bsm-infra/full
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade dependencies and secure passwords

Browse Source
This commit is contained in:
yanweidong
2026-08-10 12:53:23 +08:00
parent 1a1fa521c0
commit 581a503883
53 changed files with 298 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
module/ec/mall/go.mod
View File

@@ -12,10 +12,11 @@ tool (
)
require (
git.apinb.com/bsm-sdk/core v0.2.0
git.apinb.com/bsm-sdk/core v0.2.1
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
github.com/patrickmn/go-cache v2.1.0+incompatible
go.etcd.io/etcd/client/v3 v3.7.1
golang.org/x/crypto v0.54.0
google.golang.org/grpc v1.83.0
google.golang.org/protobuf v1.36.11
gorm.io/gorm v1.31.2

4
module/ec/mall/go.sum
View File

@@ -1,5 +1,7 @@
filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
git.apinb.com/bsm-sdk/core v0.2.1 h1:1kpbdij3qOlf1DmKTq3coIXSgLth5iJHJ3LvVZnjaXM=
git.apinb.com/bsm-sdk/core v0.2.1/go.mod h1:BL/aGHujCWdxrKZrWaiebmLx69J0OrTVv5XfugbbyhE=
git.apinb.com/bsm-tools/protoc-gen-slc v0.0.13 h1:RGg2R2kHz6IAD7scH6So2FlZYctFUDxqWR8i/+fMfOU=
git.apinb.com/bsm-tools/protoc-gen-slc v0.0.13/go.mod h1:NpJaupVAxmyBleRMAug4mGS6BQV2E32rtuiqQzj1b+A=
git.apinb.com/bsm-tools/protoc-gen-ts v0.0.2 h1:T9C1kY6iIHl5cZ7xyNgV2xlPNWxXmaWfTbD8AzpBB9M=
@@ -102,6 +104,8 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=

10
module/ec/mall/internal/logic/staff/create.go
View File

@@ -6,7 +6,9 @@ import (
"bsm/full/module/ec/mall/internal/impl"
"bsm/full/module/ec/mall/internal/models"
"bsm/full/module/ec/mall/internal/password"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
@@ -26,16 +28,18 @@ func Create(ctx context.Context, in *pb.StaffItem) (reply *pb.IdentityStatusRepl
return nil, errcode.ErrInvalidArgument
}
salt := utils.RandomString(8)
passwordHash, err := password.Hash(in.GetPassword())
if err != nil {
return nil, err
}
data := models.MallStaff{
Name: in.Name,
Account: in.Account,
Password: utils.Md5(in.Password + salt),
Password: passwordHash,
Profile: in.Profile,
Phone: in.Phone,
Email: in.Email,
Avatar: in.Avatar,
Salt: salt,
Role: "staff",
Std_IICUDS: types.Std_IICUDS{Status: 1},
}

5
module/ec/mall/internal/logic/staff/login.go
View File

@@ -9,11 +9,12 @@ import (
"bsm/full/module/ec/mall/internal/excode"
"bsm/full/module/ec/mall/internal/impl"
"bsm/full/module/ec/mall/internal/models"
"bsm/full/module/ec/mall/internal/password"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/crypto/encipher"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/utils"
"git.apinb.com/bsm-sdk/core/vars"
"gorm.io/gorm"
)
@@ -37,7 +38,7 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
return nil, errcode.ErrDB
}
// 密码校验 - 使用MD5加盐验证
if record.Password != utils.Md5(in.Password+record.Salt) {
if !password.Verify(record.Password, in.Password) {
return nil, errcode.ErrPassword
}

19
module/ec/mall/internal/logic/staff/set_password.go
View File

@@ -6,28 +6,32 @@ import (
"bsm/full/module/ec/mall/internal/impl"
"bsm/full/module/ec/mall/internal/models"
"bsm/full/module/ec/mall/internal/password"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"git.apinb.com/bsm-sdk/core/utils"
)
// SetPassword 设置账号密码
// SetPassword sets the authenticated staff password.
func SetPassword(ctx context.Context, in *pb.SetAccountRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
if in.Password == "" || in.Password != in.PasswordConfirmed {
return nil, errcode.ErrInvalidArgument
}
salt := utils.RandomString(8)
pwd := utils.Md5(in.Password + salt)
err = impl.DBService.Where("id = ?", auth.ID).Updates(&models.MallStaff{Salt: salt, Password: pwd}).Error
passwordHash, err := password.Hash(in.Password)
if err != nil {
return nil, err
}
err = impl.DBService.Where("id = ?", auth.ID).Updates(&models.MallStaff{
Salt: "",
Password: passwordHash,
}).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
@@ -38,5 +42,4 @@ func SetPassword(ctx context.Context, in *pb.SetAccountRequest) (reply *pb.Ident
Message: "OK",
Timeseq: time.Now().UnixMilli(),
}, nil
}

10
module/ec/mall/internal/models/query.go
View File

@@ -2,6 +2,8 @@ package models
import (
"bsm/full/module/ec/mall/internal/impl"
"bsm/full/module/ec/mall/internal/password"
"git.apinb.com/bsm-sdk/core/types"
"git.apinb.com/bsm-sdk/core/utils"
"gorm.io/gorm"
@@ -53,12 +55,14 @@ func CreateStore(title, domain string) {
// 创建默认目录
err = impl.DBService.Model(&MallStaff{}).Where("store_identity=? and account=?", store.Identity, "root").Count(&cnt).Error
if cnt == 0 || err != nil {
salt := utils.RandomString(8)
passwordHash, hashErr := password.Hash("123456")
if hashErr != nil {
return
}
root := &MallStaff{
Std_Store: Std_Store{Store_ID: store.ID, Store_Identity: store.Identity},
Account: "root",
Password: utils.Md5("123456" + salt),
Salt: salt,
Password: passwordHash,
Role: "Mall_Admin",
Std_IICUDS: types.Std_IICUDS{Identity: utils.UUID(), Status: 1},
}

12
module/ec/mall/internal/password/password.go Normal file
View File

@@ -0,0 +1,12 @@
package password
import "golang.org/x/crypto/bcrypt"
func Hash(plain string) (string, error) {
hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
return string(hash), err
}
func Verify(hash, plain string) bool {
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
}

13
module/ec/mall/internal/password/password_test.go Normal file
View File

@@ -0,0 +1,13 @@
package password
import "testing"
func TestHashAndVerify(t *testing.T) {
hash, err := Hash("correct horse battery staple")
if err != nil {
t.Fatal(err)
}
if !Verify(hash, "correct horse battery staple") || Verify(hash, "wrong") {
t.Fatal("bcrypt verification failed")
}
}