feat: live module and jenkins pipeline to harbor deploy

internal/biz/system/authentication.go

@@ -129,6 +129,69 @@ func (uc *AuthenticationUsecase) Login(ctx context.Context, attempt *LoginAttemp
 	}
 
 	uc.security.ClearLoginState(ctx, attempt.Username)
+	return uc.issueAuthenticatedUser(ctx, user, attempt)
+}
+
+// LoginClient authenticates the public live client without the administration
+// captcha challenge. Account locking, credential checks, audit logging and
+// multipoint-session rotation still use the same security policy as the admin
+// login flow.
+func (uc *AuthenticationUsecase) LoginClient(ctx context.Context, attempt *LoginAttempt) (*AuthenticationResult, error) {
+	config, err := uc.security.Current(ctx)
+	if err != nil || config == nil {
+		return nil, fmt.Errorf("%w: security config unavailable", ErrLoginState)
+	}
+	if config.LockEnable {
+		locked, lockErr := uc.security.LoginLocked(ctx, attempt.Username)
+		if lockErr != nil {
+			return nil, fmt.Errorf("%w: %v", ErrLoginState, lockErr)
+		}
+		if locked {
+			uc.recordLogin(ctx, attempt, false, "账号已锁定", 0)
+			return nil, &AccountLockedError{Minutes: config.LockDuration}
+		}
+	}
+	user, err := uc.users.Login(ctx, attempt.Username, attempt.Password)
+	if err != nil {
+		if config.LockEnable {
+			lockTTL := time.Duration(config.LockDuration) * time.Minute
+			failures, stateErr := uc.security.IncrementLoginFailure(ctx, attempt.Username, lockTTL)
+			if stateErr != nil {
+				return nil, fmt.Errorf("%w: %v", ErrLoginState, stateErr)
+			}
+			if int(failures) >= config.LockThreshold {
+				if stateErr = uc.security.LockLogin(ctx, attempt.Username, lockTTL); stateErr != nil {
+					return nil, fmt.Errorf("%w: %v", ErrLoginState, stateErr)
+				}
+			}
+		}
+		uc.recordLogin(ctx, attempt, false, "用户名不存在或者密码错误", 0)
+		return nil, ErrInvalidCredentials
+	}
+	if user.Enable != 1 {
+		uc.recordLogin(ctx, attempt, false, "用户被禁止登录", user.ID)
+		return nil, &UserDisabledError{UserID: user.ID}
+	}
+	uc.security.ClearLoginState(ctx, attempt.Username)
+	return uc.issueAuthenticatedUser(ctx, user, attempt)
+}
+
+// AuthenticateRegisteredUser issues the first session immediately after a
+// client registration. Credential verification has already succeeded by
+// creating the account, so this method only applies the common token/session
+// rules.
+func (uc *AuthenticationUsecase) AuthenticateRegisteredUser(ctx context.Context, user *User, ip, agent string) (*AuthenticationResult, error) {
+	if user == nil || user.ID == 0 || user.Enable != 1 {
+		return nil, ErrInvalidCredentials
+	}
+	return uc.issueAuthenticatedUser(ctx, user, &LoginAttempt{Username: user.Username, IP: ip, Agent: agent})
+}
+
+func (uc *AuthenticationUsecase) issueAuthenticatedUser(ctx context.Context, user *User, attempt *LoginAttempt) (*AuthenticationResult, error) {
+	config, err := uc.security.Current(ctx)
+	if err != nil || config == nil {
+		return nil, fmt.Errorf("%w: security config unavailable", ErrLoginState)
+	}
 	if passwordExpired(config, user) {
 		user.MustChangePassword = true
 	}