xJourney/api_user
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ai review

Browse Source
This commit is contained in:
lik
2026-09-01 21:49:41 +08:00
parent 70307d4eb8
commit 058e9135ae
9 changed files with 184 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
handler/users.js
+134 -93
View File
@@ -1,10 +1,31 @@
import Joi from 'joi';
import { DBModel } from "../models/index.js";
import ResponseUtil from "../utils/api_response.js";
import { hashPassword, verifyPassword } from "../utils/crypto.js";
import { sanitizeUser, extractToken } from "../middleware/auth.js";
import { hashPassword, verifyPassword, hashToken } from "../utils/crypto.js";
import { sanitizeUser } from "../middleware/auth.js";
import config from "../conf.json" with { type: "json" };
// 微信 access_token 进程内缓存（有效期 7200s，提前 5 分钟刷新）
const wxAccessTokenCache = new Map();
async function getWxAccessToken(appConfig) {
const cached = wxAccessTokenCache.get(appConfig.appid);
if (cached && Date.now() < cached.expiresAt) {
return cached.token;
}
const fetch = (await import("node-fetch")).default;
const tokenUrl = `https://api.weixin.qq.com/cgi-bin/token?appid=${appConfig.appid}&secret=${appConfig.secret}&grant_type=client_credential`;
const resp = await (await fetch(tokenUrl)).json();
if (!resp.access_token) {
throw new Error(resp.errmsg || "获取微信 access_token 失败");
}
wxAccessTokenCache.set(appConfig.appid, {
token: resp.access_token,
expiresAt: Date.now() + ((resp.expires_in || 7200) - 300) * 1000,
});
return resp.access_token;
}
// 输入校验 schema
const registerSchema = Joi.object({
userInfo: Joi.object({
@@ -45,6 +66,9 @@ const signinSchema = Joi.object({
const wxSigninSchema = Joi.object({
code: Joi.string().required().messages({ 'any.required': '缺少微信登录凭证 code' }),
appId: Joi.string().required().messages({ 'any.required': '缺少 appId' }),
// 推荐：传微信手机号凭证 code，由服务端换取手机号（可信）
phoneCode: Joi.string().allow('', null),
// 已废弃（不安全）：客户端直传手机号，仅允许用于新建账号
phoneNumber: Joi.string().allow('', null),
name: Joi.string().allow('', null),
});
@@ -54,8 +78,10 @@ const wxGetPhoneSchema = Joi.object({
appId: Joi.string().required().messages({ 'any.required': '缺少 appId' }),
});
const LOCK_AFTER_FAILED_ATTEMPTS = 10;
class HandlerUser {
// 生成 token
// 生成 token（DB 中只存哈希，原始 token 仅在登录响应中返回一次）
async genToken(uid) {
const crypto = await import("crypto");
const hash = crypto.createHash("sha256");
@@ -63,6 +89,25 @@ class HandlerUser {
return hash.digest("hex");
}
// 签发 token：哈希入库，返回原始值供响应
async issueToken(user) {
const raw = await this.genToken(user._id.toString());
user.security.token = await hashToken(raw);
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
user.security.lastLoginAt = new Date();
await user.save();
return { raw, tokenExpiry: user.security.tokenExpiry };
}
// 登录/注册响应：脱敏后单独附加本次签发的原始 token
buildLoginResponse(user, raw) {
const safe = sanitizeUser(user);
safe.security = safe.security || {};
safe.security.token = raw;
safe.security.tokenExpiry = user.security.tokenExpiry;
return safe;
}
// 用户注册
async register(ctx) {
const { error, value } = registerSchema.validate(ctx.request.body, { abortEarly: false });
@@ -109,13 +154,10 @@ class HandlerUser {
return ResponseUtil.internalError(ctx, "注册失败");
}
// 生成 token
const token = await this.genToken(user._id.toString());
user.security.token = token;
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
await user.save();
// 生成 token（哈希入库，响应附原始 token）
const { raw } = await this.issueToken(user);
return ResponseUtil.success(ctx, { user: sanitizeUser(user) }, "注册成功");
return ResponseUtil.success(ctx, { user: this.buildLoginResponse(user, raw) }, "注册成功");
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
}
@@ -137,14 +179,24 @@ class HandlerUser {
return ResponseUtil.unauthorized(ctx, "用户不存在");
}
// 锁定账户拒绝登录
if (user.status.account === "lock") {
return ResponseUtil.forbidden(ctx, "账户已被锁定，请联系管理员");
}
// 校验密码（支持 bcrypt 和 MD5 渐进式迁移）
const { valid, needsUpgrade } = await verifyPassword(
passwd, user.security.passwd, user.security.passwdSalt
);
if (!valid) {
// 记录失败登录次数
await DBModel.User.incrementFailedLoginAttempts(user._id);
// 记录失败登录次数，达到阈值锁定账户
const updated = await DBModel.User.incrementFailedLoginAttempts(user._id);
if (updated && updated.security.failedLoginAttempts >= LOCK_AFTER_FAILED_ATTEMPTS) {
updated.status.account = "lock";
await updated.save();
return ResponseUtil.forbidden(ctx, "失败次数过多，账户已锁定，请联系管理员");
}
return ResponseUtil.unauthorized(ctx, "密码错误");
}
@@ -159,15 +211,11 @@ class HandlerUser {
await DBModel.User.resetFailedLoginAttempts(user._id);
}
// 生成/更新 token
const token = await this.genToken(user._id.toString());
user.security.token = token;
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
user.security.lastLoginAt = new Date();
// 生成/更新 token（哈希入库）
user.security.lastLoginIp = ctx.ip || ctx.request.ip;
await user.save();
const { raw } = await this.issueToken(user);
return ResponseUtil.success(ctx, { user: sanitizeUser(user) }, "登录成功");
return ResponseUtil.success(ctx, { user: this.buildLoginResponse(user, raw) }, "登录成功");
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
}
@@ -175,12 +223,8 @@ class HandlerUser {
// 退出登录
async signout(ctx) {
const token = extractToken(ctx);
if (!token) {
return ResponseUtil.badRequest(ctx, "缺少 token");
}
const user = await DBModel.User.findOne({ "security.token": token });
// auth({required:false}) 中间件已验证登录态
const user = ctx.state.user;
if (user) {
user.security.token = null;
user.security.tokenExpiry = null;
@@ -192,7 +236,12 @@ class HandlerUser {
// 获取用户信息
async userInfo(ctx) {
// 临时支持：通过 body 里的 userId 获取用户信息
// 已通过 auth 中间件验证的登录用户
if (ctx.state.user) {
return ResponseUtil.success(ctx, { user: sanitizeUser(ctx.state.user) }, "获取用户信息成功");
}
// 兼容：通过 userId 查询（脱敏响应，不含任何安全凭证）
const { userId } = ctx.request.body || {};
if (userId) {
const user = await DBModel.User.findOne({ _id: userId });
@@ -202,40 +251,17 @@ class HandlerUser {
return ResponseUtil.success(ctx, { user: sanitizeUser(user) }, "获取用户信息成功");
}
// 原有逻辑：通过 token 获取用户信息
const token = extractToken(ctx);
if (!token) {
return ResponseUtil.badRequest(ctx, "缺少 token");
}
const user = await DBModel.User.findOne({ "security.token": token });
if (!user) {
return ResponseUtil.unauthorized(ctx, "用户未登录或 token 无效");
}
if (user.security.tokenExpiry && new Date() > user.security.tokenExpiry) {
return ResponseUtil.unauthorized(ctx, "登录已过期，请重新登录");
}
return ResponseUtil.success(ctx, { user: sanitizeUser(user) }, "获取用户信息成功");
return ResponseUtil.badRequest(ctx, "缺少 token 或 userId");
}
// 更新用户信息
async updateUser(ctx) {
const token = extractToken(ctx);
if (!token) {
return ResponseUtil.badRequest(ctx, "缺少 token");
}
const user = await DBModel.User.findOne({ "security.token": token });
// auth() 中间件已验证登录态
const user = ctx.state.user;
if (!user) {
return ResponseUtil.unauthorized(ctx, "用户未登录或 token 无效");
}
if (user.security.tokenExpiry && new Date() > user.security.tokenExpiry) {
return ResponseUtil.unauthorized(ctx, "登录已过期，请重新登录");
}
try {
const userInfo = ctx.request.body;
if (!userInfo) {
@@ -255,33 +281,28 @@ class HandlerUser {
// 获取用户列表
async userList(ctx) {
const token = extractToken(ctx);
if (!token) {
return ResponseUtil.badRequest(ctx, "缺少 token");
}
const user = await DBModel.User.findOne({ "security.token": token });
// auth() 中间件已验证登录态
const user = ctx.state.user;
if (!user) {
return ResponseUtil.unauthorized(ctx, "用户未登录或 token 无效");
}
if (!('wxapp-escort-admin' in user.app)) {
if (!("wxapp-escort-admin" in (user.app || {}))) {
return ResponseUtil.unauthorized(ctx, "用户无管理员权限");
}
if (user.security.tokenExpiry && new Date() > user.security.tokenExpiry) {
return ResponseUtil.unauthorized(ctx, "登录已过期，请重新登录");
}
try {
const { page = 1, pageSize = 100 } = ctx.request.body;
const page = Math.max(1, parseInt(ctx.request.body?.page) || 1);
const pageSize = Math.min(200, Math.max(1, parseInt(ctx.request.body?.pageSize) || 100));
const filter = { "app.wxapp-escort": { $exists: true } };
const users = await DBModel.User.find({ "app.wxapp-escort": { $exists: true } })
.skip((page - 1) * pageSize)
.limit(pageSize);
const [users, total] = await Promise.all([
DBModel.User.find(filter).skip((page - 1) * pageSize).limit(pageSize),
DBModel.User.countDocuments(filter),
]);
const safeUsers = users.map(u => sanitizeUser(u));
return ResponseUtil.success(ctx, { users: safeUsers }, "获取用户列表成功");
const safeUsers = users.map((u) => sanitizeUser(u));
return ResponseUtil.success(ctx, { users: safeUsers, total, page, pageSize }, "获取用户列表成功");
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
}
@@ -302,6 +323,29 @@ class HandlerUser {
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
}
// 手机号获取：
// 1) 优先用 phoneCode 由服务端向微信换取（可信，可绑定已有账号）
// 2) body 直传 phoneNumber 不可信，仅允许用于新建账号
let verifiedPhoneNumber = null;
if (value.phoneCode) {
try {
const accessToken = await getWxAccessToken(app);
const phoneUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${accessToken}`;
const phoneRes = await fetch(phoneUrl, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ code: value.phoneCode }),
});
const phoneData = await phoneRes.json();
if (phoneData.errcode) {
return ResponseUtil.error(ctx, `获取手机号失败: ${phoneData.errmsg}`, null, 400);
}
verifiedPhoneNumber = phoneData.phone_info?.phoneNumber || null;
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
}
}
// 通过 code 换取 openid/session_key
const sessionUrl = `https://api.weixin.qq.com/sns/jscode2session?appid=${app.appid}&secret=${app.secret}&js_code=${code}&grant_type=authorization_code`;
const wxSessionRes = await fetch(sessionUrl);
@@ -315,18 +359,26 @@ class HandlerUser {
return ResponseUtil.error(ctx, "微信登录失败，未获取到 openid", null, 400);
}
// 使用openid和phoneNumber查询用户
let key = `app.${appId}.wxopenid`;
let user = await DBModel.User.findOne({ [key]: openid });
if (!user) {
if (!phoneNumber) {
const mobile = verifiedPhoneNumber || phoneNumber;
if (!mobile) {
return ResponseUtil.badRequest(ctx, "缺少手机号");
}
user = await DBModel.User.findOne({ "profile.mobile": phoneNumber });
if (!user) {
const existingUser = await DBModel.User.findOne({ "profile.mobile": mobile });
if (existingUser) {
// 已有账号：仅允许服务端验证过的手机号绑定微信，防止账号接管
if (!verifiedPhoneNumber) {
return ResponseUtil.error(ctx, "该手机号已注册，请先使用手机号登录后再绑定微信", null, 409);
}
user = existingUser;
} else {
// 新建用户
const newUser = {
profile: { name: name || phoneNumber, mobile: phoneNumber },
profile: { name: name || mobile, mobile },
status: { account: "normal" },
app: {},
};
@@ -336,26 +388,21 @@ class HandlerUser {
}
if (user) {
if (phoneNumber && phoneNumber.length > 0 && user.profile.mobile !== phoneNumber) {
user.profile.mobile = phoneNumber;
}
// 绑定/更新 openid；不覆盖已有用户的手机号
if (!(appId in user.app)) {
user.app[appId] = { role: ["user"], wxopenid: openid };
} else {
user.app[appId].wxopenid = openid;
}
user.app[appId].wxopenid = openid;
} else {
return ResponseUtil.internalError(ctx, "用户不存在");
}
// 更新Token
const token = await this.genToken(user._id.toString());
user.security.token = token;
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
user.security.lastLoginAt = new Date();
// 更新Token（哈希入库）
user.security.lastLoginIp = ctx.ip || ctx.request.ip;
await user.save();
const { raw } = await this.issueToken(user);
return ResponseUtil.success(ctx, { user: sanitizeUser(user) }, "登录成功");
return ResponseUtil.success(ctx, { user: this.buildLoginResponse(user, raw) }, "登录成功");
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
}
@@ -376,17 +423,11 @@ class HandlerUser {
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
}
// 获取access_token
const client_credential_url = `https://api.weixin.qq.com/cgi-bin/token?appid=${app.appid}&secret=${app.secret}&grant_type=client_credential`;
const fetch = (await import("node-fetch")).default;
let sessionRes = await fetch(client_credential_url);
const resp = await sessionRes.json();
if (!resp.access_token) {
return ResponseUtil.internalError(ctx, "获取微信 access_token 失败");
}
// 获取access_token（带缓存的封装，避免耗尽微信每日配额）
const accessToken = await getWxAccessToken(app);
// 获取phoneNumber
const phoneUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${resp.access_token}`;
const phoneUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${accessToken}`;
const phoneRes = await fetch(phoneUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },