291 lines
8.3 KiB
Go
291 lines
8.3 KiB
Go
package authser
|
||
|
||
import (
|
||
"encoding/json"
|
||
"fmt"
|
||
"io"
|
||
"net/http"
|
||
"net/url"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
"videoweb/app/service/upstream"
|
||
"videoweb/pub/common/useragent"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
const (
|
||
registerPath = "/api/app/auth/register"
|
||
loginPath = "/api/app/auth/login"
|
||
resetPath = "/api/app/auth/resetPassword"
|
||
guestPath = "/api/app/auth/guest"
|
||
getInfoPath = "/api/app/auth/getInfo"
|
||
profilePath = "/api/app/auth/profile"
|
||
uploadPath = "/api/app/upload/image"
|
||
cookieMaxAge = 7 * 24 * 3600
|
||
)
|
||
|
||
// Register 调用上游注册接口。
|
||
func Register(c *gin.Context, req RegisterReq) (*APIEnvelope, *LoginResp, error) {
|
||
var env APIEnvelope
|
||
if _, err := upstream.PostJSON(c, registerPath, req, &env); err != nil {
|
||
return nil, nil, err
|
||
}
|
||
if env.Code != 200 {
|
||
return &env, nil, nil
|
||
}
|
||
user, err := decodeLoginData(env.Data)
|
||
if err != nil {
|
||
return &env, nil, err
|
||
}
|
||
return &env, user, nil
|
||
}
|
||
|
||
// ResetPassword 通过账号和邮箱校验后重置密码。
|
||
func ResetPassword(c *gin.Context, req ResetPasswordReq) (*APIEnvelope, error) {
|
||
var env APIEnvelope
|
||
if _, err := upstream.PostJSON(c, resetPath, req, &env); err != nil {
|
||
return nil, err
|
||
}
|
||
return &env, nil
|
||
}
|
||
|
||
// Login 调用上游登录接口。
|
||
func Login(c *gin.Context, req LoginReq) (*APIEnvelope, *LoginResp, error) {
|
||
var env APIEnvelope
|
||
if _, err := upstream.PostJSON(c, loginPath, req, &env); err != nil {
|
||
return nil, nil, err
|
||
}
|
||
if env.Code != 200 {
|
||
return &env, nil, nil
|
||
}
|
||
user, err := decodeLoginData(env.Data)
|
||
if err != nil {
|
||
return &env, nil, err
|
||
}
|
||
return &env, user, nil
|
||
}
|
||
|
||
// GuestLogin 调用上游游客登录（按设备 ID 创建或找回游客账号）。
|
||
func GuestLogin(c *gin.Context, req GuestLoginReq) (*APIEnvelope, *LoginResp, error) {
|
||
var env APIEnvelope
|
||
if _, err := upstream.PostJSON(c, guestPath, req, &env); err != nil {
|
||
return nil, nil, err
|
||
}
|
||
if env.Code != 200 {
|
||
return &env, nil, nil
|
||
}
|
||
user, err := decodeLoginData(env.Data)
|
||
if err != nil {
|
||
return &env, nil, err
|
||
}
|
||
return &env, user, nil
|
||
}
|
||
|
||
// GetInfo 通过 token 拉取最新用户信息。
|
||
func GetInfo(c *gin.Context) (*APIEnvelope, *LoginResp, error) {
|
||
var env APIEnvelope
|
||
if err := upstream.GetJSON(c, getInfoPath, &env); err != nil {
|
||
return nil, nil, err
|
||
}
|
||
if env.Code != 200 {
|
||
return &env, nil, nil
|
||
}
|
||
user, err := decodeLoginData(env.Data)
|
||
if err != nil {
|
||
return &env, nil, err
|
||
}
|
||
return &env, user, nil
|
||
}
|
||
|
||
// UpdateProfile 修改资料（昵称 / 头像等）。
|
||
func UpdateProfile(c *gin.Context, req UpdateProfileReq) (*APIEnvelope, error) {
|
||
var env APIEnvelope
|
||
if _, err := upstream.PostJSON(c, profilePath, req, &env); err != nil {
|
||
return nil, err
|
||
}
|
||
return &env, nil
|
||
}
|
||
|
||
// UploadImage 上传图片；头像场景不加水印。
|
||
func UploadImage(c *gin.Context, fileName string, r io.Reader) (*ImageUploadResp, error) {
|
||
var resp ImageUploadResp
|
||
_, err := upstream.PostMultipart(c, uploadPath, map[string]string{
|
||
"watermark": "0",
|
||
}, &upstream.MultipartFile{
|
||
FieldName: "file",
|
||
FileName: fileName,
|
||
Reader: r,
|
||
}, &resp)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return &resp, nil
|
||
}
|
||
|
||
func decodeLoginData(raw json.RawMessage) (*LoginResp, error) {
|
||
if len(raw) == 0 || string(raw) == "null" || string(raw) == `""` {
|
||
return nil, fmt.Errorf("empty login data")
|
||
}
|
||
var user LoginResp
|
||
if err := json.Unmarshal(raw, &user); err != nil {
|
||
return nil, err
|
||
}
|
||
return &user, nil
|
||
}
|
||
|
||
// SetAuthCookies 只持久化 SSR 与前端登录态实际依赖的字段。
|
||
// 个人简介、邮箱、邀请码、展示卡信息由 getInfo 即时提供，不再随每个页面响应重复写入；
|
||
// sid 已存在于请求时也无需原样回写。ClearAuthCookies 仍保留这些历史键用于兼容清理。
|
||
func SetAuthCookies(c *gin.Context, user *LoginResp) {
|
||
if c == nil || user == nil {
|
||
return
|
||
}
|
||
secure := c.Request != nil && c.Request.TLS != nil
|
||
if strings.TrimSpace(user.Token) != "" {
|
||
setCookie(c, "token", user.Token, secure)
|
||
}
|
||
setCookie(c, "userId", strconv.FormatInt(user.UserID, 10), secure)
|
||
setCookie(c, "accountNo", user.AccountNo, secure)
|
||
setCookie(c, "nickName", user.NickName, secure)
|
||
setCookie(c, "avatar", user.Avatar, secure)
|
||
setCookie(c, "recharge", strconv.FormatInt(user.Recharge, 10), secure)
|
||
setCookie(c, "vipType", strconv.Itoa(user.VipType), secure)
|
||
setCookie(c, "currentVipExpire", user.CurrentVipExpire, secure)
|
||
setCookie(c, "userType", strconv.Itoa(user.Type), secure)
|
||
isReg := "0"
|
||
if user.IsRegister || user.Type == 1 {
|
||
isReg = "1"
|
||
}
|
||
setCookie(c, "isRegister", isReg, secure)
|
||
// 后续 SSR 服务必须能立即读取本次刚建立/刷新的会话；同时记录为本请求的
|
||
// 权威结果，避免 HTML 渲染阶段再次调用 getInfo 并重复写整套 Cookie。
|
||
patchAuthCookiesToRequest(c, user)
|
||
rememberRequestAuthUser(c, user)
|
||
}
|
||
|
||
func setCookie(c *gin.Context, name, value string, secure bool) {
|
||
// Cookie Value 仅允许 ASCII；中文昵称等需 URL 编码。
|
||
// 使用 PathEscape（空格→%20），与前端 encodeURIComponent 一致；
|
||
// 避免 QueryEscape 的空格→+，否则 JS decodeURIComponent 会留下字面量 "+"。
|
||
writeCookie(c, &http.Cookie{
|
||
Name: name,
|
||
Value: url.PathEscape(value),
|
||
Path: "/",
|
||
MaxAge: cookieMaxAge,
|
||
HttpOnly: false,
|
||
Secure: secure,
|
||
SameSite: http.SameSiteLaxMode,
|
||
Expires: time.Now().Add(7 * 24 * time.Hour),
|
||
})
|
||
}
|
||
|
||
// writeCookie 对同一响应中同名、同 Path、同 Domain 的 Cookie 做 upsert，避免会话恢复的
|
||
// 「先清除、再重建」产生两套响应头，同时保留其他作用域下可能存在的同名 Cookie。
|
||
func writeCookie(c *gin.Context, cookie *http.Cookie) {
|
||
if c == nil || c.Writer == nil || cookie == nil || cookie.Name == "" {
|
||
return
|
||
}
|
||
header := c.Writer.Header()
|
||
existing := header.Values("Set-Cookie")
|
||
if len(existing) > 0 {
|
||
header.Del("Set-Cookie")
|
||
for _, raw := range existing {
|
||
if sameCookieScope(raw, cookie) {
|
||
continue
|
||
}
|
||
header.Add("Set-Cookie", raw)
|
||
}
|
||
}
|
||
http.SetCookie(c.Writer, cookie)
|
||
}
|
||
|
||
func sameCookieScope(raw string, target *http.Cookie) bool {
|
||
response := &http.Response{Header: http.Header{"Set-Cookie": []string{raw}}}
|
||
for _, existing := range response.Cookies() {
|
||
if existing.Name == target.Name && existing.Path == target.Path && strings.EqualFold(existing.Domain, target.Domain) {
|
||
return true
|
||
}
|
||
}
|
||
return false
|
||
}
|
||
|
||
func cookieValue(c *gin.Context, name string) string {
|
||
ck, err := c.Request.Cookie(name)
|
||
if err != nil || ck == nil {
|
||
return ""
|
||
}
|
||
raw := strings.TrimSpace(ck.Value)
|
||
if raw == "" {
|
||
return ""
|
||
}
|
||
// QueryUnescape 同时兼容历史 QueryEscape（+）与 PathEscape（%20）
|
||
if decoded, err := url.QueryUnescape(raw); err == nil {
|
||
return strings.TrimSpace(decoded)
|
||
}
|
||
return raw
|
||
}
|
||
|
||
// ClearAuthCookies 清除登录相关 cookie。
|
||
func ClearAuthCookies(c *gin.Context) {
|
||
forgetRequestAuthUser(c)
|
||
for _, name := range authCookieNames() {
|
||
writeCookie(c, &http.Cookie{
|
||
Name: name,
|
||
Value: "",
|
||
Path: "/",
|
||
MaxAge: -1,
|
||
HttpOnly: false,
|
||
SameSite: http.SameSiteLaxMode,
|
||
})
|
||
}
|
||
}
|
||
|
||
func authCookieNames() []string {
|
||
return []string{
|
||
"token", "_token_", "sid", "_s_token_",
|
||
"userId", "accountNo", "nickName", "introduction", "avatar",
|
||
"email", "inviteCode", "recharge", "vipType", "currentVipExpire", "showCardId", "showCardName",
|
||
"userType", "isRegister",
|
||
}
|
||
}
|
||
|
||
// AuthFromCookies 从 cookie 读取登录态，供 SSR 头部 / 个人中心展示。
|
||
func AuthFromCookies(c *gin.Context) (loggedIn bool, userName, avatar, email string) {
|
||
token := useragent.TokenFromRequest(c.Request)
|
||
if token == "" {
|
||
return false, "", "", ""
|
||
}
|
||
userName = cookieValue(c, "nickName")
|
||
if userName == "" {
|
||
userName = cookieValue(c, "accountNo")
|
||
}
|
||
avatar = usableAvatarURL(cookieValue(c, "avatar"))
|
||
email = cookieValue(c, "email")
|
||
return true, userName, avatar, email
|
||
}
|
||
|
||
// IsRegisteredFromCookies 是否正式注册账号（非游客）。
|
||
func IsRegisteredFromCookies(c *gin.Context) bool {
|
||
if useragent.TokenFromRequest(c.Request) == "" {
|
||
return false
|
||
}
|
||
if cookieValue(c, "isRegister") == "1" {
|
||
return true
|
||
}
|
||
return cookieValue(c, "userType") == "1"
|
||
}
|
||
|
||
func usableAvatarURL(raw string) string {
|
||
raw = strings.TrimSpace(raw)
|
||
if raw == "" {
|
||
return ""
|
||
}
|
||
if strings.HasPrefix(raw, "http://") || strings.HasPrefix(raw, "https://") || strings.HasPrefix(raw, "/static/") {
|
||
return raw
|
||
}
|
||
// 无域名的相对路径暂不可用（解密拉取需要完整 URL）
|
||
return ""
|
||
}
|