feat: 增强代理和玩家管理功能
- 在多个控制器中更新权限检查逻辑，确保管理员能够更灵活地管理代理和玩家。 - 在 AdminPlayerStoreController 中引入对玩家创建能力的验证，确保只有具备相应权限的管理员能够创建玩家。 - 更新请求验证逻辑，新增 credit_limit、rebate_rate 和 extra_rebate_rate 字段，以支持更细粒度的玩家管理。 - 在 AgentNodeProfileController 中添加对父代理能力授予的验证，确保子代理的权限在父代理范围内。 - 引入 AgentProfileFieldRules 以简化代理资料更新请求的规则定义，提升代码复用性。
This commit is contained in:
@@ -7,7 +7,9 @@ use Firebase\JWT\Key;
|
||||
use App\Models\Player;
|
||||
use App\Lottery\ErrorCode;
|
||||
use Illuminate\Http\Request;
|
||||
use App\Support\PlayerAuthSource;
|
||||
use App\Support\PlayerAutoRegistrationDefaults;
|
||||
use App\Support\PlayerFundingMode;
|
||||
use App\Support\PlayerTokenAesUnwrap;
|
||||
use Illuminate\Database\QueryException;
|
||||
use App\Exceptions\PlayerAuthenticationException;
|
||||
@@ -63,26 +65,30 @@ final class PlayerTokenResolver
|
||||
$player = $this->resolveDevToken($token);
|
||||
} else {
|
||||
$jwtPlain = $this->unwrapOpaqueToJwtString($token);
|
||||
$siteCode = $this->partnerSiteConfigResolver->peekSiteCodeFromJwt($jwtPlain);
|
||||
if ($siteCode === null) {
|
||||
throw new PlayerAuthenticationException('JWT 缺少站点标识', ErrorCode::PlayerTokenInvalid->value);
|
||||
}
|
||||
if ($this->peekAuthSourceFromJwt($jwtPlain) === PlayerAuthSource::LOTTERY_NATIVE) {
|
||||
$player = $this->resolveNativeJwt($jwtPlain);
|
||||
} else {
|
||||
$siteCode = $this->partnerSiteConfigResolver->peekSiteCodeFromJwt($jwtPlain);
|
||||
if ($siteCode === null) {
|
||||
throw new PlayerAuthenticationException('JWT 缺少站点标识', ErrorCode::PlayerTokenInvalid->value);
|
||||
}
|
||||
|
||||
$siteConfig = $this->partnerSiteConfigResolver->resolveBySiteCode($siteCode);
|
||||
if (! $siteConfig->enabled) {
|
||||
throw new PlayerAuthenticationException('站点已停用', ErrorCode::PlayerAccountSuspended->value, 403);
|
||||
}
|
||||
$siteConfig = $this->partnerSiteConfigResolver->resolveBySiteCode($siteCode);
|
||||
if (! $siteConfig->enabled) {
|
||||
throw new PlayerAuthenticationException('站点已停用', ErrorCode::PlayerAccountSuspended->value, 403);
|
||||
}
|
||||
|
||||
$secret = $siteConfig->ssoJwtSecret;
|
||||
if (! is_string($secret) || $secret === '') {
|
||||
throw new PlayerAuthenticationException(
|
||||
'SSO 未配置（站点 '.$siteCode.'）',
|
||||
ErrorCode::PlayerSsoSecretNotConfigured->value,
|
||||
503,
|
||||
);
|
||||
}
|
||||
$secret = $siteConfig->ssoJwtSecret;
|
||||
if (! is_string($secret) || $secret === '') {
|
||||
throw new PlayerAuthenticationException(
|
||||
'SSO 未配置（站点 '.$siteCode.'）',
|
||||
ErrorCode::PlayerSsoSecretNotConfigured->value,
|
||||
503,
|
||||
);
|
||||
}
|
||||
|
||||
$player = $this->resolveJwt($jwtPlain, $secret);
|
||||
$player = $this->resolveSsoJwt($jwtPlain, $secret);
|
||||
}
|
||||
}
|
||||
|
||||
$this->assertPlayerActive($player);
|
||||
@@ -127,7 +133,7 @@ final class PlayerTokenResolver
|
||||
{
|
||||
$jwtPlain = $this->unwrapOpaqueToJwtString($opaque);
|
||||
|
||||
return $this->resolveJwt($jwtPlain, $secret);
|
||||
return $this->resolveSsoJwt($jwtPlain, $secret);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -150,7 +156,48 @@ final class PlayerTokenResolver
|
||||
return preg_match('/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/', $token) === 1;
|
||||
}
|
||||
|
||||
private function resolveJwt(string $jwt, string $secret): Player
|
||||
private function resolveNativeJwt(string $jwt): Player
|
||||
{
|
||||
$secret = (string) config('lottery.player_auth.native.secret', '');
|
||||
if ($secret === '') {
|
||||
throw new PlayerAuthenticationException(
|
||||
'原生登录未配置',
|
||||
ErrorCode::PlayerSsoSecretNotConfigured->value,
|
||||
503,
|
||||
);
|
||||
}
|
||||
|
||||
$alg = (string) config('lottery.player_auth.jwt.algorithm', 'HS256');
|
||||
|
||||
try {
|
||||
/** @var object $claims */
|
||||
$claims = JWT::decode($jwt, new Key($secret, $alg));
|
||||
} catch (\Throwable) {
|
||||
throw new PlayerAuthenticationException('Token 无效或已过期', ErrorCode::PlayerTokenInvalid->value);
|
||||
}
|
||||
|
||||
$this->assertNativeJwtTemporalPolicy($claims);
|
||||
|
||||
$playerIdKey = (string) config('lottery.player_auth.native.claim_player_id', 'player_id');
|
||||
$authKey = (string) config('lottery.player_auth.native.claim_auth_source', 'auth_source');
|
||||
$playerId = (int) data_get($claims, $playerIdKey, 0);
|
||||
$authSource = data_get($claims, $authKey);
|
||||
|
||||
if ($playerId <= 0 || $authSource !== PlayerAuthSource::LOTTERY_NATIVE) {
|
||||
throw new PlayerAuthenticationException('JWT 缺少玩家标识', ErrorCode::PlayerTokenInvalid->value);
|
||||
}
|
||||
|
||||
$player = Player::query()->find($playerId);
|
||||
if ($player === null || ! $player->isLotteryNative()) {
|
||||
throw new PlayerAuthenticationException('玩家不存在', ErrorCode::PlayerNotRegistered->value);
|
||||
}
|
||||
|
||||
$player->forceFill(['last_login_at' => now()])->save();
|
||||
|
||||
return $player->refresh();
|
||||
}
|
||||
|
||||
private function resolveSsoJwt(string $jwt, string $secret): Player
|
||||
{
|
||||
$alg = (string) config('lottery.player_auth.jwt.algorithm', 'HS256');
|
||||
|
||||
@@ -178,6 +225,8 @@ final class PlayerTokenResolver
|
||||
$now = now();
|
||||
$defaults = [
|
||||
...PlayerAutoRegistrationDefaults::profileFields(),
|
||||
'auth_source' => PlayerAuthSource::MAIN_SITE_SSO,
|
||||
'funding_mode' => PlayerFundingMode::WALLET,
|
||||
'default_currency' => LotterySettings::defaultCurrency(),
|
||||
'status' => self::PLAYER_STATUS_ACTIVE,
|
||||
'last_login_at' => $now,
|
||||
@@ -209,6 +258,58 @@ final class PlayerTokenResolver
|
||||
return $player->refresh();
|
||||
}
|
||||
|
||||
private function peekAuthSourceFromJwt(string $jwt): ?string
|
||||
{
|
||||
$parts = explode('.', trim($jwt));
|
||||
if (count($parts) !== 3) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$payload = json_decode($this->base64UrlDecode($parts[1]), true);
|
||||
if (! is_array($payload)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$authKey = (string) config('lottery.player_auth.native.claim_auth_source', 'auth_source');
|
||||
$value = $payload[$authKey] ?? null;
|
||||
|
||||
return is_string($value) ? $value : null;
|
||||
}
|
||||
|
||||
private function base64UrlDecode(string $segment): string
|
||||
{
|
||||
$remainder = strlen($segment) % 4;
|
||||
if ($remainder > 0) {
|
||||
$segment .= str_repeat('=', 4 - $remainder);
|
||||
}
|
||||
|
||||
$decoded = base64_decode(strtr($segment, '-_', '+/'), true);
|
||||
|
||||
return is_string($decoded) ? $decoded : '';
|
||||
}
|
||||
|
||||
/**
|
||||
* @param object $claims
|
||||
*/
|
||||
private function assertNativeJwtTemporalPolicy(object $claims): void
|
||||
{
|
||||
if (! isset($claims->exp) || ! is_numeric($claims->exp)) {
|
||||
throw new PlayerAuthenticationException('JWT 缺少过期时间', ErrorCode::PlayerTokenInvalid->value);
|
||||
}
|
||||
|
||||
$maxTtl = (int) config('lottery.player_auth.native.ttl_seconds', 28800);
|
||||
if (isset($claims->iat) && is_numeric($claims->iat)) {
|
||||
$iat = (int) $claims->iat;
|
||||
$exp = (int) $claims->exp;
|
||||
if ($exp - $iat > $maxTtl) {
|
||||
throw new PlayerAuthenticationException(
|
||||
'JWT 有效期超过允许的 '.(string) $maxTtl.' 秒',
|
||||
ErrorCode::PlayerTokenInvalid->value,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 短效 SSO：JWT 须有 exp（由 decode 校验），可选要求 iat，且 exp-iat 不得超过配置秒数。
|
||||
*
|
||||
|
||||
Reference in New Issue
Block a user