199 lines
8.9 KiB
PHP
199 lines
8.9 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
namespace app\mcp\service;
|
||
|
||
use app\adminapi\logic\LoginLogic;
|
||
use app\common\model\auth\Admin;
|
||
use think\facade\Cache;
|
||
use think\facade\Config;
|
||
use think\facade\Db;
|
||
use think\Request;
|
||
|
||
/**
|
||
* AI 授权：用后台账号密码一次性换取只读令牌；每次调用实时校验令牌与账号状态。
|
||
* 独立于后台登录会话（zyt_admin_session），不会挤掉浏览器、医生工作站或企微客服端的登录。
|
||
*/
|
||
class GrantService
|
||
{
|
||
public const STATUS_ACTIVE = 1;
|
||
|
||
public const STATUS_REVOKED = 2;
|
||
|
||
public const STATUS_EXPIRED = 3;
|
||
|
||
/**
|
||
* 校验账号密码及各项门禁，通过后签发令牌。失败抛 McpException（reason 见接口约定）。
|
||
*/
|
||
public static function issue(array $input, string $ip): array
|
||
{
|
||
$account = trim((string) ($input['account'] ?? ''));
|
||
$password = (string) ($input['password'] ?? '');
|
||
$client = substr(trim((string) ($input['client'] ?? 'xingzhi')), 0, 32) ?: 'xingzhi';
|
||
$instance = substr(trim((string) ($input['client_instance'] ?? '')), 0, 64);
|
||
$label = mb_substr(trim((string) ($input['label'] ?? '')), 0, 100);
|
||
if ($account === '' || $password === '' || mb_strlen($account) > 64 || strlen($password) > 128) {
|
||
throw new McpException('请输入正确的账号和密码', 'invalid_request');
|
||
}
|
||
if (!RateLimiter::hit('grant_ip_' . md5($ip), McpConfig::grantAttemptsPerIp(), 600)) {
|
||
throw new McpException('尝试次数过多，请稍后再试', 'locked');
|
||
}
|
||
$lockKey = 'ai_mcp_grant_fail_' . md5(mb_strtolower($account));
|
||
$failures = (int) Cache::get($lockKey, 0);
|
||
if ($failures >= McpConfig::lockFailures()) {
|
||
throw new McpException('密码连续' . McpConfig::lockFailures() . '次错误，请' . McpConfig::lockMinutes() . '分钟后重试', 'locked');
|
||
}
|
||
|
||
$admin = Admin::where('account', '=', $account)->findOrEmpty();
|
||
$salt = (string) Config::get('project.unique_identification');
|
||
$ok = !$admin->isEmpty() && (string) $admin['password'] !== ''
|
||
&& hash_equals((string) $admin['password'], create_password($password, $salt));
|
||
if (!$ok) {
|
||
Cache::set($lockKey, $failures + 1, McpConfig::lockMinutes() * 60);
|
||
// 账号不存在与密码错误给同样的提示，避免被用来探测账号
|
||
throw new McpException('账号或密码错误', 'invalid_credentials');
|
||
}
|
||
Cache::delete($lockKey);
|
||
|
||
self::assertAdminUsable($admin);
|
||
if (McpConfig::requirePasswordChanged() && array_key_exists('is_paw', $admin->getData()) && (int) $admin['is_paw'] !== 1) {
|
||
throw new McpException('请先在甄养堂后台修改初始密码，再绑定 AI 助手', 'need_change_password');
|
||
}
|
||
|
||
$now = time();
|
||
$token = TokenService::generate();
|
||
$expire = $now + McpConfig::tokenTtlDays() * 86400;
|
||
Db::startTrans();
|
||
try {
|
||
// 同一客户端实例重新绑定时，旧授权自动作废
|
||
Db::name('ai_grant')
|
||
->where(['admin_id' => $admin['id'], 'client' => $client, 'client_instance' => $instance, 'status' => self::STATUS_ACTIVE])
|
||
->update(['status' => self::STATUS_REVOKED, 'revoke_time' => $now, 'revoke_reason' => 'rebind', 'update_time' => $now]);
|
||
$grantId = (int) Db::name('ai_grant')->insertGetId([
|
||
'admin_id' => $admin['id'],
|
||
'token_hash' => TokenService::hash($token),
|
||
'token_prefix' => TokenService::displayPrefix($token),
|
||
'client' => $client,
|
||
'client_instance' => $instance,
|
||
'label' => $label,
|
||
'scopes' => 'zyt.read',
|
||
'pwd_fp' => self::passwordFingerprint($admin),
|
||
'status' => self::STATUS_ACTIVE,
|
||
'expire_time' => $expire,
|
||
'idle_days' => McpConfig::tokenIdleDays(),
|
||
'last_used_time' => $now,
|
||
'last_used_ip' => $ip,
|
||
'created_ip' => $ip,
|
||
'create_time' => $now,
|
||
'update_time' => $now,
|
||
]);
|
||
Db::commit();
|
||
} catch (\Throwable $e) {
|
||
Db::rollback();
|
||
throw $e;
|
||
}
|
||
$identity = new Identity(self::find($grantId), $admin);
|
||
return [
|
||
'grant_id' => $grantId,
|
||
'token' => $token,
|
||
'token_prefix' => TokenService::displayPrefix($token),
|
||
'expire_at' => $expire,
|
||
'idle_days' => McpConfig::tokenIdleDays(),
|
||
'admin' => $identity->publicProfile(),
|
||
];
|
||
}
|
||
|
||
/**
|
||
* 按 Bearer 令牌识别调用人。令牌无效、过期、闲置超期、账号停用/删除/改密、失去 AI 权限时抛 401。
|
||
*/
|
||
public static function authenticate(Request $request): Identity
|
||
{
|
||
$token = TokenService::fromRequest($request);
|
||
if ($token === '') {
|
||
throw McpException::unauthorized('缺少有效的授权令牌');
|
||
}
|
||
$grant = Db::name('ai_grant')->where('token_hash', TokenService::hash($token))->find();
|
||
if (!$grant || (int) $grant['status'] !== self::STATUS_ACTIVE) {
|
||
throw McpException::unauthorized();
|
||
}
|
||
$now = time();
|
||
$idleLimit = (int) $grant['last_used_time'] + (int) $grant['idle_days'] * 86400;
|
||
if ((int) $grant['expire_time'] <= $now || $idleLimit <= $now) {
|
||
self::close((int) $grant['id'], self::STATUS_EXPIRED, 'expired');
|
||
throw McpException::unauthorized('授权已过期，请在行知重新绑定甄养堂账号', 'expired');
|
||
}
|
||
$admin = Admin::where('id', '=', $grant['admin_id'])->findOrEmpty();
|
||
if ($admin->isEmpty()) {
|
||
self::close((int) $grant['id'], self::STATUS_REVOKED, 'admin_deleted');
|
||
throw McpException::unauthorized('甄养堂账号已删除');
|
||
}
|
||
if (!hash_equals((string) $grant['pwd_fp'], self::passwordFingerprint($admin))) {
|
||
self::close((int) $grant['id'], self::STATUS_REVOKED, 'password_changed');
|
||
throw McpException::unauthorized('甄养堂账号密码已修改，请重新绑定', 'password_changed');
|
||
}
|
||
try {
|
||
self::assertAdminUsable($admin);
|
||
} catch (McpException $e) {
|
||
if ($e->reason === 'disabled') {
|
||
self::close((int) $grant['id'], self::STATUS_REVOKED, 'admin_disabled');
|
||
}
|
||
throw new McpException($e->getMessage(), $e->reason, 401);
|
||
}
|
||
$ip = $request->ip();
|
||
if ($now - (int) $grant['last_used_time'] >= 60 || $grant['last_used_ip'] !== $ip) {
|
||
Db::name('ai_grant')->where('id', $grant['id'])->update(['last_used_time' => $now, 'last_used_ip' => $ip, 'update_time' => $now]);
|
||
}
|
||
return new Identity($grant, $admin);
|
||
}
|
||
|
||
public static function find(int $grantId): array
|
||
{
|
||
return Db::name('ai_grant')->where('id', $grantId)->find() ?: [];
|
||
}
|
||
|
||
public static function close(int $grantId, int $status, string $reason, int $by = 0): void
|
||
{
|
||
$now = time();
|
||
Db::name('ai_grant')->where(['id' => $grantId, 'status' => self::STATUS_ACTIVE])->update([
|
||
'status' => $status,
|
||
'revoke_time' => $now,
|
||
'revoke_by' => $by,
|
||
'revoke_reason' => substr($reason, 0, 64),
|
||
'update_time' => $now,
|
||
]);
|
||
}
|
||
|
||
public static function publicGrant(array $grant): array
|
||
{
|
||
return [
|
||
'grant_id' => (int) $grant['id'],
|
||
'expire_at' => (int) $grant['expire_time'],
|
||
'idle_days' => (int) $grant['idle_days'],
|
||
'last_used_at' => (int) $grant['last_used_time'],
|
||
];
|
||
}
|
||
|
||
/** 停用、企微强制绑定、AI 权限点：签发和每次调用都检查 */
|
||
private static function assertAdminUsable(Admin $admin): void
|
||
{
|
||
if ((int) $admin['disable'] === 1) {
|
||
throw new McpException('甄养堂账号已停用', 'disabled');
|
||
}
|
||
if (LoginLogic::adminMustBindWorkWechat(['root' => $admin['root'], 'work_wechat_userid' => $admin['work_wechat_userid'] ?? ''])) {
|
||
throw new McpException('请先在甄养堂后台绑定企业微信，再使用 AI 助手', 'need_bind_wecom');
|
||
}
|
||
if ((int) $admin['root'] !== 1) {
|
||
$perm = PermissionService::normalize('ai.mcp/access');
|
||
if (!PermissionService::isRegistered('ai.mcp/access') || !isset(PermissionService::adminPerms((int) $admin['id'])[$perm])) {
|
||
throw new McpException('该账号未开通“AI 助手查询”权限，请联系甄养堂管理员', 'no_ai_permission');
|
||
}
|
||
}
|
||
}
|
||
|
||
/** 密码指纹：改密后与签发时不一致，授权随即失效（不需要修改后台任何改密代码） */
|
||
private static function passwordFingerprint(Admin $admin): string
|
||
{
|
||
return hash('sha256', $admin['id'] . ':' . (string) $admin['password']);
|
||
}
|
||
}
|