后台登陆验证码

backend/internal/modules/adminauth/repository.go

@@ -1,12 +1,20 @@
 package adminauth
 
 import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
+	"fmt"
+	"html"
+	"math/big"
+	"strings"
 	"time"
 
 	"hfb_sys/backend/internal/model"
 	"hfb_sys/backend/internal/modules/auth"
 
+	"github.com/redis/go-redis/v9"
 	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
 )
@@ -14,18 +22,46 @@ import (
 const (
 	defaultAdminUsername = "admin"
 	defaultAdminPassword = "admin123456"
+	captchaTTL           = 3 * time.Minute
 )
 
 type Repository struct {
-	db  *gorm.DB
-	jwt *auth.JWTManager
+	db    *gorm.DB
+	redis *redis.Client
+	jwt   *auth.JWTManager
 }
 
-func NewRepository(db *gorm.DB, jwt *auth.JWTManager) *Repository {
-	return &Repository{db: db, jwt: jwt}
+func NewRepository(db *gorm.DB, redis *redis.Client, jwt *auth.JWTManager) *Repository {
+	return &Repository{db: db, redis: redis, jwt: jwt}
 }
 
-func (r *Repository) Login(username string, password string) (LoginResult, error) {
+func (r *Repository) Captcha() (*CaptchaDTO, error) {
+	if r.redis == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	captchaID, err := randomToken(16)
+	if err != nil {
+		return nil, err
+	}
+	code, err := randomCaptchaCode(4)
+	if err != nil {
+		return nil, err
+	}
+	ctx := context.Background()
+	if err := r.redis.Set(ctx, captchaKey(captchaID), strings.ToUpper(code), captchaTTL).Err(); err != nil {
+		return nil, err
+	}
+	return &CaptchaDTO{
+		CaptchaID: captchaID,
+		Image:     captchaImageDataURL(code),
+		ExpiresIn: int64(captchaTTL.Seconds()),
+	}, nil
+}
+
+func (r *Repository) Login(username string, password string, captchaID string, captchaCode string) (LoginResult, error) {
+	if err := r.verifyCaptcha(captchaID, captchaCode); err != nil {
+		return LoginResult{}, err
+	}
 	if err := r.ensureDefaultAdmin(); err != nil {
 		return LoginResult{}, err
 	}
@@ -54,6 +90,26 @@ func (r *Repository) Login(username string, password string) (LoginResult, error
 	return LoginResult{Admin: toDTO(admin), Tokens: tokens}, nil
 }
 
+func (r *Repository) verifyCaptcha(captchaID string, captchaCode string) error {
+	if r.redis == nil {
+		return ErrDependencyUnavailable
+	}
+	ctx := context.Background()
+	key := captchaKey(captchaID)
+	stored, err := r.redis.Get(ctx, key).Result()
+	if errors.Is(err, redis.Nil) {
+		return ErrCaptchaInvalid
+	}
+	if err != nil {
+		return err
+	}
+	_ = r.redis.Del(ctx, key).Err()
+	if strings.ToUpper(strings.TrimSpace(captchaCode)) != stored {
+		return ErrCaptchaInvalid
+	}
+	return nil
+}
+
 func (r *Repository) FindByID(id uint64) (*AdminDTO, error) {
 	var admin model.AdminUser
 	if err := r.db.First(&admin, id).Error; err != nil {
@@ -96,3 +152,39 @@ func toDTO(admin model.AdminUser) AdminDTO {
 		LastLoginAt: admin.LastLoginAt,
 	}
 }
+
+func captchaKey(id string) string {
+	return "admin:captcha:" + id
+}
+
+func randomToken(length int) (string, error) {
+	buf := make([]byte, length)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}
+
+func randomCaptchaCode(length int) (string, error) {
+	const alphabet = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ"
+	result := make([]byte, length)
+	for i := range result {
+		n, err := rand.Int(rand.Reader, big.NewInt(int64(len(alphabet))))
+		if err != nil {
+			return "", err
+		}
+		result[i] = alphabet[n.Int64()]
+	}
+	return string(result), nil
+}
+
+func captchaImageDataURL(code string) string {
+	safeCode := html.EscapeString(strings.ToUpper(code))
+	svg := fmt.Sprintf(`<svg xmlns="http://www.w3.org/2000/svg" width="132" height="44" viewBox="0 0 132 44">
+<rect width="132" height="44" rx="8" fill="#eef5f7"/>
+<path d="M8 32 C32 2, 62 52, 124 12" stroke="#0f766e" stroke-width="2" fill="none" opacity=".28"/>
+<path d="M10 13 C42 42, 86 0, 122 31" stroke="#2563eb" stroke-width="2" fill="none" opacity=".22"/>
+<text x="66" y="29" text-anchor="middle" font-family="Menlo,Consolas,monospace" font-size="24" font-weight="700" letter-spacing="4" fill="#111827">%s</text>
+</svg>`, safeCode)
+	return "data:image/svg+xml;base64," + base64.StdEncoding.EncodeToString([]byte(svg))
+}