HI-VPN/hi-server
4
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

新功能(#48): 用户封禁链路接入 (#32)

Browse Source 
Co-authored-by: multica-agent <github@multica.ai>
This commit is contained in:
shanshanzhong147
2026-06-16 06:28:47 -07:00
committed by GitHub
parent 3d1a31a19f
commit 77fa0cadd2
17 changed files with 581 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+2
View File
@@ -82,6 +82,7 @@ require (
github.com/alibabacloud-go/tea-utils v1.4.5 // indirect
github.com/alibabacloud-go/tea-utils/v2 v2.0.7 // indirect
github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
github.com/alicebob/miniredis/v2 v2.35.0 // indirect
github.com/aliyun/credentials-go v1.3.10 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
@@ -145,6 +146,7 @@ require (
github.com/tjfoc/gmsm v1.4.1 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/ugorji/go/codec v1.2.12 // indirect
github.com/yuin/gopher-lua v1.1.1 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 // indirect
go.opentelemetry.io/otel/metric v1.29.0 // indirect
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
go.sum
+4
View File
@@ -54,6 +54,8 @@ github.com/alibabacloud-go/tea-utils/v2 v2.0.7/go.mod h1:qxn986l+q33J5VkialKMqT/
github.com/alibabacloud-go/tea-xml v1.1.2/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
github.com/alibabacloud-go/tea-xml v1.1.3 h1:7LYnm+JbOq2B+T/B0fHC4Ies4/FofC4zHzYtqw7dgt0=
github.com/alibabacloud-go/tea-xml v1.1.3/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
github.com/aliyun/credentials-go v1.3.6/go.mod h1:1LxUuX7L5YrZUWzBrRyk0SwSdH4OmPrib8NVePL3fxM=
github.com/aliyun/credentials-go v1.3.10 h1:45Xxrae/evfzQL9V10zL3xX31eqgLWEaIdCoPipOEQA=
@@ -395,6 +397,8 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
github.com/yuin/goldmark v1.1.30/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
internal/config/cacheKey.go
+3
View File
@@ -70,3 +70,6 @@ const RegisterIpKeyPrefix = "register:ip:"
// UserSessionsKeyPrefix per-user sessions zset key prefix
const UserSessionsKeyPrefix = "auth:user_sessions:"
// UserEnableKeyPrefix user enable state cache key prefix
const UserEnableKeyPrefix = "user:enable:"
internal/logic/admin/user/kickOfflineByUserDeviceLogic.go
+2 -79
View File
@@ -2,11 +2,7 @@ package user
import (
"context"
"fmt"
"strconv"
"strings"
"github.com/perfect-panel/server/internal/config"
"github.com/perfect-panel/server/internal/svc"
"github.com/perfect-panel/server/internal/types"
"github.com/perfect-panel/server/pkg/logger"
@@ -50,84 +46,11 @@ func (l *KickOfflineByUserDeviceLogic) KickOfflineByUserDevice(req *types.KickOf
// clearAllSessions 清除指定用户的所有会话（通过 SCAN 查找，不依赖 sorted set）
func (l *KickOfflineByUserDeviceLogic) clearAllSessions(userId int64) {
sessionSet := make(map[string]struct{})
userIDText := strconv.FormatInt(userId, 10)
pattern := fmt.Sprintf("%s:*", config.SessionIdKey)
var cursor uint64
for {
keys, nextCursor, scanErr := l.svcCtx.Redis.Scan(l.ctx, cursor, pattern, 200).Result()
if scanErr != nil {
l.Errorw("扫描会话键失败", logger.Field("user_id", userId), logger.Field("error", scanErr.Error()))
break
}
for _, sessionKey := range keys {
value, getErr := l.svcCtx.Redis.Get(l.ctx, sessionKey).Result()
if getErr != nil || value != userIDText {
continue
}
sessionID := strings.TrimPrefix(sessionKey, config.SessionIdKey+":")
if sessionID == "" || strings.HasPrefix(sessionID, "detail:") {
continue
}
sessionSet[sessionID] = struct{}{}
}
cursor = nextCursor
if cursor == 0 {
break
}
}
deviceKeySet := make(map[string]struct{})
devicePattern := fmt.Sprintf("%s:*", config.DeviceCacheKeyKey)
cursor = 0
for {
keys, nextCursor, scanErr := l.svcCtx.Redis.Scan(l.ctx, cursor, devicePattern, 200).Result()
if scanErr != nil {
l.Errorw("扫描设备会话映射失败", logger.Field("user_id", userId), logger.Field("error", scanErr.Error()))
break
}
for _, deviceKey := range keys {
sessionID, getErr := l.svcCtx.Redis.Get(l.ctx, deviceKey).Result()
if getErr != nil {
continue
}
if _, exists := sessionSet[sessionID]; exists {
deviceKeySet[deviceKey] = struct{}{}
}
}
cursor = nextCursor
if cursor == 0 {
break
}
}
if len(sessionSet) == 0 {
return
}
sessionsKey := fmt.Sprintf("%s%v", config.UserSessionsKeyPrefix, userId)
pipe := l.svcCtx.Redis.TxPipeline()
for sessionID := range sessionSet {
pipe.Del(l.ctx, fmt.Sprintf("%v:%v", config.SessionIdKey, sessionID))
pipe.Del(l.ctx, fmt.Sprintf("%s:detail:%s", config.SessionIdKey, sessionID))
pipe.ZRem(l.ctx, sessionsKey, sessionID)
}
pipe.Del(l.ctx, sessionsKey)
for deviceKey := range deviceKeySet {
pipe.Del(l.ctx, deviceKey)
}
if _, err := pipe.Exec(l.ctx); err != nil {
if err := clearAllSessions(l.ctx, l.svcCtx, userId); err != nil {
l.Errorw("清理会话缓存失败",
logger.Field("user_id", userId),
logger.Field("error", err.Error()),
)
return
}
l.Infow("[KickOffline] 管理员踢设备-清除所有Session",
logger.Field("user_id", userId),
logger.Field("count", len(sessionSet)),
)
}
internal/logic/admin/user/session.go
+81
View File
@@ -0,0 +1,81 @@
package user
import (
"context"
"fmt"
"strconv"
"strings"
"github.com/perfect-panel/server/internal/config"
"github.com/perfect-panel/server/internal/svc"
)
func clearAllSessions(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) error {
userIDText := strconv.FormatInt(userID, 10)
sessionSet := make(map[string]struct{})
pattern := fmt.Sprintf("%s:*", config.SessionIdKey)
var cursor uint64
for {
keys, nextCursor, err := svcCtx.Redis.Scan(ctx, cursor, pattern, 200).Result()
if err != nil {
return err
}
for _, sessionKey := range keys {
value, err := svcCtx.Redis.Get(ctx, sessionKey).Result()
if err != nil || value != userIDText {
continue
}
sessionID := strings.TrimPrefix(sessionKey, config.SessionIdKey+":")
if sessionID == "" || strings.HasPrefix(sessionID, "detail:") {
continue
}
sessionSet[sessionID] = struct{}{}
}
cursor = nextCursor
if cursor == 0 {
break
}
}
if len(sessionSet) == 0 {
return nil
}
deviceKeySet := make(map[string]struct{})
devicePattern := fmt.Sprintf("%s:*", config.DeviceCacheKeyKey)
cursor = 0
for {
keys, nextCursor, err := svcCtx.Redis.Scan(ctx, cursor, devicePattern, 200).Result()
if err != nil {
return err
}
for _, deviceKey := range keys {
sessionID, err := svcCtx.Redis.Get(ctx, deviceKey).Result()
if err != nil {
continue
}
if _, exists := sessionSet[sessionID]; exists {
deviceKeySet[deviceKey] = struct{}{}
}
}
cursor = nextCursor
if cursor == 0 {
break
}
}
sessionsKey := fmt.Sprintf("%s%v", config.UserSessionsKeyPrefix, userID)
pipe := svcCtx.Redis.TxPipeline()
for sessionID := range sessionSet {
pipe.Del(ctx, fmt.Sprintf("%v:%v", config.SessionIdKey, sessionID))
pipe.Del(ctx, fmt.Sprintf("%s:detail:%s", config.SessionIdKey, sessionID))
pipe.ZRem(ctx, sessionsKey, sessionID)
}
pipe.Del(ctx, sessionsKey)
for deviceKey := range deviceKeySet {
pipe.Del(ctx, deviceKey)
}
_, err := pipe.Exec(ctx)
return err
}
internal/logic/admin/user/session_test.go
+74
View File
@@ -0,0 +1,74 @@
package user
import (
"context"
"testing"
"github.com/alicebob/miniredis/v2"
"github.com/perfect-panel/server/internal/config"
"github.com/perfect-panel/server/internal/svc"
"github.com/redis/go-redis/v9"
)
func TestClearAllSessions(t *testing.T) {
redisServer, err := miniredis.Run()
if err != nil {
t.Fatalf("miniredis.Run() error = %v", err)
}
defer redisServer.Close()
rdb := redis.NewClient(&redis.Options{Addr: redisServer.Addr()})
defer rdb.Close()
svcCtx := &svc.ServiceContext{Redis: rdb}
ctx := context.Background()
userID := int64(42)
sessionID := "session-a"
otherSessionID := "session-b"
userSessionKey := config.SessionIdKey + ":" + sessionID
userDetailKey := config.SessionIdKey + ":detail:" + sessionID
otherSessionKey := config.SessionIdKey + ":" + otherSessionID
userSessionsZSet := config.UserSessionsKeyPrefix + "42"
deviceKey := config.DeviceCacheKeyKey + ":device-1"
unrelatedDeviceKey := config.DeviceCacheKeyKey + ":device-2"
setString(t, redisServer, userSessionKey, "42")
setString(t, redisServer, userDetailKey, "detail")
setString(t, redisServer, otherSessionKey, "99")
setString(t, redisServer, deviceKey, sessionID)
setString(t, redisServer, unrelatedDeviceKey, otherSessionID)
if _, err := redisServer.ZAdd(userSessionsZSet, 1, sessionID); err != nil {
t.Fatalf("seed session zset: %v", err)
}
if err := clearAllSessions(ctx, svcCtx, userID); err != nil {
t.Fatalf("clearAllSessions() error = %v", err)
}
assertMissing(t, redisServer, userSessionKey)
assertMissing(t, redisServer, userDetailKey)
assertMissing(t, redisServer, deviceKey)
assertMissing(t, redisServer, userSessionsZSet)
if !redisServer.Exists(otherSessionKey) {
t.Fatalf("unrelated session %q should remain", otherSessionKey)
}
if !redisServer.Exists(unrelatedDeviceKey) {
t.Fatalf("unrelated device mapping %q should remain", unrelatedDeviceKey)
}
}
func setString(t *testing.T, server *miniredis.Miniredis, key, value string) {
t.Helper()
if err := server.Set(key, value); err != nil {
t.Fatalf("set %q: %v", key, err)
}
}
func assertMissing(t *testing.T, server *miniredis.Miniredis, key string) {
t.Helper()
if server.Exists(key) {
t.Fatalf("expected key %q to be removed", key)
}
}
internal/logic/admin/user/updateUserBasicInfoLogic.go
+21
View File
@@ -44,6 +44,14 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
if req.Avatar != "" && !tool.IsValidImageSize(req.Avatar, 1024) {
return errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "Invalid Image Size")
}
if req.Enable != nil && !*req.Enable {
if userInfo.IsAdmin != nil && *userInfo.IsAdmin {
return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "admin user cannot be disabled")
}
if userInfo.Id == 2 {
return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "demo user cannot be disabled")
}
}
err = l.svcCtx.UserModel.Transaction(l.ctx, func(tx *gorm.DB) error {
if req.Balance != nil && userInfo.Balance != *req.Balance {
@@ -176,6 +184,19 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
}
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "Update User Error")
}
if req.Enable != nil {
if cacheErr := logicCommon.InvalidateUserEnableCache(l.ctx, l.svcCtx, userInfo.Id); cacheErr != nil {
l.Errorw("[UpdateUserBasicInfoLogic] clear enable cache failed", logger.Field("err", cacheErr.Error()), logger.Field("userId", req.UserId))
}
if !*req.Enable {
if sessionErr := clearAllSessions(l.ctx, l.svcCtx, userInfo.Id); sessionErr != nil {
l.Errorw("[UpdateUserBasicInfoLogic] clear sessions failed", logger.Field("err", sessionErr.Error()), logger.Field("userId", req.UserId))
}
for _, device := range userInfo.UserDevices {
l.svcCtx.DeviceManager.KickDevice(userInfo.Id, device.Identifier)
}
}
}
return nil
}
internal/logic/auth/admin/adminLoginLogic.go
+6
View File
@@ -7,6 +7,7 @@ import (
"github.com/perfect-panel/server/internal/config"
"github.com/perfect-panel/server/internal/logic/auth"
logiccommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/internal/model/log"
"github.com/perfect-panel/server/internal/model/user"
"github.com/perfect-panel/server/internal/svc"
@@ -19,6 +20,7 @@ import (
"github.com/perfect-panel/server/pkg/uuidx"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
)
@@ -94,6 +96,9 @@ func (l *AdminLoginLogic) AdminLogin(req *types.UserLoginRequest) (resp *types.L
if !tool.MultiPasswordVerify(userInfo.Algo, userInfo.Salt, req.Password, userInfo.Password) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserPasswordError), "user password")
}
if logiccommon.IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
// Bind device to user if identifier is provided
if req.Identifier != "" {
@@ -130,6 +135,7 @@ func (l *AdminLoginLogic) AdminLogin(req *types.UserLoginRequest) (resp *types.L
if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
}
l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
loginStatus = true
return &types.LoginResponse{
Token: token,
internal/logic/auth/emailLoginLogic.go
+6
View File
@@ -7,6 +7,7 @@ import (
"time"
"github.com/perfect-panel/server/internal/config"
logicCommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/internal/model/log"
"github.com/perfect-panel/server/internal/model/user"
"github.com/perfect-panel/server/internal/svc"
@@ -18,6 +19,7 @@ import (
"github.com/perfect-panel/server/pkg/uuidx"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
)
@@ -114,6 +116,9 @@ func (l *EmailLoginLogic) EmailLogin(req *types.EmailLoginRequest) (resp *types.
return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "register failed: %v", err.Error())
}
}
if logicCommon.IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
// Record login status
defer func() {
@@ -188,6 +193,7 @@ func (l *EmailLoginLogic) EmailLogin(req *types.EmailLoginRequest) (resp *types.
if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
}
l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
loginStatus = true
return &types.LoginResponse{
internal/logic/auth/oauth/oAuthLoginGetTokenLogic.go
+6
View File
@@ -9,6 +9,7 @@ import (
"github.com/perfect-panel/server/internal/config"
authlogic "github.com/perfect-panel/server/internal/logic/auth"
logiccommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/internal/model/auth"
"github.com/perfect-panel/server/internal/model/log"
"github.com/perfect-panel/server/internal/model/user"
@@ -23,6 +24,7 @@ import (
"github.com/perfect-panel/server/pkg/uuidx"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
)
@@ -74,6 +76,9 @@ func (l *OAuthLoginGetTokenLogic) OAuthLoginGetToken(req *types.OAuthLoginGetTok
if err != nil {
return nil, err
}
if logiccommon.IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
token, err := l.generateToken(userInfo, requestID)
if err != nil {
@@ -628,6 +633,7 @@ func (l *OAuthLoginGetTokenLogic) generateToken(userInfo *user.User, requestID s
)
return "", errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err)
}
l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
l.Infow("jwt token generated successfully",
logger.Field("request_id", requestID),
internal/logic/auth/telephoneLoginLogic.go
+5
View File
@@ -21,6 +21,7 @@ import (
"github.com/perfect-panel/server/pkg/uuidx"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
)
@@ -64,6 +65,9 @@ func (l *TelephoneLoginLogic) TelephoneLogin(req *types.TelephoneLoginRequest, r
}
return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "query user info failed: %v", err.Error())
}
if common.IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
// Record login status
defer func(svcCtx *svc.ServiceContext) {
if userInfo.Id != 0 {
@@ -165,6 +169,7 @@ func (l *TelephoneLoginLogic) TelephoneLogin(req *types.TelephoneLoginRequest, r
if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
}
l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
loginStatus = true
return &types.LoginResponse{
Token: token,
internal/logic/auth/userLoginLogic.go
+6
View File
@@ -5,6 +5,7 @@ import (
"fmt"
"time"
logicCommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/internal/model/log"
"github.com/perfect-panel/server/pkg/captcha"
"github.com/perfect-panel/server/pkg/constant"
@@ -17,6 +18,7 @@ import (
"github.com/perfect-panel/server/pkg/uuidx"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
"github.com/perfect-panel/server/internal/svc"
@@ -89,6 +91,9 @@ func (l *UserLoginLogic) UserLogin(req *types.UserLoginRequest) (resp *types.Log
if !tool.MultiPasswordVerify(userInfo.Algo, userInfo.Salt, req.Password, userInfo.Password) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserPasswordError), "user password")
}
if logicCommon.IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
// Update last login time
now := time.Now()
@@ -135,6 +140,7 @@ func (l *UserLoginLogic) UserLogin(req *types.UserLoginRequest) (resp *types.Log
if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
}
l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
loginStatus = true
return &types.LoginResponse{
Token: token,
internal/logic/auth/userRegisterLogic.go
+1 -1
View File
@@ -101,7 +101,7 @@ func (l *UserRegisterLogic) UserRegister(req *types.UserRegisterRequest) (resp *
} else if err == nil && !u.DeletedAt.Valid {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserExist), "user email exist: %v", req.Email)
} else if err == nil && u.DeletedAt.Valid {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "user email deleted: %v", req.Email)
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserNotExist), "user email deleted: %v", req.Email)
}
if !registerIpLimit(l.svcCtx, l.ctx, req.IP, "email", req.Email) {
internal/logic/common/user_enable.go
+89
View File
@@ -0,0 +1,89 @@
package common
import (
"context"
"fmt"
"strconv"
"time"
"github.com/perfect-panel/server/internal/config"
modeluser "github.com/perfect-panel/server/internal/model/user"
"github.com/perfect-panel/server/internal/svc"
"github.com/perfect-panel/server/pkg/logger"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/pkg/errors"
"github.com/redis/go-redis/v9"
)
const userEnableCacheTTL = 30 * time.Second
func UserEnableCacheKey(userID int64) string {
return fmt.Sprintf("%s%d", config.UserEnableKeyPrefix, userID)
}
func IsUserDisabled(userInfo *modeluser.User) bool {
return userInfo != nil && userInfo.Enable != nil && !*userInfo.Enable
}
func ResolveEnabledUser(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) (*modeluser.User, error) {
if userID <= 0 {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "invalid user id: %d", userID)
}
cacheKey := UserEnableCacheKey(userID)
cached, err := svcCtx.Redis.Get(ctx, cacheKey).Result()
if err == nil {
if cached == strconv.FormatBool(false) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
return svcCtx.UserModel.FindOne(ctx, userID)
}
if err != nil && err != redis.Nil {
logger.WithContext(ctx).Errorw("get user enable cache failed, fallback to db",
logger.Field("user_id", userID),
logger.Field("error", err.Error()),
)
return loadEnabledUserFromDB(ctx, svcCtx, userID)
}
userInfo, err := svcCtx.UserModel.FindOne(ctx, userID)
if err != nil {
return nil, err
}
if cacheErr := CacheUserEnabled(ctx, svcCtx, userID, !IsUserDisabled(userInfo)); cacheErr != nil {
logger.WithContext(ctx).Errorw("cache user enable state failed",
logger.Field("user_id", userID),
logger.Field("error", cacheErr.Error()),
)
}
if IsUserDisabled(userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
return userInfo, nil
}
func CacheUserEnabled(ctx context.Context, svcCtx *svc.ServiceContext, userID int64, enabled bool) error {
return svcCtx.Redis.Set(ctx, UserEnableCacheKey(userID), strconv.FormatBool(enabled), userEnableCacheTTL).Err()
}
func InvalidateUserEnableCache(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) error {
return svcCtx.Redis.Del(ctx, UserEnableCacheKey(userID)).Err()
}
func loadEnabledUserFromDB(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) (*modeluser.User, error) {
var userInfo modeluser.User
if err := svcCtx.DB.WithContext(ctx).
Model(&modeluser.User{}).
Unscoped().
Where("`id` = ?", userID).
Preload("UserDevices").
Preload("AuthMethods").
First(&userInfo).Error; err != nil {
return nil, err
}
if IsUserDisabled(&userInfo) {
return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
}
return &userInfo, nil
}
internal/logic/common/user_enable_test.go
+266
View File
@@ -0,0 +1,266 @@
package common
import (
"context"
"errors"
"regexp"
"testing"
"github.com/DATA-DOG/go-sqlmock"
"github.com/alicebob/miniredis/v2"
"github.com/perfect-panel/server/internal/model/user"
"github.com/perfect-panel/server/internal/svc"
"github.com/perfect-panel/server/pkg/xerr"
"github.com/redis/go-redis/v9"
"gorm.io/driver/mysql"
"gorm.io/gorm"
"gorm.io/gorm/schema"
)
func TestIsUserDisabled(t *testing.T) {
trueValue := true
falseValue := false
testCases := []struct {
name string
user *user.User
want bool
}{
{
name: "nil user treated as enabled",
user: nil,
want: false,
},
{
name: "nil enable treated as enabled",
user: &user.User{Id: 1},
want: false,
},
{
name: "enabled user",
user: &user.User{Id: 2, Enable: &trueValue},
want: false,
},
{
name: "disabled user",
user: &user.User{Id: 3, Enable: &falseValue},
want: true,
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
if got := IsUserDisabled(tc.user); got != tc.want {
t.Fatalf("IsUserDisabled() = %v, want %v", got, tc.want)
}
})
}
}
func TestResolveEnabledUser(t *testing.T) {
t.Run("cache hit false returns disabled error without db query", func(t *testing.T) {
svcCtx, mock, redisServer := newEnableTestServiceContext(t)
defer redisServer.Close()
ctx := context.Background()
if err := svcCtx.Redis.Set(ctx, UserEnableCacheKey(9), "false", 0).Err(); err != nil {
t.Fatalf("seed redis: %v", err)
}
_, err := ResolveEnabledUser(ctx, svcCtx, 9)
assertCodeError(t, err, xerr.UserDisabled)
if err := mock.ExpectationsWereMet(); err != nil {
t.Fatalf("unexpected db query: %v", err)
}
})
t.Run("cache miss loads enabled user and backfills cache", func(t *testing.T) {
svcCtx, mock, redisServer := newEnableTestServiceContext(t)
defer redisServer.Close()
expectFindOne(mock, 11, true)
ctx := context.Background()
userInfo, err := ResolveEnabledUser(ctx, svcCtx, 11)
if err != nil {
t.Fatalf("ResolveEnabledUser() error = %v", err)
}
if userInfo.Id != 11 {
t.Fatalf("ResolveEnabledUser() user id = %d, want 11", userInfo.Id)
}
cached, err := svcCtx.Redis.Get(ctx, UserEnableCacheKey(11)).Result()
if err != nil {
t.Fatalf("read backfilled cache: %v", err)
}
if cached != "true" {
t.Fatalf("backfilled cache = %q, want %q", cached, "true")
}
if err := mock.ExpectationsWereMet(); err != nil {
t.Fatalf("db expectations: %v", err)
}
})
t.Run("cache miss loads disabled user and caches false", func(t *testing.T) {
svcCtx, mock, redisServer := newEnableTestServiceContext(t)
defer redisServer.Close()
expectFindOne(mock, 13, false)
ctx := context.Background()
_, err := ResolveEnabledUser(ctx, svcCtx, 13)
assertCodeError(t, err, xerr.UserDisabled)
cached, cacheErr := svcCtx.Redis.Get(ctx, UserEnableCacheKey(13)).Result()
if cacheErr != nil {
t.Fatalf("read disabled cache: %v", cacheErr)
}
if cached != "false" {
t.Fatalf("disabled cache = %q, want %q", cached, "false")
}
if err := mock.ExpectationsWereMet(); err != nil {
t.Fatalf("db expectations: %v", err)
}
})
t.Run("redis failure falls back to db", func(t *testing.T) {
svcCtx, mock, redisServer := newEnableTestServiceContext(t)
expectFindOne(mock, 17, true)
redisServer.Close()
userInfo, err := ResolveEnabledUser(context.Background(), svcCtx, 17)
if err != nil {
t.Fatalf("ResolveEnabledUser() error = %v", err)
}
if userInfo.Id != 17 {
t.Fatalf("ResolveEnabledUser() user id = %d, want 17", userInfo.Id)
}
if err := mock.ExpectationsWereMet(); err != nil {
t.Fatalf("db expectations: %v", err)
}
})
}
func newEnableTestServiceContext(t *testing.T) (*svc.ServiceContext, sqlmock.Sqlmock, *miniredis.Miniredis) {
t.Helper()
sqlDB, mock, err := sqlmock.New()
if err != nil {
t.Fatalf("sqlmock.New() error = %v", err)
}
mock.MatchExpectationsInOrder(false)
t.Cleanup(func() {
_ = sqlDB.Close()
})
gdb, err := gorm.Open(mysql.New(mysql.Config{
Conn: sqlDB,
SkipInitializeWithVersion: true,
}), &gorm.Config{
NamingStrategy: schema.NamingStrategy{SingularTable: true},
})
if err != nil {
t.Fatalf("gorm.Open() error = %v", err)
}
redisServer, err := miniredis.Run()
if err != nil {
t.Fatalf("miniredis.Run() error = %v", err)
}
rdb := redis.NewClient(&redis.Options{Addr: redisServer.Addr()})
t.Cleanup(func() {
_ = rdb.Close()
})
return &svc.ServiceContext{
DB: gdb,
Redis: rdb,
UserModel: user.NewModel(gdb, rdb),
}, mock, redisServer
}
func expectFindOne(mock sqlmock.Sqlmock, userID int64, enabled bool) {
rows := sqlmock.NewRows([]string{
"id",
"password",
"algo",
"salt",
"avatar",
"balance",
"refer_code",
"referer_id",
"commission",
"referral_percentage",
"only_first_purchase",
"gift_amount",
"enable",
"is_admin",
"enable_balance_notify",
"enable_login_notify",
"enable_subscribe_notify",
"enable_trade_notify",
"rules",
"member_status",
"remark",
"last_login_time",
"created_at",
"updated_at",
"deleted_at",
}).AddRow(
userID,
"pwd",
"default",
"",
"",
int64(0),
"",
int64(0),
int64(0),
uint8(0),
true,
int64(0),
enabled,
false,
false,
false,
false,
false,
"",
"",
"",
nil,
nil,
nil,
nil,
)
mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user` WHERE `id` = ? ORDER BY `user`.`id` LIMIT ?")).
WithArgs(userID, 1).
WillReturnRows(rows)
mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user_device` WHERE `user_device`.`user_id` = ?")).
WithArgs(userID).
WillReturnRows(sqlmock.NewRows([]string{"id", "user_id", "identifier"}))
mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user_auth_methods` WHERE `user_auth_methods`.`user_id` = ?")).
WithArgs(userID).
WillReturnRows(sqlmock.NewRows([]string{"id", "user_id", "auth_type", "auth_identifier", "verified"}))
}
func assertCodeError(t *testing.T, err error, wantCode uint32) {
t.Helper()
if err == nil {
t.Fatal("expected error, got nil")
}
var codeErr *xerr.CodeError
if !errors.As(err, &codeErr) {
t.Fatalf("error %T does not contain xerr.CodeError: %v", err, err)
}
if codeErr.GetErrCode() != wantCode {
t.Fatalf("error code = %d, want %d", codeErr.GetErrCode(), wantCode)
}
}
internal/logic/subscribe/subscribeLogic.go
+5
View File
@@ -7,6 +7,7 @@ import (
"time"
"github.com/perfect-panel/server/adapter"
logiccommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/internal/model/client"
"github.com/perfect-panel/server/internal/model/group"
"github.com/perfect-panel/server/internal/model/log"
@@ -79,6 +80,10 @@ func (l *SubscribeLogic) Handler(req *types.SubscribeRequest) (resp *types.Subsc
l.Errorw("[SubscribeLogic] Get user subscribe failed", logger.Field("error", err.Error()), logger.Field("token", req.Token))
return nil, err
}
if _, err := logiccommon.ResolveEnabledUser(l.ctx.Request.Context(), l.svc, userSubscribe.UserId); err != nil {
l.Errorw("[SubscribeLogic] User disabled", logger.Field("error", err.Error()), logger.Field("userId", userSubscribe.UserId))
return nil, err
}
var subscribeStatus = false
defer func() {
internal/middleware/authMiddleware.go
+4 -3
View File
@@ -6,6 +6,7 @@ import (
"strings"
"time"
logiccommon "github.com/perfect-panel/server/internal/logic/common"
"github.com/perfect-panel/server/pkg/constant"
"github.com/perfect-panel/server/pkg/logger"
@@ -87,10 +88,10 @@ func authenticateRequest(c *gin.Context, svc *svc.ServiceContext, token string,
svc.Redis.Expire(c, sessionIdCacheKey, time.Duration(svc.Config.JwtAuth.AccessExpire)*time.Second)
userInfo, err := svc.UserModel.FindOne(c, userId)
userInfo, err := logiccommon.ResolveEnabledUser(c, svc, userId)
if err != nil {
logger.WithContext(c.Request.Context()).Debug("[AuthMiddleware] UserModel FindOne", logger.Field("error", err.Error()), logger.Field("userId", userId))
result.HttpResult(c, nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "Database Query Error"))
logger.WithContext(c.Request.Context()).Debug("[AuthMiddleware] ResolveEnabledUser", logger.Field("error", err.Error()), logger.Field("userId", userId))
result.HttpResult(c, nil, err)
c.Abort()
return false
}