providerInfos = new ArrayList<>();
+
+ if ( dataUtil.isOAuthMicrosoftEnabled() ) {
+ providerInfos.add(new OAuthProviderListResp.ProviderInfo()
+ .setProvider("microsoft")
+ .setBound(user.getMicrosoftId() != null));
+ }
+ if ( dataUtil.isOAuthGitHubEnabled() ) {
+ providerInfos.add(new OAuthProviderListResp.ProviderInfo()
+ .setProvider("github")
+ .setBound(user.getGithubId() != null));
+ }
+ if ( dataUtil.isOAuthMcjpgEnabled() ) {
+ providerInfos.add(new OAuthProviderListResp.ProviderInfo()
+ .setProvider("mcjpg")
+ .setBound(user.getMcjpgId() != null));
+ }
+ if ( dataUtil.isOAuthCustomEnabled() ) {
+ providerInfos.add(new OAuthProviderListResp.ProviderInfo()
+ .setProvider("custom")
+ .setBound(user.getCustomId() != null));
+ }
+
+ return new OAuthProviderListResp().setProviders(providerInfos);
+ }
+
+ /**
+ * 绑定第三方账号到当前用户（需要登录）
+ *
+ * 1. 校验用户 Token
+ * 2. 生成 bindNonce 存入 Redis
+ * 3. 返回带有 bind_nonce 参数的 OAuth 授权 URL
+ * 4. 前端拿到 URL 后直接跳转，剩下的全交给 Spring Security
+ */
+ @PostMapping("/bind/{provider}")
+ public ResponseEntity bindProvider(
+ @PathVariable String provider,
+ @RequestHeader("Authorization") String authorization) {
+ if ( ! dataUtil.isOAuthEnabled() ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ boolean providerEnabled = switch ( provider ) {
+ case "github" -> dataUtil.isOAuthGitHubEnabled();
+ case "microsoft" -> dataUtil.isOAuthMicrosoftEnabled();
+ case "mcjpg" -> dataUtil.isOAuthMcjpgEnabled();
+ case "custom" -> dataUtil.isOAuthCustomEnabled();
+ default -> false;
+ };
+ if ( ! providerEnabled ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ User user = getUserFromAuthorization(authorization);
+
+ String nonce = Util.genUUID();
+ redisService.saveOAuthBindNonce(nonce, user.getId());
+
+ String serverUrl = ServletUriComponentsBuilder
+ .fromCurrentContextPath()
+ .toUriString();
+
+ String authUrl = UriComponentsBuilder.fromHttpUrl(serverUrl)
+ .pathSegment("oauth", "authorize", provider)
+ .queryParam("bind_nonce", nonce)
+ .toUriString();
+
+ log.info("User {} initiate bind for provider: {}", user.getId(), provider);
+
+ return ResponseEntity.ok(Map.of("authorizationUrl", authUrl));
+ }
+
+ /**
+ * 解绑第三方账号（需要登录）
+ */
+ @DeleteMapping("/bind/{provider}")
+ public ResponseEntity unbindProvider(
+ @PathVariable String provider,
+ @RequestHeader("Authorization") String authorization) {
+ if ( ! dataUtil.isOAuthEnabled() ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ User user = getUserFromAuthorization(authorization);
+
+ oAuthService.unbind(user.getId(), provider); // 取消成功和未绑定均返回 204
+
+ return new ResponseEntity<>(HttpStatus.NO_CONTENT);
+ }
+
+ /**
+ * 登出方法
+ * //TODO 临时设置，后续更改为更合适的登出方法
+ *
+ * @see AuthController
+ */
+ @Deprecated
+ @PostMapping("/signout")
+ public ResponseEntity signOut(@RequestHeader("Authorization") String authorization) {
+ if ( ! dataUtil.isOAuthEnabled() ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ User user = getUserFromAuthorization(authorization);
+ redisService.clearToken(user.getId());
+ log.info("Oauth logout: {}", user.getUsername());
+ return new ResponseEntity<>(HttpStatus.NO_CONTENT);
+ }
+
+
+ /**
+ * 从 Authorization 头提供的 accessToken 解析用户
+ *
+ * @param authorization Http 请求 Authorization头
+ *
+ * @return {@link User} 实例
+ */
+ private @NonNull User getUserFromAuthorization(String authorization) {
+ if ( authorization == null || ! authorization.startsWith("Bearer ") ) {
+ throw new UnauthorizedException(); // 401
+ }
+
+ String accessToken = authorization.substring(7);
+ AToken aToken = tokenUtil.verifyAccessToken(accessToken, null, true);
+
+ if ( aToken == null ) {
+ throw new UnauthorizedException(); // 401
+ }
+
+ // 通过绑定的 Profile ID 获取用户 ID，避免用户名重复
+ Profile profile = profileService.getById(aToken.bindProfile());
+ if ( profile == null ) {
+ throw new UnauthorizedException(); // 401
+ }
+
+ User user = userDao.selectById(profile.getBindUser());
+
+ if ( user == null ) {
+ throw new UnauthorizedException(); // 401
+ }
+
+ return user;
+ }
+
+}
diff --git a/src/main/java/org/miowing/mioverify/controller/package-info.java b/src/main/java/org/miowing/mioverify/controller/package-info.java
new file mode 100644
index 0000000..1f6799d
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/controller/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * 控制层
+ */
+package org.miowing.mioverify.controller;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/dao/package-info.java b/src/main/java/org/miowing/mioverify/dao/package-info.java
new file mode 100644
index 0000000..97d15c3
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/dao/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * 数据访问层
+ */
+package org.miowing.mioverify.dao;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/exception/FeatureNotSupportedException.java b/src/main/java/org/miowing/mioverify/exception/FeatureNotSupportedException.java
index 5fc9a5a..db3e4b0 100644
--- a/src/main/java/org/miowing/mioverify/exception/FeatureNotSupportedException.java
+++ b/src/main/java/org/miowing/mioverify/exception/FeatureNotSupportedException.java
@@ -1,4 +1,7 @@
package org.miowing.mioverify.exception;
+/**
+ * 功能不支持异常
+ */
public class FeatureNotSupportedException extends MioVerifyException {
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/exception/ServerConfigurationException.java b/src/main/java/org/miowing/mioverify/exception/ServerConfigurationException.java
new file mode 100644
index 0000000..8f1d4be
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/exception/ServerConfigurationException.java
@@ -0,0 +1,5 @@
+package org.miowing.mioverify.exception;
+
+public class ServerConfigurationException extends MioVerifyException {
+
+}
diff --git a/src/main/java/org/miowing/mioverify/listener/TokenExpiredListener.java b/src/main/java/org/miowing/mioverify/listener/TokenExpiredListener.java
index 9acd231..bc4538f 100644
--- a/src/main/java/org/miowing/mioverify/listener/TokenExpiredListener.java
+++ b/src/main/java/org/miowing/mioverify/listener/TokenExpiredListener.java
@@ -10,6 +10,7 @@
import org.springframework.data.redis.listener.KeyExpirationEventMessageListener;
import org.springframework.data.redis.listener.RedisMessageListenerContainer;
import org.springframework.stereotype.Component;
+
import java.nio.charset.StandardCharsets;
/**
@@ -23,14 +24,18 @@
public class TokenExpiredListener extends KeyExpirationEventMessageListener {
@Autowired
private StringRedisTemplate redisTemplate;
+
public TokenExpiredListener(RedisMessageListenerContainer listenerContainer) {
super(listenerContainer);
+ //
}
+
@Override
public void afterPropertiesSet() throws Exception {
log.info("Tokens expired Listener hooked.");
super.afterPropertiesSet();
}
+
@Override
protected void doHandleMessage(Message message) {
String key = new String(message.getBody(), StandardCharsets.UTF_8);
@@ -49,4 +54,5 @@ protected void doHandleMessage(Message message) {
}
super.doHandleMessage(message);
}
+
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/package-info.java b/src/main/java/org/miowing/mioverify/package-info.java
new file mode 100644
index 0000000..a9855ff
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/package-info.java
@@ -0,0 +1,5 @@
+/**
+ * MioVerify 的顶级程序包，包含了大多数代码。
+ * 反转域名由最初的作者 FuziharaYukina 设置
+ */
+package org.miowing.mioverify;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/pojo/Profile.java b/src/main/java/org/miowing/mioverify/pojo/Profile.java
index 9e0928e..6c4e41c 100644
--- a/src/main/java/org/miowing/mioverify/pojo/Profile.java
+++ b/src/main/java/org/miowing/mioverify/pojo/Profile.java
@@ -6,6 +6,9 @@
import lombok.experimental.Accessors;
import org.springframework.lang.Nullable;
+/**
+ * 角色 数据表映射
+ */
@Data
@Accessors(chain = true)
@TableName("profiles")
diff --git a/src/main/java/org/miowing/mioverify/pojo/ProfileShow.java b/src/main/java/org/miowing/mioverify/pojo/ProfileShow.java
index be45f69..c2f3690 100644
--- a/src/main/java/org/miowing/mioverify/pojo/ProfileShow.java
+++ b/src/main/java/org/miowing/mioverify/pojo/ProfileShow.java
@@ -7,6 +7,24 @@
import java.util.List;
+/**
+ * 角色信息
+ * 序列化后的 Json 格式，不对应数据库
+ *
+ * {
+ * "id":"角色 UUID（无符号）",
+ * "name":"角色名称",
+ * "properties":[ // 角色的属性（数组，每一元素为一个属性）（仅在特定情况下需要包含）
+ * { // 一项属性
+ * "name":"属性的名称",
+ * "value":"属性的值",
+ * "signature":"属性值的数字签名（仅在特定情况下需要包含）"
+ * }
+ * // ,...（可以有更多）
+ * ]
+ * }
+ *
+ */
@Data
@Accessors(chain = true)
@JsonInclude(JsonInclude.Include.NON_EMPTY)
diff --git a/src/main/java/org/miowing/mioverify/pojo/ServerMeta.java b/src/main/java/org/miowing/mioverify/pojo/ServerMeta.java
index 6dc9bfe..59426e0 100644
--- a/src/main/java/org/miowing/mioverify/pojo/ServerMeta.java
+++ b/src/main/java/org/miowing/mioverify/pojo/ServerMeta.java
@@ -10,6 +10,10 @@
import java.util.List;
+/**
+ * 服务器元数据
+ * 返回 Json 格式
+ */
@Data
@Accessors(chain = true)
@JsonInclude(JsonInclude.Include.NON_EMPTY)
diff --git a/src/main/java/org/miowing/mioverify/pojo/TexturesShow.java b/src/main/java/org/miowing/mioverify/pojo/TexturesShow.java
index 6ab4a56..6af2eaf 100644
--- a/src/main/java/org/miowing/mioverify/pojo/TexturesShow.java
+++ b/src/main/java/org/miowing/mioverify/pojo/TexturesShow.java
@@ -5,6 +5,27 @@
import lombok.experimental.Accessors;
import org.springframework.lang.Nullable;
+/**
+ * 材质信息
+ * 序列化后的 Json 格式，不对应数据库
+ *
+ * {
+ * "timestamp":该属性值被生成时的时间戳（Java 时间戳格式，即自 1970-01-01 00:00:00 UTC 至今经过的毫秒数）,
+ * "profileId":"角色 UUID（无符号）",
+ * "profileName":"角色名称",
+ * "textures":{ // 角色的材质
+ * "材质类型（如 SKIN）":{ // 若角色不具有该项材质，则不必包含
+ * "url":"材质的 URL",
+ * "metadata":{ // 材质的元数据，若没有则不必包含
+ * "名称":"值"
+ * // ,...（可以有更多）
+ * }
+ * }
+ * // ,...（可以有更多）
+ * }
+ * }
+ *
+ */
@Data
@Accessors(chain = true)
@JsonInclude(JsonInclude.Include.NON_EMPTY)
diff --git a/src/main/java/org/miowing/mioverify/pojo/User.java b/src/main/java/org/miowing/mioverify/pojo/User.java
index 2d49590..49a58b1 100644
--- a/src/main/java/org/miowing/mioverify/pojo/User.java
+++ b/src/main/java/org/miowing/mioverify/pojo/User.java
@@ -6,6 +6,9 @@
import lombok.experimental.Accessors;
import org.springframework.lang.Nullable;
+/**
+ * 用户 数据表映射
+ */
@Data
@Accessors(chain = true)
@TableName("users")
@@ -13,6 +16,10 @@ public class User {
@TableId
private String id;
private String username;
- private String password;
+ private @Nullable String password;
private @Nullable String preferredLang;
+ private @Nullable String microsoftId;
+ private @Nullable String githubId;
+ private @Nullable String mcjpgId;
+ private @Nullable String customId;
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/pojo/UserShow.java b/src/main/java/org/miowing/mioverify/pojo/UserShow.java
index 46ffa4f..ecd9f75 100644
--- a/src/main/java/org/miowing/mioverify/pojo/UserShow.java
+++ b/src/main/java/org/miowing/mioverify/pojo/UserShow.java
@@ -3,8 +3,25 @@
import com.fasterxml.jackson.annotation.JsonInclude;
import lombok.Data;
import lombok.experimental.Accessors;
+
import java.util.List;
+/**
+ * 用户信息
+ * 序列化后的 Json 格式，不对应数据库
+ *
+ * {
+ * "id":"用户的 ID",
+ * "properties":[ // 用户的属性（数组，每一元素为一个属性）
+ * { // 一项属性
+ * "name":"属性的名称",
+ * "value":"属性的值",
+ * }
+ * // ,...（可以有更多）
+ * ]
+ * }
+ *
+ */
@Data
@Accessors(chain = true)
@JsonInclude(JsonInclude.Include.NON_EMPTY)
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthAuthReq.java b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthAuthReq.java
new file mode 100644
index 0000000..9c46b32
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthAuthReq.java
@@ -0,0 +1,22 @@
+package org.miowing.mioverify.pojo.oauth;
+
+import lombok.Data;
+import org.springframework.lang.Nullable;
+
+/**
+ * 用临时 Token 换取正式 accessToken 的请求体
+ * 用于 POST /oauth/authenticate
+ */
+@Data
+public class OAuthAuthReq {
+
+ /** OAuth 登录回调后返回的临时 Token */
+ private String tempToken;
+
+ /** 客户端 Token，为空时由服务端生成 */
+ private @Nullable String clientToken;
+
+ /** 是否在响应中返回用户信息 */
+ private boolean requestUser;
+
+}
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthCallbackResp.java b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthCallbackResp.java
new file mode 100644
index 0000000..1669fab
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthCallbackResp.java
@@ -0,0 +1,20 @@
+package org.miowing.mioverify.pojo.oauth;
+
+import lombok.Data;
+import lombok.experimental.Accessors;
+
+/**
+ * 并非 OAuth 回调响应 (临时作为数据中转类)
+ * 用于返回临时令牌和用户信息
+ */
+@Data
+@Accessors(chain = true)
+public class OAuthCallbackResp {
+
+ private String tempToken; // 临时令牌，用于后续换取 accessToken
+ private String provider; // 提供商名称 (github/microsoft/mcjpg/custom)
+ private String providerUsername; // 第三方平台上的用户名
+ private boolean needProfile; // 是否需要创建角色（profile）
+ private String userId; // 当 needProfile=true 时返回用户ID，便于前端后续创建角色
+
+}
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthProviderListResp.java b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthProviderListResp.java
new file mode 100644
index 0000000..d7e1936
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthProviderListResp.java
@@ -0,0 +1,25 @@
+package org.miowing.mioverify.pojo.oauth;
+
+import lombok.Data;
+import lombok.experimental.Accessors;
+
+import java.util.List;
+
+@Data
+@Accessors(chain = true)
+public class OAuthProviderListResp {
+
+ private List providers;
+
+ @Data
+ @Accessors(chain = true)
+ public static class ProviderInfo {
+
+ /** Provider 名称 */
+ private String provider;
+ /** 当前用户是否已绑定该 Provider */
+ private boolean bound;
+
+ }
+
+}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthStatusResp.java b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthStatusResp.java
new file mode 100644
index 0000000..ec71ba4
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthStatusResp.java
@@ -0,0 +1,23 @@
+package org.miowing.mioverify.pojo.oauth;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import lombok.Data;
+import lombok.experimental.Accessors;
+
+import java.util.List;
+
+/**
+ * OAuth 状态获取响应
+ */
+@Data
+@Accessors(chain = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class OAuthStatusResp {
+
+ /** OAuth 是否已经启用 */
+ private boolean enabled;
+
+ /** Provider 列表 */
+ private List providers;
+
+}
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthUserInfo.java b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthUserInfo.java
new file mode 100644
index 0000000..0faad5b
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/OAuthUserInfo.java
@@ -0,0 +1,14 @@
+package org.miowing.mioverify.pojo.oauth;
+
+import lombok.Data;
+import org.springframework.lang.Nullable;
+
+@Data
+public class OAuthUserInfo {
+
+ private String provider; // 提供商名称
+ private String providerUserId; // 提供商返回的唯一用户ID
+ private @Nullable String providerUsername; // 提供商返回的用户名
+ private @Nullable String email; // 邮箱
+
+}
diff --git a/src/main/java/org/miowing/mioverify/pojo/oauth/package-info.java b/src/main/java/org/miowing/mioverify/pojo/oauth/package-info.java
new file mode 100644
index 0000000..940cd5f
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/oauth/package-info.java
@@ -0,0 +1 @@
+package org.miowing.mioverify.pojo.oauth;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/pojo/package-info.java b/src/main/java/org/miowing/mioverify/pojo/package-info.java
new file mode 100644
index 0000000..6c99e88
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/pojo/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * 数据层
+ */
+package org.miowing.mioverify.pojo;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/pojo/request/UserRegisterReq.java b/src/main/java/org/miowing/mioverify/pojo/request/UserRegisterReq.java
index 9a8814d..6875184 100644
--- a/src/main/java/org/miowing/mioverify/pojo/request/UserRegisterReq.java
+++ b/src/main/java/org/miowing/mioverify/pojo/request/UserRegisterReq.java
@@ -3,6 +3,7 @@
import lombok.Data;
@Data
+@Deprecated(since = "1.4.0")
public class UserRegisterReq {
private String username;
private String password;
diff --git a/src/main/java/org/miowing/mioverify/service/OAuthService.java b/src/main/java/org/miowing/mioverify/service/OAuthService.java
new file mode 100644
index 0000000..4c19526
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/service/OAuthService.java
@@ -0,0 +1,37 @@
+package org.miowing.mioverify.service;
+
+import org.miowing.mioverify.pojo.oauth.OAuthCallbackResp;
+
+public interface OAuthService {
+
+ /**
+ * OAuth2 登录成功后的用户处理（由 SecurityConfig.successHandler 调用）。
+ * Spring Security 已自动完成 code 换 token 和获取用户信息，
+ * 此方法负责 查找/创建本地用户 并签发临时 Token。
+ *
+ * @param provider Provider 名称（github / microsoft / mcjpg / custom）
+ * @param providerUserId Provider 返回的用户唯一 ID
+ * @param providerUsername Provider 返回的用户名
+ *
+ * @return OAuthCallbackResp 包含临时 Token 等信息
+ */
+ OAuthCallbackResp handleOAuthLogin(String provider, String providerUserId, String providerUsername);
+
+ /**
+ * 解绑用户与指定 OAuth 提供商的关联
+ *
+ * @param userId 用户 ID
+ * @param provider 提供商名称（如 "microsoft"）
+ */
+ void unbind(String userId, String provider);
+
+ /**
+ * 将 OAuth provider 账号绑定到已有本地用户。
+ *
+ * @param userId 要绑定到的本地用户 ID（从 nonce 中取出）
+ * @param provider provider 名称
+ * @param providerUserId provider 返回的用户唯一 ID
+ */
+ void handleOAuthBind(String userId, String provider, String providerUserId);
+
+}
diff --git a/src/main/java/org/miowing/mioverify/service/RedisService.java b/src/main/java/org/miowing/mioverify/service/RedisService.java
index b64cfb4..26a0bd7 100644
--- a/src/main/java/org/miowing/mioverify/service/RedisService.java
+++ b/src/main/java/org/miowing/mioverify/service/RedisService.java
@@ -1,9 +1,48 @@
package org.miowing.mioverify.service;
public interface RedisService {
+
void saveToken(String token, String userId);
boolean checkToken(String token);
void removeToken(String token);
void clearToken(String userId);
void saveSession(String serverId, String token);
+
+
+ /**
+ * 保存 OAuth 临时令牌，用于后续换取正式的 accessToken。
+ * 临时令牌需设置较短的过期时间，防止滥用。
+ *
+ * @param tempToken 生成的临时令牌（通常为 UUID）
+ * @param userId 对应的用户 ID
+ */
+ void saveOAuthTempToken(String tempToken, String userId);
+
+ /**
+ * 消费 OAuth 临时令牌。
+ * 根据临时令牌获取用户 ID，并立即删除该记录，确保一次性使用。
+ *
+ * @param tempToken 待消费的临时令牌
+ * @return 若令牌有效且未过期，返回对应的用户 ID；否则返回 null
+ */
+ String consumeOAuthTempToken(String tempToken);
+
+ /**
+ * 保存 OAuth 绑定 Nonce，用于绑定流程中将 nonce 与 userId 关联。
+ * 设置与 oauthExpire 一致的过期时间，超时自动失效。
+ *
+ * @param nonce 随机生成的绑定标识符（UUID）
+ * @param userId 发起绑定的用户 ID
+ */
+ void saveOAuthBindNonce(String nonce, String userId);
+
+ /**
+ * 消费 OAuth 绑定 Nonce（一次性原子操作）。
+ * 取出对应的用户 ID 后立即删除，防止重放攻击。
+ *
+ * @param nonce 待消费的 nonce
+ *
+ * @return 对应的用户 ID；若不存在、已过期或已被消费，则返回 null
+ */
+ String consumeOAuthBindNonce(String nonce);
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/service/UserService.java b/src/main/java/org/miowing/mioverify/service/UserService.java
index 55f9fea..7a9b278 100644
--- a/src/main/java/org/miowing/mioverify/service/UserService.java
+++ b/src/main/java/org/miowing/mioverify/service/UserService.java
@@ -7,4 +7,13 @@ public interface UserService extends IService {
User getLogin(String username, String password);
User getLogin(String username, String password, boolean exception);
User getLoginNoPwd(String username);
+
+ /**
+ * 按 provider 的用户ID 查询用户（对应各字段的 UNIQUE 查询）
+ *
+ * @param providerUserId 用户 ID
+ *
+ * @return {@link User} 实例
+ */
+ User getByProviderUserId(String provider, String providerUserId);
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/service/impl/OAuthServiceImpl.java b/src/main/java/org/miowing/mioverify/service/impl/OAuthServiceImpl.java
new file mode 100644
index 0000000..b163472
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/service/impl/OAuthServiceImpl.java
@@ -0,0 +1,215 @@
+package org.miowing.mioverify.service.impl;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import lombok.NonNull;
+import lombok.extern.slf4j.Slf4j;
+import org.miowing.mioverify.dao.UserDao;
+import org.miowing.mioverify.exception.DuplicateUserNameException;
+import org.miowing.mioverify.exception.FeatureNotSupportedException;
+import org.miowing.mioverify.pojo.User;
+import org.miowing.mioverify.pojo.oauth.OAuthCallbackResp;
+import org.miowing.mioverify.service.OAuthService;
+import org.miowing.mioverify.service.ProfileService;
+import org.miowing.mioverify.service.RedisService;
+import org.miowing.mioverify.service.UserService;
+import org.miowing.mioverify.util.DataUtil;
+import org.miowing.mioverify.util.TokenUtil;
+import org.miowing.mioverify.util.Util;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.util.function.BiConsumer;
+
+@Service
+@Slf4j
+public class OAuthServiceImpl implements OAuthService {
+
+ @Autowired
+ private TokenUtil tokenUtil;
+ @Autowired
+ private DataUtil dataUtil;
+ @Autowired
+ private Util util;
+
+ @Autowired
+ private RedisService redisService;
+ @Autowired
+ private UserService userService;
+ @Autowired
+ private ProfileService profileService;
+
+ @Autowired
+ private UserDao userDao;
+
+
+ /** Provider 与数据库字段设置器的映射（用于设置对应的 provider ID） */
+ private static final java.util.Map> PROVIDER_SETTER = java.util.Map.of(
+ "github", User :: setGithubId,
+ "microsoft", User :: setMicrosoftId,
+ "mcjpg", User :: setMcjpgId,
+ "custom", User :: setCustomId
+ );
+
+ /** Provider 与数据库字段名的映射（用于查询） */
+ private static final java.util.Map PROVIDER_FIELD = java.util.Map.of(
+ "github", "github_id",
+ "microsoft", "microsoft_id",
+ "mcjpg", "mcjpg_id",
+ "custom", "custom_id"
+ );
+
+
+ @Override
+ public OAuthCallbackResp handleOAuthLogin(
+ @NonNull String provider, @NonNull String providerUserId, String providerUsername) {
+
+ // 参数校验
+ BiConsumer setter = PROVIDER_SETTER.get(provider);
+ String fieldName = PROVIDER_FIELD.get(provider);
+ if ( setter == null || fieldName == null ) {
+ throw new FeatureNotSupportedException(); // 不支持的 OAuth 提供商
+ }
+ if ( providerUserId.isBlank() ) {
+ throw new IllegalArgumentException(); // 提供商用户 ID 不能为空
+ }
+
+ User user = userDao.selectOne(
+ new QueryWrapper().eq(fieldName, providerUserId)
+ );
+
+ boolean isNewUser = (user == null);
+ if ( isNewUser ) {
+ user = createUser(provider, providerUserId, providerUsername, setter);
+ }
+
+ boolean hasProfile = ! profileService.getByUserId(user.getId()).isEmpty();
+ boolean needProfile = isNewUser || ! hasProfile;
+
+ // 生成临时令牌并存入 Redis
+ String tempToken = Util.genUUID();
+ redisService.saveOAuthTempToken(tempToken, user.getId());
+
+ return new OAuthCallbackResp()
+ .setTempToken(tempToken)
+ .setProvider(provider)
+ .setProviderUsername(providerUsername)
+ .setNeedProfile(needProfile)
+ .setUserId(needProfile ? user.getId() : null); // 需要创建 Profile 时返回 userId
+ }
+
+ @Override
+ public void unbind(@NonNull String userId, @NonNull String provider) {
+ BiConsumer setter = PROVIDER_SETTER.get(provider);
+ if ( setter == null ) {
+ throw new FeatureNotSupportedException(); // 不支持的 OAuth 提供商
+ }
+
+ User user = userDao.selectById(userId);
+
+ if ( user == null ) {
+ throw new FeatureNotSupportedException(); // 用户不存在
+ }
+
+ // 检查是否为唯一认证方式（有密码或有其他绑定的 Provider）
+ boolean hasPassword = user.getPassword() != null && ! user.getPassword().isBlank();
+ int boundProviderCount = countBoundProviders(user);
+
+ // 如果没有密码且只有一个绑定的 Provider，则不允许解绑
+ if ( ! hasPassword && boundProviderCount <= 1 ) {
+ throw new FeatureNotSupportedException(); // 无法解绑唯一的认证方式
+ }
+
+ // 清空对应的 provider ID
+ setter.accept(user, null);
+ userDao.updateById(user);
+
+ log.info("User: {} ,Unbind oauth provider: {}", userId, provider);
+ }
+
+ @Override
+ public void handleOAuthBind(String userId, String provider, String providerUserId) {
+
+ BiConsumer setter = PROVIDER_SETTER.get(provider);
+ String fieldName = PROVIDER_FIELD.get(provider);
+
+ if ( setter == null || fieldName == null ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ // 检查该第三方账号是否已被其他本地账号绑定
+ User existing = userDao.selectOne(
+ new QueryWrapper().eq(fieldName, providerUserId)
+ );
+ if ( existing != null && ! existing.getId().equals(userId) ) {
+ throw new DuplicateUserNameException(); // 已被其他账号绑定
+ }
+
+ User user = userDao.selectById(userId);
+ if ( user == null ) {
+ throw new FeatureNotSupportedException();
+ }
+
+ setter.accept(user, providerUserId);
+ userDao.updateById(user);
+
+ log.info("Oauth User {} bind provider {} -> {}", userId, provider, providerUserId);
+ }
+
+ //-----------
+
+ /** 创建新用户 */
+ private User createUser(String provider, String providerUserId, String providerUsername,
+ BiConsumer setter) {
+
+ User newUser = new User();
+ newUser.setId(Util.genUUID()); // 使用工具类生成 ID
+
+ // 用户名处理：优先使用提供商返回的用户名，否则生成默认名
+ String baseUsername = (providerUsername != null && ! providerUsername.isBlank())
+ ? providerUsername
+ : "user_" + providerUserId.substring(0, Math.min(8, providerUserId.length()));
+
+ // 检查用户名是否已存在，如存在则添加随机后缀
+ String username = ensureUniqueUsername(baseUsername);
+
+ newUser.setUsername(username);
+
+ // 设置对应的 provider ID
+ setter.accept(newUser, providerUserId);
+
+ log.info("New Oauth user register: {}", newUser.getUsername());
+ userService.save(newUser);
+ return newUser;
+ }
+
+ /** 统计用户已绑定的 Provider 数量 */
+ private int countBoundProviders(User user) {
+ int count = 0;
+ if ( user.getGithubId() != null && ! user.getGithubId().isBlank() ) count++;
+ if ( user.getMicrosoftId() != null && ! user.getMicrosoftId().isBlank() ) count++;
+ if ( user.getMcjpgId() != null && ! user.getMcjpgId().isBlank() ) count++;
+ if ( user.getCustomId() != null && ! user.getCustomId().isBlank() ) count++;
+ return count;
+ }
+
+ /** 确保用户名唯一，如果已存在则添加随机后缀 */
+ private String ensureUniqueUsername(String baseUsername) {
+ String username = baseUsername;
+ int maxAttempts = 10;
+
+ for ( int i = 0; i < maxAttempts; i++ ) {
+ User existing = userDao.selectOne(
+ new QueryWrapper().eq("username", username)
+ );
+ if ( existing == null ) {
+ return username; // 用户名可用
+ }
+ // 用户名已存在，添加随机后缀
+ username = baseUsername + "_" + Util.genUUID().substring(0, 6);
+ }
+
+ // 极端情况：多次尝试后仍冲突，使用 UUID
+ return baseUsername + "_" + Util.genUUID();
+ }
+
+}
diff --git a/src/main/java/org/miowing/mioverify/service/impl/RedisServiceImpl.java b/src/main/java/org/miowing/mioverify/service/impl/RedisServiceImpl.java
index 642934a..32e5bbe 100644
--- a/src/main/java/org/miowing/mioverify/service/impl/RedisServiceImpl.java
+++ b/src/main/java/org/miowing/mioverify/service/impl/RedisServiceImpl.java
@@ -8,24 +8,36 @@
import org.springframework.data.redis.core.HashOperations;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Service;
+
import java.util.Set;
+import java.util.concurrent.TimeUnit;
+/**
+ * Redis 操作
+ */
@Service
public class RedisServiceImpl implements RedisService {
+
@Autowired
private StringRedisTemplate redisTemplate;
@Autowired
private DataUtil dataUtil;
+
+ private static final String OAUTH_TEMP_TOKEN_PREF = "oauth:temp:";
+ private static final String OAUTH_BIND_NONCE_PREF = "oauth:bind:";
+
@Override
public void saveToken(String token, String userId) {
redisTemplate.opsForValue().set(TokenUtil.TOKEN_PREF + token, userId);
redisTemplate.opsForValue().set(TokenUtil.TMARK_PREF + token, "", dataUtil.getTokenInvalid());
redisTemplate.opsForHash().put(TokenUtil.USERID_PREF + userId, token, "");
}
+
@Override
public boolean checkToken(String token) {
return Boolean.TRUE.equals(redisTemplate.hasKey(TokenUtil.TOKEN_PREF + token));
}
+
@Override
public void removeToken(String token) {
String userId = redisTemplate.opsForValue().get(TokenUtil.TOKEN_PREF + token);
@@ -39,6 +51,7 @@ public void removeToken(String token) {
hops.delete(userIdP, token);
}
}
+
@Override
public void clearToken(String userId) {
String userIdP = TokenUtil.USERID_PREF + userId;
@@ -49,8 +62,34 @@ public void clearToken(String userId) {
}
redisTemplate.delete(userIdP);
}
+
@Override
public void saveSession(String serverId, String token) {
redisTemplate.opsForValue().set(SessionUtil.SESSION_PREF + serverId, token, dataUtil.getSessionExpire());
}
+
+
+ @Override
+ public void saveOAuthTempToken(String tempToken, String userId) {
+ String key = OAUTH_TEMP_TOKEN_PREF + tempToken;
+ redisTemplate.opsForValue().set(key, userId, dataUtil.getOauthExpire().getSeconds(), TimeUnit.SECONDS);
+ }
+
+ @Override
+ public String consumeOAuthTempToken(String tempToken) {
+ String key = OAUTH_TEMP_TOKEN_PREF + tempToken;
+ return redisTemplate.opsForValue().getAndDelete(key);
+ }
+
+ @Override
+ public void saveOAuthBindNonce(String nonce, String userId) {
+ String key = OAUTH_BIND_NONCE_PREF + nonce;
+ redisTemplate.opsForValue().set(key, userId, dataUtil.getOauthExpire().getSeconds(), TimeUnit.SECONDS);
+ }
+
+ @Override
+ public String consumeOAuthBindNonce(String nonce) {
+ return redisTemplate.opsForValue().getAndDelete(OAUTH_BIND_NONCE_PREF + nonce);
+ }
+
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/service/impl/UserServiceImpl.java b/src/main/java/org/miowing/mioverify/service/impl/UserServiceImpl.java
index 75e135f..71ade7e 100644
--- a/src/main/java/org/miowing/mioverify/service/impl/UserServiceImpl.java
+++ b/src/main/java/org/miowing/mioverify/service/impl/UserServiceImpl.java
@@ -14,7 +14,9 @@ public class UserServiceImpl extends ServiceImpl implements UserS
@Override
public User getLogin(String username, String password) {
return getLogin(username, password, false);
+ //
}
+
@Override
public User getLogin(String username, String password, boolean exception) {
LambdaQueryWrapper lqw = new LambdaQueryWrapper<>();
@@ -25,10 +27,27 @@ public User getLogin(String username, String password, boolean exception) {
}
return user;
}
+
@Override
public @Nullable User getLoginNoPwd(String username) {
LambdaQueryWrapper lqw = new LambdaQueryWrapper<>();
lqw.eq(User::getUsername, username);
return getOne(lqw);
}
+
+ @Override
+ public User getByProviderUserId(String provider, String providerUserId) {
+ LambdaQueryWrapper lqw = new LambdaQueryWrapper<>();
+ switch ( provider.toLowerCase() ) {
+ case "github" -> lqw.eq(User :: getGithubId, providerUserId);
+ case "microsoft" -> lqw.eq(User :: getMicrosoftId, providerUserId);
+ case "mcjpg" -> lqw.eq(User :: getMcjpgId, providerUserId);
+ case "custom" -> lqw.eq(User :: getCustomId, providerUserId);
+ default -> {
+ return null;
+ }
+ }
+ return getOne(lqw);
+ }
+
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/service/package-info.java b/src/main/java/org/miowing/mioverify/service/package-info.java
new file mode 100644
index 0000000..0fb6da2
--- /dev/null
+++ b/src/main/java/org/miowing/mioverify/service/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * 业务层
+ */
+package org.miowing.mioverify.service;
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/util/DataUtil.java b/src/main/java/org/miowing/mioverify/util/DataUtil.java
index d3710d2..0c32cd6 100644
--- a/src/main/java/org/miowing/mioverify/util/DataUtil.java
+++ b/src/main/java/org/miowing/mioverify/util/DataUtil.java
@@ -5,6 +5,7 @@
import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
+
import java.nio.file.Path;
import java.time.Duration;
@@ -55,8 +56,33 @@ public class DataUtil implements InitializingBean {
private boolean profileStrict;
@Value("${mioverify.extern.multi-profile-name}")
private boolean multiProfileName;
+
+ //以下为跨域设置
+ @Value("${mioverify.cors.enabled}")
+ private boolean corsEnabled;
+ @Value("${mioverify.cors.allowed-origin}")
+ private String corsAllowedOrigin;
+
+ //以下为 Oauth 设置
+ @Value("${spring.security.oauth2.enabled}")
+ private boolean oAuthEnabled;
+ @Value("${spring.security.oauth2.client.registration.github.enabled}")
+ private boolean oAuthGitHubEnabled;
+ @Value("${spring.security.oauth2.client.registration.microsoft.enabled}")
+ private boolean oAuthMicrosoftEnabled;
+ @Value("${spring.security.oauth2.client.registration.mcjpg.enabled}")
+ private boolean oAuthMcjpgEnabled;
+ @Value("${spring.security.oauth2.client.registration.custom.enabled}")
+ private boolean oAuthCustomEnabled;
+ @Value("${spring.security.oauth2.expire:5m}")
+ private Duration oauthExpire;
+ @Value("${mioverify.oauth-frontend-redirect-uri}")
+ private String oauthFrontendRedirectUri;
+
@Override
public void afterPropertiesSet() throws Exception {
log.info("Reading data from application file...");
+ //
}
+
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/util/TokenUtil.java b/src/main/java/org/miowing/mioverify/util/TokenUtil.java
index 38ee2a5..790e6f8 100644
--- a/src/main/java/org/miowing/mioverify/util/TokenUtil.java
+++ b/src/main/java/org/miowing/mioverify/util/TokenUtil.java
@@ -8,12 +8,16 @@
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.auth0.jwt.interfaces.DecodedJWT;
+import jakarta.servlet.http.HttpServletRequest;
import org.miowing.mioverify.pojo.AToken;
+import org.miowing.mioverify.pojo.Profile;
import org.miowing.mioverify.pojo.User;
+import org.miowing.mioverify.service.ProfileService;
import org.miowing.mioverify.service.RedisService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.lang.Nullable;
import org.springframework.stereotype.Component;
+
import java.util.Date;
/**
@@ -25,12 +29,31 @@ public class TokenUtil {
private DataUtil dataUtil;
@Autowired
private RedisService redisService;
+ @Autowired
+ private ProfileService profileService;
+
+ //TODO 控制优化
public static String TOKEN_PREF = "tk_";
public static String TMARK_PREF = "tm_";
public static String USERID_PREF = "tv_";
+
+ /**
+ * 生成随机的客户端令牌
+ *
+ * @return 客户端令牌字符串
+ */
public static String genClientToken() {
return IdUtil.simpleUUID();
+ //
}
+
+ /**
+ * 生成访问令牌（JWT）
+ * @param user 用户对象
+ * @param clientToken 客户端令牌（可为 null，此时自动生成）
+ * @param bindProfile 绑定的角色 ID
+ * @return JWT 访问令牌
+ */
public String genAccessToken(User user, @Nullable String clientToken, String bindProfile) {
Date invalidAt = new Date(System.currentTimeMillis() + dataUtil.getTokenInvalid().toMillis());
return JWT.create()
@@ -41,6 +64,14 @@ public String genAccessToken(User user, @Nullable String clientToken, String bin
.withExpiresAt(invalidAt)
.sign(Algorithm.HMAC256(dataUtil.getTokenSign()));
}
+
+ /**
+ * 验证访问令牌的有效性
+ * @param accessToken 访问令牌字符串
+ * @param clientToken 客户端令牌（可为 null，不校验）
+ * @param strictExpire 是否严格检查弱过期时间（wexp）
+ * @return 如果验证通过返回 {@link AToken} 对象，否则返回 null
+ */
public @Nullable AToken verifyAccessToken(String accessToken, @Nullable String clientToken, boolean strictExpire) {
try {
DecodedJWT dJWT = JWT
@@ -73,4 +104,32 @@ public String genAccessToken(User user, @Nullable String clientToken, String bin
return null;
}
}
+
+ /**
+ * 从 HTTP 请求中解析当前登录用户的 ID
+ *
+ * 从 Authorization 头中提取 Bearer 令牌，验证令牌有效性，并通过绑定的角色 ID 获取用户 ID。
+ * 令牌必须有效且未过期（严格模式）。
+ *
+ *
+ * @param request HTTP 请求对象
+ *
+ * @return 当前登录用户的 ID，如果未登录或令牌无效则返回 null
+ */
+ public @Nullable String getCurrentUserId(HttpServletRequest request) {
+ String authHeader = request.getHeader("Authorization");
+ if ( authHeader == null || ! authHeader.startsWith("Bearer ") ) {
+ return null;
+ }
+ String token = authHeader.substring(7);
+ // 验证 token，严格检查过期时间（strictExpire = true）
+ AToken aToken = verifyAccessToken(token, null, true);
+ if ( aToken == null ) {
+ return null;
+ }
+ // 通过绑定的 Profile ID 获取用户 ID
+ Profile profile = profileService.getById(aToken.bindProfile());
+ return profile != null ? profile.getBindUser() : null;
+ }
+
}
\ No newline at end of file
diff --git a/src/main/java/org/miowing/mioverify/util/Util.java b/src/main/java/org/miowing/mioverify/util/Util.java
index 4e31cc4..8628aea 100644
--- a/src/main/java/org/miowing/mioverify/util/Util.java
+++ b/src/main/java/org/miowing/mioverify/util/Util.java
@@ -9,6 +9,8 @@
import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
+
import java.io.IOException;
import java.security.*;
import java.util.Base64;
@@ -51,7 +53,7 @@ public String getTextureURL(String hash) {
return getServerURL() + "/texture/hash/" + hash;
}
public String getServerURL() {
- return dataUtil.isUseHttps() ? "https://" : "http://" + dataUtil.getServerDomain() + ":" + dataUtil.getPort();
+ return ServletUriComponentsBuilder.fromCurrentContextPath().build().toUriString();
}
public String signature(String value) {
try {
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 190a855..7adc960 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -17,7 +17,62 @@ server:
key-alias: boot
servlet:
application-display-name: MioVerify Alpha
+ # 自动适配 Nginx 和 Cloudflare，如果你使用了这两个东西，请设为 native 或 framework(更建议) 。而不是 none
+ forward-headers-strategy: none
+
+
spring:
+
+ security:
+ oauth2:
+ enabled: true
+ # State 和 TempToken 有效期
+ expire: 5m
+ client:
+ registration:
+
+ github:
+ enabled: true
+ client-id: "your-github-client-id"
+ client-secret: "your-github-client-secret"
+ redirect-uri: "{baseUrl}/oauth/callback/github" # 不可修改！
+ scope: read:user, user:email
+
+ microsoft:
+ enabled: true
+ client-id: "client-id"
+ client-secret: "client-secret"
+ redirect-uri: "{baseUrl}/oauth/callback/microsoft" # 不可修改！
+ scope: openid, profile, email
+
+ mcjpg:
+ enabled: true
+ client-id: "client-id"
+ client-secret: "client-secret"
+ redirect-uri: "{baseUrl}/oauth/callback/mcjpg" # 不可修改！
+ scope: openid, profile, email
+
+ custom:
+ enabled: true
+ client-id: "client-id"
+ client-secret: "client-secret"
+ redirect-uri: "{baseUrl}/oauth/callback/custom" # 不可修改！
+ scope: read
+ client-name: "custom"
+
+ provider:
+ microsoft:
+ issuer-uri: "https://login.microsoftonline.com/common/v2.0"
+ user-name-attribute: name
+ mcjpg:
+ issuer-uri: "https://sso.mcjpg.org"
+ user-name-attribute: sub
+ custom:
+ authorization-uri: "https://example.com"
+ token-uri: "https://example.com"
+ user-info-uri: "https://example.com"
+ user-name-attribute: sub
+
servlet:
multipart:
# 允许文件上传
@@ -27,7 +82,7 @@ spring:
# 最大上传请求尺寸
max-request-size: 2MB
profiles:
- # 选择数据库，"test-sqlite" 或 "test-mysql"
+ # 选择数据库，"test-sqlite" 或 "test-mysql"，这两个在下面配置
active: test-sqlite
data:
# 设置Redis配置
@@ -36,10 +91,24 @@ spring:
# url: ...
host: localhost
port: 6379
+
+
mybatis-plus:
global-config:
banner: false
+
+
mioverify:
+ # OAuth 前端回调地址 (路径不可修改)
+ oauth-frontend-redirect-uri: "https://your-frontend.com/oauth/callback"
+
+ # 跨域配置，生产环境中必须设置
+ cors:
+ # 是否启用跨域配置（若在 CDN 中配置或不跨域，可以不启用）
+ enabled: false
+ # 允许跨域的域名（* 表示允许所有，但生产环境不建议。）
+ allowed-origin: "https://your-domain.com"
+
# 扩展API配置项
extern:
register:
@@ -60,6 +129,7 @@ mioverify:
key: admin123098
# 是否允许重复角色名(仅发生在注册和修改)
multi-profile-name: true
+
token:
# 给角色(Profile)签名的文本
signature: 'abcd273nsi179a'
@@ -67,9 +137,11 @@ mioverify:
expire: 10m
# token永久过期时间
invalid: 1h
+
session:
# session过期时间
expire: 6m
+
security:
# 公钥路径
public-key-loc: keys/public.pem
@@ -79,12 +151,14 @@ mioverify:
sign-algorithm: SHA1withRSA
# 批量获取角色(Profile)API最大限制数量
profile-batch-limit: 5
+
texture:
# 材质存储位置
storage-loc: textures
# 默认皮肤存储位置
default-skin-loc: textures/skin/default.png
- # 服务器元数据，详见Yggdrasil API
+
+ # 服务器元数据，详见Yggdrasil API
props:
meta:
# 将会显示在启动器
@@ -92,7 +166,7 @@ mioverify:
# 实现的名称
implementation-name: mioverify
# 实现的版本
- implementation-version: '0.0.1'
+ implementation-version: '1.4.0'
links:
# 主页地址
home-page: https://www.baidu.com
diff --git a/src/main/resources/banner.txt b/src/main/resources/banner.txt
index 5beb060..6856c94 100644
--- a/src/main/resources/banner.txt
+++ b/src/main/resources/banner.txt
@@ -3,4 +3,5 @@
/ /|_/ / / __ \ | | / / _ \/ ___/ / /_/ / / /
/ / / / / /_/ / | |/ / __/ / / / __/ /_/ /
/_/ /_/_/\____/ |___/\___/_/ /_/_/ \__, /
- /____/
\ No newline at end of file
+ /____/
+Spring Boot Version${spring-boot.formatted-version} === https://github.com/pingguomc/MioVerify
\ No newline at end of file
diff --git a/src/main/resources/db/schema.sql b/src/main/resources/db/schema.sql
index 21c9afc..ff3ba74 100644
--- a/src/main/resources/db/schema.sql
+++ b/src/main/resources/db/schema.sql
@@ -13,7 +13,15 @@ CREATE TABLE IF NOT EXISTS `profiles` (
CREATE TABLE IF NOT EXISTS `users` (
`id` varchar(64) NOT NULL,
`username` varchar(255) NOT NULL,
- `password` varchar(255) NOT NULL,
+ `password` varchar(255) NULL DEFAULT NULL,
`preferred_lang` varchar(8) NULL DEFAULT NULL,
- PRIMARY KEY (`id`)
+ `microsoft_id` VARCHAR(255) NULL,
+ `github_id` VARCHAR(255) NULL,
+ `mcjpg_id` VARCHAR(255) NULL,
+ `custom_id` VARCHAR(255) NULL,
+ PRIMARY KEY (`id`),
+ UNIQUE (`microsoft_id`),
+ UNIQUE (`github_id`),
+ UNIQUE (`mcjpg_id`),
+ UNIQUE (`custom_id`)
);
\ No newline at end of file
diff --git a/src/main/resources/logback-spring.xml b/src/main/resources/logback-spring.xml
index 3cf6644..6ebb26e 100644
--- a/src/main/resources/logback-spring.xml
+++ b/src/main/resources/logback-spring.xml
@@ -7,7 +7,7 @@
- [%d{MM-dd HH:mm:ss}] [%thread] %-5level - [%logger{36}] : %msg%n
+ [%d{MM-dd HH:mm:ss.SSS}] [%thread] %-5level - [%logger{36}] : %msg%n
@@ -25,7 +25,7 @@
2GB
- %d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level - [%logger{36}] : %msg%n
+ %d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level - [%logger{36}] : %msg%n
diff --git a/src/test/java/org/miowing/mioverify/MioVerifyApplicationTests.java b/src/test/java/org/miowing/mioverify/MioVerifyApplicationTests.java
index 670f01d..1584794 100644
--- a/src/test/java/org/miowing/mioverify/MioVerifyApplicationTests.java
+++ b/src/test/java/org/miowing/mioverify/MioVerifyApplicationTests.java
@@ -2,10 +2,15 @@
import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
@SpringBootTest
class MioVerifyApplicationTests {
+ @MockBean
+ private ClientRegistrationRepository clientRegistrationRepository;
+
@Test
void contextLoads() {
}
diff --git a/src/test/resources/application-test-sqlite.yml b/src/test/resources/application-test-sqlite.yml
new file mode 100644
index 0000000..e69de29
diff --git "a/\344\270\264\346\227\266\346\226\207\344\273\266.md" "b/\344\270\264\346\227\266\346\226\207\344\273\266.md"
new file mode 100644
index 0000000..f5cc24b
--- /dev/null
+++ "b/\344\270\264\346\227\266\346\226\207\344\273\266.md"
@@ -0,0 +1,248 @@
+# MioVerify 部署配置检查清单
+
+> 本文档面向首次部署 MioVerify 的用户。请按顺序逐项检查，带 🔴 的为 **必须修改** 项，带 🟡 的为 **按需修改** 项。
+
+---
+
+## 一、数据库选择
+
+| 配置项 | 位置 | 说明 |
+|-----------------------------|-----|----------------------------------------------------|
+| 🔴 `spring.profiles.active` | 主配置 | 选择数据库类型：`test-sqlite`（轻量/单机）或 `test-mysql`（推荐生产环境） |
+
+### 如果选择 MySQL
+
+在配置文件底部 `test-mysql` 段修改：
+
+| 配置项 | 要改成什么 | 示例 |
+|---------------|------------|-----------------------------------------|
+| 🔴 `url` | 你的数据库地址和库名 | `jdbc:mysql://localhost:3306/mioverify` |
+| 🔴 `username` | 数据库用户名 | `mioverify` |
+| 🔴 `password` | 数据库密码 | 一个强密码 |
+
+> 💡 使用前需先手动创建好数据库（`CREATE DATABASE mioverify;`）
+
+### 如果选择 SQLite
+
+无需额外配置，数据会自动保存在项目目录的 `data.db` 文件中。
+
+---
+
+## 二、Redis 配置
+
+| 配置项 | 位置 | 要改成什么 |
+|-----------------------------|-----|-----------------------------|
+| 🟡 `spring.data.redis.host` | 主配置 | Redis 服务器地址（默认 `localhost`） |
+| 🟡 `spring.data.redis.port` | 主配置 | Redis 端口（默认 `6379`） |
+
+> ⚠️ Redis 是 **必须运行** 的依赖。部署前请确保 Redis 已安装并启动。
+>
+> 如果 Redis 有密码或在远程服务器，改用 URL 模式：
+> ```yaml
+> spring.data.redis.url: redis://:你的密码@地址:端口
+> ```
+
+---
+
+## 三、安全相关
+
+| 配置项 | 默认值 | 要做什么 |
+|---------------------------------------------------|------------------|-----------------|
+| 🔴 `mioverify.token.signature` | `abcd273nsi179a` | 替换为一段 **随机字符串** |
+| 🔴 `mioverify.extern.register.permission-key.key` | `admin123098` | 替换为你自己的管理密钥 |
+
+> 💡 生成随机字符串的方法（Linux/Mac 终端）：
+> ```bash
+> openssl rand -hex 32
+> ```
+
+---
+
+## 四、域名与网络
+
+### 4.1 服务器域名（必须修改）
+
+| 配置项 | 默认值 | 要改成什么 |
+|------------------------------------|-------------|-----------------------------|
+| 🔴 `mioverify.props.server-domain` | `localhost` | 你的实际域名，如 `auth.example.com` |
+| 🔴 `mioverify.props.use-https` | `false` | 如果使用 HTTPS 则改为 `true` |
+| 🔴 `mioverify.props.skin-domains` | `baidu.com` | 改为你的域名，如 `example.com` |
+
+> 💡 `skin-domains` 是 MC 客户端加载皮肤时的域名白名单，必须包含你的域名，否则皮肤不显示。
+
+### 4.2 端口
+
+| 配置项 | 默认值 | 说明 |
+|------------------|--------|--------------|
+| 🟡 `server.port` | `8080` | 服务监听端口，可按需修改 |
+
+### 4.3 反向代理（ Nginx / Cloudflare ）
+
+| 配置项 | 默认值 | 什么时候改 |
+|--------------------------------------|--------|---------------------------------------------|
+| 🟡 `server.forward-headers-strategy` | `none` | 使用了 Nginx 或 Cloudflare **必须**改为 `framework` |
+
+> ⚠️ 如果你用了反向代理但没改这个值，会导致：
+> - OAuth 回调地址错误
+> - 获取到的用户 IP 是代理服务器的 IP
+> - HTTPS 判断失败
+
+---
+
+## 五、SSL / HTTPS
+
+### 方案 A：用 Nginx 反代处理 SSL（✅ 推荐）
+
+保持以下配置不变即可：
+
+```yaml
+server.ssl.enabled: false
+server.forward-headers-strategy: framework # 记得改这个！
+mioverify.props.use-https: true # 改为 true
+```
+
+> Nginx 负责 SSL 终止，后端只跑 HTTP。
+
+### 方案 B：让 MioVerify 自己处理 SSL
+
+| 配置项 | 要改成什么 |
+|------------------------------------|---------------------------|
+| 🟡 `server.ssl.enabled` | `true` |
+| 🟡 `server.ssl.http-port` | HTTP 入口端口（会自动跳转 HTTPS） |
+| 🟡 `server.ssl.key-store` | 你的证书文件路径 |
+| 🟡 `server.ssl.key-store-password` | 证书密码（**不要用默认的 `123456`**） |
+| 🟡 `server.ssl.key-store-type` | `jks` 或 `PKCS12` |
+| 🟡 `server.ssl.key-alias` | 证书别名 |
+
+---
+
+## 六、OAuth2 第三方登录
+
+> 如果你不需要某个登录方式，把对应的 `enabled` 设为 `false` 即可跳过。
+
+### 6.1 GitHub
+
+| 配置项 | 要做什么 |
+|--------------------|---------------------------------------------------------------------------------------|
+| 🟡 `enabled` | 是否启用 |
+| 🔴 `client-id` | 去 [GitHub Developer Settings](https://github.com/settings/developers) 创建 OAuth App 获取 |
+| 🔴 `client-secret` | 同上 |
+
+> 创建 GitHub OAuth App 时，回调地址填：`https://你的域名/oauth/callback/github`
+
+### 6.2 Microsoft
+
+| 配置项 | 要做什么 |
+|--------------------|---------------------------------------------------------------------------------------|
+| 🟡 `enabled` | 是否启用 |
+| 🔴 `client-id` | 去 [Azure Portal](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps) 注册应用获取 |
+| 🔴 `client-secret` | 同上 |
+
+> 回调地址填：`https://你的域名/oauth/callback/microsoft`
+
+### 6.3 mcjpg
+
+| 配置项 | 要做什么 |
+|--------------------|----------------------------------------------|
+| 🟡 `enabled` | 是否启用 |
+| 🔴 `client-id` | 在 [mcjpg SSO](https://sso.mcjpg.org/) 平台注册获取 |
+| 🔴 `client-secret` | 同上 |
+
+### 6.4 自定义 Provider
+
+| 配置项 | 要做什么 |
+|----------------------------------------|----------------|
+| 🟡 `enabled` | 不使用请设为 `false` |
+| 🔴 `client-id` / `client-secret` | 对应平台获取 |
+| 🔴 `provider.custom.authorization-uri` | 授权端点 URL |
+| 🔴 `provider.custom.token-uri` | Token 端点 URL |
+| 🔴 `provider.custom.user-info-uri` | 用户信息端点 URL |
+| 🟡 `client-name` | 显示名称 |
+
+### 6.5 OAuth 前端回调
+
+| 配置项 | 默认值 | 要改成什么 |
+|--------------------------------------------|--------------------------------------------|-------------|
+| 🔴 `mioverify.oauth-frontend-redirect-uri` | `https://your-frontend.com/oauth/callback` | 你的前端实际回调页地址 |
+
+---
+
+## 七、跨域配置（CORS）
+
+> 仅在 **前后端域名不同** 时需要配置。注意 `api.example.com` 和 `login.example.com` 不是同一个域名。
+
+| 配置项 | 什么时候改 | 改成什么 |
+|------------------------------------|----------|-----------------------------------|
+| 🟡 `mioverify.cors.enabled` | 前后端不同域名时 | `true` |
+| 🟡 `mioverify.cors.allowed-origin` | 同上 | 前端域名，如 `https://skin.example.com` |
+
+> ⚠️ 生产环境 **不要** 设为 `*`，会有安全风险。
+
+---
+
+## 八、注册 API
+
+| 配置项 | 默认值 | 说明 |
+|---------------------------------------------|---------|-----------------------------|
+| 🟡 `extern.register.enabled` | `false` | 是否开放注册（不开则只能后台添加用户） |
+| 🟡 `extern.register.allow-user` | `true` | 允许注册账号 |
+| 🟡 `extern.register.allow-profile` | `false` | 允许注册游戏角色 |
+| 🟡 `extern.register.profile-strict` | `true` | 注册角色时要求验证密码（建议保持 `true`） |
+| 🟡 `extern.register.permission-key.enabled` | `false` | 是否需要密钥才能注册（**开放注册时强烈建议开启**） |
+| 🟡 `mioverify.extern.multi-profile-name` | `true` | 是否允许不同用户取相同角色名 |
+
+---
+
+## 九、Token 与 Session
+
+| 配置项 | 默认值 | 说明 |
+|------------------------------------|-------|-----------------|
+| 🟡 `mioverify.token.expire` | `10m` | Token 暂时失效时间 |
+| 🟡 `mioverify.token.invalid` | `1h` | Token 过期时间 |
+| 🟡 `mioverify.session.expire` | `6m` | Session 过期时间 |
+| 🟡 `spring.security.oauth2.expire` | `5m` | OAuth State 有效期 |
+
+> 💡 部署时不建议保持默认。
+> Minecraft 原版暂时失效为 24 小时
+
+---
+
+## 十、材质（ 皮肤 / 披风 ）
+
+| 配置项 | 默认值 | 说明 |
+|---------------------------------------------|-----------------------------|------------|
+| 🟡 `mioverify.texture.storage-loc` | `textures` | 材质文件存储目录 |
+| 🟡 `mioverify.texture.default-skin-loc` | `textures/skin/default.png` | 默认皮肤图片路径 |
+| 🟡 `spring.servlet.multipart.max-file-size` | `800KB` | 上传皮肤最大文件大小 |
+
+> 💡 需要提前准备一张默认皮肤 PNG 文件放到对应路径。
+
+---
+
+## 十一、服务器元数据
+
+| 配置项 | 默认值 | 要改成什么 |
+|---------------------------------------------|-------------------------|------------------|
+| 🟡 `props.meta.server-name` | `MioVerify 验证服务器` | 你的服务器名称（显示在启动器中） |
+| 🟡 `props.meta.links.home-page` | `https://www.baidu.com` | 你的主页地址 |
+| 🟡 `props.meta.links.register` | `https://www.baidu.com` | 你的注册页地址 |
+| 🟡 `mioverify.security.profile-batch-limit` | `5` | 批量查询角色上限 |
+
+---
+
+## 部署前最终自检
+
+请确认以下所有项都已完成：
+
+- [ ] 选好了数据库并填写了连接信息
+- [ ] Redis 已安装并正常运行
+- [ ] `token.signature` 已替换为随机字符串
+- [ ] `permission-key.key` 已替换
+- [ ] `server-domain` 已改为实际域名
+- [ ] `skin-domains` 已改为实际域名
+- [ ] `use-https` 根据实际情况设置
+- [ ] 使用反向代理时 `forward-headers-strategy` 已改为 `framework`
+- [ ] OAuth2 的 `client-id` 和 `client-secret` 已填入真实值（或关闭不用的）
+- [ ] `oauth-frontend-redirect-uri` 已改为前端实际地址
+- [ ] 默认皮肤文件已放置到位
+- [ ] SSL 证书密码不是默认的 `123456`（如果由应用处理 SSL）
\ No newline at end of file