main
use crate::AuthService;
use crate::errors::{AuthError, AuthResult};
use crate::events::{Labels, label};
use crate::handlers::challenge::PowProofRequest;
use crate::models::users::user_events::UserEventType;
use crate::models::users::user_verification_tokens::{self, VerificationPurpose};
use crate::models::users::users;
use crate::session::Session;
use crate::share::codes::{consume_email_code, store_email_code};
use crate::share::crypto::{random_b64url, sha256_hex};
use crate::share::password::{hash as hash_password, validate_new_password};
use crate::share::{rate, validate};
use chrono::{DateTime, Duration, Utc};
use sea_orm::entity::Set;
use sea_orm::sea_query::{Expr, ExprTrait, Func};
use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter};
use serde::{Deserialize, Serialize};
use utoipa::ToSchema;
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct PasswordResetRequest {
pub email: String,
pub pow_payload: PowProofRequest,
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct PasswordResetResponse {
pub expires_in_secs: u64,
}
#[derive(Clone, Deserialize, Serialize, ToSchema)]
pub struct PasswordResetConfirmRequest {
pub token: String,
pub password_hash: String,
pub pow_payload: PowProofRequest,
}
impl std::fmt::Debug for PasswordResetConfirmRequest {
fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
formatter
.debug_struct("PasswordResetConfirmRequest")
.field("token", &"<redacted>")
.field("password_hash", &"<redacted>")
.field("pow_payload", &self.pow_payload)
.finish()
}
}
#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct PasswordResetConfirmResponse {
pub user_id: i64,
}
const RESET_CODE_KEY_PREFIX: &str = "auth:code:reset:";
const RESET_RATE_KEY_PREFIX: &str = "auth:rate:reset:";
const RESET_HASH_KEY_ID: &str = "sha256-v1";
const PASSWORD_DIGEST_MAX_LEN: usize = 255;
impl AuthService {
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn request_password_reset(
&self,
session: Session,
request: PasswordResetRequest,
user_agent: Option<String>,
ip_addr: Option<String>,
request_id: String,
) -> AuthResult<PasswordResetResponse> {
self.challenge_verify_pow(
session.clone(),
&request.pow_payload,
request.email.as_bytes(),
request_id.clone(),
)
.await?;
let email = validate::validate_email(&request.email)?;
rate::rate_limit_once(
self.cache(),
&format!("{RESET_RATE_KEY_PREFIX}{email}"),
self.auth().email_code_rate_limit_secs,
Some(request_id.as_str()),
)
.await?;
let ttl = self.auth().reset_token_ttl_secs;
let user = users::Entity::find()
.filter(Expr::expr(Func::lower(Expr::col(users::Column::Email))).eq(email.clone()))
.one(self.db().read())
.await?;
let Some(user) = user else {
return Ok(PasswordResetResponse {
expires_in_secs: ttl,
});
};
if user.deleted_at.is_some() || !user.allow_use {
return Ok(PasswordResetResponse {
expires_in_secs: ttl,
});
}
let now = Utc::now();
self.revoke_pending_resets(user.id, now).await?;
let token = random_b64url(self.auth().reset_token_bytes);
let token_hash = sha256_hex(token.as_bytes());
user_verification_tokens::ActiveModel {
user_id: Set(user.id),
purpose: Set(VerificationPurpose::PasswordReset),
token_hash: Set(token_hash.clone()),
hash_key_id: Set(RESET_HASH_KEY_ID.to_owned()),
target_email: Set(Some(user.email.clone())),
security_version: Set(user.security_version),
created_at: Set(now),
expires_at: Set(now + Duration::seconds(ttl as i64)),
..Default::default()
}
.insert(self.db().write())
.await?;
store_email_code(
self.cache(),
&format!("{RESET_CODE_KEY_PREFIX}{email}"),
&token_hash,
ttl,
Some(request_id.as_str()),
)
.await?;
let minutes = ttl / 60;
let subject = "重置你的密码";
let text = format!(
"请在 {minutes} 分钟内使用以下重置令牌设置新密码:{token}。如果你没有申请重置密码，请忽略这封邮件。"
);
let html = format!(
"<p>请在 {minutes} 分钟内使用以下重置令牌设置新密码:</p><p><code>{token}</code></p><p>如果你没有申请重置密码，请忽略这封邮件。</p>"
);
self.publish_mail(&email, subject, &text, &html, Some(request_id.as_str()))
.await?;
crate::share::audit::entry(
self.db(),
user.id,
Some(user.id),
UserEventType::PasswordResetRequested,
Some(serde_json::json!({"email": user.email.clone()})),
Some(&request_id),
ip_addr,
user_agent,
)
.await?;
let response = PasswordResetResponse {
expires_in_secs: ttl,
};
self.emit_labeled(
label::AUTH_PASSWORD_CREATE,
Labels::new()
.with(label::USER_ID, user.id)
.with(label::REQUEST_ID, &request_id),
&response,
Some(request_id.as_str()),
)
.await;
Ok(response)
}
#[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
pub async fn reset_password(
&self,
session: Session,
request: PasswordResetConfirmRequest,
user_agent: Option<String>,
ip_addr: Option<String>,
request_id: String,
) -> AuthResult<PasswordResetConfirmResponse> {
self.challenge_verify_pow(
session.clone(),
&request.pow_payload,
request.token.as_bytes(),
request_id.clone(),
)
.await?;
if request.password_hash.is_empty() || request.password_hash.len() > PASSWORD_DIGEST_MAX_LEN
{
return Err(AuthError::InvalidPassword);
}
validate_new_password(&request.password_hash, &self.auth().password_policy)?;
let now = Utc::now();
let token_hash = sha256_hex(request.token.as_bytes());
let record = user_verification_tokens::Entity::find()
.filter(user_verification_tokens::Column::TokenHash.eq(token_hash.clone()))
.filter(
user_verification_tokens::Column::Purpose.eq(VerificationPurpose::PasswordReset),
)
.one(self.db().read())
.await?
.ok_or(AuthError::InvalidResetToken)?;
if record.consumed_at.is_some() || record.revoked_at.is_some() || record.expires_at <= now {
return Err(AuthError::InvalidResetToken);
}
let Some(target_email) = record.target_email.clone() else {
return Err(AuthError::InvalidResetToken);
};
consume_email_code(
self.cache(),
&format!("{RESET_CODE_KEY_PREFIX}{target_email}"),
&token_hash,
self.auth().max_verify_attempts as i64,
Some(request_id.as_str()),
)
.await?;
let user = users::Entity::find_by_id(record.user_id)
.one(self.db().read())
.await?
.ok_or(AuthError::InvalidResetToken)?;
if user.deleted_at.is_some()
|| !user.allow_use
|| user.security_version != record.security_version
{
return Err(AuthError::InvalidResetToken);
}
let consumed = user_verification_tokens::Entity::update_many()
.col_expr(
user_verification_tokens::Column::ConsumedAt,
Expr::value(now),
)
.filter(user_verification_tokens::Column::Id.eq(record.id))
.filter(user_verification_tokens::Column::ConsumedAt.is_null())
.exec(self.db().write())
.await?;
if consumed.rows_affected != 1 {
return Err(AuthError::InvalidResetToken);
}
let password_hash =
hash_password(request.password_hash.clone(), Some(request_id.as_str())).await?;
let updated = users::Entity::update_many()
.col_expr(users::Column::PasswordHash, Expr::value(password_hash))
.col_expr(users::Column::PasswordUpdatedAt, Expr::value(now))
.col_expr(users::Column::PasswordMustChange, Expr::value(false))
.col_expr(
users::Column::SecurityVersion,
Expr::value(user.security_version + 1),
)
.col_expr(users::Column::UpdatedAt, Expr::value(now))
.filter(users::Column::Id.eq(user.id))
.filter(users::Column::SecurityVersion.eq(user.security_version))
.exec(self.db().write())
.await?;
if updated.rows_affected != 1 {
return Err(AuthError::InvalidResetToken);
}
self.revoke_pending_resets(user.id, now).await?;
crate::share::audit::entry(
self.db(),
user.id,
Some(user.id),
UserEventType::PasswordChange,
Some(serde_json::json!({"source": "password_reset"})),
Some(&request_id),
ip_addr,
user_agent,
)
.await?;
let response = PasswordResetConfirmResponse { user_id: user.id };
self.emit_labeled(
label::AUTH_PASSWORD_UPDATE,
Labels::new()
.with(label::USER_ID, response.user_id)
.with(label::REQUEST_ID, &request_id),
&response,
Some(request_id.as_str()),
)
.await;
Ok(response)
}
async fn revoke_pending_resets(&self, user_id: i64, now: DateTime<Utc>) -> AuthResult<()> {
user_verification_tokens::Entity::update_many()
.col_expr(
user_verification_tokens::Column::RevokedAt,
Expr::value(now),
)
.filter(user_verification_tokens::Column::UserId.eq(user_id))
.filter(
user_verification_tokens::Column::Purpose.eq(VerificationPurpose::PasswordReset),
)
.filter(user_verification_tokens::Column::ConsumedAt.is_null())
.filter(user_verification_tokens::Column::RevokedAt.is_null())
.exec(self.db().write())
.await?;
Ok(())
}
}