fix: add independent error message in token endpoint (#662 )

* fix: add independent error message in token endpoint Signed-off-by: Steve0x2a <stevesough@gmail.com> * fix: reduced use of variables Signed-off-by: Steve0x2a <stevesough@gmail.com> * fix: error messages use the same variable Signed-off-by: Steve0x2a <stevesough@gmail.com>
feat: implement proxy (#661 )
2025-08-28 02:51:36 +08:00 · 2022-04-14 10:22:56 +08:00 · 2022-04-13 14:04:40 +08:00
5 changed files with 69 additions and 23 deletions
--- a/3
+++ b/3
@@ -1,8 +1,7 @@
 FROM golang:1.17.5 AS BACK
 WORKDIR /go/src/casdoor
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOPROXY=https://goproxy.cn,direct go build -ldflags="-w -s" -o server . \
-    && apt update && apt install wait-for-it && chmod +x /usr/bin/wait-for-it
+RUN ./build.sh && apt update && apt install wait-for-it && chmod +x /usr/bin/wait-for-it

 FROM node:16.13.0 AS FRONT
 WORKDIR /web
--- a/build.sh
+++ b/build.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+#try to connect to google to determine whether user need to use proxy
+curl www.google.com -o /dev/null --connect-timeout 5
+if [ $? == 0 ]
+then
+    echo "connect to google.com successed"
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-w -s" -o server .
+else
+    echo "connect to google.com failed"
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOPROXY=https://goproxy.cn,direct go build -ldflags="-w -s" -o server .
+fi
--- a/object/token.go
+++ b/object/token.go
@@ -58,6 +58,7 @@ type TokenWrapper struct {
 	TokenType    string `json:"token_type"`
 	ExpiresIn    int    `json:"expires_in"`
 	Scope        string `json:"scope"`
+	Error        string `json:"error,omitempty"`
 }

 type IntrospectionResponse struct {
@@ -306,23 +307,28 @@ func GetOAuthCode(userId string, clientId string, responseType string, redirectU
 }

 func GetOAuthToken(grantType string, clientId string, clientSecret string, code string, verifier string, scope string, username string, password string, host string) *TokenWrapper {
+	var errString string
 	application := GetApplicationByClientId(clientId)
 	if application == nil {
+		errString = "error: invalid client_id"
 		return &TokenWrapper{
-			AccessToken: "error: invalid client_id",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}

 	//Check if grantType is allowed in the current application
 	if !IsGrantTypeValid(grantType, application.GrantTypes) {
+		errString = fmt.Sprintf("error: grant_type: %s is not supported in this application", grantType)
 		return &TokenWrapper{
-			AccessToken: fmt.Sprintf("error: grant_type: %s is not supported in this application", grantType),
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}

@@ -338,11 +344,13 @@ func GetOAuthToken(grantType string, clientId string, clientSecret string, code
 	}

 	if err != nil {
+		errString = err.Error()
 		return &TokenWrapper{
-			AccessToken: err.Error(),
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}

@@ -361,62 +369,75 @@ func GetOAuthToken(grantType string, clientId string, clientSecret string, code
 }

 func RefreshToken(grantType string, refreshToken string, scope string, clientId string, clientSecret string, host string) *TokenWrapper {
+	var errString string
 	// check parameters
 	if grantType != "refresh_token" {
+		errString = "error: grant_type should be \"refresh_token\""
 		return &TokenWrapper{
-			AccessToken: "error: grant_type should be \"refresh_token\"",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}
 	application := GetApplicationByClientId(clientId)
 	if application == nil {
+		errString = "error: invalid client_id"
 		return &TokenWrapper{
-			AccessToken: "error: invalid client_id",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}
 	if clientSecret != "" && application.ClientSecret != clientSecret {
+		errString = "error: invalid client_secret"
 		return &TokenWrapper{
-			AccessToken: "error: invalid client_secret",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}
 	// check whether the refresh token is valid, and has not expired.
 	token := Token{RefreshToken: refreshToken}
 	existed, err := adapter.Engine.Get(&token)
 	if err != nil || !existed {
+		errString = "error: invalid refresh_token"
 		return &TokenWrapper{
-			AccessToken: "error: invalid refresh_token",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}

 	cert := getCertByApplication(application)
 	_, err = ParseJwtToken(refreshToken, cert)
 	if err != nil {
+		errString := fmt.Sprintf("error: %s", err.Error())
 		return &TokenWrapper{
-			AccessToken: fmt.Sprintf("error: %s", err.Error()),
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}
 	// generate a new token
 	user := getUser(application.Organization, token.User)
 	if user.IsForbidden {
+		errString = "error: the user is forbidden to sign in, please contact the administrator"
 		return &TokenWrapper{
-			AccessToken: "error: the user is forbidden to sign in, please contact the administrator",
+			AccessToken: errString,
 			TokenType:   "",
 			ExpiresIn:   0,
 			Scope:       "",
+			Error:       errString,
 		}
 	}
 	newAccessToken, newRefreshToken, err := generateJwtToken(application, user, "", scope, host)
--- a/swagger/swagger.json
+++ b/swagger/swagger.json
@@ -2797,11 +2797,11 @@
        }
    },
    "definitions": {
-        "2026.0xc000380de0.false": {
+        "2127.0xc00036c600.false": {
            "title": "false",
            "type": "object"
        },
-        "2060.0xc000380e10.false": {
+        "2161.0xc00036c630.false": {
            "title": "false",
            "type": "object"
        },
@@ -2818,10 +2818,10 @@
            "type": "object",
            "properties": {
                "data": {
-                    "$ref": "#/definitions/2026.0xc000380de0.false"
+                    "$ref": "#/definitions/2127.0xc00036c600.false"
                },
                "data2": {
-                    "$ref": "#/definitions/2060.0xc000380e10.false"
+                    "$ref": "#/definitions/2161.0xc00036c630.false"
                },
                "msg": {
                    "type": "string"
@@ -2842,10 +2842,10 @@
            "type": "object",
            "properties": {
                "data": {
-                    "$ref": "#/definitions/2026.0xc000380de0.false"
+                    "$ref": "#/definitions/2127.0xc00036c600.false"
                },
                "data2": {
-                    "$ref": "#/definitions/2060.0xc000380e10.false"
+                    "$ref": "#/definitions/2161.0xc00036c630.false"
                },
                "msg": {
                    "type": "string"
@@ -3648,6 +3648,9 @@
                "access_token": {
                    "type": "string"
                },
+                "error": {
+                    "type": "string"
+                },
                "expires_in": {
                    "type": "integer",
                    "format": "int64"
@@ -3682,6 +3685,9 @@
                "affiliation": {
                    "type": "string"
                },
+                "alipay": {
+                    "type": "string"
+                },
                "apple": {
                    "type": "string"
                },
@@ -3721,6 +3727,9 @@
                "email": {
                    "type": "string"
                },
+                "emailVerified": {
+                    "type": "boolean"
+                },
                "facebook": {
                    "type": "string"
                },
--- a/swagger/swagger.yml
+++ b/swagger/swagger.yml
@@ -1831,10 +1831,10 @@ paths:
          schema:
            $ref: '#/definitions/object.Userinfo'
 definitions:
-  2026.0xc000380de0.false:
+  2127.0xc00036c600.false:
    title: "false"
    type: object
-  2060.0xc000380e10.false:
+  2161.0xc00036c630.false:
    title: "false"
    type: object
  RequestForm:
@@ -1848,9 +1848,9 @@ definitions:
    type: object
    properties:
      data:
-        $ref: '#/definitions/2026.0xc000380de0.false'
+        $ref: '#/definitions/2127.0xc00036c600.false'
      data2:
-        $ref: '#/definitions/2060.0xc000380e10.false'
+        $ref: '#/definitions/2161.0xc00036c630.false'
      msg:
        type: string
      name:
@@ -1864,9 +1864,9 @@ definitions:
    type: object
    properties:
      data:
-        $ref: '#/definitions/2026.0xc000380de0.false'
+        $ref: '#/definitions/2127.0xc00036c600.false'
      data2:
-        $ref: '#/definitions/2060.0xc000380e10.false'
+        $ref: '#/definitions/2161.0xc00036c630.false'
      msg:
        type: string
      name:
@@ -2407,6 +2407,8 @@ definitions:
    properties:
      access_token:
        type: string
+      error:
+        type: string
      expires_in:
        type: integer
        format: int64
@@ -2430,6 +2432,8 @@ definitions:
        type: string
      affiliation:
        type: string
+      alipay:
+        type: string
      apple:
        type: string
      avatar:
@@ -2456,6 +2460,8 @@ definitions:
        type: string
      email:
        type: string
+      emailVerified:
+        type: boolean
      facebook:
        type: string
      firstName: