[Hyperf]JWT认证与自动刷新token

2022-07-07 PHP hyperf, jwt, php 评论

Auth组件

安装hyperf-ext/auth组件
1
composer require hyperf-ext/auth
发布配置文件（文件位于 config/autoload/auth.php）
1
php bin/hyperf.php vendor:publish hyperf-ext/auth

添加助手方法文件app/Functions.php

if (! function_exists('auth')) {
  /**
    * Auth认证辅助方法
    * @param string|null $guard 守护名称
    * @return \HyperfExt\Auth\Contracts\GuardInterface|\HyperfExt\Auth\Contracts\StatefulGuardInterface|\HyperfExt\Auth\Contracts\StatelessGuardInterface
    */
    function auth(string $guard = 'api')
    {
        if (is_null($guard)) $guard = config('auth.default.guard');

        return make(\HyperfExt\Auth\Contracts\AuthManagerInterface::class)->guard($guard);
    }
}

加完后记得要用composer自动加载哟

Auth依赖组件

安装hyperf-ext/hashing
1
composer require hyperf-ext/hashing
发布配置（配置文件位于 config/autoload/hashing.php）
1
php bin/hyperf.php vendor:publish hyperf-ext/hashing

JWT组件

安装hyperf-ext/jwt
1
composer require hyperf-ext/jwt
发布配置文件（文件位于 config/autoload/jwt.php）
1
php bin/hyperf.php vendor:publish hyperf-ext/jwt

创建两个数据库迁移文件

1 2	php bin/hyperf.php gen:migration create_users_table php bin/hyperf.php gen:migration create_administrators_table

两个表内容其实是一样的，用来模拟多守护认证。如下（根据实际需求调整）

use Hyperf\Database\Schema\Schema;
use Hyperf\Database\Schema\Blueprint;
use Hyperf\Database\Migrations\Migration;

class CreateUsersTable extends Migration
{
    /**
     * Run the migrations.
     */
    public function up(): void
    {
        Schema::create('users', function (Blueprint $table) {
            $table->bigIncrements('id');
            $table->char('username', 20)->default('')->comment('用户昵称');
            $table->char('password', 200)->default('')->comment('用户密码');
            $table->string('avatar')->default('')->comment('用户头像');
            $table->char('email', 50)->default('')->unique('email')->comment('用户邮箱');
            $table->char('phone', 15)->default('')->unique('phone')->comment('用户手机号');
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        Schema::dropIfExists('users');
    }
}

JWT配置

生成jwt key
1
php bin/hyperf.php gen:jwt-secret
可选（Set the JWT private key and public key used to sign the tokens）
1
php bin/hyperf.php gen:jwt-keypair

.env文件

1 2	JWT_BLACKLIST_GRACE_PERIOD=5 设置宽限期（以秒为单位）以防止并发请求失败。 JWT_TTL=3600 指定令牌有效的时长（以秒为单位）。默认为 1 小时

4.其他配置基本可以不变(config/autoload/jwt.php)

添加Auth守护guard

declare(strict_types=1);
return [
    'default' => [
        'guard' => 'api',	// 默认接口api守护
        'passwords' => 'users',
    ],
    'guards' => [
        'web' => [
            'driver' => \HyperfExt\Auth\Guards\SessionGuard::class,
            'provider' => 'users',
            'options' => [],
        ],
		// 接口api守护
        'api' => [
            'driver' => \HyperfExt\Auth\Guards\JwtGuard::class,
            'provider' => 'api',
            'options' => [],
        ],
		// 管理端admin守护
        'admin' => [
            'driver' => \HyperfExt\Auth\Guards\JwtGuard::class,
            'provider' => 'admin',
            'options' => [],
        ],
    ],
    'providers' => [
        'api' => [
            'driver' => \HyperfExt\Auth\UserProviders\ModelUserProvider::class,
            'options' => [
                'model' => \App\Model\User::class,	// 用户模型
                'hash_driver' => 'bcrypt',
            ],
        ],

        'admin' => [
            'driver' => \HyperfExt\Auth\UserProviders\ModelUserProvider::class,
            'options' => [
                'model' => \App\Model\Admin::class,	// 管理员模型
                'hash_driver' => 'bcrypt',
            ],
        ]
    ],
    'passwords' => [
        'users' => [
            'driver' => \HyperfExt\Auth\Passwords\DatabaseTokenRepository::class,
            'provider' => 'users',
            'options' => [
                'connection' => null,
                'table' => 'password_resets',
                'expire' => 3600,
                'throttle' => 60,
                'hash_driver' => null,
            ],
        ],
    ],
    'password_timeout' => 10800,
    'policies' => [
        //Model::class => Policy::class,
    ],
];

更新模型

declare (strict_types=1);
namespace App\Model;

use Hyperf\ModelCache\Cacheable;
use HyperfExt\Auth\Authenticatable;
use HyperfExt\Auth\Contracts\AuthenticatableInterface;
use HyperfExt\Jwt\Contracts\JwtSubjectInterface;

/**
 */
class User extends Model implements AuthenticatableInterface ,JwtSubjectInterface
{
    use Authenticatable, Cacheable;
    /**
     * The table associated with the model.
     *
     * @var string
     */
    protected $table = 'users';
    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [];
    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [];


    public function getJwtIdentifier()
    {
        return $this->getKey();
    }

    /**
     * JWT自定义载荷
     * @return array
     */
    public function getJwtCustomClaims(): array
    {
        return [
            'guard' => 'api'    // 添加一个自定义载荷保存守护名称，方便后续判断
        ];
    }
}

使用

创建AuthController

1	php bin/hyperf.php gen:controller AuthController

内容如下

declare(strict_types=1);

namespace App\Controller;

use App\Constants\HttpCode;
use App\Traits\ApiResponseTrait;
use Hyperf\HttpServer\Annotation\Controller;
use Hyperf\HttpServer\Annotation\Middleware;
use Hyperf\HttpServer\Annotation\Middlewares;
use Hyperf\HttpServer\Annotation\RequestMapping;
use Hyperf\HttpServer\Contract\RequestInterface;
use App\Middleware\Auth\RefreshTokenMiddleware;
use HyperfExt\Jwt\Contracts\JwtFactoryInterface;
use Psr\Http\Message\ResponseInterface;

/**
 * @Controller(prefix="auth")
 * Class AuthController
 * @package App\Controller
 */
class AuthController
{
    use ApiResponseTrait;

    /**
     * @RequestMapping(path="login", methods={"POST"})
     * @param RequestInterface $request
     * @return ResponseInterface
     */
    public function login(RequestInterface $request): ResponseInterface
    {
        $credentials = $request->inputs(['email', 'password']);
        if (!$token = auth('api')->attempt($credentials)) {
            return $this->setHttpCode(HttpCode::UNAUTHORIZED)->fail('Unauthorized');
        }
        return $this->respondWithToken($token);
    }

    /**
     * @RequestMapping(path="user")
     * @Middlewares({@Middleware(RefreshTokenMiddleware::class)})
     */
    public function me(): ResponseInterface
    {
        return $this->success(auth('api')->user());
    }

    /**
     * @RequestMapping(path="refresh", methods={"GET"})
     */
    public function refresh(): ResponseInterface
    {
        return $this->respondWithToken(auth('api')->refresh());
    }

    /**
     * @RequestMapping(path="logout", methods={"DELETE"})
     */
    public function logout(): ResponseInterface
    {
        auth('api')->logout();
        return $this->success(['message' => 'Successfully logged out']);
    }

    /**
     * @param $token
     * @return ResponseInterface
     */
    protected function respondWithToken($token): ResponseInterface
    {
        return $this->success([
            'access_token' => $token,
            'token_type' => 'bearer',
            'expire_in' => make(JwtFactoryInterface::class)->make()->getPayloadFactory()->getTtl()
        ]);
    }

}

自动刷新token中间件

生成中间件RefreshTokenMiddleware

1	php bin/hyperf.php gen:middleware Auth\\RefreshTokenMiddleware