xuyueandClaude Opus 5.5
26827e31d5
Deploy / deploy (build, debian, 22) (push) Canceled after 0s
- 登录返回 15 分钟的 access token（HS256，密钥 JWT_SECRET，未配置则每次启动随机） 和 14 天的 refresh token；请求带 Authorization: Bearer，WebSocket 用 ?token= - refresh token 只存 sha256，放在新表 auth_refresh_token（删除旧的 auth_session）； POST /account/refresh 换新的 access token，退出、改密码、封号时作废 - 带了无效或过期的 token 一律 401，前端据此刷新：快过期时提前刷新、并发请求只刷新一次， 401 时刷新后重试一次，refresh token 也失效才退出登录 - 不再用 cookie，去掉 CORS credentials 和写请求的 Origin 校验 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.1 KiB
TypeScript
71 lines
2.1 KiB
TypeScript
import axios from "axios"
|
|
import { BASE_URL, STORAGE_KEY, WS_BASE_URL } from "./utils/const"
|
|
|
|
// access token 有效期很短，快过期时提前换新的
|
|
const REFRESH_AHEAD_MS = 30_000
|
|
|
|
export function setTokens(tokens: {
|
|
access_token: string
|
|
refresh_token?: string
|
|
}) {
|
|
localStorage.setItem(STORAGE_KEY.ACCESS_TOKEN, tokens.access_token)
|
|
if (tokens.refresh_token) {
|
|
localStorage.setItem(STORAGE_KEY.REFRESH_TOKEN, tokens.refresh_token)
|
|
}
|
|
}
|
|
|
|
export function clearTokens() {
|
|
localStorage.removeItem(STORAGE_KEY.ACCESS_TOKEN)
|
|
localStorage.removeItem(STORAGE_KEY.REFRESH_TOKEN)
|
|
}
|
|
|
|
export const getRefreshToken = () =>
|
|
localStorage.getItem(STORAGE_KEY.REFRESH_TOKEN)
|
|
|
|
export const hasLogin = () => !!getRefreshToken()
|
|
|
|
function expiresSoon(token: string) {
|
|
try {
|
|
const payload = token.split(".")[1]!.replace(/-/g, "+").replace(/_/g, "/")
|
|
const { exp } = JSON.parse(atob(payload))
|
|
return exp * 1000 - Date.now() < REFRESH_AHEAD_MS
|
|
} catch {
|
|
return true
|
|
}
|
|
}
|
|
|
|
let refreshing: Promise<string | null> | null = null
|
|
|
|
// 同时有多个请求要刷新时只发一次
|
|
export function refreshAccessToken(): Promise<string | null> {
|
|
const refreshToken = getRefreshToken()
|
|
if (!refreshToken) return Promise.resolve(null)
|
|
refreshing ??= axios
|
|
.post(`${BASE_URL}/account/refresh`, { refresh_token: refreshToken })
|
|
.then((res) => {
|
|
setTokens(res.data)
|
|
return res.data.access_token as string
|
|
})
|
|
.catch((err) => {
|
|
// refresh token 失效（过期、改密码、封号）才清掉；网络错误下次再试
|
|
if (err.response?.status === 401) clearTokens()
|
|
return null
|
|
})
|
|
.finally(() => {
|
|
refreshing = null
|
|
})
|
|
return refreshing
|
|
}
|
|
|
|
export async function getAccessToken() {
|
|
const token = localStorage.getItem(STORAGE_KEY.ACCESS_TOKEN)
|
|
if (token && !expiresSoon(token)) return token
|
|
return refreshAccessToken()
|
|
}
|
|
|
|
// 浏览器建 WebSocket 时不能加请求头，token 放在查询参数里
|
|
export async function wsUrl(path: string) {
|
|
const token = await getAccessToken()
|
|
return `${WS_BASE_URL}${path}?token=${encodeURIComponent(token ?? "")}`
|
|
}
|