43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
const dummyPasswordHash = "$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy"
|
|
|
|
type AdminAccount struct {
|
|
Username string
|
|
Email string
|
|
Role string
|
|
}
|
|
|
|
// AuthenticateAdmin 统一执行用户名或邮箱登录，并只返回后端确认的真实权限。
|
|
func AuthenticateAdmin(identifier, password, username, email, passwordHash string) (AdminAccount, error) {
|
|
return AuthenticateAccount(identifier, password, username, email, passwordHash, "super_admin")
|
|
}
|
|
|
|
// AuthenticateAccount 校验任意已启用账户的登录凭据，并返回其实际角色。
|
|
func AuthenticateAccount(identifier, password, username, email, passwordHash, role string) (AdminAccount, error) {
|
|
matched := IsMatch(identifier, username, email)
|
|
if !matched || strings.TrimSpace(password) == "" || len([]byte(password)) > 256 {
|
|
_ = bcrypt.CompareHashAndPassword([]byte(dummyPasswordHash), []byte(password))
|
|
return AdminAccount{}, ErrInvalidCredentials
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(passwordHash), []byte(password)); err != nil {
|
|
return AdminAccount{}, ErrInvalidCredentials
|
|
}
|
|
return AdminAccount{
|
|
Username: strings.TrimSpace(username),
|
|
Email: strings.TrimSpace(email),
|
|
Role: role,
|
|
}, nil
|
|
}
|
|
|
|
func IsInvalidCredentials(err error) bool {
|
|
return errors.Is(err, ErrInvalidCredentials)
|
|
}
|