hashbro
124 lines
3.8 KiB
PHP
124 lines
3.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Admin;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\Admin;
|
|
use App\Services\AdminGoogle2fa;
|
|
use App\Support\VisitorIp;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
class AuthController extends Controller
|
|
{
|
|
private const MAX_ATTEMPTS = 5;
|
|
|
|
private const DECAY_SECONDS = 60;
|
|
|
|
public function showLogin()
|
|
{
|
|
if (Auth::guard('admin')->check()) {
|
|
return redirect()->route('admin.home');
|
|
}
|
|
|
|
return view('admin.login');
|
|
}
|
|
|
|
public function home()
|
|
{
|
|
return view('admin.shell');
|
|
}
|
|
|
|
public function login(Request $request, AdminGoogle2fa $google2fa): JsonResponse
|
|
{
|
|
try {
|
|
$credentials = $request->validate([
|
|
'username' => 'required|string|min:2|max:64',
|
|
'password' => 'required|string|min:6|max:128',
|
|
'GACode' => 'nullable|string|max:16',
|
|
], [
|
|
'username.required' => '请输入用户名',
|
|
'password.required' => '请输入密码',
|
|
]);
|
|
} catch (ValidationException $e) {
|
|
return response()->json([
|
|
'code' => 1,
|
|
'msg' => collect($e->errors())->flatten()->implode('<br>'),
|
|
]);
|
|
}
|
|
|
|
$throttleKey = $this->throttleKey($request);
|
|
if (RateLimiter::tooManyAttempts($throttleKey, self::MAX_ATTEMPTS)) {
|
|
$seconds = RateLimiter::availableIn($throttleKey);
|
|
|
|
return response()->json([
|
|
'code' => 1,
|
|
'msg' => '登陆失败次数过多，请'.$seconds.'秒后再重试',
|
|
]);
|
|
}
|
|
|
|
if (! Auth::guard('admin')->attempt(
|
|
['username' => $credentials['username'], 'password' => $credentials['password']],
|
|
false
|
|
)) {
|
|
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
|
|
|
|
return response()->json(['code' => 1, 'msg' => '用户名或密码错误']);
|
|
}
|
|
|
|
/** @var Admin $user */
|
|
$user = Auth::guard('admin')->user();
|
|
|
|
if ((int) $user->status !== 1) {
|
|
Auth::guard('admin')->logout();
|
|
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
|
|
|
|
return response()->json(['code' => 1, 'msg' => '用户已被禁用']);
|
|
}
|
|
|
|
if ((int) $user->google_auth_open === 1) {
|
|
$code = (string) ($credentials['GACode'] ?? '');
|
|
if ($code === '') {
|
|
Auth::guard('admin')->logout();
|
|
|
|
return response()->json(['code' => 1, 'msg' => '请输入谷歌验证码！']);
|
|
}
|
|
if (! $google2fa->verify((string) $user->google_secret, $code)) {
|
|
Auth::guard('admin')->logout();
|
|
RateLimiter::hit($throttleKey, self::DECAY_SECONDS);
|
|
|
|
return response()->json(['code' => 1, 'msg' => '谷歌验证码不正确！']);
|
|
}
|
|
}
|
|
|
|
RateLimiter::clear($throttleKey);
|
|
$request->session()->regenerate();
|
|
|
|
$user->forceFill(['last_ip' => VisitorIp::fromRequest($request)])->save();
|
|
|
|
return response()->json([
|
|
'code' => 0,
|
|
'msg' => '登录成功',
|
|
'data' => route('admin.home'),
|
|
]);
|
|
}
|
|
|
|
public function logout(Request $request)
|
|
{
|
|
Auth::guard('admin')->logout();
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
|
|
return redirect()->route('admin.login');
|
|
}
|
|
|
|
private function throttleKey(Request $request): string
|
|
{
|
|
return Str::transliterate(Str::lower((string) $request->input('username')).'|'.VisitorIp::fromRequest($request));
|
|
}
|
|
}
|