@@ -13,7 +13,6 @@ import (
1313 "github.com/heliannuuthus/helios/pkg/aegis/key"
1414 pkgtoken "github.com/heliannuuthus/helios/pkg/aegis/token"
1515 tokendef "github.com/heliannuuthus/helios/pkg/aegis/utils/token"
16- "github.com/heliannuuthus/helios/pkg/logger"
1716)
1817
1918// Service is the token service that handles issuing and verifying all token types.
@@ -26,10 +25,9 @@ type Service struct {
2625 appKeyProvider key.Provider // clientID → app.Key
2726
2827 domainSigners map [string ]* Signer
29- domainVerifiers map [string ]* pkgtoken.Verifier
3028 serviceEncryptors map [string ]* Encryptor
31- serviceDecryptors map [string ]* pkgtoken.Decryptor
32- appVerifiers map [ string ] * pkgtoken.Verifier
29+ domainDecryptors map [string ]* pkgtoken.Decryptor // audience → Decryptor (signKey=domain, encryptKey=service)
30+ appDecryptor * pkgtoken.Decryptor // CAT 专用（signKey=app, 只验签, encryptKey=nil）
3331 mu sync.RWMutex
3432}
3533
@@ -46,10 +44,9 @@ func NewService(
4644 serviceKeyProvider : serviceKeyProvider ,
4745 appKeyProvider : appKeyProvider ,
4846 domainSigners : make (map [string ]* Signer ),
49- domainVerifiers : make (map [string ]* pkgtoken.Verifier ),
5047 serviceEncryptors : make (map [string ]* Encryptor ),
51- serviceDecryptors : make (map [string ]* pkgtoken.Decryptor ),
52- appVerifiers : make ( map [ string ] * pkgtoken.Verifier ),
48+ domainDecryptors : make (map [string ]* pkgtoken.Decryptor ),
49+ appDecryptor : pkgtoken .NewDecryptor ( "" , nil , appKeyProvider ),
5350 }
5451}
5552
@@ -101,14 +98,21 @@ func (s *Service) Verify(ctx context.Context, tokenString string) (Token, error)
10198 return nil , fmt .Errorf ("get client_id: %w" , err )
10299 }
103100
104- var verifier * pkgtoken.Verifier
105101 if tokenType == tokendef .TokenTypeCAT {
106- verifier = s .appVerifier (clientID )
107- } else {
108- verifier = s .domainVerifier (clientID )
102+ pasetoToken , err = s .appDecryptor .Verifier (clientID ).Verify (ctx , tokenString )
103+ if err != nil {
104+ return nil , fmt .Errorf ("verify signature: %w" , err )
105+ }
106+ return tokendef .ParseToken (pasetoToken , tokenType )
107+ }
108+
109+ audience , err := tokendef .GetAudience (pasetoToken )
110+ if err != nil {
111+ return nil , fmt .Errorf ("get audience: %w" , err )
109112 }
110113
111- pasetoToken , err = verifier .Verify (ctx , tokenString )
114+ decryptor := s .domainDecryptor (audience )
115+ pasetoToken , err = decryptor .Verifier (clientID ).Verify (ctx , tokenString )
112116 if err != nil {
113117 return nil , fmt .Errorf ("verify signature: %w" , err )
114118 }
@@ -129,11 +133,7 @@ func (s *Service) Verify(ctx context.Context, tokenString string) (Token, error)
129133 return nil , errors .New ("missing encrypted sub" )
130134 }
131135
132- audience , err := tokendef .GetAudience (pasetoToken )
133- if err != nil {
134- logger .Warnf ("failed to get audience from token: %v" , err )
135- }
136- innerToken , err := s .serviceDecryptor (audience ).Decrypt (ctx , encryptedSub )
136+ innerToken , err := decryptor .Decrypt (ctx , encryptedSub )
137137 if err != nil {
138138 return nil , fmt .Errorf ("decrypt sub: %w" , err )
139139 }
@@ -166,26 +166,6 @@ func (s *Service) domainSigner(clientID string) *Signer {
166166 return signer
167167}
168168
169- func (s * Service ) domainVerifier (clientID string ) * pkgtoken.Verifier {
170- s .mu .RLock ()
171- verifier , ok := s .domainVerifiers [clientID ]
172- s .mu .RUnlock ()
173- if ok {
174- return verifier
175- }
176-
177- s .mu .Lock ()
178- defer s .mu .Unlock ()
179-
180- if verifier , ok := s .domainVerifiers [clientID ]; ok {
181- return verifier
182- }
183-
184- verifier = pkgtoken .NewVerifier (s .domainKeyProvider , clientID )
185- s .domainVerifiers [clientID ] = verifier
186- return verifier
187- }
188-
189169func (s * Service ) serviceEncryptor (audience string ) * Encryptor {
190170 s .mu .RLock ()
191171 encryptor , ok := s .serviceEncryptors [audience ]
@@ -206,9 +186,9 @@ func (s *Service) serviceEncryptor(audience string) *Encryptor {
206186 return encryptor
207187}
208188
209- func (s * Service ) serviceDecryptor (audience string ) * pkgtoken.Decryptor {
189+ func (s * Service ) domainDecryptor (audience string ) * pkgtoken.Decryptor {
210190 s .mu .RLock ()
211- decryptor , ok := s .serviceDecryptors [audience ]
191+ decryptor , ok := s .domainDecryptors [audience ]
212192 s .mu .RUnlock ()
213193 if ok {
214194 return decryptor
@@ -217,35 +197,15 @@ func (s *Service) serviceDecryptor(audience string) *pkgtoken.Decryptor {
217197 s .mu .Lock ()
218198 defer s .mu .Unlock ()
219199
220- if decryptor , ok := s .serviceDecryptors [audience ]; ok {
200+ if decryptor , ok := s .domainDecryptors [audience ]; ok {
221201 return decryptor
222202 }
223203
224- decryptor = pkgtoken .NewDecryptor (s .serviceKeyProvider , audience )
225- s .serviceDecryptors [audience ] = decryptor
204+ decryptor = pkgtoken .NewDecryptor (audience , s .serviceKeyProvider , s . domainKeyProvider )
205+ s .domainDecryptors [audience ] = decryptor
226206 return decryptor
227207}
228208
229- func (s * Service ) appVerifier (clientID string ) * pkgtoken.Verifier {
230- s .mu .RLock ()
231- verifier , ok := s .appVerifiers [clientID ]
232- s .mu .RUnlock ()
233- if ok {
234- return verifier
235- }
236-
237- s .mu .Lock ()
238- defer s .mu .Unlock ()
239-
240- if verifier , ok := s .appVerifiers [clientID ]; ok {
241- return verifier
242- }
243-
244- verifier = pkgtoken .NewVerifier (s .appKeyProvider , clientID )
245- s .appVerifiers [clientID ] = verifier
246- return verifier
247- }
248-
249209// ============= Payload Encryption Helpers =============
250210
251211// marshalPayload extracts the payload that needs encryption for UAT and SSO tokens.
0 commit comments