feat: 重建 Sense 认证权限与审计 (#64)

Sense/server/app/admin/apis/captcha.go

@@ -21,13 +21,12 @@ func (e System) GenerateCaptchaHandler(c *gin.Context) {
 		e.Error(500, err, "服务初始化失败！")
 		return
 	}
-	id, b64s, answer, err := captcha.DriverDigitFunc()
+	id, b64s, _, err := captcha.DriverDigitFunc()
 	if err != nil {
 		e.Logger.Errorf("DriverDigitFunc error, %s", err.Error())
 		e.Error(500, err, "验证码获取失败")
 		return
 	}
-	e.Logger.Infof("DriverDigitFunc answer: %s", answer)
 	e.Custom(gin.H{
 		"code": 200,
 		"data": b64s,

Sense/server/app/admin/apis/identity_bootstrap.go

@@ -0,0 +1,94 @@
+package apis
+
+import (
+	"crypto/subtle"
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
+	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
+	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
+)
+
+const bootstrapTokenHeader = "X-Sense-Bootstrap-Token"
+
+type bootstrapRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+	NickName string `json:"nickName"`
+}
+
+// Bootstrap creates the first Sense administrator. The one-time authorization
+// token is supplied out of band and never accepted in the JSON request body.
+func (e System) Bootstrap(c *gin.Context) {
+	if err := e.MakeContext(c).MakeOrm().Errors; err != nil {
+		e.Error(http.StatusInternalServerError, err, "安全初始化失败")
+		return
+	}
+	db := e.Orm
+	var req bootstrapRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		e.Custom(gin.H{"code": http.StatusBadRequest, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+	req.Username = strings.TrimSpace(req.Username)
+	if req.NickName == "" {
+		req.NickName = req.Username
+	}
+	if err := validateBootstrapInput(req); err != nil || !validBootstrapToken(c.GetHeader(bootstrapTokenHeader)) {
+		handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
+		e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec("LOCK TABLE sys_user IN EXCLUSIVE MODE").Error; err != nil {
+			return err
+		}
+		var count int64
+		if err := tx.Model(&models.SysUser{}).Count(&count).Error; err != nil {
+			return err
+		}
+		if count != 0 {
+			return errors.New("identity already initialized")
+		}
+		var role models.SysRole
+		if err := tx.Where("role_key = ? AND status = ?", "admin", "2").First(&role).Error; err != nil {
+			return err
+		}
+		return tx.Create(&models.SysUser{
+			Username: req.Username,
+			Password: req.Password,
+			NickName: req.NickName,
+			RoleId:   role.RoleId,
+			Status:   "2",
+		}).Error
+	})
+	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "安全初始化被拒绝", req.Username)
+		e.Custom(gin.H{"code": http.StatusForbidden, "msg": "安全初始化不可用或输入不符合要求"})
+		return
+	}
+	handler.WriteIdentityAudit(c, "2", "首个管理员创建成功", req.Username)
+	e.Custom(gin.H{"code": http.StatusOK, "msg": "管理员创建成功"})
+}
+
+func validateBootstrapInput(req bootstrapRequest) error {
+	if len(req.Username) < 3 || len(req.Username) > 64 || strings.ContainsAny(req.Username, " \t\r\n") {
+		return errors.New("invalid username")
+	}
+	return service.ValidatePassword(req.Password)
+}
+
+func validBootstrapToken(candidate string) bool {
+	expected := os.Getenv("SENSE_BOOTSTRAP_TOKEN")
+	if len(expected) < 32 || len(candidate) != len(expected) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(candidate), []byte(expected)) == 1
+}

Sense/server/app/admin/apis/identity_bootstrap_test.go

@@ -0,0 +1,33 @@
+package apis
+
+import "testing"
+
+func TestValidateBootstrapInput(t *testing.T) {
+	if err := validateBootstrapInput(bootstrapRequest{Username: "admin", Password: "abcdef"}); err != nil {
+		t.Fatalf("expected valid bootstrap input: %v", err)
+	}
+	for _, req := range []bootstrapRequest{
+		{Username: "ab", Password: "abcdef"},
+		{Username: "bad name", Password: "abcdef"},
+		{Username: "admin", Password: "abcde"},
+	} {
+		if err := validateBootstrapInput(req); err == nil {
+			t.Fatalf("expected invalid bootstrap input: %+v", req)
+		}
+	}
+}
+
+func TestValidBootstrapToken(t *testing.T) {
+	const token = "0123456789abcdef0123456789abcdef"
+	t.Setenv("SENSE_BOOTSTRAP_TOKEN", token)
+	if !validBootstrapToken(token) {
+		t.Fatal("expected configured token to be accepted")
+	}
+	if validBootstrapToken("wrong") {
+		t.Fatal("expected wrong token to be rejected")
+	}
+	t.Setenv("SENSE_BOOTSTRAP_TOKEN", "short")
+	if validBootstrapToken("short") {
+		t.Fatal("expected short configured token to be rejected")
+	}
+}

Sense/server/app/admin/apis/sys_user.go

@@ -1,9 +1,8 @@
 package apis
 
 import (
-	"github.com/gin-gonic/gin/binding"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/models"
-	"golang.org/x/crypto/bcrypt"
+	"github.com/gin-gonic/gin/binding"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -15,6 +14,7 @@ import (
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service"
 	"git.ilapage.cn/ila/yovision/Sense/server/app/admin/service/dto"
 	"git.ilapage.cn/ila/yovision/Sense/server/common/actions"
+	"git.ilapage.cn/ila/yovision/Sense/server/common/middleware/handler"
 )
 
 type SysUser struct {
@@ -113,6 +113,10 @@ func (e SysUser) Insert(c *gin.Context) {
 		e.Error(500, err, err.Error())
 		return
 	}
+	if err = service.ValidatePassword(req.Password); err != nil {
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
+	}
 	// 设置创建人
 	req.SetCreateBy(user.GetUserId(c))
 	err = s.Insert(&req)
@@ -306,6 +310,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
 		e.Error(500, err, err.Error())
 		return
 	}
+	if err = service.ValidatePassword(req.Password); err != nil {
+		handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
+	}
 
 	req.SetUpdateBy(user.GetUserId(c))
 
@@ -314,9 +323,11 @@ func (e SysUser) ResetPwd(c *gin.Context) {
 
 	err = s.ResetPwd(&req, p)
 	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "管理员重置密码失败", user.GetUserName(c))
 		e.Logger.Error(err)
 		return
 	}
+	handler.WriteIdentityAudit(c, "2", "管理员重置密码成功", user.GetUserName(c))
 	e.OK(req.GetId(), "更新成功")
 }
 
@@ -346,18 +357,21 @@ func (e SysUser) UpdatePwd(c *gin.Context) {
 
 	// 数据权限检查
 	p := actions.GetPermissionFromContext(c)
-	var hash []byte
-	if hash, err = bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost); err != nil {
-		req.NewPassword = string(hash)
+	if err = service.ValidatePassword(req.NewPassword); err != nil {
+		handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
+		e.Error(http.StatusBadRequest, err, err.Error())
+		return
 	}
 
 	err = s.UpdatePwd(user.GetUserId(c), req.OldPassword, req.NewPassword, p)
 	if err != nil {
+		handler.WriteIdentityAudit(c, "1", "修改密码失败", user.GetUserName(c))
 		e.Logger.Error(err)
 		e.Error(http.StatusForbidden, err, "密码修改失败")
 		return
 	}
 
+	handler.WriteIdentityAudit(c, "2", "修改密码成功", user.GetUserName(c))
 	e.OK(nil, "密码修改成功")
 }