1
/**
2
 * 验证码响应对象
3
 */
4
@Data
5
@Builder
6
@NoArgsConstructor
7
@AllArgsConstructor
8
public class CaptchaResponse {
9
    /** 验证码唯一标识 */
10
    private String uuid;
11
    /** 背景图片（Base64） */
12
    private String bgUrl;
13
    /** 拼图图片（Base64） */
14
    private String puzzleUrl;
15
    /** 滑块Y轴坐标 */
16
    private Integer y;
17
}

1
@Override
2
public CaptchaResponse generateSlideCaptcha() {
3
    // ... 生成图片逻辑 ...
4

5
    // 6. 缓存X坐标用于校验
6
    String uuid = UUID.randomUUID().toString().replace("-", "");
7
    String captchaKey = CacheConstants.CACHE_CAPTCHA_CODE + uuid;
8
    redisService.setCacheObject(captchaKey, String.valueOf(x), 1, TimeUnit.MINUTES);
9

10
    return CaptchaResponse.builder()
11
            .uuid(uuid)
12
            .bgUrl(bgBase64)
13
            .puzzleUrl(puzzleBase64)
14
            .y(y)
15
            .build();
16
}

1
@Override
2
public String validateCaptcha(String uuid, String code) {
3
    String captchaKey = CacheConstants.CACHE_CAPTCHA_CODE + uuid;
4
    String cachedX = redisService.getCacheObject(captchaKey);
5

6
    // ... 校验逻辑 ...
7
    int x = Integer.parseInt(code);
8
    int targetX = Integer.parseInt(cachedX);
9
    // 允许误差范围 ±5 像素
10
    if (Math.abs(x - targetX) > 5) {
11
        throw new AuthException("验证码错误");
12
    }
13

14
    // 生成验证通过凭证
15
    String verifyToken = UUID.randomUUID().toString().replace("-", "");
16
    String verifyKey = CacheConstants.CACHE_CAPTCHA_VERIFIED + verifyToken;
17
    redisService.setCacheObject(verifyKey, "true", 5, TimeUnit.MINUTES);
18

19
    return verifyToken;
20
}

1
@Override
2
public void validateEmailCode(String email, String code) {
3
    if (StringUtils.isEmpty(email) || StringUtils.isEmpty(code)) {
4
        throw new AuthException("邮箱和验证码不能为空");
5
    }
6

7
    String emailKey = CacheConstants.CACHE_EMAIL_CODE + email;
8
    String cachedCode = redisService.getCacheObject(emailKey);
9

10
    if (StringUtils.isEmpty(cachedCode)) {
11
        throw new AuthException("验证码已过期");
12
    }
13

14
    if (!code.equals(cachedCode)) {
15
        throw new AuthException("验证码错误");
16
    }
17

18
    // 验证通过后删除缓存，防止重复使用
19
    redisService.deleteObject(emailKey);
20
}

1
/**
2
 * 用户注册请求对象
3
 */
4
@Data
5
public class RegisterBody implements Serializable {
6
    /** 用户名 */
7
    @NotBlank(message = "用户名不能为空")
8
    @Length(min = 2, max = 20, message = "用户名长度必须在2到20个字符之间")
9
    private String username;
10

11
    /** 邮箱 */
12
    @NotBlank(message = "邮箱不能为空")
13
    @Email(message = "邮箱格式不正确")
14
    private String email;
15

16
    /** 用户密码 */
17
    @NotBlank(message = "密码不能为空")
18
    private String password;
19

20
    /** 确认密码 */
21
    @NotBlank(message = "确认密码不能为空")
22
    private String confirmPassword;
23

24
    /** 验证码内容 */
25
    @NotBlank(message = "验证码不能为空")
26
    private String code;
27

28
    /** 验证码标识 */
29
    @NotBlank(message = "验证码标识不能为空")
30
    private String uuid;
31
}

1
@Override
2
public void register(RegisterBody registerBody) {
3
    String username = registerBody.getUsername();
4
    // 1. RSA 密码解密
5
    String password = encryptService.decrypt(registerBody.getPassword());
6
    String confirmPassword = encryptService.decrypt(registerBody.getConfirmPassword());
7
    String code = registerBody.getCode();
8
    String email = registerBody.getEmail();
9

10
    // 2. 验证邮箱验证码
11
    emailService.validateEmailCode(email, code);
12

13
    // ... 密码规则校验 ...
14

15
    // 3. 检查用户是否已存在
16
    R<LoginUser> result = remoteUserService.getUserInfo(username, CommonConstants.REQUEST_SOURCE_INNER);
17
    if (result != null && result.isSuccess() && result.getData() != null) {
18
        throw new BusinessException("保存用户'" + username + "'失败，注册账号已存在");
19
    }
20

21
    // 4. 构建用户对象并创建
22
    SysUserApi sysUser = new SysUserApi();
23
    sysUser.setUserName(username);
24
    // ... 设置属性 ...
25
    // 5. BCrypt 密码哈希加密
26
    sysUser.setPassword(SecurityUtils.encryptPassword(password));
27

28
    R<Boolean> registerResult = remoteUserService.createUser(sysUser);
29
    // ... 结果处理 ...
30
}

1
@Data
2
public class LoginRequest {
3
    /**
4
     * 用户名
5
     */
6
    @Length(min = 2, max = 20, message = "用户名长度必须在2到20个字符之间")
7
    private String username;
8

9
    /**
10
     * 密码
11
     */
12
    @NotBlank(message = "密码不能为空")
13
    private String password;
14

15
    /**
16
     * 邮箱验证码
17
     */
18
    @NotBlank(message = "验证码不能为空")
19
    private String code;
20

21
    /**
22
     * 登录类型（password-密码登录，email-邮箱登录，qq-QQ登录，wechat-微信登录，github-GitHub登录）
23
     */
24
    @NotBlank(message = "登录类型不能为空")
25
    private String loginType;
26

27
    /**
28
     * 邮箱地址（邮箱登录时必填）
29
     */
30
    @Email(message = "邮箱格式不正确")
31
    private String email;
32

33
    /**
34
     * 邮箱验证码（邮箱登录时必填）
35
     */
36
    @NotBlank(message = "邮箱验证码不能为空")
37
    private String emailCode;
38

39
    // 第三方授权码（省略掉）
40
}

1
private LoginResponse passwordLogin(LoginRequest request) {
2
    // ... 参数获取 ...
3

4
    // 1. 远程调用获取用户信息
5
    R<LoginUser> userResult = remoteUserService.getUserInfo(username, CommonConstants.REQUEST_SOURCE_INNER);
6
    if (userResult == null || !userResult.isSuccess()) {
7
        throw new AuthException("用户不存在");
8
    }
9
    LoginUser loginUser = userResult.getData();
10

11
    // ... 邮箱验证码校验 ...
12

13
    // 2. RSA 密码解密
14
    String decryptedPassword = encryptService.decrypt(password);
15

16
    // 3. BCrypt 密码比对
17
    SysUserApi user = loginUser.getSysUser();
18
    if (!SecurityUtils.matchesPassword(decryptedPassword, user.getPassword())) {
19
        throw new AuthException("用户名或密码错误");
20
    }
21

22
    // ... 状态检查与 Token 生成 ...
23
    return generateToken(loginUser);
24
}

1
@Target(ElementType.METHOD)
2
@Retention(RetentionPolicy.RUNTIME)
3
public @interface RateLimit {
4
    /** 资源名称 (Sentinel用) */
5
    String resource() default "";
6

7
    /** 业务Key (Redis用，支持SpEL表达式，如 "#user.id") */
8
    String key() default "";
9

10
    /** 限流提示信息 */
11
    String message() default "请求过于频繁，请稍后再试";
12

13
    /** 限流阈值 */
14
    double count() default 5;
15

16
    /** 限流时间单位 */
17
    TimeUnit timeUnit() default TimeUnit.SECONDS;
18
}

1
@Around("@annotation(rateLimit)")
2
public Object aroundRateLimit(ProceedingJoinPoint point, RateLimit rateLimit) throws Throwable {
3
    String key = rateLimit.key();
4
    // 策略选择：配置了业务Key且Redis可用 -> Redis限流；否则 -> Sentinel限流
5
    if (StringUtils.isNotBlank(key) && redisService != null) {
6
        return handleRedisRateLimit(point, rateLimit);
7
    }
8
    return handleSentinelRateLimit(point, rateLimit);
9
}
10

11
// Redis 分布式限流实现
12
private Object handleRedisRateLimit(ProceedingJoinPoint point, RateLimit rateLimit) throws Throwable {
13
    String resourceName = getResourceName(point, rateLimit.resource());
14
    // 解析 SpEL 表达式获取业务值 (如用户名)
15
    String businessKey = parseSpel(rateLimit.key(), point);
16

17
    // 生成 Redis Key: rate_limit:auth:login:zhangsan
18
    String redisKey = "rate_limit:" + resourceName + ":" + businessKey;
19

20
    // 原子递增并校验
21
    Long count = redisService.increment(redisKey, 1);
22
    if (count != null && count == 1) {
23
        // 首次访问设置过期时间
24
        redisService.expire(redisKey, rateLimit.timeUnit().toSeconds(1), TimeUnit.SECONDS);
25
    }
26

27
    if (count != null && count > rateLimit.count()) {
28
         throw new RateLimitException(rateLimit.message());
29
    }
30
    return point.proceed();
31
}