Initial commit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/service/searchaccessser/search_access.go

@@ -0,0 +1,75 @@
+package searchaccessser
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"91porn-server/app/appg"
+	"91porn-server/common/crypt"
+)
+
+const (
+	tokenScope = "video_search_access"
+	tokenTTL   = 10 * time.Minute
+)
+
+// Issue 为搜索结果签发短时效的视频访问凭证。
+func Issue(uid uint64, videoID string, now time.Time) (string, error) {
+	return issue(appg.Conf.Base.JwtKey, uid, videoID, now)
+}
+
+// Validate 校验搜索结果访问凭证，凭证与用户和视频一一绑定。
+func Validate(token string, uid uint64, videoID string, now time.Time) bool {
+	return validate(appg.Conf.Base.JwtKey, token, uid, videoID, now)
+}
+
+func issue(secret string, uid uint64, videoID string, now time.Time) (string, error) {
+	if videoID == "" {
+		return "", errors.New("video id is empty")
+	}
+	return crypt.CreateToken(searchTokenSecret(secret), map[string]interface{}{
+		"scope": tokenScope,
+		"uid":   uid,
+		"vid":   videoID,
+		"iat":   now.Unix(),
+		"exp":   now.Add(tokenTTL).Unix(),
+	})
+}
+
+func validate(secret, token string, uid uint64, videoID string, now time.Time) bool {
+	claims, err := crypt.ParseToken(searchTokenSecret(secret), token)
+	if err != nil {
+		return false
+	}
+	scope, _ := claims["scope"].(string)
+	vid, _ := claims["vid"].(string)
+	tokenUID, uidOK := numberClaim(claims["uid"])
+	expiresAt, expOK := numberClaim(claims["exp"])
+	return scope == tokenScope &&
+		vid == videoID &&
+		uidOK &&
+		tokenUID == int64(uid) &&
+		expOK &&
+		expiresAt >= now.Unix()
+}
+
+func searchTokenSecret(secret string) string {
+	if secret == "" {
+		return ""
+	}
+	return fmt.Sprintf("%s:%s", secret, tokenScope)
+}
+
+func numberClaim(value interface{}) (int64, bool) {
+	switch number := value.(type) {
+	case float64:
+		return int64(number), true
+	case int64:
+		return number, true
+	case int:
+		return int64(number), true
+	default:
+		return 0, false
+	}
+}