43 lines
1.5 KiB
JavaScript
43 lines
1.5 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const { getConfig } = require('../db');
|
|
|
|
let cachedSecret = null;
|
|
|
|
function getSecret() {
|
|
if (cachedSecret) return cachedSecret;
|
|
try {
|
|
cachedSecret = getConfig()?.jwt_secret || process.env.JWT_SECRET;
|
|
} catch {}
|
|
if (!cachedSecret) throw new Error('JWT_SECRET not configured');
|
|
return cachedSecret;
|
|
}
|
|
|
|
function generateToken(user) {
|
|
return jwt.sign({ id: user.id, username: user.username, role: user.role, game_name: user.game_name, game_uid: user.game_uid, email: user.email }, getSecret(), { expiresIn: '72h' });
|
|
}
|
|
|
|
function verifyToken(token) { return jwt.verify(token, getSecret()); }
|
|
|
|
function authenticate(req, res, next) {
|
|
const h = req.headers.authorization;
|
|
if (!h || !h.startsWith('Bearer ')) return res.status(401).json({ error: '请先登录' });
|
|
try { req.user = verifyToken(h.split(' ')[1]); next(); }
|
|
catch (e) { return res.status(401).json({ error: e.name === 'TokenExpiredError' ? '登录已过期，请重新登录' : '无效的认证信息' }); }
|
|
}
|
|
|
|
function requireRole(...roles) {
|
|
return (req, res, next) => {
|
|
if (!req.user) return res.status(401).json({ error: '请先登录' });
|
|
if (!roles.includes(req.user.role)) return res.status(403).json({ error: '权限不足' });
|
|
next();
|
|
};
|
|
}
|
|
|
|
function optionalAuth(req, res, next) {
|
|
const h = req.headers.authorization;
|
|
if (h && h.startsWith('Bearer ')) { try { req.user = verifyToken(h.split(' ')[1]); } catch {} }
|
|
next();
|
|
}
|
|
|
|
module.exports = { generateToken, verifyToken, authenticate, requireRole, optionalAuth };
|