Go进阶24:Go JWT RESTful身份认证教程

	r := gin.New()
	r.MaxMultipartMemory = 32 << 20
	//sever static file in http's root path
	binStaticMiddleware, err := felixbin.NewGinStaticBinMiddleware("/")
	if err != nil {
		return err
	}
    //支持跨域
	mwCORS := cors.New(cors.Config{
		AllowOrigins:     []string{"*"},
		AllowMethods:     []string{"PUT", "PATCH", "POST", "GET", "DELETE"},
		AllowHeaders:     []string{"Origin", "Authorization", "Content-Type"},
		ExposeHeaders:    []string{"Content-Type"},
		AllowCredentials: true,
		AllowOriginFunc: func(origin string) bool {
			return true
		},
		MaxAge: 2400 * time.Hour,
	})
	r.Use(binStaticMiddleware, mwCORS)


	{
		r.POST("comment-login", internal.LoginCommenter)       //评论用户登陆
		r.POST("comment-register", internal.RegisterCommenter) //评论用户注册
	}

	api := r.Group("api")
    api.POST("admin-login", internal.LoginAdmin) //管理后台登陆

func LoginCommenter(c *gin.Context) {
	var mdl model.User
	err := c.ShouldBind(&mdl)
	if handleError(c, err) {
		return
	}
	//获取ip
	ip := c.ClientIP()
	//roleId 8 是评论系统的用户
	data, err := mdl.Login(ip, 8)
	if handleError(c, err) {
		return
	}
	jsonData(c, data)
}

//Login
func (m *User) Login(ip string, roleId uint) (string, error) {
	m.Id = 0
	if m.Password == "" {
		return "", errors.New("password is required")
	}
	inputPassword := m.Password
    //获取登录的用户
	err := db.Where("username = ? or email = ?", m.Username, m.Username).First(&m).Error
	if err != nil {
		return "", err
	}
	//校验用户角色
	if (m.RoleId & roleId) != roleId {
		return "", fmt.Errorf("not role of %d", roleId)
	}
	//验证密码
	//password is set to bcrypt check
	if err := bcrypt.CompareHashAndPassword([]byte(m.HashedPassword), []byte(inputPassword)); err != nil {
		return "", err
	}
	//防止密码泄露
	m.Password = ""
	//生成jwt-string
	return jwtGenerateToken(m, time.Hour*24*365)
}

package model

import (
	"errors"
	"fmt"
	"time"

	"github.com/dgrijalva/jwt-go"
	"github.com/sirupsen/logrus"
)

var AppSecret = ""//viper.GetString会设置这个值(32byte长度)
var AppIss = "github.com/libragen/felix"//这个值会被viper.GetString重写

//自定义payload结构体,不建议直接使用 dgrijalva/jwt-go `jwt.StandardClaims`结构体.因为他的payload包含的用户信息太少.
type userStdClaims struct {
	jwt.StandardClaims
	*User
}
//实现 `type Claims interface` 的 `Valid() error` 方法,自定义校验内容
func (c userStdClaims) Valid() (err error) {
	if c.VerifyExpiresAt(time.Now().Unix(), true) == false {
		return  errors.New("token is expired")
	}
	if !c.VerifyIssuer(AppIss, true) {
		return  errors.New("token's issuer is wrong")
	}
	if c.User.Id < 1 {
		return errors.New("invalid user in jwt")
	}
	return
}

func jwtGenerateToken(m *User,d time.Duration) (string, error) {
	m.Password = ""
	expireTime := time.Now().Add(d)
	stdClaims := jwt.StandardClaims{
		ExpiresAt: expireTime.Unix(),
		IssuedAt:  time.Now().Unix(),
		Id:        fmt.Sprintf("%d", m.Id),
		Issuer:    AppIss,
	}

	uClaims := userStdClaims{
		StandardClaims: stdClaims,
		User:           m,
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, uClaims)
	// Sign and get the complete encoded token as a string using the secret
	tokenString, err := token.SignedString([]byte(AppSecret))
	if err != nil {
		logrus.WithError(err).Fatal("config is wrong, can not generate jwt")
	}
	return tokenString, err
}


//JwtParseUser 解析payload的内容,得到用户信息
//gin-middleware 会使用这个方法
func JwtParseUser(tokenString string) (*User, error) {
	if tokenString == "" {
		return nil, errors.New("no token is found in Authorization Bearer")
	}
	claims := userStdClaims{}
	_, err := jwt.ParseWithClaims(tokenString, &claims, func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
		}
		return []byte(AppSecret), nil
	})
	if err != nil {
		return nil, err
	}
	return claims.User, err
}

package internal

import (
	"net/http"
	"strings"

	"github.com/libragen/felix/model"
	"github.com/gin-gonic/gin"
)

const contextKeyUserObj = "authedUserObj"
const bearerLength = len("Bearer ")

func ctxTokenToUser(c *gin.Context, roleId uint) {
	token, ok := c.GetQuery("_t")
	if !ok {
		hToken := c.GetHeader("Authorization")
		if len(hToken) < bearerLength {
			c.AbortWithStatusJSON(http.StatusPreconditionFailed, gin.H{"msg": "header Authorization has not Bearer token"})
			return
		}
		token = strings.TrimSpace(hToken[bearerLength:])
	}
	usr, err := model.JwtParseUser(token)
	if err != nil {
		c.AbortWithStatusJSON(http.StatusPreconditionFailed, gin.H{"msg": err.Error()})
		return
	}
	if (usr.RoleId & roleId) != roleId {
		c.AbortWithStatusJSON(http.StatusPreconditionFailed, gin.H{"msg": "roleId 没有权限"})
		return
	}

	//store the user Model in the context
	c.Set(contextKeyUserObj, *usr)
	c.Next()
	// after request
}

func MwUserAdmin(c *gin.Context) {
	ctxTokenToUser(c, 2)
}

func MwUserComment(c *gin.Context) {
	ctxTokenToUser(c, 8)
}

func mWuserId(c *gin.Context) (uint, error) {
	v,exist := c.Get(contextKeyUserObj)
	if !exist {
		return 0,errors.New(contextKeyUserObj + " not exist")
	}
	user, ok := v.(model.User)
	if ok {
		return user.Id, nil
	}
	return 0,errors.New("can't convert to user struct")
}

package ssh2ws

import (
	"time"

	"github.com/libragen/felix/felixbin"
	"github.com/libragen/felix/model"
	"github.com/libragen/felix/ssh2ws/internal"
	"github.com/libragen/felix/wslog"
	"github.com/gin-contrib/cors"
	"github.com/gin-gonic/gin"
)

func RunSsh2ws(bindAddress, user, password, secret string, expire time.Duration, verbose bool) error {
	err := model.CreateGodUser(user, password)
	if err != nil {
		return err
	}
	//config jwt variables
	model.AppSecret = secret
	model.ExpireTime = expire
	model.AppIss = "felix.mojotv.cn"
	if !verbose {
		gin.SetMode(gin.ReleaseMode)
	}
	r := gin.New()
	r.MaxMultipartMemory = 32 << 20
	//sever static file in http's root path
	binStaticMiddleware, err := felixbin.NewGinStaticBinMiddleware("/")
	if err != nil {
		return err
	}

	mwCORS := cors.New(cors.Config{
		AllowOrigins:     []string{"*"},
		AllowMethods:     []string{"PUT", "PATCH", "POST", "GET", "DELETE"},
		AllowHeaders:     []string{"Origin", "Authorization", "Content-Type"},
		ExposeHeaders:    []string{"Content-Type"},
		AllowCredentials: true,
		AllowOriginFunc: func(origin string) bool {
			return true
		},
		MaxAge: 2400 * time.Hour,
	})
	r.Use(binStaticMiddleware, mwCORS)


	{
		r.POST("comment-login", internal.LoginCommenter)       //评论用户登陆
		r.POST("comment-register", internal.RegisterCommenter) //评论用户注册
	}

	api := r.Group("api")
	api.POST("admin-login", internal.LoginAdmin) //管理后台登陆
	api.GET("meta", internal.Meta)

	//terminal log
	hub := wslog.NewHub()
	go hub.Run()

	{
		//websocket
		r.GET("ws/hook", internal.MwUserAdmin, internal.Wslog(hub))
		r.GET("ws/ssh/:id", internal.MwUserAdmin, internal.WsSsh)
	}
	//给外部调用
	{
		api.POST("wslog/hook-api", internal.JwtMiddlewareWslog, internal.WsLogHookApi(hub))
		api.GET("wslog/hook", internal.MwUserAdmin, internal.WslogHookAll)
		api.POST("wslog/hook", internal.MwUserAdmin, internal.WslogHookCreate)
		api.PATCH("wslog/hook", internal.MwUserAdmin, internal.WslogHookUpdate)
		api.DELETE("wslog/hook/:id", internal.MwUserAdmin, internal.WslogHookDelete)

		api.GET("wslog/msg", internal.MwUserAdmin, internal.WslogMsgAll)
		api.POST("wslog/msg-rm", internal.MwUserAdmin, internal.WslogMsgDelete)
	}

	//评论
	{
		api.GET("comment", internal.CommentAll)
		api.GET("comment/:id/:action", internal.MwUserComment, internal.CommentAction)
		api.POST("comment", internal.MwUserComment, internal.CommentCreate)
		api.DELETE("comment/:id", internal.MwUserAdmin, internal.CommentDelete)
	}
	{
		api.GET("hacknews",internal.MwUserAdmin, internal.HackNewAll)
		api.PATCH("hacknews", internal.HackNewUpdate)
		api.POST("hacknews-rm", internal.HackNewRm)
	}

	authG := api.Use(internal.MwUserAdmin)
	{

		//create wslog hook

		authG.GET("ssh", internal.SshAll)
		authG.POST("ssh", internal.SshCreate)
		authG.GET("ssh/:id", internal.SshOne)
		authG.PATCH("ssh", internal.SshUpdate)
		authG.DELETE("ssh/:id", internal.SshDelete)

		authG.GET("sftp/:id", internal.SftpLs)
		authG.GET("sftp/:id/dl", internal.SftpDl)
		authG.GET("sftp/:id/cat", internal.SftpCat)
		authG.GET("sftp/:id/rm", internal.SftpRm)
		authG.GET("sftp/:id/rename", internal.SftpRename)
		authG.GET("sftp/:id/mkdir", internal.SftpMkdir)
		authG.POST("sftp/:id/up", internal.SftpUp)

		authG.POST("ginbro/gen", internal.GinbroGen)
		authG.POST("ginbro/db", internal.GinbroDb)
		authG.GET("ginbro/dl", internal.GinbroDownload)

		authG.GET("ssh-log", internal.SshLogAll)
		authG.DELETE("ssh-log/:id", internal.SshLogDelete)
		authG.PATCH("ssh-log", internal.SshLogUpdate)

		authG.GET("user", internal.UserAll)
		authG.POST("user", internal.RegisterCommenter)
		//api.GET("user/:id", internal.SshAll)
		authG.DELETE("user/:id", internal.UserDelete)
		authG.PATCH("user", internal.UserUpdate)

	}

	if err := r.Run(bindAddress); err != nil {
		return err
	}
	return nil
}