企业微信集成¶

from flask import Flask, request, redirect, session, url_for, jsonify
import requests
import os

app = Flask(__name__)
app.secret_key = 'your_secure_secret_key_here'  # 请替换为安全密钥

# 企微扫码登录配置
WEIXIN_AGENTID = 123456                                       # 你的 AgentID
WEIXIN_CORPID = "wx123456"                                    # 你的 CorpID
WEIXIN_SECRET = 'AAAAAAAAAAAAAAAAAAAAAAAAAAA'                 # 你的 Secret
REDIRECT_URI = 'http://login.tech.intra.qq.com/help_qice/auth/callback'  # 回调域名
STATE = 'auth_state'                                          # 防 CSRF，建议每次动态生成

# 获取 access_token（用于后续 API 调用）
def get_access_token():
    url = f"https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid={WEIXIN_CORPID}&corpsecret={WEIXIN_SECRET}"
    resp = requests.get(url)
    data = resp.json()
    if data['errcode'] == 0:
        return data['access_token']
    else:
        return None

# 主页或测试
@app.route('/')
def index():
    return '''
    <h2>认证系统</h2>
    <p><a href="/chat">访问 /chat（触发鉴权）</a></p>
    '''

# 扫码登录入口
@app.route('/auth/login')
def login():
    redirect_url = f"https://login.work.weixin.qq.com/wwlogin/sso/login?login_type=CorpApp&appid={WEIXIN_CORPID}&agentid={WEIXIN_AGENTID}&redirect_uri={REDIRECT_URI}&state=STATE"
    next_url = request.args.get('next', '/chat')  # 默认 fallback
    session['next'] = next_url                    # 保存跳转目标
    return redirect(redirect_url)

# 扫码回调
@app.route('/auth/callback')
def callback():
    code = request.args.get('code')
    state = request.args.get('state')

    if not code:
        return "登录失败：缺少 code", 400

    access_token = get_access_token()
    if not access_token:
        return "无法获取 access_token", 500

    # 使用 code 换取用户信息
    user_info_url = f"https://qyapi.weixin.qq.com/cgi-bin/user/getuserinfo?access_token={access_token}&code={code}"
    resp = requests.get(user_info_url)
    data = resp.json()

    if data.get('errcode') != 0:
        return f"获取用户信息失败：{data.get('errmsg')}", 403

    user_id = data.get('UserId')  # 内部成员
    # open_userid = data.get('OpenUserId')  # 外部用户（如有）

    if not user_id:
        return "未获取到用户身份", 403

    # 认证成功，写入 session
    session['user_id'] = user_id  # (2)!

    next_url = session.pop('next', '/chat')  # 取出并删除
    return redirect(next_url)

# Nginx auth_request 调用的验证接口
@app.route('/auth/verify')
def verify():
    if 'user_id' in session:
        return '', 200              # 成功，允许访问
    else:
        return 'Unauthorized', 401  # 拒绝，触发登录

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=39891, debug=True)