ocdp v1

backend/internal/pkg/jwt/jwt.go

@@ -0,0 +1,123 @@
+package jwt
+
+import (
+	"fmt"
+	"time"
+	
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	AccessTokenDuration  = 24 * time.Hour      // Access Token 有效期
+	RefreshTokenDuration = 7 * 24 * time.Hour  // Refresh Token 有效期
+)
+
+// JWTManager JWT 管理器
+type JWTManager struct {
+	secretKey string
+}
+
+// NewJWTManager 创建 JWT 管理器
+func NewJWTManager(secretKey string) *JWTManager {
+	return &JWTManager{
+		secretKey: secretKey,
+	}
+}
+
+// Claims JWT Claims
+type Claims struct {
+	UserID   string `json:"user_id"`
+	Username string `json:"username"`
+	jwt.RegisteredClaims
+}
+
+// Generate 生成 Access Token 和 Refresh Token
+func (m *JWTManager) Generate(userID, username string) (accessToken, refreshToken string, err error) {
+	// 生成 Access Token
+	accessClaims := &Claims{
+		UserID:   userID,
+		Username: username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(AccessTokenDuration)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	
+	accessTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
+	accessToken, err = accessTokenObj.SignedString([]byte(m.secretKey))
+	if err != nil {
+		return "", "", fmt.Errorf("failed to sign access token: %w", err)
+	}
+	
+	// 生成 Refresh Token
+	refreshClaims := &Claims{
+		UserID:   userID,
+		Username: username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(RefreshTokenDuration)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	
+	refreshTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
+	refreshToken, err = refreshTokenObj.SignedString([]byte(m.secretKey))
+	if err != nil {
+		return "", "", fmt.Errorf("failed to sign refresh token: %w", err)
+	}
+	
+	return accessToken, refreshToken, nil
+}
+
+// Verify 验证 Token
+func (m *JWTManager) Verify(tokenString string) (userID, username string, err error) {
+	userID, username, _, err = m.VerifyWithIssuedAt(tokenString)
+	return userID, username, err
+}
+
+// VerifyWithIssuedAt 验证 Token 并返回签发时间
+func (m *JWTManager) VerifyWithIssuedAt(tokenString string) (userID, username string, issuedAt int64, err error) {
+	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return []byte(m.secretKey), nil
+	})
+	
+	if err != nil {
+		return "", "", 0, fmt.Errorf("failed to parse token: %w", err)
+	}
+	
+	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
+		return claims.UserID, claims.Username, claims.IssuedAt.Unix(), nil
+	}
+	
+	return "", "", 0, fmt.Errorf("invalid token")
+}
+
+// Refresh 刷新 Token
+func (m *JWTManager) Refresh(refreshToken string) (string, error) {
+	// 验证 Refresh Token
+	userID, username, err := m.Verify(refreshToken)
+	if err != nil {
+		return "", fmt.Errorf("invalid refresh token: %w", err)
+	}
+	
+	// 生成新的 Access Token
+	accessClaims := &Claims{
+		UserID:   userID,
+		Username: username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(AccessTokenDuration)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	
+	accessTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
+	newAccessToken, err := accessTokenObj.SignedString([]byte(m.secretKey))
+	if err != nil {
+		return "", fmt.Errorf("failed to sign new access token: %w", err)
+	}
+	
+	return newAccessToken, nil
+}
+