初始化项目：基础设施 + 用户认证 + 后台管理系统 + AGPL 3.0 许可

2026-05-26 13:46:33 +08:00
parent 1315df6501
commit 483fdd919f
56 changed files with 5804 additions and 40 deletions
--- a/internal/middleware/admin.go
+++ b/internal/middleware/admin.go
@ -0,0 +1,92 @@
+package middleware
+
+import (
+	"log"
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/model"
+	"metazone.cc/metalab/internal/repository"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AdminAuth 管理后台页面认证中间件
+// 逻辑同 AuthRequired（JWT 校验 + token_version 吊销检查）
+// 但失败时重定向到首页，而非返回 JSON
+// 成功时向 context 注入 uid/email/username/role
+func AdminAuth(cfg *config.Config, userRepo *repository.UserRepo) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tokenStr, err := c.Cookie(common.CookieName)
+		if err != nil {
+			log.Printf("[AdminAuth] NO_COOKIE path=%s → 302", c.Request.URL.Path)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+
+		claims, err := parseToken(tokenStr, cfg.JWT.Secret)
+		if err != nil {
+			log.Printf("[AdminAuth] TOKEN_PARSE_FAIL path=%s err=%v → 302", c.Request.URL.Path, err)
+			common.ClearAuthCookies(c, cfg)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+
+		uid := uint(claims["uid"].(float64))
+		tokenVer := int(claims["ver"].(float64))
+
+		// 即时吊销检查
+		currentVer, err := userRepo.FindTokenVersion(uid)
+		if err != nil || tokenVer != currentVer {
+			if tokenVer != currentVer {
+				log.Printf("[AdminAuth] REVOKED: uid=%d tokenVer=%d dbVer=%d → 302", uid, tokenVer, currentVer)
+			} else {
+				log.Printf("[AdminAuth] DB_ERR: uid=%d err=%v → 302", uid, err)
+			}
+			common.ClearAuthCookies(c, cfg)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+
+		log.Printf("[AdminAuth] OK: uid=%d role=%v path=%s", uid, claims["role"], c.Request.URL.Path)
+		c.Set("uid", uid)
+		c.Set("email", claims["email"])
+		c.Set("username", claims["username"])
+		c.Set("role", claims["role"])
+		c.Next()
+	}
+}
+
+// RequireMinRole 角色权限检查（用于 API 路由）
+// 不足时返回 JSON 403
+func RequireMinRole(minRole string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		role, exists := c.Get("role")
+		if !exists || !model.HasMinRole(role.(string), minRole) {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"success": false, "message": "权限不足",
+			})
+			return
+		}
+		c.Next()
+	}
+}
+
+// RequirePageRole 角色权限检查（用于 SSR 页面路由）
+// 不足时 302 跳转首页
+func RequirePageRole(minRole string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		role, exists := c.Get("role")
+		if !exists || !model.HasMinRole(role.(string), minRole) {
+			log.Printf("[RequirePageRole] DENY: role=%v need=%s path=%s → 302", role, minRole, c.Request.URL.Path)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
--- a/internal/middleware/auth.go
+++ b/internal/middleware/auth.go
@ -0,0 +1,146 @@
+package middleware
+
+import (
+	"log"
+	"strings"
+	"time"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/repository"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// AuthMiddleware 认证中间件（结构体模式，持有 DB 依赖用于实时令牌吊销校验）
+type AuthMiddleware struct {
+	cfg      *config.Config
+	userRepo *repository.UserRepo
+}
+
+// NewAuthMiddleware 构造函数
+func NewAuthMiddleware(cfg *config.Config, userRepo *repository.UserRepo) *AuthMiddleware {
+	return &AuthMiddleware{cfg: cfg, userRepo: userRepo}
+}
+
+// Required 登录认证中间件：校验 JWT → 检查 token_version → 注入用户信息
+// 令牌版本与 DB 不匹配时即时拒绝，实现实时吊销
+func (am *AuthMiddleware) Required() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tokenStr, err := c.Cookie(common.CookieName)
+		if err != nil {
+			c.AbortWithStatusJSON(401, gin.H{
+				"success": false, "message": "请先登录",
+			})
+			return
+		}
+
+		claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
+		if err != nil {
+			common.ClearAuthCookies(c, am.cfg)
+			c.AbortWithStatusJSON(401, gin.H{
+				"success": false, "message": "登录已过期，请重新登录",
+			})
+			return
+		}
+
+		uid := uint(claims["uid"].(float64))
+		tokenVer := int(claims["ver"].(float64))
+
+		// 即时吊销检查：查询 DB 当前版本号，不匹配则拒绝
+		currentVer, err := am.userRepo.FindTokenVersion(uid)
+		if err != nil || tokenVer != currentVer {
+			if tokenVer != currentVer {
+				log.Printf("[AuthRequired] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
+			}
+			common.ClearAuthCookies(c, am.cfg)
+			c.AbortWithStatusJSON(401, gin.H{
+				"success": false, "message": "登录凭证已失效，请重新登录",
+			})
+			return
+		}
+
+		// 注入用户信息到上下文
+		c.Set("uid", uid)
+		c.Set("email", claims["email"])
+		c.Set("username", claims["username"])
+		c.Set("role", claims["role"])
+		c.Next()
+	}
+}
+
+// Optional 可选认证：已登录且版本通过则注入，未登录或版本不匹配也放行（仅清除过期 Cookie）
+func (am *AuthMiddleware) Optional() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tokenStr, err := c.Cookie(common.CookieName)
+		if err != nil {
+			log.Println("[AuthOptional] no cookie for", c.Request.URL.Path)
+			c.Next()
+			return
+		}
+		claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
+		if err != nil {
+			log.Printf("[AuthOptional] JWT parse failed for %s: %v", c.Request.URL.Path, err)
+			c.Next()
+			return
+		}
+
+		uid := uint(claims["uid"].(float64))
+		tokenVer := int(claims["ver"].(float64))
+
+		// 即时吊销检查
+		currentVer, err := am.userRepo.FindTokenVersion(uid)
+		if err != nil || tokenVer != currentVer {
+			log.Printf("[AuthOptional] REVOKED or err: uid=%d tokenVer=%d dbVer=%d err=%v",
+				uid, tokenVer, currentVer, err)
+			// 已吊销：清除 Cookie，但仍放行（页面视图，前端自行处理）
+			c.Next()
+			return
+		}
+
+		log.Printf("[AuthOptional] OK: uid=%v username=%v path=%s", claims["uid"], claims["username"], c.Request.URL.Path)
+		c.Set("uid", uid)
+		c.Set("email", claims["email"])
+		c.Set("username", claims["username"])
+		c.Set("role", claims["role"])
+		c.Next()
+	}
+}
+
+// parseToken 解析并验证 JWT
+func parseToken(tokenStr, secret string) (jwt.MapClaims, error) {
+	now := time.Now()
+	token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
+		return []byte(secret), nil
+	})
+	if err != nil || !token.Valid {
+		log.Printf("[parseToken] FAIL: now=%v err=%v (secret_len=%d token_len=%d)",
+			now, err, len(secret), len(tokenStr))
+		return nil, err
+	}
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return nil, jwt.ErrSignatureInvalid
+	}
+	// Debug: 打印 exp/iat 对比当前时间
+	if exp, exists := claims["exp"]; exists {
+		var expTime time.Time
+		switch v := exp.(type) {
+		case float64:
+			expTime = time.Unix(int64(v), 0)
+		case *jwt.NumericDate:
+			expTime = v.Time
+		}
+		if !expTime.IsZero() {
+			log.Printf("[parseToken] OK: exp=%v (%d) now=%v isExpired=%v",
+				expTime, expTime.Unix(), now, now.After(expTime))
+		}
+	}
+	return claims, nil
+}
+
+// IsLoginPage 检查是否已在登录状态，已登录用户跳过登录/注册页
+func IsLoginPage(c *gin.Context) bool {
+	return strings.HasPrefix(c.Request.URL.Path, "/auth/")
+}
--- a/internal/middleware/csrf.go
+++ b/internal/middleware/csrf.go
@ -0,0 +1,112 @@
+package middleware
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+
+	"metazone.cc/metalab/internal/config"
+
+	"github.com/gin-gonic/gin"
+)
+
+const (
+	csrfCookieName = "mlb_csrf"
+	csrfHeaderName = "X-CSRF-Token"
+	csrfMetaName   = "csrf_token"
+	csrfTokenLen   = 32 // 字节
+)
+
+// CSRF 中间件：Double Submit Cookie 模式
+// 前端 JS 从 Cookie 中读取 token 并放入 X-CSRF-Token 请求头，后端验证两者一致
+// GET / HEAD / OPTIONS 请求自动放行
+func CSRF(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// 安全读取豁免
+		if c.Request.Method == http.MethodGet ||
+			c.Request.Method == http.MethodHead ||
+			c.Request.Method == http.MethodOptions {
+			c.Next()
+			return
+		}
+
+		cookieToken, err := c.Cookie(csrfCookieName)
+		if err != nil || cookieToken == "" {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"success": false, "message": "CSRF 验证失败",
+			})
+			return
+		}
+
+		headerToken := c.GetHeader(csrfHeaderName)
+		// Fallback：如果请求头没有，尝试从表单字段读取（纯 HTML form 提交通道）
+		if headerToken == "" {
+			headerToken = c.PostForm(csrfMetaName)
+		}
+		if headerToken == "" {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"success": false, "message": "CSRF 验证失败：缺少令牌",
+			})
+			return
+		}
+
+		// 恒定时间比较防时序攻击
+		if !constantTimeEq(cookieToken, headerToken) {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"success": false, "message": "CSRF 验证失败",
+			})
+			return
+		}
+
+		// 注入到上下文，供前端 <meta> 使用
+		c.Set(csrfMetaName, cookieToken)
+		c.Next()
+	}
+}
+
+// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
+// 注意：此 Cookie HttpOnly=false，JS 可读——这是 Double Submit 模式的必要条件
+func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
+	secure := cfg.Server.Mode != "debug"
+
+	// 如果已有 token 且未过期，复用（但必须注入 context，供模板 meta 标签使用）
+	if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
+		c.Set(csrfMetaName, existing)
+		return existing
+	}
+
+	token, err := generateCSRFToken()
+	if err != nil {
+		// 极端情况：随机数生成失败，使用短 token
+		token = "fallback-" + hex.EncodeToString([]byte("metazone"))
+	}
+
+	c.SetSameSite(http.SameSiteStrictMode)
+	// 30 天有效期，与 refresh token 对齐
+	maxAge := int(cfg.JWT.RememberExpire * 3600)
+	c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
+
+	c.Set(csrfMetaName, token)
+	return token
+}
+
+// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
+func generateCSRFToken() (string, error) {
+	b := make([]byte, csrfTokenLen)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// constantTimeEq 恒定时间字符串比较（防时序攻击）
+func constantTimeEq(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	var result byte
+	for i := 0; i < len(a); i++ {
+		result |= a[i] ^ b[i]
+	}
+	return result == 0
+}
--- a/internal/middleware/ratelimit.go
+++ b/internal/middleware/ratelimit.go
@ -0,0 +1,149 @@
+package middleware
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+// RateLimiter 双维度滑动窗口登录限流
+// 维度一（账户）：同邮箱 1 分钟内失败 3 次 → 锁定 1 分钟
+// 维度二（IP）：同 IP 1 分钟内失败 10 次 → 锁定 1 分钟
+type RateLimiter struct {
+	mu sync.RWMutex
+	// accountFailures key = 邮箱（小写）
+	accountFailures map[string]*windowState
+	// ipFailures key = IP
+	ipFailures map[string]*windowState
+}
+
+// windowState 单个维度的限流状态
+type windowState struct {
+	count      int
+	windowStart time.Time
+	blockedUntil time.Time // 零值为未封锁
+}
+
+// RateLimitResult 限流检查结果
+type RateLimitResult struct {
+	Blocked    bool
+	RetryAfter int // 剩余封锁秒数
+	Message    string
+}
+
+const (
+	accountWindow     = 1 * time.Minute
+	accountMaxFails   = 3
+	accountBlockDur   = 1 * time.Minute
+	ipWindow          = 1 * time.Minute
+	ipMaxFails        = 10
+	ipBlockDur        = 1 * time.Minute
+	cleanupInterval   = 2 * time.Minute
+	maxEntries        = 10000 // 单维度最大条目数（防内存耗尽）
+)
+
+// NewRateLimiter 创建限流器并启动后台清理
+func NewRateLimiter() *RateLimiter {
+	rl := &RateLimiter{
+		accountFailures: make(map[string]*windowState),
+		ipFailures:      make(map[string]*windowState),
+	}
+	go rl.cleanupLoop()
+	return rl
+}
+
+// AllowAccount 检查账户维度是否允许登录尝试
+// 返回 (result, 登录失败时应调用的记录函数)
+func (rl *RateLimiter) AllowAccount(email string) (RateLimitResult, func()) {
+	return rl.check(rl.accountFailures, email, accountWindow, accountBlockDur, accountMaxFails, true)
+}
+
+// AllowIP 检查 IP 维度是否允许登录尝试
+func (rl *RateLimiter) AllowIP(ip string) (RateLimitResult, func()) {
+	return rl.check(rl.ipFailures, ip, ipWindow, ipBlockDur, ipMaxFails, false)
+}
+
+// check 核心检查逻辑
+// lowKey: 是否需要脱敏日志（true = 暗示账户存在，仅泄漏给已知该邮箱的人）
+func (rl *RateLimiter) check(m map[string]*windowState, key string, window, blockDur time.Duration, maxFails int, lowKey bool) (RateLimitResult, func()) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	now := time.Now()
+	state, exists := m[key]
+
+	if !exists {
+		state = &windowState{}
+		if len(m) < maxEntries {
+			m[key] = state
+		}
+	}
+
+	// 检查是否处于封锁期
+	if !state.blockedUntil.IsZero() && now.Before(state.blockedUntil) {
+		retry := int(state.blockedUntil.Sub(now).Seconds()) + 1
+		msg := "请求过于频繁，请稍后重试"
+		if lowKey {
+			msg = fmt.Sprintf("该账号登录尝试过于频繁，请 %d 秒后重试", retry)
+		}
+		return RateLimitResult{Blocked: true, RetryAfter: retry, Message: msg}, nil
+	}
+
+	// 窗口过期 → 重置
+	if now.Sub(state.windowStart) > window {
+		state.count = 0
+		state.windowStart = now
+		state.blockedUntil = time.Time{}
+	}
+
+	// 记录失败（由调用方在登录失败时调用）的闭包
+	recordFail := func() {
+		rl.mu.Lock()
+		defer rl.mu.Unlock()
+		s := m[key]
+		if s == nil {
+			return
+		}
+		if now.Sub(s.windowStart) > window {
+			s.count = 1
+			s.windowStart = now
+			return
+		}
+		s.count++
+		if s.count >= maxFails {
+			s.blockedUntil = now.Add(blockDur)
+		}
+	}
+
+	return RateLimitResult{Blocked: false}, recordFail
+}
+
+// Clear 登录成功后清除该 email 和 IP 的失败计数
+func (rl *RateLimiter) Clear(email, ip string) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	delete(rl.accountFailures, email)
+	delete(rl.ipFailures, ip)
+}
+
+// cleanupLoop 定期清理过期条目
+func (rl *RateLimiter) cleanupLoop() {
+	ticker := time.NewTicker(cleanupInterval)
+	defer ticker.Stop()
+	for range ticker.C {
+		rl.mu.Lock()
+		now := time.Now()
+		clean := func(m map[string]*windowState) {
+			for k, v := range m {
+				// 封锁期已过且窗口已过期 → 删除
+				if (v.blockedUntil.IsZero() || now.After(v.blockedUntil)) &&
+					now.Sub(v.windowStart) > accountWindow+ipBlockDur {
+					delete(m, k)
+				}
+			}
+		}
+		clean(rl.accountFailures)
+		clean(rl.ipFailures)
+		rl.mu.Unlock()
+	}
+}
--- a/internal/middleware/security.go
+++ b/internal/middleware/security.go
@ -0,0 +1,26 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+// SecurityHeaders 添加安全相关 HTTP 响应头
+// 作为纵深防御，不影响业务逻辑，纯附加
+func SecurityHeaders() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// Content-Security-Policy：仅允许本站资源 + 内联样式/脚本
+		c.Header("Content-Security-Policy",
+			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'")
+
+		// 禁止 MIME 类型嗅探
+		c.Header("X-Content-Type-Options", "nosniff")
+
+		// 禁止被 frame 嵌入（防点击劫持）
+		c.Header("X-Frame-Options", "DENY")
+
+		// 引用策略
+		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
+
+		c.Next()
+	}
+}