feat: 实现 argon2 哈希池、令牌与登录锁定计数

2026-09-30 06:52:20 +08:00
parent f2fe4bdbbe
commit 47d627c2e7
5 changed files with 487 additions and 0 deletions
@@ -0,0 +1,155 @@
+package auth
+
+import (
+	"sync"
+	"time"
+)
+
+type lockPolicy struct {
+	window   time.Duration
+	maxFails int
+	lockFor  time.Duration
+}
+
+func policyFor(kind LockKind) lockPolicy {
+	switch kind {
+	case LockLoginEndpoint, LockTalkTarget:
+		return lockPolicy{window: time.Hour, maxFails: 50, lockFor: time.Hour}
+	default:
+		// LockLoginEndpointIP、LockTalkPair、LockAdminIP、LockRegisterIP
+		return lockPolicy{window: 5 * time.Minute, maxFails: 10, lockFor: 5 * time.Minute}
+	}
+}
+
+type lockEntry struct {
+	fails       []time.Time
+	lockedUntil time.Time
+}
+
+// MemoryLocks 是内存锁定计数器（重启清零）。
+type MemoryLocks struct {
+	mu      sync.Mutex
+	entries map[string]*lockEntry
+	now     func() time.Time
+}
+
+// NewLoginLocks 创建默认锁定计数器。
+func NewLoginLocks() *MemoryLocks {
+	return &MemoryLocks{
+		entries: make(map[string]*lockEntry),
+		now:     time.Now,
+	}
+}
+
+// SetClock 注入时钟（测试到期解除）。
+func (l *MemoryLocks) SetClock(now func() time.Time) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if now == nil {
+		l.now = time.Now
+		return
+	}
+	l.now = now
+}
+
+func lockMapKey(key LockKey) string {
+	return string(key.Kind) + "|" + key.EndpointID + "|" + key.PeerID + "|" + key.IP
+}
+
+// Check 若当前已锁定返回 locked=true 与剩余时间。
+func (l *MemoryLocks) Check(key LockKey) (bool, time.Duration) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := l.now()
+	e := l.entries[lockMapKey(key)]
+	if e == nil {
+		return false, 0
+	}
+	if e.lockedUntil.After(now) {
+		return true, e.lockedUntil.Sub(now)
+	}
+	// 到期自动解除：清空锁定与窗口内失败（保留结构以便后续 Fail）。
+	if !e.lockedUntil.IsZero() && !e.lockedUntil.After(now) {
+		e.lockedUntil = time.Time{}
+		e.fails = nil
+	}
+	return false, 0
+}
+
+// Fail 记录一次失败；若因此触发锁定，返回 locked=true。
+func (l *MemoryLocks) Fail(key LockKey) (bool, time.Duration) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := l.now()
+	k := lockMapKey(key)
+	e := l.entries[k]
+	if e == nil {
+		e = &lockEntry{}
+		l.entries[k] = e
+	}
+	if e.lockedUntil.After(now) {
+		return true, e.lockedUntil.Sub(now)
+	}
+	if !e.lockedUntil.IsZero() {
+		e.lockedUntil = time.Time{}
+		e.fails = nil
+	}
+	pol := policyFor(key.Kind)
+	cutoff := now.Add(-pol.window)
+	kept := e.fails[:0]
+	for _, t := range e.fails {
+		if t.After(cutoff) {
+			kept = append(kept, t)
+		}
+	}
+	e.fails = append(kept, now)
+	if len(e.fails) >= pol.maxFails {
+		e.lockedUntil = now.Add(pol.lockFor)
+		e.fails = nil
+		return true, pol.lockFor
+	}
+	return false, 0
+}
+
+// ClearEndpoint 清除某端编号相关的登录锁定（两种都清）。
+func (l *MemoryLocks) ClearEndpoint(endpointID string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	for k, e := range l.entries {
+		// kind|endpoint|peer|ip
+		parts := splitLockKey(k)
+		if len(parts) != 4 {
+			continue
+		}
+		kind, ep := LockKind(parts[0]), parts[1]
+		if ep != endpointID {
+			continue
+		}
+		if kind == LockLoginEndpointIP || kind == LockLoginEndpoint {
+			delete(l.entries, k)
+			_ = e
+		}
+	}
+}
+
+// Clear 清除精确键。
+func (l *MemoryLocks) Clear(key LockKey) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.entries, lockMapKey(key))
+}
+
+func splitLockKey(k string) []string {
+	out := make([]string, 0, 4)
+	start := 0
+	for i := 0; i < len(k); i++ {
+		if k[i] == '|' {
+			out = append(out, k[start:i])
+			start = i + 1
+		}
+	}
+	out = append(out, k[start:])
+	return out
+}
+
+var _ LoginLocks = (*MemoryLocks)(nil)