72 lines
2.1 KiB
Go
72 lines
2.1 KiB
Go
// Package auth 管理端 session：与 next-project lib/admin-auth.ts 的 token 格式兼容（exp.signature）
|
||
package auth
|
||
|
||
import (
|
||
"crypto/hmac"
|
||
"crypto/sha256"
|
||
"encoding/base64"
|
||
"net/http"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
)
|
||
|
||
const (
|
||
adminCookieName = "admin_session"
|
||
maxAgeSec = 7 * 24 * 3600 // 7 天
|
||
)
|
||
|
||
// CreateAdminToken 生成签名 token，格式与 next 一致：exp.base64url(hmac_sha256(exp))
|
||
func CreateAdminToken(secret string) string {
|
||
exp := time.Now().Unix() + maxAgeSec
|
||
payload := strconv.FormatInt(exp, 10)
|
||
mac := hmac.New(sha256.New, []byte(secret))
|
||
mac.Write([]byte(payload))
|
||
sig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
|
||
return payload + "." + sig
|
||
}
|
||
|
||
// VerifyAdminToken 校验 token：解析 exp、验签、验过期
|
||
func VerifyAdminToken(token, secret string) bool {
|
||
if token == "" || secret == "" {
|
||
return false
|
||
}
|
||
dot := strings.Index(token, ".")
|
||
if dot <= 0 {
|
||
return false
|
||
}
|
||
payload := token[:dot]
|
||
sig := token[dot+1:]
|
||
exp, err := strconv.ParseInt(payload, 10, 64)
|
||
if err != nil || exp < time.Now().Unix() {
|
||
return false
|
||
}
|
||
mac := hmac.New(sha256.New, []byte(secret))
|
||
mac.Write([]byte(payload))
|
||
expected := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
|
||
return hmac.Equal([]byte(sig), []byte(expected))
|
||
}
|
||
|
||
// AdminCookieName 返回 Cookie 名
|
||
func AdminCookieName() string { return adminCookieName }
|
||
|
||
// MaxAgeSec 返回 session 有效秒数
|
||
func MaxAgeSec() int { return maxAgeSec }
|
||
|
||
// SetCookieHeaderValue 返回完整的 Set-Cookie 头内容（含 SameSite=None; Secure，供跨站时携带 Cookie）
|
||
func SetCookieHeaderValue(token string, maxAge int) string {
|
||
if maxAge <= 0 {
|
||
return adminCookieName + "=; Path=/; Max-Age=0; HttpOnly; SameSite=None; Secure"
|
||
}
|
||
return adminCookieName + "=" + token + "; Path=/; Max-Age=" + strconv.Itoa(maxAge) + "; HttpOnly; SameSite=None; Secure"
|
||
}
|
||
|
||
// GetAdminTokenFromRequest 从请求 Cookie 中读取 admin_session
|
||
func GetAdminTokenFromRequest(r *http.Request) string {
|
||
c, err := r.Cookie(adminCookieName)
|
||
if err != nil || c == nil {
|
||
return ""
|
||
}
|
||
return strings.TrimSpace(c.Value)
|
||
}
|