pro/im_manager
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(imLoginFailureLog): 用户登录密码错误次数锁定与解锁能力（管理端）

Browse Source 
- 安全策略登录限频由 JSON 文本改为结构化表单（次数/锁定分钟/窗口分钟），编辑校验同步扩展
- 失败日志新增解锁入口：/imLoginFailureLog/unlock 经 internal 通道调用 im-server 释放锁定
- 失败日志模型补充 accountHash 字段，解锁按钮按 risk_action=account_locked 展示
- 租户业务库初始化模板补充 im_login_lockouts 等表；新增解锁按钮菜单权限 SQL
This commit is contained in:
Austin
2026-09-20 17:04:19 +08:00
parent fd4ff85191
commit 8675fe333d
13 changed files with 238 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin-adfahi-research/sql/IM-租户业务库初始化.sql
+16
View File
@@ -947,6 +947,22 @@ CREATE TABLE IF NOT EXISTS `im_login_failure_logs` (
KEY `idx_im_login_failure_request` (`request_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
CREATE TABLE IF NOT EXISTS `im_login_lockouts` (
`id` bigint NOT NULL,
`user_id` bigint DEFAULT NULL,
`account_hash` char(64) NOT NULL,
`failed_attempts` int NOT NULL DEFAULT '0',
`window_started_at` datetime(3) DEFAULT NULL,
`locked_until` datetime(3) DEFAULT NULL,
`last_attempt_at` datetime(3) DEFAULT NULL,
`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
`updated_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (`id`),
UNIQUE KEY `uk_im_login_lockouts_account` (`account_hash`),
KEY `idx_im_login_lockouts_user` (`user_id`),
KEY `idx_im_login_lockouts_locked` (`locked_until`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
CREATE TABLE IF NOT EXISTS `im_mailbox_config` (
`id` bigint NOT NULL AUTO_INCREMENT,
`enabled` tinyint NOT NULL DEFAULT '1',
docs/im/IM-登录失败锁定菜单权限.sql
+11
View File
@@ -0,0 +1,11 @@
-- ----------------------------------------------------------------
-- 登录失败锁定功能：登录失败日志页新增"解锁"按钮权限点
-- 依赖：im_adfahi_batch2_menu.sql（imLoginFailureLogIndex 菜单已存在）
-- ----------------------------------------------------------------
SET @now := NOW();
SET @imRootId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imManager' LIMIT 1);
SET @loginFailureId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imLoginFailureLogIndex' LIMIT 1);
INSERT INTO `hg_admin_menu` (`id`,`pid`,`title`,`name`,`path`,`icon`,`type`,`redirect`,`permissions`,`permission_name`,`component`,`always_show`,`active_menu`,`is_root`,`is_frame`,`frame_src`,`keep_alive`,`hidden`,`affix`,`level`,`tree`,`sort`,`remark`,`status`,`created_at`,`updated_at`)
SELECT NULL,@loginFailureId,'解锁登录锁定','imLoginFailureLogUnlock','','3','','','/imLoginFailureLog/unlock','','','1','','0','0','','0','0','0','3',CONCAT('tr_',@imRootId,' tr_',@loginFailureId,' '),50,'','1',@now,@now
WHERE @loginFailureId IS NOT NULL AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imLoginFailureLogUnlock');
server/api/admin/imconfiginternal/im_config.go
+15 -7
View File
@@ -99,13 +99,21 @@ type SecurityPolicyReq struct {
}
type SecurityPolicyRes struct {
TenantID int64 `json:"tenant_id"`
TenantCode string `json:"tenant_code"`
PolicyVersion uint `json:"policy_version"`
GlobalFriendEnabled bool `json:"global_friend_enabled"`
FriendDisabledPolicy map[string]interface{} `json:"friend_disabled_policy"`
MessageCurfewEnabled bool `json:"message_curfew_enabled"`
CurfewRules []*SecurityCurfewRuleRes `json:"curfew_rules"`
TenantID int64 `json:"tenant_id"`
TenantCode string `json:"tenant_code"`
PolicyVersion uint `json:"policy_version"`
GlobalFriendEnabled bool `json:"global_friend_enabled"`
FriendDisabledPolicy map[string]interface{} `json:"friend_disabled_policy"`
MessageCurfewEnabled bool `json:"message_curfew_enabled"`
LoginRateLimit *SecurityLoginRateLimitRes `json:"login_rate_limit"`
CurfewRules []*SecurityCurfewRuleRes `json:"curfew_rules"`
}
type SecurityLoginRateLimitRes struct {
Enabled bool `json:"enabled"`
PasswordMaxAttempts int `json:"password_max_attempts"`
LockSeconds int `json:"lock_seconds"`
WindowSeconds int `json:"window_seconds"`
}
type SecurityCurfewRuleRes struct {
server/api/admin/imloginfailurelog/im_login_failure_log.go
+5
View File
@@ -35,3 +35,8 @@ type BanUserReq struct {
sysin.ImLoginFailureBanUserInp
}
type BanUserRes struct{ *sysin.ImUserCommandModel }
type UnlockReq struct {
g.Meta `path:"/imLoginFailureLog/unlock" method:"post" tags:"IM登录失败日志" summary:"解锁登录失败锁定"`
sysin.ImLoginFailureUnlockInp
}
type UnlockRes struct{}
server/internal/controller/admin/sys/im_login_failure_log.go
+3
View File
@@ -37,3 +37,6 @@ func (c *cImLoginFailureLog) BanUser(ctx context.Context, req *imloginfailurelog
data, err := service.SysImLoginFailureLog().BanUser(ctx, &req.ImLoginFailureBanUserInp)
return &imloginfailurelog.BanUserRes{ImUserCommandModel: data}, err
}
func (c *cImLoginFailureLog) Unlock(ctx context.Context, req *imloginfailurelog.UnlockReq) (*imloginfailurelog.UnlockRes, error) {
return &imloginfailurelog.UnlockRes{}, service.SysImLoginFailureLog().Unlock(ctx, &req.ImLoginFailureUnlockInp)
}
server/internal/controller/internalapi/imconfig/im_config.go
+17 -1
View File
@@ -226,7 +226,7 @@ func (c *cConfig) SecurityPolicy(ctx context.Context, req *api.SecurityPolicyReq
}
columns := dao.ImSecurityPolicy.Columns()
record, err := imtenant.RegistryDB().Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
Fields(columns.Id, columns.PolicyVersion, columns.GlobalFriendEnabled, "CAST("+columns.FriendDisabledPolicy+" AS CHAR) friend_disabled_policy", columns.MessageCurfewEnabled).
Fields(columns.Id, columns.PolicyVersion, columns.GlobalFriendEnabled, columns.MessageCurfewEnabled, "CAST("+columns.LoginRateLimit+" AS CHAR) login_rate_limit", "CAST("+columns.FriendDisabledPolicy+" AS CHAR) friend_disabled_policy").
Where(columns.TenantId, tenant.Id).Where(columns.PublishStatus, consts.ImSecurityPublishPublished).
WhereNull(columns.DeletedAt).OrderDesc(columns.PolicyVersion).One()
if err != nil {
@@ -239,6 +239,22 @@ func (c *cConfig) SecurityPolicy(ctx context.Context, req *api.SecurityPolicyReq
res.PolicyVersion = record[columns.PolicyVersion].Uint()
res.GlobalFriendEnabled = record[columns.GlobalFriendEnabled].Int() == 1
res.MessageCurfewEnabled = record[columns.MessageCurfewEnabled].Int() == 1
if raw := strings.TrimSpace(record["login_rate_limit"].String()); raw != "" && raw != "null" {
var limit struct {
Enabled bool `json:"enabled"`
PasswordMaxAttempts int `json:"password_max_attempts"`
LockSeconds int `json:"lock_seconds"`
WindowSeconds int `json:"window_seconds"`
}
if json.Unmarshal([]byte(raw), &limit) == nil && limit.Enabled {
res.LoginRateLimit = &api.SecurityLoginRateLimitRes{
Enabled: true,
PasswordMaxAttempts: limit.PasswordMaxAttempts,
LockSeconds: limit.LockSeconds,
WindowSeconds: limit.WindowSeconds,
}
}
}
if raw := strings.TrimSpace(record["friend_disabled_policy"].String()); raw != "" && raw != "null" {
_ = json.Unmarshal([]byte(raw), &res.FriendDisabledPolicy)
}
server/internal/logic/sys/im_login_audit.go
+22
View File
@@ -5,6 +5,7 @@ import (
"fmt"
"hotgo/internal/consts"
"hotgo/internal/library/contexts"
"hotgo/internal/library/imadmin"
"hotgo/internal/library/imkafka"
"hotgo/internal/model/input/form"
"hotgo/internal/model/input/sysin"
@@ -15,6 +16,7 @@ import (
"strconv"
"github.com/gogf/gf/v2/encoding/gjson"
"github.com/gogf/gf/v2/frame/g"
"github.com/gogf/gf/v2/os/gctx"
)
@@ -128,6 +130,26 @@ func (s *sSysImLoginFailureLog) AddBlacklist(ctx context.Context, in *sysin.ImLo
})
}
func (s *sSysImLoginFailureLog) Unlock(ctx context.Context, in *sysin.ImLoginFailureUnlockInp) error {
if err := in.Filter(ctx); err != nil {
return err
}
tenant, err := resolveImAdminTenant(ctx, in.TenantId)
if err != nil {
return err
}
path := "/internal/admin-query/tenants/" + url.PathEscape(tenant.Code) + "/login-lockouts/release"
var out struct {
AccountHash string `json:"account_hash"`
Status string `json:"status"`
}
if err = imadmin.DefaultClient(ctx).InternalPost(ctx, path, map[string]string{"account_hash": in.AccountHash}, &out); err != nil {
return err
}
g.Log().Infof(ctx, "登录锁定已解锁 tenantId:%d accountHash:%s adminId:%d status:%s", tenant.Id, in.AccountHash, contexts.GetUserId(ctx), out.Status)
return nil
}
func (s *sSysImLoginFailureLog) BanUser(ctx context.Context, in *sysin.ImLoginFailureBanUserInp) (*sysin.ImUserCommandModel, error) {
if err := in.Filter(ctx); err != nil {
return nil, err
server/internal/model/input/sysin/im_login_audit.go
+22
View File
@@ -88,6 +88,7 @@ type ImLoginFailureLogModel struct {
UserId string `json:"userId" dc:"用户ID"`
AccountType string `json:"accountType" dc:"账号类型"`
AccountMask string `json:"accountMask" dc:"脱敏账号"`
AccountHash string `json:"accountHash" dc:"账号哈希"`
FailureType string `json:"failureType" dc:"失败类型"`
Reason string `json:"reason" dc:"原因码"`
Detail string `json:"detail" dc:"失败详情"`
@@ -130,6 +131,27 @@ func (in *ImLoginFailureAddBlacklistInp) Filter(ctx context.Context) error {
return nil
}
type ImLoginFailureUnlockInp struct {
TenantId int64 `json:"tenantId" dc:"租户ID"`
AccountHash string `json:"accountHash" dc:"账号哈希"`
}
func (in *ImLoginFailureUnlockInp) Filter(ctx context.Context) error {
in.AccountHash = strings.ToLower(strings.TrimSpace(in.AccountHash))
if in.AccountHash == "" {
return gerror.New("账号哈希不能为空")
}
if len(in.AccountHash) != 64 {
return gerror.New("账号哈希格式不正确")
}
for _, c := range in.AccountHash {
if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')) {
return gerror.New("账号哈希格式不正确")
}
}
return nil
}
type ImLoginFailureBanUserInp struct {
TenantId int64 `json:"tenantId" dc:"租户ID"`
UserId int64 `json:"userId" dc:"用户ID"`
server/internal/model/input/sysin/im_security_policy.go
+45
View File
@@ -12,6 +12,7 @@ import (
"github.com/gogf/gf/v2/encoding/gjson"
"github.com/gogf/gf/v2/errors/gerror"
"github.com/gogf/gf/v2/os/gtime"
"github.com/gogf/gf/v2/util/gconv"
)
type ImSecurityPolicyListInp struct {
@@ -164,6 +165,13 @@ func (in *ImSecurityPolicySaveInp) Filter(ctx context.Context) error {
if in.GlobalFriendEnabled != 0 && in.GlobalFriendEnabled != 1 {
return gerror.New("全局好友开关不合法")
}
if in.LoginRateLimit != nil {
normalized, err := normalizeLoginRateLimit(in.LoginRateLimit)
if err != nil {
return err
}
in.LoginRateLimit = normalized
}
if in.MessageCurfewEnabled != 0 && in.MessageCurfewEnabled != 1 {
return gerror.New("宵禁开关不合法")
}
@@ -210,6 +218,43 @@ func (in *ImSecurityPolicySaveInp) Filter(ctx context.Context) error {
return nil
}
// normalizeLoginRateLimit 校验并归一化登录失败锁定配置：
// {enabled, password_max_attempts, lock_seconds, window_seconds}。
// enabled=false 时输出仅含 enabled，行为与未配置一致。
func normalizeLoginRateLimit(value *gjson.Json) (*gjson.Json, error) {
policy := map[string]any{"enabled": false, "password_max_attempts": 5, "lock_seconds": 900, "window_seconds": 1800}
if value != nil && value.String() != "" && value.String() != "null" {
for key, item := range value.Map() {
policy[key] = item
}
}
if enabled, _ := policy["enabled"].(bool); !enabled {
return gjson.New(map[string]any{"enabled": false}), nil
}
maxAttempts := gconv.Int(policy["password_max_attempts"])
if maxAttempts == 0 {
maxAttempts = 5
}
if maxAttempts < 1 || maxAttempts > 20 {
return nil, gerror.New("登录失败最大次数必须在1至20之间")
}
lockSeconds := gconv.Int(policy["lock_seconds"])
if lockSeconds == 0 {
lockSeconds = 900
}
if lockSeconds < 60 || lockSeconds > 86400 {
return nil, gerror.New("账号锁定时长必须在1至1440分钟之间")
}
windowSeconds := gconv.Int(policy["window_seconds"])
if windowSeconds == 0 {
windowSeconds = 1800
}
if windowSeconds < 60 || windowSeconds > 14400 {
return nil, gerror.New("失败计数窗口必须在1至240分钟之间")
}
return gjson.New(map[string]any{"enabled": true, "password_max_attempts": maxAttempts, "lock_seconds": lockSeconds, "window_seconds": windowSeconds}), nil
}
type ImSecurityPolicyPublishInp struct {
Id int64 `json:"id" v:"required|min:1#策略ID不能为空|策略ID不合法"`
Reason string `json:"reason" v:"required#发布原因不能为空"`
server/internal/service/sys.go
+1
View File
@@ -448,6 +448,7 @@ type (
Export(ctx context.Context, in *sysin.ImLoginFailureLogListInp) (err error)
AddBlacklist(ctx context.Context, in *sysin.ImLoginFailureAddBlacklistInp) (err error)
BanUser(ctx context.Context, in *sysin.ImLoginFailureBanUserInp) (res *sysin.ImUserCommandModel, err error)
Unlock(ctx context.Context, in *sysin.ImLoginFailureUnlockInp) (err error)
}
ISysImExternalConfig interface {
// List 获取IM外部服务配置列表
web/src/api/imLoginFailureLog/index.ts
+3
View File
@@ -15,3 +15,6 @@ export function AddBlacklist(params) {
export function BanUser(params) {
return http.request({ url: '/imLoginFailureLog/banUser', method: 'POST', params });
}
export function Unlock(params) {
return http.request({ url: '/imLoginFailureLog/unlock', method: 'POST', params });
}
web/src/views/imLoginFailureLog/index.vue
+22 -3
View File
@@ -79,7 +79,7 @@
import { BasicTable, TableAction } from '@/components/Table';
import { usePermission } from '@/hooks/web/usePermission';
import { adaTableScrollX } from '@/utils/hotgo';
import { AddBlacklist, BanUser, Export, List, View } from '@/api/imLoginFailureLog';
import { AddBlacklist, BanUser, Export, List, Unlock, View } from '@/api/imLoginFailureLog';
import { imQueryTenantOptions, loadImQueryTenantOptions } from '@/views/imAdminQueryShared';
import { columns, loadOptions, schemas } from './model';
@@ -119,6 +119,13 @@
ifShow: () => Number(record.userId) > 0,
onClick: () => openBan(record),
},
{
label: '解锁',
type: 'primary',
auth: ['/imLoginFailureLog/unlock'],
ifShow: () => record.riskAction === 'account_locked' && !!record.accountHash,
onClick: () => unlockLockout(record),
},
],
});
},
@@ -131,8 +138,7 @@
});
const loadDataTable = async (res) => {
const params = { ...searchFormRef.value?.formModel, ...res };
if (!params.tenantId)
return { list: [], page: 1, pageCount: 0, totalCount: 0 };
if (!params.tenantId) return { list: [], page: 1, pageCount: 0, totalCount: 0 };
return List(params);
};
function reloadTable() {
@@ -177,6 +183,19 @@
banReason.value = '';
showBan.value = true;
}
function unlockLockout(record) {
dialog.warning({
title: '解锁账号',
content: `确认解除 ${record.accountMask || '该账号'} 的登录锁定吗？解锁后可立即重新登录。`,
positiveText: '确认解锁',
negativeText: '取消',
onPositiveClick: async () => {
await Unlock({ tenantId: record.tenantId, accountHash: record.accountHash });
message.success('已解锁');
reloadTable();
},
});
}
async function submitBan() {
if (!banReason.value.trim()) {
message.warning('请输入封禁原因');
web/src/views/imSecurityPolicy/index.vue
+56 -8
View File
@@ -219,12 +219,43 @@
type="textarea"
:autosize="{ minRows: 3, maxRows: 8 }"
/></n-form-item>
<n-form-item label="登录限频JSON"
><n-input
v-model:value="policyForm.loginRateLimit"
type="textarea"
:autosize="{ minRows: 3, maxRows: 8 }"
<n-form-item label="登录失败锁定"
><n-switch
v-model:value="policyForm.loginRateLimitEnabled"
:checked-value="1"
:unchecked-value="0"
/></n-form-item>
<template v-if="policyForm.loginRateLimitEnabled">
<n-grid :cols="2" :x-gap="16">
<n-form-item-gi label="最大失败次数">
<n-input-number
v-model:value="policyForm.loginRateLimitMaxAttempts"
:min="1"
:max="20"
:precision="0"
/> </n-form-item-gi
><n-form-item-gi label="锁定时长(分钟)">
<n-input-number
v-model:value="policyForm.loginRateLimitLockMinutes"
:min="1"
:max="1440"
:precision="0"
/> </n-form-item-gi
><n-form-item-gi label="计数窗口(分钟)">
<n-input-number
v-model:value="policyForm.loginRateLimitWindowMinutes"
:min="1"
:max="240"
:precision="0"
/>
</n-form-item-gi>
</n-grid>
<n-form-item label=" ">
<n-text depth="3">
同一账号在计数窗口内连续输错密码达到最大次数后锁定，锁定期间登录将被拒绝，可在“日志审计-登录失败日志”中解锁。
</n-text>
</n-form-item>
</template>
<n-form-item label="实名策略JSON"
><n-input
v-model:value="policyForm.realnamePolicy"
@@ -412,7 +443,10 @@
tenantId: tenantId(),
policyName: '安全策略',
passwordPolicy: '{}',
loginRateLimit: '{}',
loginRateLimitEnabled: 0,
loginRateLimitMaxAttempts: 5,
loginRateLimitLockMinutes: 15,
loginRateLimitWindowMinutes: 30,
sensitiveWordPolicy: '{}',
moderationPolicy: defaultModerationPolicy(),
fileReviewPolicy: '{}',
@@ -518,6 +552,7 @@
return;
}
const data = await View({ id: row.id });
const loginRateLimit = parseJSON(data.loginRateLimit, {});
policyForm.value = {
...data,
friendPolicy: {
@@ -525,7 +560,13 @@
...parseJSON(data.friendDisabledPolicy, {}),
},
passwordPolicy: data.passwordPolicy || '{}',
loginRateLimit: data.loginRateLimit || '{}',
loginRateLimitEnabled: loginRateLimit.enabled ? 1 : 0,
loginRateLimitMaxAttempts: loginRateLimit.password_max_attempts || 5,
loginRateLimitLockMinutes: Math.max(1, Math.round((loginRateLimit.lock_seconds || 900) / 60)),
loginRateLimitWindowMinutes: Math.max(
1,
Math.round((loginRateLimit.window_seconds || 1800) / 60)
),
sensitiveWordPolicy: data.sensitiveWordPolicy || '{}',
moderationPolicy: {
...defaultModerationPolicy(),
@@ -585,7 +626,14 @@
await Save({
...f,
passwordPolicy: jsonObject(f.passwordPolicy, '密码策略'),
loginRateLimit: jsonObject(f.loginRateLimit, '登录限频'),
loginRateLimit: f.loginRateLimitEnabled
? {
enabled: true,
password_max_attempts: f.loginRateLimitMaxAttempts,
lock_seconds: f.loginRateLimitLockMinutes * 60,
window_seconds: f.loginRateLimitWindowMinutes * 60,
}
: { enabled: false },
sensitiveWordPolicy: f.moderationPolicy,
fileReviewPolicy: jsonObject(f.fileReviewPolicy, '文件审核策略'),
realnamePolicy: jsonObject(f.realnamePolicy, '实名策略'),