init

src/service/middleware.js

@@ -0,0 +1,27 @@
+const { inject } = require('../common/Provider');
+const { verifyToken, createToken } = require('../utils/jwt');
+const ignoreToken = ['/sign/check', '/sign/in', '/sign/up', '/sign/forget', '/sign/send', '/sign/changePwd', '/sign/code'];
+module.exports = {
+    auth: inject(function (SysConfig) {
+        const { JWT_SECRET } = SysConfig;
+        return async (req, res, next) => {
+            const token = req.headers.token;
+            if(!ignoreToken.includes(req.path)) {
+                if (token) {
+                    const deToken = await verifyToken(token, JWT_SECRET);
+                    if(deToken) {
+                        res.locals.user = deToken.data;
+                        // 换发新token，存在问题：如果上一个token没过期，其他人截获了的话，会不会被盗用？
+                        res.set('token', createToken({
+                            userId: deToken.userId
+                        }, JWT_SECRET, {}));
+                        return next();
+                    }
+                }
+                return res.status(403).send('unauthorized');
+            } else {
+                next();
+            }
+        };
+    })
+};