Module authz_casdoor 

Casdoor authorization plugin (authz-casdoor).

Port of Apache APISIX’s authz-casdoor plugin, with two modes:

• Stateless (default) — when no session secret is configured, the node acts as a bearer-token validator: a Casdoor access token presented in the Authorization header is validated by calling Casdoor’s OAuth token introspection endpoint (/api/login/oauth/introspect, RFC 7662) authenticated with the client credentials. active: true allows the request; anything else denies it with AUTHZ_CASDOOR_DENIED (403).
• Interactive (opt-in) — set session_secret (or session.secret) to turn on the full OAuth Authorization Code login flow using the shared encrypted-cookie session primitive. Unauthenticated browsers are redirected to Casdoor’s authorize URL; the callback exchanges the code for an access token, which is sealed into an encrypted client-side cookie (no server-side session store). See the three-branch logic in AuthzCasdoorPlugin::execute_interactive.

Redirect wiring (interactive mode)

A 302 produced by this node (login redirect, post-callback redirect, or logout) is returned as an Err carrying the prepared response with code CASDOOR_REDIRECT, following the same early-exit convention as the fault-injection/mocking nodes. Wire the node’s error edge to client.in so the redirect reaches the browser; the success edge carries authenticated requests on to the upstream.

Structs

AuthzCasdoorPlugin

Validates a Casdoor access token, and in interactive mode runs the SSO flow.

CasdoorFlow 🔒

Transient login-flow payload sealed into the short-lived flow cookie.

CasdoorSession 🔒

Session payload sealed into the Casdoor session cookie (interactive mode).

Functions

access_token_body 🔒

Encodes the code-exchange request body.

basic_auth_header 🔒

Builds the Authorization: Basic <base64(client_id:client_secret)> value.

build_authorize_url 🔒

Builds the Casdoor authorize URL that begins the login handshake.

callback_path_of 🔒

Extracts the path component of a callback URL (https://h/p?x → /p). Mirrors the APISIX regex .+//[^/]+(/.*).

decode_jwt_claims 🔒

Decodes a JWT’s claim set (middle segment) without verifying the signature. The token came directly from Casdoor’s token endpoint over TLS, so it is trusted here; the claims are only used to surface identity to the upstream.

extract_token 🔒

Extracts the raw bearer token (without the Bearer prefix) from the Authorization header.

form_encode 🔒

Percent-encodes a value for application/x-www-form-urlencoded bodies.

introspect_body 🔒

Encodes the introspection request body (token + token_type_hint).

introspect_url 🔒

The Casdoor OAuth token-introspection endpoint for a base URL.

parse_access_token 🔒

Parses the token endpoint’s JSON, returning the access_token when the reply is a valid, unexpired grant (expires_in > 0, per Casdoor).

query_first 🔒

The first value of a query parameter.

random_state 🔒

Generates a random anti-CSRF state (128 bits, hex-encoded).

reconstruct_uri 🔒

Reconstructs the request URI (path plus a best-effort query string) so the browser can be returned there after login.

session_cookie_str 🔒

Reads a string field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_cookie_u64 🔒

Reads a u64 field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_secret 🔒

Reads the session secret from session_secret or nested session.secret.

token_is_active 🔒

Parses an RFC 7662 introspection response, returning the active flag. A missing/false/non-boolean active is treated as inactive.