416 lines
12 KiB
PHP
416 lines
12 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace app\common\logic;
|
||
|
|
|
||
|
|
use app\common\model\UserTokenLog;
|
||
|
|
use app\common\model\Systems;
|
||
|
|
use app\common\model\User;
|
||
|
|
use app\common\model\UserSn;
|
||
|
|
use app\common\utils\Jwt;
|
||
|
|
use support\Cache;
|
||
|
|
use support\exception\BusinessException;
|
||
|
|
use support\Log;
|
||
|
|
|
||
|
|
class AuthLogic_bak2
|
||
|
|
{
|
||
|
|
/**
|
||
|
|
* 账号密码登录
|
||
|
|
*/
|
||
|
|
public function uPwdLogin(array $data): array
|
||
|
|
{
|
||
|
|
$user = $this->validateUser($data['account'], $data['password']);
|
||
|
|
|
||
|
|
$system = $this->validateSystem($data['system_code']);
|
||
|
|
$this->validateSystemPermission($user, $system);
|
||
|
|
$payload = $this->buildJwtPayload($user, $system);
|
||
|
|
$token = $this->generateAccessToken($payload);
|
||
|
|
$refreshToken = $this->generateRefreshToken($user->id);
|
||
|
|
|
||
|
|
// 记录 token 到 Redis 和 MySQL
|
||
|
|
$this->recordUserToken($user->id, $token);
|
||
|
|
|
||
|
|
return [
|
||
|
|
'access_token' => $token,
|
||
|
|
'refresh_token' => $refreshToken,
|
||
|
|
'expires_in' => config('jwt.jwt_expiration'),
|
||
|
|
'payload' => $payload, // 方便前端调试，可移除
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 飞书登录
|
||
|
|
*/
|
||
|
|
public function feishuLogin(array $data): array
|
||
|
|
{
|
||
|
|
$feishuUserInfo = $this->getFeishuUserInfo($data['feishu_code']);
|
||
|
|
$user = $this->getOrCreateUser($feishuUserInfo);
|
||
|
|
|
||
|
|
$system = $this->validateSystem($data['system_code']);
|
||
|
|
$this->validateSystemPermission($user, $system);
|
||
|
|
$payload = $this->buildJwtPayload($user, $system);
|
||
|
|
$token = $this->generateAccessToken($payload);
|
||
|
|
$refreshToken = $this->generateRefreshToken($user->id);
|
||
|
|
|
||
|
|
return [
|
||
|
|
'access_token' => $token,
|
||
|
|
'refresh_token' => $refreshToken,
|
||
|
|
'expires_in' => config('jwt.jwt_expiration'),
|
||
|
|
'payload' => $payload,
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 扫码登录
|
||
|
|
*/
|
||
|
|
public function qrCodeLogin(array $data): array
|
||
|
|
{
|
||
|
|
$userId = $this->validateQrCodeToken($data['qr_code_token']);
|
||
|
|
$user = User::find($userId);
|
||
|
|
if (!$user || $user->status != 1) {
|
||
|
|
throw new BusinessException('用户无效', 403);
|
||
|
|
}
|
||
|
|
|
||
|
|
$system = $this->validateSystem($data['system_code']);
|
||
|
|
$this->validateSystemPermission($user, $system);
|
||
|
|
$payload = $this->buildJwtPayload($user, $system);
|
||
|
|
$token = $this->generateAccessToken($payload);
|
||
|
|
$refreshToken = $this->generateRefreshToken($user->id);
|
||
|
|
|
||
|
|
return [
|
||
|
|
'access_token' => $token,
|
||
|
|
'refresh_token' => $refreshToken,
|
||
|
|
'expires_in' => config('jwt.jwt_expiration'),
|
||
|
|
'payload' => $payload,
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 注册
|
||
|
|
*/
|
||
|
|
public function register(array $data)
|
||
|
|
{
|
||
|
|
$userSnModel = new UserSn();
|
||
|
|
$sn = $userSnModel->where('user_id', '=', 0)->inRandomOrder()->first();
|
||
|
|
if (!$sn) {
|
||
|
|
throw new BusinessException('未找到适用编号');
|
||
|
|
}
|
||
|
|
$data['sn'] = $sn->user_sn;
|
||
|
|
$data['password'] = password_hash($data['password'], PASSWORD_DEFAULT);
|
||
|
|
$user = User::create($data);
|
||
|
|
$this->updateUserId($user->id, $sn->user_sn);
|
||
|
|
return $user;
|
||
|
|
}
|
||
|
|
|
||
|
|
public function updateUserId($userId, $userSn)
|
||
|
|
{
|
||
|
|
$userSn = User::where('user_sn', $userSn)->first();
|
||
|
|
if (!$userSn) {
|
||
|
|
throw new BusinessException('用户编号不存在');
|
||
|
|
}
|
||
|
|
return $userSn->update([
|
||
|
|
'user_id' => $userId
|
||
|
|
]);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 刷新token
|
||
|
|
* @param string $refreshToken
|
||
|
|
* @param string|null $systemCode 可选，指定系统
|
||
|
|
* @return array
|
||
|
|
*/
|
||
|
|
public function refreshToken(string $refreshToken, ?string $systemCode = null): array
|
||
|
|
{
|
||
|
|
$userId = Cache::get("refresh_token:{$refreshToken}");
|
||
|
|
if (!$userId) {
|
||
|
|
throw new BusinessException('refresh_token无效或已过期', 401);
|
||
|
|
}
|
||
|
|
$user = User::find($userId);
|
||
|
|
if (!$user || $user->status != 1) {
|
||
|
|
throw new BusinessException('用户无效', 403);
|
||
|
|
}
|
||
|
|
|
||
|
|
$system = null;
|
||
|
|
if ($systemCode) {
|
||
|
|
$system = Systems::where('code', $systemCode)->first();
|
||
|
|
if (!$system) {
|
||
|
|
throw new BusinessException('系统不存在', 403);
|
||
|
|
}
|
||
|
|
$this->validateSystemPermission($user, $system);
|
||
|
|
}
|
||
|
|
|
||
|
|
$payload = $this->buildJwtPayload($user, $system);
|
||
|
|
$token = $this->generateAccessToken($payload);
|
||
|
|
|
||
|
|
return [
|
||
|
|
'access_token' => $token,
|
||
|
|
'expires_in' => config('jwt.jwt_expiration'),
|
||
|
|
'payload' => $payload,
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 记录用户token到 Redis 和 MySQL
|
||
|
|
*/
|
||
|
|
protected function recordUserToken(int $userId, string $token)
|
||
|
|
{
|
||
|
|
$request = request();
|
||
|
|
$ip = $request ? $request->getRealIp() : '';
|
||
|
|
$ua = $request ? $request->header('user-agent', '') : '';
|
||
|
|
$now = time();
|
||
|
|
$expireAt = $now + config('jwt.jwt_expiration');
|
||
|
|
|
||
|
|
// Redis Set 用户token集合
|
||
|
|
Cache::sAdd("user_tokens:{$userId}", $token);
|
||
|
|
Cache::expire("user_tokens:{$userId}", config('jwt.jwt_expiration'));
|
||
|
|
|
||
|
|
// Redis Hash token元信息
|
||
|
|
$meta = [
|
||
|
|
'login_ip' => $ip,
|
||
|
|
'user_agent' => $ua,
|
||
|
|
'login_time' => $now,
|
||
|
|
'expired_at' => $expireAt,
|
||
|
|
];
|
||
|
|
Cache::hMSet("user_token_meta:{$token}", $meta);
|
||
|
|
Cache::expire("user_token_meta:{$token}", config('jwt.jwt_expiration'));
|
||
|
|
|
||
|
|
// 可选：MySQL 持久化
|
||
|
|
try {
|
||
|
|
UserTokenLog::create([
|
||
|
|
'user_id' => $userId,
|
||
|
|
'token' => $token,
|
||
|
|
'login_ip' => $ip,
|
||
|
|
'user_agent' => $ua,
|
||
|
|
'login_time' => $now,
|
||
|
|
'expired_at' => $expireAt,
|
||
|
|
'is_valid' => 1,
|
||
|
|
]);
|
||
|
|
} catch (\Throwable $e) {
|
||
|
|
// 写库失败可忽略，但建议日志留存
|
||
|
|
Log::error('Token log write failed: '.$e->getMessage());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 校验token有效性
|
||
|
|
*/
|
||
|
|
public function verifyToken(string $token): array
|
||
|
|
{
|
||
|
|
$payload = (new Jwt())->verifyToken($token);
|
||
|
|
if (Cache::has("token_blacklist:{$token}")) {
|
||
|
|
throw new BusinessException('token已失效', 403);
|
||
|
|
}
|
||
|
|
return (array)$payload;
|
||
|
|
}
|
||
|
|
|
||
|
|
// /**
|
||
|
|
// * 登出/失效token
|
||
|
|
// */
|
||
|
|
// public function logout(?string $token)
|
||
|
|
// {
|
||
|
|
// if ($token) {
|
||
|
|
// Cache::set("token_blacklist:{$token}", 1, config('jwt.jwt_expiration'));
|
||
|
|
// }
|
||
|
|
// }
|
||
|
|
|
||
|
|
// /**
|
||
|
|
// * 强制拉黑token
|
||
|
|
// */
|
||
|
|
// public function blockToken(string $token)
|
||
|
|
// {
|
||
|
|
// if (!$token) {
|
||
|
|
// throw new BusinessException('token不能为空', 422);
|
||
|
|
// }
|
||
|
|
// Cache::set("token_blacklist:{$token}", 1, config('jwt.jwt_expiration'));
|
||
|
|
// }
|
||
|
|
|
||
|
|
public function logout(?string $token)
|
||
|
|
{
|
||
|
|
if ($token) {
|
||
|
|
Cache::set("token_blacklist:{$token}", 1, config('jwt.jwt_expiration'));
|
||
|
|
// 1. 解析token查用户
|
||
|
|
$payload = null;
|
||
|
|
try { $payload = (new Jwt())->verifyToken($token); } catch (\Throwable $e) {}
|
||
|
|
$userId = $payload['uid'] ?? null;
|
||
|
|
if ($userId) {
|
||
|
|
Cache::sRem("user_tokens:{$userId}", $token);
|
||
|
|
}
|
||
|
|
// 2. 删除meta
|
||
|
|
Cache::del("user_token_meta:{$token}");
|
||
|
|
|
||
|
|
// 3. 更新MySQL为失效
|
||
|
|
\app\common\model\UserTokenLog::where('token', $token)->update(['is_valid'=>0]);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
public function blockToken(string $token)
|
||
|
|
{
|
||
|
|
if (!$token) {
|
||
|
|
throw new BusinessException('token不能为空', 422);
|
||
|
|
}
|
||
|
|
Cache::set("token_blacklist:{$token}", 1, config('jwt.jwt_expiration'));
|
||
|
|
|
||
|
|
// 1. 解析token查用户
|
||
|
|
$payload = null;
|
||
|
|
try { $payload = (new Jwt())->verifyToken($token); } catch (\Throwable $e) {}
|
||
|
|
$userId = $payload['uid'] ?? null;
|
||
|
|
if ($userId) {
|
||
|
|
Cache::sRem("user_tokens:{$userId}", $token);
|
||
|
|
}
|
||
|
|
Cache::del("user_token_meta:{$token}");
|
||
|
|
\app\common\model\UserTokenLog::where('token', $token)->update(['is_valid'=>0]);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 获取用户所有活跃token及元信息
|
||
|
|
*/
|
||
|
|
public function getUserTokens(int $userId): array
|
||
|
|
{
|
||
|
|
$tokens = Cache::sMembers("user_tokens:{$userId}") ?: [];
|
||
|
|
$result = [];
|
||
|
|
foreach ($tokens as $token) {
|
||
|
|
$meta = Cache::hGetAll("user_token_meta:{$token}");
|
||
|
|
// 可选再查 MySQL 补充日志记录等
|
||
|
|
$result[] = [
|
||
|
|
'token' => $token,
|
||
|
|
'meta' => $meta,
|
||
|
|
];
|
||
|
|
}
|
||
|
|
return $result;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 强制某用户所有token全部下线
|
||
|
|
*/
|
||
|
|
public function blockAllTokensOfUser(int $userId)
|
||
|
|
{
|
||
|
|
$tokens = Cache::sMembers("user_tokens:{$userId}") ?: [];
|
||
|
|
foreach ($tokens as $token) {
|
||
|
|
$this->blockToken($token);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/** ----------- 内部方法 ------------- **/
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 用户验证
|
||
|
|
*/
|
||
|
|
private function validateUser(string $account, string $password)
|
||
|
|
{
|
||
|
|
$user = User::byAccount($account)->first();
|
||
|
|
if (!$user || !password_verify($password, $user->password)) {
|
||
|
|
throw new BusinessException('账号或密码错误', 401);
|
||
|
|
}
|
||
|
|
if ($user->status != 1) {
|
||
|
|
throw new BusinessException('账号已禁用', 403);
|
||
|
|
}
|
||
|
|
return $user;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 系统验证
|
||
|
|
*/
|
||
|
|
private function validateSystem(string $systemCode)
|
||
|
|
{
|
||
|
|
$system = Systems::where('code', $systemCode)->first();
|
||
|
|
if (!$system) {
|
||
|
|
throw new BusinessException('系统不存在', 403);
|
||
|
|
}
|
||
|
|
return $system;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 用户系统权限校验
|
||
|
|
*/
|
||
|
|
private function validateSystemPermission(User $user, Systems $system)
|
||
|
|
{
|
||
|
|
if ($system->is_role) {
|
||
|
|
$systemIds = $user->systems->pluck('id')->toArray();
|
||
|
|
if (!in_array($system->id, $systemIds)) {
|
||
|
|
throw new BusinessException('无该系统权限', 403);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* JWT payload 构建
|
||
|
|
* 可扩展 payload 字段
|
||
|
|
*/
|
||
|
|
private function buildJwtPayload(User $user, ?Systems $system = null): array
|
||
|
|
{
|
||
|
|
$now = time();
|
||
|
|
$exp = $now + config('jwt.jwt_expiration');
|
||
|
|
$system_ids = $user->systems ? $user->systems->pluck('id')->toArray() : [];
|
||
|
|
$role_ids = $user->roles ? $user->roles->pluck('id')->toArray() : [];
|
||
|
|
|
||
|
|
return [
|
||
|
|
'sub' => 'user_' . $user->id,
|
||
|
|
'aud' => $system ? $system->domain_url : '',
|
||
|
|
'iat' => $now,
|
||
|
|
'nbf' => $now,
|
||
|
|
'exp' => $exp,
|
||
|
|
'typ' => 'access',
|
||
|
|
'uid' => $user->id,
|
||
|
|
'role_ids' => $role_ids,
|
||
|
|
'system_ids' => $system_ids
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* JWT签发
|
||
|
|
*/
|
||
|
|
private function generateAccessToken(array $payload)
|
||
|
|
{
|
||
|
|
return (new Jwt())->generateToken($payload);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 刷新令牌生成
|
||
|
|
*/
|
||
|
|
private function generateRefreshToken(int $userId)
|
||
|
|
{
|
||
|
|
$refreshToken = bin2hex(random_bytes(32));
|
||
|
|
Cache::set("refresh_token:{$refreshToken}", $userId, config('jwt.jwt_refresh_token_expiration'));
|
||
|
|
return $refreshToken;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 验证扫码令牌
|
||
|
|
*/
|
||
|
|
private function validateQrCodeToken(string $qrCodeToken)
|
||
|
|
{
|
||
|
|
$userId = Cache::get("qr_code_token:{$qrCodeToken}");
|
||
|
|
if (!$userId) {
|
||
|
|
throw new BusinessException('扫码令牌无效或已过期', 401);
|
||
|
|
}
|
||
|
|
return $userId;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 调用飞书API获取用户信息（示例）
|
||
|
|
*/
|
||
|
|
private function getFeishuUserInfo(string $code)
|
||
|
|
{
|
||
|
|
// 实际实现需要调用飞书 API
|
||
|
|
return [
|
||
|
|
'user_id' => 'feishu_user_123',
|
||
|
|
'name' => '飞书用户',
|
||
|
|
];
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* 查找或创建飞书用户（示例）
|
||
|
|
*/
|
||
|
|
private function getOrCreateUser(array $feishuUserInfo)
|
||
|
|
{
|
||
|
|
$user = User::where('feishu_user_id', $feishuUserInfo['user_id'])->first();
|
||
|
|
if (!$user) {
|
||
|
|
$user = new User();
|
||
|
|
$user->feishu_user_id = $feishuUserInfo['user_id'];
|
||
|
|
$user->name = $feishuUserInfo['name'];
|
||
|
|
$user->status = 1;
|
||
|
|
$user->save();
|
||
|
|
}
|
||
|
|
return $user;
|
||
|
|
}
|
||
|
|
}
|