46 lines
1.6 KiB
Go
46 lines
1.6 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"strings"
|
|
"time"
|
|
|
|
"git.pcux.cn/xuans/Scert/backend/internal/repository"
|
|
)
|
|
|
|
const authStateCapacity = 4096
|
|
const authUserSessionCapacity = 16
|
|
|
|
func (session authSession) complete() bool {
|
|
return strings.TrimSpace(session.UserID) != "" && strings.TrimSpace(session.Username) != "" &&
|
|
(session.Role != repository.UserRoleSuperAdmin || strings.TrimSpace(session.Email) != "") &&
|
|
strings.TrimSpace(session.PasswordHash) != "" &&
|
|
(session.Role == repository.UserRoleUser || session.Role == repository.UserRoleAdmin || session.Role == repository.UserRoleSuperAdmin)
|
|
}
|
|
|
|
func (session authSession) usableAt(now time.Time) bool {
|
|
return session.complete() && session.ExpiresAt.After(now) && session.AbsoluteExpiresAt.After(now) &&
|
|
!session.ExpiresAt.After(session.AbsoluteExpiresAt)
|
|
}
|
|
|
|
// 调用方持有认证锁；会话表有容量上限，不淘汰仍然有效的用户会话。
|
|
func (s *Server) pruneAuthSessionsLocked(now time.Time) {
|
|
for token, session := range s.authSessions {
|
|
if !session.usableAt(now) {
|
|
delete(s.authSessions, token)
|
|
}
|
|
}
|
|
}
|
|
|
|
// 调用方持有限流锁；定期回收且保留有效封禁，避免随机账号使状态无限增长。
|
|
func (s *Server) pruneLoginAttemptsLocked(now time.Time) {
|
|
if !s.loginPrunedAt.IsZero() && !now.Before(s.loginPrunedAt) && now.Sub(s.loginPrunedAt) < time.Minute {
|
|
return
|
|
}
|
|
for key, attempt := range s.loginAttempts {
|
|
if !attempt.BlockedTill.After(now) && (attempt.WindowStart.IsZero() || now.Sub(attempt.WindowStart) >= loginWindow) {
|
|
delete(s.loginAttempts, key)
|
|
}
|
|
}
|
|
s.loginPrunedAt = now
|
|
}
|