签入脚本

internal/middleware/jwt.go

@@ -0,0 +1,117 @@
+package middleware
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/net/ghttp"
+
+	"easygoadmin/internal/consts"
+	"easygoadmin/utility/cache"
+	jwtutil "easygoadmin/utility/jwt"
+	"easygoadmin/utility/response"
+)
+
+// ============================== 身份认证中间件 ==============================
+
+// JWT 身份认证中间件
+//
+// 处理流程：
+//  1. 免登录路由直接放行
+//  2. 解析 Bearer Token，校验签名、过期与签发者
+//  3. 校验 Redis 黑名单，登出或刷新后的旧令牌失效
+//  4. 加载角色与权限（缓存 300 秒）并注入请求上下文
+func JWT(r *ghttp.Request) {
+	if IsPublicPath(r.URL.Path) {
+		r.Middleware.Next()
+		return
+	}
+	token := parseBearer(r.Header.Get("Authorization"))
+	if token == "" {
+		token = r.Get("token").String() // 兼容个别 URL 直传场景
+	}
+	if token == "" {
+		writeUnauthorized(r)
+		return
+	}
+	claims, err := jwtutil.Parse(r.Context(), token)
+	if err != nil {
+		writeUnauthorized(r)
+		return
+	}
+	// 黑名单（登出/轮换后的旧令牌）
+	if cache.Exists(r.Context(), consts.CacheKeyTokenBlacklist(claims.ID)) {
+		writeUnauthorized(r)
+		return
+	}
+
+	ctx := r.Context()
+	ctx = consts.WithUserID(ctx, claims.UserID)
+	ctx = consts.WithTenantID(ctx, claims.TenantID)
+	ctx = consts.WithUsername(ctx, claims.Username)
+	ctx = consts.WithRealname(ctx, claims.Realname)
+	ctx = consts.WithTokenJTI(ctx, claims.ID)
+	if claims.ExpiresAt != nil {
+		ctx = consts.WithTokenExpire(ctx, claims.ExpiresAt.Time)
+	}
+
+	// 身份扩展（角色/权限/数据范围）：缓存优先
+	if idn := loadIdentity(r, claims.UserID); idn != nil {
+		ctx = consts.WithRoles(ctx, idn.Roles)
+		ctx = consts.WithPerms(ctx, idn.Perms)
+		ctx = consts.WithDataScope(ctx, idn.DataScope)
+		ctx = consts.WithDeptID(ctx, idn.DeptId)
+	}
+	r.SetCtx(ctx)
+	r.Middleware.Next()
+}
+
+// loadIdentity 读取用户身份
+//
+// 优先读取身份缓存，未命中时回源 IdentityLoader 并写入缓存
+func loadIdentity(r *ghttp.Request, userID int) *Identity {
+	if userID <= 0 {
+		return nil
+	}
+	ck := consts.CacheKeyUserIdentity(userID)
+	if v, ok := cache.Get(r.Context(), ck); ok {
+		idn := &Identity{}
+		if err := json.Unmarshal([]byte(v), idn); err == nil {
+			return idn
+		}
+	}
+	if IdentityLoader == nil {
+		return &Identity{}
+	}
+	idn, err := IdentityLoader(r.Context(), userID)
+	if err != nil || idn == nil {
+		glogWarn(r.Context(), "加载用户身份失败 userID=%d err=%v", userID, err)
+		return &Identity{}
+	}
+	if b, err := json.Marshal(idn); err == nil {
+		_ = cache.Set(r.Context(), ck, string(b), 300)
+	}
+	return idn
+}
+
+// parseBearer 解析 Bearer 令牌
+//
+// 兼容带前缀与直接传值两种形式
+func parseBearer(h string) string {
+	if h == "" {
+		return ""
+	}
+	if strings.HasPrefix(h, "Bearer ") || strings.HasPrefix(h, "bearer ") {
+		return strings.TrimSpace(h[7:])
+	}
+	return strings.TrimSpace(h)
+}
+
+// writeUnauthorized 输出未认证响应
+//
+// 状态码为 401，供前端识别并跳转登录页
+func writeUnauthorized(r *ghttp.Request) {
+	res := response.Fail(gerror.NewCode(consts.CodeUnauthorized))
+	response.WriteWithCode(r, res, 401)
+}