Skip to content

Commit 888fd5a

Browse files
AlinsRanCopilot
AlinsRan
and
Copilot
committed
fix: address review comments and fix lint errors
- Fix lint: wrap long lines in t/lib/server.lua mock functions - Add no_shuffle() to feishu-auth tests (stateful test ordering) - Add secret_fallbacks to encrypt_fields for consistent encryption - Clear client-supplied X-Userinfo header before authentication - Add canonical <head> links to EN/ZH plugin docs - Add encrypt_fields note to English docs (already in ZH docs) - Update ZH docs encrypt note to include secret_fallbacks Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent b63901e commit 888fd5a

5 files changed

Lines changed: 27 additions & 4 deletions

File tree

‎apisix/plugins/feishu-auth.lua‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ local schema = {
8383
},
8484

8585
},
86-
encrypt_fields = {"app_secret", "secret"},
86+
encrypt_fields = {"app_secret", "secret", "secret_fallbacks"},
8787
required = {"app_id", "app_secret", "secret", "auth_redirect_uri", "redirect_uri"},
8888
}
8989

@@ -207,6 +207,9 @@ end
207207
function _M.rewrite(conf, ctx)
208208
local userinfo, err
209209

210+
-- clear any client-supplied X-Userinfo before authentication
211+
core.request.set_header(ctx, "X-Userinfo", nil)
212+
210213
local sess, sess_err = session.open(
211214
{
212215
secret = conf.secret,

‎docs/en/latest/plugins/feishu-auth.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ description: This document contains information about the Apache APISIX feishu-a
2828
#
2929
-->
3030

31+
<head>
32+
<link rel="canonical" href="https://docs.api7.ai/hub/feishu-auth" />
33+
</head>
34+
3135
## Description
3236

3337
The `feishu-auth` Plugin authenticates requests using the [Feishu (Lark) OAuth 2.0](https://open.feishu.cn/document/uAjLw4CM/ukTMukTMukTM/authentication-management/access-token/oauth-2.0-overview) authorization flow. Users are redirected to the Feishu login page when unauthenticated. After a successful login, Feishu user information is stored in an encrypted session cookie and optionally forwarded to upstream services via the `X-Userinfo` header.
@@ -51,6 +55,12 @@ The `feishu-auth` Plugin authenticates requests using the [Feishu (Lark) OAuth 2
5155
| `timeout` | integer | False | `6000` | Timeout (in milliseconds) for HTTP requests to Feishu endpoints. |
5256
| `ssl_verify` | boolean | False | `true` | When enabled, verifies the SSL certificate when connecting to Feishu endpoints. |
5357

58+
:::note
59+
60+
The fields `app_secret`, `secret`, and `secret_fallbacks` are encrypted and stored in etcd. See [encrypted storage fields](../plugin-develop.md#encrypted-storage-fields) for more information.
61+
62+
:::
63+
5464
## Enable Plugin
5565

5666
You can enable the Plugin on a specific Route as shown below:

‎docs/zh/latest/plugins/feishu-auth.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ description: 本篇文档介绍了 Apache APISIX feishu-auth 插件的相关信
2828
#
2929
-->
3030

31+
<head>
32+
<link rel="canonical" href="https://docs.api7.ai/hub/feishu-auth" />
33+
</head>
34+
3135
## 描述
3236

3337
`feishu-auth` 插件使用[飞书（Lark）OAuth 2.0](https://open.feishu.cn/document/uAjLw4CM/ukTMukTMukTM/authentication-management/access-token/oauth-2.0-overview) 授权流程对请求进行认证。未认证的用户将被重定向到飞书登录页面，登录成功后，飞书用户信息将存储在加密的 session Cookie 中，并可通过 `X-Userinfo` 请求头转发给上游服务。
@@ -51,7 +55,7 @@ description: 本篇文档介绍了 Apache APISIX feishu-auth 插件的相关信
5155
| `timeout` | integer | 否 | `6000` | 请求飞书接口的超时时间（毫秒）。 |
5256
| `ssl_verify` | boolean | 否 | `true` | 开启后，连接飞书接口时会验证 SSL 证书。 |
5357

54-
注意：schema 中定义了 `encrypt_fields = {"app_secret", "secret"}`，这意味着这些字段将会被加密存储在 etcd 中。具体参考[加密存储字段](../plugin-develop.md#加密存储字段)。
58+
注意：schema 中定义了 `encrypt_fields = {"app_secret", "secret", "secret_fallbacks"}`，这意味着这些字段将会被加密存储在 etcd 中。具体参考[加密存储字段](../plugin-develop.md#加密存储字段)。
5559

5660
## 启用插件
5761

‎t/lib/server.lua‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1252,12 +1252,17 @@ function _M.feishu_token()
12521252
ngx.say([[{"code": 20051, "error_description": "Unauthorized"}]])
12531253
return
12541254
end
1255-
ngx.say([[{"code": 0, "expires_in": 7200, "access_token": "85b8b7665c4c3bc5bd91d8e6cb6594b7", "token_type": "Bearer"}]])
1255+
local token = '{"code":0,"expires_in":7200,'
1256+
.. '"access_token":"85b8b7665c4c3bc5bd91d8e6cb6594b7","token_type":"Bearer"}'
1257+
ngx.say(token)
12561258
end
12571259

12581260

12591261
function _M.feishu_userinfo()
1260-
ngx.say([[{"code": 0, "data": {"avatar_big": "https://example.com/big.jpg", "avatar_middle": "https://example.com/mid.jpg", "avatar_thumb": "https://example.com/thumb.jpg", "avatar_url": "https://example.com/url.jpg", "en_name": "jack", "name": "jack", "open_id": "ou_8fc70d9ea27111749a71eb", "tenant_key": "1224d18e8d", "union_id": "on_c249ec29c9d6"}, "msg": "success"}]])
1262+
local info = '{"code":0,"data":{"en_name":"jack","name":"jack",'
1263+
.. '"open_id":"ou_8fc70d9ea27111749a71eb","tenant_key":"1224d18e8d",'
1264+
.. '"union_id":"on_c249ec29c9d6"},"msg":"success"}'
1265+
ngx.say(info)
12611266
end
12621267

12631268

‎t/plugin/feishu-auth.t‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ repeat_each(1);
2020
log_level('warn');
2121
no_long_string();
2222
no_root_location();
23+
no_shuffle();
2324

2425
add_block_preprocessor(sub {
2526
my ($block) = @_;

0 commit comments

Comments
 (0)