447 lines
16 KiB
C#
447 lines
16 KiB
C#
using System.IdentityModel.Tokens.Jwt;
|
||
using System.Security.Claims;
|
||
using System.Security.Cryptography;
|
||
using System.Text;
|
||
using HoneyBox.Admin.Data;
|
||
using HoneyBox.Admin.Entities;
|
||
using HoneyBox.Admin.Models.Auth;
|
||
using HoneyBox.Admin.Models.Common;
|
||
using Microsoft.EntityFrameworkCore;
|
||
using Microsoft.Extensions.Configuration;
|
||
using Microsoft.IdentityModel.Tokens;
|
||
|
||
namespace HoneyBox.Admin.Services;
|
||
|
||
/// <summary>
|
||
/// 认证服务实现
|
||
/// </summary>
|
||
public class AuthService : IAuthService
|
||
{
|
||
private readonly AdminDbContext _dbContext;
|
||
private readonly IConfiguration _configuration;
|
||
private readonly ILogger<AuthService> _logger;
|
||
private readonly ICaptchaService _captchaService;
|
||
|
||
// 登录失败锁定配置
|
||
private const int MaxFailedAttempts = 5;
|
||
private const int LockoutMinutes = 30;
|
||
|
||
// Token配置
|
||
private const int RefreshTokenExpirationDays = 7;
|
||
private const int AccessTokenExpirationMinutes = 30;
|
||
|
||
public AuthService(
|
||
AdminDbContext dbContext,
|
||
IConfiguration configuration,
|
||
ILogger<AuthService> logger,
|
||
ICaptchaService captchaService)
|
||
{
|
||
_dbContext = dbContext;
|
||
_configuration = configuration;
|
||
_logger = logger;
|
||
_captchaService = captchaService;
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task<LoginResponse> LoginAsync(LoginRequest request, string ipAddress)
|
||
{
|
||
// 1. 首先验证验证码（优先于密码校验）临时注释，上线在启用
|
||
#if !DEBUG
|
||
if (!_captchaService.Validate(request.CaptchaKey, request.CaptchaCode))
|
||
{
|
||
_logger.LogWarning("登录失败：验证码错误或已过期，用户名: {Username}", request.Username);
|
||
throw new AdminException(AdminErrorCodes.CaptchaInvalid, "验证码错误或已过期");
|
||
}
|
||
#endif
|
||
|
||
// 2. 查找用户
|
||
var user = await _dbContext.AdminUsers
|
||
.Include(u => u.Department)
|
||
.Include(u => u.AdminUserRoles)
|
||
.ThenInclude(ur => ur.Role)
|
||
.FirstOrDefaultAsync(u => u.Username == request.Username);
|
||
|
||
if (user == null)
|
||
{
|
||
_logger.LogWarning("登录失败：用户 {Username} 不存在", request.Username);
|
||
throw new AdminException(AdminErrorCodes.InvalidCredentials, "用户名或密码错误");
|
||
}
|
||
|
||
// 3. 检查账户是否被锁定
|
||
if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.Now)
|
||
{
|
||
var remainingMinutes = (int)(user.LockoutEnd.Value - DateTime.Now).TotalMinutes + 1;
|
||
_logger.LogWarning("登录失败：用户 {Username} 账户已锁定，剩余 {Minutes} 分钟", request.Username, remainingMinutes);
|
||
throw new AdminException(AdminErrorCodes.AccountLocked, $"账户已锁定，请在 {remainingMinutes} 分钟后重试");
|
||
}
|
||
|
||
// 4. 检查账户状态
|
||
if (user.Status == 0)
|
||
{
|
||
_logger.LogWarning("登录失败：用户 {Username} 账户已禁用", request.Username);
|
||
throw new AdminException(AdminErrorCodes.AccountDisabled, "账户已禁用");
|
||
}
|
||
|
||
// 5. 验证密码
|
||
if (!VerifyPassword(request.Password, user.PasswordHash))
|
||
{
|
||
// 增加失败次数
|
||
user.LoginFailCount++;
|
||
|
||
// 检查是否需要锁定账户
|
||
if (user.LoginFailCount >= MaxFailedAttempts)
|
||
{
|
||
user.LockoutEnd = DateTime.Now.AddMinutes(LockoutMinutes);
|
||
user.LoginFailCount = 0;
|
||
_logger.LogWarning("用户 {Username} 登录失败次数过多，账户已锁定 {Minutes} 分钟", request.Username, LockoutMinutes);
|
||
}
|
||
|
||
await _dbContext.SaveChangesAsync();
|
||
|
||
var remainingAttempts = MaxFailedAttempts - user.LoginFailCount;
|
||
_logger.LogWarning("登录失败：用户 {Username} 密码错误，剩余尝试次数 {Remaining}", request.Username, remainingAttempts);
|
||
throw new AdminException(AdminErrorCodes.InvalidCredentials, "用户名或密码错误");
|
||
}
|
||
|
||
// 6. 登录成功，重置失败次数
|
||
user.LoginFailCount = 0;
|
||
user.LockoutEnd = null;
|
||
user.LastLoginTime = DateTime.Now;
|
||
user.LastLoginIp = ipAddress;
|
||
|
||
// 7. 生成双Token
|
||
var expireMinutes = _configuration.GetValue<int>("Jwt:ExpireMinutes", AccessTokenExpirationMinutes);
|
||
var accessToken = GenerateJwtToken(user, expireMinutes);
|
||
var (refreshToken, refreshTokenEntity) = GenerateRefreshToken(user.Id, ipAddress);
|
||
|
||
// 8. 保存RefreshToken到数据库
|
||
_dbContext.RefreshTokens.Add(refreshTokenEntity);
|
||
await _dbContext.SaveChangesAsync();
|
||
|
||
// 9. 获取用户角色和权限
|
||
var roles = user.AdminUserRoles
|
||
.Where(ur => ur.Role.Status == 1)
|
||
.Select(ur => ur.Role.Code)
|
||
.ToList();
|
||
|
||
var permissions = await GetUserPermissionsAsync(user.Id);
|
||
|
||
_logger.LogInformation("用户 {Username} 登录成功，IP: {IpAddress}", request.Username, ipAddress);
|
||
|
||
return new LoginResponse
|
||
{
|
||
AccessToken = accessToken,
|
||
RefreshToken = refreshToken,
|
||
ExpiresIn = expireMinutes * 60,
|
||
UserInfo = new AdminUserInfo
|
||
{
|
||
Id = user.Id,
|
||
Username = user.Username,
|
||
RealName = user.RealName,
|
||
Avatar = user.Avatar,
|
||
Email = user.Email,
|
||
Phone = user.Phone,
|
||
DepartmentId = user.DepartmentId,
|
||
DepartmentName = user.Department?.Name,
|
||
Roles = roles,
|
||
Permissions = permissions
|
||
}
|
||
};
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task<RefreshTokenResponse> RefreshTokenAsync(string refreshToken, string ipAddress)
|
||
{
|
||
// 1. 计算Token哈希
|
||
var tokenHash = HashToken(refreshToken);
|
||
|
||
// 2. 查找Token
|
||
var storedToken = await _dbContext.RefreshTokens
|
||
.Include(t => t.AdminUser)
|
||
.ThenInclude(u => u.AdminUserRoles)
|
||
.ThenInclude(ur => ur.Role)
|
||
.FirstOrDefaultAsync(t => t.TokenHash == tokenHash);
|
||
|
||
if (storedToken == null)
|
||
{
|
||
_logger.LogWarning("Token刷新失败：Token不存在");
|
||
throw new AdminException(AdminErrorCodes.InvalidRefreshToken, "无效的RefreshToken");
|
||
}
|
||
|
||
// 3. 检查Token是否有效
|
||
if (!storedToken.IsActive)
|
||
{
|
||
if (storedToken.IsRevoked)
|
||
{
|
||
_logger.LogWarning("Token刷新失败：Token已被撤销，用户ID: {UserId}", storedToken.AdminUserId);
|
||
throw new AdminException(AdminErrorCodes.RefreshTokenRevoked, "RefreshToken已被撤销");
|
||
}
|
||
if (storedToken.IsExpired)
|
||
{
|
||
_logger.LogWarning("Token刷新失败：Token已过期，用户ID: {UserId}", storedToken.AdminUserId);
|
||
throw new AdminException(AdminErrorCodes.RefreshTokenExpired, "RefreshToken已过期");
|
||
}
|
||
}
|
||
|
||
// 4. 检查用户状态
|
||
var user = storedToken.AdminUser;
|
||
if (user.Status == 0)
|
||
{
|
||
_logger.LogWarning("Token刷新失败：用户账户已禁用，用户ID: {UserId}", user.Id);
|
||
throw new AdminException(AdminErrorCodes.AccountDisabled, "账户已禁用");
|
||
}
|
||
|
||
// 5. 生成新的Token（Token轮换）
|
||
var expireMinutes = _configuration.GetValue<int>("Jwt:ExpireMinutes", AccessTokenExpirationMinutes);
|
||
var newAccessToken = GenerateJwtToken(user, expireMinutes);
|
||
var (newRefreshToken, newRefreshTokenEntity) = GenerateRefreshToken(user.Id, ipAddress);
|
||
|
||
// 6. 撤销旧Token并记录替换关系
|
||
storedToken.RevokedAt = DateTime.Now;
|
||
storedToken.RevokedByIp = ipAddress;
|
||
storedToken.ReplacedByToken = newRefreshTokenEntity.TokenHash;
|
||
|
||
// 7. 保存新Token
|
||
_dbContext.RefreshTokens.Add(newRefreshTokenEntity);
|
||
await _dbContext.SaveChangesAsync();
|
||
|
||
_logger.LogInformation("用户 {UserId} Token刷新成功，IP: {IpAddress}", user.Id, ipAddress);
|
||
|
||
return new RefreshTokenResponse
|
||
{
|
||
AccessToken = newAccessToken,
|
||
RefreshToken = newRefreshToken,
|
||
ExpiresIn = expireMinutes * 60
|
||
};
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task RevokeTokenAsync(string refreshToken, string ipAddress)
|
||
{
|
||
// 1. 计算Token哈希
|
||
var tokenHash = HashToken(refreshToken);
|
||
|
||
// 2. 查找Token
|
||
var storedToken = await _dbContext.RefreshTokens
|
||
.FirstOrDefaultAsync(t => t.TokenHash == tokenHash);
|
||
|
||
if (storedToken == null)
|
||
{
|
||
_logger.LogWarning("Token撤销失败：Token不存在");
|
||
throw new AdminException(AdminErrorCodes.InvalidRefreshToken, "无效的RefreshToken");
|
||
}
|
||
|
||
// 3. 撤销Token
|
||
if (!storedToken.IsRevoked)
|
||
{
|
||
storedToken.RevokedAt = DateTime.Now;
|
||
storedToken.RevokedByIp = ipAddress;
|
||
await _dbContext.SaveChangesAsync();
|
||
}
|
||
|
||
_logger.LogInformation("Token已撤销，用户ID: {UserId}，IP: {IpAddress}", storedToken.AdminUserId, ipAddress);
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task RevokeAllTokensAsync(long adminUserId, string ipAddress)
|
||
{
|
||
// 查找用户所有活跃的Token
|
||
var activeTokens = await _dbContext.RefreshTokens
|
||
.Where(t => t.AdminUserId == adminUserId && t.RevokedAt == null)
|
||
.ToListAsync();
|
||
|
||
var now = DateTime.Now;
|
||
foreach (var token in activeTokens)
|
||
{
|
||
token.RevokedAt = now;
|
||
token.RevokedByIp = ipAddress;
|
||
}
|
||
|
||
await _dbContext.SaveChangesAsync();
|
||
|
||
_logger.LogInformation("用户 {UserId} 的所有Token已撤销（共{Count}个），IP: {IpAddress}",
|
||
adminUserId, activeTokens.Count, ipAddress);
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task LogoutAsync(long adminUserId)
|
||
{
|
||
// 注意：完整的登出应该通过RevokeTokenAsync来撤销RefreshToken
|
||
// 这里保留原有逻辑，前端应该同时调用RevokeTokenAsync
|
||
_logger.LogInformation("用户 {UserId} 退出登录", adminUserId);
|
||
await Task.CompletedTask;
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task<AdminUserInfo> GetCurrentUserInfoAsync(long adminUserId)
|
||
{
|
||
var user = await _dbContext.AdminUsers
|
||
.Include(u => u.Department)
|
||
.Include(u => u.AdminUserRoles)
|
||
.ThenInclude(ur => ur.Role)
|
||
.FirstOrDefaultAsync(u => u.Id == adminUserId);
|
||
|
||
if (user == null)
|
||
{
|
||
throw new AdminException(AdminErrorCodes.InvalidCredentials, "用户不存在");
|
||
}
|
||
|
||
var roles = user.AdminUserRoles
|
||
.Where(ur => ur.Role.Status == 1)
|
||
.Select(ur => ur.Role.Code)
|
||
.ToList();
|
||
|
||
var permissions = await GetUserPermissionsAsync(user.Id);
|
||
|
||
return new AdminUserInfo
|
||
{
|
||
Id = user.Id,
|
||
Username = user.Username,
|
||
RealName = user.RealName,
|
||
Avatar = user.Avatar,
|
||
Email = user.Email,
|
||
Phone = user.Phone,
|
||
DepartmentId = user.DepartmentId,
|
||
DepartmentName = user.Department?.Name,
|
||
Roles = roles,
|
||
Permissions = permissions
|
||
};
|
||
}
|
||
|
||
/// <inheritdoc />
|
||
public async Task ChangePasswordAsync(long adminUserId, ChangePasswordRequest request)
|
||
{
|
||
var user = await _dbContext.AdminUsers.FindAsync(adminUserId);
|
||
if (user == null)
|
||
{
|
||
throw new AdminException(AdminErrorCodes.InvalidCredentials, "用户不存在");
|
||
}
|
||
|
||
// 验证旧密码
|
||
if (!VerifyPassword(request.OldPassword, user.PasswordHash))
|
||
{
|
||
throw new AdminException(AdminErrorCodes.InvalidCredentials, "旧密码错误");
|
||
}
|
||
|
||
// 更新密码
|
||
user.PasswordHash = HashPassword(request.NewPassword);
|
||
user.UpdatedAt = DateTime.Now;
|
||
await _dbContext.SaveChangesAsync();
|
||
|
||
_logger.LogInformation("用户 {UserId} 修改密码成功", adminUserId);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 生成 JWT Token
|
||
/// </summary>
|
||
private string GenerateJwtToken(AdminUser user, int expireMinutes)
|
||
{
|
||
var secret = _configuration["Jwt:Secret"] ?? throw new InvalidOperationException("JWT Secret not configured");
|
||
var issuer = _configuration["Jwt:Issuer"] ?? "HoneyBox.Admin";
|
||
var audience = _configuration["Jwt:Audience"] ?? "HoneyBox.Admin.Client";
|
||
|
||
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
|
||
var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
|
||
|
||
var claims = new List<Claim>
|
||
{
|
||
new(ClaimTypes.NameIdentifier, user.Id.ToString()),
|
||
new(ClaimTypes.Name, user.Username),
|
||
new("real_name", user.RealName ?? ""),
|
||
new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
|
||
};
|
||
|
||
// 添加角色声明
|
||
foreach (var userRole in user.AdminUserRoles.Where(ur => ur.Role.Status == 1))
|
||
{
|
||
claims.Add(new Claim(ClaimTypes.Role, userRole.Role.Code));
|
||
}
|
||
|
||
var token = new JwtSecurityToken(
|
||
issuer: issuer,
|
||
audience: audience,
|
||
claims: claims,
|
||
expires: DateTime.Now.AddMinutes(expireMinutes),
|
||
signingCredentials: credentials
|
||
);
|
||
|
||
return new JwtSecurityTokenHandler().WriteToken(token);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 生成 Refresh Token
|
||
/// </summary>
|
||
/// <returns>返回原始Token和Token实体</returns>
|
||
private (string Token, RefreshToken Entity) GenerateRefreshToken(long adminUserId, string ipAddress)
|
||
{
|
||
// 生成安全随机Token
|
||
var randomBytes = new byte[64];
|
||
using var rng = RandomNumberGenerator.Create();
|
||
rng.GetBytes(randomBytes);
|
||
var token = Convert.ToBase64String(randomBytes);
|
||
|
||
// 创建Token实体
|
||
var refreshToken = new RefreshToken
|
||
{
|
||
AdminUserId = adminUserId,
|
||
TokenHash = HashToken(token),
|
||
ExpiresAt = DateTime.Now.AddDays(RefreshTokenExpirationDays),
|
||
CreatedAt = DateTime.Now,
|
||
CreatedByIp = ipAddress
|
||
};
|
||
|
||
return (token, refreshToken);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 哈希Token（用于安全存储）
|
||
/// </summary>
|
||
private static string HashToken(string token)
|
||
{
|
||
using var sha256 = SHA256.Create();
|
||
var hashedBytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(token));
|
||
return Convert.ToBase64String(hashedBytes);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 获取用户权限列表
|
||
/// </summary>
|
||
private async Task<List<string>> GetUserPermissionsAsync(long adminUserId)
|
||
{
|
||
// 获取用户的所有角色ID
|
||
var roleIds = await _dbContext.AdminUserRoles
|
||
.Where(ur => ur.AdminUserId == adminUserId)
|
||
.Select(ur => ur.RoleId)
|
||
.ToListAsync();
|
||
|
||
// 获取角色关联的权限
|
||
var permissions = await _dbContext.RolePermissions
|
||
.Where(rp => roleIds.Contains(rp.RoleId))
|
||
.Include(rp => rp.Permission)
|
||
.Select(rp => rp.Permission.Code)
|
||
.Distinct()
|
||
.ToListAsync();
|
||
|
||
return permissions;
|
||
}
|
||
|
||
/// <summary>
|
||
/// 哈希密码
|
||
/// </summary>
|
||
public static string HashPassword(string password)
|
||
{
|
||
using var sha256 = SHA256.Create();
|
||
var hashedBytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(password));
|
||
return Convert.ToBase64String(hashedBytes);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 验证密码
|
||
/// </summary>
|
||
private static bool VerifyPassword(string password, string passwordHash)
|
||
{
|
||
var hash = HashPassword(password);
|
||
return hash == passwordHash;
|
||
}
|
||
}
|