认证

Glue2 支持三种认证机制：API 密钥、会话和 OAuth 2.0。每个端点可以配置为要求认证（Require）或可选认证（Optional）。对 Require 端点的未认证请求将收到 401 Unauthorized 响应。

API 密钥

API 密钥提供机器对机器的认证。每个密钥由两部分组成：Api-Key（公共标识符）和 Api-Secret（私有密钥）。密钥以 bcrypt 哈希形式存储，创建后无法检索。

curl -X POST "https://api.hola.cloud/api/v0/lambdas" \
  -H "Api-Key: 您的_API_KEY" \
  -H "Api-Secret: 您的_API_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-function", "runtime": "js", "code": "..."}'

POST /api/v0/lambdas HTTP/1.1
Host: api.hola.cloud
Api-Key: 您的_API_KEY
Api-Secret: 您的_API_SECRET
Content-Type: application/json

{"name": "my-function", "runtime": "js", "code": "..."}

package main

import (
	"fmt"
	"io"
	"net/http"
	"encoding/json"
	"strings"
)

func main() {
	payload := map[string]any{"code": "...", "name": "my-function", "runtime": "js"}
	bodyBytes, err := json.Marshal(payload)
	if err != nil {
		panic(err)
	}
	body := string(bodyBytes)

	req, err := http.NewRequest("POST", "https://api.hola.cloud/api/v0/lambdas", strings.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Api-Key", "您的_API_KEY")
	req.Header.Set("Api-Secret", "您的_API_SECRET")
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	responseBody, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(responseBody))
}

<?php
$payload = ['code' => '...', 'name' => 'my-function', 'runtime' => 'js'];
$body = json_encode($payload);

$ch = curl_init();

curl_setopt_array($ch, [
    CURLOPT_URL => 'https://api.hola.cloud/api/v0/lambdas',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_HTTPHEADER => [
        'Api-Key: 您的_API_KEY',
        'Api-Secret: 您的_API_SECRET',
        'Content-Type: application/json',
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    throw new Exception(curl_error($ch));
}
curl_close($ch);

echo $response;

import requests

import json

headers = {
    "Api-Key": "您的_API_KEY",
    "Api-Secret": "您的_API_SECRET",
    "Content-Type": "application/json",
}

payload = {"code": "...", "name": "my-function", "runtime": "js"}
body = json.dumps(payload)

response = requests.request(
    "POST",
    "https://api.hola.cloud/api/v0/lambdas",
    headers=headers,
    data=body
)

print(response.text)

const payload = {"code": "...", "name": "my-function", "runtime": "js"};

const response = await fetch("https://api.hola.cloud/api/v0/lambdas", {
  method: "POST",
  headers: {
    "Api-Key": "您的_API_KEY",
    "Api-Secret": "您的_API_SECRET",
    "Content-Type": "application/json"
  },
  body: JSON.stringify(payload)
});

console.log(await response.text());

const payload = {"code": "...", "name": "my-function", "runtime": "js"};

const response = await fetch("https://api.hola.cloud/api/v0/lambdas", {
  method: "POST",
  headers: {
    "Api-Key": "您的_API_KEY",
    "Api-Secret": "您的_API_SECRET",
    "Content-Type": "application/json"
  },
  body: JSON.stringify(payload)
});

const text = await response.text();
console.log(text);

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.util.Map;
import java.util.List;

public class Main {
    public static void main(String[] args) throws Exception {
        var payload = Map.of("code", "...", "name", "my-function", "runtime", "js");
        var body = new ObjectMapper().writeValueAsString(payload);

        var request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.hola.cloud/api/v0/lambdas"))
            .method("POST", HttpRequest.BodyPublishers.ofString(body))
            .header("Api-Key", "您的_API_KEY")
            .header("Api-Secret", "您的_API_SECRET")
            .header("Content-Type", "application/json")
            .build();

        var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API 密钥可以限定到项目和 host 规则：

项目：密钥仅对配置的项目有效。
Host 规则：限制虚拟主机和可选 host 元数据。

路径和 HTTP 方法作用域不属于当前模型。

可选与必需认证

Require：端点拒绝未认证的请求并返回 401。
Optional：端点同时接受认证和匿名请求。认证请求会收到注入的标头；匿名请求则直接通过。

当提供有效的 API 密钥时，Glue2 会将 JSON X-Glue-Authentication 标头注入代理请求中。

会话

基于会话的认证由 HolaCloud 控制台的浏览器用户使用。用户通过 auth.hola.cloud 登录时，认证服务会创建一个存储在 InceptionDB 中的会话。会话 ID 作为 HTTP-only、Secure、SameSite cookie 返回。

1# 会话由浏览器自动管理。
2# 对于 API 访问，请改用 API 密钥或 OAuth 令牌。

会话 cookie 会自动附加到对 HolaCloud 子域名的请求中。Glue2 读取 cookie，在 InceptionDB 中查找会话，并在转发请求之前进行验证。

OAuth 2.0 / Google 登录

控制台用户可以通过 Google OAuth 2.0 进行认证。流程如下：

用户在控制台登录页面点击"使用 Google 登录"。
浏览器重定向到 Google 的授权端点。
用户授予权限，Google 重定向回带有授权码的页面。
控制台用授权码交换访问令牌和 ID 令牌。
ID 令牌发送到 Glue2，Glue2 验证令牌并创建会话。

OAuth 令牌也可以直接用于 API 调用：

curl "https://api.hola.cloud/api/v0/lambdas" \
  -H "Authorization: Bearer 您的_OAuth_令牌"

GET /api/v0/lambdas HTTP/1.1
Host: api.hola.cloud
Authorization: Bearer 您的_OAuth_令牌

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.hola.cloud/api/v0/lambdas", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer 您的_OAuth_令牌")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	responseBody, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(responseBody))
}

<?php
$ch = curl_init();

curl_setopt_array($ch, [
    CURLOPT_URL => 'https://api.hola.cloud/api/v0/lambdas',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer 您的_OAuth_令牌',
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    throw new Exception(curl_error($ch));
}
curl_close($ch);

echo $response;

import requests

headers = {
    "Authorization": "Bearer 您的_OAuth_令牌",
}

response = requests.request(
    "GET",
    "https://api.hola.cloud/api/v0/lambdas",
    headers=headers
)

print(response.text)

const response = await fetch("https://api.hola.cloud/api/v0/lambdas", {
  method: "GET",
  headers: {
    "Authorization": "Bearer 您的_OAuth_令牌"
  }
});

console.log(await response.text());

const response = await fetch("https://api.hola.cloud/api/v0/lambdas", {
  method: "GET",
  headers: {
    "Authorization": "Bearer 您的_OAuth_令牌"
  }
});

const text = await response.text();
console.log(text);

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        var request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.hola.cloud/api/v0/lambdas"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "Bearer 您的_OAuth_令牌")
            .build();

        var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

认证流程总结

1方法          凭证                    典型用途              范围
2──────────────────────────────────────────────────────────────────────
3API 密钥     Api-Key + Api-Secret    机器对机器            项目/Host 规则
4会话         Cookie (http-only)       浏览器用户            用户身份
5OAuth 2.0   Bearer 令牌              控制台 / SSO          Google 身份