146 lines
4.2 KiB
Go
146 lines
4.2 KiB
Go
package adminauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"hfb_sys/backend/internal/modules/auth"
|
|
)
|
|
|
|
var (
|
|
ErrDependencyUnavailable = errors.New("dependency unavailable")
|
|
ErrInvalidCredential = errors.New("invalid credential")
|
|
ErrCaptchaInvalid = errors.New("captcha invalid")
|
|
ErrAdminDisabled = errors.New("admin disabled")
|
|
ErrInvalidRefreshToken = errors.New("invalid refresh token")
|
|
ErrLoginLocked = errors.New("login locked")
|
|
ErrAdminNotFound = errors.New("admin not found")
|
|
ErrTokenVersionMismatch = errors.New("admin token version mismatch")
|
|
)
|
|
|
|
// TokenValidationError 为后台会话失败保留安全的诊断类别，响应仍使用统一文案。
|
|
type TokenValidationError struct {
|
|
Reason string
|
|
TokenVersion int64
|
|
CurrentVersion int64
|
|
err error
|
|
}
|
|
|
|
func (e *TokenValidationError) Error() string {
|
|
return "admin token validation failed: " + e.Reason
|
|
}
|
|
|
|
func (e *TokenValidationError) Unwrap() error {
|
|
return e.err
|
|
}
|
|
|
|
// AuthFailureReason 供中间件读取失败类别并写入结构化日志。
|
|
func (e *TokenValidationError) AuthFailureReason() string {
|
|
return e.Reason
|
|
}
|
|
|
|
// AuthFailureVersions 返回令牌声明版本和数据库当前版本；非版本不匹配时均为 0。
|
|
func (e *TokenValidationError) AuthFailureVersions() (int64, int64) {
|
|
return e.TokenVersion, e.CurrentVersion
|
|
}
|
|
|
|
func newTokenValidationError(reason string, err error) error {
|
|
return &TokenValidationError{Reason: reason, err: err}
|
|
}
|
|
|
|
func newTokenVersionMismatchError(tokenVersion, currentVersion int64) error {
|
|
return &TokenValidationError{
|
|
Reason: "token_version_mismatch",
|
|
TokenVersion: tokenVersion,
|
|
CurrentVersion: currentVersion,
|
|
err: ErrTokenVersionMismatch,
|
|
}
|
|
}
|
|
|
|
type Service struct {
|
|
repo *Repository
|
|
jwt *auth.JWTManager
|
|
}
|
|
|
|
func NewService(repo *Repository, jwt *auth.JWTManager) *Service {
|
|
return &Service{repo: repo, jwt: jwt}
|
|
}
|
|
|
|
func (s *Service) Refresh(ctx context.Context, refreshToken string) (*auth.TokenPair, error) {
|
|
if s.jwt == nil {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
claims, err := s.jwt.ParseSubject(refreshToken, "refresh", "admin")
|
|
if err != nil {
|
|
return nil, newTokenValidationError(auth.TokenFailureReason(err), ErrInvalidRefreshToken)
|
|
}
|
|
if s.repo == nil {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
admin, err := s.repo.FindActiveForToken(ctx, claims.UserID, claims.TokenVersion)
|
|
if err != nil {
|
|
if errors.Is(err, ErrAdminDisabled) {
|
|
return nil, ErrAdminDisabled
|
|
}
|
|
return nil, invalidRefreshTokenError(err)
|
|
}
|
|
pair, err := s.jwt.GenerateSubjectPairWithVersion(admin.ID, admin.Username, "admin", admin.TokenVersion)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &pair, nil
|
|
}
|
|
|
|
func invalidRefreshTokenError(err error) error {
|
|
reason := "invalid"
|
|
var tokenErr *TokenValidationError
|
|
if errors.As(err, &tokenErr) {
|
|
reason = tokenErr.Reason
|
|
return &TokenValidationError{
|
|
Reason: reason,
|
|
TokenVersion: tokenErr.TokenVersion,
|
|
CurrentVersion: tokenErr.CurrentVersion,
|
|
err: ErrInvalidRefreshToken,
|
|
}
|
|
}
|
|
return newTokenValidationError(reason, ErrInvalidRefreshToken)
|
|
}
|
|
|
|
func (s *Service) Captcha(ctx context.Context) (*CaptchaDTO, error) {
|
|
if s.repo == nil {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
return s.repo.Captcha(ctx)
|
|
}
|
|
|
|
func (s *Service) Login(ctx context.Context, username string, password string, captchaID string, captchaCode string, clientIP string) (LoginResult, error) {
|
|
if s.repo == nil {
|
|
return LoginResult{}, ErrDependencyUnavailable
|
|
}
|
|
if username == "" || password == "" || captchaID == "" || captchaCode == "" {
|
|
return LoginResult{}, ErrInvalidCredential
|
|
}
|
|
return s.repo.Login(ctx, username, password, captchaID, captchaCode, clientIP)
|
|
}
|
|
|
|
func (s *Service) Me(ctx context.Context, adminID uint64) (*AdminDTO, error) {
|
|
if s.repo == nil {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
return s.repo.FindByID(ctx, adminID)
|
|
}
|
|
|
|
func (s *Service) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {
|
|
if s.repo == nil {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
return s.repo.UpdateSupportStatus(ctx, adminID, status)
|
|
}
|
|
|
|
func (s *Service) Logout(ctx context.Context, adminID uint64) error {
|
|
if s.repo == nil {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
return s.repo.RevokeTokens(ctx, adminID)
|
|
}
|