第 1 阶段：用户与认证, mock登陆ok

2026-05-22 15:21:36 +08:00
parent 8e7f1f17f0
commit 9a79603e10
21 changed files with 780 additions and 4 deletions
@@ -0,0 +1,94 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+type SendSMSRequest struct {
+	Phone string `json:"phone" binding:"required"`
+}
+
+type LoginRequest struct {
+	Phone string `json:"phone" binding:"required"`
+	Code  string `json:"code" binding:"required,len=6"`
+}
+
+type RefreshRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) SendSMS(c *gin.Context) {
+	var req SendSMSRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "手机号不能为空")
+		return
+	}
+	if err := h.service.SendSMSCode(c.Request.Context(), strings.TrimSpace(req.Phone)); err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"phone": PublicPhone(req.Phone), "expires_in": 300})
+}
+
+func (h *Handler) Login(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "手机号和验证码不能为空")
+		return
+	}
+	result, err := h.service.LoginWithSMS(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.Code))
+	if err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) Refresh(c *gin.Context) {
+	var req RefreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "refresh_token 不能为空")
+		return
+	}
+	tokens, err := h.service.RefreshToken(req.RefreshToken)
+	if err != nil {
+		response.Unauthorized(c, "刷新令牌无效或已过期")
+		return
+	}
+	response.OK(c, tokens)
+}
+
+func (h *Handler) Logout(c *gin.Context) {
+	response.OK(c, gin.H{"logged_out": true})
+}
+
+func writeAuthError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库或 Redis 未连接")
+	case errors.Is(err, ErrInvalidPhone):
+		response.BadRequest(c, "手机号格式不正确")
+	case errors.Is(err, ErrCodeRateLimited):
+		response.Error(c, http.StatusTooManyRequests, "rate_limited", "验证码发送过于频繁")
+	case errors.Is(err, ErrCodeInvalid):
+		response.BadRequest(c, "验证码错误或已过期")
+	case errors.Is(err, ErrUserDisabled):
+		response.Error(c, http.StatusForbidden, "user_disabled", "用户已被冻结")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "服务暂时不可用")
+	}
+}
@@ -0,0 +1,95 @@
+package auth
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	tokenTypeAccess  = "access"
+	tokenTypeRefresh = "refresh"
+)
+
+var ErrInvalidToken = errors.New("invalid token")
+
+type JWTManager struct {
+	secret        []byte
+	accessTTL     time.Duration
+	refreshTTL    time.Duration
+	signingMethod jwt.SigningMethod
+}
+
+type Claims struct {
+	UserID    uint64 `json:"uid"`
+	Phone     string `json:"phone"`
+	TokenType string `json:"typ"`
+	jwt.RegisteredClaims
+}
+
+type TokenPair struct {
+	AccessToken      string `json:"access_token"`
+	RefreshToken     string `json:"refresh_token"`
+	TokenType        string `json:"token_type"`
+	ExpiresInSeconds int64  `json:"expires_in"`
+}
+
+func NewJWTManager(secret string) *JWTManager {
+	return &JWTManager{
+		secret:        []byte(secret),
+		accessTTL:     2 * time.Hour,
+		refreshTTL:    14 * 24 * time.Hour,
+		signingMethod: jwt.SigningMethodHS256,
+	}
+}
+
+func (m *JWTManager) GeneratePair(userID uint64, phone string) (TokenPair, error) {
+	accessToken, err := m.generate(userID, phone, tokenTypeAccess, m.accessTTL)
+	if err != nil {
+		return TokenPair{}, err
+	}
+	refreshToken, err := m.generate(userID, phone, tokenTypeRefresh, m.refreshTTL)
+	if err != nil {
+		return TokenPair{}, err
+	}
+	return TokenPair{
+		AccessToken:      accessToken,
+		RefreshToken:     refreshToken,
+		TokenType:        "Bearer",
+		ExpiresInSeconds: int64(m.accessTTL.Seconds()),
+	}, nil
+}
+
+func (m *JWTManager) Parse(tokenText, expectedType string) (*Claims, error) {
+	claims := &Claims{}
+	token, err := jwt.ParseWithClaims(tokenText, claims, func(token *jwt.Token) (any, error) {
+		if token.Method != m.signingMethod {
+			return nil, ErrInvalidToken
+		}
+		return m.secret, nil
+	})
+	if err != nil || !token.Valid {
+		return nil, ErrInvalidToken
+	}
+	if claims.TokenType != expectedType {
+		return nil, ErrInvalidToken
+	}
+	return claims, nil
+}
+
+func (m *JWTManager) generate(userID uint64, phone string, tokenType string, ttl time.Duration) (string, error) {
+	now := time.Now()
+	claims := Claims{
+		UserID:    userID,
+		Phone:     phone,
+		TokenType: tokenType,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   phone,
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
+		},
+	}
+	token := jwt.NewWithClaims(m.signingMethod, claims)
+	return token.SignedString(m.secret)
+}
@@ -0,0 +1,58 @@
+package auth
+
+import (
+	"errors"
+	"time"
+
+	"hfb_sys/backend/internal/model"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type UserRepository struct {
+	db *gorm.DB
+}
+
+func NewUserRepository(db *gorm.DB) *UserRepository {
+	return &UserRepository{db: db}
+}
+
+func (r *UserRepository) FindByID(id uint64) (*model.User, error) {
+	var user model.User
+	if err := r.db.First(&user, id).Error; err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+func (r *UserRepository) FindOrCreateByPhone(phone string) (*model.User, error) {
+	now := time.Now()
+	user := model.User{
+		Phone:          phone,
+		Nickname:       "用户" + phone[len(phone)-4:],
+		RealnameStatus: "unverified",
+		RiskStatus:     "normal",
+		CreditScore:    100,
+		Status:         "active",
+		LastLoginAt:    &now,
+	}
+
+	err := r.db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "phone"}},
+		DoUpdates: clause.AssignmentColumns([]string{"last_login_at", "updated_at"}),
+	}).Create(&user).Error
+	if err != nil {
+		return nil, err
+	}
+
+	var found model.User
+	if err := r.db.Where("phone = ?", phone).First(&found).Error; err != nil {
+		return nil, err
+	}
+	return &found, nil
+}
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}
@@ -0,0 +1,144 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"math/big"
+	"regexp"
+	"time"
+
+	"hfb_sys/backend/internal/model"
+
+	"github.com/redis/go-redis/v9"
+	"go.uber.org/zap"
+)
+
+var (
+	ErrDependencyUnavailable = errors.New("dependency unavailable")
+	ErrInvalidPhone          = errors.New("invalid phone")
+	ErrCodeRateLimited       = errors.New("sms code rate limited")
+	ErrCodeInvalid           = errors.New("sms code invalid")
+	ErrUserDisabled          = errors.New("user disabled")
+)
+
+type Service struct {
+	users *UserRepository
+	redis *redis.Client
+	jwt   *JWTManager
+	log   *zap.Logger
+}
+
+type LoginResult struct {
+	User   *model.User `json:"user"`
+	Tokens TokenPair   `json:"tokens"`
+}
+
+func NewService(users *UserRepository, redis *redis.Client, jwt *JWTManager, log *zap.Logger) *Service {
+	return &Service{users: users, redis: redis, jwt: jwt, log: log}
+}
+
+func (s *Service) SendSMSCode(ctx context.Context, phone string) error {
+	if s.redis == nil {
+		return ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return ErrInvalidPhone
+	}
+
+	cooldownKey := "sms:cooldown:login:" + phone
+	exists, err := s.redis.Exists(ctx, cooldownKey).Result()
+	if err != nil {
+		return err
+	}
+	if exists > 0 {
+		return ErrCodeRateLimited
+	}
+
+	code, err := randomDigits(6)
+	if err != nil {
+		return err
+	}
+
+	pipe := s.redis.TxPipeline()
+	pipe.Set(ctx, codeKey(phone), code, 5*time.Minute)
+	pipe.Set(ctx, cooldownKey, "1", 60*time.Second)
+	pipe.Incr(ctx, "sms:daily:login:"+phone)
+	pipe.Expire(ctx, "sms:daily:login:"+phone, 24*time.Hour)
+	if _, err := pipe.Exec(ctx); err != nil {
+		return err
+	}
+
+	// Development SMS adapter: keep the real provider boundary, but log only in local development.
+	s.log.Info("mock sms code generated", zap.String("phone", phone), zap.String("code", code))
+	return nil
+}
+
+func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string) (LoginResult, error) {
+	if s.redis == nil || s.users == nil {
+		return LoginResult{}, ErrDependencyUnavailable
+	}
+	if !isPhone(phone) {
+		return LoginResult{}, ErrInvalidPhone
+	}
+
+	stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
+	if errors.Is(err, redis.Nil) || stored != code {
+		return LoginResult{}, ErrCodeInvalid
+	}
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	user, err := s.users.FindOrCreateByPhone(phone)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	if user.Status != "active" {
+		return LoginResult{}, ErrUserDisabled
+	}
+
+	tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
+	if err != nil {
+		return LoginResult{}, err
+	}
+	_ = s.redis.Del(ctx, codeKey(phone)).Err()
+
+	return LoginResult{User: user, Tokens: tokens}, nil
+}
+
+func (s *Service) RefreshToken(refreshToken string) (TokenPair, error) {
+	claims, err := s.jwt.Parse(refreshToken, tokenTypeRefresh)
+	if err != nil {
+		return TokenPair{}, err
+	}
+	return s.jwt.GeneratePair(claims.UserID, claims.Phone)
+}
+
+func codeKey(phone string) string {
+	return "sms:code:login:" + phone
+}
+
+func isPhone(phone string) bool {
+	return regexp.MustCompile(`^1[3-9]\d{9}$`).MatchString(phone)
+}
+
+func randomDigits(length int) (string, error) {
+	result := make([]byte, length)
+	for i := range result {
+		n, err := rand.Int(rand.Reader, big.NewInt(10))
+		if err != nil {
+			return "", err
+		}
+		result[i] = byte('0' + n.Int64())
+	}
+	return string(result), nil
+}
+
+func PublicPhone(phone string) string {
+	if len(phone) < 7 {
+		return phone
+	}
+	return fmt.Sprintf("%s****%s", phone[:3], phone[len(phone)-4:])
+}