dachui/order_site
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): 登录态改为滑动续期（后台 24h/7d，打手 7d/30d）

Browse Source
This commit is contained in:
yml2213
2026-10-25 13:28:58 +08:00
parent 81edf530db
commit 2fb7aae13f
31 changed files with 510 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/backend/src/services/admin/admin-auth-service.ts
+44 -10
View File
@@ -18,7 +18,12 @@ import {
revokeAdminSession,
touchAdminSession,
} from '../../repositories/admin-session-repo.js'
import { addHours, nowIso } from '../../utils/time.js'
import { nowIso } from '../../utils/time.js'
import {
resolveSessionExpiryWindow,
resolveSlidingSessionExpiresAt,
} from '../../utils/session-window.js'
import { setSessionExpiryHeaders } from '../../utils/session-headers.js'
import { createHttpError } from '../../utils/http.js'
import { normalizePage, normalizePageSize } from './admin-query-utils.js'
import { recordAdminLoginLog } from './admin-login-log-service.js'
@@ -39,6 +44,7 @@ export type AdminSession = {
displayName: string
role: AdminRole
expiresAt: string
absoluteExpiresAt: string
sessionVersion: number
deviceId: string
permissions: string[]
@@ -346,8 +352,8 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
})
}
const expiresAt = String(payload?.exp || '').trim()
if (!expiresAt || Date.parse(expiresAt) <= Date.now()) {
const absoluteExpiresAt = String(payload?.exp || '').trim()
if (!absoluteExpiresAt || Date.parse(absoluteExpiresAt) <= Date.now()) {
throw createHttpError('后台登录已过期，请重新登录', {
statusCode: 401,
errorCode: 'admin_auth_expired',
@@ -362,14 +368,30 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
errorCode: 'admin_auth_invalid',
})
}
const activeSession = await getActiveAdminSession(sessionId, nowIso())
const now = nowIso()
const activeSession = await getActiveAdminSession(sessionId, now)
if (!activeSession || Number(activeSession.user_id) !== userId) {
throw createHttpError('后台登录态已失效，请重新登录', {
statusCode: 401,
errorCode: 'admin_auth_revoked',
})
}
await touchAdminSession(sessionId, nowIso())
const touchedExpiresAt = await touchAdminSession({
sessionId,
now,
idleExpiresAt: resolveSlidingSessionExpiresAt({
now,
idleHours: runtimeConfig.admin.sessionIdleTtlHours,
absoluteExpiresAt,
}),
absoluteExpiresAt,
})
if (!touchedExpiresAt) {
throw createHttpError('后台登录态已失效，请重新登录', {
statusCode: 401,
errorCode: 'admin_auth_revoked',
})
}
const user = await getAdminUserById(userId)
if (!user || user.status !== 'active') {
throw createHttpError('后台账号已不可用，请重新登录', {
@@ -393,7 +415,8 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
username: String(user.username || ''),
displayName: String(user.display_name || user.username || ''),
role: normalizeAdminRole(user.role),
expiresAt,
expiresAt: touchedExpiresAt,
absoluteExpiresAt,
sessionVersion: currentSessionVersion,
deviceId: String(activeSession.device_id || ''),
permissions: await listAdminPermissionKeysForRole(normalizeAdminRole(user.role)),
@@ -406,12 +429,17 @@ export async function logoutAdmin(token: unknown): Promise<{ success: boolean; r
return { success: true, revoked }
}
export async function getAdminSessionSummary(token: unknown): Promise<JsonObject> {
export async function getAdminSessionSummary(
token: unknown,
res?: { setHeader(name: string, value: string): unknown },
): Promise<JsonObject> {
const session = await verifyAdminSessionToken(token)
if (res) setSessionExpiryHeaders(res, session)
return {
authenticated: true,
expiresAt: session.expiresAt,
absoluteExpiresAt: session.absoluteExpiresAt,
user: {
userId: session.userId,
username: session.username,
@@ -738,7 +766,12 @@ export function ensureAdminAuthConfigured(): void {
function createAdminSession(user: AdminUserRow, deviceId = ''): JsonObject {
const issuedAt = nowIso()
const expiresAt = addHours(issuedAt, Number(runtimeConfig.admin.sessionTtlHours || 12))
// Token 的 exp 是绝对上限；DB 会话的 expires_at 是空闲窗口，会在每次访问时滑动。
const { idleExpiresAt, absoluteExpiresAt } = resolveSessionExpiryWindow({
now: issuedAt,
idleHours: Number(runtimeConfig.admin.sessionIdleTtlHours || 24),
absoluteHours: Number(runtimeConfig.admin.sessionAbsoluteTtlHours || 168),
})
const payload = {
sid: crypto.randomBytes(12).toString('hex'),
uid: Number(user.id),
@@ -747,7 +780,7 @@ function createAdminSession(user: AdminUserRow, deviceId = ''): JsonObject {
dev: String(deviceId || ''),
ver: normalizeAdminSessionVersion(user.session_version),
iat: issuedAt,
exp: expiresAt,
exp: absoluteExpiresAt,
}
const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')
const signature = signPayload(encodedPayload)
@@ -756,7 +789,8 @@ function createAdminSession(user: AdminUserRow, deviceId = ''): JsonObject {
sessionId: payload.sid,
issuedAt,
token: `${encodedPayload}.${signature}`,
expiresAt,
expiresAt: idleExpiresAt,
absoluteExpiresAt,
user: {
userId: Number(user.id),
username: String(user.username || ''),
apps/backend/src/services/worker-platform/worker-auth-utils.ts
+11 -4
View File
@@ -3,12 +3,18 @@ import crypto from 'node:crypto'
import { runtimeConfig } from '../../config/runtime.js'
import type { WorkerUserRow } from '../../repositories/worker-platform/index.js'
import { createHttpError } from '../../utils/http.js'
import { addHours, nowIso } from '../../utils/time.js'
import { nowIso } from '../../utils/time.js'
import { resolveSessionExpiryWindow } from '../../utils/session-window.js'
import { normalizeSessionVersion } from './worker-normalizers.js'
export function createWorkerSessionToken(worker: WorkerUserRow) {
const issuedAt = nowIso()
const expiresAt = addHours(issuedAt, Number(runtimeConfig.admin?.sessionTtlHours || 12))
// Token 的 exp 是绝对上限；DB 会话的 expires_at 是空闲窗口，会在每次访问时滑动。
const { idleExpiresAt, absoluteExpiresAt } = resolveSessionExpiryWindow({
now: issuedAt,
idleHours: Number(runtimeConfig.worker?.sessionIdleTtlHours || 168),
absoluteHours: Number(runtimeConfig.worker?.sessionAbsoluteTtlHours || 720),
})
const payload = {
typ: 'worker',
sid: crypto.randomBytes(12).toString('hex'),
@@ -17,13 +23,14 @@ export function createWorkerSessionToken(worker: WorkerUserRow) {
status: worker.status,
ver: normalizeSessionVersion(worker.session_version),
iat: issuedAt,
exp: expiresAt,
exp: absoluteExpiresAt,
}
const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')
return {
sessionId: payload.sid,
token: `${encodedPayload}.${signWorkerPayload(encodedPayload)}`,
expiresAt,
expiresAt: idleExpiresAt,
absoluteExpiresAt,
}
}
apps/backend/src/services/worker-platform/worker-login-service.ts
+1
View File
@@ -186,6 +186,7 @@ function createCredentialSession(worker: WorkerUserRow): WorkerSession {
username: worker.username,
status: worker.status,
expiresAt: '',
absoluteExpiresAt: '',
sessionVersion: normalizeSessionVersion(worker.session_version),
}
}
apps/backend/src/services/worker-platform/worker-platform-service.test.ts
+6 -2
View File
@@ -2828,8 +2828,12 @@ test('会话 touch 必须同时保留鉴权语义与写入节流', async () => {
src.indexOf('export async function touchWorkerSession'),
src.indexOf('export async function revokeWorkerSession'),
)
// 返回值是鉴权有效性：上层 !(await touch) 会直接 401，不能因为"不写"就返回 false
assert.ok(body.includes('EXISTS (SELECT 1 FROM target) AS valid'), '必须仍然返回会话是否有效')
// 返回值是续期后的空闲到期时间：null 才会被上层判成 401
assert.ok(body.includes('RETURNING ws.expires_at'), '必须返回滑动续期后的 expires_at')
assert.ok(
body.includes('LEAST($3::timestamptz, $4::timestamptz)'),
'滑动续期不能突破 Token 里的绝对上限',
)
assert.ok(body.includes("status = 'active'"), '有效性判定不能丢')
// 写操作必须节流：32 天里被写了 3300 万次
assert.ok(body.includes('WORKER_SESSION_TOUCH_MIN_INTERVAL'), '缺少节流间隔常量')
apps/backend/src/services/worker-platform/worker-session-auth-service.ts
+32 -6
View File
@@ -5,9 +5,12 @@ import {
revokeWorkerSession,
touchWorkerSession,
} from '../../repositories/worker-platform/index.js'
import { runtimeConfig } from '../../config/runtime.js'
import type { JsonObject } from '../../types/json.js'
import { createHttpError } from '../../utils/http.js'
import { nowIso } from '../../utils/time.js'
import { resolveSlidingSessionExpiresAt } from '../../utils/session-window.js'
import { setSessionExpiryHeaders } from '../../utils/session-headers.js'
import {
ensureWorkerAuthConfigured,
isIgnorableWorkerAuthError,
@@ -102,8 +105,8 @@ export async function verifyWorkerSessionToken(token: unknown): Promise<WorkerSe
})
}
const expiresAt = String(payload.exp || '').trim()
if (!expiresAt || Date.parse(expiresAt) <= Date.now()) {
const absoluteExpiresAt = String(payload.exp || '').trim()
if (!absoluteExpiresAt || Date.parse(absoluteExpiresAt) <= Date.now()) {
throw createHttpError('登录已过期，请重新登录', {
statusCode: 401,
errorCode: 'worker_auth_expired',
@@ -133,8 +136,7 @@ export async function verifyWorkerSessionToken(token: unknown): Promise<WorkerSe
!sessionRecord ||
Number(sessionRecord.worker_id) !== Number(worker.id) ||
sessionRecord.status !== 'active' ||
Date.parse(String(sessionRecord.expires_at || '')) <= Date.now() ||
!(await touchWorkerSession(sessionId, nowIso()))
Date.parse(String(sessionRecord.expires_at || '')) <= Date.now()
) {
throw createHttpError('登录设备已被删除，请重新登录', {
statusCode: 401,
@@ -142,12 +144,31 @@ export async function verifyWorkerSessionToken(token: unknown): Promise<WorkerSe
})
}
const nowAt = nowIso()
const touchedExpiresAt = await touchWorkerSession({
sessionId,
now: nowAt,
idleExpiresAt: resolveSlidingSessionExpiresAt({
now: nowAt,
idleHours: runtimeConfig.worker?.sessionIdleTtlHours || 168,
absoluteExpiresAt,
}),
absoluteExpiresAt,
})
if (!touchedExpiresAt) {
throw createHttpError('登录设备已被删除，请重新登录', {
statusCode: 401,
errorCode: 'worker_auth_device_revoked',
})
}
const verifiedSession: WorkerSession = {
sessionId,
workerId: Number(worker.id),
username: worker.username,
status: worker.status,
expiresAt,
expiresAt: touchedExpiresAt,
absoluteExpiresAt,
sessionVersion: currentSessionVersion,
}
@@ -200,12 +221,17 @@ export async function deleteWorkerSession(session: WorkerSession, targetSessionI
}
}
export async function getWorkerSessionSummary(token: unknown) {
export async function getWorkerSessionSummary(
token: unknown,
res?: { setHeader(name: string, value: string): unknown },
) {
const session = await verifyWorkerSessionToken(token)
if (res) setSessionExpiryHeaders(res, session)
const worker = await getRequiredWorker(session.workerId)
return {
authenticated: true,
expiresAt: session.expiresAt,
absoluteExpiresAt: session.absoluteExpiresAt,
worker: mapWorkerUser(worker),
}
}
apps/backend/src/services/worker-platform/worker-session-context-service.ts
+1
View File
@@ -12,6 +12,7 @@ export type WorkerSession = {
username: string
status: string
expiresAt: string
absoluteExpiresAt: string
sessionVersion: number
}