tmp
This commit is contained in:
415
handler/users.js
415
handler/users.js
@@ -6,111 +6,131 @@ class HandlerUser {
|
||||
constructor() {
|
||||
}
|
||||
|
||||
// 获取微信的手机号码
|
||||
async wxGetPhoneNumber(ctx) {
|
||||
// 生成 token
|
||||
async genToken(uid) {
|
||||
const crypto = await import("crypto");
|
||||
const hash = crypto.createHash("md5");
|
||||
hash.update(uid + Date.now() + Math.random());
|
||||
return hash.digest("hex");
|
||||
}
|
||||
|
||||
checkUserValid(user) {
|
||||
const isTokenValid = user.security.token &&
|
||||
user.security.tokenExpiry &&
|
||||
new Date() < user.security.tokenExpiry;
|
||||
return isTokenValid;
|
||||
}
|
||||
|
||||
// 用户注册
|
||||
async register(ctx) {
|
||||
try {
|
||||
const { code, appId } = ctx.request.body;
|
||||
if (!code || !appId) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号凭证 code 或 appId");
|
||||
const { userInfo } = ctx.request.body;
|
||||
if (!userInfo) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少用户信息");
|
||||
}
|
||||
|
||||
let app = config.app[appId];
|
||||
if (!app) {
|
||||
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
|
||||
const mobile = userInfo.profile?.mobile;
|
||||
const passwd = userInfo.security?.passwd;
|
||||
if (!mobile) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号");
|
||||
}
|
||||
if (!passwd) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少密码");
|
||||
}
|
||||
|
||||
// 获取access_token
|
||||
const client_credential_url = `https://api.weixin.qq.com/cgi-bin/token?appid=${app.appid}&secret=${app.secret}&grant_type=client_credential`;
|
||||
const fetch = (await import("node-fetch")).default;
|
||||
let sessionRes = await fetch(client_credential_url);
|
||||
const resp = await sessionRes.json();
|
||||
if (!resp.access_token) {
|
||||
return ResponseUtil.internalError(ctx, "获取微信 access_token 失败");
|
||||
// 检查手机号是否已注册
|
||||
const existingUser = await DBModel.User.findOne({ "profile.mobile": mobile });
|
||||
if (existingUser) {
|
||||
return ResponseUtil.error(ctx, "手机号已注册", null, 409);
|
||||
}
|
||||
|
||||
// 获取phoneNumber
|
||||
const phoneUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${resp.access_token}`;
|
||||
const phoneRes = await fetch(phoneUrl, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ code: code })
|
||||
});
|
||||
const phoneData = await phoneRes.json();
|
||||
if (phoneData.errcode) {
|
||||
return ResponseUtil.error(ctx, `获取手机号失败: ${phoneData.errmsg}`, null, 400);
|
||||
// 生成随机盐值
|
||||
const crypto = await import("crypto");
|
||||
const salt = crypto.randomBytes(8).toString("hex");
|
||||
|
||||
// MD5 加密密码
|
||||
const hash = crypto.createHash("md5");
|
||||
hash.update(passwd + salt);
|
||||
const encryptedPasswd = hash.digest("hex");
|
||||
|
||||
// 构建新用户，结构同 UserSchema
|
||||
const newUser = {
|
||||
profile: userInfo.profile,
|
||||
security: {
|
||||
passwd: encryptedPasswd,
|
||||
passwdSalt: salt,
|
||||
},
|
||||
location: {
|
||||
province: userInfo.location?.province || '',
|
||||
city: userInfo.location?.city || '',
|
||||
district: userInfo.location?.district || '',
|
||||
},
|
||||
addresses: userInfo.addresses || [],
|
||||
social: {
|
||||
wechat: {
|
||||
}
|
||||
},
|
||||
status: {
|
||||
account: "normal",
|
||||
},
|
||||
app: userInfo.app || {},
|
||||
};
|
||||
|
||||
const user = await DBModel.User.setUser(newUser);
|
||||
if (!user) {
|
||||
return ResponseUtil.internalError(ctx, "注册失败");
|
||||
}
|
||||
|
||||
// 从上图获取手机号
|
||||
const phoneNumber = phoneData.phone_info?.phoneNumber;
|
||||
return ResponseUtil.success(ctx, { phoneNumber }, "获取手机号成功");
|
||||
// 生成 token
|
||||
const token = await this.genToken(user._id.toString());
|
||||
user.security.token = token;
|
||||
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
|
||||
await user.save();
|
||||
|
||||
// 安全起见删除密码相关字段
|
||||
const safeUser = user.toObject();
|
||||
delete safeUser.security?.passwd;
|
||||
delete safeUser.security?.passwdSalt;
|
||||
|
||||
return ResponseUtil.success(ctx, { user: safeUser }, "注册成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// 微信登录
|
||||
async wxSignin(ctx) {
|
||||
// 手机号码登录
|
||||
async signin(ctx) {
|
||||
try {
|
||||
const { code, phoneNumber, name, appId } = ctx.request.body;
|
||||
if (!code || !appId) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少微信登录凭证 code 或 appId");
|
||||
const { mobile, passwd } = ctx.request.body;
|
||||
if (!mobile) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号");
|
||||
}
|
||||
if (!passwd) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少密码");
|
||||
}
|
||||
|
||||
|
||||
|
||||
let app = config.app[appId];
|
||||
if (!app) {
|
||||
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
|
||||
}
|
||||
|
||||
// 通过 code 换取 openid/session_key
|
||||
const sessionUrl = `https://api.weixin.qq.com/sns/jscode2session?appid=${app.appid}&secret=${app.secret}&js_code=${code}&grant_type=authorization_code`;
|
||||
const wxSessionRes = await fetch(sessionUrl);
|
||||
const sessionData = await wxSessionRes.json();
|
||||
if (sessionData.errcode) {
|
||||
return ResponseUtil.error(ctx, `微信接口错误: ${sessionData.errmsg}`, null, 400);
|
||||
}
|
||||
|
||||
const { openid } = sessionData;
|
||||
if (!openid) {
|
||||
return ResponseUtil.error(ctx, "微信登录失败，未获取到 openid", null, 400);
|
||||
}
|
||||
|
||||
// 使用openid和phoneNumber查询用户
|
||||
let key = `app.${appId}.wxopenid`;
|
||||
let user = await DBModel.User.findOne({ [key]: openid });
|
||||
// 查找用户
|
||||
let user = await DBModel.User.findOne({ "profile.mobile": mobile });
|
||||
if (!user) {
|
||||
if (!phoneNumber) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号");
|
||||
}
|
||||
|
||||
user = await DBModel.User.findOne({ "profile.mobile": phoneNumber });
|
||||
if (!user) {
|
||||
const newUser = {
|
||||
profile: { name: name || phoneNumber, mobile: phoneNumber, },
|
||||
status: { account: "normal", },
|
||||
app: {},
|
||||
};
|
||||
newUser.app[appId] = { role: ["user"], wxopenid: openid };
|
||||
|
||||
user = await DBModel.User.setUser(newUser);
|
||||
}
|
||||
return ResponseUtil.unauthorized(ctx, "用户不存在");
|
||||
}
|
||||
|
||||
//
|
||||
if (user) {
|
||||
if (phoneNumber && phoneNumber.length > 0 && user.profile.mobile !== phoneNumber) {
|
||||
user.profile.mobile = phoneNumber;
|
||||
}
|
||||
if (!(appId in user.app)) {
|
||||
user.app[appId] = { role: ["user"], wxopenid: openid };
|
||||
}
|
||||
user.app[appId].wxopenid = openid;
|
||||
} else {
|
||||
return ResponseUtil.internalError(ctx, "用户不存在");
|
||||
// 校验密码（MD5 加密比对）
|
||||
const crypto = await import("crypto");
|
||||
const hash = crypto.createHash("md5");
|
||||
hash.update(passwd + (user.security.passwdSalt || ""));
|
||||
const encryptedPasswd = hash.digest("hex");
|
||||
|
||||
if (user.security.passwd !== encryptedPasswd) {
|
||||
return ResponseUtil.unauthorized(ctx, "密码错误");
|
||||
}
|
||||
|
||||
// 更新Token
|
||||
// 检查账户状态
|
||||
if (user.status.account === "lock") {
|
||||
return ResponseUtil.forbidden(ctx, "账户已被锁定");
|
||||
}
|
||||
|
||||
// 生成/更新 token
|
||||
const isTokenValid = user.security.token &&
|
||||
user.security.tokenExpiry &&
|
||||
new Date() < user.security.tokenExpiry;
|
||||
@@ -123,58 +143,11 @@ class HandlerUser {
|
||||
await user.save();
|
||||
|
||||
// 安全起见删除密码相关字段
|
||||
delete user.security.passwd;
|
||||
delete user.security.passwdSalt;
|
||||
|
||||
return ResponseUtil.success(ctx, { user }, "登录成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// update user
|
||||
async updateUser(ctx) {
|
||||
try {
|
||||
const userInfo = ctx.request.body;
|
||||
if (!userInfo) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少用户信息");
|
||||
}
|
||||
|
||||
// 从 token 获取当前用户
|
||||
const token = ctx.request.body?.token
|
||||
|| ctx.request.query?.token
|
||||
|| ctx.header?.authorization
|
||||
|| ctx.header?.token;
|
||||
|
||||
if (!token) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少 token");
|
||||
}
|
||||
|
||||
const user = await DBModel.User.findOne({ "security.token": token });
|
||||
if (!user) {
|
||||
return ResponseUtil.unauthorized(ctx, "用户未登录或 token 无效");
|
||||
}
|
||||
|
||||
// 检查 token 是否过期
|
||||
if (user.security.tokenExpiry && new Date() > user.security.tokenExpiry) {
|
||||
return ResponseUtil.unauthorized(ctx, "登录已过期，请重新登录");
|
||||
}
|
||||
|
||||
const updatedUser = await DBModel.User.updateFromUserInfo(
|
||||
user._id,
|
||||
userInfo
|
||||
);
|
||||
|
||||
if (!updatedUser) {
|
||||
return ResponseUtil.internalError(ctx, "更新用户失败");
|
||||
}
|
||||
|
||||
// 安全起见删除密码相关字段
|
||||
const safeUser = updatedUser.toObject();
|
||||
const safeUser = user.toObject();
|
||||
delete safeUser.security?.passwd;
|
||||
delete safeUser.security?.passwdSalt;
|
||||
|
||||
return ResponseUtil.success(ctx, { user: safeUser }, "更新成功");
|
||||
return ResponseUtil.success(ctx, { user: safeUser }, "登录成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
@@ -238,6 +211,54 @@ class HandlerUser {
|
||||
}
|
||||
}
|
||||
|
||||
// update user
|
||||
async updateUser(ctx) {
|
||||
try {
|
||||
const userInfo = ctx.request.body;
|
||||
if (!userInfo) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少用户信息");
|
||||
}
|
||||
|
||||
// 从 token 获取当前用户
|
||||
const token = ctx.request.body?.token
|
||||
|| ctx.request.query?.token
|
||||
|| ctx.header?.authorization
|
||||
|| ctx.header?.token;
|
||||
|
||||
if (!token) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少 token");
|
||||
}
|
||||
|
||||
const user = await DBModel.User.findOne({ "security.token": token });
|
||||
if (!user) {
|
||||
return ResponseUtil.unauthorized(ctx, "用户未登录或 token 无效");
|
||||
}
|
||||
|
||||
// 检查 token 是否过期
|
||||
if (user.security.tokenExpiry && new Date() > user.security.tokenExpiry) {
|
||||
return ResponseUtil.unauthorized(ctx, "登录已过期，请重新登录");
|
||||
}
|
||||
|
||||
const updatedUser = await DBModel.User.updateFromUserInfo(
|
||||
user._id,
|
||||
userInfo
|
||||
);
|
||||
|
||||
if (!updatedUser) {
|
||||
return ResponseUtil.internalError(ctx, "更新用户失败");
|
||||
}
|
||||
|
||||
// 安全起见删除密码相关字段
|
||||
const safeUser = updatedUser.toObject();
|
||||
delete safeUser.security?.passwd;
|
||||
delete safeUser.security?.passwdSalt;
|
||||
|
||||
return ResponseUtil.success(ctx, { user: safeUser }, "更新成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// 获取用户列表
|
||||
async userList(ctx) {
|
||||
try {
|
||||
@@ -282,12 +303,130 @@ class HandlerUser {
|
||||
}
|
||||
}
|
||||
|
||||
// 生成 token
|
||||
async genToken(uid) {
|
||||
const crypto = await import("crypto");
|
||||
const hash = crypto.createHash("md5");
|
||||
hash.update(uid + Date.now() + Math.random());
|
||||
return hash.digest("hex");
|
||||
// 微信登录
|
||||
async wxSignin(ctx) {
|
||||
try {
|
||||
const { code, phoneNumber, name, appId } = ctx.request.body;
|
||||
if (!code || !appId) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少微信登录凭证 code 或 appId");
|
||||
}
|
||||
|
||||
|
||||
|
||||
let app = config.app[appId];
|
||||
if (!app) {
|
||||
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
|
||||
}
|
||||
|
||||
// 通过 code 换取 openid/session_key
|
||||
const sessionUrl = `https://api.weixin.qq.com/sns/jscode2session?appid=${app.appid}&secret=${app.secret}&js_code=${code}&grant_type=authorization_code`;
|
||||
const wxSessionRes = await fetch(sessionUrl);
|
||||
const sessionData = await wxSessionRes.json();
|
||||
if (sessionData.errcode) {
|
||||
return ResponseUtil.error(ctx, `微信接口错误: ${sessionData.errmsg}`, null, 400);
|
||||
}
|
||||
|
||||
const { openid } = sessionData;
|
||||
if (!openid) {
|
||||
return ResponseUtil.error(ctx, "微信登录失败，未获取到 openid", null, 400);
|
||||
}
|
||||
|
||||
// 使用openid和phoneNumber查询用户
|
||||
let key = `app.${appId}.wxopenid`;
|
||||
let user = await DBModel.User.findOne({ [key]: openid });
|
||||
if (!user) {
|
||||
if (!phoneNumber) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号");
|
||||
}
|
||||
|
||||
user = await DBModel.User.findOne({ "profile.mobile": phoneNumber });
|
||||
if (!user) {
|
||||
const newUser = {
|
||||
profile: { name: name || phoneNumber, mobile: phoneNumber, },
|
||||
status: { account: "normal", },
|
||||
app: {},
|
||||
};
|
||||
newUser.app[appId] = { role: ["user"], wxopenid: openid };
|
||||
|
||||
user = await DBModel.User.setUser(newUser);
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
if (user) {
|
||||
if (phoneNumber && phoneNumber.length > 0 && user.profile.mobile !== phoneNumber) {
|
||||
user.profile.mobile = phoneNumber;
|
||||
}
|
||||
if (!(appId in user.app)) {
|
||||
user.app[appId] = { role: ["user"], wxopenid: openid };
|
||||
}
|
||||
user.app[appId].wxopenid = openid;
|
||||
} else {
|
||||
return ResponseUtil.internalError(ctx, "用户不存在");
|
||||
}
|
||||
|
||||
// 更新Token
|
||||
const isTokenValid = user.security.token &&
|
||||
user.security.tokenExpiry &&
|
||||
new Date() < user.security.tokenExpiry;
|
||||
|
||||
if (!isTokenValid) {
|
||||
const token = await this.genToken(user._id.toString());
|
||||
user.security.token = token;
|
||||
}
|
||||
user.security.tokenExpiry = new Date(Date.now() + 15 * 24 * 60 * 60 * 1000);
|
||||
await user.save();
|
||||
|
||||
// 安全起见删除密码相关字段
|
||||
delete user.security.passwd;
|
||||
delete user.security.passwdSalt;
|
||||
|
||||
return ResponseUtil.success(ctx, { user }, "登录成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// 获取微信的手机号码
|
||||
async wxGetPhoneNumber(ctx) {
|
||||
try {
|
||||
const { code, appId } = ctx.request.body;
|
||||
if (!code || !appId) {
|
||||
return ResponseUtil.badRequest(ctx, "缺少手机号凭证 code 或 appId");
|
||||
}
|
||||
|
||||
let app = config.app[appId];
|
||||
if (!app) {
|
||||
return ResponseUtil.badRequest(ctx, `未配置 appId: ${appId}`);
|
||||
}
|
||||
|
||||
// 获取access_token
|
||||
const client_credential_url = `https://api.weixin.qq.com/cgi-bin/token?appid=${app.appid}&secret=${app.secret}&grant_type=client_credential`;
|
||||
const fetch = (await import("node-fetch")).default;
|
||||
let sessionRes = await fetch(client_credential_url);
|
||||
const resp = await sessionRes.json();
|
||||
if (!resp.access_token) {
|
||||
return ResponseUtil.internalError(ctx, "获取微信 access_token 失败");
|
||||
}
|
||||
|
||||
// 获取phoneNumber
|
||||
const phoneUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${resp.access_token}`;
|
||||
const phoneRes = await fetch(phoneUrl, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ code: code })
|
||||
});
|
||||
const phoneData = await phoneRes.json();
|
||||
if (phoneData.errcode) {
|
||||
return ResponseUtil.error(ctx, `获取手机号失败: ${phoneData.errmsg}`, null, 400);
|
||||
}
|
||||
|
||||
// 从上图获取手机号
|
||||
const phoneNumber = phoneData.phone_info?.phoneNumber;
|
||||
return ResponseUtil.success(ctx, { phoneNumber }, "获取手机号成功");
|
||||
} catch (err) {
|
||||
return ResponseUtil.internalError(ctx, err.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -11,14 +11,16 @@ class ApiRouter {
|
||||
setupRoutes() {
|
||||
const userRouter = new Router({ prefix: '/user' });
|
||||
|
||||
userRouter.post('/wxgetphonenumber', this.handler.wxGetPhoneNumber.bind(this.handler));
|
||||
userRouter.post('/wxsignin', this.handler.wxSignin.bind(this.handler));
|
||||
userRouter.post('/update', this.handler.updateUser.bind(this.handler));
|
||||
userRouter.post('/register', this.handler.register.bind(this.handler));
|
||||
userRouter.post('/signin', this.handler.signin.bind(this.handler));
|
||||
userRouter.post('/signout', this.handler.signout.bind(this.handler));
|
||||
userRouter.post('/userInfo', this.handler.userInfo.bind(this.handler));
|
||||
|
||||
userRouter.post('/update', this.handler.updateUser.bind(this.handler));
|
||||
userRouter.post('/list', this.handler.userList.bind(this.handler));
|
||||
|
||||
userRouter.post('/wxsignin', this.handler.wxSignin.bind(this.handler));
|
||||
userRouter.post('/wxgetphonenumber', this.handler.wxGetPhoneNumber.bind(this.handler));
|
||||
|
||||
this.router.use(userRouter.routes());
|
||||
|
||||
this.printRoutes(this.router.stack);
|
||||
|
||||
Reference in New Issue
Block a user