security: 会话可撤销与认证面加固
- users 加 token_version（schema v4）：改密/登出递增，该用户全部已发 access/refresh 立即作废；refresh 改轮换式换发新 cookie - 邀请码改精确匹配 + 注册成功后消费（一码一用），修复子串匹配让任意后缀放行、可无限薅体验金 - 生产校验拦下 .env.example 占位密钥；OT_ENV 枚举校验（拼错不再静默跳过断言）；生产强制 COOKIE_SECURE；非 development 拒绝默认密码播种管理员 - WebAuthn 会话启用过期校验 + 4096 容量上限（未认证 login/begin 可无限撑爆内存），begin/complete 挂登录级限速 - /api/v1 挂 1MB 请求体上限；login 先限 IP 桶再解析 body；全局安全响应头 + CSP - 连接池配置（PG 30/SQLite 8）；SQLite DSN 自动追加 WAL + busy_timeout（驱动只认 _pragma，旧注释的 _journal_mode 写法不生效）
This commit is contained in:
Sakurasan committed
1 parent
d6db0f8162
commit
e3ff0d3329
14 files changed
+392
-37
No files matched your search
+119
-15
@@ -3,6 +3,8 @@ package api
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -15,6 +17,7 @@ import (
|
||||
"github.com/openteam/server/internal/pkg/resp"
|
||||
"github.com/openteam/server/internal/proxy"
|
||||
"github.com/openteam/server/internal/store"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// Handler 聚合所有管理 API。
|
||||
@@ -73,14 +76,31 @@ func (h *Handler) Register(c *gin.Context) {
|
||||
mode = modeCfg
|
||||
}
|
||||
if mode == "invite" {
|
||||
var icRaw string
|
||||
h.a.DB.Model(&store.SystemConfig{}).Where("key = ?", "invite_codes").Pluck("value", &icRaw)
|
||||
var ic string
|
||||
_ = json.Unmarshal([]byte(icRaw), &ic)
|
||||
if req.InviteCode == "" || !strings.Contains(ic, req.InviteCode) {
|
||||
codes, err := loadInviteCodes(h.a.DB)
|
||||
if err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to load invite codes")
|
||||
return
|
||||
}
|
||||
// 精确匹配：子串匹配（Contains）会让任一真实邀请码的任意后缀都放行
|
||||
matched := false
|
||||
for _, code := range codes {
|
||||
if req.InviteCode == code {
|
||||
matched = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if req.InviteCode == "" || !matched {
|
||||
resp.Fail(c, http.StatusForbidden, "valid invite code required")
|
||||
return
|
||||
}
|
||||
defer func() {
|
||||
// 一码一用：注册成功（2xx，Created=201）才消费，避免失败请求作废邀请码
|
||||
if s := c.Writer.Status(); s >= 200 && s < 300 {
|
||||
if err := consumeInviteCode(h.a.DB, req.InviteCode); err != nil {
|
||||
log.Printf("invite: failed to consume code after registration: %v", err)
|
||||
}
|
||||
}
|
||||
}()
|
||||
}
|
||||
var count int64
|
||||
h.a.DB.Model(&store.User{}).Where("username = ? OR email = ?", req.Username, req.Email).Count(&count)
|
||||
@@ -119,16 +139,17 @@ type loginReq struct {
|
||||
|
||||
// Login POST /api/v1/auth/login — 返回 access token，refresh token 写入 HttpOnly Cookie。
|
||||
func (h *Handler) Login(c *gin.Context) {
|
||||
// 先限 IP 桶再解析 body（与 Register 同策略）：登录是未认证面，不先给大请求做绑定
|
||||
ip := c.ClientIP()
|
||||
if h.authLimited(c, "login:ip:"+ip, h.a.Cfg.RateLimit.LoginIPPerMin, time.Minute) {
|
||||
return
|
||||
}
|
||||
var req loginReq
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
resp.Fail(c, http.StatusBadRequest, "invalid input")
|
||||
return
|
||||
}
|
||||
// 两个桶：单 IP 总量挡扫库式爆破，单 IP×账号挡换 IP 定向爆破同一个账号
|
||||
ip := c.ClientIP()
|
||||
if h.authLimited(c, "login:ip:"+ip, h.a.Cfg.RateLimit.LoginIPPerMin, time.Minute) {
|
||||
return
|
||||
}
|
||||
// 单 IP×账号桶：挡换 IP 定向爆破同一个账号
|
||||
if h.authLimited(c, "login:u:"+ip+"|"+strings.ToLower(req.Username), h.a.Cfg.RateLimit.LoginUserPerMin, time.Minute) {
|
||||
return
|
||||
}
|
||||
@@ -146,12 +167,12 @@ func (h *Handler) Login(c *gin.Context) {
|
||||
now := time.Now()
|
||||
h.a.DB.Model(&u).Update("last_login_at", now)
|
||||
|
||||
access, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "access")
|
||||
access, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "access", u.TokenVersion)
|
||||
if err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to issue token")
|
||||
return
|
||||
}
|
||||
refresh, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "refresh")
|
||||
refresh, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "refresh", u.TokenVersion)
|
||||
if err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to issue token")
|
||||
return
|
||||
@@ -177,16 +198,35 @@ func (h *Handler) Refresh(c *gin.Context) {
|
||||
resp.Fail(c, http.StatusUnauthorized, "user not found or disabled")
|
||||
return
|
||||
}
|
||||
access, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "access")
|
||||
if claims.Ver != u.TokenVersion {
|
||||
// 改密/登出已递增会话版本：全部旧 refresh 作废
|
||||
resp.Fail(c, http.StatusUnauthorized, "session revoked, please sign in again")
|
||||
return
|
||||
}
|
||||
access, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "access", u.TokenVersion)
|
||||
if err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to issue token")
|
||||
return
|
||||
}
|
||||
// 轮换 refresh cookie（滑动续期）：单个 refresh token 的暴露窗口不超过一个刷新间隔
|
||||
refresh, _, err := h.a.JWT.Sign(u.ID, u.Username, u.Role, "refresh", u.TokenVersion)
|
||||
if err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to issue token")
|
||||
return
|
||||
}
|
||||
h.setRefreshCookie(c, refresh)
|
||||
resp.OK(c, gin.H{"access_token": access, "expires_in": int(h.a.JWT.AccessTTL().Seconds())})
|
||||
}
|
||||
|
||||
// Logout POST /api/v1/auth/logout — 清除 refresh cookie。
|
||||
// Logout POST /api/v1/auth/logout — 服务端撤销会话并清除 refresh cookie。
|
||||
// TokenVersion 递增使该用户全部已发 access/refresh 失效（含其他设备）；cookie 清理只是客户端侧补充。
|
||||
func (h *Handler) Logout(c *gin.Context) {
|
||||
if u, ok := userFromContext(c); ok {
|
||||
if err := h.a.DB.Model(&store.User{}).Where("id = ?", u.ID).
|
||||
Update("token_version", gorm.Expr("token_version + 1")).Error; err != nil {
|
||||
log.Printf("auth: failed to bump token version on logout for user %d: %v", u.ID, err)
|
||||
}
|
||||
}
|
||||
h.setRefreshCookie(c, "")
|
||||
resp.OK(c, gin.H{"ok": true})
|
||||
}
|
||||
@@ -214,7 +254,11 @@ func (h *Handler) ChangePassword(c *gin.Context) {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to hash password")
|
||||
return
|
||||
}
|
||||
if err := h.a.DB.Model(&store.User{}).Where("id = ?", u.ID).Update("password_hash", hash).Error; err != nil {
|
||||
// 密码与会话版本同语句更新：改密后该用户全部已发 token 立即作废
|
||||
if err := h.a.DB.Model(&store.User{}).Where("id = ?", u.ID).Updates(map[string]any{
|
||||
"password_hash": hash,
|
||||
"token_version": gorm.Expr("token_version + 1"),
|
||||
}).Error; err != nil {
|
||||
resp.Fail(c, http.StatusInternalServerError, "failed to update password")
|
||||
return
|
||||
}
|
||||
@@ -270,3 +314,63 @@ func userFromContext(c *gin.Context) (*store.User, bool) {
|
||||
}
|
||||
return u.(*store.User), true
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// 邀请码
|
||||
|
||||
// loadInviteCodes 读取邀请码列表。兼容两种存储形态：历史版本存单个 JSON 字符串
|
||||
// （逗号/分号/空白分隔），现在统一以 JSON 数组写回。
|
||||
func loadInviteCodes(db *gorm.DB) ([]string, error) {
|
||||
var raw string
|
||||
if err := db.Model(&store.SystemConfig{}).Where("key = ?", "invite_codes").Pluck("value", &raw).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
raw = strings.TrimSpace(raw)
|
||||
if raw == "" {
|
||||
return nil, nil
|
||||
}
|
||||
var arr []string
|
||||
if json.Unmarshal([]byte(raw), &arr) == nil {
|
||||
return trimCodes(arr), nil
|
||||
}
|
||||
var s string
|
||||
if json.Unmarshal([]byte(raw), &s) == nil {
|
||||
return trimCodes(strings.FieldsFunc(s, func(r rune) bool {
|
||||
return r == ',' || r == ';' || r == '\n' || r == '\r' || r == ' ' || r == '\t'
|
||||
})), nil
|
||||
}
|
||||
return nil, fmt.Errorf("invite_codes 配置格式无法解析: %s", raw)
|
||||
}
|
||||
|
||||
// consumeInviteCode 把已使用的邀请码从列表移除（一码一用）。码不存在时静默成功。
|
||||
// 写回保持「JSON 字符串 + 逗号分隔」的历史形态，管理后台的输入框按该格式展示编辑。
|
||||
func consumeInviteCode(db *gorm.DB, code string) error {
|
||||
codes, err := loadInviteCodes(db)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rest := make([]string, 0, len(codes))
|
||||
found := false
|
||||
for _, c := range codes {
|
||||
if c == code && !found {
|
||||
found = true // 同码重复录入只删一个
|
||||
continue
|
||||
}
|
||||
rest = append(rest, c)
|
||||
}
|
||||
if !found {
|
||||
return nil
|
||||
}
|
||||
raw, _ := json.Marshal(strings.Join(rest, ","))
|
||||
return db.Save(&store.SystemConfig{Key: "invite_codes", Value: string(raw)}).Error
|
||||
}
|
||||
|
||||
func trimCodes(in []string) []string {
|
||||
out := make([]string, 0, len(in))
|
||||
for _, s := range in {
|
||||
if s = strings.TrimSpace(s); s != "" {
|
||||
out = append(out, s)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
Reference in new issue
Block a user