374 lines
12 KiB
Go
374 lines
12 KiB
Go
package auth
|
||
|
||
import (
|
||
"encoding/json"
|
||
"io"
|
||
"strings"
|
||
|
||
"server/models"
|
||
authsvc "server/services/auth"
|
||
"server/services/wechatmini"
|
||
|
||
"github.com/beego/beego/v2/client/orm"
|
||
"github.com/beego/beego/v2/core/logs"
|
||
beego "github.com/beego/beego/v2/server/web"
|
||
)
|
||
|
||
// 小程序登录失败原因（前端按此分支给出不同引导）
|
||
const (
|
||
MiniReasonNotConfigured = "not_configured" // 服务端未配置小程序
|
||
MiniReasonIdentityNotFound = "identity_not_found" // 微信未匹配到云泽账号
|
||
MiniReasonNoTenant = "no_tenant" // 账号未加入任何企业
|
||
MiniReasonWechatAPI = "wechat_api_error" // 微信接口报错
|
||
)
|
||
|
||
// idPWechatMini 第三方身份源标识（写入 yz_auth_identity_third.provider）
|
||
const idPWechatMini = "wechat_mini"
|
||
|
||
// AuthWechatMiniController 微信小程序一键登录（统一认证中心）
|
||
//
|
||
// 与公众号确认链接登录（/api/wechat/mp/login）不同，小程序端由前端直接
|
||
// 携带 wx.login 的 code 与 getPhoneNumber 的动态 code 兑换登录态：
|
||
//
|
||
// POST /auth/wechat/miniapp/login
|
||
// { "code": "wx.login的code", "phone_code": "getPhoneNumber的动态code", "client_id": "yz-miniapp" }
|
||
//
|
||
// 返回结构与 POST /auth/login 完全一致（tokens / need_choose_tenant / tenants 均在顶层），
|
||
// 前端可复用同一套「写入令牌 → 选企业 → switch-tenant」流程。
|
||
type AuthWechatMiniController struct {
|
||
beego.Controller
|
||
}
|
||
|
||
func (c *AuthWechatMiniController) serveJSON(data map[string]interface{}) {
|
||
c.Data["json"] = data
|
||
_ = c.ServeJSON()
|
||
}
|
||
|
||
func (c *AuthWechatMiniController) fail(reason string, bizCode int, msg string) {
|
||
c.Ctx.Output.SetStatus(400)
|
||
c.serveJSON(map[string]interface{}{"code": bizCode, "msg": msg, "reason": reason})
|
||
}
|
||
|
||
// loadMiniConfig 按客户端传入的 appid 选择小程序配置（多应用支持），
|
||
// 未传 appid 时回退第一条启用配置
|
||
func loadMiniConfig(appID string) (*wechatmini.Config, error) {
|
||
if appID = strings.TrimSpace(appID); appID != "" {
|
||
return wechatmini.LoadEnabledAppByAppID(appID)
|
||
}
|
||
return wechatmini.LoadEnabledConfig()
|
||
}
|
||
|
||
// Config 小程序登录是否可用
|
||
// GET /auth/wechat/miniapp/config?appid=xxx（多应用时可指定，缺省取第一条启用配置）
|
||
func (c *AuthWechatMiniController) Config() {
|
||
cfg, err := loadMiniConfig(c.GetString("appid"))
|
||
if err != nil {
|
||
c.serveJSON(map[string]interface{}{
|
||
"code": 200,
|
||
"data": map[string]interface{}{"enabled": false, "auto_bind": false},
|
||
})
|
||
return
|
||
}
|
||
c.serveJSON(map[string]interface{}{
|
||
"code": 200,
|
||
"data": map[string]interface{}{"enabled": true, "auto_bind": cfg.AutoBind},
|
||
})
|
||
}
|
||
|
||
// Login 小程序一键登录
|
||
func (c *AuthWechatMiniController) Login() {
|
||
var req struct {
|
||
Code string `json:"code"`
|
||
PhoneCode string `json:"phone_code"`
|
||
ClientID string `json:"client_id"`
|
||
AppID string `json:"appid"`
|
||
}
|
||
body := c.Ctx.Input.RequestBody
|
||
if len(body) == 0 {
|
||
body, _ = io.ReadAll(c.Ctx.Request.Body)
|
||
}
|
||
if err := json.Unmarshal(body, &req); err != nil {
|
||
c.fail("", 400, "参数错误")
|
||
return
|
||
}
|
||
req.Code = strings.TrimSpace(req.Code)
|
||
req.PhoneCode = strings.TrimSpace(req.PhoneCode)
|
||
req.ClientID = strings.TrimSpace(req.ClientID)
|
||
if req.ClientID == "" {
|
||
req.ClientID = "yz-miniapp"
|
||
}
|
||
if req.Code == "" {
|
||
c.fail("", 400, "缺少登录凭证，请重新进入小程序")
|
||
return
|
||
}
|
||
|
||
cfg, err := loadMiniConfig(req.AppID)
|
||
if err != nil {
|
||
c.fail(MiniReasonNotConfigured, 400, "小程序登录未开通，请使用账号密码登录")
|
||
return
|
||
}
|
||
|
||
// code → openid / unionid
|
||
session, err := wechatmini.Code2Session(cfg, req.Code)
|
||
if err != nil {
|
||
msg := err.Error()
|
||
if hint, ok := wechatmini.ExplainError(err); ok {
|
||
msg = hint
|
||
}
|
||
logs.Warn("[wechat-mini] code 换取 openid 失败: %v", err)
|
||
c.fail(MiniReasonWechatAPI, 400, msg)
|
||
return
|
||
}
|
||
|
||
// 定位云泽身份：手机号优先（已通过微信验证），其次查已绑定的小程序 openid
|
||
var mobile string
|
||
if req.PhoneCode != "" {
|
||
phone, perr := wechatmini.GetPhoneNumber(cfg, req.PhoneCode)
|
||
if perr != nil {
|
||
// 手机号能力未开通 / code 失效时不阻断：仍尝试按已绑定 openid 登录
|
||
logs.Warn("[wechat-mini] 获取手机号失败: %v", perr)
|
||
} else {
|
||
mobile = strings.TrimSpace(phone.PurePhoneNumber)
|
||
if mobile == "" {
|
||
mobile = strings.TrimSpace(phone.PhoneNumber)
|
||
}
|
||
}
|
||
}
|
||
|
||
identity, err := c.resolveIdentity(cfg, mobile, session)
|
||
if err != nil {
|
||
c.fail(MiniReasonIdentityNotFound, 404, "该微信未绑定云泽账号，请使用手机号一键登录或先注册")
|
||
return
|
||
}
|
||
if identity.Status != models.AuthIdentityStatusEnabled {
|
||
c.fail("", 403, "账号已被禁用或锁定，无法登录")
|
||
return
|
||
}
|
||
|
||
// 企业选择：单企业直接进入，多企业签发待选令牌由前端展示选择界面
|
||
tenants, lerr := authsvc.ListTenantOptions(identity.ID)
|
||
if lerr != nil || len(tenants) == 0 {
|
||
c.fail(MiniReasonNoTenant, 403, "该账号未加入任何企业，请联系管理员")
|
||
return
|
||
}
|
||
tid := uint64(0)
|
||
needChoose := false
|
||
if len(tenants) == 1 {
|
||
tid = tenants[0].Tid
|
||
} else {
|
||
tid = authsvc.PendingTenantID
|
||
needChoose = true
|
||
}
|
||
|
||
username := "微信用户"
|
||
if identity.Nickname != nil && strings.TrimSpace(*identity.Nickname) != "" {
|
||
username = strings.TrimSpace(*identity.Nickname)
|
||
} else if identity.Mobile != nil && *identity.Mobile != "" {
|
||
username = *identity.Mobile
|
||
}
|
||
|
||
tokens, terr := c.issueTokens(identity.ID, tid, req.ClientID, username, needChoose)
|
||
if terr != nil {
|
||
c.fail("", 400, terr.Error())
|
||
return
|
||
}
|
||
|
||
resp := map[string]interface{}{
|
||
"code": 200,
|
||
"msg": "登录成功",
|
||
"tokens": tokens,
|
||
"tenants": tenants,
|
||
"identity": map[string]interface{}{"id": identity.ID, "nickname": username, "mobile": mobileOr(identity)},
|
||
}
|
||
if needChoose {
|
||
resp["need_choose_tenant"] = true
|
||
resp["sid"] = tokens.Sid
|
||
}
|
||
c.serveJSON(resp)
|
||
}
|
||
|
||
// Bind 把当前小程序 openid 绑定到已登录身份
|
||
// POST /auth/wechat/miniapp/bind { "code": "wx.login的code" } Header: Bearer 令牌
|
||
//
|
||
// 用途：小程序认证中 / 未开通「手机号快速验证」时，getPhoneNumber 拿不到手机号，
|
||
// 一键登录退化为「按 openid 匹配已绑定身份」。用户先用账号密码登录一次，
|
||
// 前端调用本接口静默绑定 openid，之后即可无手机号完成微信一键登录。
|
||
// 显式绑定视为本人操作（同时持有微信与该账号登录态），允许换绑覆盖旧绑定。
|
||
func (c *AuthWechatMiniController) Bind() {
|
||
claims := claimsFromCtxThird(c.Ctx)
|
||
if claims == nil || claims.UserID <= 0 {
|
||
c.Ctx.Output.SetStatus(401)
|
||
c.serveJSON(map[string]interface{}{"code": 401, "msg": "未登录"})
|
||
return
|
||
}
|
||
|
||
var req struct {
|
||
Code string `json:"code"`
|
||
AppID string `json:"appid"`
|
||
}
|
||
body := c.Ctx.Input.RequestBody
|
||
if len(body) == 0 {
|
||
body, _ = io.ReadAll(c.Ctx.Request.Body)
|
||
}
|
||
if err := json.Unmarshal(body, &req); err != nil {
|
||
c.fail("", 400, "参数错误")
|
||
return
|
||
}
|
||
req.Code = strings.TrimSpace(req.Code)
|
||
if req.Code == "" {
|
||
c.fail("", 400, "缺少登录凭证，请重新进入小程序")
|
||
return
|
||
}
|
||
|
||
cfg, err := loadMiniConfig(req.AppID)
|
||
if err != nil {
|
||
c.fail(MiniReasonNotConfigured, 400, "小程序登录未开通")
|
||
return
|
||
}
|
||
|
||
session, err := wechatmini.Code2Session(cfg, req.Code)
|
||
if err != nil {
|
||
msg := err.Error()
|
||
if hint, ok := wechatmini.ExplainError(err); ok {
|
||
msg = hint
|
||
}
|
||
logs.Warn("[wechat-mini] 绑定 code 换取 openid 失败: %v", err)
|
||
c.fail(MiniReasonWechatAPI, 400, msg)
|
||
return
|
||
}
|
||
|
||
c.syncBinding(cfg, uint64(claims.UserID), session, true)
|
||
c.serveJSON(map[string]interface{}{"code": 200, "msg": "绑定成功"})
|
||
}
|
||
|
||
// resolveIdentity 定位身份并维护小程序绑定关系。
|
||
// mobile 非空表示本次已通过微信手机号验证，是可信的强证据，优先采用。
|
||
func (c *AuthWechatMiniController) resolveIdentity(cfg *wechatmini.Config, mobile string, session *wechatmini.Session) (*models.AuthIdentity, error) {
|
||
// 1) 手机号命中身份（手机号已由微信验证，属于当前用户的强凭证）
|
||
if mobile != "" {
|
||
if identity, err := authsvc.FindIdentityByAccount(mobile); err == nil {
|
||
c.syncBinding(cfg, identity.ID, session, true)
|
||
return identity, nil
|
||
}
|
||
}
|
||
|
||
// 2) 已绑定过该小程序 openid / unionid
|
||
bind := findMiniBinding(session.OpenID, session.UnionID)
|
||
if bind == nil {
|
||
return nil, orm.ErrNoRows
|
||
}
|
||
var identity models.AuthIdentity
|
||
if err := models.Orm.QueryTable(new(models.AuthIdentity)).
|
||
Filter("id", bind.IdentityID).
|
||
Filter("delete_time__isnull", true).
|
||
One(&identity); err != nil {
|
||
return nil, err
|
||
}
|
||
return &identity, nil
|
||
}
|
||
|
||
// syncBinding 把当前小程序 openid 绑定到该身份。
|
||
// verified 表示本次带通过了微信手机号验证：此时手机号即身份凭证，
|
||
// 允许覆盖历史绑定（用户换绑手机号 / 换微信号场景）；
|
||
// 未验证时只允许「新增绑定」，不抢占已绑定到其他身份的 openid。
|
||
func (c *AuthWechatMiniController) syncBinding(cfg *wechatmini.Config, identityID uint64, session *wechatmini.Session, verified bool) {
|
||
bind := findMiniBinding(session.OpenID, session.UnionID)
|
||
if bind != nil && bind.IdentityID == identityID {
|
||
return
|
||
}
|
||
if bind != nil {
|
||
if !verified {
|
||
return
|
||
}
|
||
_, _ = models.Orm.QueryTable(new(models.AuthIdentityThird)).Filter("id", bind.ID).Delete()
|
||
}
|
||
if !verified && !cfg.AutoBind {
|
||
return
|
||
}
|
||
item := &models.AuthIdentityThird{
|
||
IdentityID: identityID,
|
||
Provider: idPWechatMini,
|
||
OpenID: session.OpenID,
|
||
}
|
||
if session.UnionID != "" {
|
||
uid := session.UnionID
|
||
item.UnionID = &uid
|
||
}
|
||
_, _ = models.Orm.Insert(item)
|
||
}
|
||
|
||
// findMiniBinding 按 openid 查绑定，其次按 unionid 查
|
||
func findMiniBinding(openID, unionID string) *models.AuthIdentityThird {
|
||
qs := models.Orm.QueryTable(new(models.AuthIdentityThird)).Filter("provider", idPWechatMini)
|
||
if openID != "" {
|
||
var bind models.AuthIdentityThird
|
||
if err := qs.Filter("open_id", openID).One(&bind); err == nil {
|
||
return &bind
|
||
}
|
||
}
|
||
if unionID != "" {
|
||
var bind models.AuthIdentityThird
|
||
if err := qs.Filter("union_id", unionID).One(&bind); err == nil {
|
||
return &bind
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// issueTokens 建会话并签发 UAC 令牌（含登录日志，失败不影响主流程）
|
||
func (c *AuthWechatMiniController) issueTokens(identityID, tid uint64, clientID, username string, needChoose bool) (*authsvc.TokenPair, error) {
|
||
accessTTL := 0
|
||
if needChoose {
|
||
accessTTL = 600 // 待选状态令牌只够用户完成企业选择
|
||
}
|
||
sess, serr := authsvc.CreateSession(authsvc.SessionInfo{
|
||
IdentityID: identityID,
|
||
Tid: tid,
|
||
ClientID: clientID,
|
||
IP: c.Ctx.Input.IP(),
|
||
UserAgent: c.Ctx.Request.UserAgent(),
|
||
LoginType: "wechat_mini",
|
||
Amr: "wechat_mini",
|
||
})
|
||
if serr != nil {
|
||
return nil, serr
|
||
}
|
||
tokens, terr := authsvc.IssueTokens(authsvc.TokenIssue{
|
||
IdentityID: identityID,
|
||
Tid: tid,
|
||
ClientID: clientID,
|
||
Sid: sess.Sid,
|
||
Username: username,
|
||
UserType: "app",
|
||
Amr: "wechat_mini",
|
||
AccessTTL: accessTTL,
|
||
})
|
||
if terr != nil {
|
||
return nil, terr
|
||
}
|
||
|
||
identityIDCopy := identityID
|
||
tidCopy := tid
|
||
amr := "wechat_mini"
|
||
_, _ = models.Orm.Insert(&models.AuthLoginLog{
|
||
Tid: &tidCopy,
|
||
IdentityID: &identityIDCopy,
|
||
UserName: username,
|
||
ClientID: clientID,
|
||
LoginType: "wechat_mini",
|
||
Amr: &amr,
|
||
Status: 1,
|
||
Message: "微信小程序一键登录成功",
|
||
IP: c.Ctx.Input.IP(),
|
||
UserAgent: c.Ctx.Request.UserAgent(),
|
||
})
|
||
return tokens, nil
|
||
}
|
||
|
||
func mobileOr(identity *models.AuthIdentity) string {
|
||
if identity != nil && identity.Mobile != nil {
|
||
return *identity.Mobile
|
||
}
|
||
return ""
|
||
}
|