forked from wangziqi/gongxue-base
wangziqi
a644a8de42
- 全模块类型化:controller 的 req: any → AuthenticatedRequest/RequestUser, 聚合查询 getRawMany 泛型标注、导入行/响应体定义具体 interface、 catch (e: any) → unknown + 收窄、no-base-to-string 用 String() 显式转换 - 第三方无类型库边界(pdfkit/exceljs)文件级或单行 disable 并注明理由 - 顺带修复:get-business-context.tool 两个 require-await error、 bills.controller 参数顺序隐患、main.ts compression 调用 - 运行时逻辑零改动;测试 142 套件 / 1065 用例全部通过
100 lines
3.4 KiB
TypeScript
100 lines
3.4 KiB
TypeScript
import { Injectable, UnauthorizedException, forwardRef, Inject } from '@nestjs/common';
|
||
import { InjectRepository } from '@nestjs/typeorm';
|
||
import { Repository } from 'typeorm';
|
||
import { JwtService } from '@nestjs/jwt';
|
||
import * as bcrypt from 'bcryptjs';
|
||
import { User } from '../entities/user.entity';
|
||
import { LoginDto } from './dto/auth.dto';
|
||
import { RbacService } from '../rbac/rbac.service';
|
||
|
||
// 内存中的登录失败计数器（按IP+用户名）
|
||
const loginAttempts = new Map<string, { count: number; lockedUntil?: Date }>();
|
||
const MAX_ATTEMPTS = 5;
|
||
const LOCK_MINUTES = 15;
|
||
|
||
@Injectable()
|
||
export class AuthService {
|
||
constructor(
|
||
@InjectRepository(User) private userRepo: Repository<User>,
|
||
private jwtService: JwtService,
|
||
@Inject(forwardRef(() => RbacService)) private rbacService: RbacService,
|
||
) {}
|
||
|
||
async login(dto: LoginDto, ip?: string) {
|
||
const attemptKey = `${ip || 'unknown'}:${dto.username}`;
|
||
const attempt = loginAttempts.get(attemptKey);
|
||
|
||
// 检查是否在锁定期
|
||
if (attempt?.lockedUntil && attempt.lockedUntil > new Date()) {
|
||
const remaining = Math.ceil((attempt.lockedUntil.getTime() - Date.now()) / 60000);
|
||
throw new UnauthorizedException(`账号已被临时锁定，请 ${remaining} 分钟后重试`);
|
||
}
|
||
|
||
const user = await this.userRepo.findOne({
|
||
where: { username: dto.username },
|
||
relations: ['roles'],
|
||
});
|
||
if (!user) {
|
||
this.recordFailedAttempt(attemptKey);
|
||
throw new UnauthorizedException('用户名或密码错误');
|
||
}
|
||
if (user.isArchived) {
|
||
throw new UnauthorizedException('账号已失效，请联系管理员');
|
||
}
|
||
const valid = await bcrypt.compare(dto.password, user.passwordHash);
|
||
if (!valid) {
|
||
this.recordFailedAttempt(attemptKey);
|
||
const att = loginAttempts.get(attemptKey);
|
||
const remaining = MAX_ATTEMPTS - (att?.count || 0);
|
||
if (remaining > 0) {
|
||
throw new UnauthorizedException(`用户名或密码错误，还剩 ${remaining} 次尝试机会`);
|
||
}
|
||
throw new UnauthorizedException(`登录失败次数过多，账号已被锁定 ${LOCK_MINUTES} 分钟`);
|
||
}
|
||
|
||
// 登录成功，清除失败计数
|
||
loginAttempts.delete(attemptKey);
|
||
|
||
// 记录登录时间
|
||
user.lastLoginAt = new Date();
|
||
await this.userRepo.save(user);
|
||
|
||
// 获取用户权限
|
||
const permissions = await this.rbacService.getUserPermissions(user.id);
|
||
const isSuperAdmin =
|
||
user.roles?.some(
|
||
(role) =>
|
||
role.status === 1 &&
|
||
(role.name === '超管' || role.name === 'super_admin' || role.code === 'super_admin'),
|
||
) ?? false;
|
||
const payload = { sub: user.id, username: user.username, permissions, isSuperAdmin };
|
||
|
||
// 获取角色名称列表
|
||
const roleNames = user.roles ? user.roles.filter((r) => r.status === 1).map((r) => r.name) : [];
|
||
|
||
return {
|
||
access_token: this.jwtService.sign(payload),
|
||
user: {
|
||
id: user.id,
|
||
username: user.username,
|
||
name: user.name,
|
||
roles: roleNames,
|
||
permissions,
|
||
},
|
||
};
|
||
}
|
||
|
||
private recordFailedAttempt(key: string) {
|
||
const attempt = loginAttempts.get(key) || { count: 0 };
|
||
attempt.count++;
|
||
if (attempt.count >= MAX_ATTEMPTS) {
|
||
attempt.lockedUntil = new Date(Date.now() + LOCK_MINUTES * 60 * 1000);
|
||
}
|
||
loginAttempts.set(key, attempt);
|
||
}
|
||
|
||
async validateUser(payload: { sub?: number }) {
|
||
return this.userRepo.findOne({ where: { id: payload.sub } });
|
||
}
|
||
}
|