Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/service/account.go

@@ -10,20 +10,40 @@ import (
 	"hy2xs-admin/model/dto"
 	"hy2xs-admin/model/entity"
 	"hy2xs-admin/model/vo"
+	"hy2xs-admin/util"
 )
 
-func Login(username string, pass string) (string, error) {
-	account, err := dao.GetAccount("username = ? and pass = ? and role = 'admin' and deleted = 0", username, pass)
+func Login(username string, plainPassword string) (string, bool, error) {
+	account, err := dao.GetAccount("username = ? and role = 'admin' and deleted = 0", username)
 	if err != nil {
-		return "", err
+		return "", false, err
 	}
+
+	verified, legacy := util.VerifyPassword(plainPassword, *account.Pass)
+	if !verified {
+		return "", false, errors.New(constant.WrongPassword)
+	}
+
+	if legacy {
+		hash, hashErr := util.HashPassword(plainPassword)
+		if hashErr == nil {
+			_ = dao.UpdateAccount([]int64{*account.Id}, map[string]interface{}{"pass": hash})
+		}
+	}
+
 	accountBo := bo.AccountBo{
 		Id:       *account.Id,
 		Username: *account.Username,
 		Roles:    []string{*account.Role},
 		Deleted:  *account.Deleted,
 	}
-	return GenToken(accountBo)
+	token, tokenErr := GenToken(accountBo)
+	if tokenErr != nil {
+		return "", false, tokenErr
+	}
+
+	requirePasswordChange := legacy
+	return token, requirePasswordChange, nil
 }
 
 func PageAccount(accountPageDto dto.AccountPageDto) ([]entity.Account, int64, error) {
@@ -156,4 +176,3 @@ func GetAccountInfo(c *gin.Context) (vo.AccountInfoVo, error) {
 		Roles:    myClaims.AccountBo.Roles,
 	}, nil
 }
-