优化

internal/server/middleware/auth.go

@@ -5,12 +5,10 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
-	"time"
 
-	"kra/internal/conf"
+	"kra/internal/biz"
 	"kra/internal/server/httpx"
 	"kra/internal/service"
-	"kra/pkg/adminauth"
 
 	"github.com/gin-gonic/gin"
 	"golang.org/x/sync/singleflight"
@@ -20,12 +18,7 @@ const claimsKey = "admin_claims"
 
 var refreshTokens singleflight.Group
 
-type refreshedToken struct {
-	token     string
-	expiresAt int64
-}
-
-func Auth(runtime *conf.Runtime, security *service.SecurityService, tokens *service.TokenService) gin.HandlerFunc {
+func Auth(auth *service.AuthService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := c.GetHeader("x-token")
 		if token == "" {
@@ -35,73 +28,41 @@ func Auth(runtime *conf.Runtime, security *service.SecurityService, tokens *serv
 			httpx.NoAuth(c, "未登录或非法访问，请登录")
 			return
 		}
-		secret := ""
-		config := runtime.Admin()
-		if config != nil && config.Jwt != nil {
-			secret = config.Jwt.SigningKey
-		}
-		claims, err := adminauth.Parse(token, secret)
+		value, err, _ := refreshTokens.Do(token, func() (any, error) {
+			return auth.AuthenticateToken(c.Request.Context(), token)
+		})
 		if err != nil {
 			message := "无法处理此token"
 			switch {
-			case errors.Is(err, adminauth.ErrTokenExpired):
+			case errors.Is(err, biz.ErrTokenExpired):
 				message = "登录已过期，请重新登录"
-			case errors.Is(err, adminauth.ErrTokenMalformed):
+			case errors.Is(err, biz.ErrTokenMalformed):
 				message = "这不是一个token"
-			case errors.Is(err, adminauth.ErrTokenSignatureInvalid):
+			case errors.Is(err, biz.ErrTokenSignatureInvalid):
 				message = "无效签名"
-			case errors.Is(err, adminauth.ErrTokenNotValidYet):
+			case errors.Is(err, biz.ErrTokenNotValidYet):
 				message = "token尚未激活"
+			case errors.Is(err, biz.ErrTokenDisabled):
+				message = "您的帐户异地登陆或令牌失效"
 			}
 			httpx.SetTokenCookie(c, "", -1)
 			httpx.NoAuth(c, message)
 			return
 		}
-		if disabled, checkErr := tokens.IsTokenDisabled(c.Request.Context(), token); checkErr != nil || disabled {
-			httpx.SetTokenCookie(c, "", -1)
-			httpx.NoAuth(c, "您的帐户异地登陆或令牌失效")
-			return
+		authentication := value.(*biz.TokenAuthentication)
+		if authentication.Refreshed != nil {
+			c.Header("new-token", authentication.Refreshed.Value)
+			c.Header("new-expires-at", strconv.FormatInt(authentication.Refreshed.ExpiresAt.Unix(), 10))
+			httpx.SetTokenCookie(c, authentication.Refreshed.Value, int(authentication.Refreshed.TTL.Seconds()))
 		}
-		if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
-			expires, buffer := 7*24*time.Hour, time.Duration(claims.BufferTime)*time.Second
-			issuer := claims.Issuer
-			config = runtime.Admin()
-			if config != nil && config.Jwt != nil {
-				if config.Jwt.ExpiresTime != nil {
-					expires = config.Jwt.ExpiresTime.AsDuration()
-				}
-				if config.Jwt.BufferTime != nil {
-					buffer = config.Jwt.BufferTime.AsDuration()
-				}
-				if config.Jwt.Issuer != "" {
-					issuer = config.Jwt.Issuer
-				}
-			}
-			value, refreshErr, _ := refreshTokens.Do(token, func() (any, error) {
-				newToken, newClaims, generateErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
-				if generateErr != nil {
-					return nil, generateErr
-				}
-				if rotateErr := security.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires); rotateErr != nil {
-					return nil, rotateErr
-				}
-				return refreshedToken{token: newToken, expiresAt: newClaims.ExpiresAt.Unix()}, nil
-			})
-			if refreshErr == nil {
-				refreshed := value.(refreshedToken)
-				c.Header("new-token", refreshed.token)
-				c.Header("new-expires-at", strconv.FormatInt(refreshed.expiresAt, 10))
-				httpx.SetTokenCookie(c, refreshed.token, int(expires.Seconds()))
-			}
-		}
-		c.Set(claimsKey, claims)
+		c.Set(claimsKey, authentication.Claims)
 		c.Next()
 	}
 }
 
-func Claims(c *gin.Context) *adminauth.Claims {
+func Claims(c *gin.Context) *biz.AuthClaims {
 	value, _ := c.Get(claimsKey)
-	claims, _ := value.(*adminauth.Claims)
+	claims, _ := value.(*biz.AuthClaims)
 	return claims
 }