fm453/nocobase
1
0
Fork 0
mirror of https://gitee.com/nocobase/nocobase.git synced 2025-07-01 18:52:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: auth check failed before api token expired (#6291)

Browse Source 
* refactor: streamline token validation logic in BaseAuth class
This commit is contained in:
Sheldon Guo 2025-02-26 07:33:27 +08:00 committed by GitHub
parent 1785d9f44f
commit b748fa2471
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 36 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
packages/core/auth/src/base/auth.ts
View File

@ -72,6 +72,7 @@ export class BaseAuth extends Auth {
async check(): ReturnType<Auth['check']> {
const token = this.ctx.getBearerToken();
const cache = this.ctx.cache as Cache;
if (!token) {
this.ctx.throw(401, {
@ -100,6 +101,41 @@ export class BaseAuth extends Auth {
const { userId, roleName, iat, temp, jti, exp, signInTime } = payload ?? {};
const user = userId
? await cache.wrap(this.getCacheKey(userId), () =>
this.userRepository.findOne({
filter: {
id: userId,
},
raw: true,
}),
)
: null;
if (roleName) {
this.ctx.headers['x-role'] = roleName;
}
const blocked = await this.jwt.blacklist.has(jti ?? token);
if (blocked) {
this.ctx.throw(401, {
message: this.ctx.t('Your session has expired. Please sign in again.', { ns: localeNamespace }),
code: AuthErrorCode.BLOCKED_TOKEN,
});
}
// api token check first
if (!temp) {
if (tokenStatus === 'valid') {
return user;
} else {
this.ctx.throw(401, {
message: this.ctx.t('Your session has expired. Please sign in again.', { ns: localeNamespace }),
code: AuthErrorCode.INVALID_TOKEN,
});
}
}
const tokenPolicy = await this.tokenController.getConfig();
if (signInTime && Date.now() - signInTime > tokenPolicy.sessionExpirationTime) {
@ -113,36 +149,6 @@ export class BaseAuth extends Auth {
tokenStatus = 'expired';
}
const blocked = await this.jwt.blacklist.has(jti ?? token);
if (blocked) {
this.ctx.throw(401, {
message: this.ctx.t('Your session has expired. Please sign in again.', { ns: localeNamespace }),
code: AuthErrorCode.BLOCKED_TOKEN,
});
}
if (roleName) {
this.ctx.headers['x-role'] = roleName;
}
const cache = this.ctx.cache as Cache;
const user = await cache.wrap(this.getCacheKey(userId), () =>
this.userRepository.findOne({
filter: {
id: userId,
},
raw: true,
}),
);
if (!temp && tokenStatus !== 'valid') {
this.ctx.throw(401, {
message: this.ctx.t('Your session has expired. Please sign in again.', { ns: localeNamespace }),
code: AuthErrorCode.INVALID_TOKEN,
});
}
if (tokenStatus === 'valid' && user.passwordChangeTz && iat * 1000 < user.passwordChangeTz) {
this.ctx.throw(401, {
message: this.ctx.t('User password changed, please signin again.', { ns: localeNamespace }),