133 lines
3.8 KiB
Go
133 lines
3.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v4"
|
|
)
|
|
|
|
// Claims 自定义 JWT 声明
|
|
type Claims struct {
|
|
UserID int64 `json:"userId"`
|
|
Username string `json:"username"`
|
|
RealName string `json:"realName"`
|
|
Role string `json:"role"`
|
|
jwt.RegisteredClaims
|
|
}
|
|
|
|
// TokenInfo 签发 token 所需的用户信息
|
|
type TokenInfo struct {
|
|
UserID int64
|
|
Username string
|
|
RealName string
|
|
Role string
|
|
}
|
|
|
|
const issuer = "bj_power_workstation"
|
|
|
|
func defaultExpire(expire int64) int64 {
|
|
if expire <= 0 {
|
|
return 1800
|
|
}
|
|
return expire
|
|
}
|
|
|
|
// SignToken 签发 JWT，返回 (token, 过期秒级时间戳, err)
|
|
func SignToken(secret string, expire int64, info TokenInfo) (string, int64, error) {
|
|
exp := time.Now().Add(time.Duration(defaultExpire(expire)) * time.Second)
|
|
claims := &Claims{
|
|
UserID: info.UserID,
|
|
Username: info.Username,
|
|
RealName: info.RealName,
|
|
Role: info.Role,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
ExpiresAt: jwt.NewNumericDate(exp),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
Issuer: issuer,
|
|
},
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
signed, err := token.SignedString([]byte(secret))
|
|
return signed, exp.Unix(), err
|
|
}
|
|
|
|
// ParseToken 校验并解析 JWT
|
|
func ParseToken(secret, tokenStr string) (*Claims, error) {
|
|
token, err := jwt.ParseWithClaims(tokenStr, &Claims{}, func(t *jwt.Token) (any, error) {
|
|
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, errors.New("非法签名算法")
|
|
}
|
|
return []byte(secret), nil
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
claims, ok := token.Claims.(*Claims)
|
|
if !ok || !token.Valid {
|
|
return nil, errors.New("token 无效")
|
|
}
|
|
return claims, nil
|
|
}
|
|
|
|
// renewIfNearExpiry 滑动续签：剩余有效期不足一半时重签，写入响应头 X-Renewed-Token
|
|
func renewIfNearExpiry(secret string, expire int64, w http.ResponseWriter, claims *Claims) {
|
|
remaining := time.Until(claims.ExpiresAt.Time)
|
|
if remaining > 0 && remaining < time.Duration(defaultExpire(expire))*time.Second/2 {
|
|
if newToken, _, err := SignToken(secret, expire, TokenInfo{
|
|
UserID: claims.UserID,
|
|
Username: claims.Username,
|
|
RealName: claims.RealName,
|
|
Role: claims.Role,
|
|
}); err == nil {
|
|
w.Header().Set("X-Renewed-Token", newToken)
|
|
}
|
|
}
|
|
}
|
|
|
|
// unauthorized 与业务侧 {code,message,data} 封装保持一致
|
|
func unauthorized(w http.ResponseWriter, msg string) {
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"code": 401, "message": msg})
|
|
}
|
|
|
|
// Interceptor 登录鉴权中间件。
|
|
// 白名单：/api/health、/api/auth/login、/pdfopen/*。
|
|
// 非 /api/ 且非 /pdfopen/ 的路径为前端静态资源，直接放行。
|
|
func Interceptor(secret string, accessExpire int64) func(next http.HandlerFunc) http.HandlerFunc {
|
|
return func(next http.HandlerFunc) http.HandlerFunc {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
path := r.URL.Path
|
|
|
|
notAPI := !strings.HasPrefix(path, "/api/") && !strings.HasPrefix(path, "/pdfopen/")
|
|
whitelisted := path == "/api/health" ||
|
|
path == "/api/auth/login" ||
|
|
path == "/api/config" ||
|
|
strings.HasPrefix(path, "/pdfopen/")
|
|
if notAPI || whitelisted {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
authHeader := r.Header.Get("Authorization")
|
|
if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
|
|
unauthorized(w, "未登录或 token 缺失")
|
|
return
|
|
}
|
|
tokenStr := strings.TrimPrefix(authHeader, "Bearer ")
|
|
claims, err := ParseToken(secret, tokenStr)
|
|
if err != nil {
|
|
unauthorized(w, "登录已失效")
|
|
return
|
|
}
|
|
renewIfNearExpiry(secret, accessExpire, w, claims)
|
|
r.Header.Set("X-Username", claims.Username)
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|