ocdp v1

backend/internal/domain/service/auth_service.go

@@ -0,0 +1,165 @@
+package service
+
+import (
+	"context"
+	"github.com/google/uuid"
+	"github.com/ocdp/cluster-service/internal/domain/entity"
+	"github.com/ocdp/cluster-service/internal/domain/repository"
+)
+
+// AuthService 认证领域服务
+type AuthService struct {
+	userRepo       repository.UserRepository
+	passwordHasher PasswordHasher
+	tokenGenerator TokenGenerator
+}
+
+// PasswordHasher 密码哈希接口
+type PasswordHasher interface {
+	Hash(password string) (string, error)
+	Verify(password, hash string) error
+}
+
+// TokenGenerator Token 生成器接口
+type TokenGenerator interface {
+	Generate(userID, username string) (accessToken, refreshToken string, err error)
+	Verify(token string) (userID, username string, err error)
+	VerifyWithIssuedAt(token string) (userID, username string, issuedAt int64, err error)
+	Refresh(refreshToken string) (newAccessToken string, err error)
+}
+
+// NewAuthService 创建认证服务
+func NewAuthService(
+	userRepo repository.UserRepository,
+	passwordHasher PasswordHasher,
+	tokenGenerator TokenGenerator,
+) *AuthService {
+	return &AuthService{
+		userRepo:       userRepo,
+		passwordHasher: passwordHasher,
+		tokenGenerator: tokenGenerator,
+	}
+}
+
+// Register 注册新用户（仅需用户名和密码，邮箱将自动补全）
+func (s *AuthService) Register(ctx context.Context, username, password string) (*entity.User, error) {
+	// 检查用户是否已存在
+	existingUser, _ := s.userRepo.GetByUsername(ctx, username)
+	if existingUser != nil {
+		return nil, entity.ErrUserExists
+	}
+
+	// 哈希密码
+	passwordHash, err := s.passwordHasher.Hash(password)
+	if err != nil {
+		return nil, err
+	}
+
+	// 默认生成占位邮箱，避免数据库约束失败
+	email := username + "@local.ocdp"
+
+	// 创建用户
+	user := entity.NewUser(username, passwordHash, email)
+	user.ID = uuid.New().String()
+
+	if err := user.Validate(); err != nil {
+		return nil, err
+	}
+
+	if err := s.userRepo.Create(ctx, user); err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
+
+// Login 用户登录
+func (s *AuthService) Login(ctx context.Context, username, password string) (accessToken, refreshToken string, err error) {
+	// 查找用户
+	user, err := s.userRepo.GetByUsername(ctx, username)
+	if err != nil {
+		return "", "", entity.ErrUserNotFound
+	}
+
+	// 验证密码
+	if err := s.passwordHasher.Verify(password, user.PasswordHash); err != nil {
+		return "", "", entity.ErrInvalidPassword
+	}
+
+	// 生成 Token
+	accessToken, refreshToken, err = s.tokenGenerator.Generate(user.ID, user.Username)
+	if err != nil {
+		return "", "", err
+	}
+
+	return accessToken, refreshToken, nil
+}
+
+// RefreshToken 刷新 Token
+func (s *AuthService) RefreshToken(ctx context.Context, refreshToken string) (string, error) {
+	return s.tokenGenerator.Refresh(refreshToken)
+}
+
+// GetUserByID 根据 ID 获取用户
+func (s *AuthService) GetUserByID(ctx context.Context, id string) (*entity.User, error) {
+	return s.userRepo.GetByID(ctx, id)
+}
+
+// VerifyAccessToken 验证 Access Token（包括 revoked_after 检查）
+func (s *AuthService) VerifyAccessToken(ctx context.Context, token string) (userID, username string, err error) {
+	// 1. JWT 自验证
+	userID, username, issuedAt, err := s.tokenGenerator.VerifyWithIssuedAt(token)
+	if err != nil {
+		return "", "", err
+	}
+
+	// 2. 检查用户级别的撤销时间
+	user, err := s.userRepo.GetByID(ctx, userID)
+	if err != nil {
+		return "", "", entity.ErrUserNotFound
+	}
+
+	// 3. 如果 Token 签发时间早于 revoked_after，则失效
+	if issuedAt < user.RevokedAfter.Unix() {
+		return "", "", entity.ErrTokenRevoked
+	}
+
+	return userID, username, nil
+}
+
+// ChangePassword 修改密码（会触发全局登出）
+func (s *AuthService) ChangePassword(ctx context.Context, userID, oldPassword, newPassword string) error {
+	// 1. 获取用户
+	user, err := s.userRepo.GetByID(ctx, userID)
+	if err != nil {
+		return entity.ErrUserNotFound
+	}
+
+	// 2. 验证旧密码
+	if err := s.passwordHasher.Verify(oldPassword, user.PasswordHash); err != nil {
+		return entity.ErrInvalidPassword
+	}
+
+	// 3. 哈希新密码
+	newPasswordHash, err := s.passwordHasher.Hash(newPassword)
+	if err != nil {
+		return err
+	}
+
+	// 4. 更新密码（会自动触发 revoked_after 更新）
+	user.UpdatePassword(newPasswordHash)
+
+	// 5. 保存到数据库
+	return s.userRepo.Update(ctx, user)
+}
+
+// ForceLogoutAll 强制全局登出（管理员操作）
+func (s *AuthService) ForceLogoutAll(ctx context.Context, userID string) error {
+	user, err := s.userRepo.GetByID(ctx, userID)
+	if err != nil {
+		return entity.ErrUserNotFound
+	}
+
+	user.RevokeAllTokens()
+	return s.userRepo.Update(ctx, user)
+}