water/server/app/miniapi/auth/SessionVerifier.php

<?php

declare(strict_types=1);

namespace app\miniapi\auth;

use app\miniapi\model\MiniSession;
use app\miniapi\model\MiniUser;
use app\miniapi\exception\ApiException;

final class SessionVerifier implements TokenVerifier
{
    public function verify(string $token): Principal
    {
        if (!preg_match('/^[a-f0-9]{64}$/D', $token)) {
            throw new ApiException(40101, '登录状态已失效', 401);
        }
        $session = MiniSession::query()->where('token_hash', hash('sha256', $token))->whereNull('revoked_at')
            ->where('expires_at', '>', date('Y-m-d H:i:s'))->first();
        $user = $session ? MiniUser::query()->where('id', $session->user_id)->where('status', 1)->first() : null;
        if (!$user || ($user->appid === TestPhoneIdentityProvider::APP_ID && !TestPhoneIdentityProvider::enabled())) {
            throw new ApiException(40101, '登录状态已失效', 401);
        }

        return new Principal((string) $session->user_id);
    }
}