chore: 并入 iotlcm-upstream-chan 历史到 upstream-chan/（原提交 1e74497）

upstream-chan/internal/logic/upstreamimpl/beixin_token_provider.go

@@ -0,0 +1,149 @@
+package upstreamimpl
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	sharedtoken "git.5iot.com/iotlcm-public/iotlcm-upstream-chan/internal/token"
+)
+
+// beixinOneLinkTokenPath is the fallback used when Path is empty. On the
+// template path this default is unreachable: parseSharedOneLinkConfig rejects
+// an empty token.path before any provider is built, so Path always carries the
+// value declared in temp_config. It only applies to direct construction
+// (tests). The same shape exists in every shared-token provider.
+const beixinOneLinkTokenPath = "/prod-api/open/api/oneLinkToken"
+
+// beixinTokenTTL is the local validity window. The upstream returns only the
+// token string and no expiry field, so the window is held locally; a token
+// rejected earlier than this is recovered through RecoverToken's invalidation
+// path instead of being trusted until the TTL elapses.
+const beixinTokenTTL = time.Hour
+
+// BeixinTokenConfig contains all values required by the Beixin (江苏倍信)
+// shared-token protocol. BaseURL and Path come from temp_config
+// token.baseUrl/token.path (with the per-channel tokenBaseUrl override
+// applied by parseSharedOneLinkConfig); the credentials come from chan_config.
+type BeixinTokenConfig struct {
+	BaseURL   string
+	Path      string
+	PwdKey    string
+	ChannelNo string
+	Timeout   time.Duration
+}
+
+// BeixinTokenProvider fetches a Beixin shared OneLink token.
+//
+// Wire contract (verified against the live endpoint on 2026-10-19):
+//
+//	GET {baseUrl}{path}?pwdkey=<pwdKey>&c_no=<channelNo>
+//	→ {"code":200,"msg":"请求成功","data":"<64 chars>"}
+//
+// The token is consumed by the standard OneLink business API
+// (https://api.iot.10086.cn/v5/), so all /sim/* routes work unchanged.
+type BeixinTokenProvider struct {
+	baseURL   string
+	path      string
+	pwdKey    string
+	channelNo string
+	client    *http.Client
+}
+
+type beixinTokenResponse struct {
+	Code int             `json:"code"`
+	Msg  string          `json:"msg"`
+	Data json.RawMessage `json:"data"`
+}
+
+func NewBeixinTokenProvider(config BeixinTokenConfig) *BeixinTokenProvider {
+	timeout := config.Timeout
+	if timeout <= 0 {
+		timeout = defaultUpstreamHTTPTimeout
+	}
+	return &BeixinTokenProvider{
+		baseURL:   strings.TrimRight(strings.TrimSpace(config.BaseURL), "/"),
+		path:      normalizeProviderPath(config.Path, beixinOneLinkTokenPath),
+		pwdKey:    config.PwdKey,
+		channelNo: strings.TrimSpace(config.ChannelNo),
+		client:    &http.Client{Timeout: timeout},
+	}
+}
+
+func (p *BeixinTokenProvider) Fetch(ctx context.Context) (sharedtoken.OneLinkToken, error) {
+	if p == nil || p.client == nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin token provider is not initialized")
+	}
+	if p.baseURL == "" || strings.TrimSpace(p.pwdKey) == "" || p.channelNo == "" {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin baseUrl, pwdKey and channelNo are required")
+	}
+
+	endpoint, err := url.Parse(joinProviderURL(p.baseURL, p.path))
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("parse beixin token URL: %w", err)
+	}
+	query := endpoint.Query()
+	query.Set("pwdkey", p.pwdKey)
+	query.Set("c_no", p.channelNo)
+	endpoint.RawQuery = query.Encode()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("create beixin token request: %w", err)
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("request beixin token: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4*1024*1024+1))
+	if err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("read beixin token response: %w", err)
+	}
+	if len(body) > 4*1024*1024 {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin token response is too large")
+	}
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin token HTTP status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var output beixinTokenResponse
+	if err := json.Unmarshal(body, &output); err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("decode beixin token response: %w", err)
+	}
+	if output.Code != http.StatusOK {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin token failed: code=%d, message=%s", output.Code, output.Msg)
+	}
+	// data is a bare JSON string, not an object.
+	var value string
+	if err := json.Unmarshal(output.Data, &value); err != nil {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("decode beixin shared token: %w", err)
+	}
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return sharedtoken.OneLinkToken{}, fmt.Errorf("beixin shared token is empty")
+	}
+
+	now := time.Now()
+	return sharedtoken.OneLinkToken{Value: value, CreatedAt: now, ExpiresAt: now.Add(beixinTokenTTL)}, nil
+}
+
+func (p *BeixinTokenProvider) FetchToken(ctx context.Context, _ string) (sharedtoken.OneLinkToken, error) {
+	return p.Fetch(ctx)
+}
+
+// beixinFetcher adapts BeixinTokenProvider to the shared token TokenFetcher
+// contract, mirroring tengyuFetcher.
+type beixinFetcher struct{ provider *BeixinTokenProvider }
+
+func (f beixinFetcher) FetchToken(ctx context.Context, _ string) (sharedtoken.OneLinkToken, error) {
+	return f.provider.Fetch(ctx)
+}