WebSocket 鉴权方案选型与Electron 应用的最佳实践

// 客户端实现
class WebSocketAuthService {
  private ws: WebSocket | null = null;
  private token: string;
  private authTimeout: NodeJS.Timeout | null = null;
  private isAuthenticated: boolean = false;
  
  constructor(token: string) {
    this.token = token;
  }
  
  async connect(userId: string): Promise<void> {
    return new Promise((resolve, reject) => {
      // 先建立连接
      this.ws = new WebSocket(`wss://im.example.com/ws/${userId}`);
      
      this.ws.onopen = () => {
        console.log('WebSocket 连接成功，开始鉴权');
        
        // 连接成功后立即发送鉴权消息
        this.sendAuthMessage();
        
        // 设置鉴权超时
        this.authTimeout = setTimeout(() => {
          if (!this.isAuthenticated) {
            console.error('鉴权超时，断开连接');
            this.ws?.close();
            reject(new Error('鉴权超时'));
          }
        }, 5000); // 5 秒超时
      };
      
      this.ws.onmessage = (event) => {
        const message = JSON.parse(event.data);

        // 处理鉴权响应
        if (message.status === 'success' || message.code === 200) {
          this.isAuthenticated = true;
          if (this.authTimeout) {
            clearTimeout(this.authTimeout);
          }
          console.log('鉴权成功');
          resolve();
        } else if (message.status === 'error' || message.code === 401) {
          console.error('鉴权失败');
          this.ws?.close();
          reject(new Error('鉴权失败'));
        }
      };
      
      this.ws.onerror = (error) => {
        console.error('WebSocket 连接错误');
        reject(error);
      };
    });
  }
  
  private sendAuthMessage(): void {
    const authMessage = {
      action: 'auth',
      token: this.token,
      timestamp: Date.now()
    };

    this.ws?.send(JSON.stringify(authMessage));
  }
}

// 服务端实现
import WebSocket from 'ws';
import jwt from 'jsonwebtoken';

const wss = new WebSocket.Server({ noServer: true });

wss.on('connection', (ws) => {
  let isAuthenticated = false;
  
  ws.on('message', (data) => {
    const message = JSON.parse(data);
    
    // 处理鉴权消息
    if (message.action === 'auth') {
      try {
        // 验证 Token
        const decoded = jwt.verify(message.token, JWT_SECRET);
        
        // 将用户信息附加到 ws 对象
        ws.userId = decoded.userId;
        ws.userName = decoded.userName;
        isAuthenticated = true;
        
        // 发送鉴权成功响应
        ws.send(JSON.stringify({
          status: 'success',
          code: 200,
          message: '鉴权成功'
        }));

        console.log(`用户 ${ws.userId} 鉴权成功`);
      } catch (error) {
        // 发送鉴权失败响应
        ws.send(JSON.stringify({
          status: 'error',
          code: 401,
          message: '鉴权失败'
        }));

        // 断开连接
        ws.close(1008, '鉴权失败');
      }
      return;
    }

    // 未鉴权，拒绝其他消息
    if (!isAuthenticated) {
      ws.send(JSON.stringify({
        status: 'error',
        code: 401,
        message: '未鉴权'
      }));
      return;
    }
    
    // 已鉴权，处理业务消息
    handleBusinessMessage(ws, message);
  });
  
  ws.on('close', () => {
    console.log(`用户 ${ws.userId} 断开连接`);
  });
});

// 客户端实现
class TokenManager {
  private accessToken: string | null = null;
  private refreshToken: string | null = null;
  private accessTokenExpiry: number = 0;
  private refreshTokenExpiry: number = 0;
  private refreshTimer: NodeJS.Timeout | null = null;
  
  constructor() {
    this.loadTokensFromStorage();
  }
  
  /**
   * 保存 Token 对
   */
  async saveTokens(tokens: LoginResponse): Promise<void> {
    this.accessToken = tokens.accessToken;
    this.refreshToken = tokens.refreshToken;
    this.accessTokenExpiry = Date.now() + tokens.expiresIn * 1000;
    this.refreshTokenExpiry = Date.now() + tokens.refreshExpiresIn * 1000;
    
    // 加密存储到本地
    await SecureStorage.set('access_token', this.accessToken);
    await SecureStorage.set('refresh_token', this.refreshToken);
    
    // 启动自动刷新
    this.startAutoRefresh();
  }
  
  /**
   * 获取有效的 AccessToken
   */
  async getAccessToken(): Promise<string | null> {
    // 检查内存中的 token
    if (this.accessToken && Date.now() < this.accessTokenExpiry - 300000) {
      return this.accessToken; // 还有 5 分钟才过期
    }
    
    // Token 即将过期或已过期，尝试刷新
    const success = await this.refreshAccessToken();
    return success ? this.accessToken : null;
  }
  
  /**
   * 刷新 AccessToken
   */
  async refreshAccessToken(): Promise<boolean> {
    if (!this.refreshToken || Date.now() >= this.refreshTokenExpiry) {
      console.error('Refresh token 已过期');
      await this.clearTokens();
      return false;
    }
    
    try {
      const response = await fetch('https://api.example.com/auth/refresh', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${this.refreshToken}`
        }
      });
      
      if (!response.ok) {
        throw new Error('Token refresh failed');
      }
      
      const data: LoginResponse = await response.json();
      
      // 更新 token
      this.accessToken = data.accessToken;
      this.accessTokenExpiry = Date.now() + data.expiresIn * 1000;
      
      // 保存
      await SecureStorage.set('access_token', this.accessToken);
      
      console.log('Token 刷新成功');
      return true;
    } catch (error) {
      console.error('Token 刷新失败:', error);
      await this.clearTokens();
      return false;
    }
  }
  
  /**
   * 启动自动刷新
   */
  private startAutoRefresh(): void {
    if (this.refreshTimer) {
      clearTimeout(this.refreshTimer);
    }
    
    // 在 token 过期前 5 分钟刷新
    const timeUntilRefresh = this.accessTokenExpiry - Date.now() - 300000;
    
    this.refreshTimer = setTimeout(async () => {
      const success = await this.refreshAccessToken();
      if (success) {
        this.startAutoRefresh(); // 继续下一次刷新
      } else {
        // 刷新失败，通知应用
        this.emit('token_expired');
      }
    }, Math.max(0, timeUntilRefresh));
  }
  
  /**
   * 清除所有 Token
   */
  async clearTokens(): Promise<void> {
    this.accessToken = null;
    this.refreshToken = null;
    this.accessTokenExpiry = 0;
    this.refreshTokenExpiry = 0;
    
    if (this.refreshTimer) {
      clearTimeout(this.refreshTimer);
      this.refreshTimer = null;
    }
    
    await SecureStorage.remove('access_token');
    await SecureStorage.remove('refresh_token');
  }
  
  /**
   * 从存储加载 Token
   */
  private async loadTokensFromStorage(): Promise<void> {
    try {
      this.accessToken = await SecureStorage.get('access_token');
      this.refreshToken = await SecureStorage.get('refresh_token');
      
      if (this.accessToken) {
        const decoded = jwt.decode(this.accessToken);
        this.accessTokenExpiry = decoded.exp * 1000;
      }
      
      if (this.refreshToken) {
        const decoded = jwt.decode(this.refreshToken);
        this.refreshTokenExpiry = decoded.exp * 1000;
      }
      
      // 启动自动刷新
      if (this.accessToken && this.refreshToken) {
        this.startAutoRefresh();
      }
    } catch (error) {
      console.error('加载 Token 失败:', error);
    }
  }
}


// WebSocket 服务
class WebSocketAuthService {
  private ws: WebSocket | null = null;
  private tokenManager: TokenManager;
  
  constructor(tokenManager: TokenManager) {
    this.tokenManager = tokenManager;
  }
  
  async connect(userId: string): Promise<void> {
    // 获取有效的 token
    const token = await this.tokenManager.getAccessToken();
    
    if (!token) {
      throw new Error('没有有效的 token，请先登录');
    }
    
    return new Promise((resolve, reject) => {
      this.ws = new WebSocket(`wss://im.example.com/ws/${userId}`);
      
      this.ws.onopen = async () => {
        // 发送鉴权消息
        const authMessage = {
          action: 'auth',
          token: token,
          timestamp: Date.now()
        };

        this.ws?.send(JSON.stringify(authMessage));
      };
      
      this.ws.onmessage = async (event) => {
        const message = JSON.parse(event.data);

        // 鉴权成功
        if (message.status === 'success' || message.code === 200) {
          console.log('鉴权成功');
          resolve();
        }
        // 鉴权失败（可能是 token 过期）
        else if (message.status === 'error' || message.code === 401) {
          console.log('鉴权失败，尝试刷新 token');

          // 刷新 token
          const success = await this.tokenManager.refreshAccessToken();
          if (success) {
            // 重新鉴权
            const newToken = await this.tokenManager.getAccessToken();
            const authMessage = {
              action: 'auth',
              token: newToken,
              timestamp: Date.now()
            };
            this.ws?.send(JSON.stringify(authMessage));
          } else {
            // 刷新失败，需要重新登录
            console.error('Token 刷新失败，需要重新登录');
            this.emit('relogin_required');
            reject(new Error('需要重新登录'));
          }
        }
      };
    });
  }
}

// 1. Token 管理（使用加密存储）
class TokenManager {
  private accessToken: string | null = null;
  private refreshToken: string | null = null;
  private accessTokenExpiry: number = 0;
  private refreshTokenExpiry: number = 0;
  private deviceId: string;

  constructor(private secureStore: SecureStoreService) {
    this.deviceId = this.getOrCreateDeviceId();
    this.loadTokens();
  }

  /**
   * 获取设备 ID
   */
  private getOrCreateDeviceId(): string {
    let deviceId = this.secureStore.get('device_id');
    if (!deviceId) {
      deviceId = uuidv4();
      this.secureStore.set('device_id', deviceId);
    }
    return deviceId;
  }

  /**
   * 从存储加载 Token
   */
  private async loadTokens(): Promise<void> {
    this.accessToken = this.secureStore.get('access_token');
    this.refreshToken = this.secureStore.get('refresh_token');
    if (this.accessToken) {
      const decoded = this.decodeJWT(this.accessToken);
      this.accessTokenExpiry = decoded.exp * 1000;
    }
    if (this.refreshToken) {
      const decoded = this.decodeJWT(this.refreshToken);
      this.refreshTokenExpiry = decoded.exp * 1000;
    }
  }

  /**
   * 清除所有 Token
   */
  private async clearTokens(): Promise<void> {
    this.accessToken = null;
    this.refreshToken = null;
    this.accessTokenExpiry = 0;
    this.refreshTokenExpiry = 0;
    this.secureStore.remove('access_token');
    this.secureStore.remove('refresh_token');
  }

  /**
   * 检查 Token 是否过期
   */
  private isTokenExpired(token: string): boolean {
    if (!token) return true;
    const decoded = this.decodeJWT(token);
    return decoded.exp * 1000 <= Date.now();
  }

  /**
   * 获取 Token 过期时间
   */
  private getTokenExpiry(token: string): number {
    if (!token) return 0;
    const decoded = this.decodeJWT(token);
    return decoded.exp * 1000;
  }

  /**
   * 解码 JWT Token（简化版，实际应使用库）
   */
  private decodeJWT(token: string): any {
    // 简化实现：实际应使用 jwt.decode() 或类似库
    const parts = token.split('.');
    if (parts.length !== 3) {
      throw new Error('Invalid JWT token');
    }
    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
    return payload;
  }

  /**
   * 加密保存 Token
   */
  async saveTokens(tokens: LoginResponse): Promise<void> {
    this.accessToken = tokens.accessToken;
    this.refreshToken = tokens.refreshToken;

    // 使用加密存储服务
    this.secureStore.set('access_token', tokens.accessToken);
    this.secureStore.set('refresh_token', tokens.refreshToken);

    // 解码并设置过期时间
    if (tokens.accessToken) {
      const decoded = this.decodeJWT(tokens.accessToken);
      this.accessTokenExpiry = decoded.exp * 1000;
    }
    if (tokens.refreshToken) {
      const decoded = this.decodeJWT(tokens.refreshToken);
      this.refreshTokenExpiry = decoded.exp * 1000;
    }

    this.startAutoRefresh();
  }

  /**
   * 解密读取 Token
   */
  async getAccessToken(): Promise<string | null> {
    if (this.accessToken && !this.isTokenExpired(this.accessToken)) {
      return this.accessToken;
    }

    const success = await this.refreshAccessToken();
    return success ? this.accessToken : null;
  }

  /**
   * 刷新 Token
   */
  async refreshAccessToken(): Promise<boolean> {
    if (!this.refreshToken) {
      return false;
    }

    try {
      const response = await fetch('https://api.example.com/auth/refresh', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'X-Device-Id': this.deviceId
        },
        body: JSON.stringify({
          refreshToken: this.refreshToken
        })
      });

      if (!response.ok) {
        throw new Error('Refresh failed');
      }

      const data: LoginResponse = await response.json();
      await this.saveTokens(data);
      return true;
    } catch (error) {
      console.error('Token refresh failed:', error);
      await this.clearTokens();
      return false;
    }
  }

  /**
   * 自动刷新
   */
  private startAutoRefresh(): void {
    const expiryTime = this.getTokenExpiry(this.accessToken);
    const refreshTime = expiryTime - Date.now() - 300000; // 5 分钟前刷新

    setTimeout(async () => {
      await this.refreshAccessToken();
      this.startAutoRefresh(); // 继续下一次刷新
    }, refreshTime);
  }
}

// 2. WebSocket 鉴权服务
class WebSocketAuthService {
  private ws: WebSocket | null = null;
  private tokenManager: TokenManager;
  private isAuthenticated: boolean = false;
  private authRetryCount: number = 0;

  constructor(tokenManager: TokenManager) {
    this.tokenManager = tokenManager;
  }

  async connect(userId: string): Promise<void> {
    const token = await this.tokenManager.getAccessToken();

    if (!token) {
      throw new Error('No valid token available');
    }

    return new Promise((resolve, reject) => {
      this.ws = new WebSocket(`wss://im.example.com/ws/${userId}`);

      this.ws.onopen = async () => {
        await this.authenticate();
        resolve();
      };

      this.ws.onmessage = async (event) => {
        const message = JSON.parse(event.data);

        if (message.status === 'success' || message.code === 200) {
          // 鉴权成功
          this.isAuthenticated = true;
          this.authRetryCount = 0;
          console.log('鉴权成功');
        } else if (message.status === 'error' || message.code === 401) {
          // 鉴权失败
          console.error('鉴权失败');

          if (this.authRetryCount < 3) {
            // 尝试刷新 token 并重新鉴权
            this.authRetryCount++;
            const success = await this.tokenManager.refreshAccessToken();
            if (success) {
              await this.authenticate();
            } else {
              this.emit('relogin_required');
              reject(new Error('需要重新登录'));
            }
          } else {
            this.emit('relogin_required');
            reject(new Error('需要重新登录'));
          }
        } else if (message.status === 'error' && message.code === 403) {
          // 单点登录
          this.emit('sso_conflict', message);
        }
      };

      this.ws.onclose = () => {
        this.isAuthenticated = false;
      };
    });
  }

  /**
   * 鉴权
   */
  private async authenticate(): Promise<void> {
    const token = await this.tokenManager.getAccessToken();
    const deviceId = this.tokenManager.deviceId;
    const timestamp = Date.now();
    const nonce = uuidv4();

    // 生成签名
    const authData = JSON.stringify({ deviceId, timestamp, nonce });
    const signature = crypto.createHmac('sha256', token)
      .update(authData)
      .digest('hex');

    const authMessage = {
      action: 'auth',
      token: token,
      deviceId: deviceId,
      timestamp: timestamp,
      nonce: nonce,
      signature: signature
    };

    this.ws?.send(JSON.stringify(authMessage));
  }

  /**
   * 发送业务消息
   */
  async sendMessage(message: any): Promise<void> {
    if (!this.isAuthenticated) {
      throw new Error('未鉴权');
    }

    const token = await this.tokenManager.getAccessToken();
    const timestamp = Date.now();
    const nonce = uuidv4();

    // 生成消息签名
    const messageBody = JSON.stringify(message);
    const signature = crypto.createHmac('sha256', token)
      .update(`${timestamp}${nonce}${messageBody}`)
      .digest('hex');

    const signedMessage = {
      ...message,
      timestamp: timestamp,
      nonce: nonce,
      signature: signature
    };

    this.ws?.send(JSON.stringify(signedMessage));
  }
}

┌─────────────────────────────────────────────────────────┐
│                    渲染进程 (Render)                     │
├─────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌──────────────┐  ┌──────────────┐   │
│  │  UserStore  │  │  ChatStore   │  │  UI Components│   │
│  └──────┬──────┘  └──────┬───────┘  └──────┬───────┘   │
│         │                │                  │           │
│         └────────────────┼──────────────────┘           │
│                          │ IPC 通信                      │
└──────────────────────────┼───────────────────────────────┘
                           │
┌──────────────────────────┼───────────────────────────────┐
│                    主进程 (Main)                         │
├──────────────────────────┼───────────────────────────────┤
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │            WebSocketService                     │     │
│  │  - connect(userId: string): Promise<void>     │     │
│  │  - disconnect(): void                          │     │
│  │  - sendMessage(message: WsMessage): void        │     │
│  │  - on(event, callback): void                  │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │          TokenManagerService                   │     │
│  │  - saveTokens(tokens: TokenPair): Promise      │     │
│  │  - getAccessToken(): Promise<string>          │     │
│  │  - refreshAccessToken(): Promise<boolean>     │     │
│  │  - clearTokens(): Promise<void>                │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │      MessageSignService (签名验证服务)          │     │
│  │  - sign(message: any, token: string): string  │     │
│  │  - verify(message: any, signature: string)     │     │
│  │  - generateNonce(): string                    │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │      DeviceManagerService (设备管理服务)        │     │
│  │  - getDeviceId(): string                      │     │
│  │  - registerDevice(): Promise<void>             │     │
│  │  - checkDeviceConflict(): Promise<boolean>      │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │        SecureElectronStoreService             │     │
│  │  - set(key, value): void                      │     │
│  │  - get(key): string | null                   │     │
│  │  - remove(key): void                          │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
└──────────────────────────┼───────────────────────────────┘
                           │
                    wss://api.example.com/ws
                           │
┌──────────────────────────┼───────────────────────────────┐
│                    服务器 (Server)                        │
├──────────────────────────┼───────────────────────────────┤
│  ┌───────────────────────▼───────────────────────┐     │
│  │              WebSocket Server                   │     │
│  │  - 鉴权接口 (auth message)                    │     │
│  │  - 消息路由 (message routing)                  │     │
│  │  - 会话管理 (session management)               │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │           Auth Service                        │     │
│  │  - 登录接口 (/auth/login)                     │     │
│  │  - 刷新接口 (/auth/refresh)                   │     │
│  │  - 登出接口 (/auth/logout)                    │     │
│  │  - 单点登录检测                                │     │
│  │  - 消息签名验证                                │     │
│  │  - Nonce 缓存管理                             │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │       Device Management Service                │     │
│  │  - 设备注册                                    │     │
│  │  - 设备冲突检测                                │     │
│  │  - 设备会话管理                                │     │
│  └───────────────────────┬───────────────────────┘     │
│                          │                               │
│  ┌───────────────────────▼───────────────────────┐     │
│  │           Token Storage                        │     │
│  │  - Refresh Token 存储                         │     │
│  │  - 黑名单管理                                  │     │
│  │  - 会话管理                                    │     │
│  │  - Nonce 缓存                                 │     │
│  └───────────────────────────────────────────────┘     │
└─────────────────────────────────────────────────────────┘

interface TokenPair {
  accessToken: string;
  refreshToken: string;
  accessTokenExpiry: number;
  refreshTokenExpiry: number;
}

interface ITokenManagerService {
  /**
   * 保存 Token 对（加密存储）
   */
  saveTokens(tokens: TokenPair): Promise<void>;

  /**
   * 获取有效的 AccessToken
   * 如果 Token 即将过期或已过期，自动刷新
   */
  getAccessToken(): Promise<string | null>;

  /**
   * 手动刷新 AccessToken
   */
  refreshAccessToken(): Promise<boolean>;

  /**
   * 清除所有 Token
   */
  clearTokens(): Promise<void>;

  /**
   * 检查是否已登录
   */
  isLoggedIn(): Promise<boolean>;

  /**
   * 订阅 Token 事件
   */
  on(event: 'token:expired' | 'token:refreshed' | 'token:cleared', callback: Function): void;
}

interface IMessageSignService {
  /**
   * 生成消息签名
   * @param message - 要签名的消息内容
   * @param token - 用于签名的 Token
   * @returns HMAC-SHA256 签名值
   */
  sign(message: any, token: string): string;

  /**
   * 验证消息签名
   * @param message - 要验证的消息
   * @param signature - 待验证的签名
   * @param token - 用于验证的 Token
   * @returns 签名是否有效
   */
  verify(message: any, signature: string, token: string): boolean;

  /**
   * 生成唯一的 Nonce
   * @returns UUID v4 格式的 Nonce
   */
  generateNonce(): string;

  /**
   * 验证时间戳是否在有效窗口内
   * @param timestamp - 要验证的时间戳
   * @param windowSeconds - 时间窗口(秒),默认 300 秒(5 分钟)
   * @returns 时间戳是否有效
   */
  verifyTimestamp(timestamp: number, windowSeconds?: number): boolean;
}

import { createHmac } from 'crypto';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class MessageSignService implements IMessageSignService {
  private readonly TIMESTAMP_WINDOW = 300; // 5 分钟时间窗口

  sign(message: any, token: string): string {
    const content = JSON.stringify(message);
    return createHmac('sha256', token)
      .update(content)
      .digest('hex');
  }

  verify(message: any, signature: string, token: string): boolean {
    const expectedSignature = this.sign(message, token);
    return signature === expectedSignature;
  }

  generateNonce(): string {
    return uuidv4();
  }

  verifyTimestamp(timestamp: number, windowSeconds: number = this.TIMESTAMP_WINDOW): boolean {
    const now = Date.now();
    const windowMs = windowSeconds * 1000;
    return Math.abs(now - timestamp) <= windowMs;
  }
}

interface DeviceInfo {
  deviceId: string;
  deviceName: string;
  platform: string;
  osVersion: string;
  appVersion: string;
  lastActiveAt: number;
}

interface IDeviceManagerService {
  /**
   * 获取或创建设备 ID
   * @returns 设备 ID
   */
  getDeviceId(): string;

  /**
   * 向服务器注册设备
   * @returns 注册是否成功
   */
  registerDevice(): Promise<boolean>;

  /**
   * 检测设备冲突(是否在其它设备登录)
   * @returns 是否存在冲突
   */
  checkDeviceConflict(): Promise<boolean>;

  /**
   * 获取当前设备信息
   * @returns 设备信息
   */
  getDeviceInfo(): DeviceInfo;
}

import { app } from 'electron';
import { v4 as uuidv4 } from 'uuid';
import os from 'os';
import pkg from '../../package.json';

@Injectable()
export class DeviceManagerService implements IDeviceManagerService {
  private deviceId: string;
  private deviceInfo: DeviceInfo;

  constructor(private secureStore: SecureStoreService) {
    this.deviceId = this.getOrCreateDeviceId();
    this.deviceInfo = this.buildDeviceInfo();
  }

  private getOrCreateDeviceId(): string {
    // 尝试从安全存储中获取
    let deviceId = this.secureStore.get('device_id');
    if (!deviceId) {
      // 生成新的设备 ID
      deviceId = uuidv4();
      this.secureStore.set('device_id', deviceId);
    }
    return deviceId;
  }

  private buildDeviceInfo(): DeviceInfo {
    return {
      deviceId: this.deviceId,
      deviceName: `${os.platform()}-${os.hostname()}`,
      platform: os.platform(),
      osVersion: os.release(),
      appVersion: pkg.version,
      lastActiveAt: Date.now()
    };
  }

  async registerDevice(): Promise<boolean> {
    try {
      const response = await fetch('/api/device/register', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${await this.getToken()}`
        },
        body: JSON.stringify(this.deviceInfo)
      });
      return response.ok;
    } catch (error) {
      console.error('设备注册失败:', error);
      return false;
    }
  }

  async checkDeviceConflict(): Promise<boolean> {
    try {
      const response = await fetch('/api/device/check-conflict', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${await this.getToken()}`
        },
        body: JSON.stringify({ deviceId: this.deviceId })
      });
      const data = await response.json();
      return data.conflict || false;
    } catch (error) {
      console.error('检测设备冲突失败:', error);
      return false;
    }
  }

  getDeviceInfo(): DeviceInfo {
    return this.deviceInfo;
  }

  private async getToken(): Promise<string> {
    // 从 TokenManager 获取 token
    // 这里简化处理，实际应该注入 TokenManager 服务
    return this.secureStore.get('auth_access_token') || '';
  }

  /**
   * 更新设备最后活跃时间
   */
  updateLastActiveTime(): void {
    this.deviceInfo.lastActiveAt = Date.now();
  }
}

import { safeStorage } from 'electron';

if (safeStorage.isEncryptionAvailable()) {
    const encrypted = safeStorage.encryptString(token);
    // 存储 encrypted buffer
} else {
    // 降级方案：使用 crypto 加密
}

private startAutoRefresh(): void {
    const timeUntilRefresh = this.accessTokenExpiry - Date.now() - 300000; // 5 分钟前刷新
    
    setTimeout(async () => {
      const success = await this.refreshAccessToken();
      if (success) {
        this.startAutoRefresh(); // 继续下一次刷新
      }
    }, timeUntilRefresh);
}

private isAccessTokenValid(): boolean {
    if (!this.accessToken) return false;
    
    const now = Date.now();
    // 还有 5 分钟才过期，认为有效
    return now < this.accessTokenExpiry - 300000;
}

interface IWebSocketService {
  /**
   * 连接 WebSocket
   * 连接成功后自动鉴权
   */
  connect(userId: string): Promise<void>;

  /**
   * 断开连接
   */
  disconnect(): void;

  /**
   * 发送消息（自动添加签名）
   */
  sendMessage(message: WsMessage): void;

  /**
   * 订阅事件
   */
  on(event: WebSocketEventType, callback: Function): void;
}

constructor(
    private tokenManager: TokenManagerService,
    private messageSign: MessageSignService,
    private deviceManager: DeviceManagerService
) {}

async connect(userId: string): Promise<void> {
    // 获取有效 token
    const token = await this.tokenManager.getAccessToken();

    if (!token) {
    throw new Error('未找到有效 token，请先登录');
    }

    // 获取设备 ID
    const deviceId = this.deviceManager.getDeviceId();

    // 建立连接
    this.ws = new WebSocket(`wss://api.example.com/ws/${userId}`);

    this.ws.onopen = () => {
      // 发送带签名的鉴权消息
      this.sendAuthMessage(token, deviceId);
    };
}

private async sendAuthMessage(token: string, deviceId: string): Promise<void> {
    const timestamp = Date.now();
    const nonce = this.messageSign.generateNonce();

    // 构造鉴权消息
    const authData = {
        action: 'auth',
        token: token,
        deviceId: deviceId,
        timestamp: timestamp,
        nonce: nonce
    };

    // 生成签名
    const signature = this.messageSign.sign(authData, token);

    // 发送完整消息
    const authMessage = {
        ...authData,
        signature: signature
    };

    this.ws?.send(JSON.stringify(authMessage));
}

  async sendMessage(message: WsMessage): Promise<void> {
    if (!this.isAuthenticated) {
      throw new Error('未鉴权');
    }

    const token = await this.tokenManager.getAccessToken();
    const deviceId = this.deviceManager.getDeviceId();
    const timestamp = Date.now();
    const nonce = this.messageSign.generateNonce();

    // 构造消息内容
    const messageData = {
      ...message,
      deviceId: deviceId,
      timestamp: timestamp,
      nonce: nonce
    };

    // 生成签名
    const signature = this.messageSign.sign(messageData, token);

    // 发送完整消息
    const signedMessage = {
      ...messageData,
      signature: signature
    };

    this.ws?.send(JSON.stringify(signedMessage));
}

  private async handleAuthFailed(): Promise<void> {
    // 尝试刷新 token
    const success = await this.tokenManager.refreshAccessToken();

    if (success) {
      // 重新鉴权
      const newToken = await this.tokenManager.getAccessToken();
      const deviceId = this.deviceManager.getDeviceId();
      await this.sendAuthMessage(newToken, deviceId);
    } else {
      // 刷新失败，通知应用需要重新登录
      this.emit('relogin_required');
    }
  }

  private async handleSSOConflict(): Promise<void> {
    // 检测设备冲突
    const hasConflict = await this.deviceManager.checkDeviceConflict();

    if (hasConflict) {
      // 发出事件，通知用户
      this.emit('sso_conflict');
      // 不强制断开连接，让用户选择
    }
  }

interface ISecureStoreService {
  set(key: string, value: string): void;
  get(key: string): string | null;
  remove(key: string): void;
  clear(): void;
}

import { safeStorage } from 'electron';
import Store from 'electron-store';
import crypto from 'crypto';

@Injectable()
export class SecureStoreService implements ISecureStoreService {
  private store: Store;
  
  constructor() {
    this.store = new Store({
      name: 'secure-store'
    });
  }
  
  set(key: string, value: string): void {
    let encrypted: Buffer;

    if (safeStorage.isEncryptionAvailable()) {
      // 使用 safeStorage 加密
      encrypted = safeStorage.encryptString(value);
    } else {
      // 降级方案：使用 crypto 加密
      encrypted = this.fallbackEncrypt(value);
    }
    
    // 存储 base64 编码后的加密数据
    this.store.set(key, encrypted.toString('base64'));
  }
  
  get(key: string): string | null {
    const base64 = this.store.get(key);
    if (!base64) return null;

    const encrypted = Buffer.from(base64, 'base64');

    if (safeStorage.isEncryptionAvailable()) {
      return safeStorage.decryptString(encrypted);
    } else {
      return this.fallbackDecrypt(encrypted);
    }
  }
  
  private fallbackEncrypt(text: string): Buffer {
    const algorithm = 'aes-256-gcm';
    const key = crypto.scryptSync('fallback-secret', 'salt', 32);
    const iv = crypto.randomBytes(16);

    const cipher = crypto.createCipheriv(algorithm, key, iv);
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');

    const authTag = cipher.getAuthTag();

    return Buffer.concat([iv, authTag, Buffer.from(encrypted, 'hex')]);
  }
  
  private fallbackDecrypt(encrypted: Buffer): string {
    const algorithm = 'aes-256-gcm';
    const key = crypto.scryptSync('fallback-secret', 'salt', 32);

    const iv = encrypted.slice(0, 16);
    const authTag = encrypted.slice(16, 32);
    const encryptedText = encrypted.slice(32);

    const decipher = crypto.createDecipheriv(algorithm, key, iv);
    decipher.setAuthTag(authTag);

    let decrypted = decipher.update(encryptedText);
    decrypted = Buffer.concat([decrypted, decipher.final()]);

    return decrypted.toString('utf8');
  }
}

// 使用 safeStorage 加密存储并结合 SecureStoreService
import { safeStorage } from 'electron';
import { SecureStoreService } from './secure-store.service';

const secureStore = new SecureStoreService();

if (safeStorage.isEncryptionAvailable()) {
  // Windows: 使用 DPAPI
  // macOS: 使用 Keychain
  // Linux: 使用 libsecret
  const encrypted = safeStorage.encryptString(token);

  // 存储加密后的数据到安全存储服务
  secureStore.set('token', encrypted.toString('base64'));
}

// 使用 WSS 协议（WebSocket Secure）
const ws = new WebSocket('wss://api.example.com/ws');

// 在消息体中传输 token，而不是 URL 参数
const authMessage = {
  action: 'auth',
  token: token,
  timestamp: Date.now()  // 在消息体中，不会记录在日志中
};

// 为每条消息添加 HMAC-SHA256 签名
import { createHmac } from 'crypto';

function signMessage(message: any, token: string): string {
  const content = JSON.stringify(message);
  return createHmac('sha256', token)
    .update(content)
    .digest('hex');
}

const authMessage = {
  action: 'auth',
  token: token,
  deviceId: deviceId,
  timestamp: Date.now(),
  nonce: uuidv4(),
  signature: signMessage({ token, deviceId, timestamp, nonce }, token)
};

// 服务器端维护已使用的 Nonce 集合
const usedNonces = new Map<string, number>();

function validateNonce(nonce: string, timestamp: number): boolean {
  // 1. 检查时间戳（5 分钟窗口）
  if (Math.abs(Date.now() - timestamp) > 300000) {
    return false;
  }

  // 2. 检查 Nonce 是否已使用
  if (usedNonces.has(nonce)) {
    return false;
  }

  // 3. 记录 Nonce 并设置过期时间
  usedNonces.set(nonce, timestamp);

  // 4. 定期清理过期的 Nonce（5 分钟后）
  setTimeout(() => {
    usedNonces.delete(nonce);
  }, 300000);

  return true;
}

// AccessToken: 2 小时过期
// RefreshToken: 30 天过期

// 在 token 过期前 5 分钟自动刷新
const GRACE_PERIOD = 5 * 60 * 1000; // 5 分钟

if (Date.now() >= tokenExpiry - GRACE_PERIOD) {
  await tokenManager.refreshAccessToken();
}

// 服务器端实现
const refreshTokens = new Map();

// 限制 RefreshToken 使用次数
const MAX_REFRESH_COUNT = 100;

async function refreshToken(refreshToken: string): Promise<string> {
  const tokenData = refreshTokens.get(refreshToken);

  if (!tokenData) {
    throw new Error('Invalid refresh token');
  }

  if (tokenData.useCount >= MAX_REFRESH_COUNT) {
    // 超过使用次数，使 token 失效
    refreshTokens.delete(refreshToken);
    throw new Error('Refresh token expired');
  }

  // 增加使用次数
  tokenData.useCount++;

  // 生成新的 accessToken
  const accessToken = generateAccessToken(tokenData.userId);

  return accessToken;
}

async function handleRefreshFailure(): Promise<void> {
  // 1. 清除本地 token
  await tokenManager.clearTokens();
  
  // 2. 断开 WebSocket 连接
  await webSocketService.disconnect();
  
  // 3. 通知用户需要重新登录
  emitEvent('relogin_required', {
    reason: 'token_expired',
    message: '会话已过期，请重新登录'
  });
}

async function connectWithRetry(userId: string, maxRetries: number = 3): Promise<void> {
  for (let i = 0; i < maxRetries; i++) {
    try {
      await webSocketService.connect(userId);
      return; // 连接成功，退出
    } catch (error) {
      console.error(`连接失败 (尝试 ${i + 1}/${maxRetries}):`, error);
      
      if (i < maxRetries - 1) {
        // 等待一段时间后重试
        await sleep(1000 * (i + 1)); // 1s, 2s, 3s
      }
    }
  }
  
  // 所有重试都失败
  throw new Error('连接失败，请检查网络');
}

async function authenticateWithTimeout(timeout: number = 5000): Promise<boolean> {
  return Promise.race([
    webSocketService.authenticate(),
    new Promise<boolean>((_, reject) => {
      setTimeout(() => {
        reject(new Error('鉴权超时'));
      }, timeout);
    })
  ]);
}

// 监控指标
interface AuthMetrics {
  // 鉴权成功次数
  authSuccessCount: number;
  
  // 鉴权失败次数
  authFailureCount: number;
  
  // Token 刷新次数
  tokenRefreshCount: number;
  
  // Token 刷新失败次数
  tokenRefreshFailureCount: number;
  
  // 单点登录次数
  ssoConflictCount: number;
  
  // 平均鉴权时间
  avgAuthTime: number;
}

// 告警规则
const alertRules = {
  // 鉴权失败率 > 5%
  highAuthFailureRate: (metrics: AuthMetrics) => {
    const total = metrics.authSuccessCount + metrics.authFailureCount;
    return (metrics.authFailureCount / total) > 0.05;
  },
  
  // Token 刷新失败率 > 10%
  highRefreshFailureRate: (metrics: AuthMetrics) => {
    const total = metrics.tokenRefreshCount + metrics.tokenRefreshFailureCount;
    return (metrics.tokenRefreshFailureCount / total) > 0.1;
  },
  
  // 单点登录次数 > 10
  highSSOConflictCount: (metrics: AuthMetrics) => {
    return metrics.ssoConflictCount > 10;
  }
};