wehub-resource-sync
4cddfcf2f3
Backend Tests / Tests (other) (push) Failing after 1s
Backend Tests / Static Checks (push) Failing after 2s
Backend Tests / Tests (internal) (push) Failing after 2s
Backend Tests / Tests (server) (push) Failing after 1s
Backend Tests / Tests (store) (push) Failing after 1s
Build Canary Image / build-frontend (push) Failing after 1s
Frontend Tests / Lint (push) Failing after 1s
Build Canary Image / build-push (linux/amd64) (push) Has been skipped
Build Canary Image / build-push (linux/arm64) (push) Has been skipped
Build Canary Image / merge (push) Has been skipped
Frontend Tests / Build (push) Failing after 1s
Release Please / release-please (push) Failing after 0s
Proto Linter / Lint Protos (push) Failing after 2s
84 lines
3.8 KiB
Go
84 lines
3.8 KiB
Go
package v1
|
|
|
|
// PublicMethods defines API endpoints that don't require authentication.
|
|
// All other endpoints require a valid session or access token.
|
|
//
|
|
// This is the SINGLE SOURCE OF TRUTH for public endpoints.
|
|
// Both Connect interceptor and gRPC-Gateway interceptor use this map.
|
|
//
|
|
// Format: Full gRPC procedure path as returned by req.Spec().Procedure (Connect)
|
|
// or info.FullMethod (gRPC interceptor).
|
|
var PublicMethods = map[string]struct{}{
|
|
// Auth Service - login/token endpoints must be accessible without auth
|
|
"/memos.api.v1.AuthService/SignIn": {},
|
|
"/memos.api.v1.AuthService/RefreshToken": {}, // Token refresh uses cookie, must be accessible when access token expired
|
|
|
|
// Instance Service - needed before login to show instance info
|
|
"/memos.api.v1.InstanceService/GetInstanceProfile": {},
|
|
"/memos.api.v1.InstanceService/GetInstanceSetting": {},
|
|
"/memos.api.v1.InstanceService/BatchGetInstanceSettings": {},
|
|
|
|
// User Service - public user profiles and stats
|
|
"/memos.api.v1.UserService/CreateUser": {}, // Allow first user registration
|
|
"/memos.api.v1.UserService/GetUser": {},
|
|
"/memos.api.v1.UserService/BatchGetUsers": {},
|
|
"/memos.api.v1.UserService/GetUserAvatar": {},
|
|
"/memos.api.v1.UserService/GetUserStats": {},
|
|
"/memos.api.v1.UserService/ListAllUserStats": {},
|
|
|
|
// Identity Provider Service - SSO buttons on login page
|
|
"/memos.api.v1.IdentityProviderService/ListIdentityProviders": {},
|
|
|
|
// Memo Service - public memos (visibility filtering done in service layer)
|
|
"/memos.api.v1.MemoService/GetMemo": {},
|
|
"/memos.api.v1.MemoService/ListMemos": {},
|
|
"/memos.api.v1.MemoService/ListMemoComments": {},
|
|
"/memos.api.v1.MemoService/GetLinkMetadata": {},
|
|
"/memos.api.v1.MemoService/BatchGetLinkMetadata": {},
|
|
|
|
// Memo sharing - share-token endpoints require no authentication
|
|
"/memos.api.v1.MemoService/GetMemoByShare": {},
|
|
}
|
|
|
|
// IsPublicMethod checks if a procedure path is public (no authentication required).
|
|
// Returns true for public methods, false for protected methods.
|
|
func IsPublicMethod(procedure string) bool {
|
|
_, ok := PublicMethods[procedure]
|
|
return ok
|
|
}
|
|
|
|
// AuthBootstrapMethods is the subset of PublicMethods that stays reachable by
|
|
// anonymous callers even when the instance is private (no InstanceURL configured).
|
|
//
|
|
// It is the minimum required to render the sign-in page, authenticate, and follow
|
|
// share links. Every entry here MUST also exist in PublicMethods. CreateUser is
|
|
// intentionally excluded and handled separately (allowed only during first-run
|
|
// setup, while the instance has no users yet).
|
|
var AuthBootstrapMethods = map[string]struct{}{
|
|
// Auth Service - sign-in and token refresh.
|
|
"/memos.api.v1.AuthService/SignIn": {},
|
|
"/memos.api.v1.AuthService/RefreshToken": {},
|
|
|
|
// Instance Service - needed to render the sign-in page (branding, auth options).
|
|
"/memos.api.v1.InstanceService/GetInstanceProfile": {},
|
|
"/memos.api.v1.InstanceService/GetInstanceSetting": {},
|
|
"/memos.api.v1.InstanceService/BatchGetInstanceSettings": {},
|
|
|
|
// Identity Provider Service - SSO buttons on the sign-in page.
|
|
"/memos.api.v1.IdentityProviderService/ListIdentityProviders": {},
|
|
|
|
// Memo sharing - share-token access stays public even on a private instance.
|
|
"/memos.api.v1.MemoService/GetMemoByShare": {},
|
|
}
|
|
|
|
// createUserProcedure is the CreateUser endpoint. On a private instance it is
|
|
// served to anonymous callers only while no user exists yet (initial admin setup).
|
|
const createUserProcedure = "/memos.api.v1.UserService/CreateUser"
|
|
|
|
// IsAuthBootstrapMethod reports whether an anonymous request to procedure is one
|
|
// of the fixed endpoints allowed while the instance is private.
|
|
func IsAuthBootstrapMethod(procedure string) bool {
|
|
_, ok := AuthBootstrapMethods[procedure]
|
|
return ok
|
|
}
|