video_server/app/Repositories/Utils/JwtRepository.php

<?php
declare(strict_types=1);

namespace App\Repositories\Utils;

use Carbon\CarbonImmutable;
use Lcobucci\Clock\SystemClock;
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Lcobucci\JWT\UnencryptedToken;
use Lcobucci\JWT\Validation\Constraint\PermittedFor;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Configuration;
use DateTimeImmutable;
use Lcobucci\JWT\Validation\Constraint\IssuedBy;
use Lcobucci\JWT\Validation\Constraint\SignedWith;
use Lcobucci\JWT\Validation\Constraint\StrictValidAt;
use DateTimeZone;
use Lcobucci\JWT\Encoding\CannotDecodeContent;
use Lcobucci\JWT\Token\InvalidTokenStructure;
use Lcobucci\JWT\Token\UnsupportedHeaderFound;

class JwtRepository
{
    /**
     * 签发人.
     *
     * @var string
     */
    private $issue = 'https://gfw.google.com';

    /**
     * 创建一个App Token.
     * @param array $info 用户信息，包含user_id, device_no, device_type, version
     * @return array
     */
    public function createAppJwt($info, $aud = 'app-users')
    {
        $nowObj = CarbonImmutable::now();
        $expiredObj = $nowObj->copy()->addMinutes(config('jwt.ttl'));
        $expiredAt = $expiredObj->toDateTimeString();
        // HMAC SHA256 默认简写 HS256
        $signer = new Sha256();
        $key = InMemory::plainText(config('jwt.secret'));
        // $aud = 'app-users';
        $jti = md5(implode(',', [$aud, $info['user_id'], $nowObj->timestamp, random(6)]));
        $jwtConfig = Configuration::forSymmetricSigner($signer, $key);
        $finger = $info['finger_hash'] ?? '';
        $tokenObj = $jwtConfig->builder()
            // payload-iss 签发人
            ->issuedBy($this->issue)
            ->withHeader('iss', $this->issue)
            // payload-aud 受众
            ->permittedFor($aud)
            // payload->exp 过期时间,DateTimeImmutable对象.
            ->expiresAt($expiredObj)
            // 允许在某一个时间开始就使用
            ->canOnlyBeUsedAfter($nowObj->modify('-30 second'))
            // payload->jti 编号
            ->identifiedBy($jti)
            // payload->iat 签发时间,DateTimeImmutable对象.
            ->issuedAt($nowObj)
            // payload 私有信息.
            ->withClaim('user_id', $info['user_id'])
            ->withClaim('version', $info['version'])
            ->withClaim('device_no', $info['device_no'])
            ->withClaim('device_type', $info['device_type'])
            ->withClaim('finger_hash', $finger)
            ->withClaim('ip', $this->getClientIp())
            ->getToken($jwtConfig->signer(), $jwtConfig->signingKey());

        $token = $tokenObj->toString();

        return [
            'token' => $token,
            'expired_at' => $expiredAt,
        ];
    }

    /**
     * 创建一个后台 Token.
     * @param object $manager  用户信息，包含manager_id,role_id
     * @return array
     */
    public function createManageJwt($manager)
    {
        $nowObj = CarbonImmutable::now();
        $expiredObj = $nowObj->copy()->addMinutes(intval(config('jwt.mg_ttl')));
        $expiredAt = $expiredObj->toDateTimeString();
        // HMAC SHA256 默认简写 HS256
        $signer = new Sha256();
        $key = InMemory::plainText(config('jwt.secret'));
        $aud = 'manage-users';
        $jti = md5(implode(',', [$aud, $manager->manager_id, $nowObj->timestamp, random(6)]));
        $jwtConfig = Configuration::forSymmetricSigner($signer, $key);
        $tokenObj = $jwtConfig->builder()
            // payload-iss 签发人
            ->issuedBy($this->issue)
            ->withHeader('iss', $this->issue)
            // payload-aud 受众
            ->permittedFor('manage-users')
            // payload->exp 过期时间,DateTimeImmutable对象
            ->expiresAt($expiredObj)
            // 允许在某一个时间开始就使用
            ->canOnlyBeUsedAfter($nowObj->modify('-30 second'))
            // payload->jti 编号
            ->identifiedBy($jti)
            // payload->iat 签发时间,DateTimeImmutable对象.
            ->issuedAt($nowObj)
            // payload 私有信息.
            ->withClaim('manager_id', $manager->manager_id)
            ->withClaim('role_id', $manager->role_id)
            ->withClaim('ip', $this->getClientIp())
            ->getToken($jwtConfig->signer(), $jwtConfig->signingKey());

        $token = $tokenObj->toString();

        return [
            'token' => $token,
            'expired_at' => $expiredAt,
        ];
    }

    /**
     * 校验Token (仅适用用于HS256算法).
     * @param  string  $token
     * @param  string  $aud  受众人.
     * @return array
     */
    public function validateToken(string $token, $aud = 'app-users')
    {
        // 使用的时候，只需要看is_valid，如果无效的情况下需要告知是否过期，再看is_expired
        $result = [
            // 是否非法格式（格式错误，无法解析json）.
            'is_illegal' => false,
            // 是否有效.
            'is_valid' => false,
            // 是否过期.
            'is_expired' => false,
            // 解析Token对象.
            'token_obj' => null,
        ];
        $signer = new Sha256();
        $key = InMemory::plainText(config('jwt.secret'));
        $nowObj = CarbonImmutable::now();
        $jwtConfig = Configuration::forSymmetricSigner($signer, $key);
        $clock = new SystemClock(new DateTimeZone(config('app.timezone')));

//        $jwtConfig->setValidationConstraints(
//            new IssuedBy($this->issue),
//            new SignedWith($signer, $key),
//            new PermittedFor($aud)
//            new StrictValidAt($clock)
//        );

        try {
            // 传入的token可能格式无效.
            /**
             * @var UnencryptedToken $tokenObj
             */
            $tokenObj = $jwtConfig->parser()->parse($token);
        } catch (CannotDecodeContent $e) {
            $result['is_illegal'] = true;
        } catch (InvalidTokenStructure $e) {
            $result['is_illegal'] = true;
        } catch (UnsupportedHeaderFound $e) {
            $result['is_illegal'] = true;
        } catch (\Throwable $exception) {
            $result['is_illegal'] = true;
        } catch (\Exception $exception) {
            $result['is_illegal'] = true;
        }
        if ($result['is_illegal']) {
            return $result;
        }
        if ($jwtConfig->validator()->validate($tokenObj, new IssuedBy($this->issue), new SignedWith($signer, $key), new PermittedFor($aud))) {
            $result['token_obj'] = $tokenObj;
        } else {
            // ConstraintViolation 所有错误.
            $result['is_illegal'] = true;
        }

        if (!$result['is_illegal']) {
            $result['is_valid'] = $jwtConfig->validator()->validate($tokenObj, new StrictValidAt($clock));
            if (!$result['is_valid']) {
                // 在无效的前提下，再检查详情是否过期.
                $result['is_expired'] = $tokenObj->isExpired($nowObj->toDateTime());
            }
        }

        return $result;
    }

    /**
     * 获取客户端ip.
     * @return mixed|string
     */
    public function getClientIp()
    {
        $headerIp = request()->getHeader('x-forwarded-for');
        $headerIp2 = request()->getHeader('x-real-ip');
        if (!empty($headerIp2)) {
            $ip = $headerIp2[0];
        } elseif (!empty($headerIp)) {
            $ip = $headerIp[0];
        } else {
            $sever = request()->getServerParams();
            $ip = $sever['remote_addr'] ?? '';
        }
        if (strpos($ip, ',')) {
            $ip = explode(',', $ip);
            $ip = $ip[0];
            $temp = null;
            unset($temp);
        }
        return $ip;
    }
}