rose_cat707
0d84b07f68
CI / docker (push) Successful in 1m58s
Go + Vue 管理台：Agent 隧道、域名反代、IP 安全、访客验证与监控大盘。 Gitea Actions CI 多架构镜像；纯 Go SQLite、无 CGO Docker 构建。 Co-authored-by: Cursor <cursoragent@cursor.com>
119 lines
2.8 KiB
Go
119 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/wormhole/wormhole/internal/config"
|
|
"github.com/wormhole/wormhole/internal/store"
|
|
)
|
|
|
|
type Claims struct {
|
|
UserID uint `json:"user_id"`
|
|
Username string `json:"username"`
|
|
Role string `json:"role"`
|
|
jwt.RegisteredClaims
|
|
}
|
|
|
|
type Service struct {
|
|
mu sync.RWMutex
|
|
cfg *config.AuthConfig
|
|
limiter *LoginLimiter
|
|
}
|
|
|
|
func NewService(cfg *config.AuthConfig) *Service {
|
|
return &Service{
|
|
cfg: cfg,
|
|
limiter: NewLoginLimiter(cfg),
|
|
}
|
|
}
|
|
|
|
func (s *Service) ReloadAuth(cfg *config.AuthConfig) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
*s.cfg = *cfg
|
|
s.limiter = NewLoginLimiter(cfg)
|
|
}
|
|
|
|
func (s *Service) Login(st *store.Store, ip, username, password string) (string, *store.User, error) {
|
|
s.mu.RLock()
|
|
limiter := s.limiter
|
|
s.mu.RUnlock()
|
|
if retry, blocked := limiter.IsBlocked(ip, username); blocked {
|
|
return "", nil, &LoginBlockedError{RetryAfter: retry}
|
|
}
|
|
|
|
user, err := st.GetUserByUsername(username)
|
|
if err != nil {
|
|
limiter.RecordFailure(ip, username)
|
|
time.Sleep(300 * time.Millisecond)
|
|
return "", nil, errors.New("invalid credentials")
|
|
}
|
|
if !user.Status {
|
|
limiter.RecordFailure(ip, username)
|
|
time.Sleep(300 * time.Millisecond)
|
|
return "", nil, errors.New("invalid credentials")
|
|
}
|
|
if !store.CheckPassword(user.PasswordHash, password) {
|
|
limiter.RecordFailure(ip, username)
|
|
time.Sleep(300 * time.Millisecond)
|
|
return "", nil, errors.New("invalid credentials")
|
|
}
|
|
if user.Role == "visitor" {
|
|
limiter.RecordFailure(ip, username)
|
|
time.Sleep(300 * time.Millisecond)
|
|
return "", nil, errors.New("访客账号无法登录管理后台")
|
|
}
|
|
|
|
limiter.Reset(ip, username)
|
|
token, err := s.GenerateToken(user)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
return token, user, nil
|
|
}
|
|
|
|
func (s *Service) GenerateToken(user *store.User) (string, error) {
|
|
s.mu.RLock()
|
|
cfg := s.cfg
|
|
s.mu.RUnlock()
|
|
claims := Claims{
|
|
UserID: user.ID,
|
|
Username: user.Username,
|
|
Role: user.Role,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(cfg.TokenTTL)),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
},
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
return token.SignedString([]byte(cfg.JWTSecret))
|
|
}
|
|
|
|
func (s *Service) ParseToken(tokenStr string) (*Claims, error) {
|
|
s.mu.RLock()
|
|
secret := s.cfg.JWTSecret
|
|
s.mu.RUnlock()
|
|
token, err := jwt.ParseWithClaims(tokenStr, &Claims{}, func(t *jwt.Token) (interface{}, error) {
|
|
return []byte(secret), nil
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
claims, ok := token.Claims.(*Claims)
|
|
if !ok || !token.Valid {
|
|
return nil, errors.New("invalid token")
|
|
}
|
|
return claims, nil
|
|
}
|
|
|
|
func IsAdmin(role string) bool {
|
|
return role == "admin"
|
|
}
|
|
|
|
func IsVisitor(role string) bool {
|
|
return role == "visitor"
|
|
}
|