Victor_Jay
daf87f895b
- 新增 internal/session 包：Session 结构体、Store 接口、MemoryStore（内存+后台清理）、RedisStore 预留 - Cookie 从 3 个精简为 1 个 mlb_sid（HttpOnly），移除 JWT access/refresh cookie - 会话过期采用滑动窗口：每次请求自动续期，记住我 30 天无操作过期 - AuthMiddleware/AuthAdmin/Maintenance 中间件改用 SessionManager.Validate() - AuthService Login/Register/ConfirmRestore 去除 token 生成，返回 *model.User - Controller 层在登录/注册后调用 SessionManager.Create 创建会话 - AdminService UpdateUserStatus/ResetUserToken 同步销毁 session 实现即时退登 - 改密/注销时通过 DestroyByUID 删除所有 session（替换 TokenVersion 检查） - config.yaml 新增 session 配置段（idle_timeout/remember_timeout/cleanup_interval） - TokenService/auth_parser/auth_token 标记废弃，移除 JWT 到期字段依赖
324 lines
8.5 KiB
Go
324 lines
8.5 KiB
Go
package service
|
||
|
||
import (
|
||
"regexp"
|
||
"time"
|
||
"unicode/utf8"
|
||
|
||
"metazone.cc/metalab/internal/common"
|
||
"metazone.cc/metalab/internal/config"
|
||
"metazone.cc/metalab/internal/model"
|
||
"metazone.cc/metalab/internal/session"
|
||
|
||
"golang.org/x/crypto/bcrypt"
|
||
"gorm.io/gorm"
|
||
)
|
||
|
||
// AuthService 认证业务逻辑
|
||
type AuthService struct {
|
||
userRepo userAuthStore
|
||
sessionManager *session.Manager
|
||
cfg *config.Config
|
||
siteSettings *config.SiteSettings
|
||
}
|
||
|
||
// NewAuthService 构造函数
|
||
func NewAuthService(userRepo userAuthStore, sm *session.Manager, cfg *config.Config, siteSettings *config.SiteSettings) *AuthService {
|
||
return &AuthService{userRepo: userRepo, sessionManager: sm, cfg: cfg, siteSettings: siteSettings}
|
||
}
|
||
|
||
var pwLetter = regexp.MustCompile(`[a-zA-Z]`)
|
||
var pwDigit = regexp.MustCompile(`\d`)
|
||
|
||
// usernamePattern 用户名合法字符：中文、英文大小写、数字、下划线、连字符
|
||
var usernamePattern = regexp.MustCompile(`^[\p{Han}a-zA-Z0-9_-]+$`)
|
||
|
||
// dummyHash 防时序攻击：当用户不存在时，仍对虚拟哈希执行完整的 bcrypt 比对
|
||
var dummyHash []byte
|
||
|
||
func init() {
|
||
hash, err := bcrypt.GenerateFromPassword([]byte("metazone-dummy-hash-2026"), 12)
|
||
if err != nil {
|
||
panic("failed to generate bcrypt dummy hash: " + err.Error())
|
||
}
|
||
dummyHash = hash
|
||
}
|
||
|
||
// validatePassword 密码强度：至少 8 位 + 包含字母 + 包含数字
|
||
func validatePassword(pw string) error {
|
||
if len(pw) < 8 || !pwLetter.MatchString(pw) || !pwDigit.MatchString(pw) {
|
||
return common.ErrWeakPassword
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// IsRegistrationEnabled 检查是否允许新用户注册
|
||
func (s *AuthService) IsRegistrationEnabled() bool {
|
||
return s.siteSettings.IsRegistrationEnabled()
|
||
}
|
||
|
||
// Register 注册
|
||
// 流程：密码强度 → 邮箱查重 → 哈希 → 生成唯一用户名 → 创建 → 返回 user（session 由 controller 创建）
|
||
func (s *AuthService) Register(req model.RegisterRequest, regIP string) (*model.User, error) {
|
||
// 0. 维护期间禁止注册
|
||
if s.siteSettings.IsMaintenanceEnabled() {
|
||
return nil, common.ErrMaintenanceMode
|
||
}
|
||
// 1. 检查注册开关
|
||
if !s.siteSettings.IsRegistrationEnabled() {
|
||
return nil, common.ErrRegistrationDisabled
|
||
}
|
||
|
||
// 2. 密码强度
|
||
if err := validatePassword(req.Password); err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 3. 检查邮箱
|
||
exists, err := s.userRepo.ExistsByEmail(req.Email)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if exists {
|
||
return nil, common.ErrEmailExists
|
||
}
|
||
|
||
// 4. 哈希密码
|
||
hash, err := common.HashPassword(req.Password, s.cfg.Bcrypt.Cost)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 5. 生成唯一用户名
|
||
username, err := common.GenerateUsername(s.userRepo, 20)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// 6. 创建用户
|
||
user := &model.User{
|
||
Email: req.Email,
|
||
PasswordHash: hash,
|
||
Username: username,
|
||
Role: model.RoleUser,
|
||
Status: model.StatusActive,
|
||
RegIP: regIP,
|
||
}
|
||
if err := s.userRepo.Create(user); err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
return user, nil
|
||
}
|
||
|
||
// Login 登录
|
||
// 流程：按邮箱查找 → 维护期间非站长统一拦截 → 状态检查 → 验证密码 → 记录登录信息 → 返回 user
|
||
func (s *AuthService) Login(req model.LoginRequest, loginIP string) (*model.User, error) {
|
||
user, err := s.userRepo.FindByEmail(req.Email)
|
||
|
||
// 维护期间：非站长一律返回统一提示（模拟 bcrypt 防时序攻击）
|
||
if s.siteSettings.IsMaintenanceEnabled() {
|
||
if err != nil {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrMaintenanceMode
|
||
}
|
||
if !model.HasMinRole(user.Role, model.RoleOwner) {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrMaintenanceMode
|
||
}
|
||
}
|
||
|
||
if err != nil {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrInvalidCred
|
||
}
|
||
|
||
// 已注销（deleted）→ 验证密码后要求二次确认
|
||
if user.Status == model.StatusDeleted {
|
||
if !common.CheckPassword(req.Password, user.PasswordHash) {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrInvalidCred
|
||
}
|
||
return nil, common.ErrNeedsConfirmRestore
|
||
}
|
||
|
||
// 永久锁定
|
||
if user.Status == model.StatusLocked {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrUserLocked
|
||
}
|
||
|
||
// 封禁
|
||
if user.Status == model.StatusBanned {
|
||
return nil, common.ErrUserBanned
|
||
}
|
||
|
||
if !common.CheckPassword(req.Password, user.PasswordHash) {
|
||
return nil, common.ErrInvalidCred
|
||
}
|
||
|
||
// 记录登录 IP 和时间
|
||
now := time.Now()
|
||
user.LastLoginIP = loginIP
|
||
user.LastLoginAt = &now
|
||
if err := s.userRepo.Update(user); err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
return user, nil
|
||
}
|
||
|
||
// ConfirmRestore 二次确认恢复已注销账号
|
||
func (s *AuthService) ConfirmRestore(req model.LoginRequest, loginIP string) (*model.User, error) {
|
||
user, err := s.userRepo.FindByEmail(req.Email)
|
||
if err != nil {
|
||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||
return nil, common.ErrInvalidCred
|
||
}
|
||
|
||
if user.Status != model.StatusDeleted {
|
||
return nil, common.ErrUserNotFound
|
||
}
|
||
|
||
if !common.CheckPassword(req.Password, user.PasswordHash) {
|
||
return nil, common.ErrInvalidCred
|
||
}
|
||
|
||
// 恢复账号
|
||
user.Status = model.StatusActive
|
||
user.DeletedAt = gorm.DeletedAt{}
|
||
now := time.Now()
|
||
user.LastLoginIP = loginIP
|
||
user.LastLoginAt = &now
|
||
if err := s.userRepo.Update(user); err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
return user, nil
|
||
}
|
||
|
||
// CheckEmail 检查邮箱是否已被注册
|
||
func (s *AuthService) CheckEmail(email string) (bool, error) {
|
||
return s.userRepo.ExistsByEmail(email)
|
||
}
|
||
|
||
// GetProfile 获取当前用户资料
|
||
func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
|
||
return s.userRepo.FindByID(userID)
|
||
}
|
||
|
||
// ChangePassword 修改密码
|
||
// 流程：验证当前密码 → 校验新密码强度 → 哈希 → 更新 → 删除所有 session（强制重新登录）
|
||
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
|
||
user, err := s.userRepo.FindByID(userID)
|
||
if err != nil {
|
||
return common.ErrUserNotFound
|
||
}
|
||
|
||
if !common.CheckPassword(currentPassword, user.PasswordHash) {
|
||
return common.ErrIncorrectPassword
|
||
}
|
||
|
||
if err := validatePassword(newPassword); err != nil {
|
||
return err
|
||
}
|
||
|
||
hash, err := common.HashPassword(newPassword, s.cfg.Bcrypt.Cost)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
|
||
user.PasswordHash = hash
|
||
if err := s.userRepo.Update(user); err != nil {
|
||
return err
|
||
}
|
||
|
||
// 删除所有 session，强制所有设备重新登录
|
||
return s.invalidateSessions(userID)
|
||
}
|
||
|
||
// DeleteAccount 用户自主注销
|
||
func (s *AuthService) DeleteAccount(userID uint, password, reason string) error {
|
||
user, err := s.userRepo.FindByID(userID)
|
||
if err != nil {
|
||
return common.ErrUserNotFound
|
||
}
|
||
|
||
if user.Role == model.RoleOwner {
|
||
return common.ErrOwnerCannotDelete
|
||
}
|
||
|
||
if !common.CheckPassword(password, user.PasswordHash) {
|
||
return common.ErrIncorrectPassword
|
||
}
|
||
|
||
user.Status = model.StatusDeleted
|
||
user.DeleteReason = reason
|
||
|
||
if err := s.userRepo.Update(user); err != nil {
|
||
return err
|
||
}
|
||
|
||
// 删除所有 session + 递增 token_version（向后兼容）
|
||
if err := s.invalidateSessions(userID); err != nil {
|
||
return err
|
||
}
|
||
return s.userRepo.IncrementTokenVersion(userID)
|
||
}
|
||
|
||
// invalidateSessions 销毁某用户的所有 session（内部方法）
|
||
func (s *AuthService) invalidateSessions(userID uint) error {
|
||
return s.sessionManager.DestroyByUID(userID)
|
||
}
|
||
|
||
// InvalidateSessions 公开方法：销毁用户所有 session（供 admin 等外部调用）
|
||
func (s *AuthService) InvalidateSessions(userID uint) error {
|
||
if err := s.invalidateSessions(userID); err != nil {
|
||
return err
|
||
}
|
||
return s.userRepo.IncrementTokenVersion(userID)
|
||
}
|
||
|
||
// UpdateProfile 修改个人资料
|
||
func (s *AuthService) UpdateProfile(userID uint, username, bio string) error {
|
||
user, err := s.userRepo.FindByID(userID)
|
||
if err != nil {
|
||
return common.ErrUserNotFound
|
||
}
|
||
|
||
needsUpdate := false
|
||
|
||
if n := utf8.RuneCountInString(username); n == 0 {
|
||
return common.ErrUsernameInvalid
|
||
} else if n > 16 {
|
||
return common.ErrUsernameInvalid
|
||
}
|
||
if !usernamePattern.MatchString(username) {
|
||
return common.ErrUsernameInvalid
|
||
}
|
||
if username != user.Username {
|
||
exists, err := s.userRepo.ExistsByUsername(username)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if exists {
|
||
return common.ErrUsernameTaken
|
||
}
|
||
user.Username = username
|
||
needsUpdate = true
|
||
}
|
||
|
||
if utf8.RuneCountInString(bio) > 128 {
|
||
return common.ErrBioTooLong
|
||
}
|
||
if bio != user.Bio {
|
||
user.Bio = bio
|
||
needsUpdate = true
|
||
}
|
||
|
||
if !needsUpdate {
|
||
return nil
|
||
}
|
||
return s.userRepo.Update(user)
|
||
}
|