使用Golang的Encore.Dev框架实现Auth0与VueJS的AuthHandler

在Encore中实现Auth0集成时，确实需要理解其authhandler模式与标准HTTP中间件的区别。Encore的认证处理程序返回的是auth.UID，而不是HTTP处理程序。以下是针对你问题的解决方案：

核心解决方案

Encore的authhandler应该专注于JWT验证并返回用户标识，而RBAC权限检查应该在API端点内部处理。

1. 创建Encore认证处理器

package auth

import (
    "context"
    "log"
    "net/url"
    "time"

    "encore.dev/beta/auth"
    "github.com/auth0/go-jwt-middleware/v2/jwks"
    "github.com/auth0/go-jwt-middleware/v2/validator"
)

type CustomClaims struct {
    Permissions []string `json:"permissions"`
    Subject     string   `json:"sub"`
}

func (c CustomClaims) Validate(ctx context.Context) error {
    return nil
}

//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, *CustomClaims, error) {
    // Auth0配置
    audience := "your-api-audience"
    domain := "your-auth0-domain"
    
    issuerURL, err := url.Parse("https://" + domain + "/")
    if err != nil {
        return "", nil, err
    }

    provider := jwks.NewCachingProvider(issuerURL, 5*time.Minute)

    jwtValidator, err := validator.New(
        provider.KeyFunc,
        validator.RS256,
        issuerURL.String(),
        []string{audience},
        validator.WithCustomClaims(
            func() validator.CustomClaims {
                return &CustomClaims{}
            },
        ),
    )
    if err != nil {
        return "", nil, err
    }

    // 验证JWT令牌
    validatedClaims, err := jwtValidator.ValidateToken(ctx, token)
    if err != nil {
        return "", nil, err
    }

    claims := validatedClaims.(*validator.ValidatedClaims)
    customClaims := claims.CustomClaims.(*CustomClaims)
    
    // 使用Auth0的sub作为UID
    return auth.UID(customClaims.Subject), customClaims, nil
}

2. 创建权限检查工具函数

package auth

import (
    "context"
    "encore.dev/beta/errs"
)

// HasPermission 检查用户是否拥有指定权限
func HasPermission(ctx context.Context, requiredPermission string) error {
    claims, ok := auth.Data().(*CustomClaims)
    if !ok || claims == nil {
        return &errs.Error{
            Code:    errs.PermissionDenied,
            Message: "No permission claims found",
        }
    }

    for _, perm := range claims.Permissions {
        if perm == requiredPermission {
            return nil
        }
    }

    return &errs.Error{
        Code:    errs.PermissionDenied,
        Message: "Insufficient permissions",
    }
}

// HasAllPermissions 检查用户是否拥有所有指定权限
func HasAllPermissions(ctx context.Context, requiredPermissions []string) error {
    claims, ok := auth.Data().(*CustomClaims)
    if !ok || claims == nil {
        return &errs.Error{
            Code:    errs.PermissionDenied,
            Message: "No permission claims found",
        }
    }

    permSet := make(map[string]bool)
    for _, perm := range claims.Permissions {
        permSet[perm] = true
    }

    for _, required := range requiredPermissions {
        if !permSet[required] {
            return &errs.Error{
                Code:    errs.PermissionDenied,
                Message: "Missing required permission: " + required,
            }
        }
    }

    return nil
}

3. 在API端点中使用RBAC

package api

import (
    "context"
    
    "encore.dev/beta/auth"
    "encore.app/auth"
)

//encore:api auth method=GET path=/admin
func GetAdminData(ctx context.Context) (*Response, error) {
    // 检查管理员权限
    if err := auth.HasPermission(ctx, "admin:read"); err != nil {
        return nil, err
    }
    
    // 获取当前用户ID
    userID := auth.UserID()
    
    // 业务逻辑
    return &Response{Data: "Admin data for " + string(userID)}, nil
}

//encore:api auth method=POST path=/users
func CreateUser(ctx context.Context, req *CreateUserRequest) (*Response, error) {
    // 检查多个权限
    requiredPerms := []string{"users:write", "users:create"}
    if err := auth.HasAllPermissions(ctx, requiredPerms); err != nil {
        return nil, err
    }
    
    // 业务逻辑
    return &Response{Data: "User created"}, nil
}

4. VueJS前端集成示例

// auth.js - VueJS前端
import { Auth0Client } from '@auth0/auth0-spa-js';

const auth0 = new Auth0Client({
  domain: 'your-auth0-domain',
  clientId: 'your-client-id',
  authorizationParams: {
    audience: 'your-api-audience',
    redirect_uri: window.location.origin
  }
});

// 获取访问令牌
async function getAccessToken() {
  const token = await auth0.getTokenSilently();
  return token;
}

// API调用示例
async function callEncoreAPI(endpoint, method = 'GET', data = null) {
  const token = await getAccessToken();
  
  const response = await fetch(`https://your-encore-app.encoreapi.com${endpoint}`, {
    method,
    headers: {
      'Authorization': `Bearer ${token}`,
      'Content-Type': 'application/json'
    },
    body: data ? JSON.stringify(data) : null
  });
  
  return response.json();
}

// 使用示例
async function fetchAdminData() {
  try {
    const data = await callEncoreAPI('/admin');
    console.log('Admin data:', data);
  } catch (error) {
    console.error('Permission denied:', error);
  }
}

5. 配置Encore认证中间件

// encore.app配置
package config

import "encore.dev/config"

var Auth0 = struct {
    Domain   string
    Audience string
}{
    Domain:   config.String("AUTH0_DOMAIN"),
    Audience: config.String("AUTH0_AUDIENCE"),
}

关键点：

1. Encore的authhandler只负责验证JWT并返回auth.UID
2. RBAC权限检查在API端点内部通过工具函数实现
3. auth.Data()用于获取认证时返回的自定义声明
4. 前端使用标准Bearer令牌发送请求

这种模式保持了Encore的声明式API设计，同时实现了Auth0的RBAC功能。