Module authz_casdoor 

Casdoor authorization plugin (authz-casdoor).

Port of Apache APISIX’s authz-casdoor plugin, with two modes:

• Stateless (default) — when no session secret is configured, the node acts as a bearer-token validator: a Casdoor access token presented in the Authorization header is validated by calling Casdoor’s OAuth token introspection endpoint (/api/login/oauth/introspect, RFC 7662) authenticated with the client credentials. active: true allows the request; a missing/inactive/invalid token denies it (403) on the denied port; an unreachable introspection endpoint is a genuine callout failure and exits on error instead.
• Interactive (opt-in) — set session_secret (or session.secret) to turn on the full OAuth Authorization Code login flow using the shared encrypted-cookie session primitive. Unauthenticated browsers are redirected to Casdoor’s authorize URL; the callback exchanges the code for an access token, which is sealed into an encrypted client-side cookie (no server-side session store). See the three-branch logic in AuthzCasdoorPlugin::execute_interactive.

Redirect wiring (interactive mode)

A 302 produced by this node (login redirect, post-callback redirect, or logout) exits on the dedicated redirect output port, following the same convention as the standalone redirect node. Wire the node’s redirect edge to client.in so it reaches the browser; deliberate denials (missing/invalid token, OAuth state mismatch, Casdoor refusing the decision) exit on denied (also wired to client.in, or a custom denial handler); a genuine Casdoor callout failure (token exchange or introspection unreachable) exits through the ordinary error port since the node could not do its job; the success edge carries authenticated requests on to the upstream.

Structs

AuthzCasdoorPlugin

Validates a Casdoor access token, and in interactive mode runs the SSO flow.

CasdoorFlow 🔒

Transient login-flow payload sealed into the short-lived flow cookie.

CasdoorSession 🔒

Session payload sealed into the Casdoor session cookie (interactive mode).

Functions

access_token_body 🔒

Encodes the code-exchange request body.

basic_auth_header 🔒

Builds the Authorization: Basic <base64(client_id:client_secret)> value.

build_authorize_url 🔒

Builds the Casdoor authorize URL that begins the login handshake.

callback_path_of 🔒

Extracts the path component of a callback URL (https://h/p?x → /p). Mirrors the APISIX regex .+//[^/]+(/.*).

decode_jwt_claims 🔒

Decodes a JWT’s claim set (middle segment) without verifying the signature. The token came directly from Casdoor’s token endpoint over TLS, so it is trusted here; the claims are only used to surface identity to the upstream.

extract_token 🔒

Extracts the raw bearer token (without the Bearer prefix) from the Authorization header.

form_encode 🔒

Percent-encodes a value for application/x-www-form-urlencoded bodies.

introspect_body 🔒

Encodes the introspection request body (token + token_type_hint).

introspect_url 🔒

The Casdoor OAuth token-introspection endpoint for a base URL.

parse_access_token 🔒

Parses the token endpoint’s JSON, returning the access_token when the reply is a valid, unexpired grant (expires_in > 0, per Casdoor).

query_first 🔒

The first value of a query parameter.

random_state 🔒

Generates a random anti-CSRF state (128 bits, hex-encoded).

reconstruct_uri 🔒

Reconstructs the request URI (path plus a best-effort query string) so the browser can be returned there after login.

session_cookie_str 🔒

Reads a string field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_cookie_u64 🔒

Reads a u64 field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_secret 🔒

Reads the session secret from session_secret or nested session.secret.

token_is_active 🔒

Parses an RFC 7662 introspection response, returning the active flag. A missing/false/non-boolean active is treated as inactive.