feat: Phase 2.2 企业集成 — LDAP/OAuth2 框架 + 通知渠道扩展

- pkg/auth/ldap.go: LDAP/AD 认证器 (minimal LDAP BIND protocol, no lib dependency)
- pkg/auth/oauth2.go: 通用 OAuth2 认证器 (auth_url + token exchange + userinfo)
- pkg/notifier/: Provider interface + 3 个内置驱动
  - email: SMTP 发送
  - dingtalk: 钉钉机器人 webhook
  - wecom: 企业微信机器人 webhook
- alert_service.go: 新增 dingtalk/wecom 渠道类型支持
- 通过 notifier.Send() 统一分发通知

Author: mingjia1

platform-backend/internal/services/alert_service.go

@@ -12,6 +12,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/monkeycode/mysql-ops-platform/internal/models"
 	"github.com/monkeycode/mysql-ops-platform/internal/repositories"
+	"github.com/monkeycode/mysql-ops-platform/pkg/notifier"
 )
 
 type AlertService struct {
@@ -224,6 +225,28 @@ func (s *AlertService) SendNotification(ctx context.Context, req SendNotificatio
 				continue
 			}
 			successCount++
+		case "dingtalk":
+			webhookURL, _ := cfg["webhook_url"].(string)
+			if webhookURL == "" {
+				failedChannels = append(failedChannels, channelID+" (webhook_url not configured)")
+				continue
+			}
+			if err := notifier.Send("dingtalk", webhookURL, req.AlertID, req.Message); err != nil {
+				failedChannels = append(failedChannels, channelID+" ("+err.Error()+")")
+				continue
+			}
+			successCount++
+		case "wecom":
+			webhookURL, _ := cfg["webhook_url"].(string)
+			if webhookURL == "" {
+				failedChannels = append(failedChannels, channelID+" (webhook_url not configured)")
+				continue
+			}
+			if err := notifier.Send("wecom", webhookURL, req.AlertID, req.Message); err != nil {
+				failedChannels = append(failedChannels, channelID+" ("+err.Error()+")")
+				continue
+			}
+			successCount++
 		default:
 			failedChannels = append(failedChannels, channelID+" (unsupported channel_type)")
 		}

platform-backend/pkg/auth/ldap.go

@@ -0,0 +1,114 @@
+package auth
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+)
+
+type LDAPConfig struct {
+	Server   string `json:"server"`
+	Port     int    `json:"port"`
+	BaseDN   string `json:"base_dn"`
+	BindDN   string `json:"bind_dn"`
+	BindPass string `json:"bind_pass"`
+	Filter   string `json:"filter"`
+	UseTLS   bool   `json:"use_tls"`
+	Timeout  int    `json:"timeout"`
+}
+
+type LDAPAuthenticator struct {
+	config LDAPConfig
+}
+
+func NewLDAPAuthenticator(config LDAPConfig) *LDAPAuthenticator {
+	if config.Timeout == 0 {
+		config.Timeout = 10
+	}
+	if config.Port == 0 {
+		config.Port = 389
+	}
+	if config.Filter == "" {
+		config.Filter = "(uid=%s)"
+	}
+	return &LDAPAuthenticator{config: config}
+}
+
+func (a *LDAPAuthenticator) Authenticate(username, password string) (map[string]string, error) {
+	addr := fmt.Sprintf("%s:%d", a.config.Server, a.config.Port)
+	conn, err := net.DialTimeout("tcp", addr, time.Duration(a.config.Timeout)*time.Second)
+	if err != nil {
+		return nil, fmt.Errorf("ldap connect failed: %w", err)
+	}
+	defer conn.Close()
+
+	if a.config.UseTLS {
+		tlsConn := tls.Client(conn, &tls.Config{InsecureSkipVerify: true})
+		if err := tlsConn.Handshake(); err != nil {
+			return nil, fmt.Errorf("ldap tls handshake failed: %w", err)
+		}
+		conn = tlsConn
+	}
+
+	ldapMsg := buildBindRequest(a.config.BindDN, a.config.BindPass)
+	if _, err := conn.Write(ldapMsg); err != nil {
+		return nil, fmt.Errorf("ldap bind write failed: %w", err)
+	}
+
+	resp := make([]byte, 4096)
+	n, err := conn.Read(resp)
+	if err != nil {
+		return nil, fmt.Errorf("ldap bind read failed: %w", err)
+	}
+	if n < 2 || resp[1] != 0x00 {
+		return nil, fmt.Errorf("ldap bind failed: server returned error code")
+	}
+
+	userDN := fmt.Sprintf(a.config.Filter, username)
+	if !strings.Contains(a.config.Filter, "%s") {
+		userDN = a.config.Filter
+	}
+
+	ldapMsg = buildBindRequest(userDN, password)
+	if _, err := conn.Write(ldapMsg); err != nil {
+		return nil, fmt.Errorf("ldap user bind failed: %w", err)
+	}
+
+	n, err = conn.Read(resp)
+	if err != nil {
+		return nil, fmt.Errorf("ldap user bind read failed: %w", err)
+	}
+	if n < 2 || resp[1] != 0x00 {
+		return nil, fmt.Errorf("invalid ldap credentials")
+	}
+
+	return map[string]string{
+		"username":   username,
+		"dn":         userDN,
+	}, nil
+}
+
+func buildBindRequest(dn, password string) []byte {
+	// Minimal LDAP BIND request (simple auth)
+	var req []byte
+	req = append(req, 0x30)
+	body := append([]byte{0x02, 0x01, 0x01}, // version 3
+		append([]byte{0x60}, encodeLength(len(dn)+2)...)...) // bind request tag
+	body = append(body, append([]byte{0x04}, encodeLength(len(dn))...)...)
+	body = append(body, []byte(dn)...)
+	body = append(body, 0x80)
+	body = append(body, encodeLength(len(password))...)
+	body = append(body, []byte(password)...)
+	req = append(req, encodeLength(len(body))...)
+	req = append(req, body...)
+	return req
+}
+
+func encodeLength(n int) []byte {
+	if n < 128 {
+		return []byte{byte(n)}
+	}
+	return []byte{0x81, byte(n)}
+}

platform-backend/pkg/auth/oauth2.go

@@ -0,0 +1,93 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type OAuth2Config struct {
+	Provider     string `json:"provider"`
+	ClientID     string `json:"client_id"`
+	ClientSecret string `json:"client_secret"`
+	AuthURL      string `json:"auth_url"`
+	TokenURL     string `json:"token_url"`
+	UserInfoURL  string `json:"user_info_url"`
+	RedirectURL  string `json:"redirect_url"`
+	Scopes       string `json:"scopes"`
+}
+
+type OAuth2Authenticator struct {
+	config OAuth2Config
+	client *http.Client
+}
+
+func NewOAuth2Authenticator(config OAuth2Config) *OAuth2Authenticator {
+	if config.Scopes == "" {
+		config.Scopes = "openid,profile,email"
+	}
+	return &OAuth2Authenticator{
+		config: config,
+		client: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+func (a *OAuth2Authenticator) AuthURL(state string) string {
+	return fmt.Sprintf("%s?client_id=%s&redirect_uri=%s&response_type=code&scope=%s&state=%s",
+		a.config.AuthURL, a.config.ClientID, a.config.RedirectURL, a.config.Scopes, state)
+}
+
+func (a *OAuth2Authenticator) Exchange(ctx context.Context, code string) (string, error) {
+	body := fmt.Sprintf("code=%s&client_id=%s&client_secret=%s&redirect_uri=%s&grant_type=authorization_code",
+		code, a.config.ClientID, a.config.ClientSecret, a.config.RedirectURL)
+	req, err := http.NewRequestWithContext(ctx, "POST", a.config.TokenURL, strings.NewReader(body))
+	if err != nil {
+		return "", fmt.Errorf("oauth2 token request failed: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("oauth2 token exchange failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	data, _ := io.ReadAll(resp.Body)
+	var result struct {
+		AccessToken string `json:"access_token"`
+		TokenType   string `json:"token_type"`
+		IDToken     string `json:"id_token"`
+	}
+	if err := json.Unmarshal(data, &result); err != nil {
+		return "", fmt.Errorf("oauth2 token parse failed: %w", err)
+	}
+	if result.AccessToken == "" {
+		return "", fmt.Errorf("oauth2 token response missing access_token")
+	}
+	return result.AccessToken, nil
+}
+
+func (a *OAuth2Authenticator) GetUserInfo(ctx context.Context, accessToken string) (map[string]interface{}, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", a.config.UserInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("oauth2 userinfo request failed: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("oauth2 userinfo failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	data, _ := io.ReadAll(resp.Body)
+	var info map[string]interface{}
+	if err := json.Unmarshal(data, &info); err != nil {
+		return nil, fmt.Errorf("oauth2 userinfo parse failed: %w", err)
+	}
+	return info, nil
+}

platform-backend/pkg/notifier/dingtalk.go

@@ -0,0 +1,41 @@
+package notifier
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+type DingTalkProvider struct {
+	client *http.Client
+}
+
+func NewDingTalkProvider() *DingTalkProvider {
+	return &DingTalkProvider{client: &http.Client{Timeout: 10 * time.Second}}
+}
+
+type dingtalkMsg struct {
+	MsgType string `json:"msgtype"`
+	Text    struct {
+		Content string `json:"content"`
+	} `json:"text"`
+}
+
+func (p *DingTalkProvider) Send(webhookURL, title, content string) error {
+	msg := dingtalkMsg{MsgType: "text"}
+	msg.Text.Content = title + "\n" + content
+	body, _ := json.Marshal(msg)
+
+	resp, err := p.client.Post(webhookURL, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("dingtalk send failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("dingtalk returned status %d", resp.StatusCode)
+	}
+	return nil
+}

platform-backend/pkg/notifier/email.go

@@ -0,0 +1,19 @@
+package notifier
+
+import (
+	"fmt"
+	"net/smtp"
+	"strings"
+)
+
+type EmailProvider struct{}
+
+func (p *EmailProvider) Send(config, title, content string) error {
+	parts := strings.SplitN(config, "|", 4)
+	if len(parts) < 4 {
+		return fmt.Errorf("invalid email config: want smtp_host|smtp_port|from|to, got %q", config)
+	}
+	host, port, from, to := parts[0], parts[1], parts[2], parts[3]
+	msg := []byte(fmt.Sprintf("Subject: %s\r\n\r\n%s", title, content))
+	return smtp.SendMail(host+":"+port, nil, from, strings.Split(to, ","), msg)
+}

platform-backend/pkg/notifier/notifier.go

@@ -0,0 +1,5 @@
+package notifier
+
+type Provider interface {
+	Send(channelConfig string, title, content string) error
+}

platform-backend/pkg/notifier/registry.go

@@ -0,0 +1,35 @@
+package notifier
+
+import (
+	"fmt"
+	"sync"
+)
+
+var (
+	mu        sync.RWMutex
+	providers = map[string]Provider{
+		"email":   &EmailProvider{},
+		"dingtalk": NewDingTalkProvider(),
+		"wecom":   NewWeComProvider(),
+	}
+)
+
+func Register(name string, p Provider) {
+	mu.Lock()
+	providers[name] = p
+	mu.Unlock()
+}
+
+func Get(name string) Provider {
+	mu.RLock()
+	defer mu.RUnlock()
+	return providers[name]
+}
+
+func Send(channelType, channelConfig, title, content string) error {
+	p := Get(channelType)
+	if p == nil {
+		return fmt.Errorf("unknown channel type: %s", channelType)
+	}
+	return p.Send(channelConfig, title, content)
+}

platform-backend/pkg/notifier/wecom.go

@@ -0,0 +1,41 @@
+package notifier
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+type WeComProvider struct {
+	client *http.Client
+}
+
+func NewWeComProvider() *WeComProvider {
+	return &WeComProvider{client: &http.Client{Timeout: 10 * time.Second}}
+}
+
+type wecomMsg struct {
+	MsgType string `json:"msgtype"`
+	Text    struct {
+		Content string `json:"content"`
+	} `json:"text"`
+}
+
+func (p *WeComProvider) Send(webhookURL, title, content string) error {
+	msg := wecomMsg{MsgType: "text"}
+	msg.Text.Content = title + "\n" + content
+	body, _ := json.Marshal(msg)
+
+	resp, err := p.client.Post(webhookURL, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("wecom send failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("wecom returned status %d", resp.StatusCode)
+	}
+	return nil
+}