♻️ 重写鉴权中间件，解析完 token 后立即就得读取用户信息的局部缓存。

Author: langyo

packages/database/src/models/system/sys_user.rs

@@ -43,7 +43,7 @@ pub struct Model {
     /// 头像链接
     pub logo: Option<String>,
 
-    /// 角色 ID
+    /// 角色
     pub role_id: SystemUserRole,
     /// 权限策略
     #[sea_orm(column_type = "Json")]
@@ -84,6 +84,7 @@ impl Into<SysUserVO> for Model {
             qq: self.qq,
             phone: self.phone,
             logo: self.logo,
+            role_id: self.role_id,
             access_policy: self.access_policy,
             remark: self.remark,
         }

packages/functions/src/functions/system/mod.rs

@@ -1 +1,2 @@
 pub mod oauth;
+pub mod user;

packages/functions/src/functions/system/oauth.rs

@@ -7,7 +7,8 @@ use sea_orm::{prelude::*, ActiveValue::Set};
 use _database::{models, DB_CONN};
 use _utils::{
     bcrypt::verify_hash,
-    jwt::{generate_token, EXPIRED_APPEND_DURATION},
+    jwt::{generate_token, verify_token, Claims, EXPIRED_APPEND_DURATION},
+    models::SysUserVO,
     types::{
         auth::{OauthAnonymousResponse, OauthLoginResponse, OauthScopeType, OauthTokenType},
         SystemActionLogAction,
@@ -32,15 +33,17 @@ async fn oauth_password_login_inner(
     let access_token = generate_token(now, item.id, jti).await?;
     let refresh_token = generate_token(now, item.id, jti).await?;
 
+    let id = item.id;
+    let vo: SysUserVO = item.into();
     let mut redis_conn = DB_CONN
         .wait()
         .redis_conn
         .get_multiplexed_async_connection()
         .await?;
     redis_conn
         .set_options(
-            format!("jwt:access:{}:{}", item.id, jti),
-            &access_token,
+            format!("jwt:access:{}:{}", id, jti),
+            serde_json::to_string(&vo)?,
             SetOptions::default()
                 .conditional_set(redis::ExistenceCheck::NX)
                 .with_expiration(redis::SetExpiry::EX(
@@ -50,8 +53,8 @@ async fn oauth_password_login_inner(
         .await?;
     redis_conn
         .set_options(
-            format!("jwt:refresh:{}:{}", item.id, jti),
-            &refresh_token,
+            format!("jwt:refresh:{}:{}", id, jti),
+            &"",
             SetOptions::default()
                 .conditional_set(redis::ExistenceCheck::NX)
                 .with_expiration(redis::SetExpiry::EX(
@@ -70,6 +73,21 @@ async fn oauth_password_login_inner(
     })
 }
 
+pub async fn oauth_parse_token(token: String) -> Result<(SysUserVO, Claims)> {
+    let claims = verify_token(&token).await?;
+
+    let mut redis_conn = DB_CONN
+        .wait()
+        .redis_conn
+        .get_multiplexed_async_connection()
+        .await?;
+    let item = redis_conn
+        .get(format!("jwt:access:{}:{}", claims.sub, claims.jti))
+        .await?
+        .ok_or(anyhow!("Token not found in Redis"))?;
+    Ok((serde_json::from_str(&item)?, claims))
+}
+
 pub async fn oauth_password_login(
     username: String,
     password_raw: String,

packages/functions/src/functions/system/user.rs

@@ -0,0 +1,96 @@
+use anyhow::Result;
+
+use _utils::{
+    jwt::AuthInfo,
+    models::Pagination,
+    types::{AccessPolicyItemEnum, SystemUserRole},
+};
+
+// 业务处理函数
+pub async fn do_register(
+    _auth: AuthInfo,
+    _access_policy: Vec<AccessPolicyItemEnum>,
+    _logo: String,
+    _remark: String,
+    _role_id: SystemUserRole,
+    _username: String,
+) -> Result<()> {
+    // TODO: 实现注册逻辑
+    Ok(())
+}
+
+pub async fn do_register_qq(
+    _auth: AuthInfo,
+    _access_policy: Vec<AccessPolicyItemEnum>,
+    _logo: String,
+    _remark: String,
+    _role_id: SystemUserRole,
+    _username: String,
+) -> Result<()> {
+    // TODO: 实现QQ注册逻辑
+    Ok(())
+}
+
+pub async fn do_get_info(_auth: AuthInfo, _user_id: i64) -> Result<()> {
+    // TODO: 实现获取用户信息逻辑
+    Ok(())
+}
+
+pub async fn do_update(
+    _auth: AuthInfo,
+    _id: i64,
+    _access_policy: Option<Vec<AccessPolicyItemEnum>>,
+    _logo: Option<String>,
+    _nickname: Option<String>,
+    _phone: Option<String>,
+    _qq: Option<String>,
+    _remark: Option<String>,
+    _role_id: SystemUserRole,
+) -> Result<()> {
+    // TODO: 实现更新用户信息逻辑
+    Ok(())
+}
+
+pub async fn do_update_password(
+    _auth: AuthInfo,
+    _access_policy: Vec<AccessPolicyItemEnum>,
+    _id: i64,
+    _logo: String,
+    _old_password: String,
+    _remark: String,
+    _role_id: SystemUserRole,
+) -> Result<()> {
+    // TODO: 实现更新用户密码逻辑
+    Ok(())
+}
+
+pub async fn do_update_password_by_admin(
+    _auth: AuthInfo,
+    _password: String,
+    _user_id: i64,
+) -> Result<()> {
+    // TODO: 实现管理员更新用户密码逻辑
+    Ok(())
+}
+
+pub async fn do_delete(_auth: AuthInfo, _work_id: i64) -> Result<()> {
+    // TODO: 实现删除用户逻辑
+    Ok(())
+}
+
+pub async fn do_list(
+    _auth: AuthInfo,
+    _pagination: Pagination,
+    _nickname: String,
+    _role_ids: Option<Vec<SystemUserRole>>,
+    _sort: Option<Vec<String>>, // 简化为 String，因为 UserSort 已移动
+    _username: String,
+) -> Result<()> {
+    // TODO: 实现批量查询用户信息逻辑
+    Ok(())
+}
+
+pub async fn do_kick_out(_auth: AuthInfo, _work_id: String) -> Result<()> {
+    // TODO: 实现踢出用户逻辑
+    Ok(())
+}

packages/router/src/middlewares/auth_extrator.rs

@@ -10,10 +10,8 @@ use axum_extra::{
     TypedHeader,
 };
 
-use _utils::{
-    jwt::{verify_token, AuthInfo},
-    models::CommonResponse,
-};
+use _functions::functions::system::oauth::oauth_parse_token;
+use _utils::{jwt::AuthInfo, models::CommonResponse};
 
 pub struct ExtractAuthInfo(pub AuthInfo);
 
@@ -28,7 +26,7 @@ where
             TypedHeader::<Authorization<Bearer>>::from_request_parts(parts, state).await
         {
             let token = bearer.token().to_string();
-            let claims = verify_token(&token).await.map_err(|err| {
+            let (info, claims) = oauth_parse_token(token).await.map_err(|err| {
                 (
                     StatusCode::UNAUTHORIZED,
                     serde_json::to_string(&CommonResponse::<()>::new(Err(err)))
@@ -38,8 +36,7 @@ where
             })?;
 
             return Ok(Self(AuthInfo {
-                token,
-                user_id: claims.sub,
+                info,
                 created_at: claims.iat,
                 expires_at: claims.exp,
             }));

packages/router/src/routes/system/action_log.rs

@@ -1,25 +1,25 @@
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
 
-use axum::{extract::Query, http::StatusCode, response::IntoResponse};
+use axum::{
+    extract::{Json, Query},
+    http::StatusCode,
+    response::IntoResponse,
+};
 
 use crate::middlewares::ExtractAuthInfo;
-use _utils::models::wrapper::Pagination;
+use _utils::{
+    models::Pagination,
+    types::{ActionLogAction, SystemUserRole},
+};
 
-/// 设备状态
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub enum Action {
-    #[serde(rename = "LOGIN")]
-    Login,
-}
-
-/// 操作日志排序枚举
+/// 格式：字段+ 字段-
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub enum ActionLogSort {
-    #[serde(rename = "action+")]
-    Action,
-    #[serde(rename = "action-")]
-    ActionReverse,
+    #[serde(rename = "createTime+")]
+    CreateTime,
+    #[serde(rename = "createTime-")]
+    CreateTimeReverse,
     #[serde(rename = "deviceId+")]
     DeviceId,
     #[serde(rename = "deviceId-")]
@@ -46,7 +46,7 @@ pub enum ActionLogSort {
 #[serde(rename_all = "camelCase")]
 pub struct ActionLogParams {
     /// 设备状态
-    pub action: Option<Action>,
+    pub action: Option<ActionLogAction>,
     #[serde(flatten)]
     pub pagination: Option<Pagination>,
     /// 设备ID
@@ -68,5 +68,9 @@ pub async fn list(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Query(query): Query<ActionLogParams>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }

packages/router/src/routes/system/archive.rs

@@ -9,6 +9,7 @@ use axum::{
 };
 
 use crate::middlewares::ExtractAuthInfo;
+use _utils::types::SystemUserRole;
 
 /// 获取指定槽位的最新存档
 /// GET /archive/last/{slot_index}
@@ -17,7 +18,11 @@ pub async fn get_last(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Path(slot_index): Path<u64>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 获取指定槽位的所有历史存档
@@ -27,7 +32,11 @@ pub async fn get_history(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Path(slot_index): Path<u64>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 获取所有槽位的历史存档
@@ -36,7 +45,11 @@ pub async fn get_history(
 pub async fn get_all_history(
     ExtractAuthInfo(auth): ExtractAuthInfo,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -55,7 +68,11 @@ pub async fn put(
     Path((slot_index, name)): Path<(u64, String)>,
     Json(payload): Json<ArchiveSaveParams>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 存档入指定槽位
@@ -66,7 +83,11 @@ pub async fn save(
     Path(slot_index): Path<u64>,
     Json(payload): Json<ArchiveSaveParams>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 重命名指定槽位
@@ -76,7 +97,11 @@ pub async fn rename(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Path((slot_index, new_name)): Path<(u64, String)>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 删除最近一次存档（恢复为上次存档）
@@ -86,7 +111,11 @@ pub async fn restore(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Path(slot_index): Path<u64>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }
 
 /// 删除存档槽位
@@ -96,5 +125,9 @@ pub async fn delete_slot(
     ExtractAuthInfo(auth): ExtractAuthInfo,
     Path(slot_index): Path<u64>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    Ok(())
+    if auth.info.role_id != SystemUserRole::Admin {
+        return Ok((axum::http::StatusCode::FORBIDDEN, "Forbidden".to_string()).into_response());
+    }
+
+    Ok(Json(()).into_response())
 }