main
use crate::AuthService;
use crate::errors::{AuthError, AuthResult};
use crate::events::{Labels, label};
use crate::handlers::challenge::PowProofRequest;
use crate::models::users::user_events::UserEventType;
use crate::models::users::user_mfa::{self, MfaStatus, MfaType};
use crate::models::users::users;
use crate::session::Session;
use crate::share::codes::{consume_email_code, store_email_code};
use crate::share::crypto::{now_secs, random_alnum, random_numeric_code};
use crate::share::password::{self, PasswordCheck};
use crate::share::rate::{attempts_load, attempts_reset, attempts_track, rate_limit_once};
use crate::share::validate;
use sea_orm::sea_query::{Expr, ExprTrait, Func};
use sea_orm::{ColumnTrait, Condition, EntityTrait, QueryFilter};
use serde::{Deserialize, Serialize};
use utoipa::ToSchema;
pub const SESSION_LOGIN_MFA: &str = "login_mfa";
pub const HASH_KEY_SHA256_V1: &str = "sha256-v1";
pub const LOGIN_ATTEMPTS_MAX: u64 = 5;
pub const LOGIN_ATTEMPTS_WINDOW_SECS: u64 = 300;
pub const MFA_CHALLENGE_TTL_SECS: u64 = 300;
#[derive(Clone, Deserialize, Serialize, ToSchema)]
pub struct UserLoginRequest {
pub identity: String,
pub password_hash: String,
pub pow_payload: PowProofRequest,
}
impl std::fmt::Debug for UserLoginRequest {
fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
formatter
.debug_struct("UserLoginRequest")
.field("identity", &self.identity)
.field("password_hash", &"<redacted>")
.field("pow_payload", &self.pow_payload)
.finish()
}
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct UserLoginResponse {
pub user_id: i64,
pub username: String,
pub displayname: Option<String>,
pub mfa_required: bool,
pub challenge: Option<String>,
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct LoginCodeRequest {
pub email: String,
pub pow_payload: PowProofRequest,
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct LoginCodeResponse {
pub expires_in_secs: u64,
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct LoginCodeVerifyRequest {
pub email: String,
pub email_code: String,
pub pow_payload: PowProofRequest,
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct LoginVerifyRequest {
pub challenge: String,
pub code: String,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct LoginMfaChallenge {
pub user_id: i64,
pub challenge: String,
pub expires_at: u64,
}
pub(crate) fn login_code_key(user_id: i64) -> String {
format!("auth:code:login:{user_id}")
}
impl AuthService {
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn login(
&self,
session: Session,
request: UserLoginRequest,
request_id: String,
) -> AuthResult<UserLoginResponse> {
self.challenge_verify_pow(
session.clone(),
&request.pow_payload,
request.identity.as_bytes(),
request_id.clone(),
)
.await?;
let identity = request.identity.trim().to_lowercase();
let found = self.find_user_by_identity(&request.identity).await?;
let client_ip = session.client_ip().ok().flatten().unwrap_or_default();
// IP 维计数与账号维并行：攻击者无法用 5 次失败锁死任意已知用户名，
// 只能锁自己的 IP；账号维只累计已验证失败的次数，拦住单账号分布式慢速猜测。
let ip_key = format!(
"auth:rate:login:ip:{}:{}",
client_ip,
&crate::share::crypto::sha256_hex(identity.as_bytes())[..16]
);
let ip_allowed = attempts_track(
self.cache(),
&ip_key,
LOGIN_ATTEMPTS_MAX * 10,
LOGIN_ATTEMPTS_WINDOW_SECS,
Some(request_id.as_str()),
)
.await?;
let attempts_key = match found.as_ref() {
Some(user) => format!("auth:rate:login:attempts:{}", user.id),
None => {
// identity 截断后哈希，防任意长度输入撑大 Redis key。
let identity_digest = crate::share::crypto::sha256_hex(identity.as_bytes());
format!(
"auth:rate:login:attempts:anon:{client_ip}:{}",
&identity_digest[..16]
)
}
};
// 账号维只读不写：本次尝试本身不能计入阀门，否则 5 次请求就能锁死任意已知账号。
let account_locked = attempts_load(self.cache(), &attempts_key, Some(request_id.as_str()))
.await?
>= LOGIN_ATTEMPTS_MAX;
if !ip_allowed || account_locked {
if account_locked
&& let Some(locked) = found.as_ref()
&& let Err(error) = self
.audit(
&session,
locked.id,
Some(locked.id),
UserEventType::FailedLoginAttempt,
None,
&request_id,
)
.await
{
tracing::warn!(%error, %request_id, "failed to write the locked-login audit event");
}
return Err(AuthError::RateLimited {
retry_after_secs: LOGIN_ATTEMPTS_WINDOW_SECS,
});
}
let user = found.ok_or(AuthError::InvalidCredentials)?;
match password::verify(
request.password_hash.clone(),
user.password_hash.clone(),
Some(request_id.as_str()),
)
.await?
{
PasswordCheck::Match => {}
PasswordCheck::LegacyMatch => {
let upgraded =
password::hash(request.password_hash.clone(), Some(request_id.as_str()))
.await?;
users::Entity::update_many()
.col_expr(users::Column::PasswordHash, Expr::value(upgraded))
.col_expr(
users::Column::PasswordUpdatedAt,
Expr::value(chrono::Utc::now()),
)
.filter(users::Column::Id.eq(user.id))
.exec(self.db().write())
.await?;
}
PasswordCheck::Mismatch => {
attempts_track(
self.cache(),
&attempts_key,
LOGIN_ATTEMPTS_MAX,
LOGIN_ATTEMPTS_WINDOW_SECS,
Some(request_id.as_str()),
)
.await?;
self.audit(
&session,
user.id,
Some(user.id),
UserEventType::FailedLoginAttempt,
None,
&request_id,
)
.await?;
return Err(AuthError::InvalidCredentials);
}
}
self.assert_login_allowed(&session, &user, &request_id)
.await?;
attempts_reset(self.cache(), &attempts_key, Some(request_id.as_str())).await?;
let response = self.complete_login(session, user, &request_id).await?;
self.emit_labeled(
label::AUTH_LOGIN_CREATE,
Labels::new()
.with(label::USER_ID, response.user_id)
.with(label::REQUEST_ID, &request_id),
serde_json::json!({
"user_id": response.user_id,
"username": &response.username,
"mfa_required": response.mfa_required,
}),
Some(request_id.as_str()),
)
.await;
Ok(response)
}
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn login_code(
&self,
session: Session,
request: LoginCodeRequest,
request_id: String,
) -> AuthResult<LoginCodeResponse> {
self.challenge_verify_pow(
session.clone(),
&request.pow_payload,
request.email.as_bytes(),
request_id.clone(),
)
.await?;
let email = validate::validate_email(&request.email)?;
let user = self
.find_user_by_email(&email)
.await?
.ok_or(AuthError::InvalidCredentials)?;
self.assert_login_allowed(&session, &user, &request_id)
.await?;
rate_limit_once(
self.cache(),
&format!("auth:rate:login:{}", user.id),
self.auth().email_code_rate_limit_secs,
Some(request_id.as_str()),
)
.await?;
let ttl = self.auth().verify_code_ttl_secs;
let code = random_numeric_code(self.auth().verify_code_len);
store_email_code(
self.cache(),
&login_code_key(user.id),
&code,
ttl,
Some(request_id.as_str()),
)
.await?;
let minutes = std::cmp::max(ttl.div_ceil(60), 1);
let text = format!(
"Your GitDataAi sign-in code is {code}. It expires in {minutes} minute(s); never share it with anyone."
);
let html = format!(
"<p>Your GitDataAi sign-in code is <strong>{code}</strong>. It expires in {minutes} minute(s); never share it with anyone.</p>"
);
self.publish_mail(
&user.email,
"Your GitDataAi sign-in code",
&text,
&html,
Some(request_id.as_str()),
)
.await?;
let response = LoginCodeResponse {
expires_in_secs: ttl,
};
self.emit_labeled(
label::AUTH_VERIFICATION_TOKEN_CREATE,
Labels::new()
.with(label::USER_ID, user.id)
.with(label::REQUEST_ID, &request_id),
&response,
Some(request_id.as_str()),
)
.await;
Ok(response)
}
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn login_code_verify(
&self,
session: Session,
request: LoginCodeVerifyRequest,
request_id: String,
) -> AuthResult<UserLoginResponse> {
self.challenge_verify_pow(
session.clone(),
&request.pow_payload,
request.email.as_bytes(),
request_id.clone(),
)
.await?;
let email = validate::validate_email(&request.email)?;
let user = self
.find_user_by_email(&email)
.await?
.ok_or(AuthError::InvalidCredentials)?;
consume_email_code(
self.cache(),
&login_code_key(user.id),
&request.email_code,
self.auth().max_verify_attempts as i64,
Some(request_id.as_str()),
)
.await?;
self.assert_login_allowed(&session, &user, &request_id)
.await?;
let response = self.complete_login(session, user, &request_id).await?;
self.emit_labeled(
label::AUTH_LOGIN_CREATE,
Labels::new()
.with(label::USER_ID, response.user_id)
.with(label::REQUEST_ID, &request_id),
serde_json::json!({
"user_id": response.user_id,
"username": &response.username,
"mfa_required": response.mfa_required,
}),
Some(request_id.as_str()),
)
.await;
Ok(response)
}
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn login_verify(
&self,
session: Session,
request: LoginVerifyRequest,
request_id: String,
) -> AuthResult<UserLoginResponse> {
let challenge = session
.get::<LoginMfaChallenge>(SESSION_LOGIN_MFA)?
.ok_or(AuthError::Expired)?;
if challenge.challenge != request.challenge.trim() {
let _ = session.remove(SESSION_LOGIN_MFA);
return Err(AuthError::MalformedRequest);
}
if challenge.expires_at <= now_secs() {
let _ = session.remove(SESSION_LOGIN_MFA);
return Err(AuthError::Expired);
}
let attempts_key = format!("auth:rate:login:mfa:{}", challenge.user_id);
if !attempts_track(
self.cache(),
&attempts_key,
LOGIN_ATTEMPTS_MAX,
LOGIN_ATTEMPTS_WINDOW_SECS,
Some(request_id.as_str()),
)
.await?
{
let _ = session.remove(SESSION_LOGIN_MFA);
return Err(AuthError::RateLimited {
retry_after_secs: LOGIN_ATTEMPTS_WINDOW_SECS,
});
}
let user = users::Entity::find_by_id(challenge.user_id)
.filter(users::Column::DeletedAt.is_null())
.one(self.db().read())
.await?
.ok_or(AuthError::Unauthenticated)?;
self.assert_login_allowed(&session, &user, &request_id)
.await?;
self.consume_second_factor(&user, &request.code).await?;
session.set("mfa_verified", true)?;
let _ = session.remove(SESSION_LOGIN_MFA);
attempts_reset(self.cache(), &attempts_key, Some(request_id.as_str())).await?;
let response = self.bind_session(&session, &user, &request_id).await?;
self.emit_labeled(
label::AUTH_LOGIN_CREATE,
Labels::new()
.with(label::USER_ID, response.user_id)
.with(label::REQUEST_ID, &request_id),
serde_json::json!({
"user_id": response.user_id,
"username": &response.username,
"mfa_required": response.mfa_required,
}),
Some(request_id.as_str()),
)
.await;
Ok(response)
}
async fn complete_login(
&self,
session: Session,
user: users::Model,
request_id: &str,
) -> AuthResult<UserLoginResponse> {
if self.enabled_mfa(user.id).await?.is_some() {
let challenge = LoginMfaChallenge {
user_id: user.id,
challenge: random_alnum(32),
expires_at: now_secs() + MFA_CHALLENGE_TTL_SECS,
};
let token = challenge.challenge.clone();
session.set(SESSION_LOGIN_MFA, &challenge)?;
return Ok(UserLoginResponse {
user_id: user.id,
username: user.username.clone(),
displayname: user.displayname.clone(),
mfa_required: true,
challenge: Some(token),
});
}
session.set("mfa_verified", false)?;
self.bind_session(&session, &user, request_id).await
}
async fn bind_session(
&self,
session: &Session,
user: &users::Model,
request_id: &str,
) -> AuthResult<UserLoginResponse> {
session.renew();
session.set_user_id(user.id)?;
session.set_security_version(user.security_version)?;
self.bind_auth_session(
session,
user,
session.get::<bool>("mfa_verified")?.unwrap_or(false),
Some(request_id),
)
.await?;
users::Entity::update_many()
.col_expr(users::Column::LastLoginAt, Expr::value(chrono::Utc::now()))
.filter(users::Column::Id.eq(user.id))
.exec(self.db().write())
.await?;
crate::services::me::invalidate_me_cache(self.cache(), user.id).await;
self.audit(
session,
user.id,
Some(user.id),
UserEventType::Login,
None,
request_id,
)
.await?;
Ok(UserLoginResponse {
user_id: user.id,
username: user.username.clone(),
displayname: user.displayname.clone(),
mfa_required: false,
challenge: None,
})
}
async fn consume_second_factor(&self, user: &users::Model, code: &str) -> AuthResult<()> {
let record = self
.enabled_mfa(user.id)
.await?
.ok_or(AuthError::MfaRequired)?;
if record.mfa_type == MfaType::Totp && record.secret_ciphertext.is_some() {
match crate::share::mfa::consume_totp(
self.db(),
&record,
self.auth().totp_encryption_key.as_deref(),
code,
None,
)
.await
{
Ok(_) => return Ok(()),
Err(AuthError::TotpCodeInvalid) => {}
Err(error) => return Err(error),
}
}
self.consume_recovery_code(user.id, code).await
}
async fn consume_recovery_code(&self, user_id: i64, code: &str) -> AuthResult<()> {
crate::share::mfa::consume_recovery(self.db(), user_id, code, None).await
}
async fn enabled_mfa(&self, user_id: i64) -> AuthResult<Option<user_mfa::Model>> {
Ok(user_mfa::Entity::find()
.filter(user_mfa::Column::UserId.eq(user_id))
.filter(user_mfa::Column::MfaStatus.eq(MfaStatus::Enabled))
.filter(user_mfa::Column::RevokedAt.is_null())
.one(self.db().read())
.await?)
}
async fn assert_login_allowed(
&self,
session: &Session,
user: &users::Model,
request_id: &str,
) -> AuthResult<()> {
let reason = if user.deleted_at.is_some() {
Some("deleted")
} else if !user.allow_use {
Some("disabled")
} else if user.forbid_login
&& user
.endtime_forbid_login_at
.is_none_or(|until| until > chrono::Utc::now())
{
Some("forbidden")
} else {
None
};
let Some(reason) = reason else {
return Ok(());
};
self.audit(
session,
user.id,
Some(user.id),
UserEventType::FailedLoginAttempt,
Some(serde_json::json!({
"reason": reason,
"forbid_login": user.forbid_login,
"forbid_login_reason": user.forbid_login_reason,
})),
request_id,
)
.await?;
Err(AuthError::InvalidCredentials)
}
async fn find_user_by_identity(&self, identity: &str) -> AuthResult<Option<users::Model>> {
let trimmed = identity.trim();
let lower = trimmed.to_lowercase();
let id = trimmed.parse::<i64>().ok();
Ok(users::Entity::find()
.filter(
Condition::any()
.add(users::Column::Username.eq(trimmed.to_string()))
.add(users::Column::Lowername.eq(lower.clone()))
.add(Expr::expr(Func::lower(Expr::col(users::Column::Email))).eq(lower))
.add_option(id.map(|id| users::Column::Id.eq(id))),
)
.one(self.db().read())
.await?)
}
async fn find_user_by_email(&self, email: &str) -> AuthResult<Option<users::Model>> {
Ok(users::Entity::find()
.filter(Expr::expr(Func::lower(Expr::col(users::Column::Email))).eq(email))
.one(self.db().read())
.await?)
}
async fn audit(
&self,
session: &Session,
user_id: i64,
actor_user_id: Option<i64>,
event_type: UserEventType,
details: Option<serde_json::Value>,
request_id: &str,
) -> AuthResult<()> {
crate::share::audit::entry(
self.db(),
user_id,
actor_user_id,
event_type,
details,
Some(request_id),
session.client_ip().ok().flatten(),
session.user_agent().ok().flatten(),
)
.await
}
}