main
use std::time::Duration;
use crate::cache::Cache;
use crate::errors::{AuthError, AuthResult};
use crate::share::crypto;
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum CodeAttempt {
Missing,
Exceeded,
Allowed(i64),
}
pub fn attempts_key(key: &str) -> String {
format!("{key}:attempts")
}
/// 验证码只存哈希：Redis 里的明文泄露不等于验证码泄露。
#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn store_email_code(
cache: &Cache,
key: &str,
code: &str,
ttl_secs: u64,
_request_id: Option<&str>,
) -> AuthResult<()> {
let digest = crypto::sha256_hex(code.trim().as_bytes());
cache
.set_ex(key, digest.as_str(), Duration::from_secs(ttl_secs.max(1)))
.await?;
cache.delete(&attempts_key(key)).await?;
Ok(())
}
#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn take_code_attempt(
cache: &Cache,
key: &str,
max_attempts: i64,
_request_id: Option<&str>,
) -> AuthResult<CodeAttempt> {
if !cache.exists(key).await? {
return Ok(CodeAttempt::Missing);
}
let ttl = cache
.ttl(key)
.await?
.unwrap_or_else(|| Duration::from_secs(1));
let attempts = cache.scripts().incr_ex(&attempts_key(key), ttl).await?;
if attempts > max_attempts {
cache.delete(key).await?;
cache.delete(&attempts_key(key)).await?;
return Ok(CodeAttempt::Exceeded);
}
Ok(CodeAttempt::Allowed(attempts))
}
#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn consume_email_code(
cache: &Cache,
key: &str,
code: &str,
max_attempts: i64,
_request_id: Option<&str>,
) -> AuthResult<()> {
match take_code_attempt(cache, key, max_attempts, _request_id).await? {
CodeAttempt::Missing => Err(AuthError::InvalidEmailCode),
CodeAttempt::Exceeded => Err(AuthError::EmailCodeAttemptsExceeded),
CodeAttempt::Allowed(_) => {
let digest = crypto::sha256_hex(code.trim().as_bytes());
// 原子比较并删除：并发提交同一个码时只有一方能消费成功。
let consumed = cache
.scripts()
.consume_matching(key, digest.as_bytes())
.await?;
if !consumed {
return Err(AuthError::InvalidEmailCode);
}
Ok(())
}
}
}