mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-10-09 15:38:32 +00:00
zhangwenjian
bb34108831
close #820 GET /api/v1/refresh_token 用业务 token 即可换取新 token，而续期上限 MaxRefresh 依据的 orig_iat 在每次续期时被一并重置，上限永远无法到达 —— token 一旦泄露即等同于永久访问权，且无任何吊销手段。 该路由此前还位于 CasbinExclude 中，不受 Casbin 约束，任何角色的已登录用户 都可调用。 官方前端从未使用它：store 中虽有 refreshToken action，但全仓库无一处 dispatch，属死代码。移除不影响正常登录与鉴权流程。 破坏性变更：自行调用该端点实现续期的使用者需改为重新登录。正确的无感续期 应在 go-admin-core 中区分 access token 与 refresh token 后重新实现，不应 沿用此路由。
96 lines
3.0 KiB
Go
96 lines
3.0 KiB
Go
package router
|
||
|
||
import (
|
||
"go-admin/app/admin/apis"
|
||
"mime"
|
||
|
||
"github.com/go-admin-team/go-admin-core/sdk/config"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
|
||
"github.com/go-admin-team/go-admin-core/sdk/pkg/ws"
|
||
ginSwagger "github.com/swaggo/gin-swagger"
|
||
|
||
swaggerfiles "github.com/swaggo/files"
|
||
|
||
"go-admin/common/middleware"
|
||
"go-admin/common/middleware/handler"
|
||
_ "go-admin/docs/admin"
|
||
)
|
||
|
||
func InitSysRouter(r *gin.Engine, authMiddleware *jwt.GinJWTMiddleware) *gin.RouterGroup {
|
||
g := r.Group("")
|
||
sysBaseRouter(g)
|
||
// 静态文件
|
||
sysStaticFileRouter(g)
|
||
// swagger；注意：生产环境可以注释掉
|
||
if config.ApplicationConfig.Mode != "prod" {
|
||
sysSwaggerRouter(g)
|
||
}
|
||
// 需要认证
|
||
sysCheckRoleRouterInit(g, authMiddleware)
|
||
return g
|
||
}
|
||
|
||
func sysBaseRouter(r *gin.RouterGroup) {
|
||
|
||
go ws.WebsocketManager.Start()
|
||
go ws.WebsocketManager.SendService()
|
||
go ws.WebsocketManager.SendAllService()
|
||
|
||
if config.ApplicationConfig.Mode != "prod" {
|
||
r.GET("/", apis.GoAdmin)
|
||
}
|
||
r.GET("/info", handler.Ping)
|
||
}
|
||
|
||
func sysStaticFileRouter(r *gin.RouterGroup) {
|
||
err := mime.AddExtensionType(".js", "application/javascript")
|
||
if err != nil {
|
||
return
|
||
}
|
||
r.Static("/static", "./static")
|
||
if config.ApplicationConfig.Mode != "prod" {
|
||
r.Static("/form-generator", "./static/form-generator")
|
||
}
|
||
}
|
||
|
||
func sysSwaggerRouter(r *gin.RouterGroup) {
|
||
r.GET("/swagger/admin/*any", ginSwagger.WrapHandler(swaggerfiles.NewHandler(), ginSwagger.InstanceName("admin")))
|
||
}
|
||
|
||
func sysCheckRoleRouterInit(r *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddleware) {
|
||
wss := r.Group("").Use(authMiddleware.MiddlewareFunc())
|
||
{
|
||
wss.GET("/ws/:id/:channel", ws.WebsocketManager.WsClient)
|
||
wss.GET("/wslogout/:id/:channel", ws.WebsocketManager.UnWsClient)
|
||
}
|
||
|
||
v1 := r.Group("/api/v1")
|
||
{
|
||
v1.POST("/login", authMiddleware.LoginHandler)
|
||
// GET /api/v1/refresh_token 已移除，原因见 issue #820：
|
||
// 该接口用业务 token 即可换取新 token，而续期上限 MaxRefresh 依据的
|
||
// orig_iat 在每次续期时被一并重置，上限永远无法到达 —— token 一旦泄
|
||
// 露即等同于永久访问权。它此前还位于 CasbinExclude 中，任何角色的已
|
||
// 登录用户都能调用，不受权限约束。
|
||
//
|
||
// 官方前端从未调用该接口（store 中的 refreshToken action 无人 dispatch），
|
||
// 移除不影响正常使用。若确需无感续期，应在 go-admin-core 中区分
|
||
// access token 与 refresh token 后重新实现，而非沿用此路由。
|
||
}
|
||
registerBaseRouter(v1, authMiddleware)
|
||
}
|
||
|
||
func registerBaseRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddleware) {
|
||
api := apis.SysMenu{}
|
||
api2 := apis.SysDept{}
|
||
v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
|
||
{
|
||
v1auth.GET("/roleMenuTreeselect/:roleId", api.GetMenuTreeSelect)
|
||
//v1.GET("/menuTreeselect", api.GetMenuTreeSelect)
|
||
v1auth.GET("/roleDeptTreeselect/:roleId", api2.GetDeptTreeRoleSelect)
|
||
v1auth.POST("/logout", handler.LogOut)
|
||
}
|
||
}
|