feat: update template

internal/middleware/auth.go

@@ -2,47 +2,35 @@ package middleware
 
 import (
 	"context"
+	"errors"
 	"net/http"
+	"server/internal/config"
 	"server/internal/db"
 	"server/internal/db/sqlc"
+	"server/internal/model/auth"
 	"server/internal/pkg/cache"
 	"server/internal/pkg/cache/cachekey"
 	"server/internal/pkg/errs"
 	"server/internal/pkg/httputil"
-	"strings"
 
 	"github.com/go-chi/chi/v5"
-)
-
-const (
-	IsAdminKey contextKey = "is_admin"
+	"github.com/jackc/pgx/v5"
 )
 
 type AuthMiddleware struct {
 	store *db.Store
 	cache *cache.Caches
+	cfg   *config.Config
 }
 
-func NewAuthMiddleware(store *db.Store, cache *cache.Caches) *AuthMiddleware {
+func NewAuthMiddleware(store *db.Store, cache *cache.Caches, cfg *config.Config) *AuthMiddleware {
 	return &AuthMiddleware{
 		cache: cache,
 		store: store,
+		cfg:   cfg,
 	}
 }
 
-func UserIsAdmin(uid int32) bool {
-	if uid == 1 {
-		return true
-	}
-
-	return false
-}
-
-func IsAdmin(ctx context.Context) bool {
-	isAdmin, ok := ctx.Value(IsAdminKey).(bool)
-	return ok && isAdmin
-}
-
 func (m *AuthMiddleware) hasApiPermission(ctx context.Context, uid int32, requestMethod string, requestPath string) (bool, error) {
 	var (
 		apis []sqlc.ListUserApisRow
@@ -72,22 +60,49 @@ func (m *AuthMiddleware) hasApiPermission(ctx context.Context, uid int32, reques
 	return false, nil
 }
 
+func (m *AuthMiddleware) getAuthState(ctx context.Context, id int32) (*sqlc.GetUserAuthStateRow, error) {
+	return cache.GetOrSetJSON[*sqlc.GetUserAuthStateRow](ctx, m.cache, cachekey.UserAuthState(id), m.cfg.JWTConfig.Expire, func() (*sqlc.GetUserAuthStateRow, error) {
+		state, err := m.store.GetUserAuthState(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return &state, nil
+	})
+}
+
 func (m *AuthMiddleware) Middleware(router chi.Router) func(handler http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
 
-			claims, ok := GetClaims(ctx)
-			if !ok || claims.UserID == 0 {
+			userCtx := GetUserContext(ctx)
+
+			if userCtx == nil || userCtx.UserID == 0 {
 				httputil.Fail(w, errs.ErrUnauthorized)
 				return
 			}
 
+			// 判断token version
+			state, err := m.getAuthState(ctx, userCtx.UserID)
+			if err != nil {
+				if errors.Is(err, pgx.ErrNoRows) {
+					httputil.Fail(w, errs.ErrInvalidToken) // 用户被删
+					return
+				}
+				httputil.Fail(w, errs.ErrInternalServer) // 基础设施故障，不杀会话
+				return
+			}
+
+			if state.TokenVersion != userCtx.TokenVersion {
+				httputil.Fail(w, errs.ErrInvalidToken) // 被踢 → 401
+				return
+			}
+
 			// 判断是否有管理员权限
-			isAdmin := UserIsAdmin(claims.UserID)
+			isAdmin := auth.IsAdmin(userCtx.UserID)
+			userCtx.IsAdmin = isAdmin
 
 			if isAdmin {
-				ctx = context.WithValue(ctx, IsAdminKey, isAdmin)
 				next.ServeHTTP(w, r.WithContext(ctx))
 				return
 			}
@@ -97,9 +112,8 @@ func (m *AuthMiddleware) Middleware(router chi.Router) func(handler http.Handler
 			requestMethod := r.Method
 			// https://github.com/go-chi/chi/pull/872
 			api := router.Find(rctx, requestMethod, r.URL.Path)
-			requestPath := strings.TrimPrefix(api, "/api")
 
-			hasPermission, err := m.hasApiPermission(ctx, claims.UserID, requestMethod, requestPath)
+			hasPermission, err := m.hasApiPermission(ctx, userCtx.UserID, requestMethod, api)
 			if err != nil {
 				httputil.Fail(w, err)
 				return