优化结构

2026-08-24 20:12:41 +08:00
parent 7643152c1e
commit d3c20c578f
9 changed files with 197 additions and 228 deletions
@@ -8,7 +8,6 @@ import (
 	"time"

 	"kra/internal/config"
-	"kra/internal/security"

 	jwt "github.com/golang-jwt/jwt/v5"
 )
@@ -95,7 +94,7 @@ func (i *tokenIssuer) IssueToken(user *system.User, authorityID uint, mustChange
 	if user.PasswordUpdatedAt != nil {
 		passwordVersion = user.PasswordUpdatedAt.UnixNano()
 	}
-	token, claims, err := security.Generate(settings.SigningKey, settings.Issuer, expires, settings.Buffer, user.ID, authorityID, user.UUID, user.Username, user.NickName, mustChangePassword, passwordVersion)
+	token, claims, err := generateToken(settings.SigningKey, settings.Issuer, expires, settings.Buffer, user.ID, authorityID, user.UUID, user.Username, user.NickName, mustChangePassword, passwordVersion)
 	if err != nil {
 		return nil, err
 	}
@@ -107,16 +106,16 @@ func (i *tokenIssuer) ReissueToken(source *system.AuthClaims, authorityID uint)
 		return nil, errors.New("nil JWT claims")
 	}
 	settings := i.settings.JWTSettings()
-	claims := &security.Claims{
+	claims := &tokenClaims{
 		UUID: source.UUID, ID: source.ID, Username: source.Username, NickName: source.NickName,
 		AuthorityID: authorityID, BufferTime: int64(source.BufferTime / time.Second), UserType: source.UserType,
 		MustChangePwd: source.MustChangePwd, PasswordVersion: source.PasswordVersion,
 		RegisteredClaims: jwt.RegisteredClaims{
-			Audience: jwt.ClaimStrings{security.TokenAudience}, Issuer: settings.Issuer,
+			Audience: jwt.ClaimStrings{tokenAudience}, Issuer: settings.Issuer,
 			IssuedAt: jwt.NewNumericDate(source.IssuedAt), NotBefore: jwt.NewNumericDate(source.NotBefore), ExpiresAt: jwt.NewNumericDate(source.ExpiresAt),
 		},
 	}
-	token, err := security.Sign(settings.SigningKey, claims)
+	token, err := signToken(settings.SigningKey, claims)
 	if err != nil {
 		return nil, err
 	}
@@ -125,20 +124,9 @@ func (i *tokenIssuer) ReissueToken(source *system.AuthClaims, authorityID uint)

 func (i *tokenIssuer) ParseToken(token string) (*system.AuthClaims, error) {
 	settings := i.settings.JWTSettings()
-	claims, err := security.ParseWithIssuer(token, settings.SigningKey, settings.Issuer)
+	claims, err := parseTokenWithIssuer(token, settings.SigningKey, settings.Issuer)
 	if err != nil {
-		switch {
-		case errors.Is(err, security.ErrTokenExpired):
-			return nil, system.ErrTokenExpired
-		case errors.Is(err, security.ErrTokenMalformed):
-			return nil, system.ErrTokenMalformed
-		case errors.Is(err, security.ErrTokenSignatureInvalid):
-			return nil, system.ErrTokenSignatureInvalid
-		case errors.Is(err, security.ErrTokenNotValidYet):
-			return nil, system.ErrTokenNotValidYet
-		default:
-			return nil, system.ErrTokenInvalid
-		}
+		return nil, err
 	}
 	audience := append([]string(nil), claims.Audience...)
 	issuedAt := time.Time{}
@@ -0,0 +1,111 @@
+package system
+
+import (
+	"errors"
+	"kra/internal/biz/system"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+)
+
+// tokenAudience is the KRA administrator audience claim. Claims, audience,
+// issuer and password-version fields are this application's security
+// protocol, so they stay beside the only issuer that signs them.
+const tokenAudience = "KRA"
+
+var (
+	errEmptySigningKey = errors.New("empty JWT signing key")
+	errInvalidClaims   = errors.New("invalid token claims")
+)
+
+type tokenClaims struct {
+	UUID            string
+	ID              uint
+	Username        string
+	NickName        string
+	AuthorityID     uint `json:"AuthorityId"`
+	BufferTime      int64
+	UserType        string
+	MustChangePwd   bool  `json:"mustChangePwd"`
+	PasswordVersion int64 `json:"passwordVersion,omitempty"`
+	jwt.RegisteredClaims
+}
+
+func generateToken(secret, issuer string, expires, buffer time.Duration, userID, authorityID uint, uuid, username, nickname string, mustChange bool, passwordVersion int64) (string, *tokenClaims, error) {
+	if err := validateSigningOptions(secret, expires, buffer); err != nil {
+		return "", nil, err
+	}
+	now := time.Now()
+	claims := &tokenClaims{UUID: uuid, ID: userID, Username: username, NickName: nickname, AuthorityID: authorityID, BufferTime: int64(buffer / time.Second), UserType: "admin", MustChangePwd: mustChange, PasswordVersion: passwordVersion, RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{tokenAudience}, Issuer: issuer, IssuedAt: jwt.NewNumericDate(now), NotBefore: jwt.NewNumericDate(now.Add(-time.Second)), ExpiresAt: jwt.NewNumericDate(now.Add(expires))}}
+	token, err := signToken(secret, claims)
+	return token, claims, err
+}
+
+func signToken(secret string, claims *tokenClaims) (string, error) {
+	if secret == "" {
+		return "", errEmptySigningKey
+	}
+	if claims == nil {
+		return "", errInvalidClaims
+	}
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(secret))
+}
+
+// parseTokenWithIssuer validates a KRA admin token and maps driver errors to
+// the biz token errors callers above already branch on.
+func parseTokenWithIssuer(tokenString, secret, issuer string) (*tokenClaims, error) {
+	if secret == "" {
+		return nil, errEmptySigningKey
+	}
+	options := []jwt.ParserOption{
+		jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
+		jwt.WithAudience(tokenAudience),
+		jwt.WithExpirationRequired(),
+		jwt.WithNotBeforeRequired(),
+		jwt.WithLeeway(time.Second),
+	}
+	if issuer != "" {
+		options = append(options, jwt.WithIssuer(issuer))
+	}
+	token, err := jwt.ParseWithClaims(tokenString, &tokenClaims{}, func(token *jwt.Token) (any, error) {
+		if token.Method != jwt.SigningMethodHS256 {
+			return nil, errors.New("unexpected signing method")
+		}
+		return []byte(secret), nil
+	}, options...)
+	if err != nil {
+		switch {
+		case errors.Is(err, jwt.ErrTokenExpired):
+			return nil, system.ErrTokenExpired
+		case errors.Is(err, jwt.ErrTokenMalformed):
+			return nil, system.ErrTokenMalformed
+		case errors.Is(err, jwt.ErrTokenSignatureInvalid):
+			return nil, system.ErrTokenSignatureInvalid
+		case errors.Is(err, jwt.ErrTokenNotValidYet):
+			return nil, system.ErrTokenNotValidYet
+		default:
+			return nil, system.ErrTokenInvalid
+		}
+	}
+	if !token.Valid {
+		return nil, system.ErrTokenInvalid
+	}
+	claims, ok := token.Claims.(*tokenClaims)
+	if !ok {
+		return nil, system.ErrTokenInvalid
+	}
+	return claims, nil
+}
+
+func validateSigningOptions(secret string, expires, buffer time.Duration) error {
+	if secret == "" {
+		return errEmptySigningKey
+	}
+	if expires <= 0 {
+		return errors.New("JWT expiration must be positive")
+	}
+	if buffer < 0 {
+		return errors.New("JWT buffer must not be negative")
+	}
+	return nil
+}
@@ -0,0 +1,77 @@
+package system
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"kra/internal/biz/system"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+)
+
+func TestGenerateAndParseWithIssuerRoundTrip(t *testing.T) {
+	token, want, err := generateToken("secret", "kra-admin", time.Hour, time.Minute, 7, 8, "uuid", "alice", "Alice", true, 9)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := parseTokenWithIssuer(token, "secret", "kra-admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID != want.ID || got.Username != want.Username || got.Audience[0] != tokenAudience {
+		t.Fatalf("claims = %#v, want %#v", got, want)
+	}
+}
+
+func TestParseRejectsWrongIssuerAndAudience(t *testing.T) {
+	token, _, err := generateToken("secret", "kra-admin", time.Hour, time.Minute, 1, 1, "uuid", "user", "", false, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "other"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("wrong issuer error = %v, want ErrTokenInvalid", err)
+	}
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{"other"}, Issuer: "kra-admin", IssuedAt: jwt.NewNumericDate(time.Now()), NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Second)), ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour))}}
+	token, err = signToken("secret", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("wrong audience error = %v, want ErrTokenInvalid", err)
+	}
+}
+
+func TestParseRejectsMissingRequiredTimeClaims(t *testing.T) {
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{tokenAudience}, Issuer: "kra-admin"}}
+	token, err := signToken("secret", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("missing time claims error = %v, want ErrTokenInvalid", err)
+	}
+}
+
+func TestSigningOptionsRejectInvalidValues(t *testing.T) {
+	if _, _, err := generateToken("", "kra", time.Hour, 0, 1, 1, "", "", "", false, 0); !errors.Is(err, errEmptySigningKey) {
+		t.Fatalf("empty key error = %v", err)
+	}
+	if _, _, err := generateToken("secret", "kra", 0, 0, 1, 1, "", "", "", false, 0); err == nil {
+		t.Fatal("zero expiration was accepted")
+	}
+	if _, err := signToken("secret", nil); !errors.Is(err, errInvalidClaims) {
+		t.Fatalf("nil claims error = %v", err)
+	}
+}
+
+func TestParseRejectsAlgorithmConfusion(t *testing.T) {
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{tokenAudience}, Issuer: "kra-admin", IssuedAt: jwt.NewNumericDate(time.Now()), NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Second)), ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour))}}
+	token, err := jwt.NewWithClaims(jwt.SigningMethodHS512, claims).SignedString([]byte("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenSignatureInvalid) {
+		t.Fatalf("algorithm confusion error = %v, want ErrTokenSignatureInvalid", err)
+	}
+}