feat: 完善用户治理与登录白名单

server/auth_audit.go

@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"net"
 	"strings"
 	"time"
@@ -70,6 +71,37 @@ func recordSessionLoginFailure(s *Session, scheme string, secret []byte, rec *au
 	}
 }
 
+func checkUserLoginIPWhitelist(tenantID types.TenantID, uid types.Uid, remoteAddr string) error {
+	result, err := store.InternalAdminQueries.Query(tenantID,
+		"SELECT ip_cidr FROM im_user_ip_whitelists WHERE user_id=? AND status=1 AND deleted_at IS NULL ORDER BY id",
+		"SELECT COUNT(*) FROM im_user_ip_whitelists WHERE user_id=? AND status=1 AND deleted_at IS NULL",
+		[]any{store.DecodeUid(uid)}, 1, 500)
+	if err != nil {
+		if errors.Is(err, types.ErrUnsupported) {
+			return nil
+		}
+		return err
+	}
+	if result == nil || len(result.Items) == 0 {
+		return nil
+	}
+	ipText := sessionAuditIP(strings.Split(remoteAddr, ",")[0])
+	ip := net.ParseIP(ipText)
+	if ip == nil {
+		return types.ErrPermissionDenied
+	}
+	for _, item := range result.Items {
+		value := strings.TrimSpace(fmt.Sprint(item["ip_cidr"]))
+		if allowedIP := net.ParseIP(value); allowedIP != nil && allowedIP.Equal(ip) {
+			return nil
+		}
+		if _, block, parseErr := net.ParseCIDR(value); parseErr == nil && block.Contains(ip) {
+			return nil
+		}
+	}
+	return types.ErrPermissionDenied
+}
+
 func loginAuditAccount(scheme, supplied, credential string) (string, string) {
 	if parts := strings.SplitN(strings.TrimSpace(credential), ":", 2); len(parts) == 2 && parts[1] != "" {
 		kind := strings.ToLower(strings.TrimSpace(parts[0]))