284 lines
6.9 KiB
Go
284 lines
6.9 KiB
Go
package handlers
|
||
|
||
import (
|
||
"crypto/rand"
|
||
"fmt"
|
||
"math/big"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
"github.com/niangaodev/art-code/config"
|
||
"github.com/niangaodev/art-code/middleware"
|
||
"github.com/niangaodev/art-code/models"
|
||
"github.com/niangaodev/art-code/repositories"
|
||
"github.com/niangaodev/art-code/utils"
|
||
"gorm.io/gorm"
|
||
)
|
||
|
||
const guestCharset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
|
||
|
||
func randomGuestSuffix(minLen, maxLen int) string {
|
||
nBig, _ := rand.Int(rand.Reader, big.NewInt(int64(maxLen-minLen+1)))
|
||
n := int(nBig.Int64()) + minLen
|
||
b := make([]byte, n)
|
||
for i := 0; i < n; i++ {
|
||
idx, _ := rand.Int(rand.Reader, big.NewInt(int64(len(guestCharset))))
|
||
b[i] = guestCharset[idx.Int64()]
|
||
}
|
||
return string(b)
|
||
}
|
||
|
||
func uniqueGuestUsername() (string, error) {
|
||
for i := 0; i < 8; i++ {
|
||
name := "游客_" + randomGuestSuffix(6, 10)
|
||
exist, err := repositories.GetUserByUsername(name)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
if exist == nil {
|
||
return name, nil
|
||
}
|
||
}
|
||
return "", fmt.Errorf("failed to allocate guest username")
|
||
}
|
||
|
||
// WxLogin 微信小程序静默登录 / 自动建游客账号
|
||
func WxLogin(c *gin.Context) {
|
||
var req models.WxLoginRequest
|
||
if err := c.ShouldBindJSON(&req); err != nil || strings.TrimSpace(req.Code) == "" {
|
||
utils.Error(c, 400, "Invalid request")
|
||
return
|
||
}
|
||
|
||
session, err := utils.Code2Session(req.Code)
|
||
if err != nil {
|
||
utils.Error(c, 400, err.Error())
|
||
return
|
||
}
|
||
|
||
user, err := repositories.GetUserByWxOpenID(session.OpenID)
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
|
||
if user == nil {
|
||
username, err := uniqueGuestUsername()
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
hash, err := utils.HashPassword(randomGuestSuffix(16, 24))
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
openidPrefix := session.OpenID
|
||
if len(openidPrefix) > 12 {
|
||
openidPrefix = openidPrefix[:12]
|
||
}
|
||
user = &models.User{
|
||
Username: username,
|
||
Email: fmt.Sprintf("wx_%s@guest.local", openidPrefix),
|
||
Avatar: "",
|
||
PasswordHash: hash,
|
||
WxOpenID: session.OpenID,
|
||
Role: "viewer",
|
||
IsActive: 1,
|
||
}
|
||
if role, rerr := repositories.GetRoleByName("viewer"); rerr == nil && role != nil {
|
||
user.RoleID = role.ID
|
||
}
|
||
if err := repositories.CreateUser(user); err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
// reload with role name
|
||
user, err = repositories.GetUserByWxOpenID(session.OpenID)
|
||
if err != nil || user == nil {
|
||
utils.ServerError(c, fmt.Errorf("created user but reload failed"))
|
||
return
|
||
}
|
||
}
|
||
|
||
if user.IsActive == 0 {
|
||
utils.Error(c, 403, "Account disabled")
|
||
return
|
||
}
|
||
|
||
tokenString, expireUnix, err := middleware.GenerateToken(user.ID, user.Username, user.Role)
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
|
||
go func() {
|
||
ip := c.ClientIP()
|
||
location := utils.GetRegion(ip)
|
||
logEntry := &models.UserAccessLog{
|
||
UserID: user.ID,
|
||
UserIP: ip,
|
||
UserLocation: location,
|
||
}
|
||
_ = repositories.CreateUserAccessLog(logEntry)
|
||
}()
|
||
|
||
utils.Success(c, gin.H{
|
||
"token": tokenString,
|
||
"expire": expireUnix,
|
||
"user": repositories.BuildUserResponse(user),
|
||
})
|
||
}
|
||
|
||
// isGuestUser 判断是否为可合并的游客账号（viewer 或 游客_ 前缀）
|
||
func isGuestUser(u *models.User) bool {
|
||
if u == nil {
|
||
return false
|
||
}
|
||
role := strings.ToLower(strings.TrimSpace(u.Role))
|
||
if strings.HasPrefix(u.Username, "游客_") {
|
||
return true
|
||
}
|
||
return role == "viewer" || role == "guest"
|
||
}
|
||
|
||
// isStaffUser 判断是否为可绑定的员工账号
|
||
func isStaffUser(u *models.User) bool {
|
||
if u == nil {
|
||
return false
|
||
}
|
||
role := strings.ToLower(strings.TrimSpace(u.Role))
|
||
return role == "admin" || role == "editor" || strings.Contains(role, "admin") || strings.Contains(role, "editor")
|
||
}
|
||
|
||
// MergeAccountRequest 游客合并到管理员账号
|
||
type MergeAccountRequest struct {
|
||
Username string `json:"username" binding:"required"`
|
||
Password string `json:"password" binding:"required"`
|
||
}
|
||
|
||
// MergeAccount 游客校验管理员密码后，将微信 openid 迁到管理员，并逻辑删除游客
|
||
func MergeAccount(c *gin.Context) {
|
||
var req MergeAccountRequest
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
utils.Error(c, 400, "Invalid request")
|
||
return
|
||
}
|
||
|
||
guestIDVal, ok := c.Get("userID")
|
||
if !ok {
|
||
utils.Error(c, 401, "Unauthorized")
|
||
return
|
||
}
|
||
guestID, ok := guestIDVal.(uint)
|
||
if !ok {
|
||
utils.Error(c, 401, "Unauthorized")
|
||
return
|
||
}
|
||
|
||
guest, err := repositories.GetUserByID(guestID)
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
if guest == nil {
|
||
utils.Error(c, 401, "Unauthorized")
|
||
return
|
||
}
|
||
if !isGuestUser(guest) {
|
||
utils.Error(c, 400, "当前账号不是游客，无法合并")
|
||
return
|
||
}
|
||
openid := strings.TrimSpace(guest.WxOpenID)
|
||
if openid == "" {
|
||
utils.Error(c, 400, "当前游客未绑定微信，无法合并")
|
||
return
|
||
}
|
||
|
||
target, err := repositories.GetUserByUsername(strings.TrimSpace(req.Username))
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
if target == nil || !utils.CheckPasswordHash(req.Password, target.PasswordHash) {
|
||
utils.Error(c, 401, "Invalid username or password")
|
||
return
|
||
}
|
||
if target.IsActive == 0 {
|
||
utils.Error(c, 403, "Account disabled")
|
||
return
|
||
}
|
||
if !isStaffUser(target) {
|
||
utils.Error(c, 403, "目标账号不是管理员或编辑者")
|
||
return
|
||
}
|
||
if target.ID == guest.ID {
|
||
utils.Error(c, 400, "不能合并到当前账号")
|
||
return
|
||
}
|
||
existingOpenID := strings.TrimSpace(target.WxOpenID)
|
||
if existingOpenID != "" && existingOpenID != openid {
|
||
utils.Error(c, 409, "该管理员已绑定其他微信账号")
|
||
return
|
||
}
|
||
|
||
// 事务：清空游客 openid → 软删游客 → 绑定到管理员
|
||
err = config.DB.Transaction(func(tx *gorm.DB) error {
|
||
now := time.Now().Unix()
|
||
if err := tx.Model(&models.User{}).Where("id = ?", guest.ID).
|
||
Updates(map[string]interface{}{
|
||
"wx_openid": nil,
|
||
"updated_at": now,
|
||
}).Error; err != nil {
|
||
return err
|
||
}
|
||
if err := tx.Model(&models.User{}).Where("id = ?", guest.ID).
|
||
Update("deleted_at", now).Error; err != nil {
|
||
return err
|
||
}
|
||
if existingOpenID == openid {
|
||
return nil
|
||
}
|
||
return tx.Model(&models.User{}).
|
||
Where("id = ? AND deleted_at = ?", target.ID, 0).
|
||
Updates(map[string]interface{}{
|
||
"wx_openid": openid,
|
||
"updated_at": now,
|
||
}).Error
|
||
})
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
|
||
admin, err := repositories.GetUserByID(target.ID)
|
||
if err != nil || admin == nil {
|
||
utils.ServerError(c, fmt.Errorf("merged but reload admin failed"))
|
||
return
|
||
}
|
||
|
||
tokenString, expireUnix, err := middleware.GenerateToken(admin.ID, admin.Username, admin.Role)
|
||
if err != nil {
|
||
utils.ServerError(c, err)
|
||
return
|
||
}
|
||
|
||
go func() {
|
||
ip := c.ClientIP()
|
||
location := utils.GetRegion(ip)
|
||
logEntry := &models.UserAccessLog{
|
||
UserID: admin.ID,
|
||
UserIP: ip,
|
||
UserLocation: location,
|
||
}
|
||
_ = repositories.CreateUserAccessLog(logEntry)
|
||
}()
|
||
|
||
utils.Success(c, gin.H{
|
||
"token": tokenString,
|
||
"expire": expireUnix,
|
||
"user": repositories.BuildUserResponse(admin),
|
||
})
|
||
}
|