|
@@ -6,13 +6,14 @@ import (
|
|
"github.com/go-micro/plugins/v4/auth/jwt"
|
|
"github.com/go-micro/plugins/v4/auth/jwt"
|
|
"github.com/go-redsync/redsync/v4"
|
|
"github.com/go-redsync/redsync/v4"
|
|
"github.com/go-redsync/redsync/v4/redis/goredis/v9"
|
|
"github.com/go-redsync/redsync/v4/redis/goredis/v9"
|
|
|
|
+ "github.com/google/uuid"
|
|
goredislib "github.com/redis/go-redis/v9"
|
|
goredislib "github.com/redis/go-redis/v9"
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/sirupsen/logrus"
|
|
"go-micro.dev/v4/auth"
|
|
"go-micro.dev/v4/auth"
|
|
"os"
|
|
"os"
|
|
"os/signal"
|
|
"os/signal"
|
|
- "sghblog.com/paas/common"
|
|
|
|
- "sghblog.com/paas/common/errorcode"
|
|
|
|
|
|
+ "sghgogs.com/sghblog/common"
|
|
|
|
+ "sghgogs.com/sghblog/common/errorcode"
|
|
"strconv"
|
|
"strconv"
|
|
"strings"
|
|
"strings"
|
|
"sync"
|
|
"sync"
|
|
@@ -26,12 +27,12 @@ var (
|
|
)
|
|
)
|
|
|
|
|
|
const (
|
|
const (
|
|
- expiry = time.Second * time.Duration(0.5*3600)
|
|
|
|
|
|
+ expiry = time.Second * time.Duration(24*3600)
|
|
// expiry = time.Second * time.Duration(1*3600)
|
|
// expiry = time.Second * time.Duration(1*3600)
|
|
)
|
|
)
|
|
|
|
|
|
type JWTAuth struct {
|
|
type JWTAuth struct {
|
|
- mu *redsync.Redsync
|
|
|
|
|
|
+ Mu *redsync.Redsync
|
|
Client *goredislib.Client
|
|
Client *goredislib.Client
|
|
Auth auth.Auth
|
|
Auth auth.Auth
|
|
namespace string
|
|
namespace string
|
|
@@ -61,7 +62,7 @@ func NewJWTAuth(client *goredislib.Client, namespace string, enable bool) *JWTAu
|
|
// lock.
|
|
// lock.
|
|
rs := redsync.New(pool)
|
|
rs := redsync.New(pool)
|
|
JWTAuthService = &JWTAuth{
|
|
JWTAuthService = &JWTAuth{
|
|
- mu: rs,
|
|
|
|
|
|
+ Mu: rs,
|
|
Client: client,
|
|
Client: client,
|
|
Auth: newAuth,
|
|
Auth: newAuth,
|
|
namespace: namespace,
|
|
namespace: namespace,
|
|
@@ -76,7 +77,7 @@ func NewJWTAuth(client *goredislib.Client, namespace string, enable bool) *JWTAu
|
|
// GenerateToken 示例:生成令牌
|
|
// GenerateToken 示例:生成令牌
|
|
func (svc *JWTAuth) GenerateToken(userID int64, provider, withType, secret string, scopes []string, md map[string]string) (*auth.Account, error) {
|
|
func (svc *JWTAuth) GenerateToken(userID int64, provider, withType, secret string, scopes []string, md map[string]string) (*auth.Account, error) {
|
|
var account *auth.Account
|
|
var account *auth.Account
|
|
- lock := svc.mu.NewMutex("generate-token-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("generate-token-lock-%d", userID))
|
|
// 获取锁,保证原子性
|
|
// 获取锁,保证原子性
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return account, err
|
|
return account, err
|
|
@@ -101,7 +102,7 @@ func (svc *JWTAuth) GenerateToken(userID int64, provider, withType, secret strin
|
|
|
|
|
|
func (svc *JWTAuth) RefreshToken(token string) (*auth.Token, error) {
|
|
func (svc *JWTAuth) RefreshToken(token string) (*auth.Token, error) {
|
|
var authToken *auth.Token
|
|
var authToken *auth.Token
|
|
- lock := svc.mu.NewMutex("refresh-generate-token-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex("refresh-generate-token-lock")
|
|
// 获取锁,保证原子性
|
|
// 获取锁,保证原子性
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return authToken, err
|
|
return authToken, err
|
|
@@ -131,7 +132,7 @@ func (svc *JWTAuth) RefreshToken(token string) (*auth.Token, error) {
|
|
// Token 重新刷新token
|
|
// Token 重新刷新token
|
|
func (svc *JWTAuth) Token(userID int64, accessToken string) (*auth.Token, error) {
|
|
func (svc *JWTAuth) Token(userID int64, accessToken string) (*auth.Token, error) {
|
|
var authToken *auth.Token
|
|
var authToken *auth.Token
|
|
- lock := svc.mu.NewMutex("token-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("token-lock-%d", userID))
|
|
// 获取锁,保证原子性
|
|
// 获取锁,保证原子性
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return authToken, err
|
|
return authToken, err
|
|
@@ -147,7 +148,7 @@ func (svc *JWTAuth) Token(userID int64, accessToken string) (*auth.Token, error)
|
|
// Inspect 检测token 有效期
|
|
// Inspect 检测token 有效期
|
|
func (svc *JWTAuth) Inspect(accessToken string) (*auth.Account, error) {
|
|
func (svc *JWTAuth) Inspect(accessToken string) (*auth.Account, error) {
|
|
var account *auth.Account
|
|
var account *auth.Account
|
|
- lock := svc.mu.NewMutex("inspect-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("inspect-lock-%d", uuid.New()))
|
|
// 获取锁,保证原子性
|
|
// 获取锁,保证原子性
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return account, err
|
|
return account, err
|
|
@@ -159,7 +160,7 @@ func (svc *JWTAuth) Inspect(accessToken string) (*auth.Account, error) {
|
|
|
|
|
|
// StoreToken 存储令牌到Redis
|
|
// StoreToken 存储令牌到Redis
|
|
func (svc *JWTAuth) StoreToken(ctx context.Context, ID int64, name, accessToken string) error {
|
|
func (svc *JWTAuth) StoreToken(ctx context.Context, ID int64, name, accessToken string) error {
|
|
- lock := svc.mu.NewMutex("store-token-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("store-token-lock-%d", ID))
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return err
|
|
return err
|
|
@@ -177,7 +178,7 @@ func (svc *JWTAuth) StoreToken(ctx context.Context, ID int64, name, accessToken
|
|
|
|
|
|
// StoreRevoke 从Redis中删除令牌
|
|
// StoreRevoke 从Redis中删除令牌
|
|
func (svc *JWTAuth) StoreRevoke(ctx context.Context, ID int64, name string) error {
|
|
func (svc *JWTAuth) StoreRevoke(ctx context.Context, ID int64, name string) error {
|
|
- lock := svc.mu.NewMutex("store-revoke-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("store-revoke-lock-%d", ID))
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return err
|
|
return err
|
|
@@ -195,7 +196,7 @@ func (svc *JWTAuth) StoreRevoke(ctx context.Context, ID int64, name string) erro
|
|
|
|
|
|
// StoreVerify 检查是否在有效期内
|
|
// StoreVerify 检查是否在有效期内
|
|
func (svc *JWTAuth) StoreVerify(ID int64, name string, accessToken string) bool {
|
|
func (svc *JWTAuth) StoreVerify(ID int64, name string, accessToken string) bool {
|
|
- lock := svc.mu.NewMutex("store-verify-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("store-verify-lock-%d", ID))
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
// 处理获取锁失败的情况
|
|
// 处理获取锁失败的情况
|
|
@@ -207,8 +208,8 @@ func (svc *JWTAuth) StoreVerify(ID int64, name string, accessToken string) bool
|
|
}
|
|
}
|
|
|
|
|
|
// Blacklist 将令牌添加到 Redis 黑名单并设置过期时间。
|
|
// Blacklist 将令牌添加到 Redis 黑名单并设置过期时间。
|
|
-func (svc *JWTAuth) Blacklist(accessToken string, expiration time.Duration) error {
|
|
|
|
- lock := svc.mu.NewMutex("blacklist-lock")
|
|
|
|
|
|
+func (svc *JWTAuth) Blacklist(accessToken string) error {
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("blacklist-lock-%d", uuid.New()))
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
return err
|
|
return err
|
|
@@ -216,12 +217,12 @@ func (svc *JWTAuth) Blacklist(accessToken string, expiration time.Duration) erro
|
|
defer lock.Unlock()
|
|
defer lock.Unlock()
|
|
|
|
|
|
// 将令牌添加到 Redis,并设置过期时间
|
|
// 将令牌添加到 Redis,并设置过期时间
|
|
- return svc.Client.Set(context.Background(), accessToken, "blacklisted", expiration).Err()
|
|
|
|
|
|
+ return svc.Client.Set(context.Background(), accessToken, "blacklisted", expiry).Err()
|
|
}
|
|
}
|
|
|
|
|
|
// IsBlacklisted 检查令牌是否在黑名单中。
|
|
// IsBlacklisted 检查令牌是否在黑名单中。
|
|
func (svc *JWTAuth) IsBlacklisted(accessToken string) (bool, error) {
|
|
func (svc *JWTAuth) IsBlacklisted(accessToken string) (bool, error) {
|
|
- lock := svc.mu.NewMutex("is-blacklisted-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex(fmt.Sprintf("is-blacklisted-lock-%d", uuid.New()))
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
// 处理获取锁失败的情况
|
|
// 处理获取锁失败的情况
|
|
@@ -252,7 +253,7 @@ func (svc *JWTAuth) CleanupExpiredTokens(interval time.Duration) {
|
|
}
|
|
}
|
|
|
|
|
|
func (svc *JWTAuth) cleanupExpiredTokens() {
|
|
func (svc *JWTAuth) cleanupExpiredTokens() {
|
|
- lock := svc.mu.NewMutex("cleanup-expired-tokens-lock")
|
|
|
|
|
|
+ lock := svc.Mu.NewMutex("cleanup-expired-tokens-lock")
|
|
// 获取锁
|
|
// 获取锁
|
|
if err := lock.Lock(); err != nil {
|
|
if err := lock.Lock(); err != nil {
|
|
// 处理获取锁失败的情况
|
|
// 处理获取锁失败的情况
|