|
|
@@ -292,52 +292,52 @@ export class AuthService {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- async oauth(user: User, req: FastifyRequest) {
|
|
|
- await this.loginLogService.createLog(
|
|
|
- user.username,
|
|
|
- req,
|
|
|
- LoginType.LOGIN,
|
|
|
- LoginStatus.SUCCESS,
|
|
|
- );
|
|
|
-
|
|
|
- const roleIds = await this.userService.getUserRoleIds(user.id, true);
|
|
|
- // check if roleIds in 2, 3, 4
|
|
|
- if (!roleIds.some((id: number) => [2, 3, 4].includes(id))) {
|
|
|
- throw new UnauthorizedException('您没有权限访问此资源');
|
|
|
- }
|
|
|
-
|
|
|
- const roleInfo: any[] = [];
|
|
|
- for (const roleId of roleIds) {
|
|
|
- const role = await this.roleService.get(roleId);
|
|
|
-
|
|
|
- roleInfo.push({
|
|
|
- id: role.id,
|
|
|
- name: role.name,
|
|
|
- });
|
|
|
- }
|
|
|
-
|
|
|
- const payload: JwtPayload = {
|
|
|
- username: user.username,
|
|
|
- userId: user.id,
|
|
|
- roleIds: roleIds,
|
|
|
- };
|
|
|
- const token = this.jwtService.sign(payload);
|
|
|
-
|
|
|
- // 更新用户的 JWT Token
|
|
|
- await this.userService.updateOAuthJwtToken(user.id, token);
|
|
|
-
|
|
|
- const userData = await this.userService.get(user.id);
|
|
|
-
|
|
|
- return {
|
|
|
- kfId: user.id,
|
|
|
- account: user.username,
|
|
|
- token: this.jwtService.sign(payload),
|
|
|
- avatar: user.photo || '',
|
|
|
- nick: user.nick || '',
|
|
|
- // quota: user.quota,
|
|
|
- roleInfo: roleInfo,
|
|
|
- };
|
|
|
- }
|
|
|
+ // async oauth(user: User, req: FastifyRequest) {
|
|
|
+ // await this.loginLogService.createLog(
|
|
|
+ // user.username,
|
|
|
+ // req,
|
|
|
+ // LoginType.LOGIN,
|
|
|
+ // LoginStatus.SUCCESS,
|
|
|
+ // );
|
|
|
+
|
|
|
+ // const roleIds = await this.userService.getUserRoleIds(user.id, true);
|
|
|
+ // // check if roleIds in 2, 3, 4
|
|
|
+ // if (!roleIds.some((id: number) => [2, 3, 4].includes(id))) {
|
|
|
+ // throw new UnauthorizedException('您没有权限访问此资源');
|
|
|
+ // }
|
|
|
+
|
|
|
+ // const roleInfo: any[] = [];
|
|
|
+ // for (const roleId of roleIds) {
|
|
|
+ // const role = await this.roleService.get(roleId);
|
|
|
+
|
|
|
+ // roleInfo.push({
|
|
|
+ // id: role.id,
|
|
|
+ // name: role.name,
|
|
|
+ // });
|
|
|
+ // }
|
|
|
+
|
|
|
+ // const payload: JwtPayload = {
|
|
|
+ // username: user.username,
|
|
|
+ // userId: user.id,
|
|
|
+ // roleIds: roleIds,
|
|
|
+ // };
|
|
|
+ // const token = this.jwtService.sign(payload);
|
|
|
+
|
|
|
+ // // 更新用户的 JWT Token
|
|
|
+ // await this.userService.updateOAuthJwtToken(user.id, token);
|
|
|
+
|
|
|
+ // const userData = await this.userService.get(user.id);
|
|
|
+
|
|
|
+ // return {
|
|
|
+ // kfId: user.id,
|
|
|
+ // account: user.username,
|
|
|
+ // token: this.jwtService.sign(payload),
|
|
|
+ // avatar: user.photo || '',
|
|
|
+ // nick: user.nick || '',
|
|
|
+ // // quota: user.quota,
|
|
|
+ // roleInfo: roleInfo,
|
|
|
+ // };
|
|
|
+ // }
|
|
|
|
|
|
// auth.service.ts (excerpt)
|
|
|
async login(user: User, req: FastifyRequest) {
|
|
|
@@ -398,53 +398,53 @@ export class AuthService {
|
|
|
};
|
|
|
}
|
|
|
|
|
|
- async oauth2fa(user: User, req: FastifyRequest) {
|
|
|
- // 1) login audit
|
|
|
- await this.loginLogService.createLog(
|
|
|
- user.username,
|
|
|
- req,
|
|
|
- LoginType.LOGIN,
|
|
|
- LoginStatus.SUCCESS,
|
|
|
- );
|
|
|
-
|
|
|
- // 2) role gate: only allow roles 2/3/4
|
|
|
- const roleIds = await this.userService.getUserRoleIds(user.id, true);
|
|
|
- if (!roleIds.some((id: number) => [2, 3, 4].includes(id))) {
|
|
|
- throw new UnauthorizedException('您没有权限访问此资源');
|
|
|
- }
|
|
|
-
|
|
|
- // 3) role info (unchanged)
|
|
|
- const roleInfo: Array<{ id: number; name: string }> = [];
|
|
|
- for (const roleId of roleIds) {
|
|
|
- const role = await this.roleService.get(roleId);
|
|
|
- roleInfo.push({ id: role.id, name: role.name });
|
|
|
- }
|
|
|
-
|
|
|
- // 4) build OAuth payload (NO mfa / NO stage)
|
|
|
- const payload: JwtPayload = {
|
|
|
- userId: user.id,
|
|
|
- username: user.username,
|
|
|
- roleIds,
|
|
|
- // mfa: undefined, // intentionally omitted
|
|
|
- // stage: undefined // intentionally omitted
|
|
|
- };
|
|
|
-
|
|
|
- // 5) sign OAuth token (explicit expiry, e.g., 8h)
|
|
|
- const token = await this.jwtService.signAsync(payload);
|
|
|
-
|
|
|
- // 6) persist ONLY the OAuth token (do not touch user.jwtToken)
|
|
|
- await this.userService.updateOAuthJwtToken(user.id, token);
|
|
|
-
|
|
|
- // 7) response (same shape you used)
|
|
|
- return {
|
|
|
- kfId: user.id,
|
|
|
- account: user.username,
|
|
|
- token, // OAuth token
|
|
|
- avatar: user.photo || '',
|
|
|
- nick: user.nick || '',
|
|
|
- roleInfo,
|
|
|
- };
|
|
|
- }
|
|
|
+ // async oauth2fa(user: User, req: FastifyRequest) {
|
|
|
+ // // 1) login audit
|
|
|
+ // await this.loginLogService.createLog(
|
|
|
+ // user.username,
|
|
|
+ // req,
|
|
|
+ // LoginType.LOGIN,
|
|
|
+ // LoginStatus.SUCCESS,
|
|
|
+ // );
|
|
|
+
|
|
|
+ // // 2) role gate: only allow roles 2/3/4
|
|
|
+ // const roleIds = await this.userService.getUserRoleIds(user.id, true);
|
|
|
+ // if (!roleIds.some((id: number) => [2, 3, 4].includes(id))) {
|
|
|
+ // throw new UnauthorizedException('您没有权限访问此资源');
|
|
|
+ // }
|
|
|
+
|
|
|
+ // // 3) role info (unchanged)
|
|
|
+ // const roleInfo: Array<{ id: number; name: string }> = [];
|
|
|
+ // for (const roleId of roleIds) {
|
|
|
+ // const role = await this.roleService.get(roleId);
|
|
|
+ // roleInfo.push({ id: role.id, name: role.name });
|
|
|
+ // }
|
|
|
+
|
|
|
+ // // 4) build OAuth payload (NO mfa / NO stage)
|
|
|
+ // const payload: JwtPayload = {
|
|
|
+ // userId: user.id,
|
|
|
+ // username: user.username,
|
|
|
+ // roleIds,
|
|
|
+ // // mfa: undefined, // intentionally omitted
|
|
|
+ // // stage: undefined // intentionally omitted
|
|
|
+ // };
|
|
|
+
|
|
|
+ // // 5) sign OAuth token (explicit expiry, e.g., 8h)
|
|
|
+ // const token = await this.jwtService.signAsync(payload);
|
|
|
+
|
|
|
+ // // 6) persist ONLY the OAuth token (do not touch user.jwtToken)
|
|
|
+ // await this.userService.updateOAuthJwtToken(user.id, token);
|
|
|
+
|
|
|
+ // // 7) response (same shape you used)
|
|
|
+ // return {
|
|
|
+ // kfId: user.id,
|
|
|
+ // account: user.username,
|
|
|
+ // token, // OAuth token
|
|
|
+ // avatar: user.photo || '',
|
|
|
+ // nick: user.nick || '',
|
|
|
+ // roleInfo,
|
|
|
+ // };
|
|
|
+ // }
|
|
|
|
|
|
async login2fa(user: User, req: FastifyRequest) {
|
|
|
// 1) login audit
|