101 lines
3.7 KiB
Bash
Executable File
101 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
||
# =============================================================
|
||
# 管理员 JWT 生成工具
|
||
# 用法: ./scripts/generate-admin-token.sh <user_id> [environment]
|
||
#
|
||
# 说明:
|
||
# 生成指定 user_id 的管理员 JWT token，用于调用管理 API。
|
||
# 需要服务器上已安装 python3 和 PyJWT 库。
|
||
# 在生产服务器上运行，而非本地。
|
||
#
|
||
# 示例:
|
||
# ./scripts/generate-admin-token.sh 1 production # 生产管理员 token
|
||
# ./scripts/generate-admin-token.sh 1 development # 开发管理员 token
|
||
# =============================================================
|
||
set -euo pipefail
|
||
|
||
if [ $# -lt 1 ]; then
|
||
echo "用法: $0 <user_id> [environment]"
|
||
echo " 默认 environment=production"
|
||
exit 1
|
||
fi
|
||
|
||
USER_ID="$1"
|
||
APP_ENV="${2:-production}"
|
||
JWT_SECRET=""
|
||
|
||
# 优先从 systemd 服务获取（新版部署）
|
||
if [ "$APP_ENV" = "production" ]; then
|
||
JWT_SECRET=$(systemctl cat rust-backend-blue.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
|
||
if [ -z "$JWT_SECRET" ]; then
|
||
JWT_SECRET=$(systemctl cat rust-backend-green.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
|
||
fi
|
||
elif [ "$APP_ENV" = "development" ]; then
|
||
JWT_SECRET=$(systemctl cat rust-backend-dev.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
|
||
fi
|
||
|
||
# 回退: 从 .env 文件获取（旧版部署）
|
||
if [ -z "$JWT_SECRET" ] && [ "$APP_ENV" = "production" ]; then
|
||
for f in /root/rust/rust_backend_blue/.env /root/rust/rust_backend_green/.env; do
|
||
[ -f "$f" ] && JWT_SECRET=$(grep -oP '(?<=^JWT_SECRET=).*' "$f" 2>/dev/null || true)
|
||
[ -n "$JWT_SECRET" ] && break
|
||
done
|
||
fi
|
||
if [ -z "$JWT_SECRET" ] && [ "$APP_ENV" = "development" ]; then
|
||
[ -f /root/rust/rust_backend_dev/.env ] && JWT_SECRET=$(grep -oP '(?<=^JWT_SECRET=).*' /root/rust/rust_backend_dev/.env 2>/dev/null || true)
|
||
fi
|
||
|
||
if [ -z "$JWT_SECRET" ]; then
|
||
echo "错误: 无法获取 JWT_SECRET，请在服务器上运行此脚本"
|
||
exit 1
|
||
fi
|
||
|
||
# 验证用户 ID 是否为管理员
|
||
echo "验证用户 ${USER_ID} 的管理员权限..."
|
||
if command -v docker &>/dev/null; then
|
||
DB_CONTAINER=$(docker ps --format "{{.Names}}" | grep -i postgres | head -1)
|
||
if [ -n "$DB_CONTAINER" ]; then
|
||
IS_ADMIN=$(docker exec "$DB_CONTAINER" psql -U postgres -d milkydata -t -A -c "SELECT is_admin FROM users WHERE id = ${USER_ID};" 2>/dev/null || echo "false")
|
||
if [ "$IS_ADMIN" != "t" ]; then
|
||
echo "警告: user_id=${USER_ID} 不是管理员！继续生成但不保证有权限。"
|
||
else
|
||
echo "✓ 用户 ${USER_ID} 确认为管理员"
|
||
fi
|
||
fi
|
||
else
|
||
echo "警告: 未检测到 docker，跳过管理员验证"
|
||
fi
|
||
|
||
# 生成 Token（使用 Python + PyJWT）
|
||
TOKEN=$(python3 -c "
|
||
import jwt, time
|
||
secret = '''${JWT_SECRET}'''
|
||
claims = {
|
||
'exp': int(time.time()) + 3600,
|
||
'iat': int(time.time()),
|
||
'user_id': ${USER_ID},
|
||
'openid': 'admin_${USER_ID}',
|
||
'user_type': 2
|
||
}
|
||
token = jwt.encode(claims, secret, algorithm='HS256')
|
||
print(token)
|
||
" 2>&1) || {
|
||
echo "错误: 生成 token 失败，请安装 PyJWT: pip3 install pyjwt"
|
||
exit 1
|
||
}
|
||
|
||
echo ""
|
||
echo "============================================"
|
||
echo " 管理员 JWT Token (user_id=${USER_ID}, ${APP_ENV})"
|
||
echo " 有效期: 1 小时"
|
||
echo "============================================"
|
||
echo "$TOKEN"
|
||
echo "============================================"
|
||
echo ""
|
||
echo "使用方式:"
|
||
echo " curl -H 'Authorization: Bearer 你的TOKEN' \\"
|
||
echo " https://${APP_ENV}.xmclassmate.top/api/admin/notifications \\"
|
||
echo " -X POST -H 'Content-Type: application/json' \\"
|
||
echo " -d '{\"scope\":\"all\",\"type_\":\"maintenance\",\"title\":\"通知标题\",\"content\":\"通知内容\",\"priority\":\"high\"}'"
|
||
echo ""
|