package com.talentcard.server.business.auth;
|
|
import java.nio.charset.StandardCharsets;
|
import java.security.MessageDigest;
|
import java.security.SecureRandom;
|
import java.time.LocalDateTime;
|
import java.util.Base64;
|
import java.util.LinkedHashMap;
|
import java.util.List;
|
import java.util.Map;
|
|
import com.talentcard.server.business.DatabaseRows;
|
import com.talentcard.server.common.BusinessException;
|
import com.talentcard.server.common.ErrorCode;
|
import org.springframework.jdbc.core.JdbcTemplate;
|
import org.springframework.stereotype.Service;
|
import org.springframework.transaction.annotation.Transactional;
|
|
@Service
|
public class TalentAuthService {
|
|
private static final SecureRandom RANDOM = new SecureRandom();
|
private static final int ACCESS_TOKEN_HOURS = 2;
|
private static final int REFRESH_TOKEN_DAYS = 30;
|
|
private final JdbcTemplate jdbc;
|
private final WeChatMiniProgramClient weChat;
|
|
public TalentAuthService(JdbcTemplate jdbc, WeChatMiniProgramClient weChat) {
|
this.jdbc = jdbc;
|
this.weChat = weChat;
|
}
|
|
@Transactional
|
public Map<String, Object> login(TalentLoginRequest request) {
|
String openId = weChat.exchangeOpenId(request.wechatCode());
|
String mobile = weChat.exchangePhoneNumber(request.phoneCode());
|
return establishSession(openId, mobile);
|
}
|
|
@Transactional
|
public Map<String, Object> createDevelopmentSession(long talentId) {
|
List<Map<String, Object>> talents = rows("""
|
select id, openid, status
|
from talent_user
|
where id = ? and deleted = 0
|
limit 1 for update
|
""", talentId);
|
if (talents.isEmpty()) throw new BusinessException(ErrorCode.NOT_FOUND, "开发测试人才账号不存在");
|
if (number(talents.get(0).get("status")) != 1) {
|
throw new BusinessException(ErrorCode.FORBIDDEN, "持卡人被停用");
|
}
|
Object openId = talents.get(0).get("openid");
|
if (openId == null || String.valueOf(openId).isBlank()) {
|
throw new BusinessException(ErrorCode.CONFLICT, "开发测试人才账号未配置微信标识");
|
}
|
return issueSession(talentId);
|
}
|
|
@Transactional
|
public Map<String, Object> refresh(TalentRefreshRequest request) {
|
List<Map<String, Object>> sessions = rows("""
|
select s.id, s.talent_id
|
from talent_session s
|
join talent_user t on t.id = s.talent_id and t.deleted = 0 and t.status = 1
|
where s.refresh_token_hash = ? and s.revoked_at is null and s.refresh_expires_at > now()
|
limit 1 for update
|
""", sha256(request.refreshToken().trim()));
|
if (sessions.isEmpty()) throw new BusinessException(ErrorCode.UNAUTHORIZED, "登录已失效，请重新登录");
|
Map<String, Object> session = sessions.get(0);
|
String accessToken = token();
|
String refreshToken = token();
|
LocalDateTime accessExpiresAt = LocalDateTime.now().plusHours(ACCESS_TOKEN_HOURS);
|
LocalDateTime refreshExpiresAt = LocalDateTime.now().plusDays(REFRESH_TOKEN_DAYS);
|
jdbc.update("""
|
update talent_session
|
set access_token_hash = ?, refresh_token_hash = ?, access_expires_at = ?, refresh_expires_at = ?, last_used_at = now()
|
where id = ?
|
""", sha256(accessToken), sha256(refreshToken), accessExpiresAt, refreshExpiresAt, session.get("id"));
|
return sessionResult(number(session.get("talentId")), accessToken, refreshToken, accessExpiresAt);
|
}
|
|
@Transactional
|
public Map<String, Object> logout(String authorization) {
|
String token = bearerToken(authorization);
|
if (!token.isBlank()) {
|
jdbc.update("update talent_session set revoked_at = coalesce(revoked_at, now()) where access_token_hash = ?", sha256(token));
|
}
|
return Map.of("loggedOut", true);
|
}
|
|
@Transactional(readOnly = true)
|
public TalentSessionPrincipal authenticate(String authorization) {
|
String token = bearerToken(authorization);
|
if (token.isBlank()) throw new BusinessException(ErrorCode.UNAUTHORIZED, "请先登录");
|
List<Map<String, Object>> sessions = rows("""
|
select s.talent_id
|
from talent_session s
|
join talent_user t on t.id = s.talent_id and t.deleted = 0 and t.status = 1
|
where s.access_token_hash = ? and s.revoked_at is null and s.access_expires_at > now()
|
limit 1
|
""", sha256(token));
|
if (sessions.isEmpty()) throw new BusinessException(ErrorCode.UNAUTHORIZED, "登录已失效，请重新登录");
|
return new TalentSessionPrincipal(number(sessions.get(0).get("talentId")));
|
}
|
|
private Map<String, Object> establishSession(String openId, String mobile) {
|
List<Map<String, Object>> talents = rows("""
|
select id, openid, status
|
from talent_user
|
where mobile = ? and deleted = 0
|
limit 1 for update
|
""", mobile);
|
if (talents.isEmpty()) return issueSession(registerVisitor(openId, mobile));
|
Map<String, Object> talent = talents.get(0);
|
if (number(talent.get("status")) != 1) {
|
throw new BusinessException(ErrorCode.FORBIDDEN, "持卡人被停用");
|
}
|
long talentId = number(talent.get("id"));
|
List<Map<String, Object>> binding = rows("""
|
select t.id,
|
exists(select 1 from talent_card c where c.talent_id = t.id and c.deleted = 0 and c.card_type = 'PERSONAL') has_talent_card
|
from talent_user t
|
where t.openid = ? and t.deleted = 0
|
limit 1 for update
|
""", openId);
|
if (!binding.isEmpty() && number(binding.get(0).get("id")) != talentId) {
|
if (number(binding.get(0).get("hasTalentCard")) != 0) {
|
throw new BusinessException(ErrorCode.CONFLICT, "当前微信已绑定其他人才账号，请联系管理员");
|
}
|
jdbc.update("update talent_user set openid = null where id = ?", number(binding.get(0).get("id")));
|
}
|
jdbc.update("update talent_user set openid = ? where id = ?", openId, talentId);
|
return issueSession(talentId);
|
}
|
|
private long registerVisitor(String openId, String mobile) {
|
List<Map<String, Object>> bindings = rows("""
|
select id
|
from talent_user
|
where openid = ? and deleted = 0 and status = 1
|
limit 1 for update
|
""", openId);
|
if (!bindings.isEmpty()) {
|
long talentId = number(bindings.get(0).get("id"));
|
jdbc.update("update talent_user set mobile = ? where id = ?", mobile, talentId);
|
return talentId;
|
}
|
jdbc.update("""
|
insert into talent_user(openid, name, mobile, talent_level, source_area_type, status)
|
values (?, '普通游客', ?, '普通游客', 'LOCAL', 1)
|
""", openId, mobile);
|
Long talentId = jdbc.queryForObject("select last_insert_id()", Long.class);
|
if (talentId == null) throw new BusinessException(ErrorCode.INTERNAL_ERROR, "普通游客注册失败");
|
return talentId;
|
}
|
|
private Map<String, Object> issueSession(long talentId) {
|
jdbc.update("update talent_session set revoked_at = now() where talent_id = ? and revoked_at is null", talentId);
|
|
String accessToken = token();
|
String refreshToken = token();
|
LocalDateTime accessExpiresAt = LocalDateTime.now().plusHours(ACCESS_TOKEN_HOURS);
|
LocalDateTime refreshExpiresAt = LocalDateTime.now().plusDays(REFRESH_TOKEN_DAYS);
|
jdbc.update("""
|
insert into talent_session(talent_id, access_token_hash, refresh_token_hash, access_expires_at, refresh_expires_at, last_used_at)
|
values (?, ?, ?, ?, ?, now())
|
""", talentId, sha256(accessToken), sha256(refreshToken), accessExpiresAt, refreshExpiresAt);
|
return sessionResult(talentId, accessToken, refreshToken, accessExpiresAt);
|
}
|
|
private Map<String, Object> sessionResult(long talentId, String accessToken, String refreshToken, LocalDateTime accessExpiresAt) {
|
Map<String, Object> result = new LinkedHashMap<>();
|
result.put("talentId", talentId);
|
result.put("accessToken", accessToken);
|
result.put("refreshToken", refreshToken);
|
result.put("expireAt", accessExpiresAt.atZone(java.time.ZoneId.of("Asia/Shanghai")).toInstant().toEpochMilli());
|
return result;
|
}
|
|
private String token() {
|
byte[] bytes = new byte[32];
|
RANDOM.nextBytes(bytes);
|
return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
|
}
|
|
private String bearerToken(String authorization) {
|
return authorization == null ? "" : authorization.replaceFirst("(?i)^Bearer\\s+", "").trim();
|
}
|
|
private String sha256(String value) {
|
try {
|
byte[] digest = MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8));
|
StringBuilder result = new StringBuilder();
|
for (byte item : digest) result.append(String.format("%02x", item));
|
return result.toString();
|
} catch (Exception exception) {
|
throw new IllegalStateException("Unable to process session token", exception);
|
}
|
}
|
|
private List<Map<String, Object>> rows(String sql, Object... args) {
|
return DatabaseRows.normalize(jdbc.queryForList(sql, args));
|
}
|
|
private long number(Object value) {
|
if (value instanceof Number number) return number.longValue();
|
try { return Long.parseLong(String.valueOf(value)); } catch (Exception exception) { throw new BusinessException(ErrorCode.INTERNAL_ERROR, "人才会话数据异常"); }
|
}
|
}
|
