批量优化
This commit is contained in:
hero920103 committed
1 parent
e3db229f41
commit
aa92ca40a2
79 files changed
+7495
-1104
No files matched your search
@@ -0,0 +1,243 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"server/models"
|
||||
"server/pkg/jwtutil"
|
||||
authsvc "server/services/auth"
|
||||
|
||||
beego "github.com/beego/beego/v2/server/web"
|
||||
)
|
||||
|
||||
// =============================================================
|
||||
// 移动端免登录票据（把移动端登录态桥接到 Web 端）
|
||||
//
|
||||
// POST /auth/app-ticket 移动端带 Bearer 令牌 → 签发一次性票据
|
||||
// POST /auth/app-ticket/exchange Web 端带票据 → 核销并换发 Web 端令牌
|
||||
//
|
||||
// 仅用于「移动端已登录 → 打开 Web 端功能页」这一条链路，
|
||||
// 票据一次性 + 60 秒有效，泄露也无法二次使用。
|
||||
// =============================================================
|
||||
|
||||
// AuthAppTicketController 移动端免登录票据
|
||||
type AuthAppTicketController struct {
|
||||
beego.Controller
|
||||
}
|
||||
|
||||
func (c *AuthAppTicketController) serveJSON(data map[string]interface{}) {
|
||||
c.Data["json"] = data
|
||||
_ = c.ServeJSON()
|
||||
}
|
||||
|
||||
func (c *AuthAppTicketController) fail(msg string) {
|
||||
c.Ctx.Output.SetStatus(400)
|
||||
c.serveJSON(map[string]interface{}{"code": 400, "msg": msg})
|
||||
}
|
||||
|
||||
// ticketClaims 解析 Bearer 令牌；移动端是 user_type=app，Web 端是 backend
|
||||
func (c *AuthAppTicketController) ticketClaims() (*jwtutil.Claims, error) {
|
||||
header := c.Ctx.Request.Header.Get("Authorization")
|
||||
if header == "" {
|
||||
return nil, fmt.Errorf("未登录")
|
||||
}
|
||||
parts := strings.SplitN(header, " ", 2)
|
||||
if len(parts) != 2 || parts[0] != "Bearer" {
|
||||
return nil, fmt.Errorf("认证信息格式错误")
|
||||
}
|
||||
claims, err := jwtutil.ParseToken(parts[1])
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("无效的token")
|
||||
}
|
||||
if claims.UserType != "app" && claims.UserType != "backend" {
|
||||
return nil, fmt.Errorf("无权访问")
|
||||
}
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
// Create POST /auth/app-ticket
|
||||
// 移动端用当前登录态换取一次性票据，Web 端拿票据换自己的令牌。
|
||||
func (c *AuthAppTicketController) Create() {
|
||||
claims, err := c.ticketClaims()
|
||||
if err != nil {
|
||||
c.Ctx.Output.SetStatus(401)
|
||||
c.serveJSON(map[string]interface{}{"code": 401, "msg": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
var req struct {
|
||||
ClientID string `json:"client_id"`
|
||||
}
|
||||
if body := c.Ctx.Input.RequestBody; len(body) > 0 {
|
||||
_ = json.Unmarshal(body, &req)
|
||||
}
|
||||
// 票据是给 Web 端兑换用的，默认按 Web 端应用签发
|
||||
clientID := strings.TrimSpace(req.ClientID)
|
||||
if clientID == "" {
|
||||
clientID = "yz-backend"
|
||||
}
|
||||
|
||||
tid := uint64(0)
|
||||
if claims.TenantId > 0 {
|
||||
tid = uint64(claims.TenantId)
|
||||
}
|
||||
|
||||
ticket, err := authsvc.CreateAppTicket(uint64(claims.UserID), tid, clientID)
|
||||
if err != nil {
|
||||
c.fail("签发票据失败：" + err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
c.serveJSON(map[string]interface{}{
|
||||
"code": 200,
|
||||
"msg": "success",
|
||||
"data": map[string]interface{}{
|
||||
"ticket": ticket,
|
||||
"expire_in": int(authsvc.AppTicketTTL / time.Second),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// Exchange POST /auth/app-ticket/exchange
|
||||
// Web 端核销票据并换发本端令牌（无鉴权：票据本身即凭证，一次性 + 短时效）。
|
||||
func (c *AuthAppTicketController) Exchange() {
|
||||
body := c.Ctx.Input.RequestBody
|
||||
if len(body) == 0 {
|
||||
body, _ = io.ReadAll(c.Ctx.Request.Body)
|
||||
}
|
||||
var req struct {
|
||||
Ticket string `json:"ticket"`
|
||||
Token string `json:"token"` // 兼容 mp-login 的命名
|
||||
ClientID string `json:"client_id"`
|
||||
}
|
||||
if err := json.Unmarshal(body, &req); err != nil {
|
||||
c.fail("参数错误")
|
||||
return
|
||||
}
|
||||
ticket := strings.TrimSpace(req.Ticket)
|
||||
if ticket == "" {
|
||||
ticket = strings.TrimSpace(req.Token)
|
||||
}
|
||||
|
||||
row, err := authsvc.ConsumeAppTicket(ticket)
|
||||
if err != nil {
|
||||
c.fail(err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
// 身份校验：禁用/锁定的账号不签发
|
||||
var identity models.AuthIdentity
|
||||
if err := models.Orm.QueryTable(new(models.AuthIdentity)).
|
||||
Filter("id", row.IdentityID).
|
||||
Filter("delete_time__isnull", true).
|
||||
One(&identity); err != nil {
|
||||
c.fail("账号不存在或已注销")
|
||||
return
|
||||
}
|
||||
if identity.Status != models.AuthIdentityStatusEnabled {
|
||||
c.fail("账号已被禁用或锁定，无法登录")
|
||||
return
|
||||
}
|
||||
|
||||
username := "云泽用户"
|
||||
if identity.Nickname != nil && strings.TrimSpace(*identity.Nickname) != "" {
|
||||
username = strings.TrimSpace(*identity.Nickname)
|
||||
}
|
||||
|
||||
clientID := strings.TrimSpace(req.ClientID)
|
||||
if clientID == "" {
|
||||
clientID = row.ClientID
|
||||
}
|
||||
if clientID == "" {
|
||||
clientID = "yz-backend"
|
||||
}
|
||||
|
||||
// 未确定企业（多企业）时签发待选令牌，由 Web 端展示企业选择
|
||||
tid := row.Tid
|
||||
needChoose := false
|
||||
if tid == 0 {
|
||||
tenants, lerr := authsvc.ListTenantOptions(row.IdentityID)
|
||||
if lerr != nil || len(tenants) == 0 {
|
||||
c.fail("该账号未加入任何企业，无法登录")
|
||||
return
|
||||
}
|
||||
if len(tenants) == 1 {
|
||||
tid = tenants[0].Tid
|
||||
} else {
|
||||
tid = authsvc.PendingTenantID
|
||||
needChoose = true
|
||||
}
|
||||
}
|
||||
|
||||
tokens, terr := c.issueTicketTokens(row.IdentityID, tid, clientID, username, needChoose)
|
||||
if terr != nil {
|
||||
c.fail(terr.Error())
|
||||
return
|
||||
}
|
||||
|
||||
data := map[string]interface{}{
|
||||
"type": "backend",
|
||||
"tokens": tokens,
|
||||
"tid": tid,
|
||||
}
|
||||
if needChoose {
|
||||
tenants, _ := authsvc.ListTenantOptions(row.IdentityID)
|
||||
data["need_choose_tenant"] = true
|
||||
data["tenants"] = tenants
|
||||
}
|
||||
c.serveJSON(map[string]interface{}{"code": 200, "msg": "登录成功", "data": data})
|
||||
}
|
||||
|
||||
// issueTicketTokens 建会话 + 签发令牌 + 登录日志（失败不影响主流程）
|
||||
func (c *AuthAppTicketController) issueTicketTokens(identityID, tid uint64, clientID, username string, needChoose bool) (*authsvc.TokenPair, error) {
|
||||
accessTTL := 0
|
||||
if needChoose {
|
||||
accessTTL = 600 // 待选状态令牌只够用户完成企业选择
|
||||
}
|
||||
sess, serr := authsvc.CreateSession(authsvc.SessionInfo{
|
||||
IdentityID: identityID,
|
||||
Tid: tid,
|
||||
ClientID: clientID,
|
||||
IP: c.Ctx.Input.IP(),
|
||||
UserAgent: c.Ctx.Request.UserAgent(),
|
||||
LoginType: "app_ticket",
|
||||
Amr: "app_ticket",
|
||||
})
|
||||
if serr != nil {
|
||||
return nil, fmt.Errorf("登录失败：%s", serr.Error())
|
||||
}
|
||||
tokens, terr := authsvc.IssueTokens(authsvc.TokenIssue{
|
||||
IdentityID: identityID,
|
||||
Tid: tid,
|
||||
ClientID: clientID,
|
||||
Sid: sess.Sid,
|
||||
Username: username,
|
||||
UserType: "backend", // Web 端业务接口普遍要求 backend
|
||||
Amr: "app_ticket",
|
||||
AccessTTL: accessTTL,
|
||||
})
|
||||
if terr != nil {
|
||||
return nil, fmt.Errorf("签发令牌失败：%s", terr.Error())
|
||||
}
|
||||
|
||||
identityIDCopy := identityID
|
||||
tidCopy := tid
|
||||
amr := "app_ticket"
|
||||
_, _ = models.Orm.Insert(&models.AuthLoginLog{
|
||||
Tid: &tidCopy,
|
||||
IdentityID: &identityIDCopy,
|
||||
UserName: username,
|
||||
ClientID: clientID,
|
||||
LoginType: "app_ticket",
|
||||
Amr: &amr,
|
||||
Status: 1,
|
||||
Message: "移动端票据免登录",
|
||||
IP: c.Ctx.Input.IP(),
|
||||
UserAgent: c.Ctx.Request.UserAgent(),
|
||||
})
|
||||
return tokens, nil
|
||||
}
|
||||
Reference in new issue
Block a user