118 lines
3.1 KiB
Go
118 lines
3.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
|
|
"github.com/gogf/gf/v2/errors/gerror"
|
|
"github.com/gogf/gf/v2/net/ghttp"
|
|
|
|
"easygoadmin/internal/consts"
|
|
"easygoadmin/utility/cache"
|
|
jwtutil "easygoadmin/utility/jwt"
|
|
"easygoadmin/utility/response"
|
|
)
|
|
|
|
// ============================== 身份认证中间件 ==============================
|
|
|
|
// JWT 身份认证中间件
|
|
//
|
|
// 处理流程：
|
|
// 1. 免登录路由直接放行
|
|
// 2. 解析 Bearer Token，校验签名、过期与签发者
|
|
// 3. 校验 Redis 黑名单，登出或刷新后的旧令牌失效
|
|
// 4. 加载角色与权限（缓存 300 秒）并注入请求上下文
|
|
func JWT(r *ghttp.Request) {
|
|
if IsPublicPath(r.URL.Path) {
|
|
r.Middleware.Next()
|
|
return
|
|
}
|
|
token := parseBearer(r.Header.Get("Authorization"))
|
|
if token == "" {
|
|
token = r.Get("token").String() // 兼容个别 URL 直传场景
|
|
}
|
|
if token == "" {
|
|
writeUnauthorized(r)
|
|
return
|
|
}
|
|
claims, err := jwtutil.Parse(r.Context(), token)
|
|
if err != nil {
|
|
writeUnauthorized(r)
|
|
return
|
|
}
|
|
// 黑名单（登出/轮换后的旧令牌）
|
|
if cache.Exists(r.Context(), consts.CacheKeyTokenBlacklist(claims.ID)) {
|
|
writeUnauthorized(r)
|
|
return
|
|
}
|
|
|
|
ctx := r.Context()
|
|
ctx = consts.WithUserID(ctx, claims.UserID)
|
|
ctx = consts.WithTenantID(ctx, claims.TenantID)
|
|
ctx = consts.WithUsername(ctx, claims.Username)
|
|
ctx = consts.WithRealname(ctx, claims.Realname)
|
|
ctx = consts.WithTokenJTI(ctx, claims.ID)
|
|
if claims.ExpiresAt != nil {
|
|
ctx = consts.WithTokenExpire(ctx, claims.ExpiresAt.Time)
|
|
}
|
|
|
|
// 身份扩展（角色/权限/数据范围）：缓存优先
|
|
if idn := loadIdentity(r, claims.UserID); idn != nil {
|
|
ctx = consts.WithRoles(ctx, idn.Roles)
|
|
ctx = consts.WithPerms(ctx, idn.Perms)
|
|
ctx = consts.WithDataScope(ctx, idn.DataScope)
|
|
ctx = consts.WithDeptID(ctx, idn.DeptId)
|
|
}
|
|
r.SetCtx(ctx)
|
|
r.Middleware.Next()
|
|
}
|
|
|
|
// loadIdentity 读取用户身份
|
|
//
|
|
// 优先读取身份缓存，未命中时回源 IdentityLoader 并写入缓存
|
|
func loadIdentity(r *ghttp.Request, userID int) *Identity {
|
|
if userID <= 0 {
|
|
return nil
|
|
}
|
|
ck := consts.CacheKeyUserIdentity(userID)
|
|
if v, ok := cache.Get(r.Context(), ck); ok {
|
|
idn := &Identity{}
|
|
if err := json.Unmarshal([]byte(v), idn); err == nil {
|
|
return idn
|
|
}
|
|
}
|
|
if IdentityLoader == nil {
|
|
return &Identity{}
|
|
}
|
|
idn, err := IdentityLoader(r.Context(), userID)
|
|
if err != nil || idn == nil {
|
|
glogWarn(r.Context(), "加载用户身份失败 userID=%d err=%v", userID, err)
|
|
return &Identity{}
|
|
}
|
|
if b, err := json.Marshal(idn); err == nil {
|
|
_ = cache.Set(r.Context(), ck, string(b), 300)
|
|
}
|
|
return idn
|
|
}
|
|
|
|
// parseBearer 解析 Bearer 令牌
|
|
//
|
|
// 兼容带前缀与直接传值两种形式
|
|
func parseBearer(h string) string {
|
|
if h == "" {
|
|
return ""
|
|
}
|
|
if strings.HasPrefix(h, "Bearer ") || strings.HasPrefix(h, "bearer ") {
|
|
return strings.TrimSpace(h[7:])
|
|
}
|
|
return strings.TrimSpace(h)
|
|
}
|
|
|
|
// writeUnauthorized 输出未认证响应
|
|
//
|
|
// 状态码为 401，供前端识别并跳转登录页
|
|
func writeUnauthorized(r *ghttp.Request) {
|
|
res := response.Fail(gerror.NewCode(consts.CodeUnauthorized))
|
|
response.WriteWithCode(r, res, 401)
|
|
}
|