feat: self-connection blocking API support (token-device internal endpoint, jti)

http/controller/api/internal.go

@@ -0,0 +1,50 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lejianwen/rustdesk-api/v2/global"
+	"github.com/lejianwen/rustdesk-api/v2/service"
+)
+
+type Internal struct {
+}
+
+// localOnly 仅允许本机/容器内回环访问
+func (in *Internal) localOnly(c *gin.Context) bool {
+	ip := c.RemoteIP()
+	return ip == "127.0.0.1" || ip == "::1"
+}
+
+// TokenDevice 根据token查询登录设备ID，供hbbs自连拦截内部调用
+// @Tags 内部接口
+// @Summary 根据token查询设备ID
+// @Description 仅供hbbs在容器内调用，需回环地址与共享密钥
+// @Param token query string true "访问令牌"
+// @Success 200 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Failure 404 {object} map[string]string
+// @Router /api/internal/token-device [get]
+func (in *Internal) TokenDevice(c *gin.Context) {
+	if !in.localOnly(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "forbidden"})
+		return
+	}
+	// 共享密钥：hbbs 通过 RUSTDESK_API_JWT_KEY 持有同一密钥
+	if global.Config.Jwt.Key == "" || c.GetHeader("X-Secret") != global.Config.Jwt.Key {
+		c.JSON(http.StatusForbidden, gin.H{"error": "forbidden"})
+		return
+	}
+	token := c.Query("token")
+	if token == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "token required"})
+		return
+	}
+	deviceId := service.AllService.UserService.GetDeviceIdByToken(token)
+	if deviceId == "" {
+		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"device_id": deviceId})
+}