初始化

API/internal/security/web_token.go

@@ -0,0 +1,47 @@
+package security
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type WebClaims struct {
+	UserID         string `json:"user_id"`
+	UID            string `json:"uid"`
+	Username       string `json:"username"`
+	SessionVersion int64  `json:"session_version"`
+	TokenType      string `json:"token_type"`
+	jwt.RegisteredClaims
+}
+
+type WebTokenService struct {
+	Secret    []byte
+	AccessTTL time.Duration
+}
+
+func (s WebTokenService) NewAccessToken(userID, uid, username string, sessionVersion int64) (string, time.Time, error) {
+	now := time.Now()
+	expires := now.Add(s.AccessTTL)
+	claims := WebClaims{
+		UserID: userID, UID: uid, Username: username, SessionVersion: sessionVersion, TokenType: "web_access",
+		RegisteredClaims: jwt.RegisteredClaims{Subject: userID, IssuedAt: jwt.NewNumericDate(now), ExpiresAt: jwt.NewNumericDate(expires)},
+	}
+	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(s.Secret)
+	return token, expires, err
+}
+
+func (s WebTokenService) ParseAccessToken(raw string) (*WebClaims, error) {
+	claims := new(WebClaims)
+	token, err := jwt.ParseWithClaims(raw, claims, func(token *jwt.Token) (any, error) {
+		if token.Method != jwt.SigningMethodHS256 {
+			return nil, errors.New("不支持的签名算法")
+		}
+		return s.Secret, nil
+	})
+	if err != nil || !token.Valid || claims.TokenType != "web_access" {
+		return nil, errors.New("登录凭证无效或已过期")
+	}
+	return claims, nil
+}