feat(auth): add GitLab OAuth2 provider support #264
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| package com.iflytek.skillhub.auth.oauth; | ||
|
|
||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.http.HttpHeaders; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest; | ||
| import org.springframework.security.oauth2.core.user.OAuth2User; | ||
| import org.springframework.stereotype.Component; | ||
| import org.springframework.web.client.RestClient; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Provider-specific claims extractor that enriches GitLab OAuth users with their | ||
| * verified email information. | ||
| * | ||
| * <p>GitLab OAuth2 user info endpoint returns user profile data. This extractor | ||
| * fetches additional email information from GitLab API when needed. | ||
| */ | ||
| @Component | ||
| public class GitLabClaimsExtractor implements OAuthClaimsExtractor { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(GitLabClaimsExtractor.class); | ||
|
|
||
| private final RestClient restClient; | ||
|
|
||
| public GitLabClaimsExtractor() { | ||
| this.restClient = RestClient.builder() | ||
| .defaultHeader(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE) | ||
| .build(); | ||
| } | ||
|
|
||
| @Override | ||
| public String getProvider() { | ||
| return "gitlab"; | ||
| } | ||
|
|
||
| @Override | ||
| public OAuthClaims extract(OAuth2UserRequest request, OAuth2User oAuth2User) { | ||
| Map<String, Object> attrs = oAuth2User.getAttributes(); | ||
| log.debug("Extracting GitLab OAuth claims for user attributes: {}", attrs.keySet()); | ||
|
|
||
| // GitLab returns email directly in user info | ||
| String email = (String) attrs.get("email"); | ||
|
|
||
| // GitLab provides email_verified field in the user info response | ||
| Boolean emailVerifiedObj = (Boolean) attrs.get("email_verified"); | ||
| boolean emailVerified = emailVerifiedObj != null && emailVerifiedObj; | ||
|
|
||
| log.debug("Initial email from GitLab: {}, verified: {}", email, emailVerified); | ||
|
|
||
| // If email is not verified or not present, try to fetch from emails API | ||
| if (email == null || !emailVerified) { | ||
| log.debug("Email not verified or missing, attempting to fetch from GitLab emails API"); | ||
| GitLabEmail primaryEmail = loadPrimaryEmail(request); | ||
| if (primaryEmail != null) { | ||
| email = primaryEmail.email(); | ||
| emailVerified = true; | ||
| log.debug("Found verified email from GitLab API: {}", email); | ||
| } else { | ||
| log.debug("No verified email found from GitLab emails API"); | ||
| } | ||
| } | ||
|
|
||
| // GitLab uses "username" for login name | ||
| String username = (String) attrs.get("username"); | ||
| if (username == null) { | ||
| username = (String) attrs.get("login"); | ||
| } | ||
|
|
||
| String subject = String.valueOf(attrs.get("id")); | ||
| log.info("GitLab OAuth claims extracted - subject: {}, username: {}, email: {}, emailVerified: {}", | ||
| subject, username, email, emailVerified); | ||
|
|
||
| return new OAuthClaims( | ||
| "gitlab", | ||
| subject, | ||
| email, | ||
| emailVerified, | ||
| username, | ||
| attrs | ||
| ); | ||
| } | ||
|
|
||
| private GitLabEmail loadPrimaryEmail(OAuth2UserRequest request) { | ||
| String baseUrl = getGitLabApiBaseUrl(request); | ||
| log.debug("Loading primary email from GitLab API base URL: {}", baseUrl); | ||
|
|
||
| try { | ||
| List<GitLabEmail> emails = restClient.get() | ||
| .uri(baseUrl + "/user/emails") | ||
| .header(HttpHeaders.AUTHORIZATION, "Bearer " + request.getAccessToken().getTokenValue()) | ||
| .retrieve() | ||
| .body(new org.springframework.core.ParameterizedTypeReference<List<GitLabEmail>>() {}); | ||
|
|
||
| if (emails == null || emails.isEmpty()) { | ||
| log.debug("No emails returned from GitLab emails API"); | ||
| return null; | ||
| } | ||
|
|
||
| log.debug("Retrieved {} emails from GitLab API", emails.size()); | ||
|
|
||
| // Return the primary verified email | ||
| return emails.stream() | ||
| .filter(GitLabEmail::confirmed) | ||
| .findFirst() | ||
| .orElse(null); | ||
| } catch (Exception e) { | ||
| log.warn("Failed to fetch emails from GitLab API: {}", e.getMessage()); | ||
| return null; | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Determines the GitLab API base URL from the provider configuration. | ||
| * The user-info-uri is configured as ${OAUTH2_GITLAB_BASE_URI}/api/v4/user, | ||
| * so we simply remove the /user suffix to get the API base URL. | ||
| */ | ||
|
Collaborator
There was a problem hiding this comment.
如果自建 GitLab 的域名或路径中包含 "user"（例如 建议改为： if (userInfoUri.endsWith("/user")) {
return userInfoUri.substring(0, userInfoUri.length() - "/user".length());
}
return userInfoUri; |
||
| private String getGitLabApiBaseUrl(OAuth2UserRequest request) { | ||
| String userInfoUri = request.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri(); | ||
| log.debug("GitLab user info URI: {}", userInfoUri); | ||
| // user-info-uri format: ${OAUTH2_GITLAB_BASE_URI}/api/v4/user | ||
| // Remove /user suffix to get API base URL | ||
| String baseUrl = userInfoUri.replace("/user", ""); | ||
| log.debug("GitLab API base URL: {}", baseUrl); | ||
| return baseUrl; | ||
| } | ||
|
|
||
| /** | ||
| * Represents a GitLab email object from the /user/emails API. | ||
| * | ||
| * @param email the email address | ||
| * @param confirmed whether the email has been confirmed | ||
| */ | ||
| private record GitLabEmail(String email, boolean confirmed) {} | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
scope 格式不一致
GitHub 已改为 YAML list 格式，但 GitLab 仍用逗号分隔字符串。Spring Security 对逗号分隔 scope 的处理可能因版本而异，建议统一为 list 格式：