diff --git a/docs/IM-前后端对接文档.md b/docs/IM-前后端对接文档.md index 5b935f2..edfecd1 100644 --- a/docs/IM-前后端对接文档.md +++ b/docs/IM-前后端对接文档.md @@ -322,8 +322,8 @@ X-MeetingIM-APIKey: <预置的普通 API Key> | 租户握手 `hi` | `{"hi":{"id":"hi-1","ver":"0.25","ua":"Tinodios/1","platf":"ios","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"ver":"0.25","tenant":{"code":"default","name":"Default Tenant"},"maxMessageSize":4194304,"maxFileUploadSize":33554432,"maxSubscriberCount":128}}}` | | 账号密码登录 | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | | Token 登录 | `{"login":{"id":"login-2","scheme":"token","secret":"上次登录返回的 token 原文"}}` | `{"ctrl":{"id":"login-2","code":200,"text":"ok","params":{"user":"usr...","authlvl":"auth","token":"new_token...","expires":"2026-09-03T09:00:00Z"}}}` | -| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | -| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | +| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | +| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | | 登录失败 | `{"login":{"id":"login-bad","scheme":"basic","secret":"base64(alice:wrong)"}}` | `{"ctrl":{"id":"login-bad","code":401,"text":"authentication failed","params":{"reason":"AUTH_FAILED"}}}` | | 租户不匹配 | `{"login":{"id":"login-tenant","scheme":"token","secret":"其他租户 token"}}` | `{"ctrl":{"id":"login-tenant","code":403,"text":"tenant mismatch","params":{"reason":"TENANT_MISMATCH"}}}` | @@ -617,7 +617,7 @@ X-MeetingIM-APIKey: <预置的普通 API Key> | --- | --- | --- | | `GET /v0/channels?apikey={api_key}` | WebSocket Upgrade 后首帧 `{"hi":{"id":"hi-1","ver":"0.25","ua":"ios/1.0","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"tenant":{"code":"default","name":"Default Tenant"},"ver":"0.25","maxMessageSize":4194304}}}` | | WebSocket `login basic` | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"params":{"user":"usr...","token":"token...","expires":"2026-09-03T09:00:00Z","authlvl":"auth"}}}` | -| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | +| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` | | `POST /v0/channels/lp` | Long Polling 首包 `{"hi":{"id":"hi-1","ver":"0.25","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"params":{"sid":"lp_sid_123"}}}` | | `POST /v0/file/u/` | Multipart 文件；Header `X-MeetingIM-Auth: token `；业务表单可带 `purpose=chat_file&topic=grp...` | `{"ctrl":{"code":200,"params":{"url":"/v0/file/s/file123","name":"a.pdf","size":1024,"mime":"application/pdf"}}}` | | `GET /v0/file/s/{file_id}` | Header `X-MeetingIM-Auth: token `，可带 `Range: bytes=0-` | 对象存储模式下鉴权通过后返回 302 到短期签名 URL；客户端跟随 Location 获取文件 | @@ -876,19 +876,19 @@ X-MeetingIM-APIKey: <预置的普通 API Key> 用户名方式： ```json -{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}} +{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}} ``` 手机号验证方式： ```json -{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}} +{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}} ``` 仅手机号注册方式： ```json -{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}} +{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","registration_type":1,"secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}} ``` - 成功：返回新 `user`、最终 `username` 和登录 Token；客户端保存 `params.token`，随后执行 `sub me` 和会话恢复。创建用户前原子校验 `im_tenant_config.max_users`，超限返回 `TENANT_USER_QUOTA_EXCEEDED`。 - 安全：用户名、手机号分别在租户内唯一；验证码票据单次消费，邀请码在有效期内可重复使用；密码按服务端策略校验并使用强哈希保存。 diff --git a/docs/IM-数据库变更汇总.sql b/docs/IM-数据库变更汇总.sql index a970ef7..d8df866 100644 --- a/docs/IM-数据库变更汇总.sql +++ b/docs/IM-数据库变更汇总.sql @@ -1031,5 +1031,51 @@ INSERT INTO tinode.im_feedback_config(id, categories, max_length, attachment_pol VALUES (1, '["bug","suggestion","complaint","other"]', 1000, '{"max_files":5,"purpose":"feedback"}', 1, '仅在你同意时上传脱敏诊断信息。') ON DUPLICATE KEY UPDATE updated_at = updated_at; +-- ============================================================ +-- Shared database runtime fixes for meeting_im. +-- These are required after moving default/system tenants into the shared DB. +-- ============================================================ + +CREATE TABLE IF NOT EXISTS meeting_im.im_user_account_sequences ( + tenant_id BIGINT NOT NULL, + id TINYINT UNSIGNED NOT NULL, + next_value INT UNSIGNED NOT NULL, + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY (tenant_id, id) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; + +ALTER TABLE meeting_im.im_user_account_sequences + DROP PRIMARY KEY, + ADD PRIMARY KEY (tenant_id, id); + +INSERT INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value) +SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999) +FROM meeting_im.im_users +WHERE tenant_id > 0 +GROUP BY tenant_id +ON DUPLICATE KEY UPDATE + next_value = GREATEST(next_value, VALUES(next_value)); + +INSERT IGNORE INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value) +SELECT id, 1, 999 +FROM hotgo.im_tenant +WHERE state = 1; + +CREATE TABLE IF NOT EXISTS meeting_im.im_login_lockouts ( + id BIGINT NOT NULL, + user_id BIGINT, + account_hash CHAR(64) NOT NULL, + failed_attempts INT NOT NULL DEFAULT 0, + window_started_at DATETIME(3), + locked_until DATETIME(3), + last_attempt_at DATETIME(3), + created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY (id), + UNIQUE INDEX uk_im_login_lockouts_account (account_hash), + INDEX idx_im_login_lockouts_user (user_id), + INDEX idx_im_login_lockouts_locked (locked_until) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; + -- Current MySQL adapter schema version expected by server/db/mysql/adapter.go. UPDATE tinode.im_kvmeta SET `value` = 123 WHERE `key` = 'version'; diff --git a/docs/sql/IM-共库运行态缺口修复SQL.sql b/docs/sql/IM-共库运行态缺口修复SQL.sql new file mode 100644 index 0000000..373c1e2 --- /dev/null +++ b/docs/sql/IM-共库运行态缺口修复SQL.sql @@ -0,0 +1,47 @@ +-- MySQL 8.0. Runtime fixes for the shared meeting_im database. +-- Execute with a privileged account that can read hotgo.im_tenant. + +CREATE TABLE IF NOT EXISTS im_user_account_sequences ( + tenant_id BIGINT NOT NULL, + id TINYINT UNSIGNED NOT NULL, + next_value INT UNSIGNED NOT NULL, + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) + ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY (tenant_id, id) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; + +-- If this table was created by the older independent-database script, its +-- primary key may still be only (id). Shared DB must key by tenant_id too. +ALTER TABLE im_user_account_sequences + DROP PRIMARY KEY, + ADD PRIMARY KEY (tenant_id, id); + +INSERT INTO im_user_account_sequences (tenant_id, id, next_value) +SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999) +FROM im_users +WHERE tenant_id > 0 +GROUP BY tenant_id +ON DUPLICATE KEY UPDATE + next_value = GREATEST(next_value, VALUES(next_value)); + +INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value) +SELECT id, 1, 999 +FROM hotgo.im_tenant +WHERE state = 1; + +CREATE TABLE IF NOT EXISTS im_login_lockouts ( + id BIGINT NOT NULL, + user_id BIGINT NULL, + account_hash CHAR(64) NOT NULL, + failed_attempts INT NOT NULL DEFAULT 0, + window_started_at DATETIME(3) NULL, + locked_until DATETIME(3) NULL, + last_attempt_at DATETIME(3) NULL, + created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) + ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY (id), + UNIQUE INDEX uk_im_login_lockouts_account (account_hash), + INDEX idx_im_login_lockouts_user (user_id), + INDEX idx_im_login_lockouts_locked (locked_until) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; diff --git a/docs/sql/IM-后台消息与登录审计SQL.sql b/docs/sql/IM-后台消息与登录审计SQL.sql index 5985fad..1c4d413 100644 --- a/docs/sql/IM-后台消息与登录审计SQL.sql +++ b/docs/sql/IM-后台消息与登录审计SQL.sql @@ -59,6 +59,22 @@ CREATE TABLE IF NOT EXISTS im_login_failure_logs ( INDEX idx_im_login_failure_request (request_id) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; +CREATE TABLE IF NOT EXISTS im_login_lockouts ( + id BIGINT NOT NULL, + user_id BIGINT NULL, + account_hash CHAR(64) NOT NULL, + failed_attempts INT NOT NULL DEFAULT 0, + window_started_at DATETIME(3) NULL, + locked_until DATETIME(3) NULL, + last_attempt_at DATETIME(3) NULL, + created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY (id), + UNIQUE INDEX uk_im_login_lockouts_account (account_hash), + INDEX idx_im_login_lockouts_user (user_id), + INDEX idx_im_login_lockouts_locked (locked_until) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; + CREATE TABLE IF NOT EXISTS im_message_admin_actions ( id BIGINT NOT NULL AUTO_INCREMENT, action_id VARCHAR(96) NOT NULL, diff --git a/docs/sql/IM-用户账号编号序列表SQL.sql b/docs/sql/IM-用户账号编号序列表SQL.sql index 8c91624..1fd13be 100644 --- a/docs/sql/IM-用户账号编号序列表SQL.sql +++ b/docs/sql/IM-用户账号编号序列表SQL.sql @@ -1,15 +1,29 @@ --- 在每个租户业务库执行。用于并发安全地生成 im_users.account_no。 +-- 在 meeting_im 共库执行。用于并发安全地生成每个租户的 im_users.account_no。 CREATE TABLE IF NOT EXISTS im_user_account_sequences ( + tenant_id BIGINT NOT NULL, id TINYINT UNSIGNED NOT NULL, next_value INT UNSIGNED NOT NULL, updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), - PRIMARY KEY (id) + PRIMARY KEY (tenant_id, id) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci; --- 兼容已有用户数据，从当前最大账号编号继续递增，账号编号最小为 1000。 -INSERT INTO im_user_account_sequences (id, next_value) -SELECT 1, GREATEST(COALESCE(MAX(account_no), 999), 999) +-- 如果历史脚本已经创建过单库版 PRIMARY KEY(id)，需要先改成共库主键。 +ALTER TABLE im_user_account_sequences + DROP PRIMARY KEY, + ADD PRIMARY KEY (tenant_id, id); + +-- 兼容已有用户数据，从每个租户当前最大账号编号继续递增，账号编号最小为 1000。 +INSERT INTO im_user_account_sequences (tenant_id, id, next_value) +SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999) FROM im_users +WHERE tenant_id > 0 +GROUP BY tenant_id ON DUPLICATE KEY UPDATE next_value = GREATEST(next_value, VALUES(next_value)); + +-- 如果当前租户暂时还没有用户，也要先塞一行，否则新注册无法生成账号编号。 +INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value) +SELECT id, 1, 999 +FROM hotgo.im_tenant +WHERE state = 1; diff --git a/server/db/mysql/adapter.go b/server/db/mysql/adapter.go index e6e561d..0d6b5fc 100644 --- a/server/db/mysql/adapter.go +++ b/server/db/mysql/adapter.go @@ -1351,6 +1351,10 @@ func nextUserAccountNo(ctx context.Context, tx *sqlx.Tx) (uint32, bool, error) { return 0, false, nil } + if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(id,next_value) + SELECT 1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0`); err != nil { + return 0, true, err + } if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0)) WHERE id=1`); err != nil { diff --git a/server/db/mysql/tenant_adapter.go b/server/db/mysql/tenant_adapter.go index a66e235..a1f906e 100644 --- a/server/db/mysql/tenant_adapter.go +++ b/server/db/mysql/tenant_adapter.go @@ -446,6 +446,11 @@ func nextTenantUserAccountNo(ctx context.Context, tx *sqlx.Tx, tenantID t.Tenant if columns == 0 { return 0, false, nil } + if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(tenant_id,id,next_value) + SELECT ?,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0`, + tenantID, tenantID); err != nil { + return 0, true, err + } if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0)) WHERE tenant_id=? AND id=1`, tenantID, tenantID); err != nil { diff --git a/server/db/mysql/user_identity_schema.go b/server/db/mysql/user_identity_schema.go index 7a9932d..d007b59 100644 --- a/server/db/mysql/user_identity_schema.go +++ b/server/db/mysql/user_identity_schema.go @@ -189,7 +189,7 @@ func ensureUserIdentitySchema(db *sqlx.DB) error { if _, err = conn.ExecContext(ctx, "ALTER TABLE im_users MODIFY COLUMN username VARCHAR(32) NOT NULL"); err != nil { return err } - if err = ensureUserAccountSequence(ctx, conn); err != nil { + if err = ensureUserAccountSequence(ctx, conn, usersScoped); err != nil { return err } if err = migrateBasicAuthSchema(ctx, conn, usersScoped); err != nil { @@ -213,11 +213,24 @@ func ensureUserIdentitySchema(db *sqlx.DB) error { return nil } -func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn) error { +func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn, scoped bool) error { exists, err := identityColumnExists(ctx, conn, "im_users", "account_no") if err != nil || !exists { return err } + if scoped { + if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences( + tenant_id BIGINT NOT NULL,id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL, + updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + PRIMARY KEY(tenant_id,id)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`); err != nil { + return err + } + _, err = conn.ExecContext(ctx, `INSERT INTO im_user_account_sequences(tenant_id,id,next_value) + SELECT tenant_id,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users + WHERE tenant_id>0 GROUP BY tenant_id + ON DUPLICATE KEY UPDATE next_value=GREATEST(next_value,VALUES(next_value))`) + return err + } if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences( id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL, updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),