OWASP Juice Shop - JWT与会话安全：算法配置、密钥管理与刷新策略

// Juice Shop JWT验证的漏洞实现
app.use('/rest', (req, res, next) => {
  const token = req.headers.authorization?.replace('Bearer ', '');
  
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  try {
    // 危险：使用动态算法，允许none算法
    const decoded = jwt.decode(token, { complete: true });
    const algorithm = decoded.header.alg;
    
    // 漏洞：接受none算法，导致无签名验证
    if (algorithm === 'none') {
      req.user = jwt.decode(token);
      return next();
    }
    
    // 危险：使用硬编码密钥
    const secret = 'your-256-bit-secret';
    req.user = jwt.verify(token, secret, { algorithm: ['HS256', 'none'] });
    
    next();
  } catch (error) {
    return res.status(401).json({ error: 'Invalid token' });
  }
});

// 用户登录端点 - 生成JWT
app.post('/rest/user/login', (req, res) => {
  const { email, password } = req.body;
  
  // 用户验证逻辑...
  const user = { id: 1, email: email, role: 'customer' };
  
  // 危险：使用弱算法和固定密钥
  const token = jwt.sign(
    { 
      id: user.id, 
      email: user.email, 
      role: user.role 
    },
    'your-256-bit-secret',
    { 
      algorithm: 'HS256',
      expiresIn: '24h' // 过长的有效期
    }
  );
  
  res.json({ token, user });
});

// JWT Header结构（存在安全问题）
const vulnerableHeader = {
  "alg": "HS256", // 可被降级为none
  "typ": "JWT",
  "kid": "1"      // 密钥ID，但缺乏验证机制
};

// JWT Payload结构（信息泄露风险）
const vulnerablePayload = {
  "id": 1,
  "email": "[email protected]",
  "role": "customer",
  "iat": 1634567890,
  "exp": 1634654290, // 24小时有效期
  "permissions": ["read:profile", "write:orders"],
  "sessionId": "sess_123456" // 会话信息暴露
};

// 用户数据模型 - 密钥管理问题
const UserModel = {
  id: 'INTEGER PRIMARY KEY',
  email: 'VARCHAR(255) UNIQUE',
  password: 'VARCHAR(255)', // 存储哈希，但JWT密钥硬编码
  role: 'ENUM("customer", "admin", "support")',
  tokenVersion: 'INTEGER DEFAULT 0', // 版本控制，但未在JWT中使用
  lastLogin: 'DATETIME',
  isActive: 'BOOLEAN DEFAULT 1'
};

const jwt = require('jsonwebtoken');
const crypto = require('crypto');
const redis = require('redis');
const NodeRSA = require('node-rsa');

/**
 * 企业级JWT安全管理服务
 * 实现强算法验证、密钥轮换、令牌撤销等功能
 */
class EnterpriseJWTSecurity {
  constructor(config = {}) {
    this.config = {
      // 算法配置
      allowedAlgorithms: ['RS256', 'ES256'], // 只允许非对称算法
      defaultAlgorithm: 'RS256',
      
      // 密钥配置
      keyRotationInterval: config.keyRotationInterval || 30 * 24 * 60 * 60 * 1000, // 30天
      currentKeyId: 'current',
      keyStore: new Map(), // 内存密钥存储
      
      // 令牌配置
      accessTokenExpiry: config.accessTokenExpiry || '15m',
      refreshTokenExpiry: config.refreshTokenExpiry || '7d',
      issuer: config.issuer || 'secure-app',
      
      // Redis配置
      redisUrl: config.redisUrl || 'redis://localhost:6379',
      
      // 风险控制
      maxFailedAttempts: config.maxFailedAttempts || 5,
      suspiciousIpThreshold: config.suspiciousIpThreshold || 10,
      
      ...config
    };
    
    // 初始化Redis客户端
    this.redis = redis.createClient({ url: this.config.redisUrl });
    this.redis.connect();
    
    // 初始化密钥对
    this.initializeKeyPairs();
    
    // 启动密钥轮换定时器
    this.startKeyRotation();
  }
  
  /**
   * 初始化RSA密钥对
   */
  async initializeKeyPairs() {
    // 生成当前密钥对
    const currentKey = new NodeRSA({ b: 2048 });
    const currentKeyId = this.generateKeyId();
    
    this.config.keyStore.set(currentKeyId, {
      privateKey: currentKey.exportKey('pkcs8-private-pem'),
      publicKey: currentKey.exportKey('pkcs8-public-pem'),
      createdAt: Date.now(),
      isCurrent: true
    });
    
    this.config.currentKeyId = currentKeyId;
    
    console.log(`[+] Initialized new RSA key pair: ${currentKeyId}`);
    
    // 生成备用密钥对
    await this.generateBackupKey();
  }
  
  /**
   * 生成备用密钥对
   */
  async generateBackupKey() {
    const backupKey = new NodeRSA({ b: 2048 });
    const backupKeyId = this.generateKeyId();
    
    this.config.keyStore.set(backupKeyId, {
      privateKey: backupKey.exportKey('pkcs8-private-pem'),
      publicKey: backupKey.exportKey('pkcs8-public-pem'),
      createdAt: Date.now(),
      isCurrent: false
    });
    
    console.log(`[+] Generated backup key pair: ${backupKeyId}`);
  }
  
  /**
   * 生成密钥ID
   */
  generateKeyId() {
    return `key_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`;
  }
  
  /**
   * 启动密钥轮换
   */
  startKeyRotation() {
    setInterval(async () => {
      await this.rotateKeys();
    }, this.config.keyRotationInterval);
  }
  
  /**
   * 密钥轮换
   */
  async rotateKeys() {
    console.log('[+] Starting key rotation...');
    
    // 标记当前密钥为旧密钥
    const currentKeyId = this.config.currentKeyId;
    const currentKey = this.config.keyStore.get(currentKeyId);
    if (currentKey) {
      currentKey.isCurrent = false;
    }
    
    // 生成新的当前密钥
    const newKey = new NodeRSA({ b: 2048 });
    const newKeyId = this.generateKeyId();
    
    this.config.keyStore.set(newKeyId, {
      privateKey: newKey.exportKey('pkcs8-private-pem'),
      publicKey: newKey.exportKey('pkcs8-public-pem'),
      createdAt: Date.now(),
      isCurrent: true
    });
    
    this.config.currentKeyId = newKeyId;
    
    // 清理过期密钥
    this.cleanupExpiredKeys();
    
    console.log(`[+] Key rotation completed. New key: ${newKeyId}`);
  }
  
  /**
   * 清理过期密钥
   */
  cleanupExpiredKeys() {
    const now = Date.now();
    const maxAge = this.config.keyRotationInterval * 2; // 保留2个轮换周期
    
    for (const [keyId, keyData] of this.config.keyStore.entries()) {
      if (now - keyData.createdAt > maxAge && !keyData.isCurrent) {
        this.config.keyStore.delete(keyId);
        console.log(`[+] Cleaned up expired key: ${keyId}`);
      }
    }
  }
  
  /**
   * 生成访问令牌
   * @param {Object} user - 用户信息
   * @param {Object} additionalClaims - 额外声明
   * @returns {Object} 令牌信息
   */
  async generateAccessToken(user, additionalClaims = {}) {
    const keyId = this.config.currentKeyId;
    const keyData = this.config.keyStore.get(keyId);
    
    if (!keyData) {
      throw new Error('No encryption key available');
    }
    
    const payload = {
      sub: user.id,
      email: user.email,
      role: user.role,
      permissions: user.permissions || [],
      tokenVersion: user.tokenVersion || 0,
      sessionId: this.generateSessionId(),
      ...additionalClaims,
      iat: Math.floor(Date.now() / 1000),
      exp: Math.floor(Date.now() / 1000) + this.parseExpiry(this.config.accessTokenExpiry),
      iss: this.config.issuer,
      aud: 'api-users',
      jti: this.generateTokenId()
    };
    
    const header = {
      alg: this.config.defaultAlgorithm,
      typ: 'JWT',
      kid: keyId
    };
    
    const token = jwt.sign(payload, keyData.privateKey, {
      algorithm: this.config.defaultAlgorithm,
      header: header
    });
    
    // 记录令牌元数据
    await this.recordTokenMetadata(payload.jti, user.id, 'access');
    
    return {
      token,
      expiresIn: this.parseExpiry(this.config.accessTokenExpiry),
      tokenType: 'Bearer',
      keyId
    };
  }
  
  /**
   * 生成刷新令牌
   * @param {Object} user - 用户信息
   * @param {Object} deviceInfo - 设备信息
   * @returns {Object} 刷新令牌信息
   */
  async generateRefreshToken(user, deviceInfo = {}) {
    const keyId = this.config.currentKeyId;
    const keyData = this.config.keyStore.get(keyId);
    
    const payload = {
      sub: user.id,
      tokenType: 'refresh',
      tokenVersion: user.tokenVersion || 0,
      deviceId: deviceInfo.deviceId || this.generateDeviceId(),
      deviceFingerprint: deviceInfo.fingerprint || this.generateDeviceFingerprint(),
      iat: Math.floor(Date.now() / 1000),
      exp: Math.floor(Date.now() / 1000) + this.parseExpiry(this.config.refreshTokenExpiry),
      iss: this.config.issuer,
      aud: 'api-refresh',
      jti: this.generateTokenId()
    };
    
    const header = {
      alg: this.config.defaultAlgorithm,
      typ: 'JWT',
      kid: keyId
    };
    
    const token = jwt.sign(payload, keyData.privateKey, {
      algorithm: this.config.defaultAlgorithm,
      header: header
    });
    
    // 存储刷新令牌映射
    await this.storeRefreshTokenMapping(payload.jti, user.id, payload.deviceId);
    
    return {
      token,
      expiresIn: this.parseExpiry(this.config.refreshTokenExpiry),
      deviceId: payload.deviceId
    };
  }
  
  /**
   * 验证JWT令牌
   * @param {string} token - JWT令牌
   * @param {Object} options - 验证选项
   * @returns {Object} 验证结果
   */
  async verifyToken(token, options = {}) {
    try {
      // 步骤1：解码令牌头部
      const decodedHeader = this.decodeTokenHeader(token);
      
      // 步骤2：验证算法
      const algorithmValidation = this.validateAlgorithm(decodedHeader.alg);
      if (!algorithmValidation.valid) {
        return {
          valid: false,
          error: algorithmValidation.error,
          code: 'INVALID_ALGORITHM'
        };
      }
      
      // 步骤3：获取验证密钥
      const keyData = await this.getVerificationKey(decodedHeader.kid);
      if (!keyData) {
        return {
          valid: false,
          error: 'Invalid key ID',
          code: 'INVALID_KEY_ID'
        };
      }
      
      // 步骤4：验证签名
      const decoded = jwt.verify(token, keyData.publicKey, {
        algorithms: [this.config.defaultAlgorithm],
        issuer: this.config.issuer,
        audience: options.audience || 'api-users'
      });
      
      // 步骤5：检查令牌撤销状态
      const revocationCheck = await this.checkTokenRevocation(decoded.jti);
      if (revocationCheck.revoked) {
        return {
          valid: false,
          error: 'Token has been revoked',
          code: 'TOKEN_REVOKED'
        };
      }
      
      // 步骤6：用户状态验证
      const userValidation = await this.validateUserStatus(decoded.sub, decoded.tokenVersion);
      if (!userValidation.valid) {
        return {
          valid: false,
          error: userValidation.error,
          code: 'USER_INVALID'
        };
      }
      
      // 步骤7：风险检查
      const riskCheck = await this.performRiskCheck(decoded, options);
      if (riskCheck.suspicious) {
        await this.handleSuspiciousToken(decoded, riskCheck);
        
        return {
          valid: false,
          error: 'Suspicious activity detected',
          code: 'SUSPICIOUS_ACTIVITY'
        };
      }
      
      return {
        valid: true,
        payload: decoded,
        keyId: decodedHeader.kid
      };
      
    } catch (error) {
      if (error.name === 'TokenExpiredError') {
        return {
          valid: false,
          error: 'Token expired',
          code: 'TOKEN_EXPIRED'
        };
      } else if (error.name === 'JsonWebTokenError') {
        return {
          valid: false,
          error: 'Invalid token signature',
          code: 'INVALID_SIGNATURE'
        };
      } else {
        return {
          valid: false,
          error: 'Token verification failed',
          code: 'VERIFICATION_ERROR'
        };
      }
    }
  }
  
  /**
   * 解码令牌头部
   * @param {string} token - JWT令牌
   * @returns {Object} 头部信息
   */
  decodeTokenHeader(token) {
    const parts = token.split('.');
    if (parts.length !== 3) {
      throw new Error('Invalid token format');
    }
    
    const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString());
    return header;
  }
  
  /**
   * 验证算法
   * @param {string} algorithm - 算法名称
   * @returns {Object} 验证结果
   */
  validateAlgorithm(algorithm) {
    if (!algorithm) {
      return {
        valid: false,
        error: 'Algorithm not specified'
      };
    }
    
    if (algorithm === 'none') {
      return {
        valid: false,
        error: 'None algorithm not allowed'
      };
    }
    
    if (!this.config.allowedAlgorithms.includes(algorithm)) {
      return {
        valid: false,
        error: `Algorithm ${algorithm} not in allowed list`
      };
    }
    
    return { valid: true };
  }
  
  /**
   * 获取验证密钥
   * @param {string} keyId - 密钥ID
   * @returns {Object} 密钥数据
   */
  async getVerificationKey(keyId) {
    if (!keyId) {
      // 如果没有kid，使用当前密钥
      return this.config.keyStore.get(this.config.currentKeyId);
    }
    
    return this.config.keyStore.get(keyId);
  }
  
  /**
   * 检查令牌撤销状态
   * @param {string} tokenId - 令牌ID
   * @returns {Object} 撤销状态
   */
  async checkTokenRevocation(tokenId) {
    try {
      const revoked = await this.redis.get(`revoked_token:${tokenId}`);
      return {
        revoked: !!revoked,
        revokedAt: revoked ? new Date(revoked) : null
      };
    } catch (error) {
      console.error('Token revocation check failed:', error);
      return { revoked: false };
    }
  }
  
  /**
   * 验证用户状态
   * @param {string} userId - 用户ID
   * @param {number} tokenVersion - 令牌版本
   * @returns {Object} 验证结果
   */
  async validateUserStatus(userId, tokenVersion) {
    try {
      // 这里应该查询数据库获取用户信息
      const user = await this.getUserFromDatabase(userId);
      
      if (!user) {
        return {
          valid: false,
          error: 'User not found'
        };
      }
      
      if (!user.isActive) {
        return {
          valid: false,
          error: 'User account is inactive'
        };
      }
      
      if (user.tokenVersion !== tokenVersion) {
        return {
          valid: false,
          error: 'Token version mismatch'
        };
      }
      
      return { valid: true, user };
      
    } catch (error) {
      console.error('User status validation failed:', error);
      return {
        valid: false,
        error: 'User validation failed'
      };
    }
  }
  
  /**
   * 执行风险检查
   * @param {Object} payload - 令牌载荷
   * @param {Object} options - 验证选项
   * @returns {Object} 风险评估结果
   */
  async performRiskCheck(payload, options) {
    const riskFactors = [];
    
    // 检查令牌年龄
    const tokenAge = Date.now() - (payload.iat * 1000);
    if (tokenAge > 24 * 60 * 60 * 1000) { // 24小时
      riskFactors.push('old_token');
    }
    
    // 检查IP地址异常
    if (options.clientIp) {
      const ipRisk = await this.checkIpRisk(payload.sub, options.clientIp);
      if (ipRisk.suspicious) {
        riskFactors.push('suspicious_ip');
      }
    }
    
    // 检查设备指纹
    if (options.deviceFingerprint && payload.deviceFingerprint) {
      if (payload.deviceFingerprint !== options.deviceFingerprint) {
        riskFactors.push('device_mismatch');
      }
    }
    
    // 检查地理位置异常
    if (options.location) {
      const locationRisk = await this.checkLocationRisk(payload.sub, options.location);
      if (locationRisk.suspicious) {
        riskFactors.push('location_anomaly');
      }
    }
    
    const suspicious = riskFactors.length > 0;
    const riskScore = this.calculateRiskScore(riskFactors);
    
    return {
      suspicious,
      riskFactors,
      riskScore
    };
  }
  
  /**
   * 撤销令牌
   * @param {string} tokenId - 令牌ID
   * @param {string} reason - 撤销原因
   */
  async revokeToken(tokenId, reason = 'user_logout') {
    try {
      await this.redis.setex(
        `revoked_token:${tokenId}`,
        7 * 24 * 60 * 60, // 7天过期
        JSON.stringify({
          revokedAt: new Date().toISOString(),
          reason: reason
        })
      );
      
      console.log(`[+] Token revoked: ${tokenId}, reason: ${reason}`);
      
    } catch (error) {
      console.error('Token revocation failed:', error);
      throw error;
    }
  }
  
  /**
   * 撤销用户所有令牌
   * @param {string} userId - 用户ID
   * @param {string} reason - 撤销原因
   */
  async revokeAllUserTokens(userId, reason = 'security_event') {
    try {
      // 增加用户令牌版本，使所有现有令牌失效
      await this.incrementUserTokenVersion(userId);
      
      // 记录撤销事件
      await this.recordRevocationEvent(userId, reason);
      
      console.log(`[+] All tokens revoked for user: ${userId}, reason: ${reason}`);
      
    } catch (error) {
      console.error('User token revocation failed:', error);
      throw error;
    }
  }
  
  /**
   * 刷新访问令牌
   * @param {string} refreshToken - 刷新令牌
   * @param {Object} options - 刷新选项
   * @returns {Object} 新的访问令牌
   */
  async refreshAccessToken(refreshToken, options = {}) {
    try {
      // 验证刷新令牌
      const verification = await this.verifyToken(refreshToken, {
        audience: 'api-refresh'
      });
      
      if (!verification.valid) {
        throw new Error('Invalid refresh token');
      }
      
      const payload = verification.payload;
      
      // 验证令牌类型
      if (payload.tokenType !== 'refresh') {
        throw new Error('Invalid token type for refresh');
      }
      
      // 获取用户信息
      const user = await this.getUserFromDatabase(payload.sub);
      if (!user) {
        throw new Error('User not found');
      }
      
      // 检查设备信息
      if (options.deviceId && payload.deviceId !== options.deviceId) {
        throw new Error('Device mismatch');
      }
      
      // 撤销旧的刷新令牌
      await this.revokeToken(payload.jti, 'token_refresh');
      
      // 生成新的访问令牌
      const newAccessToken = await this.generateAccessToken(user, {
        sessionId: payload.sessionId
      });
      
      // 可选：生成新的刷新令牌
      let newRefreshToken = null;
      if (options.rotateRefreshToken) {
        newRefreshToken = await this.generateRefreshToken(user, {
          deviceId: payload.deviceId,
          fingerprint: payload.deviceFingerprint
        });
      }
      
      return {
        accessToken: newAccessToken,
        refreshToken: newRefreshToken
      };
      
    } catch (error) {
      console.error('Token refresh failed:', error);
      throw error;
    }
  }
  
  /**
   * 生成令牌ID
   */
  generateTokenId() {
    return crypto.randomBytes(16).toString('hex');
  }
  
  /**
   * 生成会话ID
   */
  generateSessionId() {
    return `sess_${Date.now()}_${crypto.randomBytes(8).toString('hex')}`;
  }
  
  /**
   * 生成设备ID
   */
  generateDeviceId() {
    return `dev_${crypto.randomBytes(12).toString('hex')}`;
  }
  
  /**
   * 生成设备指纹
   */
  generateDeviceFingerprint() {
    return crypto.randomBytes(32).toString('hex');
  }
  
  /**
   * 解析过期时间
   * @param {string} expiry - 过期时间字符串
   * @returns {number} 秒数
   */
  parseExpiry(expiry) {
    const unit = expiry.slice(-1);
    const value = parseInt(expiry.slice(0, -1));
    
    switch (unit) {
      case 's': return value;
      case 'm': return value * 60;
      case 'h': return value * 3600;
      case 'd': return value * 86400;
      default: return 3600; // 默认1小时
    }
  }
  
  /**
   * 记录令牌元数据
   * @param {string} tokenId - 令牌ID
   * @param {string} userId - 用户ID
   * @param {string} tokenType - 令牌类型
   */
  async recordTokenMetadata(tokenId, userId, tokenType) {
    try {
      await this.redis.setex(
        `token_meta:${tokenId}`,
        7 * 24 * 60 * 60, // 7天
        JSON.stringify({
          userId,
          tokenType,
          createdAt: new Date().toISOString()
        })
      );
    } catch (error) {
      console.error('Token metadata recording failed:', error);
    }
  }
  
  /**
   * 存储刷新令牌映射
   * @param {string} tokenId - 令牌ID
   * @param {string} userId - 用户ID
   * @param {string} deviceId - 设备ID
   */
  async storeRefreshTokenMapping(tokenId, userId, deviceId) {
    try {
      await this.redis.setex(
        `refresh_mapping:${userId}:${deviceId}`,
        7 * 24 * 60 * 60,
        tokenId
      );
    } catch (error) {
      console.error('Refresh token mapping failed:', error);
    }
  }
  
  /**
   * 获取数据库用户信息
   * @param {string} userId - 用户ID
   * @returns {Object} 用户信息
   */
  async getUserFromDatabase(userId) {
    // 这里应该连接实际的数据库
    // 为了示例，返回模拟数据
    return {
      id: userId,
      email: '[email protected]',
      role: 'customer',
      permissions: ['read:profile', 'write:orders'],
      tokenVersion: 0,
      isActive: true
    };
  }
  
  /**
   * 计算风险分数
   * @param {Array} riskFactors - 风险因素
   * @returns {number} 风险分数
   */
  calculateRiskScore(riskFactors) {
    const riskScores = {
      'old_token': 20,
      'suspicious_ip': 40,
      'device_mismatch': 30,
      'location_anomaly': 35
    };
    
    return riskFactors.reduce((total, factor) => {
      return total + (riskScores[factor] || 0);
    }, 0);
  }
  
  /**
   * 检查IP风险
   * @param {string} userId - 用户ID
   * @param {string} clientIp - 客户端IP
   * @returns {Object} 风险评估
   */
  async checkIpRisk(userId, clientIp) {
    try {
      const key = `user_ips:${userId}`;
      const userIps = await this.redis.smembers(key);
      
      if (userIps.length === 0) {
        // 首次使用此IP，添加到已知IP列表
        await this.redis.sadd(key, clientIp);
        await this.redis.expire(key, 30 * 24 * 60 * 60); // 30天
        return { suspicious: false };
      }
      
      if (!userIps.includes(clientIp)) {
        // 新IP，检查是否在可疑IP列表中
        const isSuspicious = await this.redis.sismember('suspicious_ips', clientIp);
        
        if (isSuspicious) {
          return { suspicious: true, reason: 'ip_in_blacklist' };
        }
        
        // 记录新IP使用
        await this.redis.sadd(key, clientIp);
      }
      
      return { suspicious: false };
      
    } catch (error) {
      console.error('IP risk check failed:', error);
      return { suspicious: false };
    }
  }
  
  /**
   * 检查地理位置风险
   * @param {string} userId - 用户ID
   * @param {Object} location - 位置信息
   * @returns {Object} 风险评估
   */
  async checkLocationRisk(userId, location) {
    try {
      const key = `user_locations:${userId}`;
      const userLocations = await this.redis.smembers(key);
      
      if (userLocations.length === 0) {
        // 首次使用此位置
        await this.redis.sadd(key, JSON.stringify(location));
        await this.redis.expire(key, 30 * 24 * 60 * 60);
        return { suspicious: false };
      }
      
      // 检查位置变化是否合理
      const locationStr = JSON.stringify(location);
      if (!userLocations.includes(locationStr)) {
        // 检查是否为不可能的地理位置跳跃
        const lastLocation = await this.redis.get(`last_location:${userId}`);
        if (lastLocation) {
          const distance = this.calculateDistance(
            JSON.parse(lastLocation),
            location
          );
          
          if (distance > 1000) { // 1000km阈值
            return { suspicious: true, reason: 'impossible_travel' };
          }
        }
        
        await this.redis.sadd(key, locationStr);
        await this.redis.set(`last_location:${userId}`, locationStr);
      }
      
      return { suspicious: false };
      
    } catch (error) {
      console.error('Location risk check failed:', error);
      return { suspicious: false };
    }
  }
  
  /**
   * 计算两点间距离（公里）
   * @param {Object} loc1 - 位置1
   * @param {Object} loc2 - 位置2
   * @returns {number} 距离
   */
  calculateDistance(loc1, loc2) {
    const R = 6371; // 地球半径（公里）
    const dLat = this.toRad(loc2.lat - loc1.lat);
    const dLon = this.toRad(loc2.lon - loc1.lon);
    
    const a = Math.sin(dLat/2) * Math.sin(dLat/2) +
              Math.cos(this.toRad(loc1.lat)) * Math.cos(this.toRad(loc2.lat)) *
              Math.sin(dLon/2) * Math.sin(dLon/2);
    
    const c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a));
    return R * c;
  }
  
  /**
   * 角度转弧度
   * @param {number} degrees - 角度
   * @returns {number} 弧度
   */
  toRad(degrees) {
    return degrees * (Math.PI / 180);
  }
  
  /**
   * 处理可疑令牌
   * @param {Object} payload - 令牌载荷
   * @param {Object} riskCheck - 风险检查结果
   */
  async handleSuspiciousToken(payload, riskCheck) {
    // 记录可疑事件
    await this.recordSuspiciousEvent(payload.sub, riskCheck);
    
    // 如果风险分数高，撤销令牌
    if (riskCheck.riskScore > 50) {
      await this.revokeToken(payload.jti, 'high_risk_activity');
    }
  }
  
  /**
   * 记录可疑事件
   * @param {string} userId - 用户ID
   * @param {Object} riskCheck - 风险检查结果
   */
  async recordSuspiciousEvent(userId, riskCheck) {
    try {
      const event = {
        userId,
        riskFactors: riskCheck.riskFactors,
        riskScore: riskCheck.riskScore,
        timestamp: new Date().toISOString()
      };
      
      await this.redis.lpush(
        `suspicious_events:${userId}`,
        JSON.stringify(event)
      );
      
      await this.redis.ltrim(`suspicious_events:${userId}`, 0, 99); // 保留最近100条
      
    } catch (error) {
      console.error('Suspicious event recording failed:', error);
    }
  }
  
  /**
   * 增加用户令牌版本
   * @param {string} userId - 用户ID
   */
  async incrementUserTokenVersion(userId) {
    try {
      const key = `user_token_version:${userId}`;
      const currentVersion = await this.redis.get(key) || 0;
      await this.redis.set(key, parseInt(currentVersion) + 1);
    } catch (error) {
      console.error('Token version increment failed:', error);
    }
  }
  
  /**
   * 记录撤销事件
   * @param {string} userId - 用户ID
   * @param {string} reason - 撤销原因
   */
  async recordRevocationEvent(userId, reason) {
    try {
      const event = {
        userId,
        reason,
        timestamp: new Date().toISOString()
      };
      
      await this.redis.lpush(
        `revocation_events:${userId}`,
        JSON.stringify(event)
      );
      
    } catch (error) {
      console.error('Revocation event recording failed:', error);
    }
  }
}

module.exports = {
  EnterpriseJWTSecurity
};