m1saka
7d8a5b6f74
The 1.4.2 extension replaced the old signed/encrypted chat gateway with an
OpenAI-compatible aigateway. Align the proxy with the new flow:
- Use ecloud.10086.cn login/model base URLs, zhanlu_ide plugin headers and
v1.4.2 plugin version
- Provision the model API key via SM2-signed get-or-create after v1/login
profile fetch; store api_key/model_base_url/email in credentials
- Chat via Bearer apiKey against {modelBaseUrl}/chat/completions with plain
OpenAI SSE passthrough; fetch /v1/models from the gateway model-info endpoint
- Force HTTP/1.1 upstream (gateway drops HTTP/2 ALPN negotiation with EOF)
- Drop obsolete AES body encryption, model name mapping and vscode headers
80 lines
2.1 KiB
Go
80 lines
2.1 KiB
Go
package sign
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/sha1"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"git.misaka.ren/M1saka/zhanlu_proxy/internal/auth"
|
|
)
|
|
|
|
type Signer struct {
|
|
PublicKey *rsa.PublicKey
|
|
Now func() time.Time
|
|
Nonce func() string
|
|
Encryptor func(string) (string, error)
|
|
}
|
|
|
|
func (s Signer) BuildOpURL(path string, creds auth.Credentials, baseURL string, method string) (string, error) {
|
|
if err := creds.Validate(); err != nil {
|
|
return "", err
|
|
}
|
|
if method == "" {
|
|
method = "POST"
|
|
}
|
|
now := time.Now
|
|
if s.Now != nil {
|
|
now = s.Now
|
|
}
|
|
nonce := randomUUID
|
|
if s.Nonce != nil {
|
|
nonce = s.Nonce
|
|
}
|
|
encryptor := s.Encryptor
|
|
if encryptor == nil {
|
|
encryptor = func(text string) (string, error) { return auth.EncryptAuthorization(s.PublicKey, text) }
|
|
}
|
|
|
|
base64Auth, err := encryptor(fmt.Sprintf("%d:%s", now().UnixMilli(), creds.Token))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
// The plugin formats Beijing time (UTC+8) with a Z suffix via
|
|
// new Date(now.getTime()+8*3600*1000) and getUTC* accessors.
|
|
timestamp := now().Add(8 * time.Hour).UTC().Format("2006-01-02T15:04:05Z")
|
|
query := "AccessKey=" + creds.AccessKey +
|
|
"&SignatureMethod=HmacSHA1" +
|
|
"&SignatureNonce=" + nonce() +
|
|
"&SignatureVersion=V2.0" +
|
|
"&Timestamp=" + timestamp +
|
|
"&Version=2016-12-05" +
|
|
"&authorization=" + url.QueryEscape(base64Auth)
|
|
|
|
canonicalQuery := strings.ReplaceAll(query, ":", "%3A")
|
|
queryHash := sha256.Sum256([]byte(canonicalQuery))
|
|
stringToSign := strings.ToUpper(method) + "\n" + strings.ReplaceAll(path, "/", "%2F") + "\n" + hex.EncodeToString(queryHash[:])
|
|
|
|
mac := hmac.New(sha1.New, []byte("BC_SIGNATURE&"+creds.SecretKey))
|
|
mac.Write([]byte(stringToSign))
|
|
signature := hex.EncodeToString(mac.Sum(nil))
|
|
|
|
return strings.TrimRight(baseURL, "/") + path + "?" + query + "&Signature=" + signature, nil
|
|
}
|
|
|
|
func randomUUID() string {
|
|
b := make([]byte, 16)
|
|
if _, err := rand.Read(b); err != nil {
|
|
return fmt.Sprintf("%d", time.Now().UnixNano())
|
|
}
|
|
b[6] = (b[6] & 0x0f) | 0x40
|
|
b[8] = (b[8] & 0x3f) | 0x80
|
|
return fmt.Sprintf("%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
|
|
}
|