fix(P2): rand.Read错误处理 + JWT随机密钥 + 密码环境变量化 + 前端路由守卫

This commit is contained in:
Sisyphus
2026-04-25 15:57:15 +08:00
parent 9d903ad8e1
commit 7d02262098
5 changed files with 489 additions and 441 deletions

View File

@@ -1,65 +1,74 @@
// internal/auth/jwt.go
package auth
import (
"errors"
"os"
"time"
"github.com/golang-jwt/jwt/v5"
)
func jwtSecret() []byte {
secret := os.Getenv("JWT_SECRET")
if secret == "" {
secret = "change-me-in-env"
}
return []byte(secret)
}
type Claims struct {
AccountID uint `json:"account_id"`
Username string `json:"username"`
jwt.RegisteredClaims
}
func GenerateToken(accountID uint, username string) (string, error) {
now := time.Now()
claims := Claims{
AccountID: accountID,
Username: username,
RegisteredClaims: jwt.RegisteredClaims{
ExpiresAt: jwt.NewNumericDate(now.Add(24 * time.Hour)),
IssuedAt: jwt.NewNumericDate(now),
NotBefore: jwt.NewNumericDate(now),
},
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
return token.SignedString(jwtSecret())
}
func ParseToken(tokenString string) (*Claims, error) {
token, err := jwt.ParseWithClaims(
tokenString,
&Claims{},
func(token *jwt.Token) (interface{}, error) {
if token.Method == nil || token.Method.Alg() != jwt.SigningMethodHS256.Alg() {
return nil, errors.New("unexpected signing method")
}
return jwtSecret(), nil
},
)
if err != nil {
return nil, err
}
claims, ok := token.Claims.(*Claims)
if !ok || !token.Valid {
return nil, jwt.ErrTokenInvalidClaims
}
return claims, nil
}
// internal/auth/jwt.go
package auth
import (
"crypto/rand"
"encoding/hex"
"errors"
"log"
"os"
"time"
"github.com/golang-jwt/jwt/v5"
)
func jwtSecret() []byte {
secret := os.Getenv("JWT_SECRET")
if secret == "" {
b := make([]byte, 32)
if _, err := rand.Read(b); err != nil {
log.Printf("FATAL: cannot generate JWT secret: %v", err)
return []byte("fallback-unsafe-key-change-me")
}
secret = hex.EncodeToString(b)
log.Printf("WARNING: JWT_SECRET not set, generated random key. All tokens invalid on restart.")
}
return []byte(secret)
}
type Claims struct {
AccountID uint `json:"account_id"`
Username string `json:"username"`
jwt.RegisteredClaims
}
func GenerateToken(accountID uint, username string) (string, error) {
now := time.Now()
claims := Claims{
AccountID: accountID,
Username: username,
RegisteredClaims: jwt.RegisteredClaims{
ExpiresAt: jwt.NewNumericDate(now.Add(24 * time.Hour)),
IssuedAt: jwt.NewNumericDate(now),
NotBefore: jwt.NewNumericDate(now),
},
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
return token.SignedString(jwtSecret())
}
func ParseToken(tokenString string) (*Claims, error) {
token, err := jwt.ParseWithClaims(
tokenString,
&Claims{},
func(token *jwt.Token) (interface{}, error) {
if token.Method == nil || token.Method.Alg() != jwt.SigningMethodHS256.Alg() {
return nil, errors.New("unexpected signing method")
}
return jwtSecret(), nil
},
)
if err != nil {
return nil, err
}
claims, ok := token.Claims.(*Claims)
if !ok || !token.Valid {
return nil, jwt.ErrTokenInvalidClaims
}
return claims, nil
}

View File

@@ -1,241 +1,253 @@
package video
import (
"crypto/rand"
"encoding/hex"
"fmt"
"net/http"
"os"
"path"
"path/filepath"
"strings"
"time"
"feedsystem_video_go/internal/account"
"feedsystem_video_go/internal/middleware/jwt"
"github.com/gin-gonic/gin"
)
type VideoHandler struct {
service *VideoService
accountService *account.AccountService
}
func NewVideoHandler(service *VideoService, accountService *account.AccountService) *VideoHandler {
return &VideoHandler{service: service, accountService: accountService}
}
func (vh *VideoHandler) PublishVideo(c *gin.Context) {
var req PublishVideoRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
username, err := jwt.GetUsername(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
video := &Video{
AuthorID: authorId,
Username: username,
Title: req.Title,
Description: req.Description,
PlayURL: req.PlayURL,
CoverURL: req.CoverURL,
CreateTime: time.Now(),
}
if err := vh.service.Publish(c.Request.Context(), video); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, video)
}
func (vh *VideoHandler) UploadVideo(c *gin.Context) {
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
f, err := c.FormFile("file")
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing file"})
return
}
const maxSize = 200 << 20
if f.Size <= 0 || f.Size > maxSize {
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid file size"})
return
}
ext := strings.ToLower(filepath.Ext(f.Filename))
if ext != ".mp4" {
c.JSON(http.StatusBadRequest, gin.H{"error": "only .mp4 is allowed"})
return
}
date := time.Now().Format("20060102")
relDir := filepath.Join("videos", fmt.Sprintf("%d", authorId), date)
root := filepath.Join(".run", "uploads")
absDir := filepath.Join(root, relDir)
if err := os.MkdirAll(absDir, 0o755); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
filename := randHex(16) + ext
absPath := filepath.Join(absDir, filename)
if err := c.SaveUploadedFile(f, absPath); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
urlPath := path.Join("/static", "videos", fmt.Sprintf("%d", authorId), date, filename)
c.JSON(http.StatusOK, gin.H{
"url": buildAbsoluteURL(c, urlPath),
"play_url": buildAbsoluteURL(c, urlPath),
})
}
func (vh *VideoHandler) UploadCover(c *gin.Context) {
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
f, err := c.FormFile("file")
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing file"})
return
}
const maxSize = 10 << 20
if f.Size <= 0 || f.Size > maxSize {
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid file size"})
return
}
ext := strings.ToLower(filepath.Ext(f.Filename))
switch ext {
case ".jpg", ".jpeg", ".png", ".webp":
default:
c.JSON(http.StatusBadRequest, gin.H{"error": "only .jpg/.jpeg/.png/.webp is allowed"})
return
}
date := time.Now().Format("20060102")
relDir := filepath.Join("covers", fmt.Sprintf("%d", authorId), date)
root := filepath.Join(".run", "uploads")
absDir := filepath.Join(root, relDir)
if err := os.MkdirAll(absDir, 0o755); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
filename := randHex(16) + ext
absPath := filepath.Join(absDir, filename)
if err := c.SaveUploadedFile(f, absPath); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
urlPath := path.Join("/static", "covers", fmt.Sprintf("%d", authorId), date, filename)
c.JSON(http.StatusOK, gin.H{
"url": buildAbsoluteURL(c, urlPath),
"cover_url": buildAbsoluteURL(c, urlPath),
})
}
func randHex(n int) string {
b := make([]byte, n)
_, _ = rand.Read(b)
return hex.EncodeToString(b)
}
func buildAbsoluteURL(c *gin.Context, p string) string {
scheme := "http"
if c.Request.TLS != nil {
scheme = "https"
}
if xf := c.GetHeader("X-Forwarded-Proto"); xf != "" {
scheme = xf
}
return fmt.Sprintf("%s://%s%s", scheme, c.Request.Host, p)
}
func (vh *VideoHandler) DeleteVideo(c *gin.Context) {
var req DeleteVideoRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if err := vh.service.Delete(c.Request.Context(), req.ID, authorId); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, gin.H{"message": "video deleted"})
}
func (vh *VideoHandler) ListByAuthorID(c *gin.Context) {
var req ListByAuthorIDRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
videos, err := vh.service.ListByAuthorID(c.Request.Context(), req.AuthorID)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if videos == nil {
videos = []Video{}
}
c.JSON(200, videos)
}
func (vh *VideoHandler) GetDetail(c *gin.Context) {
var req GetDetailRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
video, err := vh.service.GetDetail(c.Request.Context(), req.ID)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, video)
}
func (vh *VideoHandler) UpdateLikesCount(c *gin.Context) {
var req UpdateLikesCountRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if err := vh.service.UpdateLikesCount(c.Request.Context(), req.ID, req.LikesCount); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, gin.H{"message": "likes count updated"})
}
package video
import (
"crypto/rand"
"encoding/hex"
"fmt"
"net/http"
"os"
"path"
"path/filepath"
"strings"
"time"
"feedsystem_video_go/internal/account"
"feedsystem_video_go/internal/middleware/jwt"
"github.com/gin-gonic/gin"
)
type VideoHandler struct {
service *VideoService
accountService *account.AccountService
}
func NewVideoHandler(service *VideoService, accountService *account.AccountService) *VideoHandler {
return &VideoHandler{service: service, accountService: accountService}
}
func (vh *VideoHandler) PublishVideo(c *gin.Context) {
var req PublishVideoRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
username, err := jwt.GetUsername(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
video := &Video{
AuthorID: authorId,
Username: username,
Title: req.Title,
Description: req.Description,
PlayURL: req.PlayURL,
CoverURL: req.CoverURL,
CreateTime: time.Now(),
}
if err := vh.service.Publish(c.Request.Context(), video); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, video)
}
func (vh *VideoHandler) UploadVideo(c *gin.Context) {
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
f, err := c.FormFile("file")
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing file"})
return
}
const maxSize = 200 << 20
if f.Size <= 0 || f.Size > maxSize {
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid file size"})
return
}
ext := strings.ToLower(filepath.Ext(f.Filename))
if ext != ".mp4" {
c.JSON(http.StatusBadRequest, gin.H{"error": "only .mp4 is allowed"})
return
}
date := time.Now().Format("20060102")
relDir := filepath.Join("videos", fmt.Sprintf("%d", authorId), date)
root := filepath.Join(".run", "uploads")
absDir := filepath.Join(root, relDir)
if err := os.MkdirAll(absDir, 0o755); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
filename, err := randHex(16)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate filename"})
return
}
filename = filename + ext
absPath := filepath.Join(absDir, filename)
if err := c.SaveUploadedFile(f, absPath); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
urlPath := path.Join("/static", "videos", fmt.Sprintf("%d", authorId), date, filename)
c.JSON(http.StatusOK, gin.H{
"url": buildAbsoluteURL(c, urlPath),
"play_url": buildAbsoluteURL(c, urlPath),
})
}
func (vh *VideoHandler) UploadCover(c *gin.Context) {
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
f, err := c.FormFile("file")
if err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing file"})
return
}
const maxSize = 10 << 20
if f.Size <= 0 || f.Size > maxSize {
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid file size"})
return
}
ext := strings.ToLower(filepath.Ext(f.Filename))
switch ext {
case ".jpg", ".jpeg", ".png", ".webp":
default:
c.JSON(http.StatusBadRequest, gin.H{"error": "only .jpg/.jpeg/.png/.webp is allowed"})
return
}
date := time.Now().Format("20060102")
relDir := filepath.Join("covers", fmt.Sprintf("%d", authorId), date)
root := filepath.Join(".run", "uploads")
absDir := filepath.Join(root, relDir)
if err := os.MkdirAll(absDir, 0o755); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
filename, err := randHex(16)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate filename"})
return
}
filename = filename + ext
absPath := filepath.Join(absDir, filename)
if err := c.SaveUploadedFile(f, absPath); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
urlPath := path.Join("/static", "covers", fmt.Sprintf("%d", authorId), date, filename)
c.JSON(http.StatusOK, gin.H{
"url": buildAbsoluteURL(c, urlPath),
"cover_url": buildAbsoluteURL(c, urlPath),
})
}
func randHex(n int) (string, error) {
b := make([]byte, n)
if _, err := rand.Read(b); err != nil {
return "", fmt.Errorf("rand.Read: %w", err)
}
return hex.EncodeToString(b), nil
}
func buildAbsoluteURL(c *gin.Context, p string) string {
scheme := "http"
if c.Request.TLS != nil {
scheme = "https"
}
if xf := c.GetHeader("X-Forwarded-Proto"); xf != "" {
scheme = xf
}
return fmt.Sprintf("%s://%s%s", scheme, c.Request.Host, p)
}
func (vh *VideoHandler) DeleteVideo(c *gin.Context) {
var req DeleteVideoRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
authorId, err := jwt.GetAccountID(c)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if err := vh.service.Delete(c.Request.Context(), req.ID, authorId); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, gin.H{"message": "video deleted"})
}
func (vh *VideoHandler) ListByAuthorID(c *gin.Context) {
var req ListByAuthorIDRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
videos, err := vh.service.ListByAuthorID(c.Request.Context(), req.AuthorID)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if videos == nil {
videos = []Video{}
}
c.JSON(200, videos)
}
func (vh *VideoHandler) GetDetail(c *gin.Context) {
var req GetDetailRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
video, err := vh.service.GetDetail(c.Request.Context(), req.ID)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, video)
}
func (vh *VideoHandler) UpdateLikesCount(c *gin.Context) {
var req UpdateLikesCountRequest
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if err := vh.service.UpdateLikesCount(c.Request.Context(), req.ID, req.LikesCount); err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
c.JSON(200, gin.H{"message": "likes count updated"})
}