83 lines
2.0 KiB
Go
83 lines
2.0 KiB
Go
package security
|
||
|
||
import (
|
||
"crypto/hmac"
|
||
"crypto/sha256"
|
||
"encoding/base64"
|
||
"fmt"
|
||
"io"
|
||
"math"
|
||
"net/url"
|
||
"strconv"
|
||
"time"
|
||
)
|
||
|
||
// https://oapi.dingtalk.com/robot/send?access_token=xxx
|
||
const dingTalkOAPI = "oapi.dingtalk.com"
|
||
|
||
var dingTalkURL url.URL = url.URL{
|
||
Scheme: "https",
|
||
Host: dingTalkOAPI,
|
||
Path: "robot/send",
|
||
}
|
||
|
||
// URL get DingTalk URL with accessToken & secret
|
||
// If no signature is set, the secret is set to ""
|
||
// 如果没有加签，secret 设置为 "" 即可
|
||
func URL(accessToken string, secret string) (string, error) {
|
||
timestamp := strconv.FormatInt(time.Now().Unix()*1000, 10)
|
||
return URLWithTimestamp(timestamp, accessToken, secret)
|
||
}
|
||
|
||
// URLWithTimestamp get DingTalk URL with timestamp & accessToken & secret
|
||
func URLWithTimestamp(timestamp string, accessToken string, secret string) (string, error) {
|
||
dtu := dingTalkURL
|
||
value := url.Values{}
|
||
value.Set("access_token", accessToken)
|
||
|
||
if secret == "" {
|
||
dtu.RawQuery = value.Encode()
|
||
return dtu.String(), nil
|
||
}
|
||
|
||
sign, err := sign(timestamp, secret)
|
||
if err != nil {
|
||
dtu.RawQuery = value.Encode()
|
||
return dtu.String(), err
|
||
}
|
||
|
||
value.Set("timestamp", timestamp)
|
||
value.Set("sign", sign)
|
||
dtu.RawQuery = value.Encode()
|
||
return dtu.String(), nil
|
||
}
|
||
|
||
// Validate validate
|
||
// https://ding-doc.dingtalk.com/doc#/serverapi2/elzz1p
|
||
func Validate(signStr, timestamp, secret string) (bool, error) {
|
||
t, err := strconv.ParseInt(timestamp, 10, 64)
|
||
if err != nil {
|
||
return false, err
|
||
}
|
||
|
||
timeGap := time.Since(time.Unix(t, 0))
|
||
if math.Abs(timeGap.Hours()) > 1 {
|
||
return false, fmt.Errorf("specified timestamp is expired")
|
||
}
|
||
|
||
ourSign, err := sign(timestamp, secret)
|
||
if err != nil {
|
||
return false, err
|
||
}
|
||
return ourSign == signStr, nil
|
||
}
|
||
|
||
func sign(timestamp string, secret string) (string, error) {
|
||
stringToSign := fmt.Sprintf("%s\n%s", timestamp, secret)
|
||
h := hmac.New(sha256.New, []byte(secret))
|
||
if _, err := io.WriteString(h, stringToSign); err != nil {
|
||
return "", err
|
||
}
|
||
return base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
|
||
}
|