feat: 重建 Sense 认证权限与审计 (#64)

Sense/server/app/admin/service/password_policy.go

@@ -0,0 +1,23 @@
+package service
+
+import (
+	"errors"
+	"unicode/utf8"
+)
+
+const (
+	MinPasswordLength = 6
+	MaxPasswordBytes  = 72
+)
+
+// ValidatePassword enforces the frozen Sense policy. Lowercase-only passwords
+// are valid; complexity rules are intentionally not added here.
+func ValidatePassword(password string) error {
+	if utf8.RuneCountInString(password) < MinPasswordLength {
+		return errors.New("密码至少需要 6 个字符")
+	}
+	if len(password) > MaxPasswordBytes {
+		return errors.New("密码不能超过 72 个字节")
+	}
+	return nil
+}

Sense/server/app/admin/service/password_policy_test.go

@@ -0,0 +1,26 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidatePassword(t *testing.T) {
+	tests := []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{name: "lowercase accepted", value: "chengma", wantErr: false},
+		{name: "six characters accepted", value: "abcdef", wantErr: false},
+		{name: "too short", value: "abcde", wantErr: true},
+		{name: "bcrypt byte limit", value: strings.Repeat("a", MaxPasswordBytes+1), wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ValidatePassword(tt.value); (got != nil) != tt.wantErr {
+				t.Fatalf("ValidatePassword() error = %v, wantErr %v", got, tt.wantErr)
+			}
+		})
+	}
+}

Sense/server/app/admin/service/sys_role.go

@@ -103,12 +103,13 @@ func (e *SysRole) Insert(c *dto.SysRoleInsertReq, cb *casbin.SyncedEnforcer) err
 		return err
 	}
 
-	mp := make(map[string]interface{}, 0)
+	mp := make(map[string]struct{})
 	polices := make([][]string, 0)
 	for _, menu := range dataMenu {
 		for _, api := range menu.SysApi {
-			if mp[data.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
-				mp[data.RoleKey+"-"+api.Path+"-"+api.Action] = ""
+			key := data.RoleKey + "-" + api.Path + "-" + api.Action
+			if _, exists := mp[key]; !exists {
+				mp[key] = struct{}{}
 				polices = append(polices, []string{data.RoleKey, api.Path, api.Action})
 			}
 		}
@@ -169,12 +170,13 @@ func (e *SysRole) Update(c *dto.SysRoleUpdateReq, cb *casbin.SyncedEnforcer) err
 		e.Log.Errorf("delete policy error:%s", err)
 		return err
 	}
-	mp := make(map[string]interface{}, 0)
+	mp := make(map[string]struct{})
 	polices := make([][]string, 0)
 	for _, menu := range mlist {
 		for _, api := range menu.SysApi {
-			if mp[model.RoleKey+"-"+api.Path+"-"+api.Action] != "" {
-				mp[model.RoleKey+"-"+api.Path+"-"+api.Action] = ""
+			key := model.RoleKey + "-" + api.Path + "-" + api.Action
+			if _, exists := mp[key]; !exists {
+				mp[key] = struct{}{}
 				//_, err = cb.AddNamedPolicy("p", model.RoleKey, api.Path, api.Action)
 				polices = append(polices, []string{model.RoleKey, api.Path, api.Action})
 			}

Sense/server/app/admin/service/sys_user.go

@@ -161,6 +161,9 @@ func (e *SysUser) UpdateStatus(c *dto.UpdateSysUserStatusReq, p *actions.DataPer
 // ResetPwd 重置用户密码
 func (e *SysUser) ResetPwd(c *dto.ResetSysUserPwdReq, p *actions.DataPermission) error {
 	var err error
+	if err = ValidatePassword(c.Password); err != nil {
+		return err
+	}
 	var model models.SysUser
 	db := e.Orm.Scopes(
 		actions.Permission(model.TableName(), p),
@@ -204,8 +207,8 @@ func (e *SysUser) Remove(c *dto.SysUserById, p *actions.DataPermission) error {
 func (e *SysUser) UpdatePwd(id int, oldPassword, newPassword string, p *actions.DataPermission) error {
 	var err error
 
-	if newPassword == "" {
-		return nil
+	if err = ValidatePassword(newPassword); err != nil {
+		return err
 	}
 	c := &models.SysUser{}