134 lines
3.8 KiB
Go
134 lines
3.8 KiB
Go
package service
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
|
|
"affiliate_dash/internal/model"
|
|
"affiliate_dash/internal/pkg/jwt"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
type AuthService struct {
|
|
db *gorm.DB
|
|
jwt *jwt.Manager
|
|
tenant *TenantService
|
|
}
|
|
|
|
func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService) *AuthService {
|
|
return &AuthService{db: db, jwt: jm, tenant: tenant}
|
|
}
|
|
|
|
type LoginResult struct {
|
|
Token string `json:"token"`
|
|
User *model.User `json:"user"`
|
|
}
|
|
|
|
func (s *AuthService) Login(username, password string) (*LoginResult, error) {
|
|
var user model.User
|
|
if err := s.db.Where("username = ?", username).First(&user).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return nil, errors.New("用户名或密码错误")
|
|
}
|
|
return nil, err
|
|
}
|
|
if user.Status != 1 {
|
|
return nil, errors.New("账号已禁用")
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
|
|
return nil, errors.New("用户名或密码错误")
|
|
}
|
|
token, err := s.jwt.Generate(user.ID, user.Username, user.Role)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &LoginResult{Token: token, User: &user}, nil
|
|
}
|
|
|
|
func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
|
|
var user model.User
|
|
if err := s.db.First(&user, userID).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return &user, nil
|
|
}
|
|
|
|
// ChangePassword only changes the current account after its existing password is verified.
|
|
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
|
|
if userID == 0 {
|
|
return errors.New("无效的用户身份")
|
|
}
|
|
if len(newPassword) < 8 {
|
|
return errors.New("新密码至少 8 位")
|
|
}
|
|
if strings.TrimSpace(newPassword) == "" {
|
|
return errors.New("新密码不能为空")
|
|
}
|
|
var user model.User
|
|
if err := s.db.First(&user, userID).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return errors.New("用户不存在")
|
|
}
|
|
return err
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
|
|
return errors.New("当前密码错误")
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(newPassword)); err == nil {
|
|
return errors.New("新密码不能与当前密码相同")
|
|
}
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return s.db.Model(&user).Update("password_hash", string(hash)).Error
|
|
}
|
|
|
|
// EnsureAdmin creates the first platform administrator for an empty database.
|
|
// Existing administrator accounts are never changed by environment variables.
|
|
func (s *AuthService) EnsureAdmin(username, password string) error {
|
|
var count int64
|
|
s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
|
|
if count > 0 {
|
|
if s.tenant != nil {
|
|
var admins []model.User
|
|
if err := s.db.Where("role = ?", model.RoleAdmin).Find(&admins).Error; err != nil {
|
|
return err
|
|
}
|
|
for _, admin := range admins {
|
|
if err := s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
username = strings.TrimSpace(username)
|
|
if len(username) < 3 {
|
|
return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
|
|
}
|
|
if len(password) < 8 {
|
|
return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
|
|
}
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
admin := &model.User{
|
|
Username: username,
|
|
PasswordHash: string(hash),
|
|
Nickname: username,
|
|
Role: model.RoleAdmin,
|
|
Status: 1,
|
|
}
|
|
if err := s.db.Create(admin).Error; err != nil {
|
|
return err
|
|
}
|
|
if s.tenant != nil {
|
|
return s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status)
|
|
}
|
|
return nil
|
|
}
|