zxyszx
86773c64ca
Docker Release / Check web and api (push) Waiting to run
Docker Release / Resolve release tag (push) Blocked by required conditions
Docker Release / Build and publish all-in-one (push) Blocked by required conditions
Docker Release / Build and publish api (push) Blocked by required conditions
Docker Release / Build and publish web (push) Blocked by required conditions
Docker Release / Build and publish dovecot (push) Blocked by required conditions
Docker Release / Build and publish postfix (push) Blocked by required conditions
Docker Release / Build and publish rspamd (push) Blocked by required conditions
Docker Release / Create GitHub release (push) Blocked by required conditions
311 lines
11 KiB
Go
311 lines
11 KiB
Go
package app
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
func (a *App) handleLogin(w http.ResponseWriter, r *http.Request) {
|
|
var req struct {
|
|
LoginName string `json:"loginName"`
|
|
Email string `json:"email"`
|
|
Password string `json:"password"`
|
|
TurnstileToken string `json:"turnstileToken"`
|
|
ChallengeToken string `json:"challengeToken"`
|
|
TwoFactorCode string `json:"twoFactorCode"`
|
|
}
|
|
if err := decodeJSON(r, &req); err != nil {
|
|
badRequest(w, err)
|
|
return
|
|
}
|
|
if strings.TrimSpace(req.ChallengeToken) != "" {
|
|
challenge, err := a.loginChallengeByToken(r.Context(), req.ChallengeToken)
|
|
if err != nil {
|
|
respondError(w, http.StatusUnauthorized, "验证已过期，请重新登录")
|
|
return
|
|
}
|
|
user, secret, err := a.loadUserAuthByID(r.Context(), challenge.UserID)
|
|
if err != nil || user.Disabled || !user.TwoFactorEnabled || strings.TrimSpace(secret) == "" {
|
|
a.deleteLoginChallenge(r.Context(), challenge.ID)
|
|
respondError(w, http.StatusUnauthorized, "验证已过期，请重新登录")
|
|
return
|
|
}
|
|
if !verifyTOTP(secret, req.TwoFactorCode, a.now().UTC()) {
|
|
ok, consumeErr := a.consumeTwoFactorRecoveryCode(r.Context(), user.ID, req.TwoFactorCode)
|
|
if consumeErr != nil || !ok {
|
|
respondError(w, http.StatusUnauthorized, "验证码或恢复码错误")
|
|
return
|
|
}
|
|
}
|
|
a.deleteLoginChallenge(r.Context(), challenge.ID)
|
|
if err := a.issueSession(w, r, user.ID); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "登录失败，请稍后重试")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, map[string]any{"user": user})
|
|
return
|
|
}
|
|
if err := a.verifyTurnstile(r.Context(), req.TurnstileToken, r.RemoteAddr); err != nil {
|
|
respondError(w, http.StatusUnauthorized, "人机验证失败，请重试")
|
|
return
|
|
}
|
|
emailInput := req.Email
|
|
if strings.TrimSpace(emailInput) == "" && strings.Contains(strings.TrimSpace(req.LoginName), "@") {
|
|
emailInput = req.LoginName
|
|
}
|
|
email, err := cleanPrimaryEmail(emailInput)
|
|
if err != nil {
|
|
respondError(w, http.StatusUnauthorized, "账号或密码错误")
|
|
return
|
|
}
|
|
user, passwordHash, err := a.userByEmail(r.Context(), email)
|
|
if err != nil || user.Disabled {
|
|
respondError(w, http.StatusUnauthorized, "账号或密码错误")
|
|
return
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(passwordHash), []byte(req.Password)); err != nil {
|
|
respondError(w, http.StatusUnauthorized, "账号或密码错误")
|
|
return
|
|
}
|
|
if a.config().TwoFactorEnabled && user.TwoFactorEnabled {
|
|
challengeToken, err := a.createLoginChallenge(r.Context(), user.ID)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "验证码生成失败，请稍后重试")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, map[string]any{"twoFactorRequired": true, "challengeToken": challengeToken})
|
|
return
|
|
}
|
|
if err := a.issueSession(w, r, user.ID); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "登录失败，请稍后重试")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, map[string]any{"user": user})
|
|
}
|
|
|
|
func (a *App) handleRegister(w http.ResponseWriter, r *http.Request) {
|
|
if !a.config().OpenRegistration {
|
|
respondError(w, http.StatusForbidden, "当前未开放注册")
|
|
return
|
|
}
|
|
var req struct {
|
|
Email string `json:"email"`
|
|
DisplayName string `json:"displayName"`
|
|
Password string `json:"password"`
|
|
TurnstileToken string `json:"turnstileToken"`
|
|
DomainID string `json:"domainId"`
|
|
LocalPart string `json:"localPart"`
|
|
}
|
|
if err := decodeJSON(r, &req); err != nil {
|
|
badRequest(w, err)
|
|
return
|
|
}
|
|
if err := a.verifyTurnstile(r.Context(), req.TurnstileToken, r.RemoteAddr); err != nil {
|
|
respondError(w, http.StatusUnauthorized, "人机验证失败，请重试")
|
|
return
|
|
}
|
|
email, err := cleanPrimaryEmail(req.Email)
|
|
if err != nil {
|
|
badRequest(w, errors.New("邮箱地址无效"))
|
|
return
|
|
}
|
|
if !hasMinimumPasswordLength(req.Password) {
|
|
badRequest(w, errors.New("密码至少需要 6 个字符"))
|
|
return
|
|
}
|
|
displayName := strings.TrimSpace(req.DisplayName)
|
|
if displayName == "" {
|
|
badRequest(w, errors.New("请输入显示名称"))
|
|
return
|
|
}
|
|
if len([]rune(displayName)) > 80 {
|
|
badRequest(w, errors.New("显示名称不能超过 80 个字符"))
|
|
return
|
|
}
|
|
parts := strings.SplitN(email, "@", 2)
|
|
mailboxLocalPart := normalizeLocalPart(req.LocalPart)
|
|
if mailboxLocalPart == "" {
|
|
mailboxLocalPart = normalizeLocalPart(parts[0])
|
|
}
|
|
mailboxDomainID := strings.TrimSpace(req.DomainID)
|
|
var mailboxDomain string
|
|
if mailboxDomainID != "" {
|
|
err = a.db.QueryRowContext(r.Context(), `SELECT name FROM domains WHERE id=? AND status='active'`, mailboxDomainID).Scan(&mailboxDomain)
|
|
} else {
|
|
err = a.db.QueryRowContext(r.Context(), `SELECT id,name FROM domains WHERE lower(name)=? AND status='active' ORDER BY created_at LIMIT 1`, normalizeDomain(parts[1])).Scan(&mailboxDomainID, &mailboxDomain)
|
|
}
|
|
if err != nil {
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
badRequest(w, errors.New("所选邮箱域名不可用"))
|
|
} else {
|
|
respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
|
|
}
|
|
return
|
|
}
|
|
if mailboxLocalPart == "" || !strings.EqualFold(email, mailboxLocalPart+"@"+normalizeDomain(mailboxDomain)) {
|
|
badRequest(w, errors.New("邮箱地址与所选前缀和域名不一致"))
|
|
return
|
|
}
|
|
for _, item := range parseReservedPrefixes(a.config().ReservedMailboxPrefixes) {
|
|
if item == mailboxLocalPart {
|
|
respondError(w, http.StatusForbidden, "该前缀已被保留，请使用其他前缀")
|
|
return
|
|
}
|
|
}
|
|
if _, _, err := a.userByEmail(r.Context(), email); err == nil {
|
|
respondError(w, http.StatusConflict, "该邮箱已被注册")
|
|
return
|
|
} else if !errors.Is(err, errNotFound) {
|
|
respondError(w, http.StatusInternalServerError, "failed to check user")
|
|
return
|
|
}
|
|
passwordHash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to hash password")
|
|
return
|
|
}
|
|
now := a.now().UTC().Format(time.RFC3339Nano)
|
|
userID := newID("usr")
|
|
tx, err := a.db.BeginTx(r.Context(), nil)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
|
|
return
|
|
}
|
|
defer tx.Rollback()
|
|
if _, err := tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
|
|
VALUES(?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", string(passwordHash), 0, now, now); err != nil {
|
|
if strings.Contains(strings.ToLower(err.Error()), "unique") {
|
|
respondError(w, http.StatusConflict, "该邮箱已被注册")
|
|
return
|
|
}
|
|
respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
|
|
return
|
|
}
|
|
if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, mailboxDomainID, mailboxLocalPart, displayName, string(passwordHash), 1024, "active"); err != nil {
|
|
if strings.Contains(strings.ToLower(err.Error()), "unique") {
|
|
respondError(w, http.StatusConflict, "该邮箱已被注册")
|
|
} else {
|
|
respondError(w, http.StatusInternalServerError, "邮箱创建失败，请稍后重试")
|
|
}
|
|
return
|
|
}
|
|
if err := tx.Commit(); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
|
|
return
|
|
}
|
|
user, err := a.userByID(r.Context(), userID)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to load user")
|
|
return
|
|
}
|
|
if err := a.issueSession(w, r, user.ID); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "登录失败，请稍后重试")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusCreated, map[string]any{"user": user})
|
|
}
|
|
|
|
func (a *App) handleLogout(w http.ResponseWriter, r *http.Request) {
|
|
if cookie, err := r.Cookie(a.config().CookieName); err == nil {
|
|
_, _ = a.db.ExecContext(r.Context(), `DELETE FROM sessions WHERE token_hash=?`, hashToken(cookie.Value))
|
|
}
|
|
http.SetCookie(w, &http.Cookie{Name: a.config().CookieName, Value: "", Path: "/", MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode})
|
|
respondJSON(w, http.StatusOK, map[string]any{"ok": true})
|
|
}
|
|
|
|
func (a *App) handleMe(w http.ResponseWriter, r *http.Request) {
|
|
respondJSON(w, http.StatusOK, map[string]any{"user": currentUser(r)})
|
|
}
|
|
|
|
func (a *App) handleUpdateProfile(w http.ResponseWriter, r *http.Request) {
|
|
user := currentUser(r)
|
|
if user == nil || user.Role != "admin" {
|
|
respondError(w, http.StatusForbidden, "显示名称注册后不可自行修改，如需更换请联系管理员")
|
|
return
|
|
}
|
|
var req struct {
|
|
DisplayName string `json:"displayName"`
|
|
}
|
|
if err := decodeJSON(r, &req); err != nil {
|
|
badRequest(w, err)
|
|
return
|
|
}
|
|
displayName := strings.TrimSpace(req.DisplayName)
|
|
if displayName == "" {
|
|
badRequest(w, errors.New("请输入显示名称"))
|
|
return
|
|
}
|
|
if len([]rune(displayName)) > 80 {
|
|
badRequest(w, errors.New("显示名称不能超过 80 个字符"))
|
|
return
|
|
}
|
|
_, err := a.db.ExecContext(r.Context(), `UPDATE users SET display_name=?, updated_at=? WHERE id=?`,
|
|
displayName, a.now().UTC().Format(time.RFC3339Nano), user.ID)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to update profile")
|
|
return
|
|
}
|
|
updated, err := a.userByID(r.Context(), user.ID)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to load profile")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, map[string]any{"user": updated})
|
|
}
|
|
|
|
func (a *App) handleChangePassword(w http.ResponseWriter, r *http.Request) {
|
|
user := currentUser(r)
|
|
var req struct {
|
|
CurrentPassword string `json:"currentPassword"`
|
|
NewPassword string `json:"newPassword"`
|
|
}
|
|
if err := decodeJSON(r, &req); err != nil {
|
|
badRequest(w, err)
|
|
return
|
|
}
|
|
if !hasMinimumPasswordLength(req.NewPassword) {
|
|
badRequest(w, errors.New("新密码至少需要 6 个字符"))
|
|
return
|
|
}
|
|
row := a.db.QueryRowContext(r.Context(), `SELECT password_hash FROM users WHERE id=?`, user.ID)
|
|
var currentHash string
|
|
if err := row.Scan(¤tHash); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to load user")
|
|
return
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(currentHash), []byte(req.CurrentPassword)); err != nil {
|
|
respondError(w, http.StatusUnauthorized, "当前密码错误")
|
|
return
|
|
}
|
|
newHash, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to hash password")
|
|
return
|
|
}
|
|
now := a.now().UTC().Format(time.RFC3339Nano)
|
|
tx, err := a.db.BeginTx(r.Context(), nil)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to start transaction")
|
|
return
|
|
}
|
|
defer tx.Rollback()
|
|
if _, err := tx.ExecContext(r.Context(), `UPDATE users SET password_hash=?, updated_at=? WHERE id=?`, string(newHash), now, user.ID); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to update password")
|
|
return
|
|
}
|
|
if _, err := tx.ExecContext(r.Context(), `UPDATE mailboxes SET password_hash=?, updated_at=? WHERE user_id=?`, string(newHash), now, user.ID); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to update mailbox password")
|
|
return
|
|
}
|
|
if err := tx.Commit(); err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to save password")
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, map[string]any{"ok": true})
|
|
}
|