root/coruna-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

admin

Browse Source
This commit is contained in:
hashbro
2026-08-09 02:08:42 +08:00
parent 74a67c3900
commit 5c7600744e
24 changed files with 1510 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Admin/AuthController.php
+84 -14
View File
@@ -3,11 +3,21 @@
namespace App\Http\Controllers\Admin;
use App\Http\Controllers\Controller;
use App\Models\Admin;
use App\Services\AdminGoogle2fa;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Str;
use Illuminate\Validation\ValidationException;
class AuthController extends Controller
{
private const MAX_ATTEMPTS = 5;
private const DECAY_SECONDS = 60;
public function showLogin()
{
if (Auth::guard('admin')->check()) {
@@ -22,23 +32,78 @@ class AuthController extends Controller
return view('admin.shell');
}
public function login(Request $request)
public function login(Request $request, AdminGoogle2fa $google2fa): JsonResponse
{
$credentials = $request->validate([
'username' => 'required|string',
'password' => 'required|string',
]);
if (Auth::guard('admin')->attempt(
['username' => $credentials['username'], 'password' => $credentials['password']],
$request->boolean('remember')
)) {
$request->session()->regenerate();
return redirect()->intended(route('admin.home'));
try {
$credentials = $request->validate([
'username' => 'required|string|min:2|max:64',
'password' => 'required|string|min:6|max:128',
'GACode' => 'nullable|string|max:16',
], [
'username.required' => '请输入用户名',
'password.required' => '请输入密码',
]);
} catch (ValidationException $e) {
return response()->json([
'code' => 1,
'msg' => collect($e->errors())->flatten()->implode('<br>'),
]);
}
return back()->withErrors(['username' => '用户名或密码错误'])->onlyInput('username');
$throttleKey = $this->throttleKey($request);
if (RateLimiter::tooManyAttempts($throttleKey, self::MAX_ATTEMPTS)) {
$seconds = RateLimiter::availableIn($throttleKey);
return response()->json([
'code' => 1,
'msg' => '登陆失败次数过多，请'.$seconds.'秒后再重试',
]);
}
if (! Auth::guard('admin')->attempt(
['username' => $credentials['username'], 'password' => $credentials['password']],
false
)) {
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
return response()->json(['code' => 1, 'msg' => '用户名或密码错误']);
}
/** @var Admin $user */
$user = Auth::guard('admin')->user();
if ((int) $user->status !== 1) {
Auth::guard('admin')->logout();
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
return response()->json(['code' => 1, 'msg' => '用户已被禁用']);
}
if ((int) $user->google_auth_open === 1) {
$code = (string) ($credentials['GACode'] ?? '');
if ($code === '') {
Auth::guard('admin')->logout();
return response()->json(['code' => 1, 'msg' => '请输入谷歌验证码！']);
}
if (! $google2fa->verify((string) $user->google_secret, $code)) {
Auth::guard('admin')->logout();
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
return response()->json(['code' => 1, 'msg' => '谷歌验证码不正确！']);
}
}
RateLimiter::clear($throttleKey);
$request->session()->regenerate();
$user->forceFill(['last_ip' => $request->ip()])->save();
return response()->json([
'code' => 0,
'msg' => '登录成功',
'data' => route('admin.home'),
]);
}
public function logout(Request $request)
@@ -49,4 +114,9 @@ class AuthController extends Controller
return redirect()->route('admin.login');
}
private function throttleKey(Request $request): string
{
return Str::transliterate(Str::lower((string) $request->input('username')).'|'.$request->ip());
}
}