yvan/kra-oa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

优化

Browse Source
This commit is contained in:
yvan
2026-08-15 03:14:56 +08:00
parent a34133cce5
commit 2a3c55bb53
71 changed files with 1445 additions and 1076 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/gin.go
+2 -2
View File
@@ -20,7 +20,7 @@ import (
kratoshttp "github.com/go-kratos/kratos/v3/transport/http"
)
func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, handlers *handler.Set, security *service.SecurityService, tokens *service.TokenService, audit *service.AuditRecorder, logger *slog.Logger) *gin.Engine {
func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, handlers *handler.Set, auth *service.AuthService, security *service.SecurityService, audit *service.AuditRecorder, logger *slog.Logger) *gin.Engine {
gin.SetMode(gin.ReleaseMode)
engine := gin.New()
engine.Use(servermiddleware.RequestMeta(), servermiddleware.Recovery(audit, logger), servermiddleware.AccessLog(runtime, logger), servermiddleware.ErrorAudit(audit), servermiddleware.SecurityRateLimit(security), servermiddleware.OperationAudit(runtime, audit))
@@ -35,7 +35,7 @@ func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, h
serverrouter.RegisterPublic(public, engine, handlers.Public)
private := engine.Group(prefix)
private.Use(servermiddleware.Auth(runtime, security, tokens), servermiddleware.MustChangePassword(), servermiddleware.AccessControl(runtime, access, audit))
private.Use(servermiddleware.Auth(auth), servermiddleware.MustChangePassword(), servermiddleware.AccessControl(runtime, access, audit))
serverrouter.RegisterUser(private, handlers.User)
serverrouter.RegisterNavigation(private, handlers.Navigation)
serverrouter.RegisterSession(private, handlers.Session)
internal/server/handler/dictionary.go
+1 -12
View File
@@ -92,17 +92,6 @@ func (h *Dictionary) Export(c *gin.Context) {
httpx.Fail(c, "导出失败")
return
}
delete(item, "ID")
delete(item, "CreatedAt")
delete(item, "UpdatedAt")
delete(item, "DeletedAt")
if details, ok := item["sysDictionaryDetails"].([]map[string]any); ok {
for _, detail := range details {
for _, key := range []string{"ID", "CreatedAt", "UpdatedAt", "DeletedAt", "sysDictionaryID", "parentID", "disabled", "children"} {
delete(detail, key)
}
}
}
httpx.Write(c, httpx.CodeSuccess, item, "导出成功")
}
func (h *Dictionary) Import(c *gin.Context) {
@@ -258,5 +247,5 @@ func (h *Dictionary) Path(c *gin.Context) {
httpx.Fail(c, "获取失败")
return
}
httpx.Write(c, httpx.CodeSuccess, gin.H{"path": item["path"]}, "获取成功")
httpx.Write(c, httpx.CodeSuccess, gin.H{"path": item.Path}, "获取成功")
}
internal/server/handler/system_config.go
+6 -1
View File
@@ -44,7 +44,12 @@ func (h *SystemConfig) SetSecurity(c *gin.Context) {
}
func (h *SystemConfig) Get(c *gin.Context) {
httpx.Write(c, httpx.CodeSuccess, h.system.SystemConfig(), "获取成功")
value, err := h.system.SystemConfig()
if err != nil {
httpx.Fail(c, "获取失败")
return
}
httpx.Write(c, httpx.CodeSuccess, value, "获取成功")
}
func (h *SystemConfig) Set(c *gin.Context) {
internal/server/middleware/auth.go
+19 -58
View File
@@ -5,12 +5,10 @@ import (
"net/http"
"strconv"
"strings"
"time"
"kra/internal/conf"
"kra/internal/biz"
"kra/internal/server/httpx"
"kra/internal/service"
"kra/pkg/adminauth"
"github.com/gin-gonic/gin"
"golang.org/x/sync/singleflight"
@@ -20,12 +18,7 @@ const claimsKey = "admin_claims"
var refreshTokens singleflight.Group
type refreshedToken struct {
token string
expiresAt int64
}
func Auth(runtime *conf.Runtime, security *service.SecurityService, tokens *service.TokenService) gin.HandlerFunc {
func Auth(auth *service.AuthService) gin.HandlerFunc {
return func(c *gin.Context) {
token := c.GetHeader("x-token")
if token == "" {
@@ -35,73 +28,41 @@ func Auth(runtime *conf.Runtime, security *service.SecurityService, tokens *serv
httpx.NoAuth(c, "未登录或非法访问，请登录")
return
}
secret := ""
config := runtime.Admin()
if config != nil && config.Jwt != nil {
secret = config.Jwt.SigningKey
}
claims, err := adminauth.Parse(token, secret)
value, err, _ := refreshTokens.Do(token, func() (any, error) {
return auth.AuthenticateToken(c.Request.Context(), token)
})
if err != nil {
message := "无法处理此token"
switch {
case errors.Is(err, adminauth.ErrTokenExpired):
case errors.Is(err, biz.ErrTokenExpired):
message = "登录已过期，请重新登录"
case errors.Is(err, adminauth.ErrTokenMalformed):
case errors.Is(err, biz.ErrTokenMalformed):
message = "这不是一个token"
case errors.Is(err, adminauth.ErrTokenSignatureInvalid):
case errors.Is(err, biz.ErrTokenSignatureInvalid):
message = "无效签名"
case errors.Is(err, adminauth.ErrTokenNotValidYet):
case errors.Is(err, biz.ErrTokenNotValidYet):
message = "token尚未激活"
case errors.Is(err, biz.ErrTokenDisabled):
message = "您的帐户异地登陆或令牌失效"
}
httpx.SetTokenCookie(c, "", -1)
httpx.NoAuth(c, message)
return
}
if disabled, checkErr := tokens.IsTokenDisabled(c.Request.Context(), token); checkErr != nil || disabled {
httpx.SetTokenCookie(c, "", -1)
httpx.NoAuth(c, "您的帐户异地登陆或令牌失效")
return
authentication := value.(*biz.TokenAuthentication)
if authentication.Refreshed != nil {
c.Header("new-token", authentication.Refreshed.Value)
c.Header("new-expires-at", strconv.FormatInt(authentication.Refreshed.ExpiresAt.Unix(), 10))
httpx.SetTokenCookie(c, authentication.Refreshed.Value, int(authentication.Refreshed.TTL.Seconds()))
}
if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
expires, buffer := 7*24*time.Hour, time.Duration(claims.BufferTime)*time.Second
issuer := claims.Issuer
config = runtime.Admin()
if config != nil && config.Jwt != nil {
if config.Jwt.ExpiresTime != nil {
expires = config.Jwt.ExpiresTime.AsDuration()
}
if config.Jwt.BufferTime != nil {
buffer = config.Jwt.BufferTime.AsDuration()
}
if config.Jwt.Issuer != "" {
issuer = config.Jwt.Issuer
}
}
value, refreshErr, _ := refreshTokens.Do(token, func() (any, error) {
newToken, newClaims, generateErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
if generateErr != nil {
return nil, generateErr
}
if rotateErr := security.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires); rotateErr != nil {
return nil, rotateErr
}
return refreshedToken{token: newToken, expiresAt: newClaims.ExpiresAt.Unix()}, nil
})
if refreshErr == nil {
refreshed := value.(refreshedToken)
c.Header("new-token", refreshed.token)
c.Header("new-expires-at", strconv.FormatInt(refreshed.expiresAt, 10))
httpx.SetTokenCookie(c, refreshed.token, int(expires.Seconds()))
}
}
c.Set(claimsKey, claims)
c.Set(claimsKey, authentication.Claims)
c.Next()
}
}
func Claims(c *gin.Context) *adminauth.Claims {
func Claims(c *gin.Context) *biz.AuthClaims {
value, _ := c.Get(claimsKey)
claims, _ := value.(*adminauth.Claims)
claims, _ := value.(*biz.AuthClaims)
return claims
}
internal/server/server.go
+1 -2
View File
@@ -2,10 +2,9 @@ package server
import (
"kra/internal/server/handler"
"kra/internal/worker"
"github.com/google/wire"
)
// ProviderSet is server providers.
var ProviderSet = wire.NewSet(NewGinEngine, NewGinServer, handler.NewAuthority, handler.NewMenu, handler.NewAPI, handler.NewPermission, handler.NewOrganization, handler.NewAnnouncement, handler.NewEmail, handler.NewTask, handler.NewMedia, handler.NewAudit, handler.NewExport, handler.NewVersion, handler.NewDictionary, handler.NewParameter, handler.NewAPIToken, handler.NewSystemConfig, handler.NewPublic, handler.NewUser, handler.NewNavigation, handler.NewSession, handler.NewSet, worker.NewTaskExecutor, worker.NewTaskScheduler, worker.NewTaskRuntime)
var ProviderSet = wire.NewSet(NewGinEngine, NewGinServer, handler.NewAuthority, handler.NewMenu, handler.NewAPI, handler.NewPermission, handler.NewOrganization, handler.NewAnnouncement, handler.NewEmail, handler.NewTask, handler.NewMedia, handler.NewAudit, handler.NewExport, handler.NewVersion, handler.NewDictionary, handler.NewParameter, handler.NewAPIToken, handler.NewSystemConfig, handler.NewPublic, handler.NewUser, handler.NewNavigation, handler.NewSession, handler.NewSet)