Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/controller/account.go

@@ -26,14 +26,15 @@ func Login(c *gin.Context) {
 		return
 	}
 
-	token, err := service.Login(*loginDto.Username, util.SHA224String(*loginDto.Pass))
+	token, forcePasswordChange, err := service.Login(*loginDto.Username, *loginDto.Pass)
 	if err != nil {
 		vo.Fail(err.Error(), c)
 		return
 	}
 	jwtVo := vo.JwtVo{
-		TokenType:   constant.TokenType,
-		AccessToken: token,
+		TokenType:           constant.TokenType,
+		AccessToken:         token,
+		ForcePasswordChange: forcePasswordChange,
 	}
 	vo.Success(jwtVo, c)
 }
@@ -100,7 +101,11 @@ func SaveAccount(c *gin.Context) {
 		return
 	}
 
-	passEncrypt := util.SHA224String(*accountSaveDto.Pass)
+	passEncrypt, err := util.HashPassword(*accountSaveDto.Pass)
+	if err != nil {
+		vo.Fail(err.Error(), c)
+		return
+	}
 	conPass := fmt.Sprintf("%s.%s", *accountSaveDto.Username, *accountSaveDto.ConPass)
 	account := entity.Account{
 		Username:   accountSaveDto.Username,
@@ -167,8 +172,12 @@ func UpdateAccount(c *gin.Context) {
 
 	var passEncrypt *string
 	if accountUpdateDto.Pass != nil && *accountUpdateDto.Pass != "" {
-		passEncryptSha224 := util.SHA224String(*accountUpdateDto.Pass)
-		passEncrypt = &passEncryptSha224
+		passEncryptHash, hashErr := util.HashPassword(*accountUpdateDto.Pass)
+		if hashErr != nil {
+			vo.Fail(hashErr.Error(), c)
+			return
+		}
+		passEncrypt = &passEncryptHash
 	}
 
 	account := entity.Account{
@@ -331,6 +340,5 @@ func VerifyDefaultPass(c *gin.Context) {
 		vo.Fail(err.Error(), c)
 		return
 	}
-	vo.Success(account.Pass != nil && *account.Pass == "02f382b76ca1ab7aa06ab03345c7712fd5b971fb0c0f2aef98bac9cd", c)
+	vo.Success(account.Pass != nil && !util.IsBcryptHash(*account.Pass), c)
 }
-