Module dingtalk_auth 

DingTalk authentication plugin (dingtalk-auth).

Validates a DingTalk authorization code by exchanging it, through DingTalk’s OAuth API, for the calling user’s identity, then attaches that identity to the request for downstream nodes. A request whose code cannot be resolved to a DingTalk user is rejected with a 401.

Ported subset / deviations from APISIX

APISIX’s dingtalk-auth is a session plugin: on the first request it reads a code, calls DingTalk, then stores the resolved userinfo in an encrypted dingtalk_session cookie so later requests skip the callout, and it 302-redirects to redirect_uri when no code and no session are present. featherbit is stateless with no session store, so this port implements the token-validation subset: every request must carry a code, which is validated against DingTalk on each request. Consequently the session / cookie / redirect machinery is dropped, along with the config keys that only served it (secret, secret_fallbacks, redirect_uri, cookie_expires_in). The app-level access token is cached in-process (7000s TTL, matching APISIX’s lrucache) so only the userinfo call happens per request.

Structs

DingtalkAuthPlugin

Authenticates requests by resolving a DingTalk authorization code to a DingTalk user via the OAuth accessToken + getuserinfo APIs.

Enums

DingtalkError 🔒

Outcome of resolving a DingTalk code into userinfo. Every failure maps to a 401 (DINGTALK_AUTH_FAILED); the variants exist to keep the reason legible.

Constants

ACCESS_TOKEN_TTL 🔒

DingTalk access tokens live 7200s; cache slightly shorter to avoid using a token that expires mid-flight (matches APISIX’s cache TTL).

DEFAULT_TOKEN_URL 🔒

DEFAULT_USERINFO_URL 🔒

Functions

append_query 🔒

Appends key=value to url, choosing ? or & as needed.

attach_identity 🔒

Copies the resolved identity into context.message and optionally the X-Userinfo request header.

parse_access_token 🔒

Parses the accessToken from DingTalk’s token-endpoint response.

parse_userinfo 🔒

Parses DingTalk’s getuserinfo response, returning the result object on errcode == 0 and an DingtalkError::Unauthorized otherwise.

require_string 🔒

Extracts a required string config key.

urlencode 🔒

Minimal percent-encoding for query values (access tokens are URL-safe-ish but may contain + / =).