强化 UID 获取

@@ -23,6 +23,8 @@ const uuid = require('uuid');
 const _ = require('lodash');
 const pkg = require('./package.json');
 
+const cookie = require('./library/cookie');
+
 const app = express();
 const MemcachedStore = memcached(session);
 
@@ -71,6 +73,11 @@ app.use((req, res, next) => {
     if (req.session && _.isNumber(req.session._LOGIN_UID)) {
         req.user.uid = req.session._LOGIN_UID;
     }
+
+    // session 没有读取到的时候，从 cookie 读取 UID
+    if (!req.user.uid && req.cookies._UID) {
+        req.user.uid = cookie.getUid(req);
+    }
     next();
 });
 

@@ -4,6 +4,7 @@
  * @return {[string]}
  */
 'use strict';
+const sign = require('./sign');
 
 exports.getUid = (req) => {
     const cookie = req.cookies._UID;
@@ -21,6 +22,11 @@ exports.getUid = (req) => {
         }
     }
 
+    // 校验 cookie 的 uid 有没有被修改
+    if (req.cookies._TOKEN !== sign.makeToken(_uid)) {
+        _uid = 0;
+    }
+
     return _uid;
 };