chore: 初始开源发布

iotlcm-upstream-chan：运营商上游通道适配服务（统一 /sim/* 协议）。 - 内联原私有依赖：yunze-public → internal/pub/（10 包 18 文件）， yunze-pb/pb → internal/pb/（9 文件）；Consul 注册改用官方 gogf/gf/contrib/registry/consul/v2（API 兼容） - Go module：yz-svr → git.5iot.com/iotlcm-public/iotlcm-upstream-chan - 修复 mingqian 包测试：实现重构后 `adapter.operations` 字段已移除，测试断言按当前实现语义重写（不改产品行为） - 凭据与内部标识脱敏：MySQL/Redis/Consul 凭据、私网与生产 IP、内网域名、真实手机号、注释里的真实 token/transid - 移除内部资产：CI 触发器、生产通道种子 SQL、真实凭据测试资源文档 - Dockerfile 改用公共基础镜像，移除写死的 registry 凭据 - 补 Apache-2.0 LICENSE，重写 README，LF 行尾 + .gitattributes
2026-10-22 15:42:29 +08:00
commit 96b1edff45
191 changed files with 30805 additions and 0 deletions
@@ -0,0 +1,224 @@
+package upstreamimpl
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	sharedtoken "git.5iot.com/iotlcm-public/iotlcm-upstream-chan/internal/token"
+)
+
+// HenanXinjingTokenConfig carries the credentials needed to call the
+// platform's `/api/v1/searchToken` endpoint and convert the response into a
+// sharedtoken.OneLinkToken for the sharedtoken manager.
+//
+// The channel card-no is optional at construction time because the
+// underlying platform scopes tokens to (channel_id, channel_pname), not to
+// a specific card. When CardNo is empty the fetcher falls back to the
+// chanKey passed by the token manager (matching how zibo/tengyu providers
+// treat the per-channel seed value).
+type HenanXinjingTokenConfig struct {
+	BaseURL      string
+	Path         string // defaults to /api/v1/searchToken
+	UserID       string
+	APIKey       string
+	ChannelID    string // e.g. "80", "97", "194"
+	ChannelPName string // e.g. "cmiotonelinkqx"
+	CardNo       string // optional seed card number; may be overridden by manager
+	Timeout      time.Duration
+}
+
+// HenanXinjingTokenProvider fetches a shared token for a given
+// (userId, channel_id, channel_pname) triple from the Henan Xinjing
+// platform.
+type HenanXinjingTokenProvider struct {
+	baseURL, path, userID, apiKey, channelID, channelPName, cardNo string
+	client                                                         *http.Client
+}
+
+// henanXinjingSearchTokenResponse matches the upstream response shape:
+//
+//	{
+//	  "code": 0,
+//	  "msg": "查询成功",
+//	  "data": {
+//	    "id": 80,
+//	    "chl_username": "C5010371A16640006582238",
+//	    "accesstoken": "v1b74e73d741cea620f0ceecaf7a733fa6964aa53fffcbf8d3a5a4c8715aabe3",
+//	    "accesstoken_at": "2026-09-16 13:19:29"
+//	  }
+//	}
+//
+// `code` may be either a JSON number or string; decode via henanXinjingDecodeCode.
+type henanXinjingSearchTokenResponse struct {
+	Code json.RawMessage `json:"code"`
+	Msg  string          `json:"msg"`
+	Data struct {
+		ID               json.RawMessage `json:"id"`
+		ChlUsername      string          `json:"chl_username"`
+		AccessToken      string          `json:"accesstoken"`
+		AccessTokenAt    string          `json:"accesstoken_at"`
+		AccessTokenSB    string          `json:"accesstokensb"`
+		AccessTokenAlias string          `json:"access_token"`
+	} `json:"data"`
+}
+
+const (
+	henanXinjingSearchTokenPath     = "/api/v1/searchToken"
+	henanXinjingTokenExpiryLayout   = "2006-01-02 15:04:05"
+	henanXinjingTokenRefreshBackoff = 5 * time.Minute
+)
+
+func NewHenanXinjingTokenProvider(config HenanXinjingTokenConfig) *HenanXinjingTokenProvider {
+	timeout := config.Timeout
+	if timeout <= 0 {
+		timeout = defaultUpstreamHTTPTimeout
+	}
+	return &HenanXinjingTokenProvider{
+		baseURL:      strings.TrimRight(strings.TrimSpace(config.BaseURL), "/"),
+		path:         normalizeProviderPath(config.Path, henanXinjingSearchTokenPath),
+		userID:       strings.TrimSpace(config.UserID),
+		apiKey:       strings.TrimSpace(config.APIKey),
+		channelID:    strings.TrimSpace(config.ChannelID),
+		channelPName: strings.TrimSpace(config.ChannelPName),
+		cardNo:       strings.TrimSpace(config.CardNo),
+		client:       &http.Client{Timeout: timeout},
+	}
+}
+
+// parseExpiry interprets the platform's `accesstoken_at` field. The
+// platform uses local China time without an explicit zone, so parse in
+// Asia/Shanghai.
+func henanXinjingParseExpiry(raw string) (time.Time, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return time.Time{}, fmt.Errorf("empty accesstoken_at")
+	}
+	loc, err := time.LoadLocation("Asia/Shanghai")
+	if err != nil {
+		loc = time.Local
+	}
+	t, err := time.ParseInLocation(henanXinjingTokenExpiryLayout, raw, loc)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("parse accesstoken_at %q: %w", raw, err)
+	}
+	return t, nil
+}
+
+// firstToken returns the first non-empty token field. The platform has been
+// observed returning the token under `accesstoken`, but earlier docs
+// referenced `accesstokensb` / `access_token`; accept all three.
+func henanXinjingFirstToken(resp *henanXinjingSearchTokenResponse) string {
+	if v := strings.TrimSpace(resp.Data.AccessToken); v != "" {
+		return v
+	}
+	if v := strings.TrimSpace(resp.Data.AccessTokenSB); v != "" {
+		return v
+	}
+	return strings.TrimSpace(resp.Data.AccessTokenAlias)
+}
+
+// fetch performs the signed GET against /api/v1/searchToken for the given
+// card number. Card number may come from the manager's chanKey seed.
+func (p *HenanXinjingTokenProvider) fetch(ctx context.Context, cardNo string) (sharedtoken.OneLinkToken, error) {
+	if p == nil || p.client == nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing token provider is not initialized")
+	}
+	if p.baseURL == "" || p.userID == "" || p.apiKey == "" || p.channelID == "" || p.channelPName == "" {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: baseURL, userID, apiKey, channelID and channelPName are required")
+	}
+	cardNo = strings.TrimSpace(cardNo)
+	if cardNo == "" {
+		cardNo = p.cardNo
+	}
+	// cardno is optional on the real platform (verified live): the token is
+	// scoped to (userId, channel_id, channel_pname), so omit the param when
+	// no seed card number is configured instead of failing the fetch.
+
+	times := strconv.FormatInt(time.Now().Unix(), 10)
+	values := url.Values{}
+	values.Set("userId", p.userID)
+	if cardNo != "" {
+		values.Set("cardno", cardNo)
+	}
+	values.Set("channel_id", p.channelID)
+	values.Set("channel_pname", p.channelPName)
+	values.Set("times", times)
+	values.Set("sign", henanXinjingSign(p.userID, p.apiKey, times))
+
+	endpoint := p.baseURL + p.path + "?" + values.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: build searchToken request: %w", err)
+	}
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: request searchToken: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: read searchToken body: %w", err)
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: searchToken HTTP %d: %s", resp.StatusCode, string(body))
+	}
+	var output henanXinjingSearchTokenResponse
+	if err := json.Unmarshal(body, &output); err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: decode searchToken response: %w (body=%s)", err, string(body))
+	}
+	code, err := henanXinjingDecodeCode(output.Code)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: searchToken: %w (body=%s)", err, string(body))
+	}
+	if code != 0 {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: searchToken failed: code=%d msg=%s", code, output.Msg)
+	}
+	tokenValue := henanXinjingFirstToken(&output)
+	if tokenValue == "" {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("henan xinjing: searchToken returned empty accesstoken")
+	}
+	expiresAt, err := henanXinjingParseExpiry(output.Data.AccessTokenAt)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, err
+	}
+	// Refresh slightly ahead of the declared expiry to absorb clock skew.
+	if until := time.Until(expiresAt); until > henanXinjingTokenRefreshBackoff {
+		expiresAt = expiresAt.Add(-henanXinjingTokenRefreshBackoff)
+	}
+	return sharedtoken.OneLinkToken{
+		Value:     tokenValue,
+		CreatedAt: time.Now(),
+		ExpiresAt: expiresAt,
+	}, nil
+}
+
+// Fetch satisfies the sharedtoken.Fetcher-style interface used by the
+// token manager. The chanKey argument is unused here because Henan Xinjing
+// scopes tokens to the (channel_id, channel_pname) pair rather than to a
+// specific chan_key; we always fetch with the configured cardNo.
+func (p *HenanXinjingTokenProvider) Fetch(ctx context.Context) (sharedtoken.OneLinkToken, error) {
+	return p.fetch(ctx, "")
+}
+
+// FetchToken matches the sharedtoken.TokenFetcher interface used by
+// sharedtoken.NewTokenManager. chanKey is the token manager's cache key
+// (typically the channel's chan_key); it does not influence the upstream
+// request but lets the manager cache one token per channel.
+func (p *HenanXinjingTokenProvider) FetchToken(ctx context.Context, _ string) (sharedtoken.OneLinkToken, error) {
+	return p.fetch(ctx, "")
+}
+
+// henanXinjingFetcher adapts HenanXinjingTokenProvider to the sharedtoken
+// fetcher shape used by RegisterTokenProviderFactory.
+type henanXinjingFetcher struct{ provider *HenanXinjingTokenProvider }
+
+func (f henanXinjingFetcher) FetchToken(ctx context.Context, chanKey string) (sharedtoken.OneLinkToken, error) {
+	return f.provider.fetch(ctx, "")
+}