Go+gRPC-Gateway(V2) 微服务实战，小程序登录鉴权服务(五)：鉴权 gRPC-Interceptor 拦截器实战

// UnaryInterceptor returns a ServerOption that sets the UnaryServerInterceptor for the
// server. Only one unary interceptor can be installed. The construction of multiple
// interceptors (e.g., chaining) can be implemented at the caller.
func UnaryInterceptor(i UnaryServerInterceptor) ServerOption {
  return newFuncServerOption(func(o *serverOptions) {
    if o.unaryInt != nil {
      panic("The unary server interceptor was already set and may not be reset.")
    }
    o.unaryInt = i
  })
}

// UnaryServerInterceptor provides a hook to intercept the execution of a unary RPC on the server. info
// contains all the information of this RPC the interceptor can operate on. And handler is the wrapper
// of the service method implementation. It is the responsibility of the interceptor to invoke handler
// to complete the RPC.
type UnaryServerInterceptor func(ctx context.Context, req interface{}, info *UnaryServerInfo, handler UnaryHandler) (resp interface{}, err error)

type interceptor struct {
  verifier tokenVerifier
}
func (i *interceptor) HandleReq(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
    // 拿到 token
  tkn, err := tokenFromContext(ctx)
  if err != nil {
    return nil, status.Error(codes.Unauthenticated, "")
  }
    // 验证 token
  aid, err := i.verifier.Verify(tkn)
  if err != nil {
    return nil, status.Errorf(codes.Unauthenticated, "token not valid: %v", err)
  }
  // 调用真正的 RPC 方法
  return handler(ContextWithAccountID(ctx, AccountID(aid)), req)
}

syntax = "proto3";
package todo.v1;
option go_package="server/todo/api/gen/v1;todopb";
message CreateTodoRequest {
    string title = 1;
}
message CreateTodoResponse {
}
service TodoService {
    rpc CreateTodo (CreateTodoRequest) returns (CreateTodoResponse);
}

type: google.api.Service
config_version: 3
http:
  rules:
  - selector: todo.v1.TodoService.CreateTodo
    post: /v1/todo
    body: "*"

sh gen.sh

sh gen_ts.sh

type Service struct {
  Logger *zap.Logger
  todopb.UnimplementedTodoServiceServer
}
func (s *Service) CreateTodo(c context.Context, req *todopb.CreateTodoRequest) (*todopb.CreateTodoResponse, error) {
    // 从 token 中解析出 accountId，确定身份后执行后续操作
  aid, err := auth.AcountIDFromContext(c)
  if err != nil {
    return nil, err
  }
  s.Logger.Info("create trip", zap.String("title", req.Title), zap.String("account_id", aid.String()))
  return nil, status.Error(codes.Unimplemented, "")
}

func RunGRPCServer(c *GRPCConfig) error {
  nameField := zap.String("name", c.Name)
  lis, err := net.Listen("tcp", c.Addr)
  if err != nil {
    c.Logger.Fatal("cannot listen", nameField, zap.Error(err))
  }
  var opts []grpc.ServerOption
  // 鉴权微服务是无需 auth 拦截器，这里做一下判断
  if c.AuthPublicKeyFile != "" {
    in, err := auth.Interceptor(c.AuthPublicKeyFile)
    if err != nil {
      c.Logger.Fatal("cannot create auth interceptor", nameField, zap.Error(err))
    }
    opts = append(opts, grpc.UnaryInterceptor(in))
  }
  s := grpc.NewServer(opts...)
  c.RegisterFunc(s)
  c.Logger.Info("server started", nameField, zap.String("addr", c.Addr))
  return s.Serve(lis)
}

logger.Sugar().Fatal(
    server.RunGRPCServer(&server.GRPCConfig{
      Name:              "todo",
      Addr:              ":8082",
      AuthPublicKeyFile: "shared/auth/public.key",
      Logger:            logger,
      RegisterFunc: func(s *grpc.Server) {
        todopb.RegisterTodoServiceServer(s, &todo.Service{
          Logger: logger,
        })
      },
    }),
)

logger.Sugar().Fatal(
  server.RunGRPCServer(&server.GRPCConfig{
    Name:   "auth",
    Addr:   ":8081",
    Logger: logger,
    RegisterFunc: func(s *grpc.Server) {
      authpb.RegisterAuthServiceServer(s, &auth.Service{
        OpenIDResolver: &wechat.Service{
          AppID:     "your-appid",
          AppSecret: "your-appsecret",
        },
        Mongo:          dao.NewMongo(mongoClient.Database("grpc-gateway-auth")),
        Logger:         logger,
        TokenExpire:    2 * time.Hour,
        TokenGenerator: token.NewJWTTokenGen("server/auth", privKey),
      })
    },
  }),
)

serverConfig := []struct {
  name         string
  addr         string
  registerFunc func(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error)
}{
  {
    name:         "auth",
    addr:         "localhost:8081",
    registerFunc: authpb.RegisterAuthServiceHandlerFromEndpoint,
  },
  {
    name:         "todo",
    addr:         "localhost:8082",
    registerFunc: todopb.RegisterTodoServiceHandlerFromEndpoint,
  },
}
for _, s := range serverConfig {
  err := s.registerFunc(
    c, mux, s.addr,
    []grpc.DialOption{grpc.WithInsecure()},
  )
  if err != nil {
    logger.Sugar().Fatalf("cannot register service %s : %v", s.name, err)
  }
}
addr := ":8080"
logger.Sugar().Infof("grpc gateway started at %s", addr)
logger.Sugar().Fatal(http.ListenAndServe(addr, mux))