256 lines
8.3 KiB
Go
256 lines
8.3 KiB
Go
|
package usecase
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"context"
|
|||
|
|
"strings"
|
|||
|
|
|
|||
|
|
"haixun-backend/internal/library/clock"
|
|||
|
|
app "haixun-backend/internal/library/errors"
|
|||
|
|
"haixun-backend/internal/library/errors/code"
|
|||
|
|
libthreads "haixun-backend/internal/library/threadsapi"
|
|||
|
|
"haixun-backend/internal/model/threads_account/domain/entity"
|
|||
|
|
domrepo "haixun-backend/internal/model/threads_account/domain/repository"
|
|||
|
|
domusecase "haixun-backend/internal/model/threads_account/domain/usecase"
|
|||
|
|
|
|||
|
|
"github.com/google/uuid"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
func (u *threadsAccountUseCase) StartThreadsOAuth(
|
|||
|
|
ctx context.Context,
|
|||
|
|
tenantID, ownerUID, accountID string,
|
|||
|
|
) (*domusecase.OAuthStartResult, error) {
|
|||
|
|
if err := requireActor(tenantID, ownerUID); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
if !u.oauth.Enabled() {
|
|||
|
|
return nil, app.For(code.ThreadsAccount).InputMissingRequired("Threads OAuth 尚未設定（THREADS_APP_ID / THREADS_APP_SECRET / THREADS_REDIRECT_URI）")
|
|||
|
|
}
|
|||
|
|
if u.oauthState == nil {
|
|||
|
|
return nil, app.For(code.ThreadsAccount).DBUnavailable("Redis 未設定，無法保存 OAuth state")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
accountID = strings.TrimSpace(accountID)
|
|||
|
|
var account *entity.Account
|
|||
|
|
var err error
|
|||
|
|
if accountID != "" {
|
|||
|
|
account, err = u.assertOwned(ctx, tenantID, ownerUID, accountID)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
} else {
|
|||
|
|
existing, listErr := u.repo.ListByOwner(ctx, tenantID, ownerUID)
|
|||
|
|
if listErr != nil {
|
|||
|
|
return nil, listErr
|
|||
|
|
}
|
|||
|
|
created, createErr := u.Create(ctx, domusecase.CreateRequest{
|
|||
|
|
TenantID: tenantID,
|
|||
|
|
OwnerUID: ownerUID,
|
|||
|
|
DisplayName: "Threads 帳號 " + itoa(len(existing)+1),
|
|||
|
|
Activate: false,
|
|||
|
|
})
|
|||
|
|
if createErr != nil {
|
|||
|
|
return nil, createErr
|
|||
|
|
}
|
|||
|
|
account, err = u.assertOwned(ctx, tenantID, ownerUID, created.ID)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
state := uuid.NewString()
|
|||
|
|
if err := u.oauthState.Save(ctx, state, domrepo.OAuthStatePayload{
|
|||
|
|
TenantID: tenantID,
|
|||
|
|
OwnerUID: ownerUID,
|
|||
|
|
AccountID: account.ID,
|
|||
|
|
}); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
authorizeURL, err := libthreads.BuildAuthorizeURL(u.oauth, state)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
redirectURI := strings.TrimSpace(u.oauth.RedirectURI)
|
|||
|
|
if !strings.HasPrefix(strings.ToLower(redirectURI), "https://") {
|
|||
|
|
recordOAuthDebug("error", "start", account.ID, "redirect_uri must be https:// (Meta error 1349187): "+redirectURI)
|
|||
|
|
return nil, app.For(code.ThreadsAccount).InputInvalidFormat("THREADS_REDIRECT_URI 必須為 https://（Meta 會拒絕 http://，錯誤碼 1349187）")
|
|||
|
|
}
|
|||
|
|
recordOAuthDebug("info", "start", account.ID, "redirect_uri="+redirectURI)
|
|||
|
|
return &domusecase.OAuthStartResult{
|
|||
|
|
AuthorizeURL: authorizeURL,
|
|||
|
|
State: state,
|
|||
|
|
AccountID: account.ID,
|
|||
|
|
}, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func (u *threadsAccountUseCase) CompleteThreadsOAuthCallback(
|
|||
|
|
ctx context.Context,
|
|||
|
|
authCode, state string,
|
|||
|
|
) (*domusecase.OAuthCallbackResult, error) {
|
|||
|
|
if !u.oauth.Enabled() {
|
|||
|
|
return nil, app.For(code.ThreadsAccount).InputMissingRequired("Threads OAuth 尚未設定")
|
|||
|
|
}
|
|||
|
|
if u.oauthState == nil {
|
|||
|
|
return nil, app.For(code.ThreadsAccount).DBUnavailable("Redis 未設定")
|
|||
|
|
}
|
|||
|
|
recordOAuthDebug("info", "callback", "", "received code len="+itoa(len(strings.TrimSpace(authCode)))+" state len="+itoa(len(strings.TrimSpace(state))))
|
|||
|
|
payload, err := u.oauthState.Consume(ctx, state)
|
|||
|
|
if err != nil {
|
|||
|
|
recordOAuthDebug("error", "consume_state", "", err.Error())
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
short, err := libthreads.ExchangeCodeForToken(ctx, u.oauth, authCode)
|
|||
|
|
if err != nil {
|
|||
|
|
recordOAuthDebug("error", "exchange_code", payload.AccountID, err.Error())
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
recordOAuthDebug("info", "exchange_code", payload.AccountID, "short-lived ok expires_in="+itoa(short.ExpiresIn))
|
|||
|
|
longLived, err := libthreads.ExchangeLongLivedToken(ctx, u.oauth, short.AccessToken)
|
|||
|
|
if err != nil {
|
|||
|
|
recordOAuthDebug("warn", "long_lived", payload.AccountID, "fallback short-lived: "+err.Error())
|
|||
|
|
longLived = short
|
|||
|
|
} else {
|
|||
|
|
recordOAuthDebug("info", "long_lived", payload.AccountID, "ok expires_in="+itoa(longLived.ExpiresIn))
|
|||
|
|
}
|
|||
|
|
account, err := u.assertOwned(ctx, payload.TenantID, payload.OwnerUID, payload.AccountID)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
profile, err := libthreads.GetMeProfile(ctx, longLived.AccessToken)
|
|||
|
|
threadsUserID := ""
|
|||
|
|
username := ""
|
|||
|
|
displayName := ""
|
|||
|
|
if err != nil {
|
|||
|
|
threadsUserID = libthreads.ThreadsUserIDFromToken(short, longLived)
|
|||
|
|
if threadsUserID == "" {
|
|||
|
|
recordOAuthDebug("error", "profile_me", payload.AccountID, err.Error())
|
|||
|
|
if libthreads.IsPermissionError(err) {
|
|||
|
|
return nil, app.For(code.ThreadsAccount).AuthForbidden(
|
|||
|
|
"Threads API 需要 threads_basic：請到 Meta App Dashboard → 應用程式角色，把你的 Threads 帳號加為「測試人員」或管理員，並確認已啟用「Access the Threads API」",
|
|||
|
|
)
|
|||
|
|
}
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
recordOAuthDebug("warn", "profile_me", payload.AccountID, "fallback token user_id="+threadsUserID+": "+err.Error())
|
|||
|
|
displayName = strings.TrimSpace(account.DisplayName)
|
|||
|
|
if displayName == "" {
|
|||
|
|
displayName = "Threads " + threadsUserID
|
|||
|
|
}
|
|||
|
|
} else {
|
|||
|
|
threadsUserID = profile.ID.String()
|
|||
|
|
username = profile.Username
|
|||
|
|
recordOAuthDebug("info", "profile_me", payload.AccountID, "username="+username+" threads_user_id="+threadsUserID)
|
|||
|
|
displayName = strings.TrimSpace(profile.Name)
|
|||
|
|
if displayName == "" {
|
|||
|
|
displayName = "@" + strings.TrimPrefix(username, "@")
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if err := u.assertNoAPIBindingConflict(ctx, payload.TenantID, payload.OwnerUID, account.ID, threadsUserID); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
updated, err := u.repo.UpdateAPIProfile(
|
|||
|
|
ctx,
|
|||
|
|
payload.TenantID,
|
|||
|
|
payload.OwnerUID,
|
|||
|
|
account.ID,
|
|||
|
|
username,
|
|||
|
|
threadsUserID,
|
|||
|
|
displayName,
|
|||
|
|
)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
expiresAt := int64(0)
|
|||
|
|
if longLived.ExpiresIn >= 300 {
|
|||
|
|
expiresAt = libthreads.NsFromNow(longLived.ExpiresIn)
|
|||
|
|
} else if longLived.ExpiresIn > 0 {
|
|||
|
|
recordOAuthDebug("warn", "expires_in", payload.AccountID, "suspicious expires_in="+itoa(longLived.ExpiresIn)+"s; store without expiry deadline")
|
|||
|
|
}
|
|||
|
|
if _, err := u.secretsRepo.SaveAPIAccessToken(ctx, updated.ID, longLived.AccessToken, expiresAt); err != nil {
|
|||
|
|
recordOAuthDebug("error", "save_token", updated.ID, err.Error())
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
recordOAuthDebug("info", "success", updated.ID, "api_connected=true username="+updated.Username)
|
|||
|
|
if err := u.members.SetActiveThreadsAccountID(ctx, payload.TenantID, payload.OwnerUID, updated.ID); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
redirectURL := strings.TrimSpace(u.oauth.SuccessRedirect)
|
|||
|
|
if redirectURL == "" {
|
|||
|
|
redirectURL = "/"
|
|||
|
|
}
|
|||
|
|
sep := "?"
|
|||
|
|
if strings.Contains(redirectURL, "?") {
|
|||
|
|
sep = "&"
|
|||
|
|
}
|
|||
|
|
return &domusecase.OAuthCallbackResult{
|
|||
|
|
AccountID: updated.ID,
|
|||
|
|
Username: updated.Username,
|
|||
|
|
ThreadsUserID: updated.ThreadsUserID,
|
|||
|
|
RedirectURL: redirectURL + sep + "threads_oauth=ok&account_id=" + updated.ID,
|
|||
|
|
}, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func (u *threadsAccountUseCase) DisconnectThreadsAPI(
|
|||
|
|
ctx context.Context,
|
|||
|
|
tenantID, ownerUID, accountID string,
|
|||
|
|
) (*domusecase.AccountSummary, error) {
|
|||
|
|
account, err := u.assertOwned(ctx, tenantID, ownerUID, accountID)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
if err := u.secretsRepo.ClearAPIAccessToken(ctx, account.ID); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
if _, err := u.repo.ClearAPIProfile(ctx, tenantID, ownerUID, account.ID); err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
return u.toSummary(ctx, account)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func (u *threadsAccountUseCase) assertNoAPIBindingConflict(
|
|||
|
|
ctx context.Context,
|
|||
|
|
tenantID, ownerUID, accountID, threadsUserID string,
|
|||
|
|
) error {
|
|||
|
|
dup, err := u.repo.FindByThreadsUserID(ctx, tenantID, ownerUID, threadsUserID)
|
|||
|
|
if err != nil || dup == nil || dup.ID == accountID {
|
|||
|
|
return nil
|
|||
|
|
}
|
|||
|
|
secrets, err := u.secretsRepo.FindByAccountID(ctx, dup.ID)
|
|||
|
|
if err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if isValidAPIToken(secrets) {
|
|||
|
|
label := dup.DisplayName
|
|||
|
|
if label == "" && dup.Username != "" {
|
|||
|
|
label = "@" + dup.Username
|
|||
|
|
}
|
|||
|
|
if label == "" {
|
|||
|
|
label = dup.ID
|
|||
|
|
}
|
|||
|
|
return app.For(code.ThreadsAccount).ResConflict(
|
|||
|
|
"此 Threads 帳號已綁定在「" + label + "」；請先中斷該帳號 API，或選該帳號按「連線選中帳號」重新授權",
|
|||
|
|
)
|
|||
|
|
}
|
|||
|
|
if _, err := u.repo.ClearAPIProfile(ctx, tenantID, ownerUID, dup.ID); err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
return nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func isValidAPIToken(secrets *entity.Secrets) bool {
|
|||
|
|
if secrets == nil {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
token := strings.TrimSpace(secrets.APIAccessToken)
|
|||
|
|
if token == "" {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
if secrets.APITokenExpiresAt > 0 && secrets.APITokenExpiresAt <= clock.NowUnixNano() {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
return true
|
|||
|
|
}
|