affiliate_dash/backend/internal/service/auth.go

package service

import (
	"errors"
	"strings"

	"affiliate_dash/internal/model"
	"affiliate_dash/internal/pkg/jwt"

	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

type AuthService struct {
	db     *gorm.DB
	jwt    *jwt.Manager
	tenant *TenantService
}

func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService) *AuthService {
	return &AuthService{db: db, jwt: jm, tenant: tenant}
}

type LoginResult struct {
	Token string      `json:"token"`
	User  *model.User `json:"user"`
}

type UpdateCurrentAccountInput struct {
	CurrentPassword string
	Username        string
	Nickname        string
	NewPassword     string
}

func (s *AuthService) Login(username, password string) (*LoginResult, error) {
	var user model.User
	if err := s.db.Where("username = ?", username).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, errors.New("用户名或密码错误")
		}
		return nil, err
	}
	if user.Status != 1 {
		return nil, errors.New("账号已禁用")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
		return nil, errors.New("用户名或密码错误")
	}
	token, err := s.jwt.Generate(user.ID, user.Username, user.Role)
	if err != nil {
		return nil, err
	}
	return &LoginResult{Token: token, User: &user}, nil
}

func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		return nil, err
	}
	return &user, nil
}

// ChangePassword only changes the current account after its existing password is verified.
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
	if userID == 0 {
		return errors.New("无效的用户身份")
	}
	if len(newPassword) < 8 {
		return errors.New("新密码至少 8 位")
	}
	if strings.TrimSpace(newPassword) == "" {
		return errors.New("新密码不能为空")
	}
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return errors.New("用户不存在")
		}
		return err
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
		return errors.New("当前密码错误")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(newPassword)); err == nil {
		return errors.New("新密码不能与当前密码相同")
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	return s.db.Model(&user).Update("password_hash", string(hash)).Error
}

// UpdateCurrentAccount lets a user maintain their own login identity. The
// current password is always required before username, nickname, or password
// changes are accepted.
func (s *AuthService) UpdateCurrentAccount(userID uint, in UpdateCurrentAccountInput) (*model.User, error) {
	if userID == 0 {
		return nil, errors.New("无效的用户身份")
	}
	in.Username = strings.TrimSpace(in.Username)
	if len(in.Username) < 3 || len(in.Username) > 64 {
		return nil, errors.New("用户名长度需为 3 至 64 位")
	}
	if len(in.Nickname) > 64 {
		return nil, errors.New("昵称不能超过 64 位")
	}
	if in.NewPassword != "" && len(in.NewPassword) < 8 {
		return nil, errors.New("新密码至少 8 位")
	}

	updated := &model.User{}
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, userID).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.CurrentPassword)); err != nil {
			return errors.New("当前密码错误")
		}
		if in.Username != user.Username {
			var count int64
			if err := tx.Model(&model.User{}).Where("username = ? AND id <> ?", in.Username, user.ID).Count(&count).Error; err != nil {
				return err
			}
			if count > 0 {
				return errors.New("用户名已存在")
			}
		}
		updates := map[string]interface{}{"username": in.Username, "nickname": in.Nickname}
		if in.NewPassword != "" {
			if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.NewPassword)); err == nil {
				return errors.New("新密码不能与当前密码相同")
			}
			hash, err := bcrypt.GenerateFromPassword([]byte(in.NewPassword), bcrypt.DefaultCost)
			if err != nil {
				return err
			}
			updates["password_hash"] = string(hash)
		}
		if err := tx.Model(&user).Updates(updates).Error; err != nil {
			return err
		}
		return tx.First(updated, user.ID).Error
	})
	if err != nil {
		return nil, err
	}
	return updated, nil
}