yml2213
88d74aca7d
新增单行文本编码器与结构化 GORM 日志，统一错误记录与请求日志策略，收紧日志文件权限并修复按天切分与压缩，支付回调参数脱敏，生产强制阿里云短信，RequestID 校验防注入，日志文案中文化。
412 lines
11 KiB
Go
412 lines
11 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"errors"
|
|
"fmt"
|
|
"math/big"
|
|
"regexp"
|
|
"time"
|
|
|
|
"hfb_sys/backend/internal/captcha"
|
|
smsprovider "hfb_sys/backend/internal/integrations/sms"
|
|
"hfb_sys/backend/internal/logging"
|
|
"hfb_sys/backend/internal/model"
|
|
|
|
"github.com/redis/go-redis/v9"
|
|
"go.uber.org/zap"
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
var (
|
|
ErrDependencyUnavailable = errors.New("dependency unavailable")
|
|
ErrInvalidPhone = errors.New("invalid phone")
|
|
ErrCaptchaInvalid = errors.New("captcha invalid")
|
|
ErrCodeRateLimited = errors.New("sms code rate limited")
|
|
ErrCodeInvalid = errors.New("sms code invalid")
|
|
ErrSMSSendFailed = errors.New("sms send failed")
|
|
ErrUserDisabled = errors.New("user disabled")
|
|
ErrInvalidPassword = errors.New("invalid password")
|
|
ErrInvalidOldPassword = errors.New("invalid old password")
|
|
ErrPasswordNotSet = errors.New("password not set")
|
|
ErrPasswordTooWeak = errors.New("password too weak")
|
|
ErrLoginLocked = errors.New("login locked")
|
|
ErrUserAlreadyExists = errors.New("user already exists")
|
|
)
|
|
|
|
const (
|
|
smsLoginCooldown = 60 * time.Second
|
|
smsLoginHourlyLimit = 5
|
|
smsLoginHourlyWindow = time.Hour
|
|
smsCaptchaTTL = 3 * time.Minute
|
|
passwordMinLength = 8
|
|
passwordMaxLength = 20
|
|
loginFailureTTL = 15 * time.Minute
|
|
loginLockTTL = 15 * time.Minute
|
|
loginMaxFailureCount = 5
|
|
)
|
|
|
|
type Service struct {
|
|
users *UserRepository
|
|
redis *redis.Client
|
|
jwt *JWTManager
|
|
sms smsprovider.Provider
|
|
log *zap.Logger
|
|
}
|
|
|
|
type LoginResult struct {
|
|
User *model.User `json:"user"`
|
|
Tokens TokenPair `json:"tokens"`
|
|
}
|
|
|
|
func NewService(users *UserRepository, redis *redis.Client, jwt *JWTManager, sms smsprovider.Provider, log *zap.Logger) *Service {
|
|
return &Service{users: users, redis: redis, jwt: jwt, sms: sms, log: log}
|
|
}
|
|
|
|
func (s *Service) Captcha(ctx context.Context) (*captcha.Item, error) {
|
|
if s.redis == nil {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
item, err := captcha.Generate(ctx, s.redis, "auth:sms", smsCaptchaTTL)
|
|
if errors.Is(err, captcha.ErrDependencyUnavailable) {
|
|
return nil, ErrDependencyUnavailable
|
|
}
|
|
return item, err
|
|
}
|
|
|
|
func (s *Service) SendSMSCode(ctx context.Context, phone string, captchaID string, captchaCode string) error {
|
|
if s.redis == nil {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
if !isPhone(phone) {
|
|
return ErrInvalidPhone
|
|
}
|
|
|
|
cooldownKey := "sms:cooldown:login:" + phone
|
|
exists, err := s.redis.Exists(ctx, cooldownKey).Result()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if exists > 0 {
|
|
return ErrCodeRateLimited
|
|
}
|
|
|
|
hourlyKey := "sms:hourly:login:" + phone
|
|
hourlyCount, err := s.redis.Get(ctx, hourlyKey).Int()
|
|
if err != nil && !errors.Is(err, redis.Nil) {
|
|
return err
|
|
}
|
|
if hourlyCount >= smsLoginHourlyLimit {
|
|
return ErrCodeRateLimited
|
|
}
|
|
|
|
if err := captcha.Verify(ctx, s.redis, "auth:sms", captchaID, captchaCode); err != nil {
|
|
if errors.Is(err, captcha.ErrDependencyUnavailable) {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
if errors.Is(err, captcha.ErrInvalid) {
|
|
return ErrCaptchaInvalid
|
|
}
|
|
return err
|
|
}
|
|
|
|
code, err := randomDigits(6)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if s.sms == nil {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
if err := s.sms.SendLoginCode(ctx, phone, code); err != nil {
|
|
if s.log != nil {
|
|
fields := []zap.Field{
|
|
zap.String("module", "auth"),
|
|
zap.String("phone", PublicPhone(phone)),
|
|
zap.Error(err),
|
|
}
|
|
if requestID := logging.RequestIDFromContext(ctx); requestID != "" {
|
|
fields = append(fields, zap.String("request_id", requestID))
|
|
}
|
|
s.log.Warn("短信验证码发送失败", fields...)
|
|
}
|
|
if smsprovider.IsProviderRateLimited(err) {
|
|
pipe := s.redis.TxPipeline()
|
|
pipe.Set(ctx, cooldownKey, "1", smsLoginCooldown)
|
|
pipe.Set(ctx, hourlyKey, smsLoginHourlyLimit, smsLoginHourlyWindow)
|
|
if _, pipeErr := pipe.Exec(ctx); pipeErr != nil {
|
|
return pipeErr
|
|
}
|
|
return ErrCodeRateLimited
|
|
}
|
|
return ErrSMSSendFailed
|
|
}
|
|
|
|
pipe := s.redis.TxPipeline()
|
|
pipe.Set(ctx, codeKey(phone), code, 5*time.Minute)
|
|
pipe.Set(ctx, cooldownKey, "1", smsLoginCooldown)
|
|
pipe.Incr(ctx, hourlyKey)
|
|
pipe.Expire(ctx, hourlyKey, smsLoginHourlyWindow)
|
|
pipe.Incr(ctx, "sms:daily:login:"+phone)
|
|
pipe.Expire(ctx, "sms:daily:login:"+phone, 24*time.Hour)
|
|
if _, err := pipe.Exec(ctx); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string) (LoginResult, error) {
|
|
if s.redis == nil || s.users == nil {
|
|
return LoginResult{}, ErrDependencyUnavailable
|
|
}
|
|
if !isPhone(phone) {
|
|
return LoginResult{}, ErrInvalidPhone
|
|
}
|
|
|
|
stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
|
|
if errors.Is(err, redis.Nil) || stored != code {
|
|
return LoginResult{}, ErrCodeInvalid
|
|
}
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
|
|
user, err := s.users.FindOrCreateByPhone(ctx, phone)
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
if user.Status != "active" {
|
|
return LoginResult{}, ErrUserDisabled
|
|
}
|
|
|
|
tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
_ = s.redis.Del(ctx, codeKey(phone)).Err()
|
|
|
|
return LoginResult{User: user, Tokens: tokens}, nil
|
|
}
|
|
|
|
func (s *Service) RefreshToken(refreshToken string) (TokenPair, error) {
|
|
claims, err := s.jwt.ParseSubject(refreshToken, tokenTypeRefresh, "user")
|
|
if err != nil {
|
|
return TokenPair{}, err
|
|
}
|
|
return s.jwt.GeneratePair(claims.UserID, claims.Phone)
|
|
}
|
|
|
|
func codeKey(phone string) string {
|
|
return "sms:code:login:" + phone
|
|
}
|
|
|
|
func isPhone(phone string) bool {
|
|
return regexp.MustCompile(`^1[3-9]\d{9}$`).MatchString(phone)
|
|
}
|
|
|
|
func randomDigits(length int) (string, error) {
|
|
result := make([]byte, length)
|
|
for i := range result {
|
|
n, err := rand.Int(rand.Reader, big.NewInt(10))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
result[i] = byte('0' + n.Int64())
|
|
}
|
|
return string(result), nil
|
|
}
|
|
|
|
func PublicPhone(phone string) string {
|
|
if len(phone) < 7 {
|
|
return phone
|
|
}
|
|
return fmt.Sprintf("%s****%s", phone[:3], phone[len(phone)-4:])
|
|
}
|
|
|
|
func (s *Service) LoginWithPassword(ctx context.Context, phone, password, clientIP string) (LoginResult, error) {
|
|
if s.redis == nil || s.users == nil {
|
|
return LoginResult{}, ErrDependencyUnavailable
|
|
}
|
|
if !isPhone(phone) {
|
|
return LoginResult{}, ErrInvalidPhone
|
|
}
|
|
|
|
locked, err := s.redis.Exists(ctx, loginLockRedisKey(phone, clientIP)).Result()
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
if locked > 0 {
|
|
return LoginResult{}, ErrLoginLocked
|
|
}
|
|
|
|
user, err := s.users.FindByPhone(ctx, phone)
|
|
if IsNotFound(err) {
|
|
// 用户不存在也计失败次数，避免该接口被用于探测手机号是否已注册
|
|
_ = recordLoginFailure(ctx, s.redis, phone, clientIP)
|
|
return LoginResult{}, ErrInvalidPassword
|
|
}
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
|
|
if user.PasswordHash == "" {
|
|
return LoginResult{}, ErrPasswordNotSet
|
|
}
|
|
if checkPasswordHash(password, user.PasswordHash) != nil {
|
|
_ = recordLoginFailure(ctx, s.redis, phone, clientIP)
|
|
return LoginResult{}, ErrInvalidPassword
|
|
}
|
|
|
|
if user.Status != "active" {
|
|
return LoginResult{}, ErrUserDisabled
|
|
}
|
|
|
|
_ = clearLoginFailure(ctx, s.redis, phone, clientIP)
|
|
|
|
tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
return LoginResult{User: user, Tokens: tokens}, nil
|
|
}
|
|
|
|
func (s *Service) SetPassword(ctx context.Context, userID uint64, password, oldPassword string) error {
|
|
if !isValidPassword(password) {
|
|
return ErrPasswordTooWeak
|
|
}
|
|
user, err := s.users.FindByID(ctx, userID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// 已设置过密码时必须校验旧密码，避免会话被他人借用后直接改密锁定原号主
|
|
if user.PasswordHash != "" {
|
|
if checkPasswordHash(oldPassword, user.PasswordHash) != nil {
|
|
return ErrInvalidOldPassword
|
|
}
|
|
}
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return s.users.SetPassword(ctx, userID, string(hash))
|
|
}
|
|
|
|
func (s *Service) ResetPassword(ctx context.Context, phone, code, newPassword string) error {
|
|
if s.redis == nil || s.users == nil {
|
|
return ErrDependencyUnavailable
|
|
}
|
|
if !isPhone(phone) {
|
|
return ErrInvalidPhone
|
|
}
|
|
|
|
stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
|
|
if errors.Is(err, redis.Nil) || stored != code {
|
|
return ErrCodeInvalid
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !isValidPassword(newPassword) {
|
|
return ErrPasswordTooWeak
|
|
}
|
|
|
|
user, err := s.users.FindByPhone(ctx, phone)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := s.users.SetPassword(ctx, user.ID, string(hash)); err != nil {
|
|
return err
|
|
}
|
|
_ = s.redis.Del(ctx, codeKey(phone)).Err()
|
|
return nil
|
|
}
|
|
|
|
func (s *Service) RegisterWithPassword(ctx context.Context, phone, code, password string) (LoginResult, error) {
|
|
if s.redis == nil || s.users == nil {
|
|
return LoginResult{}, ErrDependencyUnavailable
|
|
}
|
|
if !isPhone(phone) {
|
|
return LoginResult{}, ErrInvalidPhone
|
|
}
|
|
|
|
stored, err := s.redis.Get(ctx, codeKey(phone)).Result()
|
|
if errors.Is(err, redis.Nil) || stored != code {
|
|
return LoginResult{}, ErrCodeInvalid
|
|
}
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
if !isValidPassword(password) {
|
|
return LoginResult{}, ErrPasswordTooWeak
|
|
}
|
|
|
|
// 已注册的号不允许通过注册流程覆盖密码，避免"注册即改密"接管账号
|
|
existing, err := s.users.FindByPhone(ctx, phone)
|
|
if err == nil && existing != nil {
|
|
return LoginResult{}, ErrUserAlreadyExists
|
|
}
|
|
if err != nil && !IsNotFound(err) {
|
|
return LoginResult{}, err
|
|
}
|
|
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
|
|
user, err := s.users.RegisterWithPassword(ctx, phone, string(hash))
|
|
if err != nil {
|
|
// 并发场景下仍可能因唯一索引冲突，统一按"已注册"处理
|
|
return LoginResult{}, ErrUserAlreadyExists
|
|
}
|
|
if user.Status != "active" {
|
|
return LoginResult{}, ErrUserDisabled
|
|
}
|
|
|
|
tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
|
|
if err != nil {
|
|
return LoginResult{}, err
|
|
}
|
|
_ = s.redis.Del(ctx, codeKey(phone)).Err()
|
|
return LoginResult{User: user, Tokens: tokens}, nil
|
|
}
|
|
|
|
func isValidPassword(password string) bool {
|
|
return len(password) >= passwordMinLength && len(password) <= passwordMaxLength
|
|
}
|
|
|
|
func checkPasswordHash(password, hash string) error {
|
|
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
|
|
}
|
|
|
|
func recordLoginFailure(ctx context.Context, rdb *redis.Client, phone, clientIP string) error {
|
|
key := loginFailureRedisKey(phone, clientIP)
|
|
count, err := rdb.Incr(ctx, key).Result()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_ = rdb.Expire(ctx, key, loginFailureTTL).Err()
|
|
if count >= int64(loginMaxFailureCount) {
|
|
_ = rdb.Set(ctx, loginLockRedisKey(phone, clientIP), "1", loginLockTTL).Err()
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func clearLoginFailure(ctx context.Context, rdb *redis.Client, phone, clientIP string) error {
|
|
return rdb.Del(ctx, loginFailureRedisKey(phone, clientIP), loginLockRedisKey(phone, clientIP)).Err()
|
|
}
|
|
|
|
func loginFailureRedisKey(phone, clientIP string) string {
|
|
return fmt.Sprintf("user:login:fail:%s:%s", clientIP, phone)
|
|
}
|
|
|
|
func loginLockRedisKey(phone, clientIP string) string {
|
|
return fmt.Sprintf("user:login:lock:%s:%s", clientIP, phone)
|
|
}
|