1
tp8-sa-token/
2
├── app/
3
│   ├── controller/
4
│   │   ├── AuthController.php
5
│   │   └── UserController.php
6
│   ├── middleware/
7
│   │   └── SaTokenMiddleware.php
8
│   ├── exception/
9
│   │   └── Handler.php
10
│   ├── service/
11
│   │   └── PermissionService.php
12
│   └── provider/
13
│       └── SaTokenProvider.php
14
├── config/
15
│   ├── sa_token.php
16
│   ├── sa_token_sso.php
17
│   ├── sa_token_oauth2.php
18
│   ├── middleware.php
19
│   └── service.php
20
├── route/
21
│   └── app.php
22
├── .env
23
└── composer.json

1
<?php
2

3
return [
4
    // ==================== Token 基础配置 ====================
5
    // tokenName: Token 名称，同时也是 Cookie 名称
6
    'tokenName' => 'satoken',
7

8
    // tokenPrefix: Token 前缀，如 Bearer
9
    'tokenPrefix' => 'Bearer',
10

11
    // tokenStyle: Token 风格
12
    // uuid: UUID 格式 (550e8400-e29b-41d4-a716-446655440000)
13
    // simple-uuid: 简化 UUID (550e8400e29b41d4a716446655440000)
14
    // random-32: 32位随机字符串
15
    // random-64: 64位随机字符串
16
    // random-128: 128位随机字符串
17
    // tik: 24位随机字符串
18
    'tokenStyle' => 'uuid',
19

20
    // ==================== 有效期配置 ====================
21
    // timeout: Token 有效期（秒），默认30天，-1代表永不过期
22
    'timeout' => 86400,
23

24
    // activityTimeout: 最低活跃频率（秒），-1不限制
25
    // 设置为正数时，每次请求会刷新 Token 有效期
26
    'activityTimeout' => -1,
27

28
    // ==================== Cookie 详细配置 ====================
29
    // cookieName: Cookie 名称（默认与 tokenName 一致）
30
    'cookieName' => 'satoken',
31

32
    // cookieDomain: Cookie 域名，空表示当前域名
33
    // 设置为 .example.com 可在子域名间共享
34
    'cookieDomain' => '',
35

36
    // cookiePath: Cookie 路径，'/' 表示整个网站都有效
37
    'cookiePath' => '/',
38

39
    // cookieSecure: 是否仅通过 HTTPS 传输，生产环境建议 true
40
    'cookieSecure' => false,
41

42
    // cookieHttpOnly: 是否禁止 JavaScript 读取 Cookie，建议 true 防止 XSS
43
    'cookieHttpOnly' => true,
44

45
    // cookieSameSite: CSRF 防护策略
46
    // Strict: 最安全，Lax: 兼容性更好，None: 需要配合 Secure
47
    'cookieSameSite' => 'Strict',
48

49
    // cookieMaxAge: Cookie 在客户端的最大存活时间（秒）
50
    'cookieMaxAge' => 86400,
51

52
    // cookiePrefix: Cookie 前缀，如 __Secure- 增强安全性
53
    'cookiePrefix' => '',
54

55
    // ==================== 读取/写入配置 ====================
56
    // isReadHeader: 是否从 Header 读取 Token
57
    'isReadHeader' => true,
58

59
    // isReadCookie: 是否从 Cookie 读取 Token
60
    'isReadCookie' => true,
61

62
    // isReadBody: 是否从请求体读取 Token
63
    'isReadBody' => false,
64

65
    // isWriteCookie: 登录后是否写入 Cookie
66
    'isWriteCookie' => true,
67

68
    // isWriteHeader: 登录后是否写入响应头
69
    'isWriteHeader' => false,
70

71
    // ==================== 登录策略 ====================
72
    // concurrent: 是否允许多端同时登录
73
    'concurrent' => true,
74

75
    // isShare: 同端是否复用 Token
76
    'isShare' => true,
77

78
    // maxLoginCount: 同账号最大登录数，-1不限
79
    'maxLoginCount' => 12,
80

81
    // maxTryTimes: 创建 Token 最高循环次数
82
    'maxTryTimes' => 12,
83

84
    // ==================== 存储配置（Redis 模式） ====================
85
    'storage' => 'redis',
86
    'redis' => [
87
        'host' => env('REDIS_HOST', '127.0.0.1'),
88
        'port' => env('REDIS_PORT', 6379),
89
        'password' => env('REDIS_PASSWORD', ''),
90
        'db' => env('REDIS_DB', 0),
91
        'timeout' => 3,
92
        'prefix' => 'sa_token_',
93
    ],
94

95
    // ==================== Session 配置 ====================
96
    'session' => [
97
        'timeout' => 86400,
98
        'activityTimeout' => 1800,
99
        'maxSize' => 1024,
100
        'prefix' => 'session_',
101
    ],
102

103
    // ==================== 加密配置 ====================
104
    // cryptoType: 加密类型，intl（国际）/ sm（国密）
105
    'cryptoType' => 'intl',
106

107
    // tokenEncrypt: 是否启用 Token 内容加密
108
    'tokenEncrypt' => false,
109

110
    // tokenEncryptKey: Token 加密密钥（16/24/32 字节）
111
    'tokenEncryptKey' => '',
112

113
    // tokenFingerprint: 是否启用 Token 指纹绑定（IP + User-Agent）
114
    'tokenFingerprint' => false,
115

116
    // ==================== Refresh Token ====================
117
    // refreshToken: 是否启用 RefreshToken
118
    'refreshToken' => false,
119

120
    // refreshTokenTimeout: RefreshToken 有效期（秒），默认30天
121
    'refreshTokenTimeout' => 2592000,
122

123
    // refreshTokenRotation: 刷新时是否轮换 RefreshToken
124
    'refreshTokenRotation' => true,
125

126
    // ==================== 安全配置 ====================
127
    // antiBruteMaxFailures: 防暴力破解最大失败次数，0不限制
128
    'antiBruteMaxFailures' => 5,
129

130
    // antiBruteLockDuration: 锁定持续时间（秒）
131
    'antiBruteLockDuration' => 600,
132

133
    // ipAnomalyDetection: IP 异常检测
134
    'ipAnomalyDetection' => true,
135

136
    // ipAnomalySensitivity: IP 异常灵敏度（1-5）
137
    'ipAnomalySensitivity' => 3,
138

139
    // deviceManagement: 设备管理
140
    'deviceManagement' => true,
141

142
    // auditLog: 审计日志
143
    'auditLog' => true,
144

145
    // auditLogMaxEntries: 每种事件最大日志条数
146
    'auditLogMaxEntries' => 1000,
147

148
    // auditLogTtlDays: 日志保留天数
149
    'auditLogTtlDays' => 30,
150

151
    // ==================== JWT 配置 ====================
152
    'jwtSecretKey' => env('JWT_SECRET_KEY', ''),
153
    'jwtStateless' => false,
154

155
    // ==================== 签名配置 ====================
156
    'signKey' => env('SIGN_KEY', ''),
157
    'signTimestampGap' => 600,
158
    'signAlg' => 'sha256',
159

160
    // ==================== 日志配置 ====================
161
    'isLog' => env('APP_DEBUG', false),
162
];

1
<?php
2

3
declare(strict_types=1);
4

5
namespace app\service;
6

7
use think\facade\Db;
8

9
/**
10
 * 权限数据提供者
11
 * 负责从数据库获取用户的权限和角色信息
12
 */
13
class PermissionService
14
{
15
    /**
16
     * 获取用户权限码集合
17
     *
18
     * @param int $userId 用户ID
19
     * @return array 权限码列表
20
     */
21
    public function getPermissionList(int $userId): array
22
    {
23
        $perms = Db::name('user_permission')
24
            ->where('user_id', $userId)
25
            ->column('permission_code');
26
        return $perms ?: [];
27
    }
28

29
    /**
30
     * 获取用户角色标识集合
31
     *
32
     * @param int $userId 用户ID
33
     * @return array 角色标识列表
34
     */
35
    public function getRoleList(int $userId): array
36
    {
37
        $roles = Db::name('user_role')
38
            ->alias('ur')
39
            ->join('role r', 'ur.role_id = r.id')
40
            ->where('ur.user_id', $userId)
41
            ->column('r.role_code');
42
        return $roles ?: [];
43
    }
44

45
    /**
46
     * 获取用户所有权限（含角色继承）
47
     *
48
     * @param int $userId 用户ID
49
     * @return array 所有权限码列表
50
     */
51
    public function getAllPermissions(int $userId): array
52
    {
53
        $roles = $this->getRoleList($userId);
54
        $perms = [];
55

56
        // 从角色继承权限
57
        if (!empty($roles)) {
58
            $rolePerms = Db::name('role_permission')
59
                ->whereIn('role_code', $roles)
60
                ->column('permission_code');
61
            $perms = array_merge($perms, $rolePerms);
62
        }
63

64
        // 合并用户直接权限
65
        $userPerms = $this->getPermissionList($userId);
66
        $perms = array_merge($perms, $userPerms);
67

68
        return array_unique($perms);
69
    }
70

71
    /**
72
     * 验证用户密码
73
     *
74
     * @param string $username 用户名
75
     * @param string $password 密码
76
     * @return array|null 用户信息或 null
77
     */
78
    public function verifyPassword(string $username, string $password): ?array
79
    {
80
        $user = Db::name('user')
81
            ->where('username', $username)
82
            ->where('status', 1)
83
            ->find();
84

85
        if ($user && password_verify($password, $user['password'])) {
86
            return $user;
87
        }
88
        return null;
89
    }
90

91
    /**
92
     * 根据用户ID获取用户信息
93
     *
94
     * @param int $userId 用户ID
95
     * @return array|null 用户信息
96
     */
97
    public function getUserById(int $userId): ?array
98
    {
99
        return Db::name('user')->find($userId);
100
    }
101

102
    /**
103
     * 检查用户是否有指定权限
104
     *
105
     * @param int $userId 用户ID
106
     * @param string $permission 权限码
107
     * @return bool
108
     */
109
    public function hasPermission(int $userId, string $permission): bool
110
    {
111
        $permissions = $this->getAllPermissions($userId);
112
        return in_array($permission, $permissions);
113
    }
114

115
    /**
116
     * 检查用户是否有指定角色
117
     *
118
     * @param int $userId 用户ID
119
     * @param string $role 角色码
120
     * @return bool
121
     */
122
    public function hasRole(int $userId, string $role): bool
123
    {
124
        $roles = $this->getRoleList($userId);
125
        return in_array($role, $roles);
126
    }
127
}

1
<?php
2

3
declare(strict_types=1);
4

5
namespace app\provider;
6

7
use think\Service;
8
use SaToken\SaToken;
9
use SaToken\Dao\SaTokenDaoRedis;
10
use SaToken\StpUtil;
11
use app\service\PermissionService;
12

13
class SaTokenProvider extends Service
14
{
15
    public function register(): void
16
    {
17
        // 1. 加载配置
18
        $config = config('sa_token');
19

20
        // 2. 初始化 Sa-Token
21
        SaToken::init($config);
22

23
        // 3. 设置 Redis 存储驱动
24
        if ($config['storage'] === 'redis') {
25
            SaToken::setDao(new SaTokenDaoRedis($config['redis']));
26
        }
27

28
        // 4. 注入权限提供者
29
        $this->injectPermissionGetter();
30

31
        // 5. 注册事件监听器（可选）
32
        $this->registerListeners();
33
    }
34

35
    protected function injectPermissionGetter(): void
36
    {
37
        $service = new PermissionService();
38

39
        // 设置权限获取回调
40
        StpUtil::setPermissionGetter(function($loginId) use ($service) {
41
            return $service->getAllPermissions((int) $loginId);
42
        });
43

44
        // 设置角色获取回调
45
        StpUtil::setRoleGetter(function($loginId) use ($service) {
46
            return $service->getRoleList((int) $loginId);
47
        });
48
    }
49

50
    protected function registerListeners(): void
51
    {
52
        // 注册事件监听器
53
        // SaToken::addListener(new MySaTokenListener());
54
    }
55
}

1
<?php
2

3
declare(strict_types=1);
4

5
namespace app\middleware;
6

7
use SaToken\SaRouter;
8
use SaToken\StpUtil;
9
use SaToken\Exception\NotLoginException;
10
use SaToken\Exception\NotPermissionException;
11
use SaToken\Exception\NotRoleException;
12
use SaToken\Exception\DisableServiceException;
13
use think\Response;
14
use think\facade\Log;
15

16
class SaTokenMiddleware
17
{
18
    public function handle($request, \Closure $next)
19
    {
20
        try {
21
            // ========== 定义路由拦截规则 ==========
22

23
            // 1. 登录校验：所有 /api/** 接口需要登录
24
            // 排除登录、注册、刷新接口
25
            SaRouter::match('/api/**')
26
                ->exclude('/api/login', '/api/register', '/api/refresh')
27
                ->check(function() {
28
                    StpUtil::checkLogin();
29
                });
30

31
            // 2. 角色校验：/admin/** 需要 admin 角色
32
            SaRouter::match('/admin/**')
33
                ->check(function() {
34
                    StpUtil::checkLogin();
35
                    StpUtil::checkRole('admin');
36
                });
37

38
            // 3. 权限校验：/api/user/** 需要 user:read 权限
39
            SaRouter::match('/api/user/**')
40
                ->check(function() {
41
                    StpUtil::checkPermission('user:read');
42
                });
43

44
            // 4. 多权限校验：/api/order/** 需要 order:manage 或 order:view
45
            SaRouter::match('/api/order/**')
46
                ->check(function() {
47
                    StpUtil::checkPermissionOr(['order:manage', 'order:view']);
48
                });
49

50
            // 5. GET 请求特殊校验：/api/search/** 需要登录
51
            SaRouter::match('/api/search/**', 'GET')
52
                ->check(function() {
53
                    StpUtil::checkLogin();
54
                });
55

56
            // 6. POST 请求特殊校验：/api/upload/** 需要 upload 权限
57
            SaRouter::match('/api/upload/**', 'POST')
58
                ->check(function() {
59
                    StpUtil::checkPermission('upload');
60
                });
61

62
        } catch (NotLoginException $e) {
63
            return $this->error(401, '未登录或登录已过期', ['type' => $e->getType()]);
64
        } catch (NotPermissionException $e) {
65
            return $this->error(403, '权限不足：' . $e->getPermission());
66
        } catch (NotRoleException $e) {
67
            return $this->error(403, '角色不足：' . $e->getRole());
68
        } catch (DisableServiceException $e) {
69
            $remaining = StpUtil::getDisableTime();
70
            return $this->error(403, "账号已被封禁，剩余 {$remaining} 秒");
71
        } catch (\Exception $e) {
72
            Log::error('SaToken 鉴权异常：' . $e->getMessage());
73
            return $this->error(500, '服务器内部错误');
74
        }
75

76
        return $next($request);
77
    }
78

79
    protected function error(int $code, string $msg, array $extra = []): Response
80
    {
81
        return json([
82
            'code' => $code,
83
            'msg' => $msg,
84
            'data' => null,
85
            'extra' => $extra
86
        ], $code);
87
    }
88
}

1
<?php
2

3
use think\facade\Route;
4

5
// ========== 公开路由（无需鉴权） ==========
6
Route::post('api/login', 'Auth/login');
7
Route::post('api/register', 'Auth/register');
8
Route::post('api/refresh', 'Auth/refresh');
9

10
// ========== 需要鉴权的路由（使用中间件） ==========
11
Route::group('api', function () {
12
    Route::get('user/info', 'Auth/info');
13
    Route::post('user/logout', 'Auth/logout');
14
    Route::resource('users', 'User');
15
})->middleware('sa-token');
16

17
// ========== 后台管理路由 ==========
18
Route::group('admin', function () {
19
    Route::get('/', 'Admin/index');
20
    Route::get('/users', 'Admin/users');
21
    Route::get('/settings', 'Admin/settings');
22
})->middleware('sa-token');
23

24
// ========== 公开API ==========
25
Route::get('api/public', 'Public/index');

1
-- 用户表
2
CREATE TABLE `user` (
3
    `id` INT PRIMARY KEY AUTO_INCREMENT,
4
    `username` VARCHAR(50) NOT NULL UNIQUE,
5
    `password` VARCHAR(255) NOT NULL,
6
    `nickname` VARCHAR(100),
7
    `email` VARCHAR(100),
8
    `avatar` VARCHAR(255),
9
    `status` TINYINT DEFAULT 1,
10
    `last_login` INT,
11
    `last_ip` VARCHAR(45),
12
    `create_time` INT,
13
    `update_time` INT,
14
    INDEX `idx_username` (`username`),
15
    INDEX `idx_status` (`status`)
16
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户表';
17

18
-- 用户权限表
19
CREATE TABLE `user_permission` (
20
    `id` INT PRIMARY KEY AUTO_INCREMENT,
21
    `user_id` INT NOT NULL,
22
    `permission_code` VARCHAR(50) NOT NULL,
23
    `create_time` INT,
24
    UNIQUE KEY `uk_user_perm` (`user_id`, `permission_code`),
25
    INDEX `idx_user_id` (`user_id`)
26
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户权限表';
27

28
-- 角色表
29
CREATE TABLE `role` (
30
    `id` INT PRIMARY KEY AUTO_INCREMENT,
31
    `role_code` VARCHAR(50) NOT NULL UNIQUE,
32
    `role_name` VARCHAR(100) NOT NULL,
33
    `description` VARCHAR(255),
34
    `create_time` INT,
35
    INDEX `idx_role_code` (`role_code`)
36
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='角色表';
37

38
-- 用户角色关联表
39
CREATE TABLE `user_role` (
40
    `id` INT PRIMARY KEY AUTO_INCREMENT,
41
    `user_id` INT NOT NULL,
42
    `role_id` INT NOT NULL,
43
    `create_time` INT,
44
    UNIQUE KEY `uk_user_role` (`user_id`, `role_id`),
45
    INDEX `idx_user_id` (`user_id`),
46
    INDEX `idx_role_id` (`role_id`)
47
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户角色关联表';
48

49
-- 角色权限表
50
CREATE TABLE `role_permission` (
51
    `id` INT PRIMARY KEY AUTO_INCREMENT,
52
    `role_code` VARCHAR(50) NOT NULL,
53
    `permission_code` VARCHAR(50) NOT NULL,
54
    `create_time` INT,
55
    UNIQUE KEY `uk_role_perm` (`role_code`, `permission_code`),
56
    INDEX `idx_role_code` (`role_code`)
57
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='角色权限表';
58

59
-- 审计日志表
60
CREATE TABLE `audit_log` (
61
    `id` INT PRIMARY KEY AUTO_INCREMENT,
62
    `user_id` INT,
63
    `event_type` VARCHAR(50) NOT NULL,
64
    `ip` VARCHAR(45),
65
    `user_agent` VARCHAR(255),
66
    `details` JSON,
67
    `create_time` INT,
68
    INDEX `idx_user_id` (`user_id`),
69
    INDEX `idx_event_type` (`event_type`),
70
    INDEX `idx_create_time` (`create_time`)
71
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='审计日志表';

1
<?php
2

3
return [
4
    // ==================== Token 基础配置 ====================
5
    'tokenName' => 'satoken',
6
    'tokenPrefix' => 'Bearer',
7
    'tokenStyle' => 'uuid',
8

9
    // ==================== 有效期配置 ====================
10
    'timeout' => 86400,
11
    'activityTimeout' => -1,
12

13
    // ==================== Cookie 配置 ====================
14
    'cookieName' => 'satoken',
15
    'cookieDomain' => '',
16
    'cookiePath' => '/',
17
    'cookieSecure' => false,
18
    'cookieHttpOnly' => true,
19
    'cookieSameSite' => 'Strict',
20
    'cookieMaxAge' => 86400,
21

22
    // ==================== 读取/写入配置 ====================
23
    'isReadHeader' => true,
24
    'isReadCookie' => true,
25
    'isReadBody' => false,
26
    'isWriteCookie' => true,
27
    'isWriteHeader' => false,
28

29
    // ==================== 登录策略 ====================
30
    'concurrent' => true,
31
    'isShare' => true,
32
    'maxLoginCount' => 12,
33

34
    // ==================== 存储配置（内存模式） ====================
35
    'storage' => 'memory',
36

37
    // ==================== Session 配置 ====================
38
    'session' => [
39
        'timeout' => 86400,
40
        'activityTimeout' => 1800,
41
        'maxSize' => 1024,
42
    ],
43

44
    // ==================== 加密配置 ====================
45
    'cryptoType' => 'intl',
46
    'tokenEncrypt' => false,
47
    'tokenFingerprint' => false,
48

49
    // ==================== Refresh Token ====================
50
    'refreshToken' => false,
51
    'refreshTokenTimeout' => 2592000,
52

53
    // ==================== 安全配置 ====================
54
    'antiBruteMaxFailures' => 5,
55
    'antiBruteLockDuration' => 600,
56
    'ipAnomalyDetection' => true,
57
    'deviceManagement' => true,
58
    'auditLog' => true,
59

60
    // ==================== JWT 配置 ====================
61
    'jwtSecretKey' => '',
62
    'jwtStateless' => false,
63

64
    // ==================== 签名配置 ====================
65
    'signKey' => '',
66
    'signTimestampGap' => 600,
67
    'signAlg' => 'sha256',
68

69
    'isLog' => true,
70
];

1
<?php
2

3
declare(strict_types=1);
4

5
namespace app\provider;
6

7
use think\Service;
8
use SaToken\SaToken;
9
use SaToken\Dao\SaTokenDaoMemory;
10
use SaToken\StpUtil;
11
use app\service\PermissionService;
12

13
class SaTokenProvider extends Service
14
{
15
    public function register(): void
16
    {
17
        $config = config('sa_token');
18
        SaToken::init($config);
19

20
        // ========== 使用内存存储 ==========
21
        // 所有会话数据存储在 PHP 内存中
22
        // 应用重启后数据全部丢失
23
        SaToken::setDao(new SaTokenDaoMemory());
24

25
        $service = new PermissionService();
26
        StpUtil::setPermissionGetter(function($loginId) use ($service) {
27
            return $service->getAllPermissions((int) $loginId);
28
        });
29
        StpUtil::setRoleGetter(function($loginId) use ($service) {
30
            return $service->getRoleList((int) $loginId);
31
        });
32
    }
33
}

1
tp8-sa-token/
2
├── app/
3
│   ├── common/
4
│   │   ├── middleware/
5
│   │   │   └── SaTokenMiddleware.php
6
│   │   ├── service/
7
│   │   │   └── PermissionService.php
8
│   │   ├── exception/
9
│   │   │   └── Handler.php
10
│   │   └── provider/
11
│   │       └── SaTokenProvider.php
12
│   ├── api/
13
│   │   ├── controller/
14
│   │   │   └── AuthController.php
15
│   │   ├── config/
16
│   │   │   └── sa_token.php
17
│   │   └── route/
18
│   │       └── app.php
19
│   ├── admin/
20
│   │   ├── controller/
21
│   │   │   └── AuthController.php
22
│   │   ├── config/
23
│   │   │   └── sa_token.php
24
│   │   └── route/
25
│   │       └── app.php
26
│   └── provider.php
27
├── config/
28
│   └── sa_token.php
29
└── .env

1
<?php
2

3
return [
4
    // ==================== 通用配置 ====================
5
    'tokenName' => 'satoken',
6
    'tokenPrefix' => 'Bearer',
7
    'tokenStyle' => 'uuid',
8

9
    // ==================== Cookie 通用配置 ====================
10
    'cookieDomain' => '',
11
    'cookiePath' => '/',
12
    'cookieSecure' => false,
13
    'cookieHttpOnly' => true,
14
    'cookieSameSite' => 'Strict',
15

16
    // ==================== 存储配置（共享 Redis） ====================
17
    'storage' => 'redis',
18
    'redis' => [
19
        'host' => env('REDIS_HOST', '127.0.0.1'),
20
        'port' => env('REDIS_PORT', 6379),
21
        'password' => env('REDIS_PASSWORD', ''),
22
        'db' => env('REDIS_DB', 0),
23
        'timeout' => 3,
24
        // 全局前缀由各应用配置覆盖
25
    ],
26

27
    // ==================== Session 配置（共享） ====================
28
    'session' => [
29
        'timeout' => 86400,
30
        'activityTimeout' => 1800,
31
        'maxSize' => 1024,
32
    ],
33

34
    // ==================== 安全配置（全局通用） ====================
35
    'antiBruteMaxFailures' => 5,
36
    'antiBruteLockDuration' => 600,
37
    'ipAnomalyDetection' => true,
38
    'deviceManagement' => true,
39
    'auditLog' => true,
40

41
    // ==================== 各应用差异化配置 ====================
42
    'apps' => [
43
        'api' => [
44
            // API Token 有效期 2 小时
45
            'timeout' => 7200,
46
            'refreshToken' => true,
47
            'refreshTokenTimeout' => 2592000,
48
            'isReadCookie' => false,
49
            'isWriteCookie' => false,
50
            'isReadHeader' => true,
51
            'isWriteHeader' => true,
52
            'tokenFingerprint' => true,
53
            'redis' => ['prefix' => 'sa_token_api_'],
54
        ],
55
        'admin' => [
56
            // Admin Token 有效期 8 小时
57
            'timeout' => 28800,
58
            'refreshToken' => true,
59
            'concurrent' => false,
60
            'isShare' => false,
61
            'isReadCookie' => true,
62
            'isWriteCookie' => true,
63
            'cookiePath' => '/admin',
64
            'cookieSecure' => true,
65
            'tokenFingerprint' => true,
66
            'redis' => ['prefix' => 'sa_token_admin_'],
67
        ],
68
    ],
69
];

1
<?php
2

3
return [
4
    'timeout' => 7200,
5
    'refreshToken' => true,
6
    'refreshTokenTimeout' => 2592000,
7
    'refreshTokenRotation' => true,
8
    'isReadCookie' => false,
9
    'isWriteCookie' => false,
10
    'isReadHeader' => true,
11
    'isWriteHeader' => true,
12
    'concurrent' => true,
13
    'tokenFingerprint' => true,
14
    'redis' => [
15
        'prefix' => 'sa_token_api_',
16
    ],
17
];

1
<?php
2

3
return [
4
    'timeout' => 28800,
5
    'refreshToken' => true,
6
    'concurrent' => false,
7
    'isShare' => false,
8
    'isReadCookie' => true,
9
    'isWriteCookie' => true,
10
    'cookiePath' => '/admin',
11
    'cookieSecure' => true,
12
    'tokenFingerprint' => true,
13
    'redis' => [
14
        'prefix' => 'sa_token_admin_',
15
    ],
16
];

1
<?php
2

3
declare(strict_types=1);
4

5
namespace app\common\provider;
6

7
use think\Service;
8
use SaToken\SaToken;
9
use SaToken\StpUtil;
10
use SaToken\Dao\SaTokenDaoRedis;
11
use app\common\service\PermissionService;
12

13
class SaTokenProvider extends Service
14
{
15
    public function register(): void
16
    {
17
        $baseConfig = config('sa_token');
18
        $appName = app()->http->getName() ?: 'api';
19

20
        // 获取应用专属配置
21
        $appConfig = $this->getAppConfig($appName, $baseConfig);
22

23
        SaToken::init($appConfig);
24

25
        // ========== 使用 Redis 存储 ==========
26
        $redisConfig = $appConfig['redis'] ?? $baseConfig['redis'] ?? [];
27
        SaToken::setDao(new SaTokenDaoRedis($redisConfig));
28

29
        $this->injectPermission($appName);
30
    }
31

32
    protected function getAppConfig(string $appName, array $baseConfig): array
33
    {
34
        $appConfigFile = app()->getAppPath() . $appName . '/config/sa_token.php';
35
        if (is_file($appConfigFile)) {
36
            $appConfig = include $appConfigFile;
37
            return array_merge($baseConfig, $appConfig);
38
        }
39

40
        if (isset($baseConfig['apps'][$appName])) {
41
            return array_merge($baseConfig, $baseConfig['apps'][$appName]);
42
        }
43

44
        return $baseConfig;
45
    }
46

47
    protected function injectPermission(string $appName): void
48
    {
49
        // 不同应用使用不同的权限服务
50
        $service = match ($appName) {
51
            'admin' => new \app\admin\service\AdminPermissionService(),
52
            'api'   => new \app\api\service\ApiPermissionService(),
53
            default => new PermissionService(),
54
        };
55

56
        StpUtil::setPermissionGetter(function($loginId) use ($service) {
57
            return $service->getAllPermissions((int) $loginId);
58
        });
59

60
        StpUtil::setRoleGetter(function($loginId) use ($service) {
61
            return $service->getRoleList((int) $loginId);
62
        });
63
    }
64
}