68 lines
1.8 KiB
Go
68 lines
1.8 KiB
Go
|
package commonservice
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"time"
|
|||
|
|
|
|||
|
|
"github.com/golang-jwt/jwt/v5"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// Claims 是 access / refresh token 的载荷。
|
|||
|
|
type Claims struct {
|
|||
|
|
UserID int64 `json:"userId"`
|
|||
|
|
Username string `json:"username"`
|
|||
|
|
Type string `json:"type"` // access | refresh
|
|||
|
|
jwt.RegisteredClaims
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// IssueAccess 签发 access token。
|
|||
|
|
func IssueAccess(secret string, userID int64, username string, ttlHours int) (string, error) {
|
|||
|
|
if ttlHours <= 0 {
|
|||
|
|
ttlHours = 2
|
|||
|
|
}
|
|||
|
|
return issue(secret, userID, username, "access", time.Duration(ttlHours)*time.Hour)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// IssueRefresh 签发 refresh token。
|
|||
|
|
func IssueRefresh(secret string, userID int64, username string, ttlDays int) (string, error) {
|
|||
|
|
if ttlDays <= 0 {
|
|||
|
|
ttlDays = 30
|
|||
|
|
}
|
|||
|
|
return issue(secret, userID, username, "refresh", time.Duration(ttlDays)*24*time.Hour)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func issue(secret string, userID int64, username, typ string, ttl time.Duration) (string, error) {
|
|||
|
|
now := time.Now()
|
|||
|
|
claims := Claims{
|
|||
|
|
UserID: userID,
|
|||
|
|
Username: username,
|
|||
|
|
Type: typ,
|
|||
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|||
|
|
IssuedAt: jwt.NewNumericDate(now),
|
|||
|
|
ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
|
|||
|
|
},
|
|||
|
|
}
|
|||
|
|
t := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|||
|
|
return t.SignedString([]byte(secret))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// Parse 校验并解析 JWT；typ 非空时要求 claims.Type 匹配。
|
|||
|
|
func Parse(secret, token, typ string) (*Claims, error) {
|
|||
|
|
parsed, err := jwt.ParseWithClaims(token, &Claims{}, func(t *jwt.Token) (any, error) {
|
|||
|
|
if t.Method != jwt.SigningMethodHS256 {
|
|||
|
|
return nil, Unauthorized("UNAUTHORIZED")
|
|||
|
|
}
|
|||
|
|
return []byte(secret), nil
|
|||
|
|
})
|
|||
|
|
if err != nil || !parsed.Valid {
|
|||
|
|
return nil, Unauthorized("UNAUTHORIZED")
|
|||
|
|
}
|
|||
|
|
claims, ok := parsed.Claims.(*Claims)
|
|||
|
|
if !ok || claims.UserID <= 0 {
|
|||
|
|
return nil, Unauthorized("UNAUTHORIZED")
|
|||
|
|
}
|
|||
|
|
if typ != "" && claims.Type != typ {
|
|||
|
|
return nil, Unauthorized("UNAUTHORIZED")
|
|||
|
|
}
|
|||
|
|
return claims, nil
|
|||
|
|
}
|