chore(init): 初始化解忧商行项目并完成 Phase 0 基座

2026-10-30 11:46:10 +08:00
commit 8d9481c251
689 changed files with 138703 additions and 0 deletions
@@ -0,0 +1,469 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"math/big"
+	"regexp"
+	"strings"
+	"time"
+
+	"hfb_sys/backend/internal/captcha"
+	smsprovider "hfb_sys/backend/internal/integrations/sms"
+	"hfb_sys/backend/internal/logging"
+	"hfb_sys/backend/internal/model"
+
+	"github.com/redis/go-redis/v9"
+	"go.uber.org/zap"
+	"golang.org/x/crypto/bcrypt"
+)
+
+var (
+	ErrDependencyUnavailable = errors.New("dependency unavailable")
+	ErrInvalidPhone          = errors.New("invalid phone")
+	ErrCaptchaInvalid        = errors.New("captcha invalid")
+	ErrCodeRateLimited       = errors.New("sms code rate limited")
+	ErrCodeInvalid           = errors.New("sms code invalid")
+	ErrSMSSendFailed         = errors.New("sms send failed")
+	ErrUserDisabled          = errors.New("user disabled")
+	ErrInvalidPassword       = errors.New("invalid password")
+	ErrInvalidOldPassword    = errors.New("invalid old password")
+	ErrPasswordNotSet        = errors.New("password not set")
+	ErrPasswordTooWeak       = errors.New("password too weak")
+	ErrLoginLocked           = errors.New("login locked")
+	ErrUserAlreadyExists     = errors.New("user already exists")
+	ErrTokenVersionMismatch  = errors.New("user token version mismatch")
+)
+
+const (
+	smsLoginCooldown     = 60 * time.Second
+	smsLoginHourlyLimit  = 5
+	smsLoginHourlyWindow = time.Hour
+	smsCaptchaTTL        = 3 * time.Minute
+	passwordMinLength    = 8
+	passwordMaxLength    = 20
+	loginFailureTTL      = 15 * time.Minute
+	loginLockTTL         = 15 * time.Minute
+	loginMaxFailureCount = 5
+)
+
+// SiteSMSProviderResolver 用于根据分销站点标识解析专属 SMS Provider
+type SiteSMSProviderResolver interface {
+	ResolveSMSProvider(ctx context.Context, siteCode, domain string) (smsprovider.Provider, error)
+}
+
+type Service struct {
+	users       *UserRepository
+	redis       *redis.Client
+	jwt         *JWTManager
+	sms         smsprovider.Provider
+	smsResolver SiteSMSProviderResolver
+	log         *zap.Logger
+}
+
+type LoginResult struct {
+	User   *model.User `json:"user"`
+	Tokens TokenPair   `json:"tokens"`
+}
+
+func NewService(users *UserRepository, redis *redis.Client, jwt *JWTManager, sms smsprovider.Provider, log *zap.Logger) *Service {
+	return &Service{users: users, redis: redis, jwt: jwt, sms: sms, log: log}
+}
+
+func (s *Service) SetSiteSMSResolver(resolver SiteSMSProviderResolver) {
+	s.smsResolver = resolver
+}
+
+func (s *Service) Captcha(ctx context.Context) (*captcha.Item, error) {
+	if s.redis == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	item, err := captcha.Generate(ctx, s.redis, "auth:sms", smsCaptchaTTL)
+	if errors.Is(err, captcha.ErrDependencyUnavailable) {
+		return nil, ErrDependencyUnavailable
+	}
+	return item, err
+}
+
+func (s *Service) SendSMSCode(ctx context.Context, phone string, captchaID string, captchaCode string, siteContext ...string) error {
+	if s.redis == nil {
+		return ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return ErrInvalidPhone
+	}
+
+	cooldownKey := "sms:cooldown:login:" + phone
+	exists, err := s.redis.Exists(ctx, cooldownKey).Result()
+	if err != nil {
+		return err
+	}
+	if exists > 0 {
+		return ErrCodeRateLimited
+	}
+
+	hourlyKey := "sms:hourly:login:" + phone
+	hourlyCount, err := s.redis.Get(ctx, hourlyKey).Int()
+	if err != nil && !errors.Is(err, redis.Nil) {
+		return err
+	}
+	if hourlyCount >= smsLoginHourlyLimit {
+		return ErrCodeRateLimited
+	}
+
+	if err := captcha.Verify(ctx, s.redis, "auth:sms", captchaID, captchaCode); err != nil {
+		if errors.Is(err, captcha.ErrDependencyUnavailable) {
+			return ErrDependencyUnavailable
+		}
+		if errors.Is(err, captcha.ErrInvalid) {
+			return ErrCaptchaInvalid
+		}
+		return err
+	}
+
+	code, err := randomDigits(6)
+	if err != nil {
+		return err
+	}
+
+	provider := s.sms
+	siteCode := ""
+	domain := ""
+	if len(siteContext) > 0 {
+		siteCode = strings.TrimSpace(siteContext[0])
+	}
+	if len(siteContext) > 1 {
+		domain = strings.TrimSpace(siteContext[1])
+	}
+	if s.smsResolver != nil && (siteCode != "" || domain != "") {
+		customProvider, resolveErr := s.smsResolver.ResolveSMSProvider(ctx, siteCode, domain)
+		if resolveErr != nil {
+			if s.log != nil {
+				s.log.Warn("解析分销站点独立短信服务商失败，将回退至主站默认通道",
+					zap.String("site_code", siteCode),
+					zap.String("domain", domain),
+					zap.Error(resolveErr),
+				)
+			}
+		} else if customProvider != nil {
+			provider = customProvider
+		}
+	}
+
+	if provider == nil {
+		return ErrDependencyUnavailable
+	}
+	if err := provider.SendLoginCode(ctx, phone, code); err != nil {
+		if s.log != nil {
+			fields := []zap.Field{
+				zap.String("module", "auth"),
+				zap.String("phone", PublicPhone(phone)),
+				zap.String("site_code", siteCode),
+				zap.Error(err),
+			}
+			if requestID := logging.RequestIDFromContext(ctx); requestID != "" {
+				fields = append(fields, zap.String("request_id", requestID))
+			}
+			s.log.Warn("短信验证码发送失败", fields...)
+		}
+		if smsprovider.IsProviderRateLimited(err) {
+			pipe := s.redis.TxPipeline()
+			pipe.Set(ctx, cooldownKey, "1", smsLoginCooldown)
+			pipe.Set(ctx, hourlyKey, smsLoginHourlyLimit, smsLoginHourlyWindow)
+			if _, pipeErr := pipe.Exec(ctx); pipeErr != nil {
+				return pipeErr
+			}
+			return ErrCodeRateLimited
+		}
+		return ErrSMSSendFailed
+	}
+
+	pipe := s.redis.TxPipeline()
+	pipe.Set(ctx, codeKey(phone), code, 5*time.Minute)
+	pipe.Set(ctx, cooldownKey, "1", smsLoginCooldown)
+	pipe.Incr(ctx, hourlyKey)
+	pipe.Expire(ctx, hourlyKey, smsLoginHourlyWindow)
+	pipe.Incr(ctx, "sms:daily:login:"+phone)
+	pipe.Expire(ctx, "sms:daily:login:"+phone, 24*time.Hour)
+	if _, err := pipe.Exec(ctx); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string, trackCode string, siteCode ...string) (LoginResult, error) {
+	if s.redis == nil || s.users == nil {
+		return LoginResult{}, ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return LoginResult{}, ErrInvalidPhone
+	}
+
+	stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
+	if errors.Is(err, redis.Nil) || stored != code {
+		return LoginResult{}, ErrCodeInvalid
+	}
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	user, err := s.users.FindOrCreateByPhone(ctx, phone, trackCode, siteCode...)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	if user.Status != "active" {
+		return LoginResult{}, ErrUserDisabled
+	}
+
+	tokens, err := s.generateUserTokenPair(user)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	_ = s.redis.Del(ctx, codeKey(phone)).Err()
+
+	return LoginResult{User: user, Tokens: tokens}, nil
+}
+
+func (s *Service) RefreshToken(ctx context.Context, refreshToken string) (TokenPair, error) {
+	if s.jwt == nil || s.users == nil {
+		return TokenPair{}, ErrDependencyUnavailable
+	}
+	claims, err := s.jwt.ParseSubject(refreshToken, tokenTypeRefresh, "user")
+	if err != nil {
+		return TokenPair{}, err
+	}
+	user, err := s.users.FindActiveForToken(ctx, claims.UserID, claims.TokenVersion)
+	if err != nil {
+		return TokenPair{}, err
+	}
+	return s.generateUserTokenPair(user)
+}
+
+func (s *Service) generateUserTokenPair(user *model.User) (TokenPair, error) {
+	if s.jwt == nil {
+		return TokenPair{}, ErrDependencyUnavailable
+	}
+	return s.jwt.GenerateSubjectPairWithVersion(user.ID, user.Phone, "user", user.TokenVersion)
+}
+
+func (s *Service) Logout(ctx context.Context, userID uint64) error {
+	if s.jwt == nil || s.users == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.users.RevokeTokens(ctx, userID)
+}
+
+func codeKey(phone string) string {
+	return "sms:code:login:" + phone
+}
+
+func isPhone(phone string) bool {
+	return regexp.MustCompile(`^1[3-9]\d{9}$`).MatchString(phone)
+}
+
+func randomDigits(length int) (string, error) {
+	result := make([]byte, length)
+	for i := range result {
+		n, err := rand.Int(rand.Reader, big.NewInt(10))
+		if err != nil {
+			return "", err
+		}
+		result[i] = byte('0' + n.Int64())
+	}
+	return string(result), nil
+}
+
+func PublicPhone(phone string) string {
+	if len(phone) < 7 {
+		return phone
+	}
+	return fmt.Sprintf("%s****%s", phone[:3], phone[len(phone)-4:])
+}
+
+func (s *Service) LoginWithPassword(ctx context.Context, phone, password, clientIP string) (LoginResult, error) {
+	if s.redis == nil || s.users == nil {
+		return LoginResult{}, ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return LoginResult{}, ErrInvalidPhone
+	}
+
+	locked, err := s.redis.Exists(ctx, loginLockRedisKey(phone, clientIP)).Result()
+	if err != nil {
+		return LoginResult{}, err
+	}
+	if locked > 0 {
+		return LoginResult{}, ErrLoginLocked
+	}
+
+	user, err := s.users.FindByPhone(ctx, phone)
+	if IsNotFound(err) {
+		// 用户不存在也计失败次数，避免该接口被用于探测手机号是否已注册
+		_ = recordLoginFailure(ctx, s.redis, phone, clientIP)
+		return LoginResult{}, ErrInvalidPassword
+	}
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	if user.PasswordHash == "" {
+		return LoginResult{}, ErrPasswordNotSet
+	}
+	if checkPasswordHash(password, user.PasswordHash) != nil {
+		_ = recordLoginFailure(ctx, s.redis, phone, clientIP)
+		return LoginResult{}, ErrInvalidPassword
+	}
+
+	if user.Status != "active" {
+		return LoginResult{}, ErrUserDisabled
+	}
+
+	_ = clearLoginFailure(ctx, s.redis, phone, clientIP)
+
+	tokens, err := s.generateUserTokenPair(user)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	return LoginResult{User: user, Tokens: tokens}, nil
+}
+
+func (s *Service) SetPassword(ctx context.Context, userID uint64, password, oldPassword string) error {
+	if !isValidPassword(password) {
+		return ErrPasswordTooWeak
+	}
+	user, err := s.users.FindByID(ctx, userID)
+	if err != nil {
+		return err
+	}
+	// 已设置过密码时必须校验旧密码，避免会话被他人借用后直接改密锁定原号主
+	if user.PasswordHash != "" {
+		if checkPasswordHash(oldPassword, user.PasswordHash) != nil {
+			return ErrInvalidOldPassword
+		}
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	return s.users.SetPassword(ctx, userID, string(hash))
+}
+
+func (s *Service) ResetPassword(ctx context.Context, phone, code, newPassword string) error {
+	if s.redis == nil || s.users == nil {
+		return ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return ErrInvalidPhone
+	}
+
+	stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
+	if errors.Is(err, redis.Nil) || stored != code {
+		return ErrCodeInvalid
+	}
+	if err != nil {
+		return err
+	}
+	if !isValidPassword(newPassword) {
+		return ErrPasswordTooWeak
+	}
+
+	user, err := s.users.FindByPhone(ctx, phone)
+	if err != nil {
+		return err
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	if err := s.users.SetPassword(ctx, user.ID, string(hash)); err != nil {
+		return err
+	}
+	_ = s.redis.Del(ctx, codeKey(phone)).Err()
+	return nil
+}
+
+func (s *Service) RegisterWithPassword(ctx context.Context, phone, code, password string, trackCode string, siteCode ...string) (LoginResult, error) {
+	if s.redis == nil || s.users == nil {
+		return LoginResult{}, ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return LoginResult{}, ErrInvalidPhone
+	}
+
+	stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
+	if errors.Is(err, redis.Nil) || stored != code {
+		return LoginResult{}, ErrCodeInvalid
+	}
+	if err != nil {
+		return LoginResult{}, err
+	}
+	if !isValidPassword(password) {
+		return LoginResult{}, ErrPasswordTooWeak
+	}
+
+	// 已注册的号不允许通过注册流程覆盖密码，避免"注册即改密"接管账号
+	existing, err := s.users.FindByPhone(ctx, phone)
+	if err == nil && existing != nil {
+		return LoginResult{}, ErrUserAlreadyExists
+	}
+	if err != nil && !IsNotFound(err) {
+		return LoginResult{}, err
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	user, err := s.users.RegisterWithPassword(ctx, phone, string(hash), trackCode, siteCode...)
+	if err != nil {
+		// 并发场景下仍可能因唯一索引冲突，统一按"已注册"处理
+		return LoginResult{}, ErrUserAlreadyExists
+	}
+	if user.Status != "active" {
+		return LoginResult{}, ErrUserDisabled
+	}
+
+	tokens, err := s.generateUserTokenPair(user)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	_ = s.redis.Del(ctx, codeKey(phone)).Err()
+	return LoginResult{User: user, Tokens: tokens}, nil
+}
+
+func isValidPassword(password string) bool {
+	return len(password) >= passwordMinLength && len(password) <= passwordMaxLength
+}
+
+func checkPasswordHash(password, hash string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+}
+
+func recordLoginFailure(ctx context.Context, rdb *redis.Client, phone, clientIP string) error {
+	key := loginFailureRedisKey(phone, clientIP)
+	count, err := rdb.Incr(ctx, key).Result()
+	if err != nil {
+		return err
+	}
+	_ = rdb.Expire(ctx, key, loginFailureTTL).Err()
+	if count >= int64(loginMaxFailureCount) {
+		_ = rdb.Set(ctx, loginLockRedisKey(phone, clientIP), "1", loginLockTTL).Err()
+	}
+	return nil
+}
+
+func clearLoginFailure(ctx context.Context, rdb *redis.Client, phone, clientIP string) error {
+	return rdb.Del(ctx, loginFailureRedisKey(phone, clientIP), loginLockRedisKey(phone, clientIP)).Err()
+}
+
+func loginFailureRedisKey(phone, clientIP string) string {
+	return fmt.Sprintf("user:login:fail:%s:%s", clientIP, phone)
+}
+
+func loginLockRedisKey(phone, clientIP string) string {
+	return fmt.Sprintf("user:login:lock:%s:%s", clientIP, phone)
+}