Explorar o código

fix: 添加token撤销token info清除逻辑

runphp hai 1 mes
pai
achega
5c7f427b76
Modificáronse 1 ficheiros con 11 adicións e 5 borrados
  1. 11 5
      src/Hook/AuthHook.php

+ 11 - 5
src/Hook/AuthHook.php

@@ -19,14 +19,14 @@ class AuthHook
     }
 
     /**
-     * Token生成时在Redis中记录token信息,方便服务端查看token状态
+     * Token生成时记录token信息
      */
     #[Hook("token_generate")]
     public function generateToken($payload): void
     {
         $userId = decrypt_data($payload->sub, Auth::$config['jwt_secret']);
         $userType = $payload->aud;
-        $this->cache->remember(self::TOKEN_INFO .$userType.':'.$userId, (array) $payload, $payload->exp - time());
+        $this->cache->remember(self::TOKEN_INFO . $userType . ':' . $userId, (array) $payload, $payload->exp - time());
     }
 
     /**
@@ -48,16 +48,22 @@ class AuthHook
     }
 
     /**
-     * Token被撤销时,在Redis中存储撤销标记,并清除token信息
-     * 撤销标记的TTL设置为token剩余有效期,确保撤销记录在token过期后自动清除
+     * Token被撤销时,登记撤销信息并清除token信息
      */
     #[Hook("token_revoke")]
     public function revokeToken($payload): void
     {
         $remainingTime = $payload->exp - time();
         if ($remainingTime > 0) {
+            $userId = decrypt_data($payload->sub, Auth::$config['jwt_secret']);
+            $userType = $payload->aud;
+            $tokenInfoKey = self::TOKEN_INFO . $userType . ':' . $userId;
             $this->cache->remember(self::TOKEN_REVOKE . $payload->jti, time(), $remainingTime);
-            $this->cache->delete(self::TOKEN_INFO . $payload->jti);
+            // 只有jti匹配才清除token_info
+            $tokenInfo = $this->cache->get($tokenInfoKey);
+            if ($tokenInfo && ($tokenInfo['jti'] ?? null) === $payload->jti) {
+                $this->cache->delete($tokenInfoKey);
+            }
         }
     }
 }