调整接口授权机制

app/data/controller/api/Article.php

@@ -4,6 +4,11 @@ namespace app\data\controller\api;
 
 use think\admin\Controller;
 
+/**
+ * 文章接口控制器
+ * Class Article
+ * @package app\data\controller\api
+ */
 class Article extends Controller
 {
     /**

app/data/controller/api/Member.php

@@ -19,6 +19,12 @@ abstract class Member extends Controller
      */
     protected $mid;
 
+    /**
+     * 接口授权TOKEN
+     * @var string
+     */
+    protected $token;
+
     /**
      * 当前会员数据
      * @var array
@@ -27,30 +33,22 @@ abstract class Member extends Controller
 
     /**
      * 控制器初始化
-     * @return $this
      */
     protected function initialize()
     {
-        $this->mid = input('mid', '');
         $this->token = input('token', '');
-        if (empty($this->mid)) $this->error('请求会员MID无效！');
         if (empty($this->token)) $this->error('接口授权TOKEN无效！');
         $this->member = $this->getMember();
-        return $this;
     }
 
     /**
      * 获取会员数据
      * @return array
      */
-    protected function getMember()
+    protected function getMember(): array
     {
         try {
-            $this->member = MemberService::instance()->get($this->mid);
+            return MemberService::instance()->get($this->token);
-            if ($this->member['token'] !== $this->token) {
-                $this->error('无效的授权，请重新登录授权！');
-            }
-            return $this->member;
         } catch (HttpResponseException $exception) {
             throw $exception;
         } catch (\Exception $exception) {

app/data/data.sql

@@ -11,7 +11,7 @@
  Target Server Version : 50562
  File Encoding         : 65001
 
- Date: 13/07/2020 14:50:12
+ Date: 13/07/2020 16:11:40
 */
 
 SET NAMES utf8mb4;
@@ -72,7 +72,7 @@ CREATE TABLE `data_article_content`  (
   INDEX `idx_data_article_content_type`(`type`) USING BTREE,
   INDEX `idx_data_article_content_status`(`status`) USING BTREE,
   INDEX `idx_data_article_content_deleted`(`deleted`) USING BTREE
-) ENGINE = InnoDB AUTO_INCREMENT = 1 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci COMMENT = '数据-文章-内容' ROW_FORMAT = Compact;
+) ENGINE = InnoDB AUTO_INCREMENT = 2 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci COMMENT = '数据-文章-内容' ROW_FORMAT = Compact;
 
 -- ----------------------------
 -- Table structure for data_article_history
@@ -117,7 +117,7 @@ CREATE TABLE `data_article_tags`  (
   PRIMARY KEY (`id`) USING BTREE,
   INDEX `idx_data_article_tags_status`(`status`) USING BTREE,
   INDEX `idx_data_article_tags_deleted`(`deleted`) USING BTREE
-) ENGINE = InnoDB AUTO_INCREMENT = 1 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci COMMENT = '数据-文章-标签' ROW_FORMAT = Compact;
+) ENGINE = InnoDB AUTO_INCREMENT = 2 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci COMMENT = '数据-文章-标签' ROW_FORMAT = Compact;
 
 -- ----------------------------
 -- Table structure for data_member
@@ -127,6 +127,7 @@ CREATE TABLE `data_member`  (
   `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
   `from` bigint(20) NULL DEFAULT 0 COMMENT '邀请者MID',
   `token` varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT '' COMMENT '授权TOKEN',
+  `tokenv` varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT '' COMMENT '授权TOKEN验证',
   `openid` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT '' COMMENT '小程序OPENID',
   `phone` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT '' COMMENT '会员手机',
   `headimg` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT '' COMMENT '会员头像',

app/data/service/MemberService.php

@@ -2,7 +2,6 @@
 
 namespace app\data\service;
 
-use think\admin\extend\CodeExtend;
 use think\admin\Service;
 
 /**
@@ -19,53 +18,66 @@ class MemberService extends Service
     protected $table = 'DataMember';
 
     /**
-     * 获取商品会员资料
+     * 获取会员资料
-     * @param string $openid
+     * @param string $token 接口认证
-     * @param array $data
+     * @param array $data 额外数据
      * @return array
      * @throws \think\Exception
      * @throws \think\db\exception\DataNotFoundException
      * @throws \think\db\exception\DbException
      * @throws \think\db\exception\ModelNotFoundException
      */
-    public function get($openid, $data = [])
+    public function get(string $token, array $data = []): array
     {
-        $map = ['id|openid' => $openid, 'deleted' => 0];
+        $map = ['token' => $token, 'deleted' => 0];
         $query = $this->app->db->name($this->table)->where($map);
         $member = $query->withoutField('status,deleted')->find();
         if (empty($member)) throw new \think\Exception('会员查询失败');
+        if ($member['tokenv'] !== $this->buildTokenVerify()) {
+            throw new \think\Exception('请重新登录授权');
+        }
         return array_merge($member, $data);
     }
 
     /**
-     * 刷新会员授权token
+     * 刷新会员授权 TOKEN
-     * @param string $openid
+     * @param int $mid 会员MID
-     * @param array $data
+     * @param array $data 额外数据
      * @return array
      * @throws \think\Exception
      * @throws \think\db\exception\DataNotFoundException
      * @throws \think\db\exception\DbException
      * @throws \think\db\exception\ModelNotFoundException
      */
-    public function token($openid, $data = [])
+    public function token(int $mid, array $data = []): array
     {
-        $map = ['id|openid' => $openid, 'deleted' => 0];
+        do $up = ['token' => md5(uniqid("{$mid}#", true) . rand(100, 999))];
-        $this->app->db->name($this->table)->where($map)->update([
+        while ($this->app->db->name($this->table)->where($up)->count() > 0);
-            'token' => CodeExtend::random(20, 3, 't'),
+        $count = $this->app->db->name($this->table)->where(['id' => $mid, 'deleted' => 0])->update([
+            'token' => $up['token'], 'tokenv' => $this->buildTokenVerify(),
         ]);
-        return $this->get($openid, $data);
+        if ($count < 1) throw new \think\Exception('生成授权TOKEN失败');
+        return $this->get($up['token'], $data);
+    }
+
+    /**
+     * 获取认证信息编码
+     * @return string
+     */
+    protected function buildTokenVerify(): string
+    {
+        return md5($this->app->request->server('user-agent', '-'));
     }
 
     /**
      * 获取会员数据统计
-     * @param integer $mid
+     * @param int $mid 会员MID
      * @return array
      */
-    public function total($mid)
+    public function total(int $mid): array
     {
-        return [
+        $query = $this->app->db->name($this->table);
-            'myinvited' => $this->app->db->name($this->table)->where(['from' => $mid])->count(),
+        return ['myinvited' => $query->where(['from' => $mid])->count()];
-        ];
     }
 
 }