MrleeAdmin/backend/core/jwt/JwtToken.php

<?php
declare(strict_types=1);

namespace core\jwt;

use core\jwt\enum\ClientType;
use core\jwt\enum\LoginMode;
use core\jwt\enum\TokenStatus;
use core\jwt\enum\TokenType;
use core\jwt\ex\JwtException;
use core\jwt\ex\JwtRefreshTokenExpiredException;
use core\jwt\ex\JwtTokenExpiredException;
use core\jwt\ex\JwtTokenInBlacklistException;
use core\jwt\ex\JwtTokenInvalidException;
use core\jwt\interfaces\BlacklistStorageInterface;
use core\jwt\interfaces\TokenStorageInterface;
use core\jwt\storage\RedisTokenStorage;
use core\jwt\storage\RedisBlacklistStorage;
use Firebase\JWT\BeforeValidException;
use Firebase\JWT\ExpiredException;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Firebase\JWT\SignatureInvalidException;
use app\model\system\Config;
use UnexpectedValueException;

class JwtToken
{
    /**
     * @var string 密钥
     */
    protected string $secret;

    /**
     * @var string 加密算法
     */
    protected string $algo;

    /**
     * @var array 配置
     */
    protected array $config;

    /**
     * @var TokenStorageInterface Token 存储
     */
    protected TokenStorageInterface $tokenStorage;

    /**
     * @var BlacklistStorageInterface 黑名单存储
     */
    protected BlacklistStorageInterface $blacklistStorage;

    /**
     * @var Token|null 当前 Token
     */
    protected ?Token $currentToken = null;

    /**
     * @var array|null 当前载荷缓存
     */
    protected ?array $payloadCache = null;

    public function __construct(
        ?TokenStorageInterface     $tokenStorage = null,
        ?BlacklistStorageInterface $blacklistStorage = null,
        array                      $config = []
    )
    {
        $this->config = $config ?: config('core.jwt.app', []);
        $this->secret = $this->config['secret'] ?? '';
        $this->algo   = $this->config['algo'] ?? 'HS256';

        if (empty($this->secret) || $this->secret === 'your-secret-key-change-in-production') {
            $this->secret = 'default-secret-key-for-development';
        }

        $this->tokenStorage     = $tokenStorage ?? new RedisTokenStorage($this->config);
        $this->blacklistStorage = $blacklistStorage ?? new RedisBlacklistStorage($this->config);
    }

    /**
     * 获取 Token 存储
     */
    public function getTokenStorage(): TokenStorageInterface
    {
        return $this->tokenStorage;
    }

    /**
     * 获取黑名单存储
     */
    public function getBlacklistStorage(): BlacklistStorageInterface
    {
        return $this->blacklistStorage;
    }

    /**
     * 生成 Token
     *
     * @param string      $id         用户ID（雪花ID，需用string）
     * @param string      $clientType 客户端类型（可扩展）
     * @param array       $extraData  额外数据
     * @param string|null $loginMode  登录模式（null 使用配置默认）
     *
     * @return Token
     * @throws \core\jwt2\ex\JwtException
     */
    public function generate(
        string  $id,
        string  $clientType,
        array   $extraData = [],
        ?string $loginMode = null
    ): Token
    {
        // 验证客户端类型
        if (!ClientType::isValid($clientType)) {
            throw new JwtException("Invalid client type: {$clientType}");
        }

        $loginMode = $loginMode ?? ($this->config['login_mode'] ?? LoginMode::MULTI->value);

        // 根据登录模式处理现有 Token
        $this->handleLoginMode($id, $clientType, $loginMode);

        // 生成 JTI
        $jti = $this->generateJti();

        // 生成 Access Token
        $accessTtl     = $this->getConfiguredTtl('access', $clientType);
        $accessPayload = $this->buildPayload(
            id: $id,
            client: $clientType,
            jti: $jti,
            type: TokenType::ACCESS,
            extra: $extraData
        );
        $accessToken   = $this->makeToken($accessPayload);

        // 生成 Refresh Token
        $refreshTtl     = $this->getConfiguredTtl('refresh', $clientType);
        $refreshJti     = $this->generateJti();
        $refreshPayload = $this->buildPayload(
            id: $id,
            client: $clientType,
            jti: $refreshJti,
            type: TokenType::REFRESH,
            extra: $extraData
        );
        $refreshToken   = $this->makeToken($refreshPayload);

        // 存储 Token 信息
        $this->tokenStorage->save($jti, [
            'id'          => $id,
            'client_type' => $clientType,
            'refresh_jti' => $refreshJti,
            'extra'       => $extraData,
            'login_mode'  => $loginMode,
            'created_at'  => time(),
        ], max($accessTtl, $refreshTtl));

        // 创建 Token 对象
        $fullPayload = array_merge($accessPayload, ['id' => $id]);
        return Token::create($accessToken, $refreshToken, $accessTtl, $fullPayload);
    }

    /**
     * 刷新 Token
     *
     * @param string|null $refreshToken 刷新令牌（null 使用请求中的）
     *
     * @return Token
     * @throws \core\jwt\ex\JwtException
     * @throws \core\jwt\ex\JwtRefreshTokenExpiredException
     * @throws \core\jwt\ex\JwtTokenInBlacklistException
     */
    public function refresh(?string $refreshToken = null): Token
    {
        $token = $refreshToken ?? $this->getRefreshTokenFromRequest();

        if (empty($token)) {
            throw new JwtException('Refresh token is required');
        }

        // 解析 Token
        try {
            $payload = $this->parseToken($token);
        } catch (ExpiredException $e) {
            throw new JwtRefreshTokenExpiredException('Refresh token has expired');
        }

        // 验证 Token 类型
        if (($payload['type'] ?? '') !== TokenType::REFRESH->value) {
            throw new JwtException('Invalid token type for refresh');
        }

        $id         = (string)($payload['id'] ?? '');
        $clientType = $payload['client'] ?? '';
        $oldJti     = $payload['jti'] ?? '';

        if (empty($id)) {
            throw new JwtException('Invalid user in token');
        }

        // 检查刷新令牌是否在黑名单
        if ($this->blacklistStorage->has($oldJti)) {
            throw new JwtTokenInBlacklistException('Token has been revoked');
        }

        // 通过 refresh_jti 反查对应的 access token 会话
        [$oldAccessJti, $oldTokenInfo] = $this->findAccessTokenByRefreshJti($id, $clientType, $oldJti);
        if ($oldTokenInfo === null) {
            throw new JwtRefreshTokenExpiredException('Refresh token has been revoked');
        }

        // 获取额外数据
        $extraData = $oldTokenInfo['extra'] ?? [];
        $loginMode = $this->config['login_mode'] ?? $oldTokenInfo['login_mode'] ?? LoginMode::MULTI->value;

        // 将旧 access_token 和 refresh_token 加入黑名单
        $blacklistTtl = $this->getConfiguredTtl('refresh', $clientType);
        if ($oldAccessJti !== '') {
            $this->blacklistStorage->add($oldAccessJti, $blacklistTtl);
            $this->tokenStorage->delete($oldAccessJti);
        }
        $this->blacklistStorage->add($oldJti, $blacklistTtl);

        // 生成新 Token
        return $this->generate($id, $clientType, $extraData, $loginMode);
    }

    /**
     * 解析 Token
     *
     * @param string $token
     *
     * @return array
     */
    public function parse(string $token): array
    {
        return $this->parseToken($token);
    }

    /**
     * 获取当前用户
     *
     * @return array|null
     */
    public function user(): ?array
    {
        $payload = $this->getPayloadFromRequest();
        if (empty($payload)) {
            return null;
        }

        return [
            'id'          => (string)($payload['id'] ?? ''),
            'client_type' => $payload['client'] ?? '',
            'jti'         => $payload['jti'] ?? '',
            'extra'       => $payload['extra'] ?? [],
        ];
    }

    /**
     * 获取当前用户ID（雪花ID）
     */
    public function id(): ?string
    {
        $user = $this->user();
        return $user ? $user['id'] : null;
    }

    /**
     * 获取当前 Token
     */
    public function getToken(): ?Token
    {
        if ($this->currentToken !== null) {
            return $this->currentToken;
        }

        $payload = $this->getPayloadFromRequest();
        if (empty($payload)) {
            return null;
        }

        $accessToken = $this->getAccessTokenFromRequest();
        if (empty($accessToken)) {
            return null;
        }

        $accessTtl          = $this->getConfiguredTtl('access', $payload['client'] ?? '');
        $this->currentToken = Token::create($accessToken, '', $accessTtl, $payload);

        return $this->currentToken;
    }

    /**
     * 验证 Token
     *
     * @param string|null $token
     *
     * @return array|null
     * @throws \core\jwt\ex\JwtException
     * @throws \core\jwt\ex\JwtTokenExpiredException
     * @throws \core\jwt\ex\JwtTokenInBlacklistException
     * @throws \core\jwt\ex\JwtTokenInvalidException
     */
    public function verify(?string $token = null): ?array
    {
        $token = $token ?? $this->getAccessTokenFromRequest();

        if (empty($token)) {
            return null;
        }

        try {
            $payload = $this->parseToken($token);

            // 检查是否在黑名单
            $jti = $payload['jti'] ?? '';
            if (!empty($jti) && $this->blacklistStorage->has($jti)) {
                throw new JwtTokenInBlacklistException('Token has been revoked');
            }

            // 检查 Token 类型
            if (($payload['type'] ?? '') !== TokenType::ACCESS->value) {
                throw new JwtException('Invalid token type');
            }

            // 检查用户是否存在
            $id = (string)($payload['id'] ?? '');
            if (empty($id)) {
                throw new JwtException('Invalid user in token');
            }

            return $payload;
        } catch (ExpiredException $e) {
            throw new JwtTokenExpiredException('Token has expired');
        } catch (SignatureInvalidException $e) {
            throw new JwtTokenInvalidException('Invalid token signature');
        } catch (BeforeValidException $e) {
            throw new JwtTokenInvalidException('Token not yet valid');
        } catch (UnexpectedValueException $e) {
            throw new JwtTokenInvalidException('Invalid token format');
        }
    }

    /**
     * 退出登录（当前设备）
     *
     * @param string|null $token
     *
     * @return bool
     */
    public function logout(?string $token = null): bool
    {
        $token = $token ?? $this->getAccessTokenFromRequest();

        if (empty($token)) {
            return false;
        }

        try {
            $payload = $this->parseToken($token);
            $jti     = $payload['jti'] ?? '';

            if (!empty($jti)) {
                // 将 Token 加入黑名单
                $this->blacklistStorage->add($jti, $this->config['ttl']['access'] ?? 7200);

                // 获取并删除 refresh_token
                $tokenInfo = $this->tokenStorage->get($jti);
                if ($tokenInfo && !empty($tokenInfo['refresh_jti'])) {
                    $this->tokenStorage->delete($tokenInfo['refresh_jti']);
                }

                // 删除 Token 信息
                $this->tokenStorage->delete($jti);
            }

            return true;
        } catch (\Throwable $e) {
            return false;
        }
    }

    /**
     * 退出所有设备
     *
     * @param string      $id
     * @param string|null $clientType
     *
     * @return int 退出设备数
     */
    /**
     * 退出所有设备
     *
     * @param string      $id
     * @param string|null $clientType
     *
     * @return int
     */
    public function logoutAll(string $id, ?string $clientType = null): int
    {
        // 获取用户的所有 token 信息
        $tokens = $this->tokenStorage->getUserTokens($id, $clientType);

        if (empty($tokens)) {
            return 0;
        }

        $count = 0;
        // 将所有 token 加入黑名单并删除
        foreach ($tokens as $jti => $info) {
            // 将 access_token 加入黑名单（使用 refresh_ttl 确保足够长）
            $blacklistTtl = $this->config['ttl']['refresh'] ?? 604800;
            $this->blacklistStorage->add($jti, $blacklistTtl);

            // 将 refresh_token 也加入黑名单
            if (!empty($info['refresh_jti'])) {
                $this->blacklistStorage->add($info['refresh_jti'], $blacklistTtl);
                // 删除 refresh_token 存储
                $this->tokenStorage->delete($info['refresh_jti']);
            }

            // 删除 access_token 存储
            $this->tokenStorage->delete($jti);
            $count++;
        }

        // 清理用户索引（deleteByUser 只会清理索引，不会删除已删除的 token）
        $this->tokenStorage->deleteByUser($id, $clientType);

        return $count;
    }

    /**
     * 退出其他设备（保留当前）
     *
     * @param string|null $id
     * @param string|null $clientType
     * @param string|null $exceptJti 保留的 JTI
     *
     * @return int 退出设备数
     */
    public function logoutOthers(?string $id = null, ?string $clientType = null, ?string $exceptJti = null): int
    {
        $id = $id ?? $this->id();
        if ($id === null) {
            return 0;
        }

        $exceptJti = $exceptJti ?? ($this->getPayloadFromRequest()['jti'] ?? null);

        // 获取用户的所有 token 信息
        $tokens = $this->tokenStorage->getUserTokens($id, $clientType);

        if (empty($tokens)) {
            return 0;
        }

        $blacklistTtl = $this->config['ttl']['refresh'] ?? 604800;
        $count        = 0;

        // 遍历并处理需要删除的 token
        foreach ($tokens as $jti => $info) {
            // 跳过保留的 JTI
            if ($exceptJti !== null && $jti === $exceptJti) {
                continue;
            }

            // 将 access_token 加入黑名单
            $this->blacklistStorage->add($jti, $blacklistTtl);

            // 将 refresh_token 加入黑名单并删除
            if (!empty($info['refresh_jti'])) {
                $this->blacklistStorage->add($info['refresh_jti'], $blacklistTtl);
                $this->tokenStorage->delete($info['refresh_jti']);
            }

            // 删除 access_token 存储
            $this->tokenStorage->delete($jti);
            $count++;
        }

        // 清理用户索引
        $this->tokenStorage->deleteByUser($id, $clientType, $exceptJti);

        return $count;
    }

    /**
     * 获取用户的所有会话列表
     *
     * @param string      $id
     * @param string|null $clientType
     *
     * @return array
     */
    public function getSessions(string $id, ?string $clientType = null): array
    {
        // 使用 tokenStorage 获取用户的所有 token 信息
        $tokens = $this->tokenStorage->getUserTokens($id, $clientType);

        if (empty($tokens)) {
            return [];
        }

        $sessions = [];
        foreach ($tokens as $jti => $info) {
            // 获取完整的 token 数据
            $tokenData = $this->tokenStorage->get($jti);
            if ($tokenData !== null) {
                $sessions[] = [
                    'jti'         => $jti,
                    'client_type' => $info['client_type'] ?? $tokenData['client_type'] ?? '',
                    'created_at'  => $info['created_at'] ?? $tokenData['created_at'] ?? 0,
                    'extra'       => $tokenData['extra'] ?? [],
                ];
            }
        }

        return $sessions;
    }

    /**
     * 获取所有在线会话列表
     *
     * @param string|null $clientType
     *
     * @return array
     */
    public function getAllSessions(?string $clientType = null): array
    {
        $tokens = $this->tokenStorage->getAllTokens($clientType);

        return array_values($tokens);
    }

    /**
     * 刷新当前 Token 的最后活跃时间
     *
     * @return bool
     */
    public function touchCurrentToken(): bool
    {
        $payload = $this->getPayloadFromRequest();
        $jti = $payload['jti'] ?? '';
        if (empty($jti)) {
            return false;
        }

        return $this->tokenStorage->touch($jti);
    }

    /**
     * 通过 JTI 踢出指定会话
     *
     * @param string $jti
     *
     * @return bool
     */
    public function kickoutByJti(string $jti): bool
    {
        // 获取 token 信息
        $tokenData = $this->tokenStorage->get($jti);

        if ($tokenData === null) {
            return $this->tokenStorage->markOffline($jti);
        }

        // 将 access_token 加入黑名单
        $blacklistTtl = $this->config['ttl']['refresh'] ?? 604800;
        $this->blacklistStorage->add($jti, $blacklistTtl);

        // 将 refresh_token 也加入黑名单
        $refreshJti = $tokenData['refresh_jti'] ?? '';
        if (!empty($refreshJti)) {
            $this->blacklistStorage->add($refreshJti, $blacklistTtl);
        }

        // 标记会话离线，保留监控列表记录
        return $this->tokenStorage->markOffline($jti);
    }

    /**
     * 获取登录设备数
     *
     * @param string      $id
     * @param string|null $clientType
     *
     * @return int
     */
    public function deviceCount(string $id, ?string $clientType = null): int
    {
        return $this->tokenStorage->countByUser($id, $clientType);
    }

    /**
     * 检查用户是否在黑名单
     *
     * @param string $id
     *
     * @return bool
     */
    public function isUserBlacklisted(string $id): bool
    {
        return $this->blacklistStorage->hasUser($id);
    }

    /**
     * 将用户加入黑名单
     *
     * @param string   $id
     * @param int|null $ttl 有效期（秒）
     *
     * @return bool
     */
    public function blacklistUser(string $id, ?int $ttl = null): bool
    {
        $ttl = $ttl ?? ($this->config['ttl']['refresh'] ?? 604800);

        // 退出用户所有设备
        $this->logoutAll($id);

        // 加入黑名单
        return $this->blacklistStorage->addUser($id, $ttl);
    }

    /**
     * 撤销 Token
     *
     * @param string $token
     *
     * @return bool
     */
    public function revoke(string $token): bool
    {
        try {
            $payload = $this->parseToken($token);
            $jti     = $payload['jti'] ?? '';

            if (!empty($jti)) {
                $this->blacklistStorage->add($jti, $this->config['ttl']['access'] ?? 7200);
                $this->tokenStorage->delete($jti);
                return true;
            }

            return false;
        } catch (\Throwable $e) {
            return false;
        }
    }

    /**
     * 获取 Token 状态
     *
     * @param string $token
     *
     * @return TokenStatus
     */
    public function getTokenStatus(string $token): TokenStatus
    {
        try {
            $payload = $this->parseToken($token);
            $jti     = $payload['jti'] ?? '';

            // 检查是否在黑名单
            if (!empty($jti) && $this->blacklistStorage->has($jti)) {
                return TokenStatus::REVOKED;
            }

            // 检查是否过期
            $exp = $payload['exp'] ?? 0;
            if ($exp > 0 && $exp < time()) {
                return TokenStatus::EXPIRED;
            }

            return TokenStatus::ACTIVE;
        } catch (ExpiredException $e) {
            return TokenStatus::EXPIRED;
        } catch (\Throwable $e) {
            return TokenStatus::REVOKED;
        }
    }

    // ==================== 私有方法 ====================

    /**
     * 处理登录模式
     */
    protected function handleLoginMode(string $id, string $clientType, string $loginMode): void
    {
        switch ($loginMode) {
            case LoginMode::SINGLE->value:
                // 单端登录：踢掉所有现有设备
                $this->logoutAll($id);
                break;

            case LoginMode::CLIENT->value:
                // 客户端模式：踢掉同类型设备的登录
                $this->logoutAll($id, $clientType);
                break;

            case LoginMode::MULTI->value:
                // 多端登录：检查最大设备数
                $maxDevices = $this->config['security']['max_devices'] ?? 0;
                if ($maxDevices > 0) {
                    $count = $this->tokenStorage->countByUser($id);
                    if ($count >= $maxDevices) {
                        // 删除最早的设备
                        $this->tokenStorage->deleteOldest($id);
                    }
                }
                break;
        }
    }

    /**
     * 通过 refresh_jti 反查 access token 会话
     */
    protected function findAccessTokenByRefreshJti(string $id, string $clientType, string $refreshJti): array
    {
        $tokens = $this->tokenStorage->getUserTokens($id, $clientType);
        foreach ($tokens as $accessJti => $info) {
            if (($info['refresh_jti'] ?? '') !== $refreshJti) {
                continue;
            }

            $tokenInfo = $this->tokenStorage->get($accessJti);
            if ($tokenInfo !== null) {
                return [$accessJti, $tokenInfo];
            }
        }

        return ['', null];
    }

    /**
     * 构建 Token 载荷
     */
    protected function getConfiguredTtl(string $type, string $clientType): int
    {
        $defaults = $this->config['ttl'] ?? ['access' => 3600, 'refresh' => 604800];
        $default = (int)($defaults[$type] ?? ($type === 'access' ? 3600 : 604800));
        $content = Config::query()->where('code', 'auth_token_setting')->where('enabled', 1)->value('content');
        if (is_string($content)) {
            $decoded = json_decode($content, true);
            $content = json_last_error() === JSON_ERROR_NONE ? $decoded : null;
        }
        if (!is_array($content)) {
            return $default;
        }

        $client = strtolower($clientType);
        $key = match ($client) {
            'admin' => $type === 'refresh' ? 'admin_refresh_ttl' : 'admin_access_ttl',
            'app', 'mobile' => $type === 'refresh' ? 'app_refresh_ttl' : 'app_access_ttl',
            default => $type === 'refresh' ? 'web_refresh_ttl' : 'web_access_ttl',
        };
        if ($type === 'refresh' && !array_key_exists($key, $content)) {
            $key = 'refresh_ttl';
        }
        $value = (int)($content[$key] ?? $default);
        $minimum = $type === 'refresh' ? 300 : 60;
        return $value >= $minimum ? $value : $default;
    }

    protected function buildPayload(
        string    $id,
        string    $client,
        string    $jti,
        TokenType $type,
        array     $extra = []
    ): array
    {
        $now = time();
        $ttl = match ($type) {
            TokenType::ACCESS => $this->getConfiguredTtl('access', $client),
            TokenType::REFRESH => $this->getConfiguredTtl('refresh', $client),
        };

        $payload = [
            'iss'    => $this->config['issuer'] ?? 'webman',
            'id'     => $id,
            'client' => $client,
            'jti'    => $jti,
            'type'   => $type->value,
            'iat'    => $now,
            'exp'    => $now + $ttl,
        ];

        if (!empty($extra)) {
            $payload['extra'] = $extra;
        }

        return $payload;
    }

    /**
     * 生成 JWT Token
     */
    protected function makeToken(array $payload): string
    {
        return JWT::encode($payload, $this->secret, $this->algo);
    }

    /**
     * 解析 Token
     */
    protected function parseToken(string $token): array
    {
        // 处理带有前缀的 token
        if (str_starts_with($token, 'Bearer ')) {
            $token = substr($token, 7);
        }
        return (array)JWT::decode($token, new Key($this->secret, $this->algo));
    }

    /**
     * 生成 JTI
     */
    protected function generateJti(): string
    {
        return bin2hex(random_bytes(16));
    }

    /**
     * 从请求中获取 Access Token
     */
    protected function getAccessTokenFromRequest(): ?string
    {
        $auth = request()->header('Authorization', '');
        if (str_starts_with($auth, 'Bearer ')) {
            return substr($auth, 7);
        }
        return request()->input('token');
    }

    /**
     * 从请求中获取 Refresh Token
     */
    protected function getRefreshTokenFromRequest(): ?string
    {
        // 先从 Authorization 头中获取
        $tokenName     = config('core.jwt.app.token_name', 'Authorization');
        $authorization = request()->header($tokenName);
        if (!empty($authorization)) {
            if (str_starts_with($authorization, 'Bearer ')) {
                $token = substr($authorization, 7);
                if (!empty($token)) {
                    return $token;
                }
            }
        }

        // 再从请求输入中获取
        return request()->input('refresh_token');
    }

    /**
     * 从请求中获取 Token 载荷
     */
    public function getPayloadFromRequest(): array
    {
        if ($this->payloadCache !== null) {
            return $this->payloadCache;
        }

        try {
            $token = $this->getAccessTokenFromRequest();
            if (empty($token)) {
                return [];
            }

            $this->payloadCache = $this->parseToken($token);
            return $this->payloadCache;
        } catch (\Throwable $e) {
            return [];
        }
    }
}