wangjia
a5e25b444f
实现 server/internal/auth 控制面鉴权底座，对应 doc/02 §4.1、doc/06 §3：
- POST /v1/auth/code：IP+邮箱双维度 Redis 滑窗限频（同邮箱 1/min、同 IP 10/h）
+ 一次性邮箱域黑名单（embed 词表）→ 6 位数字码写 auth:code:{email} TTL 10min
→ 异步发信（SMTP / 开发态 log mailer）。
- POST /v1/auth/register：验码（一次性，删 key；超次数烧码）→ 单事务建号
（uuid + dp_uuid 应用层生成、argon2id）+ 7 天 PRO 试用（source='trial'）→ 签发 JWT。
- POST /v1/auth/login：argon2id 校验（失败恒定时、未知用户走 dummy hash）；
失败计数限流 rl:login:{email} + 锁定；banned 拒绝。
- POST /v1/auth/refresh：RS256，access 15min + refresh 30d 落 Redis 白名单
jwt:refresh:{jti}，旋转时删旧写新；JWT 头带 kid，验证端接受新旧公钥支持轮换。
- RequireAuth 中间件：解析 Bearer access，注入 user id（复用 codes.CtxKeyUserID
避免循环依赖）+ uuid + claims 到 context。
- 错误体统一走 internal/apierr 的 {code, message_zh, message_en}，文案双语脱敏。
- 文件拆分：handler/service/password/token/ratelimit/emailcheck/store/mailer/
middleware/errors/keyloader；config 增加可选 JWT PEM 路径/kid 加载。
测试：password/token/ratelimit/emailcheck/service/handler/middleware 单测
（miniredis，含注册全流程、重复邮箱 409、验证码错误/过期/复用/烧码、限频 429
带 Retry-After、登录失败锁定、banned 拒绝、refresh 旋转后旧 token 失效），
go test -race 通过；集成测试 integration_test.go（testcontainers MySQL8+Redis，
register→login→refresh→受保护接口全链路，构建 tag integration）与 codes 模块同构。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
69 lines
1.9 KiB
Go
69 lines
1.9 KiB
Go
package auth
|
|
|
|
import (
|
|
_ "embed"
|
|
"strings"
|
|
)
|
|
|
|
//go:embed disposable_domains.txt
|
|
var disposableList string
|
|
|
|
// disposableDomains is the parsed blocklist, built once at package init.
|
|
var disposableDomains = parseDisposable(disposableList)
|
|
|
|
// parseDisposable turns the embedded wordlist into a lookup set.
|
|
func parseDisposable(raw string) map[string]struct{} {
|
|
set := make(map[string]struct{})
|
|
for _, line := range strings.Split(raw, "\n") {
|
|
line = strings.TrimSpace(strings.ToLower(line))
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
set[line] = struct{}{}
|
|
}
|
|
return set
|
|
}
|
|
|
|
// NormalizeEmail lowercases and trims the address for consistent storage and
|
|
// rate-limit keying. It does not alter the local part beyond trimming.
|
|
func NormalizeEmail(email string) string {
|
|
return strings.ToLower(strings.TrimSpace(email))
|
|
}
|
|
|
|
// emailDomain returns the lowercased domain part of an email, or "" if the
|
|
// address has no single '@'.
|
|
func emailDomain(email string) string {
|
|
at := strings.LastIndex(email, "@")
|
|
if at < 0 || at == len(email)-1 {
|
|
return ""
|
|
}
|
|
return strings.ToLower(email[at+1:])
|
|
}
|
|
|
|
// ValidEmail performs a cheap structural sanity check: exactly one '@', a
|
|
// non-empty local part, and a domain containing a dot. It is deliberately
|
|
// permissive — true deliverability is proven by the verification code.
|
|
func ValidEmail(email string) bool {
|
|
email = strings.TrimSpace(email)
|
|
if len(email) < 3 || len(email) > 254 {
|
|
return false
|
|
}
|
|
at := strings.IndexByte(email, '@')
|
|
if at <= 0 || at != strings.LastIndexByte(email, '@') {
|
|
return false
|
|
}
|
|
domain := email[at+1:]
|
|
return strings.Contains(domain, ".") && !strings.HasPrefix(domain, ".") && !strings.HasSuffix(domain, ".")
|
|
}
|
|
|
|
// IsDisposable reports whether the email's domain is on the disposable-domain
|
|
// blocklist.
|
|
func IsDisposable(email string) bool {
|
|
domain := emailDomain(email)
|
|
if domain == "" {
|
|
return false
|
|
}
|
|
_, ok := disposableDomains[domain]
|
|
return ok
|
|
}
|