移动端和 PC 端登录页都加了“图形验证码

backend/internal/modules/auth/handler.go

@@ -15,7 +15,9 @@ type Handler struct {
 }
 
 type SendSMSRequest struct {
-	Phone string `json:"phone" binding:"required"`
+	Phone       string `json:"phone" binding:"required"`
+	CaptchaID   string `json:"captcha_id" binding:"required"`
+	CaptchaCode string `json:"captcha_code" binding:"required"`
 }
 
 type LoginRequest struct {
@@ -31,6 +33,15 @@ func NewHandler(service *Service) *Handler {
 	return &Handler{service: service}
 }
 
+func (h *Handler) Captcha(c *gin.Context) {
+	item, err := h.service.Captcha(c.Request.Context())
+	if err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
 // SendSMS 发送短信验证码
 // @Summary      发送短信验证码
 // @Description  发送登录验证码到指定手机号
@@ -45,10 +56,10 @@ func NewHandler(service *Service) *Handler {
 func (h *Handler) SendSMS(c *gin.Context) {
 	var req SendSMSRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
-		response.BadRequest(c, "手机号不能为空")
+		response.BadRequest(c, "手机号和图形验证码不能为空")
 		return
 	}
-	if err := h.service.SendSMSCode(c.Request.Context(), strings.TrimSpace(req.Phone)); err != nil {
+	if err := h.service.SendSMSCode(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.CaptchaID), strings.TrimSpace(req.CaptchaCode)); err != nil {
 		writeAuthError(c, err)
 		return
 	}
@@ -125,6 +136,8 @@ func writeAuthError(c *gin.Context, err error) {
 		response.ServiceUnavailable(c, "数据库或 Redis 未连接")
 	case errors.Is(err, ErrInvalidPhone):
 		response.BadRequest(c, "手机号格式不正确")
+	case errors.Is(err, ErrCaptchaInvalid):
+		response.BadRequest(c, "图形验证码错误或已过期")
 	case errors.Is(err, ErrCodeRateLimited):
 		response.Error(c, http.StatusTooManyRequests, "rate_limited", "验证码发送过于频繁")
 	case errors.Is(err, ErrSMSSendFailed):

backend/internal/modules/auth/service.go

@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"time"
 
+	"hfb_sys/backend/internal/captcha"
 	smsprovider "hfb_sys/backend/internal/integrations/sms"
 	"hfb_sys/backend/internal/model"
 
@@ -19,6 +20,7 @@ import (
 var (
 	ErrDependencyUnavailable = errors.New("dependency unavailable")
 	ErrInvalidPhone          = errors.New("invalid phone")
+	ErrCaptchaInvalid        = errors.New("captcha invalid")
 	ErrCodeRateLimited       = errors.New("sms code rate limited")
 	ErrCodeInvalid           = errors.New("sms code invalid")
 	ErrSMSSendFailed         = errors.New("sms send failed")
@@ -29,6 +31,7 @@ const (
 	smsLoginCooldown     = 60 * time.Second
 	smsLoginHourlyLimit  = 5
 	smsLoginHourlyWindow = time.Hour
+	smsCaptchaTTL        = 3 * time.Minute
 )
 
 type Service struct {
@@ -48,7 +51,18 @@ func NewService(users *UserRepository, redis *redis.Client, jwt *JWTManager, sms
 	return &Service{users: users, redis: redis, jwt: jwt, sms: sms, log: log}
 }
 
-func (s *Service) SendSMSCode(ctx context.Context, phone string) error {
+func (s *Service) Captcha(ctx context.Context) (*captcha.Item, error) {
+	if s.redis == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	item, err := captcha.Generate(ctx, s.redis, "auth:sms", smsCaptchaTTL)
+	if errors.Is(err, captcha.ErrDependencyUnavailable) {
+		return nil, ErrDependencyUnavailable
+	}
+	return item, err
+}
+
+func (s *Service) SendSMSCode(ctx context.Context, phone string, captchaID string, captchaCode string) error {
 	if s.redis == nil {
 		return ErrDependencyUnavailable
 	}
@@ -74,6 +88,16 @@ func (s *Service) SendSMSCode(ctx context.Context, phone string) error {
 		return ErrCodeRateLimited
 	}
 
+	if err := captcha.Verify(ctx, s.redis, "auth:sms", captchaID, captchaCode); err != nil {
+		if errors.Is(err, captcha.ErrDependencyUnavailable) {
+			return ErrDependencyUnavailable
+		}
+		if errors.Is(err, captcha.ErrInvalid) {
+			return ErrCaptchaInvalid
+		}
+		return err
+	}
+
 	code, err := randomDigits(6)
 	if err != nil {
 		return err