kra-new/internal/service/authentication.go

78 lines
2.8 KiB
Go

package service
import (
"context"
"time"
"kra/internal/biz"
"kra/pkg/adminauth"
)
type UserDisabledError struct{ UserID uint }
func (e *UserDisabledError) Error() string { return biz.ErrUserDisabled.Error() }
func (e *UserDisabledError) Unwrap() error { return biz.ErrUserDisabled }
type LoginResult struct {
User map[string]any `json:"user"`
Token string `json:"token"`
ExpiresAt int64 `json:"expiresAt"`
NeedChangePassword bool `json:"needChangePassword"`
}
func (s *SystemService) CacheGet(ctx context.Context, key string) (string, bool, error) {
return s.uc.CacheGet(ctx, key)
}
func (s *SystemService) CacheSet(ctx context.Context, key, value string, expiration time.Duration) error {
return s.uc.CacheSet(ctx, key, value, expiration)
}
func (s *SystemService) CacheDelete(ctx context.Context, key string) error {
return s.uc.CacheDelete(ctx, key)
}
func (s *SystemService) CacheIncrement(ctx context.Context, key string, expiration time.Duration) (int64, error) {
return s.uc.CacheIncrement(ctx, key, expiration)
}
func (s *SystemService) Login(ctx context.Context, username, password string) (*LoginResult, error) {
u, err := s.uc.Login(ctx, username, password)
if err != nil {
return nil, err
}
if u.Enable != 1 {
return nil, &UserDisabledError{UserID: u.ID}
}
if security, securityErr := s.settings.CurrentSecurity(ctx); securityErr == nil && security.PwdExpireEnable && u.PasswordUpdatedAt != nil && time.Since(*u.PasswordUpdatedAt) > time.Duration(security.PwdExpireDays)*24*time.Hour {
u.MustChangePassword = true
}
return s.issueLogin(ctx, u, u.AuthorityID)
}
func (s *SystemService) issueLogin(ctx context.Context, user *biz.User, authorityID uint) (*LoginResult, error) {
expires, buffer := 7*24*time.Hour, 24*time.Hour
secret, issuer := "", "kra"
config := s.runtime.Admin()
if config != nil && config.Jwt != nil {
secret, issuer = config.Jwt.SigningKey, config.Jwt.Issuer
if config.Jwt.ExpiresTime != nil {
expires = config.Jwt.ExpiresTime.AsDuration()
}
if config.Jwt.BufferTime != nil {
buffer = config.Jwt.BufferTime.AsDuration()
}
}
token, claims, err := adminauth.Generate(secret, issuer, expires, buffer, user.ID, authorityID, user.UUID, user.Username, user.NickName, user.MustChangePassword)
if err != nil {
return nil, err
}
if s.settings.UseMultipoint() {
oldToken, _, cacheErr := s.settings.cache.Get(ctx, activeTokenKey(user.Username))
if cacheErr != nil {
return nil, cacheErr
}
if cacheErr = s.settings.RotateActiveToken(ctx, user.Username, oldToken, token, expires); cacheErr != nil {
return nil, cacheErr
}
}
return &LoginResult{User: convertUser(user), Token: token, ExpiresAt: claims.ExpiresAt.UnixMilli(), NeedChangePassword: user.MustChangePassword}, nil
}