124 lines
3.4 KiB
Go
124 lines
3.4 KiB
Go
package jwt
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
const (
|
|
AccessTokenDuration = 24 * time.Hour // Access Token 有效期
|
|
RefreshTokenDuration = 7 * 24 * time.Hour // Refresh Token 有效期
|
|
)
|
|
|
|
// JWTManager JWT 管理器
|
|
type JWTManager struct {
|
|
secretKey string
|
|
}
|
|
|
|
// NewJWTManager 创建 JWT 管理器
|
|
func NewJWTManager(secretKey string) *JWTManager {
|
|
return &JWTManager{
|
|
secretKey: secretKey,
|
|
}
|
|
}
|
|
|
|
// Claims JWT Claims
|
|
type Claims struct {
|
|
UserID string `json:"user_id"`
|
|
Username string `json:"username"`
|
|
jwt.RegisteredClaims
|
|
}
|
|
|
|
// Generate 生成 Access Token 和 Refresh Token
|
|
func (m *JWTManager) Generate(userID, username string) (accessToken, refreshToken string, err error) {
|
|
// 生成 Access Token
|
|
accessClaims := &Claims{
|
|
UserID: userID,
|
|
Username: username,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(AccessTokenDuration)),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
},
|
|
}
|
|
|
|
accessTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
|
|
accessToken, err = accessTokenObj.SignedString([]byte(m.secretKey))
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("failed to sign access token: %w", err)
|
|
}
|
|
|
|
// 生成 Refresh Token
|
|
refreshClaims := &Claims{
|
|
UserID: userID,
|
|
Username: username,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(RefreshTokenDuration)),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
},
|
|
}
|
|
|
|
refreshTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
|
|
refreshToken, err = refreshTokenObj.SignedString([]byte(m.secretKey))
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("failed to sign refresh token: %w", err)
|
|
}
|
|
|
|
return accessToken, refreshToken, nil
|
|
}
|
|
|
|
// Verify 验证 Token
|
|
func (m *JWTManager) Verify(tokenString string) (userID, username string, err error) {
|
|
userID, username, _, err = m.VerifyWithIssuedAt(tokenString)
|
|
return userID, username, err
|
|
}
|
|
|
|
// VerifyWithIssuedAt 验证 Token 并返回签发时间
|
|
func (m *JWTManager) VerifyWithIssuedAt(tokenString string) (userID, username string, issuedAt int64, err error) {
|
|
token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
|
}
|
|
return []byte(m.secretKey), nil
|
|
})
|
|
|
|
if err != nil {
|
|
return "", "", 0, fmt.Errorf("failed to parse token: %w", err)
|
|
}
|
|
|
|
if claims, ok := token.Claims.(*Claims); ok && token.Valid {
|
|
return claims.UserID, claims.Username, claims.IssuedAt.Unix(), nil
|
|
}
|
|
|
|
return "", "", 0, fmt.Errorf("invalid token")
|
|
}
|
|
|
|
// Refresh 刷新 Token
|
|
func (m *JWTManager) Refresh(refreshToken string) (string, error) {
|
|
// 验证 Refresh Token
|
|
userID, username, err := m.Verify(refreshToken)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid refresh token: %w", err)
|
|
}
|
|
|
|
// 生成新的 Access Token
|
|
accessClaims := &Claims{
|
|
UserID: userID,
|
|
Username: username,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(AccessTokenDuration)),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
},
|
|
}
|
|
|
|
accessTokenObj := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
|
|
newAccessToken, err := accessTokenObj.SignedString([]byte(m.secretKey))
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to sign new access token: %w", err)
|
|
}
|
|
|
|
return newAccessToken, nil
|
|
}
|
|
|