FatttSnake/oxygen-api
1
0
Fork 0
Code Pull Requests Activity

Optimize: login - check two-factor authentication after verifying password

Browse Source
This commit is contained in:
Fat Snake
2024-03-05 11:21:32 +08:00
parent 03b9fba38c
commit 0368ccd01d
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/main/kotlin/top/fatweb/oxygen/api/service/permission/impl/AuthenticationServiceImpl.kt
View File

@@ -360,18 +360,6 @@ class AuthenticationServiceImpl(
password: String, password: String,
twoFactorCode: String? = null twoFactorCode: String? = null
): LoginVo { ): LoginVo {
val userWithPowerByAccount = userService.getUserWithPowerByAccount(account) ?: throw UserNotFoundException()
if (!userWithPowerByAccount.twoFactor.isNullOrBlank()
&& !userWithPowerByAccount.twoFactor!!.endsWith("?")
) {
if (twoFactorCode.isNullOrBlank()) {
throw NeedTwoFactorException()
}
if (!TOTPUtil.validateCode(userWithPowerByAccount.twoFactor!!, twoFactorCode)) {
throw TwoFactorVerificationCodeErrorException()
}
}
val usernamePasswordAuthenticationToken = val usernamePasswordAuthenticationToken =
UsernamePasswordAuthenticationToken(account, password) UsernamePasswordAuthenticationToken(account, password)
val authentication = authenticationManager.authenticate(usernamePasswordAuthenticationToken) val authentication = authenticationManager.authenticate(usernamePasswordAuthenticationToken)
@@ -380,6 +368,15 @@ class AuthenticationServiceImpl(
val loginUser = authentication.principal as LoginUser val loginUser = authentication.principal as LoginUser
loginUser.user.password = "" loginUser.user.password = ""
if (!loginUser.user.twoFactor.isNullOrBlank() && !loginUser.user.twoFactor!!.endsWith("?")) {
if (twoFactorCode.isNullOrBlank()) {
throw NeedTwoFactorException()
}
if (!TOTPUtil.validateCode(loginUser.user.twoFactor!!, twoFactorCode)) {
throw TwoFactorVerificationCodeErrorException()
}
}
logger.info("用户登录 [用户名: '{}', IP: '{}']", loginUser.username, request.remoteAddr) logger.info("用户登录 [用户名: '{}', IP: '{}']", loginUser.username, request.remoteAddr)
userService.update(User().apply { userService.update(User().apply {
currentLoginIp = request.remoteAddr currentLoginIp = request.remoteAddr