<?php

return [
    // ==================== Token 基础配置 ====================
    // tokenName: Token 名称，同时也是 Cookie 名称
    'tokenName' => 'satoken',
    
    // tokenPrefix: Token 前缀，如 Bearer
    'tokenPrefix' => 'Bearer',
    
    // tokenStyle: Token 风格
    // uuid: UUID 格式 (550e8400-e29b-41d4-a716-446655440000)
    // simple-uuid: 简化 UUID (550e8400e29b41d4a716446655440000)
    // random-32: 32位随机字符串
    // random-64: 64位随机字符串
    // random-128: 128位随机字符串
    // tik: 24位随机字符串
    'tokenStyle' => 'uuid',
    
    // ==================== 有效期配置 ====================
    // timeout: Token 有效期（秒），默认30天，-1代表永不过期
    'timeout' => 86400,
    
    // activityTimeout: 最低活跃频率（秒），-1不限制
    // 设置为正数时，每次请求会刷新 Token 有效期
    'activityTimeout' => -1,
    
    // ==================== Cookie 详细配置 ====================
    // cookieName: Cookie 名称（默认与 tokenName 一致）
    'cookieName' => 'satoken',
    
    // cookieDomain: Cookie 域名，空表示当前域名
    // 设置为 .example.com 可在子域名间共享
    'cookieDomain' => '',
    
    // cookiePath: Cookie 路径，'/' 表示整个网站都有效
    'cookiePath' => '/',
    
    // cookieSecure: 是否仅通过 HTTPS 传输，生产环境建议 true
    'cookieSecure' => false,
    
    // cookieHttpOnly: 是否禁止 JavaScript 读取 Cookie，建议 true 防止 XSS
    'cookieHttpOnly' => true,
    
    // cookieSameSite: CSRF 防护策略
    // Strict: 最安全，Lax: 兼容性更好，None: 需要配合 Secure
    'cookieSameSite' => 'Strict',
    
    // cookieMaxAge: Cookie 在客户端的最大存活时间（秒）
    'cookieMaxAge' => 86400,
    
    // cookiePrefix: Cookie 前缀，如 __Secure- 增强安全性
    'cookiePrefix' => '',
    
    // ==================== 读取/写入配置 ====================
    // isReadHeader: 是否从 Header 读取 Token
    'isReadHeader' => true,
    
    // isReadCookie: 是否从 Cookie 读取 Token
    'isReadCookie' => true,
    
    // isReadBody: 是否从请求体读取 Token
    'isReadBody' => false,
    
    // isWriteCookie: 登录后是否写入 Cookie
    'isWriteCookie' => true,
    
    // isWriteHeader: 登录后是否写入响应头
    'isWriteHeader' => false,
    
    // ==================== 登录策略 ====================
    // concurrent: 是否允许多端同时登录
    'concurrent' => true,
    
    // isShare: 同端是否复用 Token
    'isShare' => true,
    
    // maxLoginCount: 同账号最大登录数，-1不限
    'maxLoginCount' => 12,
    
    // maxTryTimes: 创建 Token 最高循环次数
    'maxTryTimes' => 12,
    
    // ==================== 存储配置（Redis 模式） ====================
    'storage' => 'redis',
    'redis' => [
        'host' => env('REDIS_HOST', '127.0.0.1'),
        'port' => env('REDIS_PORT', 6379),
        'password' => env('REDIS_PASSWORD', ''),
        'db' => env('REDIS_DB', 0),
        'timeout' => 3,
        'prefix' => 'sa_token_',
    ],
    
    // ==================== Session 配置 ====================
    'session' => [
        'timeout' => 86400,
        'activityTimeout' => 1800,
        'maxSize' => 1024,
        'prefix' => 'session_',
    ],
    
    // ==================== 加密配置 ====================
    // cryptoType: 加密类型，intl（国际）/ sm（国密）
    'cryptoType' => 'intl',
    
    // tokenEncrypt: 是否启用 Token 内容加密
    'tokenEncrypt' => false,
    
    // tokenEncryptKey: Token 加密密钥（16/24/32 字节）
    'tokenEncryptKey' => '',
    
    // tokenFingerprint: 是否启用 Token 指纹绑定（IP + User-Agent）
    'tokenFingerprint' => false,
    
    // ==================== Refresh Token ====================
    // refreshToken: 是否启用 RefreshToken
    'refreshToken' => false,
    
    // refreshTokenTimeout: RefreshToken 有效期（秒），默认30天
    'refreshTokenTimeout' => 2592000,
    
    // refreshTokenRotation: 刷新时是否轮换 RefreshToken
    'refreshTokenRotation' => true,
    
    // ==================== 安全配置 ====================
    // antiBruteMaxFailures: 防暴力破解最大失败次数，0不限制
    'antiBruteMaxFailures' => 5,
    
    // antiBruteLockDuration: 锁定持续时间（秒）
    'antiBruteLockDuration' => 600,
    
    // ipAnomalyDetection: IP 异常检测
    'ipAnomalyDetection' => true,
    
    // ipAnomalySensitivity: IP 异常灵敏度（1-5）
    'ipAnomalySensitivity' => 3,
    
    // deviceManagement: 设备管理
    'deviceManagement' => true,
    
    // auditLog: 审计日志
    'auditLog' => true,
    
    // auditLogMaxEntries: 每种事件最大日志条数
    'auditLogMaxEntries' => 1000,
    
    // auditLogTtlDays: 日志保留天数
    'auditLogTtlDays' => 30,
    
    // ==================== JWT 配置 ====================
    'jwtSecretKey' => env('JWT_SECRET_KEY', ''),
    'jwtStateless' => false,
    
    // ==================== 签名配置 ====================
    'signKey' => env('SIGN_KEY', ''),
    'signTimestampGap' => 600,
    'signAlg' => 'sha256',
    
    // ==================== 日志配置 ====================
    'isLog' => env('APP_DEBUG', false),
];

<?php

declare(strict_types=1);

namespace app\service;

use think\facade\Db;

/**
 * 权限数据提供者
 * 负责从数据库获取用户的权限和角色信息
 */
class PermissionService
{
    /**
     * 获取用户权限码集合
     *
     * @param int $userId 用户ID
     * @return array 权限码列表
     */
    public function getPermissionList(int $userId): array
    {
        $perms = Db::name('user_permission')
            ->where('user_id', $userId)
            ->column('permission_code');
        return $perms ?: [];
    }

    /**
     * 获取用户角色标识集合
     *
     * @param int $userId 用户ID
     * @return array 角色标识列表
     */
    public function getRoleList(int $userId): array
    {
        $roles = Db::name('user_role')
            ->alias('ur')
            ->join('role r', 'ur.role_id = r.id')
            ->where('ur.user_id', $userId)
            ->column('r.role_code');
        return $roles ?: [];
    }

    /**
     * 获取用户所有权限（含角色继承）
     *
     * @param int $userId 用户ID
     * @return array 所有权限码列表
     */
    public function getAllPermissions(int $userId): array
    {
        $roles = $this->getRoleList($userId);
        $perms = [];

        // 从角色继承权限
        if (!empty($roles)) {
            $rolePerms = Db::name('role_permission')
                ->whereIn('role_code', $roles)
                ->column('permission_code');
            $perms = array_merge($perms, $rolePerms);
        }

        // 合并用户直接权限
        $userPerms = $this->getPermissionList($userId);
        $perms = array_merge($perms, $userPerms);

        return array_unique($perms);
    }

    /**
     * 验证用户密码
     *
     * @param string $username 用户名
     * @param string $password 密码
     * @return array|null 用户信息或 null
     */
    public function verifyPassword(string $username, string $password): ?array
    {
        $user = Db::name('user')
            ->where('username', $username)
            ->where('status', 1)
            ->find();

        if ($user && password_verify($password, $user['password'])) {
            return $user;
        }
        return null;
    }

    /**
     * 根据用户ID获取用户信息
     *
     * @param int $userId 用户ID
     * @return array|null 用户信息
     */
    public function getUserById(int $userId): ?array
    {
        return Db::name('user')->find($userId);
    }

    /**
     * 检查用户是否有指定权限
     *
     * @param int $userId 用户ID
     * @param string $permission 权限码
     * @return bool
     */
    public function hasPermission(int $userId, string $permission): bool
    {
        $permissions = $this->getAllPermissions($userId);
        return in_array($permission, $permissions);
    }

    /**
     * 检查用户是否有指定角色
     *
     * @param int $userId 用户ID
     * @param string $role 角色码
     * @return bool
     */
    public function hasRole(int $userId, string $role): bool
    {
        $roles = $this->getRoleList($userId);
        return in_array($role, $roles);
    }
}

<?php

declare(strict_types=1);

namespace app\provider;

use think\Service;
use SaToken\SaToken;
use SaToken\Dao\SaTokenDaoRedis;
use SaToken\StpUtil;
use app\service\PermissionService;

class SaTokenProvider extends Service
{
    public function register(): void
    {
        // 1. 加载配置
        $config = config('sa_token');

        // 2. 初始化 Sa-Token
        SaToken::init($config);

        // 3. 设置 Redis 存储驱动
        if ($config['storage'] === 'redis') {
            SaToken::setDao(new SaTokenDaoRedis($config['redis']));
        }

        // 4. 注入权限提供者
        $this->injectPermissionGetter();

        // 5. 注册事件监听器（可选）
        $this->registerListeners();
    }

    protected function injectPermissionGetter(): void
    {
        $service = new PermissionService();

        // 设置权限获取回调
        StpUtil::setPermissionGetter(function($loginId) use ($service) {
            return $service->getAllPermissions((int) $loginId);
        });

        // 设置角色获取回调
        StpUtil::setRoleGetter(function($loginId) use ($service) {
            return $service->getRoleList((int) $loginId);
        });
    }

    protected function registerListeners(): void
    {
        // 注册事件监听器
        // SaToken::addListener(new MySaTokenListener());
    }
}

<?php

declare(strict_types=1);

namespace app\middleware;

use SaToken\SaRouter;
use SaToken\StpUtil;
use SaToken\Exception\NotLoginException;
use SaToken\Exception\NotPermissionException;
use SaToken\Exception\NotRoleException;
use SaToken\Exception\DisableServiceException;
use think\Response;
use think\facade\Log;

class SaTokenMiddleware
{
    public function handle($request, \Closure $next)
    {
        try {
            // ========== 定义路由拦截规则 ==========

            // 1. 登录校验：所有 /api/** 接口需要登录
            // 排除登录、注册、刷新接口
            SaRouter::match('/api/**')
                ->exclude('/api/login', '/api/register', '/api/refresh')
                ->check(function() {
                    StpUtil::checkLogin();
                });

            // 2. 角色校验：/admin/** 需要 admin 角色
            SaRouter::match('/admin/**')
                ->check(function() {
                    StpUtil::checkLogin();
                    StpUtil::checkRole('admin');
                });

            // 3. 权限校验：/api/user/** 需要 user:read 权限
            SaRouter::match('/api/user/**')
                ->check(function() {
                    StpUtil::checkPermission('user:read');
                });

            // 4. 多权限校验：/api/order/** 需要 order:manage 或 order:view
            SaRouter::match('/api/order/**')
                ->check(function() {
                    StpUtil::checkPermissionOr(['order:manage', 'order:view']);
                });

            // 5. GET 请求特殊校验：/api/search/** 需要登录
            SaRouter::match('/api/search/**', 'GET')
                ->check(function() {
                    StpUtil::checkLogin();
                });

            // 6. POST 请求特殊校验：/api/upload/** 需要 upload 权限
            SaRouter::match('/api/upload/**', 'POST')
                ->check(function() {
                    StpUtil::checkPermission('upload');
                });

        } catch (NotLoginException $e) {
            return $this->error(401, '未登录或登录已过期', ['type' => $e->getType()]);
        } catch (NotPermissionException $e) {
            return $this->error(403, '权限不足：' . $e->getPermission());
        } catch (NotRoleException $e) {
            return $this->error(403, '角色不足：' . $e->getRole());
        } catch (DisableServiceException $e) {
            $remaining = StpUtil::getDisableTime();
            return $this->error(403, "账号已被封禁，剩余 {$remaining} 秒");
        } catch (\Exception $e) {
            Log::error('SaToken 鉴权异常：' . $e->getMessage());
            return $this->error(500, '服务器内部错误');
        }

        return $next($request);
    }

    protected function error(int $code, string $msg, array $extra = []): Response
    {
        return json([
            'code' => $code,
            'msg' => $msg,
            'data' => null,
            'extra' => $extra
        ], $code);
    }
}

<?php

return [
    // 全局中间件
    'global' => [
        // ...
    ],

    // 别名中间件（用于路由注册）
    'alias' => [
        'sa-token' => \app\middleware\SaTokenMiddleware::class,
    ],
];

<?php

use think\facade\Route;

// ========== 公开路由（无需鉴权） ==========
Route::post('api/login', 'Auth/login');
Route::post('api/register', 'Auth/register');
Route::post('api/refresh', 'Auth/refresh');

// ========== 需要鉴权的路由（使用中间件） ==========
Route::group('api', function () {
    Route::get('user/info', 'Auth/info');
    Route::post('user/logout', 'Auth/logout');
    Route::resource('users', 'User');
})->middleware('sa-token');

// ========== 后台管理路由 ==========
Route::group('admin', function () {
    Route::get('/', 'Admin/index');
    Route::get('/users', 'Admin/users');
    Route::get('/settings', 'Admin/settings');
})->middleware('sa-token');

// ========== 公开API ==========
Route::get('api/public', 'Public/index');

<?php

return [
    // ==================== Token 基础配置 ====================
    'tokenName' => 'satoken',
    'tokenPrefix' => 'Bearer',
    'tokenStyle' => 'uuid',

    // ==================== 有效期配置 ====================
    'timeout' => 86400,
    'activityTimeout' => -1,

    // ==================== Cookie 配置 ====================
    'cookieName' => 'satoken',
    'cookieDomain' => '',
    'cookiePath' => '/',
    'cookieSecure' => false,
    'cookieHttpOnly' => true,
    'cookieSameSite' => 'Strict',
    'cookieMaxAge' => 86400,

    // ==================== 读取/写入配置 ====================
    'isReadHeader' => true,
    'isReadCookie' => true,
    'isReadBody' => false,
    'isWriteCookie' => true,
    'isWriteHeader' => false,

    // ==================== 登录策略 ====================
    'concurrent' => true,
    'isShare' => true,
    'maxLoginCount' => 12,

    // ==================== 存储配置（内存模式） ====================
    'storage' => 'memory',

    // ==================== Session 配置 ====================
    'session' => [
        'timeout' => 86400,
        'activityTimeout' => 1800,
        'maxSize' => 1024,
    ],

    // ==================== 加密配置 ====================
    'cryptoType' => 'intl',
    'tokenEncrypt' => false,
    'tokenFingerprint' => false,

    // ==================== Refresh Token ====================
    'refreshToken' => false,
    'refreshTokenTimeout' => 2592000,

    // ==================== 安全配置 ====================
    'antiBruteMaxFailures' => 5,
    'antiBruteLockDuration' => 600,
    'ipAnomalyDetection' => true,
    'deviceManagement' => true,
    'auditLog' => true,

    // ==================== JWT 配置 ====================
    'jwtSecretKey' => '',
    'jwtStateless' => false,

    // ==================== 签名配置 ====================
    'signKey' => '',
    'signTimestampGap' => 600,
    'signAlg' => 'sha256',

    'isLog' => true,
];

<?php

declare(strict_types=1);

namespace app\provider;

use think\Service;
use SaToken\SaToken;
use SaToken\Dao\SaTokenDaoMemory;
use SaToken\StpUtil;
use app\service\PermissionService;

class SaTokenProvider extends Service
{
    public function register(): void
    {
        $config = config('sa_token');
        SaToken::init($config);

        // ========== 使用内存存储 ==========
        // 所有会话数据存储在 PHP 内存中
        // 应用重启后数据全部丢失
        SaToken::setDao(new SaTokenDaoMemory());

        $service = new PermissionService();
        StpUtil::setPermissionGetter(function($loginId) use ($service) {
            return $service->getAllPermissions((int) $loginId);
        });
        StpUtil::setRoleGetter(function($loginId) use ($service) {
            return $service->getRoleList((int) $loginId);
        });
    }
}

// ========== 内存模式特点 ==========
// 1. 应用重启后所有会话丢失，用户需重新登录
// 2. 不支持分布式部署
// 3. 适合开发测试环境
// 4. 数据存储在 SaTokenDaoMemory 类的静态属性中
// 5. 进程内共享，进程重启丢失

// ========== 内存模式适用场景 ==========
// - 本地开发调试
// - 单元测试
// - 演示/原型项目
// - 低并发内部工具

<?php

return [
    // ==================== 通用配置 ====================
    'tokenName' => 'satoken',
    'tokenPrefix' => 'Bearer',
    'tokenStyle' => 'uuid',

    // ==================== Cookie 通用配置 ====================
    'cookieDomain' => '',
    'cookiePath' => '/',
    'cookieSecure' => false,
    'cookieHttpOnly' => true,
    'cookieSameSite' => 'Strict',

    // ==================== 存储配置（共享 Redis） ====================
    'storage' => 'redis',
    'redis' => [
        'host' => env('REDIS_HOST', '127.0.0.1'),
        'port' => env('REDIS_PORT', 6379),
        'password' => env('REDIS_PASSWORD', ''),
        'db' => env('REDIS_DB', 0),
        'timeout' => 3,
        // 全局前缀由各应用配置覆盖
    ],

    // ==================== Session 配置（共享） ====================
    'session' => [
        'timeout' => 86400,
        'activityTimeout' => 1800,
        'maxSize' => 1024,
    ],

    // ==================== 安全配置（全局通用） ====================
    'antiBruteMaxFailures' => 5,
    'antiBruteLockDuration' => 600,
    'ipAnomalyDetection' => true,
    'deviceManagement' => true,
    'auditLog' => true,

    // ==================== 各应用差异化配置 ====================
    'apps' => [
        'api' => [
            // API Token 有效期 2 小时
            'timeout' => 7200,
            'refreshToken' => true,
            'refreshTokenTimeout' => 2592000,
            'isReadCookie' => false,
            'isWriteCookie' => false,
            'isReadHeader' => true,
            'isWriteHeader' => true,
            'tokenFingerprint' => true,
            'redis' => ['prefix' => 'sa_token_api_'],
        ],
        'admin' => [
            // Admin Token 有效期 8 小时
            'timeout' => 28800,
            'refreshToken' => true,
            'concurrent' => false,
            'isShare' => false,
            'isReadCookie' => true,
            'isWriteCookie' => true,
            'cookiePath' => '/admin',
            'cookieSecure' => true,
            'tokenFingerprint' => true,
            'redis' => ['prefix' => 'sa_token_admin_'],
        ],
    ],
];

<?php

return [
    'timeout' => 7200,
    'refreshToken' => true,
    'refreshTokenTimeout' => 2592000,
    'refreshTokenRotation' => true,
    'isReadCookie' => false,
    'isWriteCookie' => false,
    'isReadHeader' => true,
    'isWriteHeader' => true,
    'concurrent' => true,
    'tokenFingerprint' => true,
    'redis' => [
        'prefix' => 'sa_token_api_',
    ],
];

<?php

return [
    'timeout' => 28800,
    'refreshToken' => true,
    'concurrent' => false,
    'isShare' => false,
    'isReadCookie' => true,
    'isWriteCookie' => true,
    'cookiePath' => '/admin',
    'cookieSecure' => true,
    'tokenFingerprint' => true,
    'redis' => [
        'prefix' => 'sa_token_admin_',
    ],
];

<?php

declare(strict_types=1);

namespace app\common\provider;

use think\Service;
use SaToken\SaToken;
use SaToken\StpUtil;
use SaToken\Dao\SaTokenDaoRedis;
use app\common\service\PermissionService;

class SaTokenProvider extends Service
{
    public function register(): void
    {
        $baseConfig = config('sa_token');
        $appName = app()->http->getName() ?: 'api';

        // 获取应用专属配置
        $appConfig = $this->getAppConfig($appName, $baseConfig);

        SaToken::init($appConfig);

        // ========== 使用 Redis 存储 ==========
        $redisConfig = $appConfig['redis'] ?? $baseConfig['redis'] ?? [];
        SaToken::setDao(new SaTokenDaoRedis($redisConfig));

        $this->injectPermission($appName);
    }

    protected function getAppConfig(string $appName, array $baseConfig): array
    {
        $appConfigFile = app()->getAppPath() . $appName . '/config/sa_token.php';
        if (is_file($appConfigFile)) {
            $appConfig = include $appConfigFile;
            return array_merge($baseConfig, $appConfig);
        }

        if (isset($baseConfig['apps'][$appName])) {
            return array_merge($baseConfig, $baseConfig['apps'][$appName]);
        }

        return $baseConfig;
    }

    protected function injectPermission(string $appName): void
    {
        // 不同应用使用不同的权限服务
        $service = match ($appName) {
            'admin' => new \app\admin\service\AdminPermissionService(),
            'api'   => new \app\api\service\ApiPermissionService(),
            default => new PermissionService(),
        };

        StpUtil::setPermissionGetter(function($loginId) use ($service) {
            return $service->getAllPermissions((int) $loginId);
        });

        StpUtil::setRoleGetter(function($loginId) use ($service) {
            return $service->getRoleList((int) $loginId);
        });
    }
}

<?php

declare(strict_types=1);

namespace app\common\middleware;

use SaToken\SaRouter;
use SaToken\StpUtil;
use SaToken\Exception\NotLoginException;
use SaToken\Exception\NotPermissionException;
use SaToken\Exception\NotRoleException;
use think\Response;
use think\facade\Log;

class SaTokenMiddleware
{
    protected array $appRoutes = [
        'api' => [
            'match' => '/api/**',
            'exclude' => ['/api/login', '/api/register', '/api/refresh'],
            'check' => 'login',
        ],
        'admin' => [
            'match' => '/admin/**',
            'exclude' => ['/admin/login'],
            'check' => ['login', 'role:admin'],
        ],
    ];

    public function handle($request, \Closure $next)
    {
        try {
            $appName = app()->http->getName() ?: 'api';
            $rules = $this->appRoutes[$appName] ?? $this->appRoutes['api'];

            $router = SaRouter::match($rules['match']);
            if (!empty($rules['exclude'])) {
                $router->exclude(...$rules['exclude']);
            }

            $router->check(function() use ($rules) {
                $checks = is_array($rules['check']) ? $rules['check'] : [$rules['check']];
                foreach ($checks as $check) {
                    if ($check === 'login') {
                        StpUtil::checkLogin();
                    } elseif (str_starts_with($check, 'role:')) {
                        StpUtil::checkRole(substr($check, 5));
                    } elseif (str_starts_with($check, 'perm:')) {
                        StpUtil::checkPermission(substr($check, 5));
                    }
                }
            });

        } catch (NotLoginException $e) {
            return json(['code' => 401, 'msg' => '请先登录'], 401);
        } catch (NotPermissionException $e) {
            return json(['code' => 403, 'msg' => '权限不足：' . $e->getPermission()], 403);
        } catch (NotRoleException $e) {
            return json(['code' => 403, 'msg' => '角色不足：' . $e->getRole()], 403);
        } catch (\Exception $e) {
            Log::error('SaToken 鉴权异常：' . $e->getMessage());
            return json(['code' => 500, 'msg' => '服务器内部错误'], 500);
        }

        return $next($request);
    }
}

<?php

use think\facade\Route;

Route::post('login', 'Auth/login');
Route::post('register', 'Auth/register');
Route::post('refresh', 'Auth/refresh');

Route::group(function () {
    Route::get('user/info', 'Auth/info');
    Route::post('user/logout', 'Auth/logout');
    Route::resource('users', 'User');
})->middleware('sa-token');

<?php

use think\facade\Route;

Route::post('login', 'Auth/login');

Route::group(function () {
    Route::get('dashboard', 'Admin/dashboard');
    Route::get('users', 'Admin/users');
    Route::get('settings', 'Admin/settings');
})->middleware('sa-token');

<?php

declare(strict_types=1);

namespace app\api\service;

use think\facade\Db;

class ApiPermissionService
{
    public function getPermissionList(int $userId): array
    {
        return Db::name('user_permission')
            ->where('user_id', $userId)
            ->column('permission_code') ?: [];
    }

    public function getRoleList(int $userId): array
    {
        return Db::name('user_role')
            ->alias('ur')
            ->join('role r', 'ur.role_id = r.id')
            ->where('ur.user_id', $userId)
            ->column('r.role_code') ?: [];
    }

    public function getAllPermissions(int $userId): array
    {
        return $this->getPermissionList($userId);
    }

    public function verifyPassword(string $username, string $password): ?array
    {
        $user = Db::name('user')
            ->where('username', $username)
            ->where('status', 1)
            ->find();

        if ($user && password_verify($password, $user['password'])) {
            return $user;
        }
        return null;
    }
}

<?php

declare(strict_types=1);

namespace app\admin\service;

use think\facade\Db;

class AdminPermissionService
{
    public function getPermissionList(int $adminId): array
    {
        $perms = Db::name('admin_permission')
            ->where('admin_id', $adminId)
            ->column('permission_code');
        return $perms ?: [];
    }

    public function getRoleList(int $adminId): array
    {
        $roles = Db::name('admin_role')
            ->alias('ar')
            ->join('role r', 'ar.role_id = r.id')
            ->where('ar.admin_id', $adminId)
            ->column('r.role_code');
        return $roles ?: [];
    }

    public function getAllPermissions(int $adminId): array
    {
        $roles = $this->getRoleList($adminId);
        $perms = [];

        if (!empty($roles)) {
            $rolePerms = Db::name('role_permission')
                ->whereIn('role_code', $roles)
                ->column('permission_code');
            $perms = array_merge($perms, $rolePerms);
        }

        $userPerms = $this->getPermissionList($adminId);
        $perms = array_merge($perms, $userPerms);

        return array_unique($perms);
    }

    public function verifyPassword(string $username, string $password): ?array
    {
        $user = Db::name('admin')
            ->where('username', $username)
            ->where('status', 1)
            ->find();

        if ($user && password_verify($password, $user['password'])) {
            return $user;
        }
        return null;
    }
}

<?php

return [
    'tokenName' => 'satoken',
    'tokenPrefix' => 'Bearer',
    'tokenStyle' => 'uuid',
    'cookieDomain' => '',
    'cookiePath' => '/',
    'cookieSecure' => false,
    'cookieHttpOnly' => true,
    'cookieSameSite' => 'Strict',

    // ========== 存储配置（内存模式） ==========
    'storage' => 'memory',

    'session' => [
        'timeout' => 86400,
        'activityTimeout' => 1800,
        'maxSize' => 1024,
    ],
    'antiBruteMaxFailures' => 5,
    'antiBruteLockDuration' => 600,
    'ipAnomalyDetection' => true,
    'deviceManagement' => true,
    'auditLog' => true,

    'apps' => [
        'api' => [
            'timeout' => 7200,
            'refreshToken' => true,
            'isReadCookie' => false,
            'isWriteCookie' => false,
            'isReadHeader' => true,
            'isWriteHeader' => true,
            'tokenFingerprint' => true,
        ],
        'admin' => [
            'timeout' => 28800,
            'refreshToken' => true,
            'concurrent' => false,
            'isShare' => false,
            'cookiePath' => '/admin',
            'tokenFingerprint' => true,
        ],
    ],
];

<?php

declare(strict_types=1);

namespace app\common\provider;

use think\Service;
use SaToken\SaToken;
use SaToken\StpUtil;
use SaToken\Dao\SaTokenDaoMemory;
use app\common\service\PermissionService;

class SaTokenProvider extends Service
{
    public function register(): void
    {
        $baseConfig = config('sa_token');
        $appName = app()->http->getName() ?: 'api';

        $appConfig = $this->getAppConfig($appName, $baseConfig);
        SaToken::init($appConfig);

        // ========== 使用内存存储 ==========
        SaToken::setDao(new SaTokenDaoMemory());

        $this->injectPermission($appName);
    }

    protected function getAppConfig(string $appName, array $baseConfig): array
    {
        $appConfigFile = app()->getAppPath() . $appName . '/config/sa_token.php';
        if (is_file($appConfigFile)) {
            return array_merge($baseConfig, include $appConfigFile);
        }
        if (isset($baseConfig['apps'][$appName])) {
            return array_merge($baseConfig, $baseConfig['apps'][$appName]);
        }
        return $baseConfig;
    }

    protected function injectPermission(string $appName): void
    {
        $service = match ($appName) {
            'admin' => new \app\admin\service\AdminPermissionService(),
            'api'   => new \app\api\service\ApiPermissionService(),
            default => new PermissionService(),
        };

        StpUtil::setPermissionGetter(function($loginId) use ($service) {
            return $service->getAllPermissions((int) $loginId);
        });
        StpUtil::setRoleGetter(function($loginId) use ($service) {
            return $service->getRoleList((int) $loginId);
        });
    }
}

<?php

declare(strict_types=1);

namespace app\controller;

use think\facade\Db;
use SaToken\StpUtil;
use app\service\PermissionService;
use think\response\Json;
use SaToken\Security\SaAuditLog;

class AuthController
{
    protected PermissionService $permissionService;

    public function __construct(PermissionService $permissionService)
    {
        $this->permissionService = $permissionService;
    }

    /**
     * 用户登录 - 完整流程演示
     */
    public function login(): Json
    {
        $username = input('post.username', '');
        $password = input('post.password', '');
        $device = input('post.device', 'web');
        $remember = input('post.remember', false);

        if (empty($username) || empty($password)) {
            return json(['code' => 400, 'msg' => '用户名和密码不能为空']);
        }

        // ========== 防暴力破解检查 ==========
        StpUtil::checkAntiBrute($username);

        // ========== 验证用户凭证 ==========
        $user = $this->permissionService->verifyPassword($username, $password);
        if (!$user) {
            StpUtil::recordAntiBruteFailure($username);
            $info = StpUtil::getAntiBruteInfo($username);
            return json([
                'code' => 401,
                'msg' => '用户名或密码错误',
                'remaining' => $info['remainingAttempts'] ?? 0
            ]);
        }

        // 登录成功，清除失败记录
        StpUtil::clearAntiBruteFailure($username);

        // ========== 执行登录 ==========
        // Sa-Token 登录，一行代码搞定
        // 内部自动完成：生成Token、绑定LoginId、创建Session、写入Cookie、触发事件
        StpUtil::login((string) $user['id'], [
            'device' => $device,
            'isLasting' => $remember,
            'extra' => [
                'nickname' => $user['nickname'],
                'ip' => request()->ip(),
                'login_time' => time(),
            ]
        ]);

        // ========== 登录后操作 ==========
        // 1. 存储用户信息到 Session
        StpUtil::setSession('user_info', [
            'id' => $user['id'],
            'username' => $user['username'],
            'nickname' => $user['nickname'],
            'email' => $user['email'] ?? '',
        ]);

        // 2. 存储权限信息到 Session（避免每次查询数据库）
        $permissions = $this->permissionService->getAllPermissions((int) $user['id']);
        $roles = $this->permissionService->getRoleList((int) $user['id']);
        StpUtil::setSession('permissions', $permissions);
        StpUtil::setSession('roles', $roles);

        // 3. 更新数据库登录信息
        Db::name('user')
            ->where('id', $user['id'])
            ->update([
                'last_login' => time(),
                'last_ip' => request()->ip(),
            ]);

        // 4. 记录审计日志
        SaAuditLog::logLogin($user['id'], [
            'ip' => request()->ip(),
            'device' => $device,
        ]);

        // ========== 返回结果 ==========
        return json([
            'code' => 200,
            'msg' => '登录成功',
            'data' => [
                'token' => StpUtil::getTokenValue(),
                'tokenPrefix' => config('sa_token.tokenPrefix'),
                'userId' => $user['id'],
                'nickname' => $user['nickname'],
                'expires' => StpUtil::getTokenTimeout(),
                'permissions' => $permissions,
                'roles' => $roles,
            ]
        ]);
    }

    /**
     * 退出登录
     */
    public function logout(): Json
    {
        // 获取用户信息（用于审计）
        $userId = StpUtil::getLoginId(false);

        // 执行登出
        StpUtil::logout();

        // 记录审计日志
        if ($userId) {
            SaAuditLog::logLogout($userId);
        }

        return json([
            'code' => 200,
            'msg' => '退出成功'
        ]);
    }

    /**
     * 获取当前用户信息
     */
    public function info(): Json
    {
        StpUtil::checkLogin();

        $userId = StpUtil::getLoginId();

        // 从 Session 读取用户信息
        $userInfo = StpUtil::getSession('user_info');
        if (empty($userInfo)) {
            // Session 中没有，从数据库读取
            $user = Db::name('user')->find($userId);
            if (!$user) {
                return json(['code' => 404, 'msg' => '用户不存在']);
            }
            $userInfo = $user;
        }

        // 获取权限和角色
        $permissions = StpUtil::getPermissionList();
        $roles = StpUtil::getRoleList();

        return json([
            'code' => 200,
            'data' => [
                'id' => $userId,
                'username' => $userInfo['username'] ?? '',
                'nickname' => $userInfo['nickname'] ?? '',
                'email' => $userInfo['email'] ?? '',
                'permissions' => $permissions,
                'roles' => $roles,
                'token' => StpUtil::getTokenValue(),
                'tokenTimeout' => StpUtil::getTokenTimeout(),
                'loginDevice' => StpUtil::getLoginDevice(),
                'extra' => StpUtil::getExtra(),
            ]
        ]);
    }

    /**
     * 刷新 Token（启用 RefreshToken 时使用）
     */
    public function refresh(): Json
    {
        if (!config('sa_token.refreshToken')) {
            return json(['code' => 400, 'msg' => 'RefreshToken 未启用']);
        }

        try {
            $newToken = StpUtil::refreshToken();
            return json([
                'code' => 200,
                'msg' => 'Token 刷新成功',
                'data' => [
                    'token' => $newToken,
                    'expires' => StpUtil::getTokenTimeout(),
                ]
            ]);
        } catch (\Exception $e) {
            return json([
                'code' => 401,
                'msg' => '刷新失败：' . $e->getMessage()
            ]);
        }
    }

    /**
     * 注册账号
     */
    public function register(): Json
    {
        $username = input('post.username', '');
        $password = input('post.password', '');
        $nickname = input('post.nickname', '');

        if (empty($username) || empty($password)) {
            return json(['code' => 400, 'msg' => '用户名和密码不能为空']);
        }

        if (strlen($password) < 6) {
            return json(['code' => 400, 'msg' => '密码长度不能少于6位']);
        }

        $exist = Db::name('user')->where('username', $username)->find();
        if ($exist) {
            return json(['code' => 400, 'msg' => '用户名已存在']);
        }

        $userId = Db::name('user')->insertGetId([
            'username' => $username,
            'password' => password_hash($password, PASSWORD_BCRYPT),
            'nickname' => $nickname ?: $username,
            'status' => 1,
            'create_time' => time(),
            'update_time' => time(),
        ]);

        StpUtil::login((string) $userId);
        $token = StpUtil::getTokenValue();

        return json([
            'code' => 200,
            'msg' => '注册成功',
            'data' => [
                'userId' => $userId,
                'token' => $token,
            ]
        ]);
    }
}