初始化

2026-08-08 18:27:38 +08:00
parent efc150c937
commit 060eb79c09
336 changed files with 24613 additions and 15 deletions
@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+/**
+ * 管理员独立登录：与普通用户登录（/login）分离到不同页面。
+ * 仅允许具备后台角色（isAdmin）的账户登录，其余账户直接拒绝。
+ * 含图形验证码 + 10 分钟 5 次错误锁定的人机/防暴破管控。
+ */
+class AdminLoginController extends Controller
+{
+    protected const MAX_ATTEMPTS = 5;
+    protected const DECAY_SECONDS = 600;
+
+    public function show(): View
+    {
+        return view('auth.admin-login');
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $key = $this->throttleKey($request);
+
+        if (RateLimiter::tooManyAttempts($key, self::MAX_ATTEMPTS)) {
+            $seconds = RateLimiter::availableIn($key);
+            $request->session()->forget('captcha');
+            throw ValidationException::withMessages([
+                'email' => '登录尝试过于频繁，出于安全考虑已临时锁定。请在约 '.ceil($seconds / 60).' 分钟（'.ceil($seconds).' 秒）后重试。',
+            ]);
+        }
+
+        $data = $request->validate([
+            'email' => ['required', 'email'],
+            'password' => ['required', 'string'],
+            'captcha' => ['required', 'string', function ($attribute, $value, $fail) use ($request) {
+                if (strtolower(trim((string) $value)) !== strtolower((string) $request->session()->get('captcha', ''))) {
+                    $fail('图形验证码不正确，请重新输入。');
+                }
+            }],
+        ]);
+
+        if (! Auth::attempt(['email' => $data['email'], 'password' => $data['password']], $request->boolean('remember'))) {
+            RateLimiter::hit($key, self::DECAY_SECONDS);
+            $attempts = RateLimiter::attempts($key);
+            $left = max(0, self::MAX_ATTEMPTS - $attempts);
+            $request->session()->forget('captcha');
+
+            $msg = '账号或密码不正确。';
+            if ($left > 0) {
+                $msg .= "（已错误 {$attempts} 次，再错 {$left} 次将锁定 10 分钟）";
+            } else {
+                $msg .= '（错误次数过多，已锁定 10 分钟）';
+            }
+
+            return back()->withErrors([
+                'email' => $msg,
+            ])->onlyInput('email');
+        }
+
+        $user = Auth::user();
+
+        if (! $user->isAdmin()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+            $request->session()->forget('captcha');
+
+            return back()->withErrors([
+                'email' => '该账户没有后台管理权限。',
+            ])->onlyInput('email');
+        }
+
+        RateLimiter::clear($key);
+        $request->session()->forget('captcha');
+        $request->session()->regenerate();
+
+        return redirect()->intended('/admin');
+    }
+
+    protected function throttleKey(Request $request): string
+    {
+        return 'admin-login:'.strtolower($request->input('email', '')).':'.$request->ip();
+    }
+}
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Session;
+
+/**
+ * 图形验证码（轻量、零依赖，基于 GD 绘制）。
+ * - GET /captcha 生成一张 4 位字符的图片，并把答案写入 session('captcha')。
+ * - 登录接口校验用户输入与 session 中的值（大小写不敏感），校验后清空，防止复用。
+ * - 仅用于「人/机」区分，配合登录限流构成基础安全管控。
+ */
+class CaptchaController extends Controller
+{
+    public function show(Request $request)
+    {
+        $code = $this->generateCode(4);
+        Session::put('captcha', $code);
+
+        $width = 120;
+        $height = 44;
+        $img = imagecreatetruecolor($width, $height);
+
+        // 背景
+        $bg = imagecolorallocate($img, 244, 247, 250);
+        imagefilledrectangle($img, 0, 0, $width, $height, $bg);
+
+        // 干扰线
+        for ($i = 0; $i < 6; $i++) {
+            $c = imagecolorallocate($img, rand(160, 210), rand(160, 210), rand(160, 210));
+            imageline($img, rand(0, $width), rand(0, $height), rand(0, $width), rand(0, $height), $c);
+        }
+
+        // 字符（随机色 + 轻微纵向抖动）
+        $palette = [[74, 138, 244], [110, 140, 176], [43, 182, 164], [123, 126, 240], [200, 120, 60]];
+        $len = strlen($code);
+        $step = (int) ($width / ($len + 1));
+        for ($i = 0; $i < $len; $i++) {
+            $col = $palette[array_rand($palette)];
+            $c = imagecolorallocate($img, $col[0], $col[1], $col[2]);
+            $x = $step * ($i + 1) - 10 + rand(-3, 3);
+            $y = rand(8, 18);
+            imagestring($img, 5, $x, $y, $code[$i], $c);
+        }
+
+        // 噪点
+        for ($i = 0; $i < 50; $i++) {
+            $c = imagecolorallocate($img, rand(180, 225), rand(180, 225), rand(180, 225));
+            imagesetpixel($img, rand(0, $width), rand(0, $height), $c);
+        }
+
+        ob_start();
+        imagepng($img);
+        $data = ob_get_clean();
+        imagedestroy($img);
+
+        return response($data, 200)
+            ->header('Content-Type', 'image/png')
+            ->header('Cache-Control', 'no-store, no-cache, must-revalidate, private')
+            ->header('Pragma', 'no-cache');
+    }
+
+    /**
+     * 生成验证码字符（去除易混淆的 0/O/1/I/L）。
+     */
+    protected function generateCode(int $len): string
+    {
+        $pool = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        $out = '';
+        for ($i = 0; $i < $len; $i++) {
+            $out .= $pool[random_int(0, strlen($pool) - 1)];
+        }
+        return $out;
+    }
+}
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+class LoginController extends Controller
+{
+    // 限流参数：10 分钟内最多 5 次错误，超出后锁定至窗口结束（≈10 分钟）
+    protected const MAX_ATTEMPTS = 5;
+    protected const DECAY_SECONDS = 600;
+
+    public function show(): View
+    {
+        return view('auth.login');
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $key = $this->throttleKey($request);
+
+        // 锁定检查：10 分钟内错误满 5 次即锁定，提示等待时长
+        if (RateLimiter::tooManyAttempts($key, self::MAX_ATTEMPTS)) {
+            $seconds = RateLimiter::availableIn($key);
+            $request->session()->forget('captcha');
+            throw ValidationException::withMessages([
+                'email' => '登录尝试过于频繁，出于安全考虑已临时锁定。请在约 '.ceil($seconds / 60).' 分钟（'.ceil($seconds).' 秒）后重试。',
+            ]);
+        }
+
+        $credentials = $request->validate([
+            'email' => ['required', 'email'],
+            'password' => ['required', 'string'],
+            'captcha' => ['required', 'string', function ($attribute, $value, $fail) use ($request) {
+                if (strtolower(trim((string) $value)) !== strtolower((string) $request->session()->get('captcha', ''))) {
+                    $fail('图形验证码不正确，请重新输入。');
+                }
+            }],
+        ]);
+
+        if (Auth::attempt(['email' => $credentials['email'], 'password' => $credentials['password']], $request->boolean('remember'))) {
+            RateLimiter::clear($key);
+            $request->session()->forget('captcha');
+            $request->session()->regenerate();
+
+            return redirect()->intended('/');
+        }
+
+        // 失败：记录一次错误（10 分钟滚动窗口），并给出剩余次数提醒
+        RateLimiter::hit($key, self::DECAY_SECONDS);
+        $attempts = RateLimiter::attempts($key);
+        $left = max(0, self::MAX_ATTEMPTS - $attempts);
+        $request->session()->forget('captcha');
+
+        $msg = '账号或密码不正确。';
+        if ($left > 0) {
+            $msg .= "（已错误 {$attempts} 次，再错 {$left} 次将锁定 10 分钟）";
+        } else {
+            $msg .= '（错误次数过多，已锁定 10 分钟）';
+        }
+
+        return back()->withErrors([
+            'email' => $msg,
+        ])->onlyInput('email');
+    }
+
+    protected function throttleKey(Request $request): string
+    {
+        return 'login:'.strtolower($request->input('email', '')).':'.$request->ip();
+    }
+
+    /**
+     * 退出登录。定义为控制器方法而非闭包，
+     * 以保证生产环境 `php artisan route:cache` 可用。
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        Auth::guard('web')->logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect('/');
+    }
+}
@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class RegisterController extends Controller
+{
+    public function show(): View
+    {
+        return view('auth.register');
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:40'],
+            'email' => ['required', 'email', 'max:120', 'unique:users,email'],
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+            'real_name' => ['nullable', 'string', 'max:40'],
+            'phone' => ['nullable', 'string', 'max:30'],
+            'company' => ['nullable', 'string', 'max:120'],
+            'industry' => ['nullable', 'string', 'max:60'],
+        ]);
+
+        $user = User::create([
+            'name' => $data['name'],
+            'email' => $data['email'],
+            'password' => $data['password'],
+            'real_name' => $data['real_name'] ?? null,
+            'phone' => $data['phone'] ?? null,
+            'company' => $data['company'] ?? null,
+            'industry' => $data['industry'] ?? null,
+        ]);
+
+        Auth::login($user);
+
+        $user->awardPoints(20);
+
+        return redirect('/');
+    }
+}
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\View\View;
+
+class SettingsController extends Controller
+{
+    public function index(): View
+    {
+        return view('auth.settings');
+    }
+
+    public function updatePassword(Request $request): RedirectResponse
+    {
+        $data = $request->validate([
+            'current_password' => ['required', 'current_password'],
+            'password' => ['required', 'confirmed', Password::min(8)],
+        ]);
+
+        $request->user()->update([
+            'password' => Hash::make($data['password']),
+        ]);
+
+        return redirect()->route('auth.settings')->with('success', '密码已修改');
+    }
+}