5038ec2fc5
feat: implement redis-based logout and jwt middleware 🚀 feat: 实现基于 Redis 的登出机制与 JWT 中间件 🚀 Middleware Construction: Implemented JWTTokenAuth middleware for Gin, featuring structured claims parsing and active session validation. 🛡️ 中间件构建：为 Gin 框架实现了 JWTTokenAuth 中间件，支持结构化 Claims 解析与活跃会话验证。🛡️ Redis Integration: Introduced Redis for high-performance state management. Integrated CacheDAO into the Dependency Injection (DI) chain. ⚡ Redis 引入：引入 Redis 进行高性能状态管理。将 CacheDAO 成功集成至依赖注入 (DI) 调用链中。⚡ Secure Logout Module: Developed the logout functional module using a Redis Blacklist mechanism. 🔐 安全登出模块：开发了基于 Redis 黑名单 机制的登出功能模块。🔐 Marked invalidated tokens by storing jti (JWT ID) in Redis with automatic TTL expiration. 通过在 Redis 中存储 jti（JWT 唯一标识）并设置自动 TTL 过期，实现 Token 的主动失效。 Added blacklist checkpoints in both AuthMiddleware and RefreshToken logic to prevent session resurrection. 在认证中间件与 Token 刷新逻辑中同步增设黑名单检查点，杜绝登出后的“死灰复燃”。 Architecture Refinement: Upgraded ValidateRefreshToken and Service-layer handlers to use type-safe struct assertions instead of raw MapClaims. 🏗️ 架构精进：升级了 ValidateRefreshToken 与 Service 层处理器，改用类型安全的结构体断言取代原始的 MapClaims，提升了代码健壮性。🏗️
73 lines
2.0 KiB
Go
73 lines
2.0 KiB
Go
package middleware
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"github.com/LoveLosita/smartflow/backend/auth"
|
|
"github.com/LoveLosita/smartflow/backend/dao"
|
|
"github.com/LoveLosita/smartflow/backend/model"
|
|
"github.com/LoveLosita/smartflow/backend/respond"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/golang-jwt/jwt/v4"
|
|
)
|
|
|
|
// JWTTokenAuth 接收 cache 实例，体现依赖注入
|
|
func JWTTokenAuth(cache *dao.CacheDAO) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// 1. 获取 Token (Gin 的 GetHeader 直接返回 string)
|
|
tokenString := c.GetHeader("Authorization")
|
|
if tokenString == "" {
|
|
c.JSON(http.StatusUnauthorized, respond.MissingToken)
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
// 2. 改动：使用 ParseWithClaims 直接解析到你的结构体
|
|
// 假设你的结构体叫 model.MyCustomClaims
|
|
token, err := jwt.ParseWithClaims(tokenString, &model.MyCustomClaims{}, func(token *jwt.Token) (interface{}, error) {
|
|
return auth.AccessKey, nil
|
|
})
|
|
|
|
if err != nil || !token.Valid {
|
|
c.JSON(http.StatusUnauthorized, respond.InvalidToken)
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
// 3. 校验 Claims
|
|
claims, ok := token.Claims.(*model.MyCustomClaims)
|
|
if !ok {
|
|
c.JSON(http.StatusUnauthorized, respond.InvalidClaims)
|
|
c.Abort()
|
|
return
|
|
}
|
|
// --- 🛡️ 核心改造：设卡检查 ---
|
|
if claims.TokenType != "access_token" {
|
|
c.JSON(http.StatusUnauthorized, respond.WrongTokenType)
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
// 拿着 jti 去 Redis 查一下
|
|
isBlack, err := cache.IsBlacklisted(claims.Jti)
|
|
if err != nil {
|
|
// 如果 Redis 挂了，为了安全通常选择报错，或者降级放行（取决于你的业务）
|
|
c.JSON(http.StatusInternalServerError, respond.InternalError(errors.New("无法验证令牌状态")))
|
|
c.Abort()
|
|
return
|
|
}
|
|
if isBlack {
|
|
c.JSON(http.StatusUnauthorized, respond.UserLoggedOut)
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
// 4. 存入上下文
|
|
c.Set("user_id", claims.UserID)
|
|
c.Set("claims", claims)
|
|
c.Next() // 只有所有关卡都过了，才放行
|
|
}
|
|
}
|