Files
sundynix-pets/pets-be/internal/router/router.go
T
Blizzard 9adafb1354 feat(auth): access token 缩到 2 小时 + refresh token 机制
后台登录框原来预填了 sundynix/sundynix,等于把凭证写在页面上,去掉。

令牌改为 access(2h) + refresh 两段式:
- 新表 sundynix_refresh_tokens,只存 sha256,明文只在签发时返回一次
- 有效期:小程序 30 天、后台 7 天
- 新接口 /api/auth/refresh|logout、/api/admin/refresh|logout

安全约定:
- 每次续期都轮换刷新令牌,旧的立即作废
- 作废后 60 秒内再到达算并发重试放行,超过则判定泄露、吊销该账号全部会话
- 主动退出与被连坐吊销的令牌不吃宽限期,否则「吊销全部」形同虚设
- 禁用用户时一并吊销刷新令牌,最多 2 小时彻底失去访问

两端请求层都做了单飞续期:并发请求同时 401 只发一次 refresh,
否则刷新令牌会被并发轮换掉互相打架。小程序续期失败回退 wx.login,
登录/续期请求标 noAuthRetry,避免登录失败(同样返回 40100)触发自我套娃。

顺带修掉 vite 代理仍指向 8080 的遗留(端口早已改 9090)。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-29 09:38:19 +08:00

157 lines
4.8 KiB
Go

package router
import (
"github.com/gin-gonic/gin"
"github.com/sundynix/pets-be/internal/admin"
"github.com/sundynix/pets-be/internal/handler"
"github.com/sundynix/pets-be/internal/middleware"
appjwt "github.com/sundynix/pets-be/pkg/jwt"
"github.com/sundynix/pets-be/pkg/response"
)
// New 组装 gin 引擎与所有路由
func New(h *handler.Handler, jm *appjwt.Manager, mode string) *gin.Engine {
gin.SetMode(mode)
r := gin.New()
r.Use(gin.Logger(), gin.Recovery(), middleware.CORS())
// 健康检查
r.GET("/api/ping", func(c *gin.Context) { response.OK(c, gin.H{"pong": true}) })
// 根路径跳转后台
r.GET("/", func(c *gin.Context) { c.Redirect(302, "/admin/") })
api := r.Group("/api")
registerAuth(api, h)
registerUserAPI(api, h, jm)
registerAdminAPI(api, h, jm)
// 内嵌后台 SPA
admin.Register(r)
return r
}
func registerAuth(api *gin.RouterGroup, h *handler.Handler) {
auth := api.Group("/auth")
auth.POST("/login", h.Login)
auth.POST("/wechat", h.WechatLogin)
// 刷新/退出走刷新令牌,不需要(也不可能带)有效的 access token
auth.POST("/refresh", h.RefreshToken)
auth.POST("/logout", h.Logout)
}
// 小程序用户接口(需 user JWT)
func registerUserAPI(api *gin.RouterGroup, h *handler.Handler, jm *appjwt.Manager) {
g := api.Group("")
g.Use(middleware.AuthUser(jm))
g.GET("/user/profile", h.Profile)
g.PUT("/user/profile", h.UpdateProfile)
g.GET("/user/summary", h.UserSummary)
g.GET("/pets", h.ListPets)
g.POST("/pets", h.CreatePet)
g.POST("/onboarding", h.Onboarding)
g.GET("/pets/:id", h.GetPet)
g.PUT("/pets/:id", h.UpdatePet)
g.DELETE("/pets/:id", h.DeletePet)
g.GET("/pets/:id/records", h.ListRecords)
g.POST("/pets/:id/records", h.CreateRecord)
g.GET("/pets/:id/records/weight-trend", h.WeightTrend)
g.DELETE("/records/:id", h.DeleteRecord)
g.GET("/pets/:id/tasks", h.ListTasks)
g.POST("/pets/:id/tasks", h.CreateTask)
g.POST("/pets/:id/tasks/complete-all", h.CompleteAllTasks)
g.POST("/tasks/:id/toggle", h.ToggleTask)
g.PUT("/tasks/:id", h.UpdateTask)
g.DELETE("/tasks/:id", h.DeleteTask)
g.GET("/pets/:id/home-summary", h.HomeSummary)
g.GET("/pets/:id/plan", h.GetPlan)
g.GET("/pets/:id/plan/calendar", h.PlanCalendar)
g.GET("/pets/:id/day-plan", h.DayPlan)
g.POST("/pets/:id/ai-plan", h.CreateAIPlan)
g.POST("/ai-plan/:id/apply", h.ApplyAIPlan)
g.POST("/plan-tasks/:id/toggle", h.TogglePlanTask)
g.GET("/pets/:id/reminders", h.ListReminders)
g.POST("/pets/:id/reminders", h.CreateReminder)
g.PUT("/reminders/:id", h.UpdateReminder)
g.DELETE("/reminders/:id", h.DeleteReminder)
g.GET("/pets/:id/report/weekly", h.WeeklyReport)
g.GET("/pets/:id/bill", h.Bill)
g.GET("/pets/:id/health-summary", h.HealthSummary)
g.GET("/pets/:id/poster", h.Poster)
g.POST("/users/:id/follow", h.FollowUser)
g.DELETE("/users/:id/follow", h.UnfollowUser)
g.GET("/posts", h.ListPosts)
g.POST("/posts", h.CreatePost)
g.GET("/posts/:id", h.GetPost)
g.POST("/posts/:id/like", h.LikePost)
g.DELETE("/posts/:id/like", h.UnlikePost)
g.GET("/posts/:id/comments", h.ListComments)
g.POST("/posts/:id/comments", h.CreateComment)
g.DELETE("/posts/:id", h.DeleteOwnPost)
g.DELETE("/comments/:id", h.DeleteOwnComment)
g.GET("/articles", h.ListArticles)
g.POST("/feedback", h.CreateFeedback)
g.GET("/articles/:id", h.GetArticle)
g.GET("/pro", h.GetPro)
g.POST("/pro/activate", h.ActivatePro)
g.POST("/ai/chat", h.AIChat)
g.GET("/ai/messages", h.ListAIMessages)
g.POST("/pets/:id/ai/assess-symptom", h.AssessSymptom)
g.POST("/upload", h.Upload)
}
// 后台接口(登录开放,其余需 admin JWT)
func registerAdminAPI(api *gin.RouterGroup, h *handler.Handler, jm *appjwt.Manager) {
api.POST("/admin/login", h.AdminLogin)
api.POST("/admin/refresh", h.AdminRefresh)
api.POST("/admin/logout", h.AdminLogout)
g := api.Group("/admin")
g.Use(middleware.AuthAdmin(jm))
g.GET("/me", h.AdminMe)
g.GET("/stats", h.AdminStats)
g.GET("/users", h.AdminListUsers)
g.PUT("/users/:id/disabled", h.AdminSetUserDisabled)
g.GET("/pets", h.AdminListPets)
g.GET("/posts", h.AdminListPosts)
g.PUT("/posts/:id/status", h.AdminSetPostStatus)
g.GET("/comments", h.AdminListComments)
g.DELETE("/comments/:id", h.AdminDeleteComment)
g.GET("/articles", h.AdminListArticles)
g.POST("/articles", h.AdminSaveArticle)
g.DELETE("/articles/:id", h.AdminDeleteArticle)
g.GET("/care-templates/meta", h.AdminCareTemplateMeta)
g.GET("/care-templates", h.AdminGetCareTemplate)
g.PUT("/care-templates", h.AdminSaveCareTemplate)
g.POST("/care-templates/generate", h.AdminGenerateCareTemplate)
g.GET("/community-bot", h.AdminGetCommunityBot)
g.PUT("/community-bot", h.AdminSaveCommunityBot)
g.POST("/community-bot/generate", h.AdminGenerateCommunityPosts)
g.GET("/feedback", h.AdminListFeedback)
g.PUT("/feedback/:id/handled", h.AdminSetFeedbackHandled)
g.GET("/memberships", h.AdminListPro)
}