feat(auth): JWT 滑动续期 + 401 自动登出，修复长挂机莫名掉线
- 后端：JWT 有效期可配（JWT_EXPIRE_HOURS，默认 24h）；令牌寿命过半时经 X-Renewed-Token 响应头滑动续期；新增 POST /api/auth/refresh 以数据库真实身份签发 - 前端 request 层：静默接管续期头并同步 localStorage；任何 401（登录/续期除外） 统一广播会话过期事件 - auth store：监听过期事件清理登录态并跳转 /login?expired=1（不再卡 403 页）； 每 10 分钟定时续期，避免 WS 重连时令牌已过期 - 新增滑动续期单元测试（回签过期时间戳），go test -race 通过
This commit is contained in:
yml2213
+2
-2
@@ -22,8 +22,8 @@ func main() {
|
||||
// 初始化数据库
|
||||
model.InitDB(cfg.Database.DSN())
|
||||
|
||||
// 初始化 JWT
|
||||
middleware.InitJWT(cfg.JWT.Secret)
|
||||
// 初始化 JWT（有效期可用 JWT_EXPIRE_HOURS 配置，默认 24 小时）
|
||||
middleware.InitJWT(cfg.JWT.Secret, cfg.JWT.ExpireTime)
|
||||
|
||||
// 对象存储（MinIO / S3 兼容）
|
||||
store, err := storage.NewS3(cfg.Storage)
|
||||
|
||||
@@ -31,8 +31,9 @@ type DatabaseConfig struct {
|
||||
}
|
||||
|
||||
type JWTConfig struct {
|
||||
Secret string
|
||||
ExpireTime time.Duration
|
||||
Secret string
|
||||
ExpireTime time.Duration
|
||||
ExpireHours int
|
||||
}
|
||||
|
||||
// StorageConfig S3 兼容对象存储（MinIO / OSS / COS / S3 共用字段）
|
||||
@@ -70,10 +71,17 @@ func Load() *Config {
|
||||
Name: getEnv("DB_NAME", "kefu_cloud"),
|
||||
SSLMode: getEnv("DB_SSLMODE", "disable"),
|
||||
},
|
||||
JWT: JWTConfig{
|
||||
Secret: getEnv("JWT_SECRET", "kefu-cloud-secret-key"),
|
||||
ExpireTime: 24 * time.Hour,
|
||||
},
|
||||
JWT: func() JWTConfig {
|
||||
hours := getEnvInt("JWT_EXPIRE_HOURS", 24)
|
||||
if hours <= 0 {
|
||||
hours = 24
|
||||
}
|
||||
return JWTConfig{
|
||||
Secret: getEnv("JWT_SECRET", "kefu-cloud-secret-key"),
|
||||
ExpireTime: time.Duration(hours) * time.Hour,
|
||||
ExpireHours: hours,
|
||||
}
|
||||
}(),
|
||||
Storage: StorageConfig{
|
||||
// 默认映射宿主机 9100→容器 9000，避免与其它项目 MinIO 冲突
|
||||
Endpoint: getEnv("STORAGE_ENDPOINT", "localhost:9100"),
|
||||
|
||||
@@ -70,6 +70,27 @@ func (h *AuthHandler) Login(c *gin.Context) {
|
||||
})
|
||||
}
|
||||
|
||||
// Refresh 以当前登录身份签发新令牌（用于前端定时续期，避免长挂机后令牌过期掉线）。
|
||||
// 以数据库中的真实角色/租户为准，防止携带过期角色的令牌被无限续期。
|
||||
func (h *AuthHandler) Refresh(c *gin.Context) {
|
||||
userID := middleware.GetUserID(c)
|
||||
var user model.User
|
||||
if err := model.DB.Select("id", "tenant_id", "role", "status").First(&user, userID).Error; err != nil {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "账号状态已变化，请重新登录"})
|
||||
return
|
||||
}
|
||||
if status, message := middleware.ValidateUserAccess(user.ID, user.TenantID, user.Role); status != 0 {
|
||||
c.JSON(status, gin.H{"code": status, "message": message})
|
||||
return
|
||||
}
|
||||
token, err := middleware.GenerateToken(user.ID, user.TenantID, user.Role)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "生成token失败"})
|
||||
return
|
||||
}
|
||||
middleware.JSON(c, gin.H{"token": token})
|
||||
}
|
||||
|
||||
// Me 当前登录用户信息。
|
||||
func (h *AuthHandler) Me(c *gin.Context) {
|
||||
var user model.User
|
||||
|
||||
@@ -56,10 +56,12 @@ func SetupRoutes(r *gin.Engine, store storage.ObjectStorage, storageCfg config.S
|
||||
authRequired := api.Group("")
|
||||
authRequired.Use(middleware.AuthRequired())
|
||||
{
|
||||
// 当前用户
|
||||
authRequired.GET("/me", auth.Me)
|
||||
authRequired.GET("/me/permissions", auth.MePermissions)
|
||||
authRequired.PUT("/me/status", auth.UpdatePresence)
|
||||
// 当前用户
|
||||
authRequired.GET("/me", auth.Me)
|
||||
authRequired.GET("/me/permissions", auth.MePermissions)
|
||||
authRequired.PUT("/me/status", auth.UpdatePresence)
|
||||
// 令牌续期（前端定时调用，防止长挂机后过期掉线）
|
||||
authRequired.POST("/auth/refresh", auth.Refresh)
|
||||
|
||||
// WebSocket
|
||||
authRequired.GET("/ws", wsHandler.Connect)
|
||||
|
||||
@@ -36,7 +36,7 @@ func setupRouter(t *testing.T) *gin.Engine {
|
||||
t.Fatalf("迁移测试数据库失败: %v", err)
|
||||
}
|
||||
model.DB = db
|
||||
middleware.InitJWT("test-secret")
|
||||
middleware.InitJWT("test-secret", time.Hour)
|
||||
router := gin.New()
|
||||
mem := storage.NewMemory("http://localhost:9100/kefu")
|
||||
handler.SetupRoutes(router, mem, config.StorageConfig{
|
||||
|
||||
@@ -13,12 +13,21 @@ import (
|
||||
"kefu-cloud/server/internal/model"
|
||||
)
|
||||
|
||||
var jwtSecret []byte
|
||||
var (
|
||||
jwtSecret []byte
|
||||
jwtExpire = 24 * time.Hour
|
||||
)
|
||||
|
||||
func InitJWT(secret string) {
|
||||
func InitJWT(secret string, expire time.Duration) {
|
||||
jwtSecret = []byte(secret)
|
||||
if expire > 0 {
|
||||
jwtExpire = expire
|
||||
}
|
||||
}
|
||||
|
||||
// TokenExpire 返回令牌有效期时长。
|
||||
func TokenExpire() time.Duration { return jwtExpire }
|
||||
|
||||
type Claims struct {
|
||||
UserID uint `json:"user_id"`
|
||||
TenantID uint `json:"tenant_id"`
|
||||
@@ -32,7 +41,7 @@ func GenerateToken(userID, tenantID uint, role string) (string, error) {
|
||||
TenantID: tenantID,
|
||||
Role: role,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(jwtExpire)),
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
},
|
||||
}
|
||||
@@ -125,6 +134,17 @@ func AuthRequired() gin.HandlerFunc {
|
||||
return
|
||||
}
|
||||
|
||||
// 滑动续期：令牌剩余寿命不足一半时签发新令牌，前端经 X-Renewed-Token 静默替换，
|
||||
// 避免活跃用户在请求间隙令牌过期而"莫名掉线"。
|
||||
if issuedAt := claims.IssuedAt; issuedAt != nil {
|
||||
elapsed := time.Since(issuedAt.Time)
|
||||
if elapsed >= jwtExpire/2 {
|
||||
if renewed, err := GenerateToken(claims.UserID, claims.TenantID, claims.Role); err == nil {
|
||||
c.Header("X-Renewed-Token", renewed)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
c.Set("user_id", claims.UserID)
|
||||
c.Set("tenant_id", claims.TenantID)
|
||||
c.Set("role", claims.Role)
|
||||
|
||||
@@ -0,0 +1,126 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
jwtlib "github.com/golang-jwt/jwt/v5"
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"kefu-cloud/server/internal/model"
|
||||
)
|
||||
|
||||
// setupRenewEnv 初始化测试用 JWT（1 小时）与内存数据库（含可用租户/账号）。
|
||||
func setupRenewEnv(t *testing.T) {
|
||||
t.Helper()
|
||||
InitJWT("renew-test-secret", time.Hour)
|
||||
|
||||
// 每个测试独立命名空间，避免共享内存库的命名冲突
|
||||
dsn := fmt.Sprintf("file:kefu_renew_%d?mode=memory&cache=shared", time.Now().UnixNano())
|
||||
db, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{})
|
||||
if err != nil {
|
||||
t.Fatalf("打开测试数据库失败: %v", err)
|
||||
}
|
||||
if err := model.Migrate(db); err != nil {
|
||||
t.Fatalf("迁移测试数据库失败: %v", err)
|
||||
}
|
||||
model.DB = db
|
||||
t.Cleanup(func() { model.DB = nil })
|
||||
|
||||
tenant := model.Tenant{Name: "续期测试租户", Status: "normal"}
|
||||
if err := db.Create(&tenant).Error; err != nil {
|
||||
t.Fatalf("创建租户失败: %v", err)
|
||||
}
|
||||
user := model.User{TenantID: tenant.ID, Role: "admin", Username: "renew_admin", PasswordHash: "x", Nickname: "续期管理员", Status: "online"}
|
||||
if err := db.Create(&user).Error; err != nil {
|
||||
t.Fatalf("创建用户失败: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// signToken 按指定签发时间生成令牌（jwtExpire 由 setupRenewEnv 设为 1h）。
|
||||
func signToken(userID, tenantID uint, role string, issuedAt time.Time) string {
|
||||
claims := Claims{
|
||||
UserID: userID, TenantID: tenantID, Role: role,
|
||||
RegisteredClaims: jwtlib.RegisteredClaims{
|
||||
IssuedAt: jwtlib.NewNumericDate(issuedAt),
|
||||
ExpiresAt: jwtlib.NewNumericDate(issuedAt.Add(jwtExpire)),
|
||||
},
|
||||
}
|
||||
token := jwtlib.NewWithClaims(jwtlib.SigningMethodHS256, claims)
|
||||
signed, _ := token.SignedString(jwtSecret)
|
||||
return signed
|
||||
}
|
||||
|
||||
func newRenewRouter() *gin.Engine {
|
||||
gin.SetMode(gin.TestMode)
|
||||
r := gin.New()
|
||||
r.Use(AuthRequired())
|
||||
r.GET("/ping", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"code": 0}) })
|
||||
return r
|
||||
}
|
||||
|
||||
func TestAuthRequiredSlidesTokenWhenHalfExpired(t *testing.T) {
|
||||
setupRenewEnv(t)
|
||||
r := newRenewRouter()
|
||||
|
||||
// jwtExpire=1h，签发于 40 分钟前 → 已过半寿命，应滑动续期
|
||||
oldToken := signToken(1, 1, "admin", time.Now().Add(-40*time.Minute))
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+oldToken)
|
||||
r.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
|
||||
}
|
||||
renewed := rec.Header().Get("X-Renewed-Token")
|
||||
if renewed == "" {
|
||||
t.Fatal("超过半寿命的令牌应返回 X-Renewed-Token")
|
||||
}
|
||||
// 新令牌应是全新签发（IssuedAt ≈ 现在），可正常解析且未过期
|
||||
claims, err := ParseToken(renewed)
|
||||
if err != nil {
|
||||
t.Fatalf("续期令牌应可解析: %v", err)
|
||||
}
|
||||
if claims.UserID != 1 || claims.Role != "admin" {
|
||||
t.Fatalf("续期令牌身份不符: %+v", claims)
|
||||
}
|
||||
if time.Since(claims.IssuedAt.Time) > time.Minute {
|
||||
t.Fatalf("续期令牌应为新签发: issuedAt=%v", claims.IssuedAt.Time)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthRequiredDoesNotRenewFreshToken(t *testing.T) {
|
||||
setupRenewEnv(t)
|
||||
r := newRenewRouter()
|
||||
|
||||
freshToken := signToken(1, 1, "admin", time.Now())
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+freshToken)
|
||||
r.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if renewed := rec.Header().Get("X-Renewed-Token"); renewed != "" {
|
||||
t.Fatal("新鲜令牌不应触发续期")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseTokenRejectsGarbage(t *testing.T) {
|
||||
InitJWT("parse-test-secret", time.Hour)
|
||||
if _, err := ParseToken("not-a-token"); err == nil {
|
||||
t.Fatal("无效令牌应解析失败")
|
||||
}
|
||||
if _, err := ParseToken(strings.Repeat("x", 64)); err == nil {
|
||||
t.Fatal("垃圾令牌应解析失败")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user