yunzerwebsite/yunzerwebsiteallinone
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

批量优化功能

Browse Source
This commit is contained in:
hero920103
2026-09-30 00:57:36 +08:00
parent ca4220f92c
commit e3db229f41
43 changed files with 2959 additions and 207 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go/conf/app.conf
+3
View File
@@ -86,6 +86,9 @@ jwt_rsa_kid = rsa-1
wechat_mp_secret_key = 8f3c2a1d94b74e28a6c5f0187d3e9b4c72a5d0e6f13b8c47d92a6e5f0b7c3148
# 微信服务器回调地址基址（默认回落 payment_callback_base）：
# wechat_mp_callback_base = https://api.yunzer.cn
# 公众号「登录」一次性链接的页面基址（前端应用对外可访问地址，链接形如 {基址}/#/mp-login?token=xxx）：
# 缺省回落 wechat_mp_callback_base / payment_callback_base；本地开发可填 http://127.0.0.1:4401（仅同机可点）
# wechat_mp_login_base = https://back.yunzer.cn
# ==================== 支付模块 ====================
# 渠道敏感参数（商户密钥/私钥/Secret）入库加密密钥：任意随机串即可，代码内部做 SHA-256 派生。
go/controllers/api_wechat_mp.go
+149
View File
@@ -1,14 +1,18 @@
package controllers
import (
"fmt"
"io"
"strconv"
"strings"
"time"
"server/models"
authsvc "server/services/auth"
"server/services/wechatmp"
beego "github.com/beego/beego/v2/server/web"
"github.com/beego/beego/v2/core/logs"
)
// WechatMpCallbackController 微信公众号服务器回调（微信服务器调用，无需平台鉴权）
@@ -100,6 +104,10 @@ func (c *WechatMpCallbackController) Callback() {
return
}
// 排查用：记录微信推送的消息/事件类型
logs.Info("[wechat-mp] 收到推送: type=%s event=%s from=%s key=%s",
msg.MsgType, msg.Event, msg.FromUserName, msg.EventKey)
reply := wechatmp.HandleInbound(cfg, msg)
if strings.TrimSpace(reply) == "" {
// 无需回复：返回空串，微信视为处理成功
@@ -122,3 +130,144 @@ func (c *WechatMpCallbackController) Callback() {
}
c.Ctx.Output.Body([]byte(plainReply))
}
// Login GET/POST /api/wechat/mp/login?token=xxx&client_id=yyy
// 公众号「确认登录」一次性令牌兑换登录态（无平台鉴权：令牌本身即凭证，一次性 + 短时效）。
// 已绑定身份：单企业直接签发令牌；多企业签发待选令牌并由前端展示企业选择。
// 同时认领等待中的 PC 扫码会话（存在时），PC 端轮询后自动登录。
func (c *WechatMpCallbackController) Login() {
token := strings.TrimSpace(c.GetString("token"))
clientID := strings.TrimSpace(c.GetString("client_id"))
if clientID == "" {
clientID = "yz-backend"
}
row, err := wechatmp.ConsumeLoginToken(token)
if err != nil {
c.Ctx.Output.SetStatus(400)
c.Data["json"] = map[string]interface{}{"code": 400, "msg": err.Error()}
_ = c.ServeJSON()
return
}
switch row.BindType {
case models.WechatBindTypeTenantUser:
// 认领 PC 扫码会话：确认链接携带 scene 时精确认领；「登录」文本路径无 scene，FIFO 兜底
if scene := strings.TrimSpace(c.GetString("scene")); scene != "" {
wechatmp.ConfirmScanLoginByToken(scene, token, row.BindType, row.BindID, row.BindTid)
} else {
wechatmp.ConfirmOldestPendingScanLogin(row.BindType, row.BindID, row.BindTid)
}
// 身份状态校验（禁用/锁定则拒绝登录）
var identity models.AuthIdentity
if err := models.Orm.QueryTable(new(models.AuthIdentity)).
Filter("id", row.BindID).One(&identity); err != nil {
c.failJSON(400, "账号不存在或已注销")
return
}
if identity.Status != models.AuthIdentityStatusEnabled {
c.failJSON(400, "账号已被禁用或锁定，无法登录")
return
}
username := "微信用户"
if identity.Nickname != nil && strings.TrimSpace(*identity.Nickname) != "" {
username = *identity.Nickname
}
// 企业选择：单企业直接登录；多企业签发待选令牌，由前端展示选择界面
tenants, lerr := authsvc.ListTenantOptions(row.BindID)
if lerr != nil || len(tenants) == 0 {
c.failJSON(400, "该账号未加入任何企业，无法登录")
return
}
tid := uint64(0)
needChoose := false
if len(tenants) == 1 {
tid = tenants[0].Tid
} else {
tid = authsvc.PendingTenantID
needChoose = true
}
tokens, terr := c.issueMpLoginTokens(row.BindID, tid, clientID, username, "公众号确认链接登录成功", needChoose)
if terr != nil {
c.failJSON(400, terr.Error())
return
}
data := map[string]interface{}{
"type": "backend",
"tokens": tokens,
"tenant": row.BindTid,
}
if needChoose {
data["need_choose_tenant"] = true
data["tenants"] = tenants
}
c.Data["json"] = map[string]interface{}{
"code": 200,
"msg": "登录成功",
"data": data,
}
_ = c.ServeJSON()
default:
c.failJSON(400, "该微信绑定的账号类型暂不支持链接登录")
}
}
// issueMpLoginTokens 为绑定身份建会话并签发 UAC 令牌（含登录日志，失败不影响主流程）
// tid 为 authsvc.PendingTenantID 时签发待选企业用的短期令牌
func (c *WechatMpCallbackController) issueMpLoginTokens(identityID, tid uint64, clientID, username, logMsg string, needChoose bool) (*authsvc.TokenPair, error) {
accessTTL := 0
if needChoose {
accessTTL = 600 // 待选状态令牌只够用户完成企业选择
}
sess, serr := authsvc.CreateSession(authsvc.SessionInfo{
IdentityID: identityID,
Tid: tid,
ClientID: clientID,
IP: c.Ctx.Input.IP(),
UserAgent: c.Ctx.Request.UserAgent(),
LoginType: "wechat_mp",
Amr: "wechat_mp",
})
if serr != nil {
return nil, fmt.Errorf("登录失败：%s", serr.Error())
}
tokens, terr := authsvc.IssueTokens(authsvc.TokenIssue{
IdentityID: identityID,
Tid: tid,
ClientID: clientID,
Sid: sess.Sid,
Username: username,
Amr: "wechat_mp",
AccessTTL: accessTTL,
})
if terr != nil {
return nil, fmt.Errorf("签发令牌失败：%s", terr.Error())
}
identityIDCopy := identityID
tidCopy := tid
amr := "wechat_mp"
_, _ = models.Orm.Insert(&models.AuthLoginLog{
Tid: &tidCopy,
IdentityID: &identityIDCopy,
UserName: username,
ClientID: clientID,
LoginType: "wechat_mp",
Amr: &amr,
Status: 1,
Message: logMsg,
IP: c.Ctx.Input.IP(),
UserAgent: c.Ctx.Request.UserAgent(),
})
return tokens, nil
}
func (c *WechatMpCallbackController) failJSON(bizCode int, msg string) {
c.Ctx.Output.SetStatus(400)
c.Data["json"] = map[string]interface{}{"code": bizCode, "msg": msg}
_ = c.ServeJSON()
}
go/controllers/auth/login.go
+15 -3
View File
@@ -399,12 +399,24 @@ func bearerTokenLogin(c *AuthLoginController) string {
}
func setSessionCookieForCtx(ctx *context.Context, sid string) {
// Secure 仅在 https 下添加：本地 http 联调时浏览器会丢弃 Secure Cookie，
// 导致 authorize 识别不到会话又被送回登录页
flag := cookieSecureFlag(ctx)
ctx.Output.Header("Set-Cookie",
fmt.Sprintf("%s=%s; Path=/; Max-Age=%d; HttpOnly; Secure; SameSite=Lax",
sessionCookieName, sid, sessionCookieTTL))
fmt.Sprintf("%s=%s; Path=/; Max-Age=%d; HttpOnly%s; SameSite=Lax",
sessionCookieName, sid, sessionCookieTTL, flag))
}
func clearSessionCookieForCtx(ctx *context.Context) {
flag := cookieSecureFlag(ctx)
ctx.Output.Header("Set-Cookie",
fmt.Sprintf("%s=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax", sessionCookieName))
fmt.Sprintf("%s=; Path=/; Max-Age=0; HttpOnly%s; SameSite=Lax", sessionCookieName, flag))
}
// cookieSecureFlag https 请求（或网关带 X-Forwarded-Proto: https）时返回 "; Secure"
func cookieSecureFlag(ctx *context.Context) string {
if ctx.Request.TLS != nil || strings.EqualFold(ctx.Request.Header.Get("X-Forwarded-Proto"), "https") {
return "; Secure"
}
return ""
}
go/controllers/auth/wechat_scan.go
+143
View File
@@ -0,0 +1,143 @@
package auth
import (
"net/url"
"strings"
"time"
"server/models"
authsvc "server/services/auth"
"server/services/wechatmp"
)
// =============================================================
// 统一认证中心「微信扫码登录」（未认证公众号方案）：
// 登录页展示「服务号关注二维码 + 6 位登录码」→ 用户微信扫码进入公众号会话
// → 发送登录码 → 服务号回复「确认登录」链接 → 用户点击（/mp-login 兑换时
// 携带 scene 回写确认）→ 本组接口轮询确认后建立 UAC 会话 Cookie，
// 前端跳回 authorize 完成 OAuth 发放。全程无极验验证码。
// =============================================================
// WechatScanStart POST /auth/wechat/scan/start
// 发起扫码登录会话并生成带参二维码（认证公众号）；未认证回退普通关注二维码。
// 用户扫码后公众号自动回复「确认登录」链接，无需输入任何登录码。
func (c *AuthLoginController) WechatScanStart() {
scene, qrURL, notice, expireAt, err := wechatmp.StartScanLogin()
if err != nil {
c.serveJSON(map[string]interface{}{"code": 500, "msg": "发起扫码登录失败：" + err.Error()})
return
}
c.serveJSON(map[string]interface{}{
"code": 200,
"msg": "success",
"data": map[string]interface{}{
"scene": scene,
"qrcode_url": qrURL, // 带参二维码（认证公众号）；空 = 已回退
"follow_qrcode": wechatmp.FollowQrcodeURL(),
"notice": notice, // 回退原因（非空时前端醒目提示）
"expire_in": int(time.Until(expireAt).Seconds()),
},
})
}
// WechatScanStatus GET /auth/wechat/scan/status?scene=xxx&redirect=yyy
// 登录页轮询：待确认 status=0；已确认 → 建立 UAC 会话（写 Cookie）并返回回跳地址
// （多企业时回跳企业选择步骤）；过期 status=2。
func (c *AuthLoginController) WechatScanStatus() {
redirectParam := c.GetString("redirect")
clientID := strings.TrimSpace(c.GetString("client_id"))
row, err := wechatmp.PickScanLogin(c.GetString("scene"))
if err != nil {
if err == wechatmp.ErrScanLoginInvalid {
c.serveJSON(map[string]interface{}{"code": 200, "data": map[string]interface{}{"status": 2}})
return
}
// 待确认等业务提示：status=0 继续轮询
c.serveJSON(map[string]interface{}{"code": 200, "data": map[string]interface{}{"status": 0, "msg": err.Error()}})
return
}
// 身份状态校验（禁用/锁定则拒绝）
var identity models.AuthIdentity
if err := models.Orm.QueryTable(new(models.AuthIdentity)).
Filter("id", row.BindID).One(&identity); err != nil || identity.Status != models.AuthIdentityStatusEnabled {
c.serveJSON(map[string]interface{}{"code": 400, "msg": "账号已被禁用或锁定，无法登录"})
return
}
// 企业选择：单企业直接进入；多企业进入登录页企业选择步骤
tenants, lerr := authsvc.ListTenantOptions(row.BindID)
if lerr != nil || len(tenants) == 0 {
c.serveJSON(map[string]interface{}{"code": 400, "msg": "该账号未加入任何企业，无法登录"})
return
}
tid := uint64(authsvc.PendingTenantID)
if len(tenants) == 1 {
tid = tenants[0].Tid
}
username := "微信用户"
if identity.Nickname != nil && strings.TrimSpace(*identity.Nickname) != "" {
username = *identity.Nickname
}
ip := c.Ctx.Input.IP()
userAgent := c.Ctx.Request.UserAgent()
// 建立 UAC 会话并写 Cookie（与账号密码登录同一套会话体系，authorize 据此发码）
sess, serr := authsvc.CreateSession(authsvc.SessionInfo{
IdentityID: row.BindID,
Tid: tid,
ClientID: clientID,
IP: ip,
UserAgent: userAgent,
LoginType: "wechat_mp",
Amr: "wechat_mp",
})
if serr != nil {
c.serveJSON(map[string]interface{}{"code": 400, "msg": "登录失败：" + serr.Error()})
return
}
if _, terr := authsvc.IssueTokens(authsvc.TokenIssue{
IdentityID: row.BindID,
Tid: tid,
ClientID: clientID,
Sid: sess.Sid,
Username: username,
Amr: "wechat_mp",
}); terr != nil {
c.serveJSON(map[string]interface{}{"code": 500, "msg": "签发令牌失败：" + terr.Error()})
return
}
setSessionCookieForCtx(c.Ctx, sess.Sid)
// 登录日志（失败不影响主流程）
identityID := row.BindID
amr := "wechat_mp"
_, _ = models.Orm.Insert(&models.AuthLoginLog{
Tid: &tid,
IdentityID: &identityID,
UserName: username,
ClientID: clientID,
LoginType: "wechat_mp",
Amr: &amr,
Status: 1,
Message: "公众号扫码登录成功",
IP: ip,
UserAgent: userAgent,
})
// 默认回跳到原 authorize；多企业时回跳登录页企业选择步骤
back := decodeRedirect(redirectParam)
if len(tenants) > 1 {
back = "/auth/login?step=tenant&client_id=" + url.QueryEscape(clientID) +
"&redirect=" + url.QueryEscape(redirectParam)
}
c.serveJSON(map[string]interface{}{
"code": 200,
"data": map[string]interface{}{
"status": 1,
"redirect": back,
},
})
}
go/controllers/backend_wechat_mp.go
+9 -9
View File
@@ -5,7 +5,6 @@ import (
"fmt"
"io"
"strings"
"time"
"server/models"
"server/pkg/jwtutil"
@@ -76,6 +75,8 @@ func (c *BackendWechatMpController) readBody(out interface{}) bool {
}
// BindStart POST /backend/wechatMp/bind/start
// 未认证公众号无法生成带参二维码（48001）：不再下发二维码，
// 返回绑定指引（公众号内发送「验证码」取码 → 页面填码 → bind/confirm 核销）。
func (c *BackendWechatMpController) BindStart() {
claims, err := c.claims()
if err != nil {
@@ -88,17 +89,16 @@ func (c *BackendWechatMpController) BindStart() {
c.jsonErr(401, 401, "未获取到用户信息")
return
}
scene, _, qrURL, expireAt, err := wechatmp.CreateVerifyCode(models.WechatBindTypeTenantUser, uid, tid, 0)
if err != nil {
c.jsonErr(400, 400, "生成二维码失败："+err.Error())
if _, err := wechatmp.LoadEnabledConfig(); err != nil {
c.jsonErr(400, 400, "公众号未启用："+err.Error())
return
}
c.ok(map[string]interface{}{
"scene": scene,
"qrcode_url": qrURL,
"expire_at": expireAt,
"expires_in": int(time.Until(expireAt).Seconds()),
}, "生成成功")
"mode": "mp_message",
"guides": wechatmp.BindGuides(),
"follow_qrcode": wechatmp.FollowQrcodeURL(),
"expires_in": int(wechatmp.DefaultVerifyTTL.Seconds()),
}, "请按指引完成绑定")
}
// BindStatus GET /backend/wechatMp/bind/status?scene=xxx
go/controllers/password_store.go
+467 -4
View File
@@ -2,6 +2,7 @@ package controllers
import (
"encoding/json"
"fmt"
"io"
"strconv"
"strings"
@@ -105,6 +106,105 @@ func validPassword(p passwordPayload) bool {
return p.Platform != ""
}
// sameAccount 判定两个账号是否重复：
// 登录账号都非空时按账号比较（忽略大小写）；账号为空时按密码比较。
func sameAccount(a, b models.PasswordAccountItem) bool {
u1 := strings.TrimSpace(a.Username)
u2 := strings.TrimSpace(b.Username)
if u1 != "" && u2 != "" {
return strings.EqualFold(u1, u2)
}
if u1 != u2 {
return false
}
return strings.TrimSpace(a.Password) == strings.TrimSpace(b.Password)
}
// validateAccountsUnique 校验同一平台下的登录账号不重复
func validateAccountsUnique(list []models.PasswordAccountItem) error {
seen := map[string]bool{}
for _, item := range list {
u := strings.TrimSpace(item.Username)
if u == "" {
continue
}
key := strings.ToLower(u)
if seen[key] {
return fmt.Errorf("同一平台下登录账号「%s」重复，请合并后再保存", u)
}
seen[key] = true
}
return nil
}
// dedupeAccounts 去掉同组内的重复账号（保留首次出现的一条），返回去重后的列表与去重数量
func dedupeAccounts(list []models.PasswordAccountItem) ([]models.PasswordAccountItem, int) {
out := make([]models.PasswordAccountItem, 0, len(list))
removed := 0
for _, item := range list {
dup := false
for _, keep := range out {
if sameAccount(keep, item) {
dup = true
break
}
}
if dup {
removed++
continue
}
out = append(out, item)
}
return out, removed
}
// findSamePlatformRecord 查询同用户（同租户）下是否已存在「平台名称 + 网址」相同的记录
func findSamePlatformRecord(qs orm.QuerySeter, excludeID uint64, platform, url string) (uint64, error) {
q := qs.Filter("is_deleted", 0).Filter("platform", platform).Filter("url", url)
if excludeID > 0 {
q = q.Exclude("id", excludeID)
}
// 用 Values 只取 ID，避免不同模型的 One() 类型差异
var rows []orm.Params
if _, err := q.OrderBy("id").Limit(1).Values(&rows, "id"); err != nil {
return 0, err
}
if len(rows) == 0 {
return 0, orm.ErrNoRows
}
id, _ := strconv.ParseUint(fmt.Sprintf("%v", rows[0]["Id"]), 10, 64)
if id == 0 {
id, _ = strconv.ParseUint(fmt.Sprintf("%v", rows[0]["id"]), 10, 64)
}
if id == 0 {
return 0, orm.ErrNoRows
}
return id, nil
}
// passwordPageParams 解析分页参数：page 默认 1，pageSize 默认 20、上限 200
func passwordPageParams(c *beego.Controller) (page, pageSize int) {
page, _ = c.GetInt("page", 1)
pageSize, _ = c.GetInt("pageSize", 20)
if page < 1 {
page = 1
}
if pageSize < 1 || pageSize > 200 {
pageSize = 20
}
return page, pageSize
}
// passwordPageReply 分页列表统一响应（list + total + 当前分页信息）
func passwordPageReply(c *beego.Controller, msg string, list interface{}, total int64, page, pageSize int) {
passwordReply(c, 200, msg, map[string]interface{}{
"list": list,
"total": total,
"page": page,
"page_size": pageSize,
})
}
// ==================== 平台端 Password Store ====================
type PlatformPasswordStoreController struct{ beego.Controller }
@@ -125,9 +225,11 @@ func (c *PlatformPasswordStoreController) List() {
Or("remark__icontains", k)
qs = qs.SetCond(orm.NewCondition().And("is_deleted", 0).And("user_id", cl.UserID).AndCond(cond))
}
// 分页：默认每页 20 条，单页最多 200 条
page, pageSize := passwordPageParams(&c.Controller)
total, _ := qs.Count()
var list []models.PlatformPasswordStore
_, e = qs.OrderBy("-id").Limit(200).All(&list)
_, e = qs.OrderBy("-id").Limit(pageSize, (page-1)*pageSize).All(&list)
if e != nil && e != orm.ErrNoRows {
logs.Error("[passwordStore] platform list failed: %v", e)
passwordReply(&c.Controller, 500, "查询失败: "+e.Error(), nil)
@@ -146,7 +248,7 @@ func (c *PlatformPasswordStoreController) List() {
UpdateTime: row.UpdateTime,
})
}
passwordReply(&c.Controller, 200, "success", map[string]interface{}{"list": res, "total": total})
passwordPageReply(&c.Controller, "success", res, total, page, pageSize)
}
func (c *PlatformPasswordStoreController) Detail() {
@@ -186,6 +288,18 @@ func (c *PlatformPasswordStoreController) Create() {
passwordReply(&c.Controller, 400, "平台名称不能为空", nil)
return
}
// 重复检测：平台名称 + 网址 已存在则拒绝新增
if existID, ferr := findSamePlatformRecord(
models.Orm.QueryTable(new(models.PlatformPasswordStore)).Filter("user_id", cl.UserID),
0, p.Platform, p.URL); ferr == nil && existID > 0 {
passwordReply(&c.Controller, 400, fmt.Sprintf("已存在同名同网址的平台「%s」（ID %d），请直接编辑该记录", p.Platform, existID), nil)
return
}
// 重复检测：同一平台下的登录账号不能重复
if verr := validateAccountsUnique(p.Accounts); verr != nil {
passwordReply(&c.Controller, 400, verr.Error(), nil)
return
}
accJSON := accountsToJSON(p.Accounts)
v := &models.PlatformPasswordStore{
Platform: p.Platform,
@@ -232,6 +346,18 @@ func (c *PlatformPasswordStoreController) Update() {
passwordReply(&c.Controller, 404, "记录不存在", nil)
return
}
// 重复检测：改成的平台名称 + 网址 不能与自己的其它记录冲突
if existID, ferr := findSamePlatformRecord(
models.Orm.QueryTable(new(models.PlatformPasswordStore)).Filter("user_id", cl.UserID),
id, p.Platform, p.URL); ferr == nil && existID > 0 {
passwordReply(&c.Controller, 400, fmt.Sprintf("已存在同名同网址的平台「%s」（ID %d），请先合并或改名", p.Platform, existID), nil)
return
}
// 重复检测：同一平台下的登录账号不能重复
if verr := validateAccountsUnique(p.Accounts); verr != nil {
passwordReply(&c.Controller, 400, verr.Error(), nil)
return
}
now := time.Now()
accJSON := accountsToJSON(p.Accounts)
_, e = models.Orm.QueryTable(new(models.PlatformPasswordStore)).Filter("id", id).Update(map[string]interface{}{
@@ -299,9 +425,11 @@ func (c *BackendPasswordStoreController) List() {
Or("remark__icontains", k)
qs = qs.SetCond(orm.NewCondition().And("is_deleted", 0).And("tid", cl.TenantId).And("user_id", cl.UserID).AndCond(cond))
}
// 分页：默认每页 20 条，单页最多 200 条
page, pageSize := passwordPageParams(&c.Controller)
total, _ := qs.Count()
var list []models.BackendPasswordStore
_, e = qs.OrderBy("-id").Limit(200).All(&list)
_, e = qs.OrderBy("-id").Limit(pageSize, (page-1)*pageSize).All(&list)
if e != nil && e != orm.ErrNoRows {
logs.Error("[passwordStore] backend list failed: %v", e)
passwordReply(&c.Controller, 500, "查询失败: "+e.Error(), nil)
@@ -321,7 +449,7 @@ func (c *BackendPasswordStoreController) List() {
UpdateTime: row.UpdateTime,
})
}
passwordReply(&c.Controller, 200, "success", map[string]interface{}{"list": res, "total": total})
passwordPageReply(&c.Controller, "success", res, total, page, pageSize)
}
func (c *BackendPasswordStoreController) Detail() {
@@ -362,6 +490,18 @@ func (c *BackendPasswordStoreController) Create() {
passwordReply(&c.Controller, 400, "平台名称不能为空", nil)
return
}
// 重复检测：同租户下平台名称 + 网址 已存在则拒绝新增
if existID, ferr := findSamePlatformRecord(
models.Orm.QueryTable(new(models.BackendPasswordStore)).Filter("tid", cl.TenantId).Filter("user_id", cl.UserID),
0, p.Platform, p.URL); ferr == nil && existID > 0 {
passwordReply(&c.Controller, 400, fmt.Sprintf("已存在同名同网址的平台「%s」（ID %d），请直接编辑该记录", p.Platform, existID), nil)
return
}
// 重复检测：同一平台下的登录账号不能重复
if verr := validateAccountsUnique(p.Accounts); verr != nil {
passwordReply(&c.Controller, 400, verr.Error(), nil)
return
}
accJSON := accountsToJSON(p.Accounts)
v := &models.BackendPasswordStore{
Tid: cl.TenantId,
@@ -410,6 +550,18 @@ func (c *BackendPasswordStoreController) Update() {
passwordReply(&c.Controller, 404, "记录不存在", nil)
return
}
// 重复检测：改成的平台名称 + 网址 不能与自己的其它记录冲突
if existID, ferr := findSamePlatformRecord(
models.Orm.QueryTable(new(models.BackendPasswordStore)).Filter("tid", cl.TenantId).Filter("user_id", cl.UserID),
id, p.Platform, p.URL); ferr == nil && existID > 0 {
passwordReply(&c.Controller, 400, fmt.Sprintf("已存在同名同网址的平台「%s」（ID %d），请先合并或改名", p.Platform, existID), nil)
return
}
// 重复检测：同一平台下的登录账号不能重复
if verr := validateAccountsUnique(p.Accounts); verr != nil {
passwordReply(&c.Controller, 400, verr.Error(), nil)
return
}
now := time.Now()
accJSON := accountsToJSON(p.Accounts)
_, e = models.Orm.QueryTable(new(models.BackendPasswordStore)).Filter("id", id).Update(map[string]interface{}{
@@ -457,3 +609,314 @@ func (c *BackendPasswordStoreController) Delete() {
}
passwordReply(&c.Controller, 200, "删除成功", nil)
}
// ==================== 批量导入 / 导出 ====================
//
// Excel 列顺序（与数据库字段一一对应）：
// 平台名称 platform | 网址 url | 账号 username | 密码 password |
// 注册信息 registration_info | 账号备注 account_remark | 备注 remark
// 一个平台可挂多个账号：多行「平台名称 + 网址」相同即合并为一条记录的多个账号；
// 已存在的同平台同网址记录按「追加账号（跳过完全重复项）」处理。
type passwordImportRow struct {
Platform string `json:"platform"`
URL string `json:"url"`
Username string `json:"username"`
Password string `json:"password"`
RegistrationInfo string `json:"registration_info"`
AccountRemark string `json:"account_remark"`
Remark string `json:"remark"`
}
type passwordImportResult struct {
Created int `json:"created"`
Updated int `json:"updated"`
Skipped int `json:"skipped"`
Failed int `json:"failed"`
Failures []string `json:"failures"`
}
type passwordImportGroup struct {
Platform string
URL string
Remark string
Accounts []models.PasswordAccountItem
}
func parsePasswordImportRows(c *beego.Controller) ([]passwordImportRow, error) {
b, e := io.ReadAll(c.Ctx.Request.Body)
var p struct {
Rows []passwordImportRow `json:"rows"`
}
if e == nil {
e = json.Unmarshal(b, &p)
}
return p.Rows, e
}
// groupPasswordImportRows 按「平台名称 + 网址」聚合成记录，返回有序分组与行级错误
func groupPasswordImportRows(rows []passwordImportRow) ([]*passwordImportGroup, []string) {
order := make([]string, 0, len(rows))
index := map[string]*passwordImportGroup{}
failures := make([]string, 0)
for i, r := range rows {
platform := strings.TrimSpace(r.Platform)
if platform == "" {
failures = append(failures, fmt.Sprintf("第%d行：平台名称不能为空", i+2))
continue
}
url := strings.TrimSpace(r.URL)
username := strings.TrimSpace(r.Username)
pwd := strings.TrimSpace(r.Password)
reg := strings.TrimSpace(r.RegistrationInfo)
accRemark := strings.TrimSpace(r.AccountRemark)
remark := strings.TrimSpace(r.Remark)
key := platform + "\n" + url
g, ok := index[key]
if !ok {
g = &passwordImportGroup{Platform: platform, URL: url}
index[key] = g
order = append(order, key)
}
if username != "" || pwd != "" || reg != "" || accRemark != "" {
item := models.PasswordAccountItem{
Username: username,
Password: pwd,
RegistrationInfo: reg,
Remark: accRemark,
}
// 文件内重复检测：同一「平台名称 + 网址」下登录账号重复则跳过
dup := false
for _, keep := range g.Accounts {
if sameAccount(keep, item) {
dup = true
break
}
}
if dup {
label := username
if label == "" {
label = "(空账号)"
}
failures = append(failures, fmt.Sprintf("第%d行：平台「%s」下账号「%s」与前面某行重复，已跳过", i+2, platform, label))
continue
}
g.Accounts = append(g.Accounts, item)
}
if remark != "" {
g.Remark = remark
}
}
out := make([]*passwordImportGroup, 0, len(order))
for _, k := range order {
out = append(out, index[k])
}
return out, failures
}
// mergeAccounts 追加导入账号到已有账号之后，返回合并结果与「实际新增条数」。
// 重复判定：登录账号相同（忽略大小写）即视为重复，账号为空时按密码比较。
func mergeAccounts(exist, incoming []models.PasswordAccountItem) ([]models.PasswordAccountItem, int) {
out := make([]models.PasswordAccountItem, 0, len(exist)+len(incoming))
out = append(out, exist...)
added := 0
for _, in := range incoming {
dup := false
for _, e := range exist {
if sameAccount(e, in) {
dup = true
break
}
}
if dup {
continue
}
out = append(out, in)
added++
}
return out, added
}
// Import POST /platform/passwordStore/import { rows: [...] }
func (c *PlatformPasswordStoreController) Import() {
cl, e := passwordClaims(&c.Controller, "platform")
if e != nil {
passwordReply(&c.Controller, 401, "未登录或无权限", nil)
return
}
rows, e := parsePasswordImportRows(&c.Controller)
if e != nil {
passwordReply(&c.Controller, 400, "参数错误", nil)
return
}
uid := uint64(cl.UserID)
groups, failures := groupPasswordImportRows(rows)
res := passwordImportResult{Failed: len(failures), Failures: failures}
now := time.Now()
for _, g := range groups {
var exist models.PlatformPasswordStore
err := models.Orm.QueryTable(new(models.PlatformPasswordStore)).
Filter("is_deleted", 0).Filter("user_id", uid).
Filter("platform", g.Platform).Filter("url", g.URL).One(&exist)
if err == nil {
merged, added := mergeAccounts(accountsFromJSON(exist.Accounts), g.Accounts)
if added == 0 {
res.Skipped++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」的登录账号已全部存在，已跳过", g.Platform))
continue
}
accounts := accountsToJSON(merged)
remark := exist.Remark
if g.Remark != "" {
remark = g.Remark
}
if _, uerr := models.Orm.QueryTable(new(models.PlatformPasswordStore)).Filter("id", exist.ID).
Update(map[string]interface{}{"accounts": accounts, "remark": remark, "update_time": now}); uerr != nil {
res.Failed++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」更新失败：%s", g.Platform, uerr.Error()))
continue
}
res.Updated++
continue
}
v := &models.PlatformPasswordStore{
Platform: g.Platform,
URL: g.URL,
Accounts: accountsToJSON(g.Accounts),
Remark: g.Remark,
UserID: uid,
}
if _, ierr := models.Orm.Insert(v); ierr != nil {
res.Failed++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」新增失败：%s", g.Platform, ierr.Error()))
continue
}
res.Created++
}
passwordReply(&c.Controller, 200, "导入完成", res)
}
// Export GET /platform/passwordStore/export 导出全部（不受列表 200 条限制）
func (c *PlatformPasswordStoreController) Export() {
cl, e := passwordClaims(&c.Controller, "platform")
if e != nil {
passwordReply(&c.Controller, 401, "未登录或无权限", nil)
return
}
var list []models.PlatformPasswordStore
if _, e = models.Orm.QueryTable(new(models.PlatformPasswordStore)).
Filter("is_deleted", 0).Filter("user_id", cl.UserID).
OrderBy("-id").All(&list); e != nil && e != orm.ErrNoRows {
passwordReply(&c.Controller, 500, "查询失败: "+e.Error(), nil)
return
}
res := make([]PasswordStoreItemDTO, 0, len(list))
for _, row := range list {
res = append(res, PasswordStoreItemDTO{
ID: row.ID,
Platform: row.Platform,
URL: row.URL,
Accounts: accountsFromJSON(row.Accounts),
Remark: row.Remark,
UserID: row.UserID,
CreateTime: row.CreateTime,
UpdateTime: row.UpdateTime,
})
}
passwordReply(&c.Controller, 200, "success", map[string]interface{}{"list": res, "total": len(res)})
}
// Import POST /backend/passwordStore/import { rows: [...] }
func (c *BackendPasswordStoreController) Import() {
cl, e := passwordClaims(&c.Controller, "backend")
if e != nil || cl.TenantId <= 0 {
passwordReply(&c.Controller, 401, "未登录或无权限", nil)
return
}
rows, e := parsePasswordImportRows(&c.Controller)
if e != nil {
passwordReply(&c.Controller, 400, "参数错误", nil)
return
}
uid := uint64(cl.UserID)
tid := cl.TenantId
groups, failures := groupPasswordImportRows(rows)
res := passwordImportResult{Failed: len(failures), Failures: failures}
now := time.Now()
for _, g := range groups {
var exist models.BackendPasswordStore
err := models.Orm.QueryTable(new(models.BackendPasswordStore)).
Filter("is_deleted", 0).Filter("tid", tid).Filter("user_id", uid).
Filter("platform", g.Platform).Filter("url", g.URL).One(&exist)
if err == nil {
merged, added := mergeAccounts(accountsFromJSON(exist.Accounts), g.Accounts)
if added == 0 {
res.Skipped++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」的登录账号已全部存在，已跳过", g.Platform))
continue
}
accounts := accountsToJSON(merged)
remark := exist.Remark
if g.Remark != "" {
remark = g.Remark
}
if _, uerr := models.Orm.QueryTable(new(models.BackendPasswordStore)).Filter("id", exist.ID).
Update(map[string]interface{}{"accounts": accounts, "remark": remark, "update_time": now}); uerr != nil {
res.Failed++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」更新失败：%s", g.Platform, uerr.Error()))
continue
}
res.Updated++
continue
}
v := &models.BackendPasswordStore{
Tid: tid,
Platform: g.Platform,
URL: g.URL,
Accounts: accountsToJSON(g.Accounts),
Remark: g.Remark,
UserID: uid,
}
if _, ierr := models.Orm.Insert(v); ierr != nil {
res.Failed++
res.Failures = append(res.Failures, fmt.Sprintf("平台「%s」新增失败：%s", g.Platform, ierr.Error()))
continue
}
res.Created++
}
passwordReply(&c.Controller, 200, "导入完成", res)
}
// Export GET /backend/passwordStore/export 导出当前租户下本人全部记录
func (c *BackendPasswordStoreController) Export() {
cl, e := passwordClaims(&c.Controller, "backend")
if e != nil || cl.TenantId <= 0 {
passwordReply(&c.Controller, 401, "未登录或无权限", nil)
return
}
var list []models.BackendPasswordStore
if _, e = models.Orm.QueryTable(new(models.BackendPasswordStore)).
Filter("is_deleted", 0).Filter("tid", cl.TenantId).Filter("user_id", cl.UserID).
OrderBy("-id").All(&list); e != nil && e != orm.ErrNoRows {
passwordReply(&c.Controller, 500, "查询失败: "+e.Error(), nil)
return
}
res := make([]PasswordStoreItemDTO, 0, len(list))
for _, row := range list {
res = append(res, PasswordStoreItemDTO{
ID: row.ID,
Tid: row.Tid,
Platform: row.Platform,
URL: row.URL,
Accounts: accountsFromJSON(row.Accounts),
Remark: row.Remark,
UserID: row.UserID,
CreateTime: row.CreateTime,
UpdateTime: row.UpdateTime,
})
}
passwordReply(&c.Controller, 200, "success", map[string]interface{}{"list": res, "total": len(res)})
}
go/controllers/platform_admin_user.go
+24 -1
View File
@@ -25,6 +25,7 @@ type adminUserDTO struct {
Email *string `json:"email"`
Qq *string `json:"qq"`
Sex uint8 `json:"sex"`
Birth *string `json:"birth"`
Avatar *string `json:"avatar"`
Rid uint64 `json:"rid"`
LoginCount uint64 `json:"login_count"`
@@ -34,6 +35,18 @@ type adminUserDTO struct {
UpdateTime *string `json:"update_time"`
}
// formatPlatformBirth 空串统一返回 nil，避免前端拿到空字符串
func formatPlatformBirth(birth *string) *string {
if birth == nil {
return nil
}
s := strings.TrimSpace(*birth)
if s == "" {
return nil
}
return &s
}
func toAdminUserDTO(u models.AdminUser) adminUserDTO {
var updateTime *string
if u.UpdateTime != nil {
@@ -48,6 +61,7 @@ func toAdminUserDTO(u models.AdminUser) adminUserDTO {
Email: u.Email,
Qq: u.Qq,
Sex: u.Sex,
Birth: formatPlatformBirth(u.Birth),
Avatar: u.Avatar,
Rid: u.RoleID,
LoginCount: u.LoginCount,
@@ -111,6 +125,7 @@ type adminAddUserPayload struct {
Email *string `json:"email"`
Qq *string `json:"qq"`
Sex *uint8 `json:"sex"`
Birth *string `json:"birth"`
Avatar *string `json:"avatar"`
Rid *uint64 `json:"rid"`
Status *uint8 `json:"status"`
@@ -152,7 +167,7 @@ func (c *PlatformAdminUserController) AddUser() {
roleID = *p.Rid
}
id, err := services.CreateAdminUser(p.Account, p.Password, p.Name, p.Phone, p.Email, p.Qq, p.Avatar, sex, roleID, status)
id, err := services.CreateAdminUser(p.Account, p.Password, p.Name, p.Phone, p.Email, p.Qq, p.Avatar, formatPlatformBirth(p.Birth), sex, roleID, status)
if err != nil {
c.Data["json"] = map[string]interface{}{"code": 500, "msg": "添加失败"}
_ = c.ServeJSON()
@@ -175,6 +190,7 @@ type editUserPayload struct {
Email *string `json:"email"`
Qq *string `json:"qq"`
Sex *uint8 `json:"sex"`
Birth *string `json:"birth"`
Avatar *string `json:"avatar"`
Rid *uint64 `json:"rid"`
Status *uint8 `json:"status"`
@@ -220,6 +236,13 @@ func (c *PlatformAdminUserController) EditUser() {
if p.Sex != nil {
fields["sex"] = *p.Sex
}
if p.Birth != nil {
if birth := formatPlatformBirth(p.Birth); birth != nil {
fields["birth"] = *birth
} else {
fields["birth"] = nil
}
}
if p.Avatar != nil {
fields["avatar"] = *p.Avatar
}
go/controllers/platform_auth.go
+1 -1
View File
@@ -127,7 +127,7 @@ func (c *PlatformAuthController) LoginPlatform() {
}
// 控制器只做 HTTP 解析与响应编排，业务逻辑放 services 层
token, loginUser, err := services.PlatformAdminLogin(req.Account, req.Password)
token, loginUser, err := services.PlatformAdminLogin(req.Account, req.Password, c.Ctx.Input.IP())
if err != nil {
RecordLoginLog(nil, 0, req.Account, "", "", "password", 0, err.Error(), c.Ctx.Input.IP(), c.Ctx.Request.UserAgent())
c.Data["json"] = map[string]interface{}{
go/controllers/platform_wechat_mp.go
+133 -10
View File
@@ -1,9 +1,11 @@
package controllers
import (
"encoding/base64"
"encoding/json"
"fmt"
"io"
"path/filepath"
"strings"
"time"
@@ -106,6 +108,7 @@ func (c *PlatformWechatMpController) GetConfig() {
data["encrypt_mode"] = cfg.EncryptMode
data["template_id"] = cfg.TemplateID
data["remark"] = cfg.Remark
data["follow_qrcode"] = cfg.FollowQrcode
data["configured"] = cfg.AppID != ""
if cfg.Verified {
data["verified"] = 1
@@ -190,7 +193,8 @@ func (c *PlatformWechatMpController) TestConnection() {
// ============================ 绑定（当前平台用户） ============================
// BindStart POST /platform/wechatMp/bind/start
// 生成带参二维码；用户扫码关注后公众号将被动回复验证码
// 未认证公众号无法生成带参二维码（48001）：不再下发二维码，
// 返回绑定指引（公众号内发送「验证码」取码 → 页面填码 → bind/confirm 核销）。
func (c *PlatformWechatMpController) BindStart() {
claims, err := c.claims()
if err != nil {
@@ -202,18 +206,137 @@ func (c *PlatformWechatMpController) BindStart() {
c.jsonErr(401, 401, "未获取到用户信息")
return
}
scene, _, qrURL, expireAt, err := wechatmp.CreateVerifyCode(models.WechatBindTypePlatformUser, uid, 0, 0)
if err != nil {
c.jsonErr(400, 400, "生成二维码失败："+err.Error())
if _, err := wechatmp.LoadEnabledConfig(); err != nil {
c.jsonErr(400, 400, "公众号未启用："+err.Error())
return
}
c.ok(map[string]interface{}{
"scene": scene,
"qrcode_url": qrURL,
"expire_at": expireAt,
"expires_in": int(time.Until(expireAt).Seconds()),
"callback_url": wechatmp.CallbackURL(),
}, "生成成功")
"mode": "mp_message",
"guides": wechatmp.BindGuides(),
"follow_qrcode": wechatmp.FollowQrcodeURL(),
"expires_in": int(wechatmp.DefaultVerifyTTL.Seconds()),
"callback_url": wechatmp.CallbackURL(),
}, "请按指引完成绑定")
}
// ============================ 自定义菜单 ============================
// PublishMenu POST /platform/wechatMp/menu/publish
// 通过接口在公众号底部发布「扫码登录」菜单（点击 → 自动回复确认登录链接）。
// 需认证公众号；未认证（48001）时提示改用「公众号内发送登录」路径。
func (c *PlatformWechatMpController) PublishMenu() {
if _, err := c.claims(); err != nil {
c.jsonErr(401, 401, err.Error())
return
}
cfg, err := wechatmp.LoadEnabledConfig()
if err != nil {
c.jsonErr(400, 400, "公众号未启用："+err.Error())
return
}
res, merr := wechatmp.PublishLoginMenu(cfg)
if merr != nil {
msg := "发布菜单失败：" + merr.Error()
if hint, ok := wechatmp.ExplainError(merr); ok {
msg += "；" + hint
}
c.jsonErr(400, 400, msg)
return
}
// 微信客户端有菜单缓存：发布后需重新关注或等待（最长 24 小时）才可见
msg := "菜单已发布：微信客户端有缓存，请重新关注公众号或等待刷新（最长 24 小时）后可见「扫码登录」"
if res.AlreadyExists {
msg = "菜单中已存在「扫码登录」入口，未重复发布；若底部未显示，请等待客户端刷新或重新关注"
}
if res.ConditionalMenuCount > 0 {
msg += fmt.Sprintf("；检测到个性化菜单 %d 条，个性化菜单会覆盖默认菜单，请到公众号后台确认",
res.ConditionalMenuCount)
}
c.ok(map[string]interface{}{
"menu": res.Buttons,
"already_exists": res.AlreadyExists,
"conditional_menu_count": res.ConditionalMenuCount,
}, msg)
}
// ============================ 关注二维码 ============================
// 二维码图片限制：2MB，常见图片格式
const followQrcodeMaxBytes = 2 * 1024 * 1024
var followQrcodeAllowedExts = map[string]bool{
"jpg": true, "jpeg": true, "png": true, "gif": true, "webp": true, "bmp": true,
}
// saveFollowQrcode 校验图片并写入配置表（data URL 存储），返回 data URL
func (c *PlatformWechatMpController) saveFollowQrcode() (string, error) {
if err := c.Ctx.Request.ParseMultipartForm(followQrcodeMaxBytes); err != nil {
return "", fmt.Errorf("解析上传失败: %w", err)
}
fh, header, err := c.GetFile("file")
if err != nil || fh == nil {
return "", fmt.Errorf("请选择要上传的二维码图片")
}
defer fh.Close()
if header != nil && header.Size > followQrcodeMaxBytes {
return "", fmt.Errorf("图片大小不能超过 2MB")
}
ext := strings.ToLower(strings.TrimPrefix(filepath.Ext(header.Filename), "."))
if !followQrcodeAllowedExts[ext] {
return "", fmt.Errorf("仅支持 jpg / png / gif / webp / bmp 格式")
}
raw, err := io.ReadAll(fh)
if err != nil {
return "", fmt.Errorf("读取图片失败: %w", err)
}
if len(raw) == 0 {
return "", fmt.Errorf("图片内容为空")
}
mime := "image/png"
switch ext {
case "jpg", "jpeg":
mime = "image/jpeg"
case "gif":
mime = "image/gif"
case "webp":
mime = "image/webp"
case "bmp":
mime = "image/bmp"
}
return "data:" + mime + ";base64," + base64.StdEncoding.EncodeToString(raw), nil
}
// UploadFollowQrcode POST /platform/wechatMp/followQrcode
// 上传公众号「关注二维码」图片（普通二维码，用户扫码进入公众号会话）
func (c *PlatformWechatMpController) UploadFollowQrcode() {
if _, err := c.claims(); err != nil {
c.jsonErr(401, 401, err.Error())
return
}
dataURL, err := c.saveFollowQrcode()
if err != nil {
c.jsonErr(400, 400, err.Error())
return
}
if err := wechatmp.SaveFollowQrcode(dataURL); err != nil {
c.jsonErr(500, 500, "保存失败："+err.Error())
return
}
c.ok(map[string]interface{}{"follow_qrcode": dataURL}, "上传成功")
}
// DeleteFollowQrcode POST /platform/wechatMp/followQrcode/delete
func (c *PlatformWechatMpController) DeleteFollowQrcode() {
if _, err := c.claims(); err != nil {
c.jsonErr(401, 401, err.Error())
return
}
if err := wechatmp.SaveFollowQrcode(""); err != nil {
c.jsonErr(500, 500, "删除失败："+err.Error())
return
}
c.ok(nil, "已删除")
}
// BindStatus GET /platform/wechatMp/bind/status?scene=xxx
go/docs/sql/alter_platform_admin_user_birth.sql
+4
View File
@@ -0,0 +1,4 @@
-- 平台管理员用户表补充生日字段（yz_system_admin_user）
-- 用途：/platform/editUser/:id 支持 birth，/platform/getUserInfo/:id 返回 birth
ALTER TABLE `yz_system_admin_user`
ADD COLUMN `birth` varchar(20) DEFAULT NULL COMMENT '生日' AFTER `sex`;
go/docs/sql/alter_platform_wechat_mp_config_follow_qrcode.sql
+5
View File
@@ -0,0 +1,5 @@
-- 服务号配置表补充「关注二维码」字段（未认证公众号无带参二维码，
-- 平台端上传普通关注二维码图片，绑定页展示供用户扫码关注后发送「验证码」绑定）
-- 存储格式：data URL（data:image/png;base64,...），前端可直接作为 <img> 源
ALTER TABLE `yz_platform_wechat_mp_config`
ADD COLUMN `follow_qrcode` longtext NULL COMMENT '公众号关注二维码图片（data URL）' AFTER `remark`;
go/docs/sql/create_platform_wechat_mp_login_token.sql
+16
View File
@@ -0,0 +1,16 @@
-- 微信公众号一次性登录令牌（未认证公众号无法使用网页授权，
-- 用户在公众号发送「登录」→ 回复一次性链接 → 前端用令牌换取正式登录态）
CREATE TABLE IF NOT EXISTS `yz_platform_wechat_mp_login_token` (
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
`token` VARCHAR(64) NOT NULL COMMENT '一次性登录令牌',
`openid` VARCHAR(64) NOT NULL COMMENT '微信 openid',
`bind_type` VARCHAR(32) NOT NULL DEFAULT '' COMMENT '绑定对象类型 platform_user/tenant_user',
`bind_id` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '绑定的用户 ID',
`bind_tid` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '绑定的租户 ID',
`expire_at` DATETIME NOT NULL COMMENT '过期时间',
`used_at` DATETIME DEFAULT NULL COMMENT '核销时间（一次性）',
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
PRIMARY KEY (`id`),
UNIQUE KEY `uk_token` (`token`),
KEY `idx_openid` (`openid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='微信公众号一次性登录令牌';
go/docs/sql/create_platform_wechat_mp_scan_login.sql
+20
View File
@@ -0,0 +1,20 @@
-- 微信公众号扫码登录会话（未认证公众号无带参二维码，用「公众号二维码 + 6 位登录码」替代：
-- PC 端展示二维码与登录码 → 用户扫码进入公众号会话发送登录码 → 服务号回复确认登录链接 →
-- 点击链接（/mp-login 兑换）后 PC 端轮询本表拿到确认状态并签发令牌自动登录）
CREATE TABLE IF NOT EXISTS `yz_platform_wechat_mp_scan_login` (
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
`scene` VARCHAR(64) NOT NULL COMMENT 'PC 登录会话标识',
`code` VARCHAR(8) NOT NULL COMMENT '6 位扫码登录码',
`openid` VARCHAR(64) NOT NULL DEFAULT '' COMMENT '确认用户 openid',
`status` TINYINT NOT NULL DEFAULT 0 COMMENT '0待确认 1已确认 2已过期 3令牌已领取',
`login_token` VARCHAR(64) NOT NULL DEFAULT '' COMMENT '确认链接携带的一次性登录令牌',
`bind_type` VARCHAR(32) NOT NULL DEFAULT '' COMMENT '绑定对象类型',
`bind_id` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '绑定用户 ID',
`bind_tid` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '绑定租户 ID',
`expire_at` DATETIME NOT NULL COMMENT '过期时间',
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
`update_time` DATETIME DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `uk_scene` (`scene`),
KEY `idx_code` (`code`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='微信公众号扫码登录会话';
go/models/admin_user.go
+1
View File
@@ -12,6 +12,7 @@ type AdminUser struct {
Email *string `orm:"column(email);size(255);null" json:"email"`
Qq *string `orm:"column(qq);size(16);null" json:"qq"`
Sex uint8 `orm:"column(sex);default(0)" json:"sex"`
Birth *string `orm:"column(birth);size(20);null" json:"birth"`
Avatar *string `orm:"column(avatar);size(255);null" json:"avatar"`
RoleID uint64 `orm:"column(role_id)" json:"rid"`
LoginCount uint64 `orm:"column(login_count);default(0)" json:"login_count"`
go/models/init.go
+2
View File
@@ -197,6 +197,8 @@ func Init(_ string) {
new(WechatMpConfig),
new(WechatMpFollower),
new(WechatMpVerifyCode),
new(WechatMpLoginToken),
new(WechatMpScanLogin),
// 统一认证中心（UAC）：docs/sql/create_auth_tables.sql，人工执行建表
new(AuthIdentity),
go/models/wechat_mp.go
+44
View File
@@ -35,6 +35,7 @@ type WechatMpConfig struct {
Verified int8 `orm:"column(verified);default(0)" json:"verified"`
Enabled int8 `orm:"column(enabled);default(0)" json:"enabled"`
Remark string `orm:"column(remark);size(255)" json:"remark"`
FollowQrcode string `orm:"column(follow_qrcode);type(text);null" json:"follow_qrcode"` // 关注二维码（data URL）
CreateTime time.Time `orm:"column(create_time);type(datetime);auto_now_add" json:"create_time"`
UpdateTime *time.Time `orm:"column(update_time);type(datetime);null" json:"update_time"`
}
@@ -83,3 +84,46 @@ type WechatMpVerifyCode struct {
}
func (m *WechatMpVerifyCode) TableName() string { return "yz_platform_wechat_mp_verify_code" }
// WechatMpLoginToken 公众号一次性登录令牌 yz_platform_wechat_mp_login_token
// 用户在公众号内发送「登录」→ 生成一次性令牌并回复登录链接 →
// 用户在微信内打开链接，前端用令牌换取正式登录态（未认证公众号无法使用网页授权，用此方案替代）。
type WechatMpLoginToken struct {
ID uint64 `orm:"column(id);pk;auto" json:"id"`
Token string `orm:"column(token);size(64)" json:"token"`
OpenID string `orm:"column(openid);size(64)" json:"openid"`
BindType string `orm:"column(bind_type);size(32)" json:"bind_type"`
BindID uint64 `orm:"column(bind_id)" json:"bind_id"`
BindTid uint64 `orm:"column(bind_tid)" json:"bind_tid"`
ExpireAt time.Time `orm:"column(expire_at);type(datetime)" json:"expire_at"`
UsedAt *time.Time `orm:"column(used_at);type(datetime);null" json:"used_at"`
CreateTime time.Time `orm:"column(create_time);type(datetime);auto_now_add" json:"create_time"`
}
func (m *WechatMpLoginToken) TableName() string { return "yz_platform_wechat_mp_login_token" }
// 扫码登录会话状态
const (
WechatScanLoginPending = 0 // 待确认（等待用户点击确认链接）
WechatScanLoginOK = 1 // 已确认（待 PC 端领取令牌）
WechatScanLoginExpired = 2 // 已过期
WechatScanLoginPicked = 3 // 令牌已领取
)
// WechatMpScanLogin 公众号扫码登录会话 yz_platform_wechat_mp_scan_login
type WechatMpScanLogin struct {
ID uint64 `orm:"column(id);pk;auto" json:"id"`
Scene string `orm:"column(scene);size(64)" json:"scene"`
Code string `orm:"column(code);size(8)" json:"code"`
OpenID string `orm:"column(openid);size(64);default('')" json:"openid"`
Status int8 `orm:"column(status);default(0)" json:"status"`
LoginToken string `orm:"column(login_token);size(64);default('')" json:"login_token"`
BindType string `orm:"column(bind_type);size(32);default('')" json:"bind_type"`
BindID uint64 `orm:"column(bind_id);default(0)" json:"bind_id"`
BindTid uint64 `orm:"column(bind_tid);default(0)" json:"bind_tid"`
ExpireAt time.Time `orm:"column(expire_at);type(datetime)" json:"expire_at"`
CreateTime time.Time `orm:"column(create_time);type(datetime);auto_now_add" json:"create_time"`
UpdateTime *time.Time `orm:"column(update_time);type(datetime);null" json:"update_time"`
}
func (m *WechatMpScanLogin) TableName() string { return "yz_platform_wechat_mp_scan_login" }
go/routers/auth/auth.go
+4
View File
@@ -44,4 +44,8 @@ func Register() {
beego.Router("/auth/sessions", &authctl.AuthLoginController{}, "get:Sessions")
beego.Router("/auth/sessions/kick", &authctl.AuthLoginController{}, "post:KickSession")
beego.Router("/auth/verify-config", &authctl.AuthLoginController{}, "get:VerifyConfig")
// 微信扫码登录（未认证公众号：服务号二维码 + 登录码 + 公众号内确认链接）
beego.Router("/auth/wechat/scan/start", &authctl.AuthLoginController{}, "post:WechatScanStart")
beego.Router("/auth/wechat/scan/status", &authctl.AuthLoginController{}, "get:WechatScanStatus")
}
go/routers/backend/backend.go
+2
View File
@@ -261,6 +261,8 @@ func RegisterAuthRoutes() {
beego.Router("/backend/passwordStore/create", &controllers.BackendPasswordStoreController{}, "post:Create")
beego.Router("/backend/passwordStore/update/:id", &controllers.BackendPasswordStoreController{}, "post:Update")
beego.Router("/backend/passwordStore/delete/:id", &controllers.BackendPasswordStoreController{}, "delete:Delete")
beego.Router("/backend/passwordStore/import", &controllers.BackendPasswordStoreController{}, "post:Import")
beego.Router("/backend/passwordStore/export", &controllers.BackendPasswordStoreController{}, "get:Export")
// 记事本管理
beego.Router("/backend/notebook/list", &controllers.BackendNotebookController{}, "get:List")
go/routers/platform/platform.go
+2
View File
@@ -340,6 +340,8 @@ func Register() {
beego.Router("/platform/passwordStore/create", &controllers.PlatformPasswordStoreController{}, "post:Create")
beego.Router("/platform/passwordStore/update/:id", &controllers.PlatformPasswordStoreController{}, "post:Update")
beego.Router("/platform/passwordStore/delete/:id", &controllers.PlatformPasswordStoreController{}, "delete:Delete")
beego.Router("/platform/passwordStore/import", &controllers.PlatformPasswordStoreController{}, "post:Import")
beego.Router("/platform/passwordStore/export", &controllers.PlatformPasswordStoreController{}, "get:Export")
// 智能体API管理（yz_platform_agent_api）
// 注意：固定路径需先于 /:id 通配路径注册，避免 list/test/batchDelete 被当作 ID 解析
go/routers/platform/wechat_mp.go
+7
View File
@@ -12,9 +12,16 @@ func RegisterWechatMpRoutes() {
// 微信服务器回调（URL 填入公众号后台「服务器配置」，Token 与平台配置一致）
beego.Router("/api/wechat/mp/callback", &controllers.WechatMpCallbackController{}, "get:Callback;post:Callback")
// 公众号一次性登录令牌兑换（无鉴权：令牌本身即凭证，一次性 + 短时效）
// 扫码登录的发起/轮询在统一认证中心：/auth/wechat/scan/start、/auth/wechat/scan/status
beego.Router("/api/wechat/mp/login", &controllers.WechatMpCallbackController{}, "get:Login;post:Login")
// 服务号配置
beego.Router("/platform/wechatMp/config", &controllers.PlatformWechatMpController{}, "get:GetConfig;post:SaveConfig")
beego.Router("/platform/wechatMp/test", &controllers.PlatformWechatMpController{}, "post:TestConnection")
beego.Router("/platform/wechatMp/menu/publish", &controllers.PlatformWechatMpController{}, "post:PublishMenu")
beego.Router("/platform/wechatMp/followQrcode", &controllers.PlatformWechatMpController{}, "post:UploadFollowQrcode")
beego.Router("/platform/wechatMp/followQrcode/delete", &controllers.PlatformWechatMpController{}, "post:DeleteFollowQrcode")
// 绑定（平台用户）
beego.Router("/platform/wechatMp/bind/start", &controllers.PlatformWechatMpController{}, "post:BindStart")
go/services/admin_user.go
+2 -1
View File
@@ -11,7 +11,7 @@ func NormalizeAccount(s string) string {
return strings.TrimSpace(s)
}
func CreateAdminUser(account, password string, name, phone, email, qq, avatar *string, sex uint8, roleID uint64, status uint8) (uint64, error) {
func CreateAdminUser(account, password string, name, phone, email, qq, avatar, birth *string, sex uint8, roleID uint64, status uint8) (uint64, error) {
hashed, err := passwordutil.Hash(password)
if err != nil {
return 0, err
@@ -24,6 +24,7 @@ func CreateAdminUser(account, password string, name, phone, email, qq, avatar *s
Email: email,
Qq: qq,
Avatar: avatar,
Birth: birth,
Sex: sex,
RoleID: roleID,
Status: status,
go/services/platform_auth.go
+9 -1
View File
@@ -54,7 +54,7 @@ func toPlatformLoginUser(user *models.AdminUser) *PlatformLoginUser {
}
// PlatformAdminLogin 平台端登录：仅校验 yz_system_admin_user，不需要租户。
func PlatformAdminLogin(account, password string) (string, *PlatformLoginUser, error) {
func PlatformAdminLogin(account, password, ip string) (string, *PlatformLoginUser, error) {
account = strings.TrimSpace(account)
password = strings.TrimSpace(password)
if account == "" || password == "" {
@@ -89,6 +89,14 @@ func PlatformAdminLogin(account, password string) (string, *PlatformLoginUser, e
return "", nil, err
}
// 回写最后登录 IP 与登录次数（失败不影响登录）
_, _ = models.Orm.QueryTable(new(models.AdminUser)).
Filter("id", user.ID).
Update(map[string]interface{}{
"last_login_ip": ip,
"login_count": user.LoginCount + 1,
})
loginUser := toPlatformLoginUser(&user)
return token, loginUser, nil
}
go/services/wechatmp/bind.go
+34 -4
View File
@@ -398,14 +398,29 @@ func HandleInbound(cfg *Config, msg *InboundMessage) string {
_, _ = UpsertSubscribe(openid, now)
scene := strings.TrimPrefix(strings.TrimSpace(msg.EventKey), "qrscene_")
if scene != "" {
// 带参二维码：先看是否为扫码登录会话（自动回复确认链接）
if reply, ok := HandleScanLoginEvent(scene, openid); ok {
return reply
}
return handleScanScene(cfg, scene, openid)
}
return "欢迎关注云泽平台！\n如需接收系统提醒、公告推送，请回到系统页面点击「绑定微信」，使用微信扫码获取专属验证码；已扫码但未收到时可发送「验证码」重新获取。"
// 普通关注：已绑定直接给「确认登录」链接，未绑定提示先绑定
return DirectLoginReply(openid)
case "scan":
return handleScanScene(cfg, strings.TrimSpace(msg.EventKey), openid)
scene := strings.TrimSpace(msg.EventKey)
if reply, ok := HandleScanLoginEvent(scene, openid); ok {
return reply
}
return handleScanScene(cfg, scene, openid)
case "unsubscribe":
_ = MarkUnsubscribe(openid, now)
return ""
case "click":
// 自定义菜单点击：键值为登录入口时直接回复确认登录链接
if isLoginMenuKey(msg.EventKey) {
return DirectLoginReply(openid)
}
return ""
}
case "text":
return handleTextIntent(openid, msg.Content)
@@ -414,11 +429,16 @@ func HandleInbound(cfg *Config, msg *InboundMessage) string {
}
// handleTextIntent 处理公众号文本消息：
// - 发送「登录」：已绑定用户获取一次性登录链接（见 login.go）；
// - 发送「验证码」等关键词：返回该微信号的验证码（复用未核销会话；没有则在公众号侧
// 新建「待认领」会话），用户回系统页面输入即完成绑定，无需先扫码；
// - 其余文本：给出绑定引导。
func handleTextIntent(openid, content string) string {
if !isBindKeyword(strings.TrimSpace(content)) {
text := strings.TrimSpace(content)
if isLoginKeyword(text) {
return DirectLoginReply(openid)
}
if !isBindKeyword(text) {
return textBindGuide()
}
// 1) 复用该微信号未核销、未过期的会话（扫码会话或此前公众号发起的会话）
@@ -457,7 +477,17 @@ func isBindKeyword(text string) bool {
// textBindGuide 非关键词文本的绑定引导
func textBindGuide() string {
return "如需绑定账号：请在系统页面点击「绑定微信」，然后任选一种方式——① 扫描页面上的二维码；② 直接在本公众号发送「验证码」。\n两种方式都会回复 6 位验证码，回到系统页面输入即可完成绑定。"
return "如需绑定账号：请在系统页面点击「绑定微信」，然后直接在本公众号发送「验证码」，" +
"收到 6 位验证码后回到系统页面输入即可完成绑定。\n绑定后在本公众号发送「登录」可获取一次性登录链接。"
}
// BindGuides 系统页面「绑定微信」卡片的操作指引（未认证公众号无带参二维码，仅引导发码取码）
func BindGuides() []string {
return []string{
"① 用微信扫码关注本公众号（或微信搜索公众号名称进入会话）",
"② 在公众号会话中直接发送文字「验证码」",
"③ 公众号回复 6 位验证码，填入本页输入框完成绑定",
}
}
// handleScanScene 扫码（关注/已关注）后的统一处理：写入验证码会话 + 回复验证码
go/services/wechatmp/config.go
+36 -3
View File
@@ -35,6 +35,8 @@ type Config struct {
Verified bool
Enabled bool
Remark string
FollowQrcode string // 关注二维码（data URL），绑定页展示供扫码关注
}
// ErrNotConfigured 未配置或未启用
@@ -56,9 +58,10 @@ func LoadConfig() (*Config, error) {
Token: strings.TrimSpace(row.Token),
EncryptMode: strings.TrimSpace(row.EncryptMode),
TemplateID: strings.TrimSpace(row.TemplateID),
Verified: row.Verified == 1,
Enabled: row.Enabled == 1,
Remark: row.Remark,
Verified: row.Verified == 1,
Enabled: row.Enabled == 1,
Remark: row.Remark,
FollowQrcode: strings.TrimSpace(row.FollowQrcode),
}
if cfg.EncryptMode == "" {
cfg.EncryptMode = EncryptModePlain
@@ -171,6 +174,36 @@ func SaveConfig(in SaveInput) error {
return err
}
// SaveFollowQrcode 保存/清空关注二维码（data URL，空串表示删除）
func SaveFollowQrcode(dataURL string) error {
dataURL = strings.TrimSpace(dataURL)
now := time.Now()
var row models.WechatMpConfig
err := models.Orm.QueryTable(new(models.WechatMpConfig)).OrderBy("id").One(&row)
if err != nil {
if err == orm.ErrNoRows {
// 尚无配置行：仅存二维码，其余字段留空
row = models.WechatMpConfig{FollowQrcode: dataURL, EncryptMode: EncryptModePlain, CreateTime: now}
_, err = models.Orm.Insert(&row)
return err
}
return err
}
_, err = models.Orm.QueryTable(new(models.WechatMpConfig)).
Filter("id", row.ID).
Update(map[string]interface{}{"follow_qrcode": dataURL, "update_time": now})
return err
}
// FollowQrcodeURL 读取关注二维码（未配置时返回空串）
func FollowQrcodeURL() string {
cfg, err := LoadConfig()
if err != nil {
return ""
}
return cfg.FollowQrcode
}
// CallbackURL 微信服务器回调地址（供公众号后台「服务器配置」填写）。
// 优先读取 app.conf 的 wechat_mp_callback_base，其次回落 payment_callback_base（同为对外 API 域名）。
func CallbackURL() string {
go/services/wechatmp/login.go
+142
View File
@@ -0,0 +1,142 @@
package wechatmp
import (
"crypto/rand"
"encoding/hex"
"errors"
"net/url"
"strings"
"time"
"server/models"
beego "github.com/beego/beego/v2/server/web"
)
// =============================================================
// 公众号微信登录（免认证方案）：
// 用户在公众号内发送「登录」→ 后端校验绑定关系并生成一次性登录令牌 →
// 被动回复登录链接 → 用户在微信内打开链接 → 前端 /mp-login 页面
// 用令牌调用 /api/wechat/mp/login 换取正式登录态。
// 未认证公众号无法使用网页授权（snsapi_*），一次性链接是替代方案。
// =============================================================
// DefaultLoginTokenTTL 登录令牌默认有效期
const DefaultLoginTokenTTL = 5 * time.Minute
var (
ErrLoginTokenInvalid = errors.New("登录链接无效或已过期，请在公众号重新发送「登录」")
ErrLoginTokenUsed = errors.New("登录链接已被使用，请在公众号重新发送「登录」")
ErrLoginTokenExpired = errors.New("登录链接已过期，请在公众号重新发送「登录」")
)
func randomTokenHex(nBytes int) string {
b := make([]byte, nBytes)
if _, err := rand.Read(b); err != nil {
return ""
}
return hex.EncodeToString(b)
}
// LoginLinkURL 由一次性令牌拼出前端登录页链接。
// 页面基址读取 app.conf 的 wechat_mp_login_base（前端应用对外可访问地址，
// 如 https://back.yunzer.cn），缺省回落 wechat_mp_callback_base / payment_callback_base。
// 未配置时返回空串，由调用方给出提示。
func LoginLinkURL(token string) string {
base, _ := beego.AppConfig.String("wechat_mp_login_base")
if strings.TrimSpace(base) == "" {
base, _ = beego.AppConfig.String("wechat_mp_callback_base")
}
if strings.TrimSpace(base) == "" {
base, _ = beego.AppConfig.String("payment_callback_base")
}
base = strings.TrimRight(strings.TrimSpace(base), "/")
if base == "" {
return ""
}
return base + "/#/mp-login?token=" + url.QueryEscape(token)
}
// CreateLoginToken 为已绑定的粉丝生成一次性登录令牌。
func CreateLoginToken(f *models.WechatMpFollower, ttl time.Duration) (token string, expireAt time.Time, err error) {
if f == nil || strings.TrimSpace(f.BindType) == "" || f.BindID == 0 {
return "", time.Time{}, errors.New("该微信尚未绑定账号")
}
if ttl <= 0 {
ttl = DefaultLoginTokenTTL
}
token = randomTokenHex(32)
if token == "" {
return "", time.Time{}, errors.New("生成登录令牌失败")
}
now := time.Now()
expireAt = now.Add(ttl)
row := &models.WechatMpLoginToken{
Token: token,
OpenID: f.OpenID,
BindType: f.BindType,
BindID: f.BindID,
BindTid: f.BindTid,
ExpireAt: expireAt,
CreateTime: now,
}
if _, err := models.Orm.Insert(row); err != nil {
return "", time.Time{}, err
}
return token, expireAt, nil
}
// ConsumeLoginToken 核销一次性登录令牌（CAS 防重放），返回令牌携带的绑定信息。
func ConsumeLoginToken(token string) (*models.WechatMpLoginToken, error) {
token = strings.TrimSpace(token)
if token == "" {
return nil, ErrLoginTokenInvalid
}
var row models.WechatMpLoginToken
if err := models.Orm.QueryTable(new(models.WechatMpLoginToken)).
Filter("token", token).One(&row); err != nil {
return nil, ErrLoginTokenInvalid
}
if row.UsedAt != nil {
return nil, ErrLoginTokenUsed
}
if row.ExpireAt.Before(time.Now()) {
return nil, ErrLoginTokenExpired
}
now := time.Now()
affected, err := models.Orm.QueryTable(new(models.WechatMpLoginToken)).
Filter("id", row.ID).
Filter("used_at__isnull", true).
Update(map[string]interface{}{"used_at": now})
if err != nil {
return nil, err
}
if affected == 0 {
return nil, ErrLoginTokenUsed
}
return &row, nil
}
// isLoginKeyword 判断文本是否为「登录」意图
func isLoginKeyword(text string) bool {
switch strings.TrimSpace(text) {
case "登录", "登陸", "login", "Login", "微信登录", "微信登陆":
return true
}
return false
}
// isLoginMenuKey 判断自定义菜单点击（CLICK 事件）的 EventKey 是否为「登录」入口。
// 菜单在公众号后台手动配置即可（未认证公众号同样支持），
// 用户点菜单 → CLICK 事件 → 自动回复确认登录链接，免输入。
func isLoginMenuKey(key string) bool {
k := strings.TrimSpace(key)
if k == "" {
return false
}
switch strings.ToLower(k) {
case "login", "登录", "扫码登录", "微信登录":
return true
}
return false
}
go/services/wechatmp/menu.go
+103
View File
@@ -0,0 +1,103 @@
package wechatmp
import (
"errors"
"net/url"
"strings"
"github.com/beego/beego/v2/core/logs"
)
// =============================================================
// 公众号自定义菜单：发布「扫码登录」菜单（点击事件 → CLICK 事件 → 自动回复
// 确认登录链接，用户不用输入任何内容）。
// 注意：菜单接口（menu/create）与带参二维码同属认证后能力，
// 未认证公众号会返回 48001，届时需改用「公众号内发送登录」路径。
// =============================================================
// LoginMenuKey 登录菜单的事件键值（与 isLoginMenuKey 保持一致）
const LoginMenuKey = "LOGIN"
type mpMenuButton struct {
Type string `json:"type,omitempty"`
Name string `json:"name"`
Key string `json:"key,omitempty"`
URL string `json:"url,omitempty"`
SubButton []mpMenuButton `json:"sub_button,omitempty"`
}
type mpMenuGetResp struct {
Menu struct {
Button []mpMenuButton `json:"button"`
} `json:"menu"`
// 个性化菜单：命中条件时会覆盖默认菜单（公众号底部看到的可能来自这里）
ConditionalMenu []map[string]interface{} `json:"conditionalmenu"`
ErrCode int `json:"errcode"`
ErrMsg string `json:"errmsg"`
}
// PublishMenuResult 发布结果（供页面展示与排查）
type PublishMenuResult struct {
Buttons []mpMenuButton `json:"button"`
AlreadyExists bool `json:"already_exists"`
ConditionalMenuCount int `json:"conditional_menu_count"`
}
type mpMenuCreateResp struct {
ErrCode int `json:"errcode"`
ErrMsg string `json:"errmsg"`
}
// PublishLoginMenu 在现有菜单基础上追加「扫码登录」菜单并发布。
// - 已存在登录菜单：不再重复发布（AlreadyExists=true）；
// - 一级菜单满 3 个：返回错误提示；
// - 存在个性化菜单：一并返回条数（个性化菜单会覆盖默认菜单，需到公众号后台处理）。
//
// 注意：微信客户端有菜单缓存，发布后通常需重新关注或等待（最长 24 小时）才可见。
func PublishLoginMenu(cfg *Config) (*PublishMenuResult, error) {
token, err := GetAccessToken(cfg)
if err != nil {
return nil, err
}
// 1) 读取现有菜单；46003（菜单不存在）视为空菜单
var cur mpMenuGetResp
if gerr := httpGetJSON(apiBase+"/cgi-bin/menu/get?access_token="+url.QueryEscape(token), &cur); gerr != nil {
return nil, gerr
}
buttons := cur.Menu.Button
if cur.ErrCode != 0 && cur.ErrCode != 46003 {
return nil, &APIError{API: "读取自定义菜单", Code: cur.ErrCode, Msg: cur.ErrMsg}
}
logs.Info("[wechat-mp] 当前默认菜单 %d 项，个性化菜单 %d 条", len(buttons), len(cur.ConditionalMenu))
for i := range buttons {
if strings.EqualFold(strings.TrimSpace(buttons[i].Key), LoginMenuKey) {
return &PublishMenuResult{
Buttons: buttons,
AlreadyExists: true,
ConditionalMenuCount: len(cur.ConditionalMenu),
}, nil
}
}
if len(buttons) >= 3 {
return nil, errors.New("一级菜单已达 3 个上限，请到公众号后台精简后再发布")
}
// 2) 追加登录菜单并发布
buttons = append(buttons, mpMenuButton{Type: "click", Name: "扫码登录", Key: LoginMenuKey})
var created mpMenuCreateResp
if perr := httpPostJSON(apiBase+"/cgi-bin/menu/create?access_token="+url.QueryEscape(token),
map[string]interface{}{"button": buttons}, &created); perr != nil {
return nil, perr
}
if created.ErrCode != 0 {
return nil, &APIError{API: "发布自定义菜单", Code: created.ErrCode, Msg: created.ErrMsg}
}
logs.Info("[wechat-mp] 菜单发布成功，当前 %d 项", len(buttons))
return &PublishMenuResult{
Buttons: buttons,
ConditionalMenuCount: len(cur.ConditionalMenu),
}, nil
}
go/services/wechatmp/scanlogin.go
+232
View File
@@ -0,0 +1,232 @@
package wechatmp
import (
"errors"
"fmt"
"net/url"
"strings"
"time"
"server/models"
)
// =============================================================
// 公众号扫码登录（带参二维码方案）：
// PC 端 /auth/login 扫码面板发起会话并轮询 → 展示带参二维码（scene=会话标识）→
// 用户微信扫码：已关注触发 SCAN 事件 / 未关注关注后触发 subscribe 事件，
// 服务号【自动】回复「确认登录」一次性链接（无需用户输入任何内容）→
// 用户点击链接（/mp-login 兑换，链接携带 scene）→ 精确认领 PC 会话 →
// PC 端轮询到确认后建立 UAC 会话自动登录。全程无极验 / 无登录码。
// 注：带参二维码需认证公众号；未认证（48001）时回退普通关注二维码，
// 用户在公众号发送「登录」换取确认链接。
// =============================================================
// ScanLoginTTL 扫码登录会话有效期
const ScanLoginTTL = 5 * time.Minute
var ErrScanLoginInvalid = errors.New("扫码登录会话不存在或已过期，请刷新二维码重试")
// StartScanLogin 发起 PC 扫码登录会话，并生成带参二维码。
// 带参二维码生成失败（未认证公众号 48001 等）时回退普通关注二维码：
// qrURL 为空、notice 返回回退原因，前端需明确提示用户走「发送登录」路径。
func StartScanLogin() (scene, qrURL, notice string, expireAt time.Time, err error) {
scene = randomScene()
now := time.Now()
expireAt = now.Add(ScanLoginTTL)
row := &models.WechatMpScanLogin{
Scene: scene,
Code: "-",
ExpireAt: expireAt,
CreateTime: now,
}
if _, err = models.Orm.Insert(row); err != nil {
return "", "", "", time.Time{}, err
}
cfg, cerr := LoadEnabledConfig()
if cerr == nil {
qr, qerr := CreateQRCode(cfg, scene, int(ScanLoginTTL.Seconds())+120)
if qerr == nil {
return scene, qr, "", expireAt, nil
}
var apiErr *APIError
if errors.As(qerr, &apiErr) {
notice = "公众号未返回带参二维码（" + apiErr.Error() + "）"
if hint := apiErr.Explain(); hint != "" {
notice += "：" + hint
}
} else {
notice = "生成带参二维码失败：" + qerr.Error()
}
} else {
notice = "公众号未配置或未启用，无法生成带参二维码"
}
notice += "。已回退普通二维码：已关注的用户扫码不会触发消息，请在公众号内发送「登录」获取确认链接。"
return scene, "", notice, expireAt, nil
}
// GetScanLogin 查询扫码登录会话（过期时惰性标记）
func GetScanLogin(scene string) (*models.WechatMpScanLogin, error) {
scene = strings.TrimSpace(scene)
if scene == "" {
return nil, ErrScanLoginInvalid
}
var row models.WechatMpScanLogin
if err := models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("scene", scene).One(&row); err != nil {
return nil, ErrScanLoginInvalid
}
if row.Status == models.WechatScanLoginPending && row.ExpireAt.Before(time.Now()) {
now := time.Now()
_, _ = models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("id", row.ID).
Update(map[string]interface{}{"status": models.WechatScanLoginExpired, "update_time": now})
row.Status = models.WechatScanLoginExpired
}
return &row, nil
}
// HandleScanLoginEvent 带参二维码扫码事件（SCAN / subscribe 带 qrscene）：
// scene 属于等待中的扫码登录会话时，自动回复「确认登录」链接（已绑定）
// 或绑定提示（未绑定），并返回 true；不属于登录会话返回 false 交由绑定流程处理。
func HandleScanLoginEvent(scene, openid string) (string, bool) {
scene = strings.TrimSpace(scene)
if scene == "" {
return "", false
}
row, err := GetScanLogin(scene)
if err != nil || row.Status != models.WechatScanLoginPending {
return "", false
}
f, ferr := GetFollowerByOpenID(openid)
if ferr != nil || f == nil || strings.TrimSpace(f.BindType) == "" || f.BindID == 0 {
return "当前微信尚未绑定账号，无法扫码登录：请先在系统页面完成「绑定微信」。", true
}
if f.BindType != models.WechatBindTypeTenantUser {
return "该微信绑定的是平台账号，暂不支持扫码登录。", true
}
token, _, terr := CreateLoginToken(f, ScanLoginTTL)
if terr != nil {
return "系统繁忙，请稍后重新扫码。", true
}
now := time.Now()
if _, uerr := models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("id", row.ID).
Update(map[string]interface{}{
"openid": openid,
"login_token": token,
"update_time": now,
}); uerr != nil {
return "系统繁忙，请稍后重新扫码。", true
}
link := LoginLinkURL(token) + "&scene=" + url.QueryEscape(scene)
minutes := 1
if m := int(time.Until(now.Add(ScanLoginTTL)).Minutes()); m > 1 {
minutes = m
}
return fmt.Sprintf("【扫码登录确认】\n点击以下链接确认登录（%d 分钟内有效，仅可使用一次）：\n%s\n\n确认后您的电脑将自动登录。如非本人操作，请忽略本条消息。", minutes, link), true
}
// DirectLoginReply 判断该微信的绑定状态并返回对应回复：
// - 已绑定：直接给出「确认登录」一次性链接（点击后 web 直接登录）；
// - 未绑定：提示先去系统页面完成绑定。
//
// 用于普通关注（无 scene）与公众号内发送「登录」的兜底路径。
func DirectLoginReply(openid string) string {
f, err := GetFollowerByOpenID(openid)
if err != nil || f == nil || strings.TrimSpace(f.BindType) == "" || f.BindID == 0 {
return "当前微信尚未绑定账号：请先在系统页面「绑定微信」处完成绑定（关注后发送「验证码」，再到页面填码）。"
}
if f.BindType != models.WechatBindTypeTenantUser {
return "该微信绑定的是平台账号，暂不支持扫码登录。"
}
token, expireAt, terr := CreateLoginToken(f, ScanLoginTTL)
if terr != nil {
return "系统繁忙，请稍后重新发送「登录」。"
}
link := LoginLinkURL(token)
if link == "" {
return "管理员尚未配置登录页地址（app.conf 的 wechat_mp_login_base），请联系管理员。"
}
minutes := 1
if m := int(time.Until(expireAt).Minutes()); m > 1 {
minutes = m
}
return fmt.Sprintf("【确认登录】\n点击以下链接直接登录（%d 分钟内有效，仅可使用一次）：\n%s\n\n如非本人操作，请忽略本条消息。", minutes, link)
}
// ConfirmScanLoginByToken 兑换确认链接时精确认领 PC 扫码会话（scene + 令牌双重匹配，CAS）
func ConfirmScanLoginByToken(scene, loginToken, bindType string, bindID, bindTid uint64) {
scene = strings.TrimSpace(scene)
if scene == "" || strings.TrimSpace(loginToken) == "" {
return
}
now := time.Now()
_, _ = models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("scene", scene).
Filter("login_token", strings.TrimSpace(loginToken)).
Filter("status", models.WechatScanLoginPending).
Update(map[string]interface{}{
"status": models.WechatScanLoginOK,
"bind_type": bindType,
"bind_id": bindID,
"bind_tid": bindTid,
"update_time": now,
})
}
// ConfirmOldestPendingScanLogin 无 scene 的兜底认领（「登录」文本路径）：
// 认领最早一条待确认 PC 会话；没有等待中的会话时静默跳过。
func ConfirmOldestPendingScanLogin(bindType string, bindID, bindTid uint64) {
now := time.Now()
var row models.WechatMpScanLogin
err := models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("status", models.WechatScanLoginPending).
Filter("expire_at__gt", now).
OrderBy("id").
One(&row)
if err != nil {
return
}
models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("id", row.ID).
Filter("status", models.WechatScanLoginPending).
Update(map[string]interface{}{
"status": models.WechatScanLoginOK,
"bind_type": bindType,
"bind_id": bindID,
"bind_tid": bindTid,
"update_time": now,
})
}
// PickScanLogin PC 端领取确认结果：CAS 把「已确认」置为「已领取」，防止重复领取
func PickScanLogin(scene string) (*models.WechatMpScanLogin, error) {
row, err := GetScanLogin(scene)
if err != nil {
return nil, err
}
if row.Status == models.WechatScanLoginPending {
return nil, errors.New("等待微信确认：请在公众号内点击「确认登录」链接")
}
if row.Status == models.WechatScanLoginExpired {
return nil, ErrScanLoginInvalid
}
if row.Status != models.WechatScanLoginOK || row.BindID == 0 {
return nil, errors.New("该二维码已完成登录，请刷新后重新扫码")
}
now := time.Now()
affected, err := models.Orm.QueryTable(new(models.WechatMpScanLogin)).
Filter("id", row.ID).
Filter("status", models.WechatScanLoginOK).
Update(map[string]interface{}{"status": models.WechatScanLoginPicked, "update_time": now})
if err != nil {
return nil, err
}
if affected == 0 {
return nil, errors.New("该二维码已完成登录，请刷新后重新扫码")
}
return row, nil
}
go/views/auth/login.tpl
+132 -2
View File
@@ -324,6 +324,26 @@
.back { text-align: center; margin-top: 22px; font-size: 13px; }
/* 微信扫码登录 */
.scan-flex { display: flex; justify-content: center; }
.scan-qr {
width: 180px; height: 180px; flex: 0 0 180px;
border: 1px solid var(--border); border-radius: 10px;
display: flex; align-items: center; justify-content: center;
overflow: hidden; background: #fff;
}
.scan-qr .qr-img { width: 100%; height: 100%; object-fit: contain; }
.scan-qr .qr-mask {
display: flex; flex-direction: column; align-items: center; gap: 8px;
font-size: 12px; color: var(--muted); text-align: center; padding: 8px;
white-space: pre-line;
}
.scan-btn {
border: none; background: var(--primary); color: #fff;
border-radius: 8px; padding: 6px 16px; font-size: 12px; cursor: pointer;
}
.scan-right { display: none; }
.foot-tip {
margin-top: 26px;
padding-top: 18px;
@@ -485,6 +505,30 @@
<div class="divider"><span>其他登录方式</span></div>
<div class="third-list" id="thirdList"></div>
</div>
<!-- 微信扫码登录（未认证公众号：服务号二维码 + 登录码，公众号内确认后自动登录） -->
<div class="divider"><span>其他登录方式</span></div>
<div class="third-list" style="justify-content:flex-start">
<button class="third-btn" type="button" id="wechatScanEntry" onclick="showWechatScan()">
<svg viewBox="0 0 24 24" width="15" height="15" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
<path d="M4 4h16v12H8l-4 4z"/><path d="M8.5 9.5h.01M12 9.5h.01M15.5 9.5h.01"/>
</svg>
微信登录
</button>
</div>
<div id="wechatScanArea" style="display:none; margin-top:18px;">
<div class="scan-flex">
<div class="scan-qr">
<img id="scanQrImg" class="qr-img" alt="微信扫码登录" style="display:none" />
<div class="qr-mask" id="scanQrMask">
<span id="scanQrMaskText">正在获取二维码…</span>
<button class="scan-btn" onclick="restartWechatScan()" style="display:none" id="scanQrRefreshBtn">刷新</button>
</div>
</div>
</div>
<div class="back"><a class="link" onclick="hideWechatScan()">返回账号密码登录</a></div>
</div>
{{end}}
<div class="foot-tip">
@@ -617,9 +661,11 @@
.then(function (r) { return r.json(); })
.then(function (res) {
var list = (res && res.data) || [];
var enabled = list.filter(function (i) { return i.enabled; });
if (!enabled.length) return;
// 微信走「公众号扫码登录」独立入口，第三方列表里不再重复展示
var enabled = list.filter(function (i) { return i.enabled && i.provider !== 'wechat'; });
var box = document.getElementById('thirdList');
box.innerHTML = ''; // 防止重复渲染
if (!enabled.length) return;
enabled.forEach(function (item) {
var btn = document.createElement('button');
btn.className = 'third-btn';
@@ -793,6 +839,90 @@
window.location.href = '/auth/login?client_id=' + encodeURIComponent(CLIENT_ID) + '&redirect=' + encodeURIComponent(REDIRECT);
});
}
// ==================== 微信扫码登录（未认证公众号：服务号二维码 + 登录码） ====================
var scanScene = '';
var scanExpireAt = 0;
var scanPollTimer = null;
function showWechatScan() {
hideError();
document.getElementById('loginForm').style.display = 'none';
document.getElementById('thirdArea').style.display = 'none';
document.getElementById('wechatScanEntry').parentElement.style.display = 'none';
document.getElementById('wechatScanArea').style.display = 'block';
restartWechatScan();
}
function hideWechatScan() {
stopWechatScan();
document.getElementById('wechatScanArea').style.display = 'none';
document.getElementById('loginForm').style.display = 'block';
document.getElementById('wechatScanEntry').parentElement.style.display = 'flex';
loadThirdProviders();
}
function stopWechatScan() {
if (scanPollTimer) { clearInterval(scanPollTimer); scanPollTimer = null; }
}
function setScanQrMask(text, showRefresh) {
var img = document.getElementById('scanQrImg');
var mask = document.getElementById('scanQrMask');
img.style.display = 'none';
mask.style.display = 'flex';
document.getElementById('scanQrMaskText').textContent = text || '';
document.getElementById('scanQrRefreshBtn').style.display = showRefresh ? 'block' : 'none';
}
function restartWechatScan() {
stopWechatScan();
setScanQrMask('获取中…', false);
fetch('/auth/wechat/scan/start', { method: 'POST' })
.then(function (r) { return r.json(); })
.then(function (res) {
if (res.code !== 200) {
setScanQrMask('获取失败', true);
return;
}
var d = res.data || {};
scanScene = d.scene || '';
var qr = d.qrcode_url || d.follow_qrcode || '';
if (qr) {
var img = document.getElementById('scanQrImg');
img.src = qr;
img.style.display = 'block';
document.getElementById('scanQrMask').style.display = 'none';
} else {
setScanQrMask('暂无二维码', true);
}
// 回退原因只写控制台，不在页面展示
if (d.notice && window.console) console.warn('[wechat-scan]', d.notice);
scanPollTimer = setInterval(pollWechatScan, 3000);
})
.catch(function () {
setScanQrMask('网络异常', true);
});
}
function pollWechatScan() {
if (!scanScene) return;
fetch('/auth/wechat/scan/status?scene=' + encodeURIComponent(scanScene) +
'&client_id=' + encodeURIComponent(CLIENT_ID) +
'&redirect=' + encodeURIComponent(REDIRECT))
.then(function (r) { return r.json(); })
.then(function (res) {
var d = (res && res.data) || {};
if (Number(d.status) === 1) {
stopWechatScan();
window.location.href = d.redirect || ('/auth/login?client_id=' + encodeURIComponent(CLIENT_ID));
} else if (Number(d.status) === 2) {
stopWechatScan();
setScanQrMask('已过期', true);
}
})
.catch(function () { /* 下个周期重试 */ });
}
</script>
</body>
</html>