初始化项目：基础设施 + 用户认证 + 后台管理系统 + AGPL 3.0 许可
This commit is contained in:
229
internal/controller/auth_controller.go
Normal file
229
internal/controller/auth_controller.go
Normal file
@ -0,0 +1,229 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/config"
|
||||
"metazone.cc/metalab/internal/middleware"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
"metazone.cc/metalab/internal/service"
|
||||
"metazone.cc/metalab/internal/theme"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// AuthController 认证相关页面 + API
|
||||
type AuthController struct {
|
||||
authService *service.AuthService
|
||||
tokenService *service.TokenService
|
||||
rateLimiter *middleware.RateLimiter
|
||||
cfg *config.Config
|
||||
}
|
||||
|
||||
// NewAuthController 构造函数
|
||||
func NewAuthController(authService *service.AuthService, tokenSvc *service.TokenService, limiter *middleware.RateLimiter, cfg *config.Config) *AuthController {
|
||||
return &AuthController{authService: authService, tokenService: tokenSvc, rateLimiter: limiter, cfg: cfg}
|
||||
}
|
||||
|
||||
// RegisterPage 注册页面（已登录用户重定向到首页）
|
||||
func (ac *AuthController) RegisterPage(c *gin.Context) {
|
||||
if _, exists := c.Get("uid"); exists {
|
||||
c.Redirect(http.StatusMovedPermanently, "/")
|
||||
return
|
||||
}
|
||||
guidelines, err := theme.LoadContent("templates/MetaLab-2026/guidelines.html")
|
||||
if err != nil {
|
||||
c.String(http.StatusInternalServerError, "加载准则失败")
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusOK, "auth/register.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "注册",
|
||||
"ExtraCSS": "/static/css/auth.css",
|
||||
"Guidelines": guidelines,
|
||||
}))
|
||||
}
|
||||
|
||||
// LoginPage 登录页面（已登录用户重定向到首页）
|
||||
func (ac *AuthController) LoginPage(c *gin.Context) {
|
||||
if _, exists := c.Get("uid"); exists {
|
||||
c.Redirect(http.StatusMovedPermanently, "/")
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusOK, "auth/login.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "登录",
|
||||
"ExtraCSS": "/static/css/auth.css",
|
||||
}))
|
||||
}
|
||||
|
||||
// clientIP 获取客户端真实 IP（考虑反向代理）
|
||||
func clientIP(c *gin.Context) string {
|
||||
if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
|
||||
return fwd
|
||||
}
|
||||
if real := c.GetHeader("X-Real-IP"); real != "" {
|
||||
return real
|
||||
}
|
||||
return c.ClientIP()
|
||||
}
|
||||
|
||||
// Login 登录 API（含双维度限流）
|
||||
func (ac *AuthController) Login(c *gin.Context) {
|
||||
var req model.LoginRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入")
|
||||
return
|
||||
}
|
||||
|
||||
email := req.Email
|
||||
ip := clientIP(c)
|
||||
|
||||
// --- 限流：账户维度 ---
|
||||
acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
|
||||
if acctResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, acctResult.Message)
|
||||
return
|
||||
}
|
||||
|
||||
// --- 限流：IP 维度 ---
|
||||
ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
|
||||
if ipResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, ipResult.Message)
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Login(req)
|
||||
if err != nil {
|
||||
// 记录失败 → 两个维度各 +1
|
||||
if recordAccount != nil {
|
||||
recordAccount()
|
||||
}
|
||||
if recordIP != nil {
|
||||
recordIP()
|
||||
}
|
||||
|
||||
switch err {
|
||||
case service.ErrInvalidCred:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
case service.ErrUserBanned:
|
||||
common.Error(c, http.StatusForbidden, "账号已被封禁")
|
||||
case service.ErrUserLocked:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
case service.ErrUserDeleted:
|
||||
// deleted 状态本应在 Login 中自动恢复，此 case 作为兜底
|
||||
common.Error(c, http.StatusForbidden, "该账号已申请注销，登录即自动恢复")
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// 登录成功 → 清除失败计数
|
||||
ac.rateLimiter.Clear(email, ip)
|
||||
|
||||
common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "登录成功",
|
||||
"data": user,
|
||||
})
|
||||
}
|
||||
|
||||
// CheckEmail 检查邮箱是否已注册
|
||||
func (ac *AuthController) CheckEmail(c *gin.Context) {
|
||||
var req model.CheckEmailRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请提供有效的邮箱地址")
|
||||
return
|
||||
}
|
||||
|
||||
exists, err := ac.authService.CheckEmail(req.Email)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "检查失败")
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"data": gin.H{"exists": exists},
|
||||
})
|
||||
}
|
||||
|
||||
// Register 注册 API
|
||||
func (ac *AuthController) Register(c *gin.Context) {
|
||||
var req model.RegisterRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入："+err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
// 注册 IP 限流：1 分钟 5 次
|
||||
regResult, recordReg := ac.rateLimiter.AllowIP(clientIP(c) + ":register")
|
||||
if regResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, "注册请求过于频繁，请稍后重试")
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Register(req)
|
||||
if err != nil {
|
||||
if recordReg != nil {
|
||||
recordReg()
|
||||
}
|
||||
switch err {
|
||||
case service.ErrEmailExists:
|
||||
common.Error(c, http.StatusConflict, "该邮箱已注册")
|
||||
case service.ErrWeakPassword:
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "注册失败，请稍后重试")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "注册成功！欢迎加入 MetaLab",
|
||||
"data": user,
|
||||
})
|
||||
}
|
||||
|
||||
// Logout 退出登录：清除所有认证 Cookie
|
||||
func (ac *AuthController) Logout(c *gin.Context) {
|
||||
common.ClearAuthCookies(c, ac.cfg)
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "已退出登录",
|
||||
})
|
||||
}
|
||||
|
||||
// RefreshToken 用 refresh token 换取新的 access token
|
||||
func (ac *AuthController) RefreshToken(c *gin.Context) {
|
||||
refreshToken, err := c.Cookie(common.RefreshCookieName)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusUnauthorized, "请重新登录")
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
|
||||
if err != nil {
|
||||
common.ClearAuthCookies(c, ac.cfg)
|
||||
switch err {
|
||||
case service.ErrTokenExpired, service.ErrTokenRevoked:
|
||||
common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
|
||||
case service.ErrUserBanned:
|
||||
common.Error(c, http.StatusForbidden, "账号已被封禁")
|
||||
default:
|
||||
common.Error(c, http.StatusUnauthorized, "请重新登录")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
common.SetAccessCookie(c, accessToken, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user