708 lines
16 KiB
Go
708 lines
16 KiB
Go
swagger: "2.0"
|
|
info:
|
|
title: oc-auth
|
|
description: |
|
|
OpenCloud authentication services
|
|
version: 1.0.0
|
|
termsOfService: http://cloud.o-forge.io/
|
|
contact:
|
|
email: admin@o-cloud.io
|
|
license:
|
|
name: AGPL
|
|
url: https://www.gnu.org/licenses/agpl-3.0.html
|
|
basePath: /oc/
|
|
paths:
|
|
/consent:
|
|
get:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Hydra redirects here with a consent_challenge. Auto-accepts consent with user permissions.
|
|
<br>
|
|
operationId: OAuthController.Consent
|
|
parameters:
|
|
- in: query
|
|
name: consent_challenge
|
|
description: The consent challenge from Hydra
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.Redirect'
|
|
"400":
|
|
description: missing consent_challenge
|
|
"500":
|
|
description: internal error
|
|
/forward:
|
|
get:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Forward auth for Traefik — validates JWT via Hydra introspection.
|
|
<br>
|
|
operationId: OAuthController.AuthForward
|
|
parameters:
|
|
- in: header
|
|
name: Authorization
|
|
description: Bearer token
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string}'
|
|
/group/:
|
|
get:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
find groups
|
|
<br>
|
|
operationId: GroupController.GetAll
|
|
responses:
|
|
"200":
|
|
description: '{group} string'
|
|
/group/{id}:
|
|
get:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
find group by id
|
|
<br>
|
|
operationId: GroupController.Get
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{group} string'
|
|
post:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
create group
|
|
<br>
|
|
operationId: GroupController.Create
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} create success!'
|
|
delete:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
delete the group
|
|
<br>
|
|
operationId: GroupController.Delete
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: The id you want to delete
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} delete success!'
|
|
/group/{user_id}/{group_id}:
|
|
post:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
bind the group to user
|
|
<br>
|
|
operationId: GroupController.Bind
|
|
parameters:
|
|
- in: path
|
|
name: user_id
|
|
description: The user_id you want to bind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: group_id
|
|
description: The group_id you want to bind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
delete:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
unbind the group to user
|
|
<br>
|
|
operationId: GroupController.UnBind
|
|
parameters:
|
|
- in: path
|
|
name: user_id
|
|
description: The group_id you want to unbind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: group_id
|
|
description: The user_id you want to unbind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
/group/clear:
|
|
delete:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
clear the group
|
|
<br>
|
|
operationId: GroupController.Clear
|
|
responses:
|
|
"200":
|
|
description: '{string} delete success!'
|
|
/group/user/{id}:
|
|
get:
|
|
tags:
|
|
- group
|
|
description: |-
|
|
find group by user id
|
|
<br>
|
|
operationId: GroupController.GetByUser
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} string'
|
|
/introspect:
|
|
get:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Introspect a token — respects Hydra's response
|
|
<br>
|
|
operationId: OAuthController.Introspect
|
|
parameters:
|
|
- in: header
|
|
name: Authorization
|
|
description: Bearer token
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.IntrospectResult'
|
|
/login:
|
|
get:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Hydra redirects here with a login_challenge. Returns challenge info or auto-accepts if session exists.
|
|
<br>
|
|
operationId: OAuthController.GetLogin
|
|
parameters:
|
|
- in: query
|
|
name: login_challenge
|
|
description: The login challenge from Hydra
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.LoginChallenge'
|
|
"400":
|
|
description: missing login_challenge
|
|
"500":
|
|
description: internal error
|
|
post:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Authenticate user via LDAP and accept Hydra login challenge
|
|
<br>
|
|
operationId: OAuthController.PostLogin
|
|
parameters:
|
|
- in: body
|
|
name: body
|
|
description: Login credentials and challenge
|
|
required: true
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.LoginRequest'
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.Redirect'
|
|
"401":
|
|
description: invalid credentials
|
|
"500":
|
|
description: internal error
|
|
/logout:
|
|
get:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Hydra redirects here with a logout_challenge. Accepts the challenge and returns a redirect URL.
|
|
<br>
|
|
operationId: OAuthController.GetLogout
|
|
parameters:
|
|
- in: query
|
|
name: logout_challenge
|
|
description: The logout challenge from Hydra
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.Redirect'
|
|
"400":
|
|
description: missing logout_challenge
|
|
"500":
|
|
description: internal error
|
|
delete:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Revoke an OAuth2 token
|
|
<br>
|
|
operationId: OAuthController.Logout
|
|
parameters:
|
|
- in: header
|
|
name: Authorization
|
|
description: Bearer token
|
|
type: string
|
|
- in: query
|
|
name: client_id
|
|
description: The client_id
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.Token'
|
|
/permission/:
|
|
get:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
find permissions
|
|
<br>
|
|
operationId: PermissionController.GetAll
|
|
responses:
|
|
"200":
|
|
description: '{permission} string'
|
|
/permission/{id}/{relation}:
|
|
get:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
find auth by permission
|
|
<br>
|
|
operationId: PermissionController.Get
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the permission you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} models.auth'
|
|
/permission/{permission_id}/{role_id}/{relation}:
|
|
post:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
bind the permission to role
|
|
<br>
|
|
operationId: PermissionController.Bind
|
|
parameters:
|
|
- in: path
|
|
name: role_id
|
|
description: The role_id you want to bind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: method
|
|
description: The method you want to relate role & permission
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: permission_id
|
|
description: The permission_id you want to bind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
delete:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
unbind the permission to role
|
|
<br>
|
|
operationId: PermissionController.UnBind
|
|
parameters:
|
|
- in: path
|
|
name: role_id
|
|
description: The role_id you want to unbind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: relation
|
|
description: The method you want to unrelate role & permission
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: permission_id
|
|
description: The permission_id you want to unbind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
/permission/clear:
|
|
delete:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
clear the permission
|
|
<br>
|
|
operationId: PermissionController.Clear
|
|
responses:
|
|
"200":
|
|
description: '{string} delete success!'
|
|
/permission/role/{id}:
|
|
get:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
find permission by role id
|
|
<br>
|
|
operationId: PermissionController.GetByRole
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} string'
|
|
/permission/user/{id}:
|
|
get:
|
|
tags:
|
|
- permission
|
|
description: |-
|
|
find permission by user id
|
|
<br>
|
|
operationId: PermissionController.GetByUser
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} string'
|
|
/refresh:
|
|
post:
|
|
tags:
|
|
- oc-auth/controllersOAuthController
|
|
description: |-
|
|
Exchange a refresh_token for a new token set
|
|
<br>
|
|
operationId: OAuthController.Refresh
|
|
parameters:
|
|
- in: body
|
|
name: body
|
|
description: refresh_token and client_id
|
|
required: true
|
|
schema:
|
|
$ref: '#/definitions/object'
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
schema:
|
|
$ref: '#/definitions/auth_connectors.TokenResponse'
|
|
"401":
|
|
description: invalid refresh token
|
|
/role/:
|
|
get:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
find roles
|
|
<br>
|
|
operationId: RoleController.GetAll
|
|
responses:
|
|
"200":
|
|
description: '{role} string'
|
|
/role/{id}:
|
|
get:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
find role by id
|
|
<br>
|
|
operationId: RoleController.Get
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{role} string'
|
|
post:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
create role
|
|
<br>
|
|
operationId: RoleController.Create
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} create success!'
|
|
delete:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
delete the role
|
|
<br>
|
|
operationId: RoleController.Delete
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: The id you want to delete
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} delete success!'
|
|
/role/{user_id}/{role_id}:
|
|
post:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
bind the role to user
|
|
<br>
|
|
operationId: RoleController.Bind
|
|
parameters:
|
|
- in: path
|
|
name: user_id
|
|
description: The user_id you want to bind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: role_id
|
|
description: The role_id you want to bind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
delete:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
unbind the role to user
|
|
<br>
|
|
operationId: RoleController.UnBind
|
|
parameters:
|
|
- in: path
|
|
name: role_id
|
|
description: The role_id you want to unbind
|
|
required: true
|
|
type: string
|
|
- in: path
|
|
name: user_id
|
|
description: The user_id you want to unbind
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{string} bind success!'
|
|
/role/clear:
|
|
delete:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
clear the role
|
|
<br>
|
|
operationId: RoleController.Clear
|
|
responses:
|
|
"200":
|
|
description: '{string} delete success!'
|
|
/role/user/{id}:
|
|
get:
|
|
tags:
|
|
- role
|
|
description: |-
|
|
find role by user id
|
|
<br>
|
|
operationId: RoleController.GetByUser
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
description: the id you want to get
|
|
required: true
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: '{auth} string'
|
|
/version/:
|
|
get:
|
|
tags:
|
|
- version
|
|
description: |-
|
|
get version
|
|
<br>
|
|
operationId: VersionController.GetAll
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
/version/discovery:
|
|
get:
|
|
tags:
|
|
- version
|
|
description: |-
|
|
get version
|
|
<br>
|
|
operationId: VersionController.Get
|
|
responses:
|
|
"200":
|
|
description: ""
|
|
definitions:
|
|
2432.0xc000460e70.false:
|
|
title: "false"
|
|
type: object
|
|
4171.0xc000461050.false:
|
|
title: "false"
|
|
type: object
|
|
auth_connectors.IntrospectResult:
|
|
title: IntrospectResult
|
|
type: object
|
|
properties:
|
|
active:
|
|
type: boolean
|
|
client_id:
|
|
type: string
|
|
exp:
|
|
type: integer
|
|
format: int64
|
|
ext:
|
|
$ref: '#/definitions/4171.0xc000461050.false'
|
|
scope:
|
|
type: string
|
|
sub:
|
|
type: string
|
|
token_type:
|
|
type: string
|
|
auth_connectors.LoginChallenge:
|
|
title: LoginChallenge
|
|
type: object
|
|
properties:
|
|
challenge:
|
|
type: string
|
|
client:
|
|
$ref: '#/definitions/2432.0xc000460e70.false'
|
|
request_url:
|
|
type: string
|
|
session_id:
|
|
type: string
|
|
skip:
|
|
type: boolean
|
|
subject:
|
|
type: string
|
|
auth_connectors.LoginRequest:
|
|
title: LoginRequest
|
|
type: object
|
|
properties:
|
|
login_challenge:
|
|
type: string
|
|
password:
|
|
type: string
|
|
username:
|
|
type: string
|
|
auth_connectors.Redirect:
|
|
title: Redirect
|
|
type: object
|
|
properties:
|
|
redirect_to:
|
|
type: string
|
|
auth_connectors.Token:
|
|
title: Token
|
|
type: object
|
|
properties:
|
|
access_token:
|
|
type: string
|
|
active:
|
|
type: boolean
|
|
expires_in:
|
|
type: integer
|
|
format: int64
|
|
id_token:
|
|
type: string
|
|
refresh_token:
|
|
type: string
|
|
scope:
|
|
type: string
|
|
token_type:
|
|
type: string
|
|
auth_connectors.TokenResponse:
|
|
title: TokenResponse
|
|
type: object
|
|
properties:
|
|
access_token:
|
|
type: string
|
|
expires_in:
|
|
type: integer
|
|
format: int64
|
|
id_token:
|
|
type: string
|
|
refresh_token:
|
|
type: string
|
|
scope:
|
|
type: string
|
|
token_type:
|
|
type: string
|
|
object:
|
|
title: object
|
|
type: object
|
|
tags:
|
|
- name: oc-auth/controllersOAuthController
|
|
description: |
|
|
OAuthController handles OAuth2 login/consent provider endpoints
|
|
- name: group
|
|
description: |
|
|
Operations about auth
|
|
- name: role
|
|
description: |
|
|
Operations about auth
|
|
- name: permission
|
|
description: |
|
|
Operations about auth
|
|
- name: version
|
|
description: |
|
|
VersionController operations for Version
|