127 lines
4.8 KiB
Go
127 lines
4.8 KiB
Go
package postgres
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
"time"
|
|
|
|
"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/administration"
|
|
"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/identity"
|
|
)
|
|
|
|
const SelectPasswordChangeAccountSQL = `SELECT
|
|
id, phone, display_name, role, organization_id, status,
|
|
password_hash, password_salt, session_version
|
|
FROM public.platform_users
|
|
WHERE id = $1::text
|
|
FOR UPDATE`
|
|
|
|
const UpdatePasswordChangeAccountSQL = `UPDATE public.platform_users
|
|
SET password_hash = $2,
|
|
password_salt = $3,
|
|
session_version = session_version + 1,
|
|
updated_at = $4
|
|
WHERE id = $1::text
|
|
RETURNING id, phone, display_name, role, organization_id, status, session_version`
|
|
|
|
// ChangeOwnPassword serializes password changes on the account row so two
|
|
// concurrent requests cannot both verify the same previous credential.
|
|
func (db *Database) ChangeOwnPassword(ctx context.Context, accountID, currentPassword, nextPassword string, now time.Time) (identity.AuthorizationSnapshot, error) {
|
|
if db.config.Backend != BackendPostgres || db.transactions == nil {
|
|
return identity.AuthorizationSnapshot{}, fmt.Errorf("PostgreSQL is unavailable when ZHINIAN_DATA_BACKEND=%s", db.config.Backend)
|
|
}
|
|
tx, err := db.transactions.Begin(ctx)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, fmt.Errorf("begin password change transaction: %w", err)
|
|
}
|
|
finished := false
|
|
defer func() {
|
|
if !finished {
|
|
_ = tx.Rollback(ctx)
|
|
}
|
|
}()
|
|
|
|
account, hash, salt, found, err := loadPasswordChangeAccount(ctx, tx, accountID)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, err
|
|
}
|
|
if !found || account.Status != "active" {
|
|
return identity.AuthorizationSnapshot{}, &identity.PasswordChangeError{Reason: identity.PasswordChangeNotFound}
|
|
}
|
|
valid, err := verifyNodeScryptPassword(currentPassword, hash, salt)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, fmt.Errorf("verify current password: %w", err)
|
|
}
|
|
if !valid {
|
|
return identity.AuthorizationSnapshot{}, &identity.PasswordChangeError{Reason: identity.PasswordChangeCurrentIncorrect}
|
|
}
|
|
password, err := administration.HashPassword(nextPassword)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, fmt.Errorf("hash new password: %w", err)
|
|
}
|
|
updated, err := updatePasswordChangeAccount(ctx, tx, accountID, password, now)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, err
|
|
}
|
|
|
|
snapshot := identity.AuthorizationSnapshot{Account: updated}
|
|
if updated.OrganizationID != "" {
|
|
organization, found, err := loadPasswordLoginOrganization(ctx, tx, updated.OrganizationID)
|
|
if err != nil {
|
|
return identity.AuthorizationSnapshot{}, err
|
|
}
|
|
if found {
|
|
snapshot.Organization = &organization
|
|
}
|
|
}
|
|
if err := tx.Commit(ctx); err != nil {
|
|
return identity.AuthorizationSnapshot{}, fmt.Errorf("commit password change transaction: %w", err)
|
|
}
|
|
finished = true
|
|
return snapshot, nil
|
|
}
|
|
|
|
func loadPasswordChangeAccount(ctx context.Context, tx Transaction, id string) (identity.AccountSnapshot, string, string, bool, error) {
|
|
rows, err := tx.Query(ctx, SelectPasswordChangeAccountSQL, id)
|
|
if err != nil {
|
|
return identity.AccountSnapshot{}, "", "", false, fmt.Errorf("query password change account: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
if !rows.Next() {
|
|
return identity.AccountSnapshot{}, "", "", false, rows.Err()
|
|
}
|
|
var account identity.AccountSnapshot
|
|
var organizationID sql.NullString
|
|
var hash, salt string
|
|
if err := rows.Scan(&account.ID, &account.Phone, &account.DisplayName, &account.Role, &organizationID, &account.Status, &hash, &salt, &account.SessionVersion); err != nil {
|
|
return identity.AccountSnapshot{}, "", "", false, fmt.Errorf("scan password change account: %w", err)
|
|
}
|
|
if organizationID.Valid {
|
|
account.OrganizationID = organizationID.String
|
|
}
|
|
return account, hash, salt, true, rows.Err()
|
|
}
|
|
|
|
func updatePasswordChangeAccount(ctx context.Context, tx Transaction, id string, password administration.PasswordHash, now time.Time) (identity.AccountSnapshot, error) {
|
|
rows, err := tx.Query(ctx, UpdatePasswordChangeAccountSQL, id, password.Hash, password.Salt, now)
|
|
if err != nil {
|
|
return identity.AccountSnapshot{}, fmt.Errorf("update password change account: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
if !rows.Next() {
|
|
return identity.AccountSnapshot{}, &identity.PasswordChangeError{Reason: identity.PasswordChangeNotFound}
|
|
}
|
|
var account identity.AccountSnapshot
|
|
var organizationID sql.NullString
|
|
if err := rows.Scan(&account.ID, &account.Phone, &account.DisplayName, &account.Role, &organizationID, &account.Status, &account.SessionVersion); err != nil {
|
|
return identity.AccountSnapshot{}, fmt.Errorf("scan updated password change account: %w", err)
|
|
}
|
|
if organizationID.Valid {
|
|
account.OrganizationID = organizationID.String
|
|
}
|
|
return account, rows.Err()
|
|
}
|
|
|
|
var _ identity.PasswordChanger = (*Database)(nil)
|