fix shared database account sequence initialization

This commit is contained in:
richjohnrambo
2026-09-22 18:00:18 +08:00
parent e4416da04a
commit 8e04f00e96
8 changed files with 158 additions and 13 deletions
+6 -6
View File
@@ -322,8 +322,8 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
| 租户握手 `hi` | `{"hi":{"id":"hi-1","ver":"0.25","ua":"Tinodios/1","platf":"ios","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"ver":"0.25","tenant":{"code":"default","name":"Default Tenant"},"maxMessageSize":4194304,"maxFileUploadSize":33554432,"maxSubscriberCount":128}}}` |
| 账号密码登录 | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| Token 登录 | `{"login":{"id":"login-2","scheme":"token","secret":"上次登录返回的 token 原文"}}` | `{"ctrl":{"id":"login-2","code":200,"text":"ok","params":{"user":"usr...","authlvl":"auth","token":"new_token...","expires":"2026-09-03T09:00:00Z"}}}` |
| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| 登录失败 | `{"login":{"id":"login-bad","scheme":"basic","secret":"base64(alice:wrong)"}}` | `{"ctrl":{"id":"login-bad","code":401,"text":"authentication failed","params":{"reason":"AUTH_FAILED"}}}` |
| 租户不匹配 | `{"login":{"id":"login-tenant","scheme":"token","secret":"其他租户 token"}}` | `{"ctrl":{"id":"login-tenant","code":403,"text":"tenant mismatch","params":{"reason":"TENANT_MISMATCH"}}}` |
@@ -617,7 +617,7 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
| --- | --- | --- |
| `GET /v0/channels?apikey={api_key}` | WebSocket Upgrade 后首帧 `{"hi":{"id":"hi-1","ver":"0.25","ua":"ios/1.0","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"tenant":{"code":"default","name":"Default Tenant"},"ver":"0.25","maxMessageSize":4194304}}}` |
| WebSocket `login basic` | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"params":{"user":"usr...","token":"token...","expires":"2026-09-03T09:00:00Z","authlvl":"auth"}}}` |
| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
| `POST /v0/channels/lp` | Long Polling 首包 `{"hi":{"id":"hi-1","ver":"0.25","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"params":{"sid":"lp_sid_123"}}}` |
| `POST /v0/file/u/` | Multipart 文件;Header `X-MeetingIM-Auth: token <base64_token>`;业务表单可带 `purpose=chat_file&topic=grp...` | `{"ctrl":{"code":200,"params":{"url":"/v0/file/s/file123","name":"a.pdf","size":1024,"mime":"application/pdf"}}}` |
| `GET /v0/file/s/{file_id}` | Header `X-MeetingIM-Auth: token <base64_token>`,可带 `Range: bytes=0-` | 对象存储模式下鉴权通过后返回 302 到短期签名 URL;客户端跟随 Location 获取文件 |
@@ -876,19 +876,19 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
用户名方式:
```json
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}}
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}}
```
手机号验证方式:
```json
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
```
仅手机号注册方式:
```json
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","registration_type":1,"secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
```
- 成功:返回新 `user`、最终 `username` 和登录 Token;客户端保存 `params.token`,随后执行 `sub me` 和会话恢复。创建用户前原子校验 `im_tenant_config.max_users`,超限返回 `TENANT_USER_QUOTA_EXCEEDED`。
- 安全:用户名、手机号分别在租户内唯一;验证码票据单次消费,邀请码在有效期内可重复使用;密码按服务端策略校验并使用强哈希保存。
+46
View File
@@ -1031,5 +1031,51 @@ INSERT INTO tinode.im_feedback_config(id, categories, max_length, attachment_pol
VALUES (1, '["bug","suggestion","complaint","other"]', 1000, '{"max_files":5,"purpose":"feedback"}', 1, '仅在你同意时上传脱敏诊断信息。')
ON DUPLICATE KEY UPDATE updated_at = updated_at;
-- ============================================================
-- Shared database runtime fixes for meeting_im.
-- These are required after moving default/system tenants into the shared DB.
-- ============================================================
CREATE TABLE IF NOT EXISTS meeting_im.im_user_account_sequences (
tenant_id BIGINT NOT NULL,
id TINYINT UNSIGNED NOT NULL,
next_value INT UNSIGNED NOT NULL,
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (tenant_id, id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
ALTER TABLE meeting_im.im_user_account_sequences
DROP PRIMARY KEY,
ADD PRIMARY KEY (tenant_id, id);
INSERT INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value)
SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
FROM meeting_im.im_users
WHERE tenant_id > 0
GROUP BY tenant_id
ON DUPLICATE KEY UPDATE
next_value = GREATEST(next_value, VALUES(next_value));
INSERT IGNORE INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value)
SELECT id, 1, 999
FROM hotgo.im_tenant
WHERE state = 1;
CREATE TABLE IF NOT EXISTS meeting_im.im_login_lockouts (
id BIGINT NOT NULL,
user_id BIGINT,
account_hash CHAR(64) NOT NULL,
failed_attempts INT NOT NULL DEFAULT 0,
window_started_at DATETIME(3),
locked_until DATETIME(3),
last_attempt_at DATETIME(3),
created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (id),
UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
INDEX idx_im_login_lockouts_user (user_id),
INDEX idx_im_login_lockouts_locked (locked_until)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
-- Current MySQL adapter schema version expected by server/db/mysql/adapter.go.
UPDATE tinode.im_kvmeta SET `value` = 123 WHERE `key` = 'version';
@@ -0,0 +1,47 @@
-- MySQL 8.0. Runtime fixes for the shared meeting_im database.
-- Execute with a privileged account that can read hotgo.im_tenant.
CREATE TABLE IF NOT EXISTS im_user_account_sequences (
tenant_id BIGINT NOT NULL,
id TINYINT UNSIGNED NOT NULL,
next_value INT UNSIGNED NOT NULL,
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (tenant_id, id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
-- If this table was created by the older independent-database script, its
-- primary key may still be only (id). Shared DB must key by tenant_id too.
ALTER TABLE im_user_account_sequences
DROP PRIMARY KEY,
ADD PRIMARY KEY (tenant_id, id);
INSERT INTO im_user_account_sequences (tenant_id, id, next_value)
SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
FROM im_users
WHERE tenant_id > 0
GROUP BY tenant_id
ON DUPLICATE KEY UPDATE
next_value = GREATEST(next_value, VALUES(next_value));
INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value)
SELECT id, 1, 999
FROM hotgo.im_tenant
WHERE state = 1;
CREATE TABLE IF NOT EXISTS im_login_lockouts (
id BIGINT NOT NULL,
user_id BIGINT NULL,
account_hash CHAR(64) NOT NULL,
failed_attempts INT NOT NULL DEFAULT 0,
window_started_at DATETIME(3) NULL,
locked_until DATETIME(3) NULL,
last_attempt_at DATETIME(3) NULL,
created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (id),
UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
INDEX idx_im_login_lockouts_user (user_id),
INDEX idx_im_login_lockouts_locked (locked_until)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
@@ -59,6 +59,22 @@ CREATE TABLE IF NOT EXISTS im_login_failure_logs (
INDEX idx_im_login_failure_request (request_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
CREATE TABLE IF NOT EXISTS im_login_lockouts (
id BIGINT NOT NULL,
user_id BIGINT NULL,
account_hash CHAR(64) NOT NULL,
failed_attempts INT NOT NULL DEFAULT 0,
window_started_at DATETIME(3) NULL,
locked_until DATETIME(3) NULL,
last_attempt_at DATETIME(3) NULL,
created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (id),
UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
INDEX idx_im_login_lockouts_user (user_id),
INDEX idx_im_login_lockouts_locked (locked_until)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
CREATE TABLE IF NOT EXISTS im_message_admin_actions (
id BIGINT NOT NULL AUTO_INCREMENT,
action_id VARCHAR(96) NOT NULL,
+19 -5
View File
@@ -1,15 +1,29 @@
-- 在每个租户业务库执行。用于并发安全地生成 im_users.account_no。
-- 在 meeting_im 共库执行。用于并发安全地生成每个租户的 im_users.account_no。
CREATE TABLE IF NOT EXISTS im_user_account_sequences (
tenant_id BIGINT NOT NULL,
id TINYINT UNSIGNED NOT NULL,
next_value INT UNSIGNED NOT NULL,
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY (id)
PRIMARY KEY (tenant_id, id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
-- 兼容已有用户数据,从当前最大账号编号继续递增,账号编号最小为 1000。
INSERT INTO im_user_account_sequences (id, next_value)
SELECT 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
-- 如果历史脚本已经创建过单库版 PRIMARY KEY(id),需要先改成共库主键。
ALTER TABLE im_user_account_sequences
DROP PRIMARY KEY,
ADD PRIMARY KEY (tenant_id, id);
-- 兼容已有用户数据,从每个租户当前最大账号编号继续递增,账号编号最小为 1000。
INSERT INTO im_user_account_sequences (tenant_id, id, next_value)
SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
FROM im_users
WHERE tenant_id > 0
GROUP BY tenant_id
ON DUPLICATE KEY UPDATE
next_value = GREATEST(next_value, VALUES(next_value));
-- 如果当前租户暂时还没有用户,也要先塞一行,否则新注册无法生成账号编号。
INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value)
SELECT id, 1, 999
FROM hotgo.im_tenant
WHERE state = 1;
+4
View File
@@ -1351,6 +1351,10 @@ func nextUserAccountNo(ctx context.Context, tx *sqlx.Tx) (uint32, bool, error) {
return 0, false, nil
}
if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(id,next_value)
SELECT 1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0`); err != nil {
return 0, true, err
}
if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences
SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0))
WHERE id=1`); err != nil {
+5
View File
@@ -446,6 +446,11 @@ func nextTenantUserAccountNo(ctx context.Context, tx *sqlx.Tx, tenantID t.Tenant
if columns == 0 {
return 0, false, nil
}
if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(tenant_id,id,next_value)
SELECT ?,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0`,
tenantID, tenantID); err != nil {
return 0, true, err
}
if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences
SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0))
WHERE tenant_id=? AND id=1`, tenantID, tenantID); err != nil {
+15 -2
View File
@@ -189,7 +189,7 @@ func ensureUserIdentitySchema(db *sqlx.DB) error {
if _, err = conn.ExecContext(ctx, "ALTER TABLE im_users MODIFY COLUMN username VARCHAR(32) NOT NULL"); err != nil {
return err
}
if err = ensureUserAccountSequence(ctx, conn); err != nil {
if err = ensureUserAccountSequence(ctx, conn, usersScoped); err != nil {
return err
}
if err = migrateBasicAuthSchema(ctx, conn, usersScoped); err != nil {
@@ -213,11 +213,24 @@ func ensureUserIdentitySchema(db *sqlx.DB) error {
return nil
}
func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn) error {
func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn, scoped bool) error {
exists, err := identityColumnExists(ctx, conn, "im_users", "account_no")
if err != nil || !exists {
return err
}
if scoped {
if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences(
tenant_id BIGINT NOT NULL,id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL,
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
PRIMARY KEY(tenant_id,id)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`); err != nil {
return err
}
_, err = conn.ExecContext(ctx, `INSERT INTO im_user_account_sequences(tenant_id,id,next_value)
SELECT tenant_id,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users
WHERE tenant_id>0 GROUP BY tenant_id
ON DUPLICATE KEY UPDATE next_value=GREATEST(next_value,VALUES(next_value))`)
return err
}
if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences(
id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL,
updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),