From 79a07a882a9c8f349e17f89aaa2f2241b184e942 Mon Sep 17 00:00:00 2001
From: milky0217 <m943790568@163.com>
Date: Fri, 17 Jul 2026 20:23:35 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=F0=9F=94=B4=20Refresh=20token=20?=
 =?UTF-8?q?=E6=B3=84=E9=9C=B2=20JWT=5FSECRET=20=E2=80=94=20=E6=94=B9?=
 =?UTF-8?q?=E7=94=A8=E9=9A=8F=E6=9C=BA=20UUID=20=E6=9B=BF=E4=BB=A3=20base6?=
 =?UTF-8?q?4(secret)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/auth.rs | 43 +++++--------------------------------------
 1 file changed, 5 insertions(+), 38 deletions(-)

diff --git a/src/auth.rs b/src/auth.rs
index 93b0495..e703298 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -1,6 +1,6 @@
 use chrono::{Utc, Duration};
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, Validation, decode, encode};
-use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
+use uuid::Uuid;
 
 use crate::error::AppError;
 use crate::models::{Claims, TempTokenClaims};
@@ -11,7 +11,6 @@ use actix_web::{
 
 // 常量
 const ACCESS_TOKEN_EXPIRE_HOURS: i64 = 24;
-const REFRESH_TOKEN_EXPIRE_DAYS: i64 = 7;
 
 pub async fn jwt_middleware<B: MessageBody>(
     req: ServiceRequest,
@@ -65,42 +64,10 @@ pub fn generate_token(
     .map_err(|e| format!("生成JWT失败: {}", e))
 }
 
-// 生成 refresh_token（简单 base64 编码的随机字符串）
-pub fn generate_refresh_token(user_id: i32, secret: &str) -> Result<String, String> {
-    let now = Utc::now();
-    let exp = (now + Duration::days(REFRESH_TOKEN_EXPIRE_DAYS)).timestamp();
-
-    let payload = format!("{}:{}:{}", user_id, exp, secret);
-    let token = BASE64.encode(payload.as_bytes());
-
-    Ok(token)
-}
-
-// 解析 refresh_token，返回 (user_id, expires_at)
-#[allow(dead_code)]
-pub fn verify_refresh_token(token: &str, _secret: &str) -> Result<(i32, i64), String> {
-    let decoded = BASE64.decode(token)
-        .map_err(|e| format!("Refresh token 格式错误: {}", e))?;
-
-    let payload = String::from_utf8(decoded)
-        .map_err(|_| "Refresh token 解析失败".to_string())?;
-
-    let parts: Vec<&str> = payload.split(':').collect();
-    if parts.len() != 3 {
-        return Err("Refresh token 结构错误".to_string());
-    }
-
-    let user_id: i32 = parts[0].parse()
-        .map_err(|_| "Refresh token user_id 解析失败".to_string())?;
-    let exp: i64 = parts[1].parse()
-        .map_err(|_| "Refresh token exp 解析失败".to_string())?;
-
-    let now = Utc::now().timestamp();
-    if now > exp {
-        return Err("Refresh token 已过期".to_string());
-    }
-
-    Ok((user_id, exp))
+// 生成 refresh_token（随机 UUID，不含任何敏感信息）
+// 身份验证通过数据库查询该 token 是否存在实现
+pub fn generate_refresh_token(_user_id: i32, _secret: &str) -> Result<String, String> {
+    Ok(Uuid::new_v4().to_string())
 }
 
 // 验证并解析JWT的函数