{
  "platform_id": "qianwei-retail",
  "user_id": "qw_user_10248",
  "access_token": "ACCESS_TOKEN",
  "refresh_token": "REFRESH_TOKEN",
  "access_token_expired_time": 1783607200,
  "refresh_token_http": "GET",
  "refresh_token_refresh_input_params": {"refresh_token": "REFRESH_TOKEN"},
  "refresh_token_url": "https://saas.example.com/api/auth/refresh",
  "timestamp": 1783600000,
  "nonce": "n_8f2a91",
  "aud": "lingwu-ai-staging",
  "origin": "https://saas.example.com"
}

import base64
import json
import os
import secrets
import time
from urllib.parse import urlencode

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

LAUNCH_ENDPOINT = "http://8.210.155.175:8083/api/saas/launch"


def b64url(value: bytes) -> str:
    return base64.urlsafe_b64encode(value).rstrip(b"=").decode()


def build_iframe_src(*, platform_id, kid, public_key_pem, user_id,
                     access_token, refresh_token, access_token_expired_time,
                     refresh_token_url, refresh_token_http, saas_origin):
    payload = {
        "platform_id": platform_id,
        "user_id": str(user_id),
        "access_token": access_token,
        "refresh_token": refresh_token,
        "access_token_expired_time": int(access_token_expired_time),
        "refresh_token_http": refresh_token_http.upper(),
        "refresh_token_refresh_input_params": {"refresh_token": refresh_token},
        "refresh_token_url": refresh_token_url,
        "timestamp": int(time.time()),
        "nonce": secrets.token_urlsafe(24),
        "aud": "lingwu-ai-staging",
        "origin": saas_origin,
    }
    aad = f"{platform_id}:{kid}".encode()
    aes_key, iv = os.urandom(32), os.urandom(12)
    encrypted = AESGCM(aes_key).encrypt(
        iv,
        json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode(),
        aad,
    )
    public_key = serialization.load_pem_public_key(public_key_pem.encode())
    encrypted_key = public_key.encrypt(
        aes_key,
        padding.OAEP(
            mgf=padding.MGF1(hashes.SHA256()),
            algorithm=hashes.SHA256(),
            label=None,
        ),
    )
    envelope = {
        "version": "1.0",
        "alg": "RSA-OAEP-256+A256GCM",
        "encrypted_key": b64url(encrypted_key),
        "iv": b64url(iv),
        "ciphertext": b64url(encrypted[:-16]),
        "tag": b64url(encrypted[-16:]),
    }
    return LAUNCH_ENDPOINT + "?" + urlencode({
        "platform_id": platform_id,
        "kid": kid,
        "encrypted_payload": b64url(json.dumps(envelope).encode()),
    })


# 在 SaaS 已完成登录校验的后端接口中调用；两个参数来自贵司认证系统。
def create_iframe_src_for_logged_in_user(current_user, current_session):
    return build_iframe_src(
        platform_id=os.environ["LINGWU_PLATFORM_ID"],
        kid=os.environ["LINGWU_KID"],
        public_key_pem=os.environ["LINGWU_PUBLIC_KEY_PEM"],
        user_id=current_user.id,  # 用户表稳定主键或 JWT sub
        access_token=current_session.access_token,
        refresh_token=current_session.refresh_token,
        access_token_expired_time=current_session.access_token_expired_time,
        refresh_token_url=os.environ["SAAS_REFRESH_TOKEN_URL"],
        refresh_token_http="POST",
        saas_origin=os.environ["SAAS_PUBLIC_ORIGIN"],
    )

该代码必须运行在 SaaS 后端。SaaS 后端只把生成的 iframe_src 返回给前端，前端将其赋给 iframe.src，由浏览器发起 GET 并接收 302 对话页面；SaaS 后端不应提前请求这个一次性 URL。不要把 access_token 或 refresh_token 写入日志、页面 HTML 或 URL。

{
  "version": "1.0",
  "alg": "RSA-OAEP-256+A256GCM",
  "encrypted_key": "BASE64URL_RSA_ENCRYPTED_AES_KEY",
  "iv": "BASE64URL_12_BYTE_IV",
  "ciphertext": "BASE64URL_CIPHERTEXT",
  "tag": "BASE64URL_16_BYTE_TAG"
}

HTTP/1.1 302 Found
Location: /embed/chat?s=sess_xxx
Set-Cookie: noema_saas_session=...; HttpOnly; Secure; SameSite=None
Cache-Control: no-store
Content-Security-Policy: frame-ancestors https://saas.qianwei.cn

失败时返回稳定 error_code 和 request_id，不返回解密细节。支持 PLATFORM_NOT_FOUND、KEY_REVOKED、PAYLOAD_EXPIRED、NONCE_REPLAYED、ORIGIN_NOT_ALLOWED、TOKEN_INVALID。

<iframe
  src="http://8.210.155.175:8083/api/saas/launch?platform_id=plt_xxx&kid=kid_xxx&encrypted_payload=BASE64URL_ENVELOPE"
  title="千为灵宝助手"
  allow="microphone; clipboard-write"
></iframe>