239 lines
8.7 KiB
Go
239 lines
8.7 KiB
Go
package auth
|
||
|
||
import (
|
||
"context"
|
||
"database/sql"
|
||
|
||
"hyapp/pkg/appcode"
|
||
"hyapp/pkg/xerr"
|
||
authdomain "hyapp/services/user-service/internal/domain/auth"
|
||
invitedomain "hyapp/services/user-service/internal/domain/invite"
|
||
userdomain "hyapp/services/user-service/internal/domain/user"
|
||
invitestorage "hyapp/services/user-service/internal/storage/mysql/invite"
|
||
"hyapp/services/user-service/internal/storage/mysql/shared"
|
||
userstorage "hyapp/services/user-service/internal/storage/mysql/user"
|
||
)
|
||
|
||
func (r *Repository) FindThirdPartyIdentity(ctx context.Context, provider string, providerSubject string) (authdomain.ThirdPartyIdentity, error) {
|
||
var identity authdomain.ThirdPartyIdentity
|
||
err := r.db.QueryRowContext(ctx, `
|
||
SELECT app_code, user_id, provider, provider_subject, COALESCE(provider_union_id, ''), created_at_ms, updated_at_ms
|
||
FROM third_party_identities
|
||
WHERE app_code = ? AND provider = ? AND provider_subject = ?
|
||
`, appcode.FromContext(ctx), provider, providerSubject).Scan(&identity.AppCode, &identity.UserID, &identity.Provider, &identity.ProviderSubject, &identity.ProviderUnionID, &identity.CreatedAtMs, &identity.UpdatedAtMs)
|
||
if err == sql.ErrNoRows {
|
||
// 未绑定三方身份时由 service 转入注册路径。
|
||
return authdomain.ThirdPartyIdentity{}, xerr.New(xerr.NotFound, "third-party identity not found")
|
||
}
|
||
if err != nil {
|
||
return authdomain.ThirdPartyIdentity{}, err
|
||
}
|
||
|
||
return identity, nil
|
||
}
|
||
|
||
func (r *Repository) FindUserIDByRegisterDeviceID(ctx context.Context, appCode string, deviceID string) (int64, error) {
|
||
var userID int64
|
||
err := r.db.QueryRowContext(ctx, `
|
||
SELECT user_id
|
||
FROM users
|
||
WHERE app_code = ? AND register_device_id = ?
|
||
LIMIT 1
|
||
`, appcode.Normalize(appCode), deviceID).Scan(&userID)
|
||
if err == sql.ErrNoRows {
|
||
// 未查到占用者时，service 才允许新三方身份走注册事务。
|
||
return 0, xerr.New(xerr.NotFound, "registered device not found")
|
||
}
|
||
if err != nil {
|
||
return 0, err
|
||
}
|
||
|
||
return userID, nil
|
||
}
|
||
|
||
func (r *Repository) CountUsersByRegisterDeviceID(ctx context.Context, appCode string, deviceID string) (int64, error) {
|
||
var count int64
|
||
if err := r.db.QueryRowContext(ctx, `
|
||
SELECT COUNT(*)
|
||
FROM users
|
||
WHERE app_code = ? AND register_device_id = ?
|
||
`, appcode.Normalize(appCode), deviceID).Scan(&count); err != nil {
|
||
return 0, err
|
||
}
|
||
|
||
return count, nil
|
||
}
|
||
|
||
func (r *Repository) ListDisplayUserIDsByRegisterDeviceID(ctx context.Context, appCode string, deviceID string) ([]string, error) {
|
||
rows, err := r.db.QueryContext(ctx, `
|
||
SELECT current_display_user_id
|
||
FROM users
|
||
WHERE app_code = ? AND register_device_id = ?
|
||
ORDER BY user_id ASC
|
||
`, appcode.Normalize(appCode), deviceID)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
defer rows.Close()
|
||
|
||
displayUserIDs := make([]string, 0)
|
||
for rows.Next() {
|
||
var displayUserID string
|
||
if err := rows.Scan(&displayUserID); err != nil {
|
||
return nil, err
|
||
}
|
||
displayUserIDs = append(displayUserIDs, displayUserID)
|
||
}
|
||
if err := rows.Err(); err != nil {
|
||
return nil, err
|
||
}
|
||
return displayUserIDs, nil
|
||
}
|
||
|
||
// CreateThirdPartyUser 原子创建用户、默认短号、三方身份和首个 session。
|
||
|
||
func (r *Repository) CreateThirdPartyUser(ctx context.Context, user userdomain.User, identity userdomain.Identity, thirdParty authdomain.ThirdPartyIdentity, session authdomain.Session, inviteBind invitedomain.BindCommand, maxAccountsPerDevice int32) error {
|
||
// 三方首次登录注册必须同时写用户、默认短号、三方绑定和首个 session。
|
||
tx, err := r.db.BeginTx(ctx, nil)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
defer tx.Rollback()
|
||
|
||
if err := ensureRegisterDeviceQuotaTx(ctx, tx, user.AppCode, user.RegisterDeviceID, maxAccountsPerDevice); err != nil {
|
||
// 事务内再次校验设备上限，避免两个并发注册都在事务外读到旧计数后同时插入。
|
||
return err
|
||
}
|
||
if err := userstorage.InsertUserIdentity(ctx, tx, user, identity); err != nil {
|
||
// 默认短号冲突由 service 重试。
|
||
return mapAuthDuplicateError(err)
|
||
}
|
||
if _, err := invitestorage.EnsurePrimaryCodeForUser(ctx, tx, user.AppCode, user.UserID, user.CreatedAtMs); err != nil {
|
||
return err
|
||
}
|
||
if _, err := invitestorage.BindRelation(ctx, tx, inviteBind); err != nil {
|
||
return err
|
||
}
|
||
|
||
_, err = tx.ExecContext(ctx, `
|
||
INSERT INTO third_party_identities (app_code, user_id, provider, provider_subject, provider_union_id, created_at_ms, updated_at_ms)
|
||
VALUES (?, ?, ?, ?, ?, ?, ?)
|
||
`, appcode.Normalize(thirdParty.AppCode), thirdParty.UserID, thirdParty.Provider, thirdParty.ProviderSubject, shared.NullableString(thirdParty.ProviderUnionID), thirdParty.CreatedAtMs, thirdParty.UpdatedAtMs)
|
||
if err != nil {
|
||
return mapAuthDuplicateError(err)
|
||
}
|
||
|
||
if err := insertSession(ctx, tx, session); err != nil {
|
||
// session 插入失败会回滚用户和三方绑定。
|
||
return err
|
||
}
|
||
if err := userstorage.InsertUserRegisteredOutbox(ctx, tx, user); err != nil {
|
||
// 完整注册入口会传入 profile_completed=true；旧三方登录仍是 pending 用户，这里会按用户状态自动跳过。
|
||
return err
|
||
}
|
||
return tx.Commit()
|
||
}
|
||
|
||
// CompleteThirdPartyRegistration 原子补齐旧三方 pending 用户资料并写入可续期 session。
|
||
// 它只服务 provider subject 已绑定但尚未 completed 的兼容路径，避免 Flutter 完成资料时再创建第二个用户。
|
||
func (r *Repository) CompleteThirdPartyRegistration(ctx context.Context, command userdomain.CompleteOnboardingCommand, session authdomain.Session) (userdomain.User, error) {
|
||
tx, err := r.db.BeginTx(ctx, nil)
|
||
if err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
defer tx.Rollback()
|
||
|
||
user, err := userstorage.QueryUser(ctx, tx, "WHERE user_id = ? FOR UPDATE", command.UserID)
|
||
if err == sql.ErrNoRows {
|
||
return userdomain.User{}, xerr.New(xerr.NotFound, "user not found")
|
||
}
|
||
if err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
if !user.CanLogin() {
|
||
// pending 用户可能已被后台禁用；注册完成入口不能绕过用户状态限制创建新 session。
|
||
return userdomain.User{}, xerr.New(xerr.UserDisabled, "user is disabled")
|
||
}
|
||
if user.ProfileCompleted {
|
||
// 幂等兼容：已完成用户只补 session，不重写用户资料，避免重复提交覆盖用户后续修改。
|
||
if err := insertSession(ctx, tx, session); err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
if err := tx.Commit(); err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
return userstorage.New(r.db).GetUser(ctx, command.UserID)
|
||
}
|
||
|
||
inviteSnapshot := command.InviteCode
|
||
if command.InviteCode != "" {
|
||
binding, err := invitestorage.BindRelation(ctx, tx, invitedomain.BindCommand{
|
||
AppCode: command.AppCode,
|
||
InvitedUserID: command.UserID,
|
||
InvitedRegionID: command.RegionID,
|
||
InviteCode: command.InviteCode,
|
||
Source: "third_party_register",
|
||
RequestID: command.RequestID,
|
||
BoundAtMs: command.CompletedAtMs,
|
||
})
|
||
if err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
if binding.InviteCode != "" {
|
||
inviteSnapshot = binding.InviteCode
|
||
user.InviteBinding = binding
|
||
}
|
||
}
|
||
|
||
_, err = tx.ExecContext(ctx, `
|
||
UPDATE users
|
||
SET username = ?,
|
||
avatar = ?,
|
||
gender = ?,
|
||
country = ?,
|
||
region_id = ?,
|
||
invite_code = CASE WHEN ? = '' THEN invite_code ELSE ? END,
|
||
profile_completed = ?,
|
||
profile_completed_at_ms = ?,
|
||
onboarding_status = ?,
|
||
updated_at_ms = ?
|
||
WHERE user_id = ?
|
||
AND app_code = ?
|
||
`, command.Username, command.Avatar, command.Gender, command.Country, shared.NullableRegionID(command.RegionID), inviteSnapshot, inviteSnapshot, true, command.CompletedAtMs, string(userdomain.OnboardingStatusCompleted), command.CompletedAtMs, command.UserID, appcode.Normalize(command.AppCode))
|
||
if err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
user.Username = command.Username
|
||
user.Avatar = command.Avatar
|
||
user.Gender = command.Gender
|
||
user.Country = command.Country
|
||
user.RegionID = command.RegionID
|
||
if inviteSnapshot != "" {
|
||
user.InviteCode = inviteSnapshot
|
||
}
|
||
user.ProfileCompleted = true
|
||
user.ProfileCompletedAtMs = command.CompletedAtMs
|
||
user.OnboardingStatus = userdomain.OnboardingStatusCompleted
|
||
user.UpdatedAtMs = command.CompletedAtMs
|
||
if err := insertSession(ctx, tx, session); err != nil {
|
||
// session 和资料完成必须同事务提交，否则 Flutter 会拿不到可落 AppAuthSession 的 refresh token。
|
||
return userdomain.User{}, err
|
||
}
|
||
if err := userstorage.InsertUserRegisteredOutbox(ctx, tx, user); err != nil {
|
||
// UserRegistered 是统计和注册完成事实，必须和首次资料完成一起提交。
|
||
return userdomain.User{}, err
|
||
}
|
||
if err := tx.Commit(); err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
|
||
updated, err := userstorage.New(r.db).GetUser(ctx, command.UserID)
|
||
if err != nil {
|
||
return userdomain.User{}, err
|
||
}
|
||
updated.InviteBinding = user.InviteBinding
|
||
return updated, nil
|
||
}
|
||
|
||
// RecordLoginAudit 写登录审计；调用方不会让审计失败影响主链路。
|