204 lines
8.1 KiB
Python
204 lines
8.1 KiB
Python
import re
|
|
|
|
from django.core.cache import cache
|
|
from django.utils import timezone
|
|
from rest_framework.decorators import api_view, permission_classes
|
|
from rest_framework.permissions import AllowAny
|
|
from rest_framework.response import Response
|
|
from rest_framework import serializers as drf_serializers
|
|
from drf_spectacular.utils import extend_schema, inline_serializer
|
|
|
|
from config.exceptions import AppError
|
|
from apps.user.models import User
|
|
from apps.user.audit import log_login_success, log_login_fail, log_register
|
|
from apps.user.auth import (
|
|
get_tokens_for_user, build_user_response, get_client_ip, get_user_agent,
|
|
resolve_or_create_institution,
|
|
)
|
|
|
|
LOGIN_FAIL_MAX = 5
|
|
LOGIN_FAIL_LOCK_SECONDS = 15 * 60 # 15 分钟
|
|
|
|
_LOGIN_RESPONSE = inline_serializer('LoginResponse', fields={
|
|
'message': drf_serializers.CharField(),
|
|
'user': drf_serializers.DictField(help_text='用户基本信息'),
|
|
'tokens': drf_serializers.DictField(help_text='access + refresh'),
|
|
})
|
|
|
|
|
|
# ── U3 密码登录 ──────────────────────────────────────────────────────────────
|
|
|
|
@extend_schema(
|
|
summary='U3 密码登录',
|
|
request=inline_serializer('LoginPasswordRequest', fields={
|
|
'phone': drf_serializers.CharField(help_text='手机号'),
|
|
'password': drf_serializers.CharField(help_text='密码'),
|
|
}),
|
|
responses={200: _LOGIN_RESPONSE},
|
|
tags=['认证'],
|
|
)
|
|
@api_view(['POST'])
|
|
@permission_classes([AllowAny])
|
|
def login_password(request):
|
|
"""U3 密码登录"""
|
|
data = request.data
|
|
phone = str(data.get('phone', ''))
|
|
password = str(data.get('password', ''))
|
|
|
|
if not phone or not password:
|
|
raise AppError('AUTH_BAD_CREDENTIALS', '手机号和密码不能为空')
|
|
|
|
ip = get_client_ip(request)
|
|
ua = get_user_agent(request)
|
|
|
|
# 检查账号锁定
|
|
fail_key = f'login_fail:{phone}'
|
|
fail_count = cache.get(fail_key)
|
|
if fail_count is not None and int(fail_count) >= LOGIN_FAIL_MAX:
|
|
raise AppError('AUTH_ACCOUNT_LOCKED', '登录失败次数过多，请 15 分钟后再试', status_code=423)
|
|
|
|
# 查找用户（不区分"未注册"和"密码错"，防用户名枚举）
|
|
try:
|
|
user = User.objects.select_related('institution', 'department').get(phone=phone)
|
|
except User.DoesNotExist:
|
|
log_login_fail(phone, ip=ip, reason='phone_not_found')
|
|
raise AppError('AUTH_BAD_CREDENTIALS', '手机号或密码错误')
|
|
|
|
# 账号禁用检查
|
|
if user.status == 0:
|
|
log_login_fail(phone, ip=ip, reason='account_disabled')
|
|
raise AppError('AUTH_ACCOUNT_DISABLED', '账号已被禁用，请联系管理员', status_code=403)
|
|
|
|
# 校验密码
|
|
if not user.check_password(password):
|
|
current = cache.get(fail_key)
|
|
new_count = (int(current) + 1) if current is not None else 1
|
|
cache.set(fail_key, new_count, timeout=LOGIN_FAIL_LOCK_SECONDS)
|
|
log_login_fail(phone, ip=ip, reason='wrong_password')
|
|
raise AppError('AUTH_BAD_CREDENTIALS', '手机号或密码错误')
|
|
|
|
# 登录成功
|
|
cache.delete(fail_key)
|
|
user.last_login_time = timezone.now()
|
|
user.save(update_fields=['last_login_time'])
|
|
|
|
tokens = get_tokens_for_user(user)
|
|
log_login_success(user.id, phone, ip=ip, ua=ua)
|
|
|
|
return Response({
|
|
'message': '登录成功',
|
|
'user': build_user_response(user),
|
|
'tokens': tokens,
|
|
})
|
|
|
|
|
|
# ── U4 验证码登录（自动注册）────────────────────────────────────────────────
|
|
|
|
_LOGIN_CODE_RESPONSE = inline_serializer('LoginCodeResponse', fields={
|
|
'message': drf_serializers.CharField(),
|
|
'user': drf_serializers.DictField(help_text='用户基本信息'),
|
|
'tokens': drf_serializers.DictField(help_text='access + refresh'),
|
|
'is_new_user': drf_serializers.BooleanField(help_text='是否为新注册用户'),
|
|
})
|
|
|
|
|
|
@extend_schema(
|
|
summary='U4 验证码登录（未注册自动注册）',
|
|
description='前端一键登录/注册：验证码校验通过后，若手机号未注册则自动创建账号（角色=student，无密码）。'
|
|
'机构不存在会自动创建。',
|
|
request=inline_serializer('LoginCodeRequest', fields={
|
|
'phone': drf_serializers.CharField(help_text='手机号'),
|
|
'code': drf_serializers.CharField(help_text='6 位短信验证码'),
|
|
'institution_code': drf_serializers.CharField(help_text='机构编码（必填，唯一标识）'),
|
|
'institution_name': drf_serializers.CharField(help_text='机构名称（必填）'),
|
|
}),
|
|
responses={200: _LOGIN_CODE_RESPONSE, 201: _LOGIN_CODE_RESPONSE},
|
|
tags=['认证'],
|
|
)
|
|
@api_view(['POST'])
|
|
@permission_classes([AllowAny])
|
|
def login_code(request):
|
|
"""U4 验证码登录 — 未注册用户自动注册"""
|
|
data = request.data
|
|
phone = str(data.get('phone', ''))
|
|
code = str(data.get('code', ''))
|
|
institution_code = str(data.get('institution_code', '')).strip()
|
|
institution_name = str(data.get('institution_name', '')).strip()
|
|
|
|
# ── 入参校验 ──────────────────────────────────────────────────────────────
|
|
|
|
if not re.match(r'^1[3-9]\d{9}$', phone):
|
|
raise AppError('SMS_INVALID_PHONE', '手机号格式不合法')
|
|
|
|
if not code:
|
|
raise AppError('AUTH_CODE_INVALID', '请输入验证码')
|
|
|
|
if not institution_code:
|
|
raise AppError('USER_INSTITUTION_CODE_REQUIRED', '机构编码不能为空')
|
|
|
|
if not institution_name:
|
|
raise AppError('USER_INSTITUTION_REQUIRED', '机构名称不能为空')
|
|
|
|
# ── 校验验证码（先校验再查用户，避免未注册用户也暴露手机号状态）───────────
|
|
|
|
cache_key = f'sms:login:{phone}'
|
|
cached_code = cache.get(cache_key)
|
|
if not cached_code:
|
|
raise AppError('AUTH_CODE_EXPIRED', '验证码已过期或未发送')
|
|
if str(cached_code) != code:
|
|
raise AppError('AUTH_CODE_MISMATCH', '验证码错误')
|
|
|
|
# 验证码一次性使用
|
|
cache.delete(cache_key)
|
|
cache.delete(f'login_fail:{phone}')
|
|
|
|
# ── 解析 / 创建机构 ──────────────────────────────────────────────────────
|
|
|
|
institution = resolve_or_create_institution(institution_code, institution_name)
|
|
|
|
# ── 查找用户 or 自动注册 ────────────────────────────────────────────────
|
|
|
|
ip = get_client_ip(request)
|
|
ua = get_user_agent(request)
|
|
|
|
from django.db import IntegrityError
|
|
|
|
try:
|
|
user = User.objects.select_related('institution', 'department').get(phone=phone)
|
|
is_new = False
|
|
except User.DoesNotExist:
|
|
try:
|
|
user = User.objects.create_user(
|
|
username=phone,
|
|
password=None,
|
|
phone=phone,
|
|
role_type='student',
|
|
institution=institution,
|
|
status=1,
|
|
)
|
|
is_new = True
|
|
except IntegrityError:
|
|
user = User.objects.select_related('institution', 'department').get(phone=phone)
|
|
is_new = False
|
|
|
|
if is_new:
|
|
log_register(user.id, phone)
|
|
else:
|
|
if user.status == 0:
|
|
raise AppError('AUTH_ACCOUNT_DISABLED', '账号已被禁用，请联系管理员', status_code=403)
|
|
if user.institution_id != institution.id:
|
|
user.institution = institution
|
|
|
|
user.last_login_time = timezone.now()
|
|
user.save(update_fields=['institution', 'last_login_time'])
|
|
|
|
tokens = get_tokens_for_user(user)
|
|
log_login_success(user.id, phone, ip=ip, ua=ua)
|
|
|
|
return Response({
|
|
'message': '注册并登录成功' if is_new else '登录成功',
|
|
'user': build_user_response(user),
|
|
'tokens': tokens,
|
|
'is_new_user': is_new,
|
|
}, status=201 if is_new else 200)
|