
|
elseif resName == '/hello/500' then
|
|
ngx.status = 500
|
|
ngx.say(json_encode({ok=false, reason="ERR_SERVER_ERROR"}))
|
|
elseif resName == '/hello/401' then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"}))
|
|
else
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ok=false, reason="ERR_ACCESS_DENIED"}))
|
|
end
|
|
end
|
|
|
|
|
|
function _M.wolf_rbac_user_info()
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers['x-rbac-token']
|
|
if token ~= 'wolf-rbac-token' then
|
|
ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"}))
|
|
ngx.exit(0)
|
|
end
|
|
|
|
ngx.say(json_encode({ok=true,
|
|
data={ userInfo={nickname="administrator", username="admin", id="100"} }}))
|
|
end
|
|
|
|
|
|
function _M.wolf_rbac_change_pwd()
|
|
ngx.req.read_body()
|
|
local data = ngx.req.get_body_data()
|
|
local args = json_decode(data)
|
|
if args.oldPassword ~= "123456" then
|
|
ngx.say(json_encode({ok=false, reason="ERR_OLD_PASSWORD_INCORRECT"}))
|
|
ngx.exit(0)
|
|
end
|
|
|
|
ngx.say(json_encode({ok=true, data={ }}))
|
|
end
|
|
|
|
|
|
function _M.wolf_rbac_custom_headers()
|
|
local headers = ngx.req.get_headers()
|
|
ngx.say('id:' .. headers['X-UserId'] .. ',username:' .. headers['X-Username']
|
|
.. ',nickname:' .. headers['X-Nickname'])
|
|
end
|
|
|
|
|
|
function _M.websocket_handshake()
|
|
local websocket = require "resty.websocket.server"
|
|
local wb, err = websocket:new()
|
|
if not wb then
|
|
ngx.log(ngx.ERR, "failed to new websocket: ", err)
|
|
return ngx.exit(400)
|
|
end
|
|
|
|
local bytes, err = wb:send_text("hello")
|
|
if not bytes then
|
|
ngx.log(ngx.ERR, "failed to send text: ", err)
|
|
return ngx.exit(444)
|
|
end
|
|
end
|
|
_M.websocket_handshake_route = _M.websocket_handshake
|
|
|
|
|
|
function _M.api_breaker()
|
|
ngx.exit(tonumber(ngx.var.arg_code))
|
|
end
|
|
|
|
|
|
function _M.mysleep()
|
|
ngx.sleep(tonumber(ngx.var.arg_seconds))
|
|
if ngx.var.arg_abort then
|
|
ngx.exit(ngx.ERROR)
|
|
else
|
|
ngx.say(ngx.var.arg_seconds)
|
|
end
|
|
end
|
|
|
|
|
|
local function print_uri()
|
|
ngx.say(ngx.var.uri)
|
|
end
|
|
for i = 1, 100 do
|
|
_M["print_uri_" .. i] = print_uri
|
|
end
|
|
|
|
function _M.print_uri_detailed()
|
|
ngx.say("ngx.var.uri: ", ngx.var.uri)
|
|
ngx.say("ngx.var.request_uri: ", ngx.var.request_uri)
|
|
end
|
|
|
|
function _M.headers()
|
|
local args = ngx.req.get_uri_args()
|
|
for name, val in pairs(args) do
|
|
ngx.header[name] = nil
|
|
ngx.header[name] = val
|
|
end
|
|
|
|
ngx.say("/headers")
|
|
end
|
|
|
|
|
|
function _M.echo()
|
|
ngx.req.read_body()
|
|
local hdrs = ngx.req.get_headers()
|
|
for k, v in pairs(hdrs) do
|
|
ngx.header[k] = v
|
|
end
|
|
ngx.print(ngx.req.get_body_data() or "")
|
|
end
|
|
|
|
|
|
function _M.log()
|
|
ngx.req.read_body()
|
|
local body = ngx.req.get_body_data()
|
|
local ct = ngx.var.content_type
|
|
if ct ~= "text/plain" then
|
|
body = json_decode(body)
|
|
body = json_encode(body)
|
|
end
|
|
ngx.log(ngx.WARN, "request log: ", body or "nil")
|
|
end
|
|
|
|
|
|
function _M.server_error()
|
|
error("500 Internal Server Error")
|
|
end
|
|
|
|
|
|
function _M.log_request()
|
|
ngx.log(ngx.WARN, "uri: ", ngx.var.uri)
|
|
local headers = ngx.req.get_headers()
|
|
|
|
local keys = {}
|
|
for k in pairs(headers) do
|
|
table.insert(keys, k)
|
|
end
|
|
table.sort(keys)
|
|
|
|
for _, key in ipairs(keys) do
|
|
ngx.log(ngx.WARN, key, ": ", headers[key])
|
|
end
|
|
end
|
|
|
|
|
|
function _M.v3_auth_authenticate()
|
|
ngx.log(ngx.WARN, "etcd auth failed!")
|
|
end
|
|
|
|
|
|
function _M._well_known_openid_configuration()
|
|
local t = require("lib.test_admin")
|
|
local openid_data = t.read_file("t/plugin/openid-connect/configuration.json")
|
|
ngx.say(openid_data)
|
|
end
|
|
|
|
function _M.google_logging_token()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
ngx.req.read_body()
|
|
local data = ngx.decode_args(ngx.req.get_body_data())
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://apisix.apache.org/logs:admin"
|
|
local verify = jwt:verify(rsa_public_key, data["assertion"])
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scopes" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
expire_time = 0
|
|
end
|
|
|
|
local jwt_token = jwt:sign(rsa_private_key, {
|
|
header = { typ = "JWT", alg = "RS256" },
|
|
payload = { exp = verify.payload.exp, scope = access_scopes }
|
|
})
|
|
|
|
ngx.say(json_encode({
|
|
access_token = jwt_token,
|
|
expires_in = expire_time,
|
|
token_type = args_token_type
|
|
}))
|
|
end
|
|
|
|
function _M.google_logging_entries()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
ngx.req.read_body()
|
|
local data = ngx.req.get_body_data()
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://apisix.apache.org/logs:admin"
|
|
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers["Authorization"]
|
|
if not token then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "authentication header not exists" }))
|
|
return
|
|
end
|
|
|
|
token = string.sub(token, #args_token_type + 2)
|
|
local verify = jwt:verify(rsa_public_key, token)
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scopes" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "token has expired" }))
|
|
return
|
|
end
|
|
|
|
ngx.say(data)
|
|
end
|
|
|
|
function _M.google_secret_token()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
ngx.req.read_body()
|
|
local data = ngx.decode_args(ngx.req.get_body_data())
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://www.googleapis.com/auth/cloud"
|
|
local verify = jwt:verify(rsa_public_key, data["assertion"])
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scope" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
expire_time = 0
|
|
end
|
|
|
|
local jwt_token = jwt:sign(rsa_private_key, {
|
|
header = { typ = "JWT", alg = "RS256" },
|
|
payload = { exp = verify.payload.exp, scope = access_scopes }
|
|
})
|
|
|
|
ngx.say(json_encode({
|
|
access_token = jwt_token,
|
|
expires_in = expire_time,
|
|
token_type = args_token_type
|
|
}))
|
|
end
|
|
|
|
function _M.google_secret_apisix_jack()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://www.googleapis.com/auth/cloud"
|
|
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers["Authorization"]
|
|
if not token then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "authentication header not exists" }))
|
|
return
|
|
end
|
|
|
|
token = string.sub(token, #args_token_type + 2)
|
|
local verify = jwt:verify(rsa_public_key, token)
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scope" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "token has expired" }))
|
|
return
|
|
end
|
|
|
|
local response = {
|
|
name = "projects/647037004838/secrets/apisix/versions/1",
|
|
payload = {
|
|
data = "eyJrZXkiOiJ2YWx1ZSJ9",
|
|
dataCrc32c = "2296192492"
|
|
}
|
|
}
|
|
|
|
ngx.status = 200
|
|
ngx.say(json_encode(response))
|
|
end
|
|
|
|
function _M.google_secret_apisix_error_jack()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://www.googleapis.com/auth/root/cloud"
|
|
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers["Authorization"]
|
|
if not token then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "authentication header not exists" }))
|
|
return
|
|
end
|
|
|
|
token = string.sub(token, #args_token_type + 2)
|
|
local verify = jwt:verify(rsa_public_key, token)
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scope" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "token has expired" }))
|
|
return
|
|
end
|
|
|
|
local response = {
|
|
name = "projects/647037004838/secrets/apisix_error/versions/1",
|
|
payload = {
|
|
data = "eyJrZXkiOiJ2YWx1ZSJ9",
|
|
dataCrc32c = "2296192492"
|
|
}
|
|
}
|
|
|
|
ngx.status = 200
|
|
ngx.say(json_encode(response))
|
|
end
|
|
|
|
function _M.google_secret_apisix_mysql()
|
|
local args = ngx.req.get_uri_args()
|
|
local args_token_type = args.token_type or "Bearer"
|
|
local jwt = require("resty.jwt")
|
|
local access_scopes = "https://www.googleapis.com/auth/cloud"
|
|
|
|
local headers = ngx.req.get_headers()
|
|
local token = headers["Authorization"]
|
|
if not token then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "authentication header not exists" }))
|
|
return
|
|
end
|
|
|
|
token = string.sub(token, #args_token_type + 2)
|
|
local verify = jwt:verify(rsa_public_key, token)
|
|
if not verify.verified then
|
|
ngx.status = 401
|
|
ngx.say(json_encode({ error = "identity authentication failed" }))
|
|
return
|
|
end
|
|
|
|
local scopes_valid = type(verify.payload.scope) == "string" and
|
|
verify.payload.scope:find(access_scopes)
|
|
if not scopes_valid then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "no access to this scope" }))
|
|
return
|
|
end
|
|
|
|
local expire_time = (verify.payload.exp or ngx.time()) - ngx.time()
|
|
if expire_time <= 0 then
|
|
ngx.status = 403
|
|
ngx.say(json_encode({ error = "token has expired" }))
|
|
return
|
|
end
|
|
|
|
local response = {
|
|
name = "projects/647037004838/secrets/apisix/versions/1",
|
|
payload = {
|
|
data = "c2VjcmV0",
|
|
dataCrc32c = "0xB03C4D4D"
|
|
}
|
|
}
|
|
|
|
ngx.status = 200
|
|
ngx.say(json_encode(response))
|
|
end
|
|
|
|
function _M.plugin_proxy_rewrite_resp_header()
|
|
ngx.req.read_body()
|
|
local s = "plugin_proxy_rewrite_resp_header"
|
|
ngx.header['Content-Length'] = #s + 1
|
|
ngx.say(s)
|
|
end
|
|
|
|
-- Please add your fake upstream above
|
|
function _M.go()
|
|
local action = string.sub(ngx.var.uri, 2)
|
|
action = string.gsub(action, "[/\\.-]", "_")
|
|
if not action or not _M[action] then
|
|
ngx.log(ngx.WARN, "undefined path in test server, uri: ", ngx.var.request_uri)
|
|
return ngx.exit(404)
|
|
end
|
|
|
|
inject_headers()
|
|
return _M[action]()
|
|
end
|
|
|
|
|
|
function _M.clickhouse_logger_server()
|
|
ngx.req.read_body()
|
|
local data = ngx.req.get_body_data()
|
|
local headers = ngx.req.get_headers()
|
|
ngx.log(ngx.WARN, "clickhouse body: ", data)
|
|
for k, v in pairs(headers) do
|
|
ngx.log(ngx.WARN, "clickhouse headers: " .. k .. ":" .. v)
|
|
end
|
|
ngx.say("ok")
|
|
end
|
|
|
|
|
|
function _M.mock_compressed_upstream_response()
|
|
local s = "compressed_response"
|
|
ngx.header['Content-Encoding'] = 'gzip'
|
|
ngx.say(s)
|
|
end
|
|
|
|
|
|
return _M
|