yml2213
cdee93c7c5
根因：access_token每2小时过期，前端收到401直接清token跳登录，没有用refresh_token续期 后端修复： - adminauth模块新增 POST /admin/auth/refresh 接口 - Service 注入 JWTManager，支持 admin refresh token 换新 token pair - Refresh 方法验证 subjectType=admin + tokenType=refresh 前端修复： - 401 拦截器核心改造：收到401先调 refresh 接口续期 - 加 isRefreshing 锁 + pendingRequests 队列防止并发刷新 - refresh 用原生 axios.post 避免拦截器递归 - 成功则更新 localStorage + 重试原请求，失败才清 token 跳登录 - 排除 /auth/refresh 自身避免死循环 - 支持 /admin/ 请求独立 token 管理 - auth.ts/adminAuth.ts 新增手动 refreshUserToken/refreshAdminSession - 路由守卫给所有需登录路由添加 meta.requiresAuth - 守卫同时支持 PC 端 /login 和移动端 /m/login
102 lines
2.4 KiB
Go
102 lines
2.4 KiB
Go
package adminauth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"hfb_sys/backend/internal/middleware"
|
|
"hfb_sys/backend/pkg/response"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type Handler struct {
|
|
service *Service
|
|
}
|
|
|
|
func NewHandler(service *Service) *Handler {
|
|
return &Handler{service: service}
|
|
}
|
|
|
|
func (h *Handler) Captcha(c *gin.Context) {
|
|
item, err := h.service.Captcha()
|
|
if err != nil {
|
|
writeAdminAuthError(c, err)
|
|
return
|
|
}
|
|
response.OK(c, item)
|
|
}
|
|
|
|
func (h *Handler) Login(c *gin.Context) {
|
|
var req LoginRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
response.BadRequest(c, "用户名、密码和验证码不能为空")
|
|
return
|
|
}
|
|
result, err := h.service.Login(strings.TrimSpace(req.Username), req.Password, strings.TrimSpace(req.CaptchaID), strings.TrimSpace(req.CaptchaCode))
|
|
if err != nil {
|
|
writeAdminAuthError(c, err)
|
|
return
|
|
}
|
|
response.OK(c, result)
|
|
}
|
|
|
|
func (h *Handler) Me(c *gin.Context) {
|
|
value, ok := c.Get(middleware.ContextAdminID)
|
|
if !ok {
|
|
response.Unauthorized(c, "缺少管理员上下文")
|
|
return
|
|
}
|
|
adminID, ok := value.(uint64)
|
|
if !ok {
|
|
response.Unauthorized(c, "管理员上下文无效")
|
|
return
|
|
}
|
|
admin, err := h.service.Me(adminID)
|
|
if err != nil {
|
|
writeAdminAuthError(c, err)
|
|
return
|
|
}
|
|
response.OK(c, admin)
|
|
}
|
|
|
|
func (h *Handler) Logout(c *gin.Context) {
|
|
response.OK(c, gin.H{"logged_out": true})
|
|
}
|
|
|
|
type AdminRefreshRequest struct {
|
|
RefreshToken string `json:"refresh_token" binding:"required"`
|
|
}
|
|
|
|
func (h *Handler) Refresh(c *gin.Context) {
|
|
var req AdminRefreshRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
response.BadRequest(c, "refresh_token 不能为空")
|
|
return
|
|
}
|
|
tokens, err := h.service.Refresh(req.RefreshToken)
|
|
if err != nil {
|
|
writeAdminAuthError(c, err)
|
|
return
|
|
}
|
|
response.OK(c, tokens)
|
|
}
|
|
|
|
func writeAdminAuthError(c *gin.Context, err error) {
|
|
switch {
|
|
case errors.Is(err, ErrDependencyUnavailable):
|
|
response.ServiceUnavailable(c, "数据库未连接")
|
|
case errors.Is(err, ErrInvalidRefreshToken):
|
|
response.Unauthorized(c, "刷新令牌无效或已过期")
|
|
case errors.Is(err, ErrInvalidCredential):
|
|
response.BadRequest(c, "用户名或密码错误")
|
|
case errors.Is(err, ErrCaptchaInvalid):
|
|
response.BadRequest(c, "验证码错误或已过期")
|
|
case errors.Is(err, ErrAdminDisabled):
|
|
response.Error(c, http.StatusForbidden, "admin_disabled", "管理员已禁用")
|
|
default:
|
|
response.Error(c, http.StatusInternalServerError, "internal_error", "后台认证服务暂时不可用")
|
|
}
|
|
}
|