mce/internal/controller/auth_controller.go

package controller

import (
	"net/http"

	"metazone.cc/metalab/internal/common"
	"metazone.cc/metalab/internal/config"
	"metazone.cc/metalab/internal/middleware"
	"metazone.cc/metalab/internal/model"
	"metazone.cc/metalab/internal/service"
	"metazone.cc/metalab/internal/theme"

	"github.com/gin-gonic/gin"
)

// AuthController 认证相关页面 + API
type AuthController struct {
	authService  *service.AuthService
	tokenService *service.TokenService
	rateLimiter  *middleware.RateLimiter
	cfg          *config.Config
}

// NewAuthController 构造函数
func NewAuthController(authService *service.AuthService, tokenSvc *service.TokenService, limiter *middleware.RateLimiter, cfg *config.Config) *AuthController {
	return &AuthController{authService: authService, tokenService: tokenSvc, rateLimiter: limiter, cfg: cfg}
}

// RegisterPage 注册页面（已登录用户重定向到首页）
func (ac *AuthController) RegisterPage(c *gin.Context) {
	if _, exists := c.Get("uid"); exists {
		c.Redirect(http.StatusMovedPermanently, "/")
		return
	}
	guidelines, err := theme.LoadContent("templates/MetaLab-2026/guidelines.html")
	if err != nil {
		c.String(http.StatusInternalServerError, "加载准则失败")
		return
	}
	c.HTML(http.StatusOK, "auth/register.html", common.BuildPageData(c, gin.H{
		"Title":      "注册",
		"ExtraCSS":   "/static/css/auth.css",
		"Guidelines": guidelines,
	}))
}

// LoginPage 登录页面（已登录用户重定向到首页）
func (ac *AuthController) LoginPage(c *gin.Context) {
	if _, exists := c.Get("uid"); exists {
		c.Redirect(http.StatusMovedPermanently, "/")
		return
	}
	c.HTML(http.StatusOK, "auth/login.html", common.BuildPageData(c, gin.H{
		"Title":    "登录",
		"ExtraCSS": "/static/css/auth.css",
	}))
}

// clientIP 获取客户端真实 IP（考虑反向代理）
func clientIP(c *gin.Context) string {
	if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
		return fwd
	}
	if real := c.GetHeader("X-Real-IP"); real != "" {
		return real
	}
	return c.ClientIP()
}

// Login 登录 API（含双维度限流）
func (ac *AuthController) Login(c *gin.Context) {
	var req model.LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		common.Error(c, http.StatusBadRequest, "请检查输入")
		return
	}

	email := req.Email
	ip := clientIP(c)

	// --- 限流：账户维度 ---
	acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
	if acctResult.Blocked {
		common.Error(c, http.StatusTooManyRequests, acctResult.Message)
		return
	}

	// --- 限流：IP 维度 ---
	ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
	if ipResult.Blocked {
		common.Error(c, http.StatusTooManyRequests, ipResult.Message)
		return
	}

	accessToken, refreshToken, user, err := ac.authService.Login(req)
	if err != nil {
		// 记录失败 → 两个维度各 +1
		if recordAccount != nil {
			recordAccount()
		}
		if recordIP != nil {
			recordIP()
		}

		switch err {
		case service.ErrInvalidCred:
			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
		case service.ErrUserBanned:
			common.Error(c, http.StatusForbidden, "账号已被封禁")
		case service.ErrUserLocked:
			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
		case service.ErrUserDeleted:
			// deleted 状态本应在 Login 中自动恢复，此 case 作为兜底
			common.Error(c, http.StatusForbidden, "该账号已申请注销，登录即自动恢复")
		default:
			common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
		}
		return
	}

	// 登录成功 → 清除失败计数
	ac.rateLimiter.Clear(email, ip)

	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)

	c.JSON(http.StatusOK, gin.H{
		"success": true,
		"message": "登录成功",
		"data":    user,
	})
}

// CheckEmail 检查邮箱是否已注册
func (ac *AuthController) CheckEmail(c *gin.Context) {
	var req model.CheckEmailRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		common.Error(c, http.StatusBadRequest, "请提供有效的邮箱地址")
		return
	}

	exists, err := ac.authService.CheckEmail(req.Email)
	if err != nil {
		common.Error(c, http.StatusInternalServerError, "检查失败")
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"success": true,
		"data":    gin.H{"exists": exists},
	})
}

// Register 注册 API
func (ac *AuthController) Register(c *gin.Context) {
	var req model.RegisterRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		common.Error(c, http.StatusBadRequest, "请检查输入："+err.Error())
		return
	}

	// 注册 IP 限流：1 分钟 5 次
	regResult, recordReg := ac.rateLimiter.AllowIP(clientIP(c) + ":register")
	if regResult.Blocked {
		common.Error(c, http.StatusTooManyRequests, "注册请求过于频繁，请稍后重试")
		return
	}

	accessToken, refreshToken, user, err := ac.authService.Register(req)
	if err != nil {
		if recordReg != nil {
			recordReg()
		}
		switch err {
		case service.ErrEmailExists:
			common.Error(c, http.StatusConflict, "该邮箱已注册")
		case service.ErrWeakPassword:
			common.Error(c, http.StatusBadRequest, err.Error())
		default:
			common.Error(c, http.StatusInternalServerError, "注册失败，请稍后重试")
		}
		return
	}

	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)

	c.JSON(http.StatusOK, gin.H{
		"success": true,
		"message": "注册成功！欢迎加入 MetaLab",
		"data":    user,
	})
}

// Logout 退出登录：清除所有认证 Cookie
func (ac *AuthController) Logout(c *gin.Context) {
	common.ClearAuthCookies(c, ac.cfg)
	c.JSON(http.StatusOK, gin.H{
		"success": true,
		"message": "已退出登录",
	})
}

// RefreshToken 用 refresh token 换取新的 access token
func (ac *AuthController) RefreshToken(c *gin.Context) {
	refreshToken, err := c.Cookie(common.RefreshCookieName)
	if err != nil {
		common.Error(c, http.StatusUnauthorized, "请重新登录")
		return
	}

	accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
	if err != nil {
		common.ClearAuthCookies(c, ac.cfg)
		switch err {
		case service.ErrTokenExpired, service.ErrTokenRevoked:
			common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
		case service.ErrUserBanned:
			common.Error(c, http.StatusForbidden, "账号已被封禁")
		default:
			common.Error(c, http.StatusUnauthorized, "请重新登录")
		}
		return
	}

	common.SetAccessCookie(c, accessToken, ac.cfg)

	c.JSON(http.StatusOK, gin.H{
		"success": true,
	})
}