feature:接入系统区分单租户和全租户 (#338)

Author: dongrongyi

build/support-files/sql/0034_iam_20260413-0300_mysql.sql

@@ -0,0 +1 @@
+ALTER TABLE `bkiam`.`saas_system_info` ADD COLUMN `tenant_id` VARCHAR(32) NOT NULL DEFAULT '';

pkg/api/model/handler/system.go

@@ -11,6 +11,9 @@
 package handler
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/TencentBlueKing/gopkg/collection/set"
 	"github.com/TencentBlueKing/gopkg/errorx"
 	"github.com/fatih/structs"
@@ -24,6 +27,29 @@ import (
 	"iam/pkg/util"
 )
 
+// getAppTenantID 根据当前请求的网关 JWT 信息确定创建/更新 system 时应使用的 tenant_id
+//   - 全租户应用（tenant_mode=global）：返回 ""，该 system 对所有租户可见
+//   - 单租户应用（tenant_mode=single）：返回 app.tenant_id
+func getAppTenantID(c *gin.Context) (string, error) {
+	mode := util.GetAppTenantMode(c)
+	appTenantID := util.GetAppTenantID(c)
+
+	switch mode {
+	case util.AppTenantModeGlobal:
+		return "", nil
+	case util.AppTenantModeSingle:
+		if appTenantID == "" {
+			return "", errors.New("single tenant app must have tenant_id in jwt")
+		}
+		return appTenantID, nil
+	default:
+		return "", fmt.Errorf(
+			"unknown or missing tenant_mode: %q, request must come from apigateway with a valid jwt",
+			mode,
+		)
+	}
+}
+
 // add the clientID into body.Clients if not exists, 注册这个系统的client一定是其合法client!
 func defaultValidClients(c *gin.Context, originClients string) string {
 	clients := originClients
@@ -85,6 +111,15 @@ func CreateSystem(c *gin.Context) {
 	// 注册这个系统的client一定是其合法client!
 	clients := defaultValidClients(c, body.Clients)
 
+	//  根据请求的App 确定 system 归属的 tenant_id
+	//   - 全租户应用： 接入系统为全租户
+	//   - 单租户应用： 接入系统为单租户，租户与应用一致
+	tenantID, err := getAppTenantID(c)
+	if err != nil {
+		util.BadRequestErrorJSONResponse(c, err.Error())
+		return
+	}
+
 	// add the logical here
 	system := svctypes.System{
 		ID:             body.ID,
@@ -94,6 +129,7 @@ func CreateSystem(c *gin.Context) {
 		DescriptionEn:  body.DescriptionEn,
 		Clients:        clients,
 		ProviderConfig: structs.Map(body.ProviderConfig),
+		TenantID:       tenantID,
 	}
 
 	svc := service.NewSystemService()

pkg/api/model/handler/system_test.go

@@ -182,8 +182,8 @@ func TestCreateSystem(t *testing.T) {
 			}).
 			Expect(t).
 			Assert(util.NewResponseAssertFunc(t, func(resp util.Response) error {
-				assert.Equal(t, resp.Code, util.SystemError)
-				assert.Contains(t, resp.Message, "system error")
+				assert.Equal(t, resp.Code, util.BadRequestError)
+				assert.Contains(t, resp.Message, "unknown or missing tenant_mode")
 				return nil
 			})).
 			Status(http.StatusOK).

pkg/api/web/handler/system_slz.go

@@ -11,8 +11,8 @@
 package handler
 
 const (
-	systemSupportFields = "id,name,name_en,clients,provider_config,description,description_en"
-	systemDefaultFields = "id,name,name_en"
+	systemSupportFields = "id,name,name_en,clients,provider_config,description,description_en,tenant_id"
+	systemDefaultFields = "id,name,name_en,tenant_id"
 )
 
 type systemQuerySerializer struct {

pkg/cacheimpls/init.go

@@ -37,7 +37,7 @@ var (
 	LocalRemoteResourceListCache    memory.Cache
 	LocalSubjectPKCache             memory.Cache
 	LocalSubjectDepartmentCache     memory.Cache
-	LocalAPIGatewayJWTClientIDCache memory.Cache
+	LocalAPIGatewayJWTAppInfoCache  memory.Cache
 	LocalActionCache                memory.Cache // for iam engine
 	LocalUnmarshaledExpressionCache *gocache.Cache
 	LocalGroupSystemAuthTypeCache   *gocache.Cache
@@ -167,10 +167,10 @@ func InitCaches(disabled bool) {
 
 	// 无影响, 重算而已不查db
 
-	LocalAPIGatewayJWTClientIDCache = memory.NewCache(
-		"local_apigw_jwt_client_id",
+	LocalAPIGatewayJWTAppInfoCache = memory.NewCache(
+		"local_apigw_jwt_app_info",
 		disabled,
-		retrieveAPIGatewayJWTClientID,
+		retrieveAPIGatewayJWTAppInfo,
 		30*time.Second,
 		nil,
 	)

pkg/cacheimpls/local_apigw_jwt_app_info.go

@@ -0,0 +1,73 @@
+/*
+ * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-权限中心(BlueKing-IAM) available.
+ * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+ * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at http://opensource.org/licenses/MIT
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+
+package cacheimpls
+
+import (
+	"errors"
+
+	"github.com/TencentBlueKing/gopkg/cache"
+	"github.com/TencentBlueKing/gopkg/stringx"
+)
+
+// AppInfo 从网关 JWT 中解析出的应用信息
+type AppInfo struct {
+	AppCode    string // 应用 code
+	TenantMode string // 租户模式：global / single
+	TenantID   string // 租户 id（global 时为空）
+}
+
+// APIGatewayJWTAppInfoCacheKey cache key for JWTToken
+type APIGatewayJWTAppInfoCacheKey struct {
+	JWTToken string
+}
+
+// Key ...
+func (k APIGatewayJWTAppInfoCacheKey) Key() string {
+	return stringx.MD5Hash(k.JWTToken)
+}
+
+func retrieveAPIGatewayJWTAppInfo(key cache.Key) (interface{}, error) {
+	// NOTE: this func not work
+	return AppInfo{}, nil
+}
+
+var (
+	ErrAPIGatewayJWTCacheNotFound   = errors.New("not found")
+	ErrAPIGatewayJWTValueNotAppInfo = errors.New("value not AppInfo type")
+)
+
+// GetJWTTokenAppInfo will retrieve the AppInfo of a jwtToken
+func GetJWTTokenAppInfo(jwtToken string) (appInfo AppInfo, err error) {
+	key := APIGatewayJWTAppInfoCacheKey{
+		JWTToken: jwtToken,
+	}
+
+	value, ok := LocalAPIGatewayJWTAppInfoCache.DirectGet(key)
+	if !ok {
+		err = ErrAPIGatewayJWTCacheNotFound
+		return
+	}
+
+	appInfo, ok = value.(AppInfo)
+	if !ok {
+		err = ErrAPIGatewayJWTValueNotAppInfo
+		return
+	}
+	return appInfo, nil
+}
+
+// SetJWTTokenAppInfo will set the jwtToken-AppInfo in cache
+func SetJWTTokenAppInfo(jwtToken string, appInfo AppInfo) {
+	key := APIGatewayJWTAppInfoCacheKey{
+		JWTToken: jwtToken,
+	}
+	LocalAPIGatewayJWTAppInfoCache.Set(key, appInfo)
+}

…eimpls/local_apigw_jwt_client_id_test.go …heimpls/local_apigw_jwt_app_info_test.gopkg/cacheimpls/local_apigw_jwt_client_id_test.go renamed to pkg/cacheimpls/local_apigw_jwt_app_info_test.go pkg/cacheimpls/local_apigw_jwt_client_id_test.go renamed to pkg/cacheimpls/local_apigw_jwt_app_info_test.go

@@ -19,22 +19,22 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-var _ = Describe("LocalApigwJwtClientId", func() {
+var _ = Describe("LocalApigwJWTAppInfo", func() {
 	It("Key", func() {
-		key := APIGatewayJWTClientIDCacheKey{
+		key := APIGatewayJWTAppInfoCacheKey{
 			JWTToken: "abc",
 		}
 
 		assert.Equal(GinkgoT(), "900150983cd24fb0d6963f7d28e17f72", key.Key())
 	})
 
 	It("retrieve should not work", func() {
-		key := APIGatewayJWTClientIDCacheKey{
+		key := APIGatewayJWTAppInfoCacheKey{
 			JWTToken: "abc",
 		}
 
-		value, err := retrieveAPIGatewayJWTClientID(key)
-		assert.Equal(GinkgoT(), "", value.(string))
+		value, err := retrieveAPIGatewayJWTAppInfo(key)
+		assert.Equal(GinkgoT(), AppInfo{}, value.(AppInfo))
 		assert.NoError(GinkgoT(), err)
 	})
 
@@ -47,31 +47,36 @@ var _ = Describe("LocalApigwJwtClientId", func() {
 			}
 			mockCache := memory.NewCache(
 				"mockCache", false, retrieveFunc, expiration, nil)
-			LocalAPIGatewayJWTClientIDCache = mockCache
+			LocalAPIGatewayJWTAppInfoCache = mockCache
 		})
 
 		It("not exists", func() {
-			_, err := GetJWTTokenClientID("abc")
+			_, err := GetJWTTokenAppInfo("abc")
 			assert.ErrorIs(GinkgoT(), err, ErrAPIGatewayJWTCacheNotFound)
 		})
 
-		It("not string", func() {
-			key := APIGatewayJWTClientIDCacheKey{
+		It("not AppInfo", func() {
+			key := APIGatewayJWTAppInfoCacheKey{
 				JWTToken: "abc",
 			}
 
-			LocalAPIGatewayJWTClientIDCache.Set(key, 1)
+			LocalAPIGatewayJWTAppInfoCache.Set(key, 1)
 
-			_, err := GetJWTTokenClientID("abc")
-			assert.ErrorIs(GinkgoT(), err, ErrAPIGatewayJWTClientIDNotString)
+			_, err := GetJWTTokenAppInfo("abc")
+			assert.ErrorIs(GinkgoT(), err, ErrAPIGatewayJWTValueNotAppInfo)
 		})
 
 		It("ok", func() {
-			SetJWTTokenClientID("abc", "bk_test")
+			expectedAppInfo := AppInfo{
+				AppCode:    "bk_test",
+				TenantMode: "global",
+				TenantID:   "",
+			}
+			SetJWTTokenAppInfo("abc", expectedAppInfo)
 
-			clientID, err := GetJWTTokenClientID("abc")
+			appInfo, err := GetJWTTokenAppInfo("abc")
 			assert.NoError(GinkgoT(), err)
-			assert.Equal(GinkgoT(), "bk_test", clientID)
+			assert.Equal(GinkgoT(), expectedAppInfo, appInfo)
 		})
 	})
 })

pkg/cacheimpls/local_apigw_jwt_client_id.go

@@ -33,6 +33,7 @@ type SaaSSystem struct {
 	DescriptionEn  string `db:"description_en"`
 	Clients        string `db:"clients"`         // 逗号分隔
 	ProviderConfig string `db:"provider_config"` // JSON 'iam,saas_iam'
+	TenantID       string `db:"tenant_id"`
 }
 
 // SaaSSystemManager ...
@@ -104,8 +105,9 @@ func (m *saasSystemManager) insertWithTx(tx *sqlx.Tx, system SaaSSystem) error {
         description,
         description_en,
 		clients,
-		provider_config
-	) VALUES (:id, :name, :name_en, :description, :description_en, :clients, :provider_config)`
+		provider_config,
+        tenant_id
+	) VALUES (:id, :name, :name_en, :description, :description_en, :clients, :provider_config, :tenant_id)`
 	return database.SqlxInsertWithTx(tx, query, system)
 }
 
@@ -125,7 +127,8 @@ func (m *saasSystemManager) selectOne(saasSystem *SaaSSystem, id string) error {
 		description,
 		description_en,
 		clients,
-		provider_config
+		provider_config,
+		tenant_id
 		FROM saas_system_info
 		WHERE id = ?
 		LIMIT 1`
@@ -140,7 +143,8 @@ func (m *saasSystemManager) selectAll(saasSystems *[]SaaSSystem) error {
 		description,
 		description_en,
 		clients,
-		provider_config
+		provider_config,
+		tenant_id
 		FROM saas_system_info ORDER BY created_at`
 	return database.SqlxSelect(m.DB, saasSystems, query)
 }