111 lines
3.5 KiB
Go
111 lines
3.5 KiB
Go
package api
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"oci-portal/internal/model"
|
|
"oci-portal/internal/service"
|
|
)
|
|
|
|
type authHandler struct {
|
|
svc *service.AuthService
|
|
logs *service.SystemLogService
|
|
}
|
|
|
|
type loginRequest struct {
|
|
Username string `json:"username" binding:"required"`
|
|
Password string `json:"password" binding:"required"`
|
|
// 两步验证码;账号已启用 TOTP 时必填,缺失返回 428
|
|
TotpCode string `json:"totpCode"`
|
|
}
|
|
|
|
// login 校验用户名密码(与可选 TOTP)后签发 JWT。
|
|
//
|
|
// @Summary 登录
|
|
// @Tags 认证
|
|
// @Accept json
|
|
// @Produce json
|
|
// @Param body body loginRequest true "登录凭据"
|
|
// @Success 200 {object} map[string]any "token 与 expiresAt"
|
|
// @Failure 401 {object} map[string]string "凭据错误"
|
|
// @Failure 428 {object} map[string]any "需要两步验证码(totpRequired=true)"
|
|
// @Router /api/v1/auth/login [post]
|
|
func (h *authHandler) login(c *gin.Context) {
|
|
var req loginRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
start := time.Now()
|
|
token, expires, err := h.svc.Login(c.Request.Context(), req.Username, req.Password, requestIP(c), req.TotpCode)
|
|
if errors.Is(err, service.ErrTotpRequired) {
|
|
// 密码已通过,引导前端弹出二次验证输入;不算失败不留痕
|
|
c.JSON(http.StatusPreconditionRequired, gin.H{"error": err.Error(), "totpRequired": true})
|
|
return
|
|
}
|
|
if errors.Is(err, service.ErrPasswordLoginDisabled) {
|
|
h.recordLogin(c, req.Username, http.StatusForbidden, start)
|
|
c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
if errors.Is(err, service.ErrLoginLocked) {
|
|
h.recordLogin(c, req.Username, http.StatusTooManyRequests, start)
|
|
c.JSON(http.StatusTooManyRequests, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
if errors.Is(err, service.ErrInvalidCredentials) {
|
|
h.recordLogin(c, req.Username, http.StatusUnauthorized, start)
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
h.recordLogin(c, req.Username, http.StatusOK, start)
|
|
c.JSON(http.StatusOK, gin.H{"token": token, "expiresAt": expires})
|
|
}
|
|
|
|
// logout 把当前令牌拉黑至自然过期(secured 组内,写请求由系统日志中间件留痕)。
|
|
//
|
|
// @Summary 登出
|
|
// @Tags 认证
|
|
// @Success 204 "令牌已吊销"
|
|
// @Security BearerAuth
|
|
// @Router /api/v1/auth/logout [post]
|
|
func (h *authHandler) logout(c *gin.Context) {
|
|
token, ok := strings.CutPrefix(c.GetHeader("Authorization"), "Bearer ")
|
|
if ok && token != "" {
|
|
h.svc.Logout(token)
|
|
}
|
|
c.Status(http.StatusNoContent)
|
|
}
|
|
|
|
// recordLogin 显式记录一次登录成败——登录不在 secured 组内，
|
|
// 系统日志中间件覆盖不到；登录失败是安全关键事件，必须留痕。
|
|
func (h *authHandler) recordLogin(c *gin.Context, username string, status int, start time.Time) {
|
|
errMsg := ""
|
|
if status == http.StatusUnauthorized {
|
|
errMsg = "用户名、密码或验证码错误"
|
|
} else if status == http.StatusTooManyRequests {
|
|
errMsg = "连续失败已锁定"
|
|
} else if status == http.StatusForbidden {
|
|
errMsg = "密码登录已禁用"
|
|
}
|
|
h.logs.Record(model.SystemLog{
|
|
Username: username,
|
|
Method: http.MethodPost,
|
|
Path: requestPath(c),
|
|
Status: status,
|
|
DurationMs: time.Since(start).Milliseconds(),
|
|
ClientIP: requestIP(c),
|
|
UserAgent: truncateLogField(c.Request.UserAgent(), 256),
|
|
ErrMsg: errMsg,
|
|
})
|
|
}
|