Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wangjia
|
53fa259284 |
@@ -5,6 +5,16 @@
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [1.0.56] - 2026-06-17
|
||||
|
||||
### 新功能
|
||||
- 在线设备/会话管理：服务端记录每次登录会话，支持查看本店在线设备、按平台类（桌面端 / 移动端 / 网页端）分别限制并发登录数，管理员可强制将指定设备下线
|
||||
- 登录失败锁定：同一账号连续多次密码错误后自动锁定一段时间，防止暴力破解
|
||||
- 记录账号最近登录时间
|
||||
|
||||
### 修复
|
||||
- 修复被禁用账号仍能凭刷新令牌继续续期登录的安全漏洞：续期时校验账号状态与会话是否有效
|
||||
|
||||
## [1.0.55] - 2026-06-17
|
||||
|
||||
### 新功能
|
||||
|
||||
@@ -13,6 +13,7 @@ type Config struct {
|
||||
JWT JWTConfig
|
||||
License LicenseConfig
|
||||
Storage StorageConfig
|
||||
Session SessionConfig
|
||||
}
|
||||
|
||||
type ServerConfig struct {
|
||||
@@ -39,6 +40,15 @@ type LicenseConfig struct {
|
||||
Ed25519PrivateKey string `mapstructure:"ed25519_private_key"` // base64 Ed25519 private key for token signing (keep in Bitwarden)
|
||||
}
|
||||
|
||||
// SessionConfig 登录会话与并发限制（全局默认，可被每店 session_policy 覆盖）。
|
||||
type SessionConfig struct {
|
||||
LimitDesktop int `mapstructure:"limit_desktop"` // 桌面端(win/mac/linux)最大并发会话，0=禁止
|
||||
LimitMobile int `mapstructure:"limit_mobile"` // 移动端(android/ios)最大并发会话，0=禁止
|
||||
LimitWeb int `mapstructure:"limit_web"` // web 端最大并发会话，0=禁止
|
||||
MaxFailures int `mapstructure:"max_failures"` // 连续登录失败几次后锁定
|
||||
LockMinutes int `mapstructure:"lock_minutes"` // 锁定时长（分钟）
|
||||
}
|
||||
|
||||
type StorageConfig struct {
|
||||
UploadDir string `mapstructure:"upload_dir"`
|
||||
BaseURL string `mapstructure:"base_url"`
|
||||
@@ -75,6 +85,11 @@ func Load() {
|
||||
viper.SetDefault("server.cors_origin", "*")
|
||||
viper.SetDefault("jwt.access_expire_min", 60)
|
||||
viper.SetDefault("jwt.refresh_expire_h", 168) // 7天
|
||||
viper.SetDefault("session.limit_desktop", 2)
|
||||
viper.SetDefault("session.limit_mobile", 2)
|
||||
viper.SetDefault("session.limit_web", 2) // 默认不禁 web（官网挂着 Web 版 app）；设 0 可禁
|
||||
viper.SetDefault("session.max_failures", 5)
|
||||
viper.SetDefault("session.lock_minutes", 15)
|
||||
viper.SetDefault("database.max_idle_conns", 10)
|
||||
viper.SetDefault("database.max_open_conns", 100)
|
||||
viper.SetDefault("storage.upload_dir", "./uploads/images")
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/wangjia/jiu/backend/internal/middleware"
|
||||
"github.com/wangjia/jiu/backend/internal/service"
|
||||
"github.com/wangjia/jiu/backend/internal/util"
|
||||
)
|
||||
@@ -19,18 +21,34 @@ func NewAuthHandler(svc *service.AuthService) *AuthHandler {
|
||||
// Login POST /api/v1/auth/login
|
||||
func (h *AuthHandler) Login(c *gin.Context) {
|
||||
var req struct {
|
||||
ShopCode string `json:"shop_code" binding:"required"`
|
||||
Username string `json:"username" binding:"required"`
|
||||
Password string `json:"password" binding:"required"`
|
||||
ShopCode string `json:"shop_code" binding:"required"`
|
||||
Username string `json:"username" binding:"required"`
|
||||
Password string `json:"password" binding:"required"`
|
||||
DeviceID string `json:"device_id"`
|
||||
DeviceName string `json:"device_name"`
|
||||
Platform string `json:"platform"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
pair, user, err := h.svc.Login(req.ShopCode, req.Username, req.Password)
|
||||
dev := service.DeviceInfo{
|
||||
DeviceID: req.DeviceID,
|
||||
DeviceName: req.DeviceName,
|
||||
Platform: req.Platform,
|
||||
IP: c.ClientIP(),
|
||||
UserAgent: c.Request.UserAgent(),
|
||||
}
|
||||
pair, user, err := h.svc.Login(req.ShopCode, req.Username, req.Password, dev)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
|
||||
status := http.StatusUnauthorized
|
||||
if errors.Is(err, service.ErrTooManyAttempts) {
|
||||
status = http.StatusTooManyRequests
|
||||
} else if errors.Is(err, service.ErrPlatformNotAllowed) {
|
||||
status = http.StatusForbidden
|
||||
}
|
||||
c.JSON(status, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
@@ -79,9 +97,28 @@ func (h *AuthHandler) Refresh(c *gin.Context) {
|
||||
|
||||
pair, err := h.svc.RefreshTokens(req.RefreshToken)
|
||||
if err != nil {
|
||||
// 被踢/登出/禁用 → 给前端明确 code，便于提示"账号已在其他设备登录/已失效"
|
||||
if errors.Is(err, service.ErrSessionRevoked) || errors.Is(err, service.ErrUserInactive) {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error(), "code": "SESSION_REVOKED"})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
util.RespondSuccess(c, pair)
|
||||
}
|
||||
|
||||
// Logout POST /api/v1/auth/logout —— 撤销当前会话
|
||||
func (h *AuthHandler) Logout(c *gin.Context) {
|
||||
if err := h.svc.Logout(middleware.GetSID(c)); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
util.RespondSuccess(c, gin.H{"ok": true})
|
||||
}
|
||||
|
||||
// Ping POST /api/v1/auth/ping —— 心跳，仅触发中间件刷新 last_seen；会话已撤销则中间件直接 401
|
||||
func (h *AuthHandler) Ping(c *gin.Context) {
|
||||
util.RespondSuccess(c, gin.H{"ok": true})
|
||||
}
|
||||
|
||||
@@ -24,7 +24,7 @@ func TestFeedbackHandler_SubmitAndList(t *testing.T) {
|
||||
r := gin.New()
|
||||
r.Use(gin.Recovery())
|
||||
api := r.Group("/api/v1")
|
||||
api.Use(middleware.JWT())
|
||||
api.Use(middleware.JWT(db))
|
||||
api.POST("/feedback", fh.Submit)
|
||||
adminG := api.Group("/admin")
|
||||
adminG.Use(middleware.SuperAdminOnly())
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gorm.io/gorm"
|
||||
|
||||
"github.com/wangjia/jiu/backend/internal/middleware"
|
||||
"github.com/wangjia/jiu/backend/internal/service"
|
||||
"github.com/wangjia/jiu/backend/internal/util"
|
||||
)
|
||||
|
||||
type SessionHandler struct {
|
||||
svc *service.AuthService
|
||||
}
|
||||
|
||||
func NewSessionHandler(svc *service.AuthService) *SessionHandler {
|
||||
return &SessionHandler{svc: svc}
|
||||
}
|
||||
|
||||
// List GET /api/v1/sessions —— 列出本店在线会话（所有登录用户只读）
|
||||
func (h *SessionHandler) List(c *gin.Context) {
|
||||
shopID := middleware.GetShopID(c)
|
||||
views, err := h.svc.ListSessions(shopID, middleware.GetSID(c))
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
util.RespondSuccess(c, views)
|
||||
}
|
||||
|
||||
// ForceLogout DELETE /api/v1/sessions/:id —— 强制下线（仅 admin/superadmin，挂 AdminOnly）
|
||||
func (h *SessionHandler) ForceLogout(c *gin.Context) {
|
||||
id, err := strconv.ParseUint(c.Param("id"), 10, 64)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid session id"})
|
||||
return
|
||||
}
|
||||
shopID := middleware.GetShopID(c)
|
||||
if err := h.svc.ForceLogout(shopID, id); err != nil {
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
util.RespondSuccess(c, gin.H{"ok": true})
|
||||
}
|
||||
@@ -32,7 +32,7 @@ func setupProtectedRouter(db *gorm.DB) *gin.Engine {
|
||||
r.Use(gin.Recovery())
|
||||
|
||||
api := r.Group("/api/v1")
|
||||
api.Use(middleware.JWT())
|
||||
api.Use(middleware.JWT(db))
|
||||
|
||||
// 商品路由
|
||||
products := api.Group("/products")
|
||||
|
||||
@@ -3,17 +3,22 @@ package middleware
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"gorm.io/gorm"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
"github.com/wangjia/jiu/backend/internal/model"
|
||||
)
|
||||
|
||||
type Claims struct {
|
||||
UserID uint64 `json:"user_id"`
|
||||
ShopID uint64 `json:"shop_id"`
|
||||
Role string `json:"role"`
|
||||
LicenseExpiresAt *int64 `json:"lic_exp,omitempty"` // unix seconds; nil = perpetual
|
||||
UserID uint64 `json:"user_id"`
|
||||
ShopID uint64 `json:"shop_id"`
|
||||
Role string `json:"role"`
|
||||
SID string `json:"sid,omitempty"` // 服务端会话标识（user_sessions.sid）
|
||||
LicenseExpiresAt *int64 `json:"lic_exp,omitempty"` // unix seconds; nil = perpetual
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
@@ -21,10 +26,14 @@ const (
|
||||
CtxUserID = "user_id"
|
||||
CtxShopID = "shop_id"
|
||||
CtxRole = "role"
|
||||
CtxSID = "sid"
|
||||
CtxLicenseExpiresAt = "lic_exp"
|
||||
)
|
||||
|
||||
func JWT() gin.HandlerFunc {
|
||||
// lastSeenThrottle 控制 last_seen_at 写频率，避免每请求一写。
|
||||
const lastSeenThrottle = 30 * time.Second
|
||||
|
||||
func JWT(db *gorm.DB) gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
authHeader := c.GetHeader("Authorization")
|
||||
if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
|
||||
@@ -42,14 +51,44 @@ func JWT() gin.HandlerFunc {
|
||||
return
|
||||
}
|
||||
|
||||
// 会话校验：带 sid 的 token 必须对应一条未撤销会话（支持踢人/登出/禁用即时失效）。
|
||||
// 存量无 sid 的 token 过渡放行（其 access ≤60min 过期后会换到带 sid 的会话）。
|
||||
if claims.SID != "" {
|
||||
var sess model.UserSession
|
||||
if err := db.Where("sid = ?", claims.SID).First(&sess).Error; err != nil || sess.RevokedAt != nil {
|
||||
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "session revoked", "code": "SESSION_REVOKED"})
|
||||
return
|
||||
}
|
||||
// 节流刷新 last_seen，用于在线状态判定
|
||||
if time.Since(sess.LastSeenAt) > lastSeenThrottle {
|
||||
db.Model(&model.UserSession{}).Where("id = ?", sess.ID).
|
||||
Update("last_seen_at", time.Now())
|
||||
}
|
||||
}
|
||||
|
||||
c.Set(CtxUserID, claims.UserID)
|
||||
c.Set(CtxShopID, claims.ShopID)
|
||||
c.Set(CtxRole, claims.Role)
|
||||
c.Set(CtxSID, claims.SID)
|
||||
c.Set(CtxLicenseExpiresAt, claims.LicenseExpiresAt)
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// GetSID 从 context 中获取当前会话 sid（可能为空：存量无 sid token）。
|
||||
func GetSID(c *gin.Context) string {
|
||||
v, _ := c.Get(CtxSID)
|
||||
s, _ := v.(string)
|
||||
return s
|
||||
}
|
||||
|
||||
// GetRole 从 context 中获取当前用户角色。
|
||||
func GetRole(c *gin.Context) string {
|
||||
v, _ := c.Get(CtxRole)
|
||||
s, _ := v.(string)
|
||||
return s
|
||||
}
|
||||
|
||||
// AdminOnly 仅管理员可访问
|
||||
func AdminOnly() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
|
||||
@@ -1,13 +1,16 @@
|
||||
package model
|
||||
|
||||
import "time"
|
||||
|
||||
type User struct {
|
||||
Base
|
||||
ShopID uint64 `gorm:"not null;index;uniqueIndex:uk_shop_username" json:"shop_id"`
|
||||
Username string `gorm:"size:50;uniqueIndex:uk_shop_username" json:"username"`
|
||||
PasswordHash string `gorm:"size:255" json:"-"`
|
||||
RealName string `gorm:"size:50" json:"real_name"`
|
||||
Phone string `gorm:"size:30" json:"phone"`
|
||||
Role string `gorm:"type:enum('admin','operator','readonly','superadmin');default:'operator'" json:"role"`
|
||||
IsActive bool `gorm:"default:true" json:"is_active"`
|
||||
CustomFields JSON `gorm:"type:json" json:"custom_fields,omitempty"`
|
||||
ShopID uint64 `gorm:"not null;index;uniqueIndex:uk_shop_username" json:"shop_id"`
|
||||
Username string `gorm:"size:50;uniqueIndex:uk_shop_username" json:"username"`
|
||||
PasswordHash string `gorm:"size:255" json:"-"`
|
||||
RealName string `gorm:"size:50" json:"real_name"`
|
||||
Phone string `gorm:"size:30" json:"phone"`
|
||||
Role string `gorm:"type:enum('admin','operator','readonly','superadmin');default:'operator'" json:"role"`
|
||||
IsActive bool `gorm:"default:true" json:"is_active"`
|
||||
LastLoginAt *time.Time `json:"last_login_at,omitempty"`
|
||||
CustomFields JSON `gorm:"type:json" json:"custom_fields,omitempty"`
|
||||
}
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
package model
|
||||
|
||||
import "time"
|
||||
|
||||
// UserSession 服务端登录会话。JWT 的 sid claim 指向此表一行，
|
||||
// 用于支持登出/踢人/在线状态监控（JWT 本身无状态，无法撤销）。
|
||||
type UserSession struct {
|
||||
ID uint64 `gorm:"primaryKey;autoIncrement" json:"id"`
|
||||
ShopID uint64 `gorm:"not null;index:idx_session_shop_user" json:"shop_id"`
|
||||
UserID uint64 `gorm:"not null;index:idx_session_shop_user" json:"user_id"`
|
||||
SID string `gorm:"column:sid;size:64;not null;uniqueIndex" json:"sid"` // 嵌入 JWT
|
||||
DeviceID string `gorm:"size:255" json:"device_id"`
|
||||
DeviceName string `gorm:"size:255" json:"device_name"`
|
||||
Platform string `gorm:"size:50" json:"platform"` // windows|macos|linux|android|ios|web
|
||||
PlatformClass string `gorm:"size:20;index" json:"platform_class"` // desktop|mobile|web
|
||||
IP string `gorm:"size:64" json:"ip"`
|
||||
UserAgent string `gorm:"size:512" json:"user_agent"`
|
||||
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
||||
LastSeenAt time.Time `gorm:"autoCreateTime" json:"last_seen_at"`
|
||||
RevokedAt *time.Time `gorm:"index" json:"revoked_at,omitempty"`
|
||||
RevokedReason string `gorm:"size:30" json:"revoked_reason,omitempty"` // kicked|logout|admin|disabled
|
||||
RefreshExpAt time.Time `json:"refresh_exp_at"`
|
||||
}
|
||||
|
||||
func (UserSession) TableName() string { return "user_sessions" }
|
||||
|
||||
// PlatformClass 把具体平台归类，用于按类限并发。
|
||||
func PlatformClass(platform string) string {
|
||||
switch platform {
|
||||
case "android", "ios":
|
||||
return "mobile"
|
||||
case "web":
|
||||
return "web"
|
||||
case "windows", "macos", "linux":
|
||||
return "desktop"
|
||||
default:
|
||||
return "desktop" // 未知平台按桌面端处理
|
||||
}
|
||||
}
|
||||
@@ -17,6 +17,7 @@ func Setup(r *gin.Engine, db *gorm.DB) {
|
||||
|
||||
// 处理器
|
||||
authH := handler.NewAuthHandler(authSvc)
|
||||
sessionH := handler.NewSessionHandler(authSvc)
|
||||
licenseH := handler.NewLicenseHandler(licenseSvc)
|
||||
productH := handler.NewProductHandler(db)
|
||||
warehouseH := handler.NewWarehouseHandler(db)
|
||||
@@ -69,7 +70,17 @@ func Setup(r *gin.Engine, db *gorm.DB) {
|
||||
|
||||
// 需要 JWT 的基础路由组
|
||||
api := v1.Group("")
|
||||
api.Use(middleware.JWT())
|
||||
api.Use(middleware.JWT(db))
|
||||
|
||||
// 会话/在线状态（豁免 LicenseGuard：登出/心跳/在线列表在锁定期也要可用）
|
||||
{
|
||||
api.POST("/auth/logout", authH.Logout)
|
||||
api.POST("/auth/ping", authH.Ping)
|
||||
// 在线会话列表：所有登录用户只读
|
||||
api.GET("/sessions", sessionH.List)
|
||||
// 强制下线：仅 admin/superadmin
|
||||
api.DELETE("/sessions/:id", middleware.AdminOnly(), sessionH.ForceLogout)
|
||||
}
|
||||
|
||||
// 许可证路由：豁免 LicenseGuard（锁定时仍需查看状态和激活）
|
||||
license := api.Group("/license")
|
||||
|
||||
@@ -3,6 +3,7 @@ package service
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
@@ -19,8 +20,65 @@ var (
|
||||
ErrInvalidCredentials = errors.New("invalid username or password")
|
||||
ErrUserInactive = errors.New("user is disabled")
|
||||
ErrLicenseLocked = errors.New("license locked, please renew or contact support")
|
||||
ErrPlatformNotAllowed = errors.New("该平台不允许登录")
|
||||
ErrTooManyAttempts = errors.New("登录失败次数过多，账号已临时锁定，请稍后再试")
|
||||
ErrSessionRevoked = errors.New("session revoked")
|
||||
)
|
||||
|
||||
// DeviceInfo 登录请求携带的设备信息，用于会话记录与按平台限并发。
|
||||
type DeviceInfo struct {
|
||||
DeviceID string
|
||||
DeviceName string
|
||||
Platform string
|
||||
IP string
|
||||
UserAgent string
|
||||
}
|
||||
|
||||
// loginLimiter 内存登录失败限流器（单实例，重启即清零）。
|
||||
type loginLimiter struct {
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterEntry
|
||||
}
|
||||
|
||||
type limiterEntry struct {
|
||||
failures int
|
||||
lockedTill time.Time
|
||||
}
|
||||
|
||||
var loginLim = &loginLimiter{entries: map[string]*limiterEntry{}}
|
||||
|
||||
// locked 返回该 key 是否处于锁定中。
|
||||
func (l *loginLimiter) locked(key string) bool {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
return e != nil && time.Now().Before(e.lockedTill)
|
||||
}
|
||||
|
||||
// recordFailure 记一次失败，达到阈值则锁定。
|
||||
func (l *loginLimiter) recordFailure(key string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
if e == nil {
|
||||
e = &limiterEntry{}
|
||||
l.entries[key] = e
|
||||
}
|
||||
e.failures++
|
||||
max := config.C.Session.MaxFailures
|
||||
if max > 0 && e.failures >= max {
|
||||
e.lockedTill = time.Now().Add(time.Duration(config.C.Session.LockMinutes) * time.Minute)
|
||||
e.failures = 0
|
||||
}
|
||||
}
|
||||
|
||||
// reset 登录成功后清除失败计数。
|
||||
func (l *loginLimiter) reset(key string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
delete(l.entries, key)
|
||||
}
|
||||
|
||||
type AuthService struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
@@ -37,15 +95,22 @@ type TokenPair struct {
|
||||
}
|
||||
|
||||
// Login 账号密码登录
|
||||
func (s *AuthService) Login(shopCode, username, password string) (*TokenPair, *model.User, error) {
|
||||
func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo) (*TokenPair, *model.User, error) {
|
||||
limiterKey := shopCode + "|" + username
|
||||
if loginLim.locked(limiterKey) {
|
||||
return nil, nil, ErrTooManyAttempts
|
||||
}
|
||||
|
||||
var shop model.Shop
|
||||
if err := s.db.Where("code = ?", shopCode).First(&shop).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
|
||||
var user model.User
|
||||
if err := s.db.Where("shop_id = ? AND username = ? AND deleted_at IS NULL", shop.ID, username).
|
||||
First(&user).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
|
||||
@@ -54,6 +119,7 @@ func (s *AuthService) Login(shopCode, username, password string) (*TokenPair, *m
|
||||
}
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
|
||||
@@ -61,13 +127,176 @@ func (s *AuthService) Login(shopCode, username, password string) (*TokenPair, *m
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
pair, err := s.issueTokens(user.ID, shop.ID, user.Role)
|
||||
// 按平台类限并发：取有效配额，0=禁止该平台，超额则踢最旧会话腾位。
|
||||
pclass := model.PlatformClass(dev.Platform)
|
||||
quota := s.effectiveQuota(&shop, pclass)
|
||||
if quota <= 0 {
|
||||
return nil, nil, ErrPlatformNotAllowed
|
||||
}
|
||||
|
||||
sid := uuid.New().String()
|
||||
now := time.Now()
|
||||
if err := s.db.Transaction(func(tx *gorm.DB) error {
|
||||
// 统计该 user 在该 class 的活跃会话；超额踢最旧
|
||||
var active []model.UserSession
|
||||
if err := tx.Set("gorm:query_option", "FOR UPDATE").
|
||||
Where("shop_id = ? AND user_id = ? AND platform_class = ? AND revoked_at IS NULL",
|
||||
shop.ID, user.ID, pclass).
|
||||
Order("last_seen_at ASC").Find(&active).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
// 需要腾出 (active+1) - quota 个位置
|
||||
for i := 0; i <= len(active)-quota; i++ {
|
||||
if err := tx.Model(&model.UserSession{}).Where("id = ?", active[i].ID).
|
||||
Updates(map[string]interface{}{"revoked_at": now, "revoked_reason": "kicked"}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
sess := model.UserSession{
|
||||
ShopID: shop.ID,
|
||||
UserID: user.ID,
|
||||
SID: sid,
|
||||
DeviceID: dev.DeviceID,
|
||||
DeviceName: dev.DeviceName,
|
||||
Platform: dev.Platform,
|
||||
PlatformClass: pclass,
|
||||
IP: dev.IP,
|
||||
UserAgent: dev.UserAgent,
|
||||
LastSeenAt: now,
|
||||
RefreshExpAt: now.Add(time.Duration(config.C.JWT.RefreshExpireH) * time.Hour),
|
||||
}
|
||||
if err := tx.Create(&sess).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
return tx.Model(&model.User{}).Where("id = ?", user.ID).Update("last_login_at", now).Error
|
||||
}); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
loginLim.reset(limiterKey)
|
||||
user.LastLoginAt = &now
|
||||
|
||||
pair, err := s.issueTokens(user.ID, shop.ID, user.Role, sid)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return pair, &user, nil
|
||||
}
|
||||
|
||||
// effectiveQuota 返回某店某平台类的有效并发配额：优先每店 session_policy 覆盖，否则全局默认。
|
||||
func (s *AuthService) effectiveQuota(shop *model.Shop, pclass string) int {
|
||||
def := map[string]int{
|
||||
"desktop": config.C.Session.LimitDesktop,
|
||||
"mobile": config.C.Session.LimitMobile,
|
||||
"web": config.C.Session.LimitWeb,
|
||||
}[pclass]
|
||||
|
||||
if shop.CustomFields == nil {
|
||||
return def
|
||||
}
|
||||
raw, ok := shop.CustomFields["session_policy"]
|
||||
if !ok {
|
||||
return def
|
||||
}
|
||||
policy, ok := raw.(map[string]interface{})
|
||||
if !ok {
|
||||
return def
|
||||
}
|
||||
v, ok := policy[pclass]
|
||||
if !ok {
|
||||
return def
|
||||
}
|
||||
switch n := v.(type) {
|
||||
case float64:
|
||||
return int(n)
|
||||
case int:
|
||||
return n
|
||||
default:
|
||||
return def
|
||||
}
|
||||
}
|
||||
|
||||
// Logout 撤销指定会话（用户主动登出）。sid 为空（存量 token）时为 no-op。
|
||||
func (s *AuthService) Logout(sid string) error {
|
||||
if sid == "" {
|
||||
return nil
|
||||
}
|
||||
return s.db.Model(&model.UserSession{}).
|
||||
Where("sid = ? AND revoked_at IS NULL", sid).
|
||||
Updates(map[string]interface{}{"revoked_at": time.Now(), "revoked_reason": "logout"}).Error
|
||||
}
|
||||
|
||||
// SessionView 在线会话视图（含用户名，供管理端列表展示）。
|
||||
type SessionView struct {
|
||||
ID uint64 `json:"id"`
|
||||
UserID uint64 `json:"user_id"`
|
||||
Username string `json:"username"`
|
||||
RealName string `json:"real_name"`
|
||||
Platform string `json:"platform"`
|
||||
PlatformClass string `json:"platform_class"`
|
||||
DeviceName string `json:"device_name"`
|
||||
IP string `json:"ip"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
LastSeenAt time.Time `json:"last_seen_at"`
|
||||
Online bool `json:"online"`
|
||||
IsCurrent bool `json:"is_current"`
|
||||
}
|
||||
|
||||
// OnlineThreshold last_seen 在此时间内视为在线。
|
||||
const OnlineThreshold = 90 * time.Second
|
||||
|
||||
// ListSessions 列出本店活跃（未撤销）会话，按最近活跃排序。currentSID 标记当前请求自身会话。
|
||||
func (s *AuthService) ListSessions(shopID uint64, currentSID string) ([]SessionView, error) {
|
||||
var rows []struct {
|
||||
model.UserSession
|
||||
Username string
|
||||
RealName string
|
||||
}
|
||||
err := s.db.Table("user_sessions AS s").
|
||||
Select("s.*, u.username AS username, u.real_name AS real_name").
|
||||
Joins("LEFT JOIN users u ON u.id = s.user_id").
|
||||
Where("s.shop_id = ? AND s.revoked_at IS NULL", shopID).
|
||||
Order("s.last_seen_at DESC").
|
||||
Scan(&rows).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
now := time.Now()
|
||||
views := make([]SessionView, 0, len(rows))
|
||||
for _, r := range rows {
|
||||
views = append(views, SessionView{
|
||||
ID: r.ID,
|
||||
UserID: r.UserID,
|
||||
Username: r.Username,
|
||||
RealName: r.RealName,
|
||||
Platform: r.Platform,
|
||||
PlatformClass: r.PlatformClass,
|
||||
DeviceName: r.DeviceName,
|
||||
IP: r.IP,
|
||||
CreatedAt: r.CreatedAt,
|
||||
LastSeenAt: r.LastSeenAt,
|
||||
Online: now.Sub(r.LastSeenAt) <= OnlineThreshold,
|
||||
IsCurrent: currentSID != "" && r.SID == currentSID,
|
||||
})
|
||||
}
|
||||
return views, nil
|
||||
}
|
||||
|
||||
// ForceLogout 管理员强制下线本店某会话（按 id + shop_id 隔离）。
|
||||
func (s *AuthService) ForceLogout(shopID, sessionID uint64) error {
|
||||
res := s.db.Model(&model.UserSession{}).
|
||||
Where("id = ? AND shop_id = ? AND revoked_at IS NULL", sessionID, shopID).
|
||||
Updates(map[string]interface{}{"revoked_at": time.Now(), "revoked_reason": "admin"})
|
||||
if res.Error != nil {
|
||||
return res.Error
|
||||
}
|
||||
if res.RowsAffected == 0 {
|
||||
return gorm.ErrRecordNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RegisterInput 注册新门店所需参数
|
||||
type RegisterInput struct {
|
||||
ShopName string `json:"shop_name" binding:"required"`
|
||||
@@ -146,7 +375,8 @@ func HashPassword(plain string) (string, error) {
|
||||
return string(b), err
|
||||
}
|
||||
|
||||
// RefreshTokens 用 Refresh Token 换新 Token Pair
|
||||
// RefreshTokens 用 Refresh Token 换新 Token Pair。
|
||||
// 修复历史漏洞：续期时重新查库校验用户/会话状态，被禁用或被踢的用户无法再续命。
|
||||
func (s *AuthService) RefreshTokens(refreshToken string) (*TokenPair, error) {
|
||||
claims := &middleware.Claims{}
|
||||
token, err := jwt.ParseWithClaims(refreshToken, claims, func(t *jwt.Token) (interface{}, error) {
|
||||
@@ -155,7 +385,35 @@ func (s *AuthService) RefreshTokens(refreshToken string) (*TokenPair, error) {
|
||||
if err != nil || !token.Valid {
|
||||
return nil, errors.New("invalid refresh token")
|
||||
}
|
||||
return s.issueTokens(claims.UserID, claims.ShopID, claims.Role)
|
||||
|
||||
// 带 sid 的 token 必须对应未撤销会话（被踢/登出后无法续期）。
|
||||
if claims.SID != "" {
|
||||
var sess model.UserSession
|
||||
if err := s.db.Where("sid = ?", claims.SID).First(&sess).Error; err != nil || sess.RevokedAt != nil {
|
||||
return nil, ErrSessionRevoked
|
||||
}
|
||||
}
|
||||
|
||||
// 重新加载用户：不存在或已禁用 → 拒绝续期（修复漏洞）。
|
||||
var user model.User
|
||||
if err := s.db.Where("id = ? AND deleted_at IS NULL", claims.UserID).First(&user).Error; err != nil {
|
||||
return nil, ErrInvalidCredentials
|
||||
}
|
||||
if !user.IsActive {
|
||||
return nil, ErrUserInactive
|
||||
}
|
||||
|
||||
if err := s.checkLicenseNotLocked(user.ShopID); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// 刷新会话存活时间（同 sid 续期）。
|
||||
if claims.SID != "" {
|
||||
s.db.Model(&model.UserSession{}).Where("sid = ?", claims.SID).
|
||||
Update("last_seen_at", time.Now())
|
||||
}
|
||||
|
||||
return s.issueTokens(user.ID, user.ShopID, user.Role, claims.SID)
|
||||
}
|
||||
|
||||
func (s *AuthService) checkLicenseNotLocked(shopID uint64) error {
|
||||
@@ -170,7 +428,7 @@ func (s *AuthService) checkLicenseNotLocked(shopID uint64) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *AuthService) issueTokens(userID, shopID uint64, role string) (*TokenPair, error) {
|
||||
func (s *AuthService) issueTokens(userID, shopID uint64, role, sid string) (*TokenPair, error) {
|
||||
cfg := config.C.JWT
|
||||
now := time.Now()
|
||||
|
||||
@@ -188,6 +446,7 @@ func (s *AuthService) issueTokens(userID, shopID uint64, role string) (*TokenPai
|
||||
UserID: userID,
|
||||
ShopID: shopID,
|
||||
Role: role,
|
||||
SID: sid,
|
||||
LicenseExpiresAt: licExpAt,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(accessExp),
|
||||
@@ -204,6 +463,7 @@ func (s *AuthService) issueTokens(userID, shopID uint64, role string) (*TokenPai
|
||||
UserID: userID,
|
||||
ShopID: shopID,
|
||||
Role: role,
|
||||
SID: sid,
|
||||
LicenseExpiresAt: licExpAt,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(refreshExp),
|
||||
|
||||
@@ -15,7 +15,7 @@ func TestAuthService_Login_Success(t *testing.T) {
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, user, err := svc.Login("HOTEL001", "admin", "password123")
|
||||
pair, user, err := svc.Login("HOTEL001", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, pair)
|
||||
@@ -31,7 +31,7 @@ func TestAuthService_Login_WrongPassword(t *testing.T) {
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, user, err := svc.Login("HOTEL002", "admin", "wrongpassword")
|
||||
pair, user, err := svc.Login("HOTEL002", "admin", "wrongpassword", DeviceInfo{Platform: "windows"})
|
||||
|
||||
assert.Error(t, err)
|
||||
assert.Equal(t, ErrInvalidCredentials, err)
|
||||
@@ -44,7 +44,7 @@ func TestAuthService_Login_WrongHotel(t *testing.T) {
|
||||
testutil.CreateTestShop(db, "HOTEL003")
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, user, err := svc.Login("NONEXISTENT", "admin", "password123")
|
||||
pair, user, err := svc.Login("NONEXISTENT", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
|
||||
assert.Error(t, err)
|
||||
assert.Equal(t, ErrInvalidCredentials, err)
|
||||
@@ -60,7 +60,7 @@ func TestAuthService_Login_DisabledUser(t *testing.T) {
|
||||
db.Model(user).Update("is_active", false)
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, u, err := svc.Login("HOTEL004", "disabled", "password123")
|
||||
pair, u, err := svc.Login("HOTEL004", "disabled", "password123", DeviceInfo{Platform: "windows"})
|
||||
|
||||
assert.Error(t, err)
|
||||
assert.Equal(t, ErrUserInactive, err)
|
||||
@@ -74,7 +74,7 @@ func TestAuthService_Login_WrongUsername(t *testing.T) {
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, user, err := svc.Login("HOTEL005", "nonexistent", "password123")
|
||||
pair, user, err := svc.Login("HOTEL005", "nonexistent", "password123", DeviceInfo{Platform: "windows"})
|
||||
|
||||
assert.Error(t, err)
|
||||
assert.Equal(t, ErrInvalidCredentials, err)
|
||||
@@ -88,7 +88,7 @@ func TestAuthService_RefreshTokens(t *testing.T) {
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
|
||||
svc := NewAuthService(db)
|
||||
pair, _, err := svc.Login("HOTEL006", "admin", "password123")
|
||||
pair, _, err := svc.Login("HOTEL006", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, pair)
|
||||
|
||||
|
||||
@@ -0,0 +1,169 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
"github.com/wangjia/jiu/backend/internal/model"
|
||||
"github.com/wangjia/jiu/backend/testutil"
|
||||
)
|
||||
|
||||
// 同平台类超配额时踢掉最旧会话。
|
||||
func TestLogin_PerClassQuota_KicksOldest(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS01")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
dev := DeviceInfo{Platform: "windows"}
|
||||
p1, _, err := svc.Login("SESS01", "admin", "password123", dev)
|
||||
require.NoError(t, err)
|
||||
p2, _, err := svc.Login("SESS01", "admin", "password123", dev)
|
||||
require.NoError(t, err)
|
||||
// 配额 2，第 3 次桌面端登录应踢掉最旧（p1）
|
||||
_, _, err = svc.Login("SESS01", "admin", "password123", dev)
|
||||
require.NoError(t, err)
|
||||
|
||||
// 共 2 个未撤销会话
|
||||
var active int64
|
||||
db.Model(&model.UserSession{}).Where("shop_id = ? AND revoked_at IS NULL", shop.ID).Count(&active)
|
||||
assert.Equal(t, int64(2), active)
|
||||
|
||||
// p1 的 refresh 应失败（会话被踢）
|
||||
_, err = svc.RefreshTokens(p1.RefreshToken)
|
||||
assert.ErrorIs(t, err, ErrSessionRevoked)
|
||||
// p2 仍可续期
|
||||
_, err = svc.RefreshTokens(p2.RefreshToken)
|
||||
assert.NoError(t, err)
|
||||
}
|
||||
|
||||
// 移动端与桌面端配额互不影响。
|
||||
func TestLogin_QuotaIsolatedByClass(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS02")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
_, _, err := svc.Login("SESS02", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
_, _, err = svc.Login("SESS02", "admin", "password123", DeviceInfo{Platform: "android"})
|
||||
require.NoError(t, err)
|
||||
|
||||
var active int64
|
||||
db.Model(&model.UserSession{}).Where("shop_id = ? AND revoked_at IS NULL", shop.ID).Count(&active)
|
||||
assert.Equal(t, int64(2), active) // 桌面 1 + 移动 1，都没被踢
|
||||
}
|
||||
|
||||
// 配额为 0 的平台拒绝登录（如禁 web）。
|
||||
func TestLogin_PlatformDisabled(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS03")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
old := config.C.Session.LimitWeb
|
||||
config.C.Session.LimitWeb = 0
|
||||
defer func() { config.C.Session.LimitWeb = old }()
|
||||
|
||||
_, _, err := svc.Login("SESS03", "admin", "password123", DeviceInfo{Platform: "web"})
|
||||
assert.ErrorIs(t, err, ErrPlatformNotAllowed)
|
||||
}
|
||||
|
||||
// 每店 session_policy 覆盖全局默认。
|
||||
func TestLogin_PerShopPolicyOverride(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS04")
|
||||
// 该店限桌面 1
|
||||
db.Model(&model.Shop{}).Where("id = ?", shop.ID).
|
||||
Update("custom_fields", model.JSON{"session_policy": map[string]interface{}{"desktop": float64(1)}})
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
p1, _, err := svc.Login("SESS04", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
_, _, err = svc.Login("SESS04", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
|
||||
// 第 2 次登录应把 p1 踢掉（配额 1）
|
||||
_, err = svc.RefreshTokens(p1.RefreshToken)
|
||||
assert.ErrorIs(t, err, ErrSessionRevoked)
|
||||
}
|
||||
|
||||
// 被禁用用户无法用 refresh token 续命（修复历史漏洞）。
|
||||
func TestRefresh_DisabledUserRejected(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS05")
|
||||
user := testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
pair, _, err := svc.Login("SESS05", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
|
||||
db.Model(user).Update("is_active", false)
|
||||
|
||||
_, err = svc.RefreshTokens(pair.RefreshToken)
|
||||
assert.ErrorIs(t, err, ErrUserInactive)
|
||||
}
|
||||
|
||||
// 管理员强制下线后，该会话 token 无法续期。
|
||||
func TestForceLogout_RevokesSession(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS06")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
pair, _, err := svc.Login("SESS06", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
|
||||
views, err := svc.ListSessions(shop.ID, "")
|
||||
require.NoError(t, err)
|
||||
require.Len(t, views, 1)
|
||||
assert.True(t, views[0].Online)
|
||||
|
||||
require.NoError(t, svc.ForceLogout(shop.ID, views[0].ID))
|
||||
|
||||
_, err = svc.RefreshTokens(pair.RefreshToken)
|
||||
assert.ErrorIs(t, err, ErrSessionRevoked)
|
||||
|
||||
// 列表中不再出现
|
||||
views, err = svc.ListSessions(shop.ID, "")
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, views, 0)
|
||||
}
|
||||
|
||||
// 强制下线跨店隔离：不能下线别店会话。
|
||||
func TestForceLogout_TenantIsolation(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shopA := testutil.CreateTestShop(db, "SESS07A")
|
||||
shopB := testutil.CreateTestShop(db, "SESS07B")
|
||||
testutil.CreateTestUser(db, shopA.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
_, _, err := svc.Login("SESS07A", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
require.NoError(t, err)
|
||||
views, _ := svc.ListSessions(shopA.ID, "")
|
||||
require.Len(t, views, 1)
|
||||
|
||||
// 用 shopB 的 shopID 尝试下线 shopA 的会话 → 找不到
|
||||
err = svc.ForceLogout(shopB.ID, views[0].ID)
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
// 连续登录失败达到阈值后锁定。
|
||||
func TestLogin_LockoutAfterFailures(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "SESS08")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
svc := NewAuthService(db)
|
||||
|
||||
for i := 0; i < config.C.Session.MaxFailures; i++ {
|
||||
_, _, err := svc.Login("SESS08", "admin", "wrong", DeviceInfo{Platform: "windows"})
|
||||
assert.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
// 锁定后即便密码正确也被拒
|
||||
_, _, err := svc.Login("SESS08", "admin", "password123", DeviceInfo{Platform: "windows"})
|
||||
assert.ErrorIs(t, err, ErrTooManyAttempts)
|
||||
}
|
||||
@@ -97,6 +97,7 @@ func autoMigrate(db *gorm.DB) {
|
||||
&model.User{},
|
||||
&model.License{},
|
||||
&model.LicenseDevice{},
|
||||
&model.UserSession{},
|
||||
&model.ProductCategory{},
|
||||
&model.Product{},
|
||||
&model.Warehouse{},
|
||||
|
||||
@@ -42,6 +42,7 @@ CREATE TABLE IF NOT EXISTS `users` (
|
||||
`phone` VARCHAR(30) DEFAULT NULL,
|
||||
`role` ENUM('admin','operator','readonly','superadmin') NOT NULL DEFAULT 'operator',
|
||||
`is_active` TINYINT(1) NOT NULL DEFAULT 1,
|
||||
`last_login_at` DATETIME DEFAULT NULL COMMENT '最近登录时间',
|
||||
`custom_fields` JSON DEFAULT NULL,
|
||||
`created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
`updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
@@ -52,6 +53,32 @@ CREATE TABLE IF NOT EXISTS `users` (
|
||||
KEY `idx_deleted_at` (`deleted_at`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户';
|
||||
|
||||
-- ------------------------------------------------------------
|
||||
-- 登录会话（支持登出/踢人/在线状态监控；JWT 的 sid claim 指向此表）
|
||||
-- ------------------------------------------------------------
|
||||
CREATE TABLE IF NOT EXISTS `user_sessions` (
|
||||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||||
`shop_id` BIGINT UNSIGNED NOT NULL,
|
||||
`user_id` BIGINT UNSIGNED NOT NULL,
|
||||
`sid` VARCHAR(64) NOT NULL COMMENT '嵌入 JWT 的会话标识',
|
||||
`device_id` VARCHAR(255) DEFAULT NULL,
|
||||
`device_name` VARCHAR(255) DEFAULT NULL,
|
||||
`platform` VARCHAR(50) DEFAULT NULL COMMENT 'windows|macos|linux|android|ios|web',
|
||||
`platform_class` VARCHAR(20) DEFAULT NULL COMMENT 'desktop|mobile|web',
|
||||
`ip` VARCHAR(64) DEFAULT NULL,
|
||||
`user_agent` VARCHAR(512) DEFAULT NULL,
|
||||
`created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
`last_seen_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
`revoked_at` DATETIME DEFAULT NULL,
|
||||
`revoked_reason` VARCHAR(30) DEFAULT NULL COMMENT 'kicked|logout|admin|disabled',
|
||||
`refresh_exp_at` DATETIME DEFAULT NULL,
|
||||
PRIMARY KEY (`id`),
|
||||
UNIQUE KEY `uk_session_sid` (`sid`),
|
||||
KEY `idx_session_shop_user` (`shop_id`, `user_id`),
|
||||
KEY `idx_session_class` (`platform_class`),
|
||||
KEY `idx_session_revoked` (`revoked_at`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='登录会话';
|
||||
|
||||
-- ------------------------------------------------------------
|
||||
-- 许可证
|
||||
-- ------------------------------------------------------------
|
||||
|
||||
@@ -30,6 +30,13 @@ func InitConfig() {
|
||||
License: config.LicenseConfig{
|
||||
HMACSecret: "test-license-hmac-secret",
|
||||
},
|
||||
Session: config.SessionConfig{
|
||||
LimitDesktop: 2,
|
||||
LimitMobile: 2,
|
||||
LimitWeb: 2,
|
||||
MaxFailures: 5,
|
||||
LockMinutes: 15,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
@@ -76,9 +83,27 @@ func SetupTestDB() *gorm.DB {
|
||||
phone TEXT,
|
||||
role TEXT DEFAULT 'operator',
|
||||
is_active INTEGER DEFAULT 1,
|
||||
last_login_at DATETIME,
|
||||
custom_fields TEXT
|
||||
)`,
|
||||
`CREATE UNIQUE INDEX IF NOT EXISTS uk_shop_username ON users(shop_id, username)`,
|
||||
`CREATE TABLE IF NOT EXISTS user_sessions (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
shop_id INTEGER NOT NULL,
|
||||
user_id INTEGER NOT NULL,
|
||||
sid TEXT NOT NULL UNIQUE,
|
||||
device_id TEXT,
|
||||
device_name TEXT,
|
||||
platform TEXT,
|
||||
platform_class TEXT,
|
||||
ip TEXT,
|
||||
user_agent TEXT,
|
||||
created_at DATETIME,
|
||||
last_seen_at DATETIME,
|
||||
revoked_at DATETIME,
|
||||
revoked_reason TEXT,
|
||||
refresh_exp_at DATETIME
|
||||
)`,
|
||||
`CREATE TABLE IF NOT EXISTS licenses (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
created_at DATETIME,
|
||||
|
||||
Reference in New Issue
Block a user