105 lines
3.0 KiB
PHP
105 lines
3.0 KiB
PHP
|
<?php
|
|||
|
|
|
|||
|
|
namespace App\Service\wx;
|
|||
|
|
|
|||
|
|
use App\Models\business\WxUserModel;
|
|||
|
|
use App\Service\common\UtilsService;
|
|||
|
|
use Firebase\JWT\JWT;
|
|||
|
|
use Firebase\JWT\Key;
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 小程序用户令牌
|
|||
|
|
*
|
|||
|
|
* 老 lgp-wx-api 把微信的 session_key 当 token 直接返回客户端：
|
|||
|
|
* 它既是解密用户数据的密钥，又永不过期，泄露等于长期冒用身份。
|
|||
|
|
* 这里改成服务端自签 JWT，session_key 只留库里。
|
|||
|
|
*
|
|||
|
|
* payload 带 scope=wx，与后台管理端的 token 互不通用——
|
|||
|
|
* 否则一个小程序 token 就能打后台接口。
|
|||
|
|
*/
|
|||
|
|
class WxTokenService
|
|||
|
|
{
|
|||
|
|
private static mixed $_instance;
|
|||
|
|
|
|||
|
|
private const SCOPE = 'wx';
|
|||
|
|
|
|||
|
|
private string $secretKey;
|
|||
|
|
|
|||
|
|
public function __construct()
|
|||
|
|
{
|
|||
|
|
$secret = (string) config('nl.jwt.secret', '');
|
|||
|
|
// 与后台同一个密钥但 scope 不同，验证时强制校验 scope，不存在越权互通
|
|||
|
|
$this->secretKey = strlen($secret) >= 32 ? $secret : hash('sha256', $secret !== '' ? $secret : 'nl_wx_jwt_fallback');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
public static function getInstance(): null|static
|
|||
|
|
{
|
|||
|
|
$name = get_called_class();
|
|||
|
|
if (!isset(self::$_instance[$name])) {
|
|||
|
|
self::$_instance[$name] = new static();
|
|||
|
|
}
|
|||
|
|
return self::$_instance[$name];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 签发令牌
|
|||
|
|
*/
|
|||
|
|
public function issue(int $userId, string $appCode = ''): string
|
|||
|
|
{
|
|||
|
|
$now = time();
|
|||
|
|
return JWT::encode([
|
|||
|
|
'iat' => $now,
|
|||
|
|
'exp' => $now + (int) config('nl.wx.token_ttl', 30 * 24 * 3600),
|
|||
|
|
'scope' => self::SCOPE,
|
|||
|
|
'uid' => $userId,
|
|||
|
|
'app' => $appCode,
|
|||
|
|
], $this->secretKey, 'HS256');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 校验令牌并返回用户；失败返回 null 由中间件统一响应
|
|||
|
|
*/
|
|||
|
|
public function resolveUser(?string $token): ?array
|
|||
|
|
{
|
|||
|
|
if (empty($token)) {
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
try {
|
|||
|
|
$payload = JWT::decode($token, new Key($this->secretKey, 'HS256'));
|
|||
|
|
} catch (\Throwable) {
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
if (($payload->scope ?? '') !== self::SCOPE) {
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
$userId = (int) ($payload->uid ?? 0);
|
|||
|
|
if ($userId <= 0) {
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
// 每次请求回查用户：倍率、价格可见性、是否被停用都可能刚被后台改过
|
|||
|
|
$user = WxUserModel::where('id', $userId)->where('deleted_at', 0)->first();
|
|||
|
|
if (empty($user)) {
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
$user = $user->toArray();
|
|||
|
|
unset($user['session_key']);
|
|||
|
|
return $user;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 取当前请求的小程序用户，取不到直接中断
|
|||
|
|
*/
|
|||
|
|
public function requireUser(): array
|
|||
|
|
{
|
|||
|
|
$user = request()->attributes->get('wx_user');
|
|||
|
|
if (!empty($user)) {
|
|||
|
|
return $user;
|
|||
|
|
}
|
|||
|
|
$user = $this->resolveUser(request()->bearerToken());
|
|||
|
|
if (empty($user)) {
|
|||
|
|
UtilsService::getInstance()->notAuth('请先登录');
|
|||
|
|
}
|
|||
|
|
return $user;
|
|||
|
|
}
|
|||
|
|
}
|