加固后台管理安全

2026-06-11 07:23:00 +08:00
parent 5255b21141
commit 88b1df64e7
41 changed files with 1276 additions and 293 deletions
@@ -21,9 +21,10 @@ import (
 )

 const (
-	defaultAdminUsername = "admin"
-	defaultAdminPassword = "admin123456"
 	captchaTTL           = 3 * time.Minute
+	loginFailureTTL      = 15 * time.Minute
+	loginLockTTL         = 15 * time.Minute
+	loginMaxFailureCount = 5
 )

 type Repository struct {
@@ -58,16 +59,17 @@ func (r *Repository) Captcha(ctx context.Context) (*CaptchaDTO, error) {
 	}, nil
 }

-func (r *Repository) Login(ctx context.Context, username string, password string, captchaID string, captchaCode string) (LoginResult, error) {
+func (r *Repository) Login(ctx context.Context, username string, password string, captchaID string, captchaCode string, clientIP string) (LoginResult, error) {
 	if err := r.verifyCaptcha(ctx, captchaID, captchaCode); err != nil {
 		return LoginResult{}, err
 	}
-	if err := r.ensureDefaultAdmin(ctx); err != nil {
+	if err := r.ensureLoginNotLocked(ctx, username, clientIP); err != nil {
 		return LoginResult{}, err
 	}
 	var admin model.AdminUser
 	if err := r.db.WithContext(ctx).Where("username = ?", username).First(&admin).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
+			r.recordLoginFailure(ctx, username, clientIP)
 			return LoginResult{}, ErrInvalidCredential
 		}
 		return LoginResult{}, err
@@ -76,14 +78,19 @@ func (r *Repository) Login(ctx context.Context, username string, password string
 		return LoginResult{}, ErrAdminDisabled
 	}
 	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(password)); err != nil {
+		r.recordLoginFailure(ctx, username, clientIP)
 		return LoginResult{}, ErrInvalidCredential
 	}
 	now := time.Now()
 	admin.LastLoginAt = &now
+	if admin.TokenVersion <= 0 {
+		admin.TokenVersion = 1
+	}
 	if err := r.db.WithContext(ctx).Save(&admin).Error; err != nil {
 		return LoginResult{}, err
 	}
-	tokens, err := r.jwt.GenerateSubjectPair(admin.ID, admin.Username, "admin")
+	r.clearLoginFailures(ctx, username, clientIP)
+	tokens, err := r.jwt.GenerateSubjectPairWithVersion(admin.ID, admin.Username, "admin", admin.TokenVersion)
 	if err != nil {
 		return LoginResult{}, err
 	}
@@ -92,6 +99,26 @@ func (r *Repository) Login(ctx context.Context, username string, password string
 	return LoginResult{Admin: dto, Tokens: tokens}, nil
 }

+func (r *Repository) FindActiveForToken(ctx context.Context, id uint64, tokenVersion int64) (*model.AdminUser, error) {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if admin.Status != "active" {
+		return nil, ErrAdminDisabled
+	}
+	if admin.TokenVersion <= 0 || admin.TokenVersion != tokenVersion {
+		return nil, ErrInvalidRefreshToken
+	}
+	return &admin, nil
+}
+
+func (r *Repository) RevokeTokens(ctx context.Context, adminID uint64) error {
+	return r.db.WithContext(ctx).Model(&model.AdminUser{}).
+		Where("id = ?", adminID).
+		UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error
+}
+
 func (r *Repository) verifyCaptcha(ctx context.Context, captchaID string, captchaCode string) error {
 	if r.redis == nil {
 		return ErrDependencyUnavailable
@@ -136,48 +163,15 @@ func (r *Repository) UpdateSupportStatus(ctx context.Context, adminID uint64, st
 		Update("support_status", status).Error
 }

-func (r *Repository) ensureDefaultAdmin(ctx context.Context) error {
-	var count int64
-	if err := r.db.WithContext(ctx).Model(&model.AdminUser{}).Count(&count).Error; err != nil {
-		return err
-	}
-	if count > 0 {
-		return nil
-	}
-	hash, err := bcrypt.GenerateFromPassword([]byte(defaultAdminPassword), bcrypt.DefaultCost)
-	if err != nil {
-		return err
-	}
-	admin := model.AdminUser{
-		Username:     defaultAdminUsername,
-		PasswordHash: string(hash),
-		Nickname:     "超级管理员",
-		Status:       "active",
-	}
-	if err := r.db.WithContext(ctx).Create(&admin).Error; err != nil {
-		return err
-	}
-
-	// 自动关联 super_admin 角色
-	var superAdminRole model.Role
-	if err := r.db.WithContext(ctx).Where("code = ?", "super_admin").First(&superAdminRole).Error; err == nil {
-		r.db.WithContext(ctx).Create(&model.AdminUserRole{
-			AdminID: admin.ID,
-			RoleID:  superAdminRole.ID,
-		})
-	}
-
-	return nil
-}
-
 func toDTO(admin model.AdminUser) AdminDTO {
 	return AdminDTO{
-		ID:            admin.ID,
-		Username:      admin.Username,
-		Nickname:      admin.Nickname,
-		Status:        admin.Status,
-		SupportStatus: admin.SupportStatus,
-		LastLoginAt:   admin.LastLoginAt,
+		ID:                 admin.ID,
+		Username:           admin.Username,
+		Nickname:           admin.Nickname,
+		Status:             admin.Status,
+		SupportStatus:      admin.SupportStatus,
+		PasswordMustChange: admin.PasswordMustChange,
+		LastLoginAt:        admin.LastLoginAt,
 	}
 }

@@ -224,6 +218,62 @@ func cachePermissions(ctx context.Context, r *Repository, adminID uint64, permCo
 	r.redis.Set(ctx, key, string(raw), 2*time.Hour)
 }

+func (r *Repository) ensureLoginNotLocked(ctx context.Context, username string, clientIP string) error {
+	if r.redis == nil {
+		return nil
+	}
+	locked, err := r.redis.Exists(ctx, loginLockKey(username, clientIP)).Result()
+	if err != nil {
+		return err
+	}
+	if locked > 0 {
+		return ErrLoginLocked
+	}
+	return nil
+}
+
+func (r *Repository) recordLoginFailure(ctx context.Context, username string, clientIP string) {
+	if r.redis == nil {
+		return
+	}
+	key := loginFailureKey(username, clientIP)
+	count, err := r.redis.Incr(ctx, key).Result()
+	if err != nil {
+		return
+	}
+	if count == 1 {
+		_ = r.redis.Expire(ctx, key, loginFailureTTL).Err()
+	}
+	if count >= loginMaxFailureCount {
+		_ = r.redis.Set(ctx, loginLockKey(username, clientIP), "1", loginLockTTL).Err()
+	}
+}
+
+func (r *Repository) clearLoginFailures(ctx context.Context, username string, clientIP string) {
+	if r.redis == nil {
+		return
+	}
+	_ = r.redis.Del(ctx, loginFailureKey(username, clientIP), loginLockKey(username, clientIP)).Err()
+}
+
+func loginFailureKey(username string, clientIP string) string {
+	return "admin:login:fail:" + loginKeyPart(clientIP) + ":" + loginKeyPart(username)
+}
+
+func loginLockKey(username string, clientIP string) string {
+	return "admin:login:lock:" + loginKeyPart(clientIP) + ":" + loginKeyPart(username)
+}
+
+func loginKeyPart(value string) string {
+	value = strings.ToLower(strings.TrimSpace(value))
+	value = strings.ReplaceAll(value, ":", "_")
+	value = strings.ReplaceAll(value, "/", "_")
+	if value == "" {
+		return "_"
+	}
+	return value
+}
+
 func captchaKey(id string) string {
 	return "admin:captcha:" + id
 }