temp

internal/shared/middleware/auth.go

@@ -31,6 +31,11 @@ func (m *JWTAuthMiddleware) GetName() string {
 	return "jwt_auth"
 }
 
+// GetExpiresIn 返回JWT过期时间
+func (m *JWTAuthMiddleware) GetExpiresIn() time.Duration {
+	return m.config.JWT.ExpiresIn
+}
+
 // GetPriority 返回中间件优先级
 func (m *JWTAuthMiddleware) GetPriority() int {
 	return 60 // 中等优先级，在日志之后，业务处理之前
@@ -74,6 +79,8 @@ func (m *JWTAuthMiddleware) Handle() gin.HandlerFunc {
 		c.Set("user_id", claims.UserID)
 		c.Set("username", claims.Username)
 		c.Set("email", claims.Email)
+		c.Set("phone", claims.Phone)
+		c.Set("user_type", claims.UserType)
 		c.Set("token_claims", claims)
 
 		c.Next()
@@ -90,6 +97,8 @@ type JWTClaims struct {
 	UserID   string `json:"user_id"`
 	Username string `json:"username"`
 	Email    string `json:"email"`
+	Phone    string `json:"phone"`
+	UserType string `json:"user_type"` // 新增：用户类型
 	jwt.RegisteredClaims
 }
 
@@ -128,13 +137,15 @@ func (m *JWTAuthMiddleware) respondUnauthorized(c *gin.Context, message string)
 }
 
 // GenerateToken 生成JWT token
-func (m *JWTAuthMiddleware) GenerateToken(userID, username, email string) (string, error) {
+func (m *JWTAuthMiddleware) GenerateToken(userID, phone, email, userType string) (string, error) {
 	now := time.Now()
 
 	claims := &JWTClaims{
 		UserID:   userID,
-		Username: username,
+		Username: phone, // 普通用户用手机号，管理员用用户名
 		Email:    email,
+		Phone:    phone,
+		UserType: userType, // 新增：用户类型
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    "tyapi-server",
 			Subject:   userID,
@@ -249,6 +260,8 @@ func (m *OptionalAuthMiddleware) Handle() gin.HandlerFunc {
 		c.Set("user_id", claims.UserID)
 		c.Set("username", claims.Username)
 		c.Set("email", claims.Email)
+		c.Set("phone", claims.Phone)
+		c.Set("user_type", claims.UserType)
 		c.Set("token_claims", claims)
 
 		c.Next()
@@ -259,3 +272,108 @@ func (m *OptionalAuthMiddleware) Handle() gin.HandlerFunc {
 func (m *OptionalAuthMiddleware) IsGlobal() bool {
 	return false
 }
+
+// AdminAuthMiddleware 管理员认证中间件
+type AdminAuthMiddleware struct {
+	jwtAuth *JWTAuthMiddleware
+	logger  *zap.Logger
+}
+
+// NewAdminAuthMiddleware 创建管理员认证中间件
+func NewAdminAuthMiddleware(jwtAuth *JWTAuthMiddleware, logger *zap.Logger) *AdminAuthMiddleware {
+	return &AdminAuthMiddleware{
+		jwtAuth: jwtAuth,
+		logger:  logger,
+	}
+}
+
+// GetName 返回中间件名称
+func (m *AdminAuthMiddleware) GetName() string {
+	return "admin_auth"
+}
+
+// GetPriority 返回中间件优先级
+func (m *AdminAuthMiddleware) GetPriority() int {
+	return 60 // 与JWT认证中间件相同
+}
+
+// Handle 管理员认证处理
+func (m *AdminAuthMiddleware) Handle() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// 首先进行JWT认证
+		authHeader := c.GetHeader("Authorization")
+		if authHeader == "" {
+			m.respondUnauthorized(c, "缺少认证头部")
+			return
+		}
+
+		// 检查Bearer前缀
+		const bearerPrefix = "Bearer "
+		if !strings.HasPrefix(authHeader, bearerPrefix) {
+			m.respondUnauthorized(c, "认证头部格式无效")
+			return
+		}
+
+		// 提取token
+		tokenString := authHeader[len(bearerPrefix):]
+		if tokenString == "" {
+			m.respondUnauthorized(c, "缺少认证令牌")
+			return
+		}
+
+		// 验证token
+		claims, err := m.jwtAuth.validateToken(tokenString)
+		if err != nil {
+			m.logger.Warn("无效的认证令牌",
+				zap.Error(err),
+				zap.String("request_id", c.GetString("request_id")))
+			m.respondUnauthorized(c, "认证令牌无效")
+			return
+		}
+
+		// 检查用户类型是否为管理员
+		if claims.UserType != "admin" {
+			m.respondForbidden(c, "需要管理员权限")
+			return
+		}
+
+		// 设置用户信息到上下文
+		c.Set("user_id", claims.UserID)
+		c.Set("username", claims.Username)
+		c.Set("email", claims.Email)
+		c.Set("phone", claims.Phone)
+		c.Set("user_type", claims.UserType)
+		c.Set("token_claims", claims)
+
+		c.Next()
+	}
+}
+
+// IsGlobal 是否为全局中间件
+func (m *AdminAuthMiddleware) IsGlobal() bool {
+	return false
+}
+
+// respondForbidden 返回禁止访问响应
+func (m *AdminAuthMiddleware) respondForbidden(c *gin.Context, message string) {
+	c.JSON(http.StatusForbidden, gin.H{
+		"success":    false,
+		"message":    "权限不足",
+		"error":      message,
+		"request_id": c.GetString("request_id"),
+		"timestamp":  time.Now().Unix(),
+	})
+	c.Abort()
+}
+
+// respondUnauthorized 返回未授权响应
+func (m *AdminAuthMiddleware) respondUnauthorized(c *gin.Context, message string) {
+	c.JSON(http.StatusUnauthorized, gin.H{
+		"success":    false,
+		"message":    "认证失败",
+		"error":      message,
+		"request_id": c.GetString("request_id"),
+		"timestamp":  time.Now().Unix(),
+	})
+	c.Abort()
+}