chore: upgrade dependencies and secure passwords

module/ec/mall/internal/logic/staff/create.go

@@ -6,7 +6,9 @@ import (
 
 	"bsm/full/module/ec/mall/internal/impl"
 	"bsm/full/module/ec/mall/internal/models"
+	"bsm/full/module/ec/mall/internal/password"
 	pb "bsm/full/module/ec/mall/pb"
+
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/service"
@@ -26,16 +28,18 @@ func Create(ctx context.Context, in *pb.StaffItem) (reply *pb.IdentityStatusRepl
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	salt := utils.RandomString(8)
+	passwordHash, err := password.Hash(in.GetPassword())
+	if err != nil {
+		return nil, err
+	}
 	data := models.MallStaff{
 		Name:       in.Name,
 		Account:    in.Account,
-		Password:   utils.Md5(in.Password + salt),
+		Password:   passwordHash,
 		Profile:    in.Profile,
 		Phone:      in.Phone,
 		Email:      in.Email,
 		Avatar:     in.Avatar,
-		Salt:       salt,
 		Role:       "staff",
 		Std_IICUDS: types.Std_IICUDS{Status: 1},
 	}

module/ec/mall/internal/logic/staff/login.go

@@ -9,11 +9,12 @@ import (
 	"bsm/full/module/ec/mall/internal/excode"
 	"bsm/full/module/ec/mall/internal/impl"
 	"bsm/full/module/ec/mall/internal/models"
+	"bsm/full/module/ec/mall/internal/password"
 	pb "bsm/full/module/ec/mall/pb"
+
 	"git.apinb.com/bsm-sdk/core/crypto/encipher"
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
-	"git.apinb.com/bsm-sdk/core/utils"
 	"git.apinb.com/bsm-sdk/core/vars"
 	"gorm.io/gorm"
 )
@@ -37,7 +38,7 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
 			return nil, errcode.ErrDB
 		}
 		// 密码校验 - 使用MD5加盐验证
-		if record.Password != utils.Md5(in.Password+record.Salt) {
+		if !password.Verify(record.Password, in.Password) {
 			return nil, errcode.ErrPassword
 		}
 

module/ec/mall/internal/logic/staff/set_password.go

@@ -6,28 +6,32 @@ import (
 
 	"bsm/full/module/ec/mall/internal/impl"
 	"bsm/full/module/ec/mall/internal/models"
+	"bsm/full/module/ec/mall/internal/password"
 	pb "bsm/full/module/ec/mall/pb"
+
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/service"
-	"git.apinb.com/bsm-sdk/core/utils"
 )
 
-// SetPassword 设置账号密码
+// SetPassword sets the authenticated staff password.
 func SetPassword(ctx context.Context, in *pb.SetAccountRequest) (reply *pb.IdentityStatusReply, err error) {
-	// parse authorization meta.
 	auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
 	if err != nil {
 		return nil, err
 	}
-
 	if in.Password == "" || in.Password != in.PasswordConfirmed {
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	salt := utils.RandomString(8)
-	pwd := utils.Md5(in.Password + salt)
-	err = impl.DBService.Where("id = ?", auth.ID).Updates(&models.MallStaff{Salt: salt, Password: pwd}).Error
+	passwordHash, err := password.Hash(in.Password)
+	if err != nil {
+		return nil, err
+	}
+	err = impl.DBService.Where("id = ?", auth.ID).Updates(&models.MallStaff{
+		Salt:     "",
+		Password: passwordHash,
+	}).Error
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB
@@ -38,5 +42,4 @@ func SetPassword(ctx context.Context, in *pb.SetAccountRequest) (reply *pb.Ident
 		Message: "OK",
 		Timeseq: time.Now().UnixMilli(),
 	}, nil
-
 }

module/ec/mall/internal/models/query.go

@@ -2,6 +2,8 @@ package models
 
 import (
 	"bsm/full/module/ec/mall/internal/impl"
+	"bsm/full/module/ec/mall/internal/password"
+
 	"git.apinb.com/bsm-sdk/core/types"
 	"git.apinb.com/bsm-sdk/core/utils"
 	"gorm.io/gorm"
@@ -53,12 +55,14 @@ func CreateStore(title, domain string) {
 	// 创建默认目录
 	err = impl.DBService.Model(&MallStaff{}).Where("store_identity=? and account=?", store.Identity, "root").Count(&cnt).Error
 	if cnt == 0 || err != nil {
-		salt := utils.RandomString(8)
+		passwordHash, hashErr := password.Hash("123456")
+		if hashErr != nil {
+			return
+		}
 		root := &MallStaff{
 			Std_Store:  Std_Store{Store_ID: store.ID, Store_Identity: store.Identity},
 			Account:    "root",
-			Password:   utils.Md5("123456" + salt),
-			Salt:       salt,
+			Password:   passwordHash,
 			Role:       "Mall_Admin",
 			Std_IICUDS: types.Std_IICUDS{Identity: utils.UUID(), Status: 1},
 		}

module/ec/mall/internal/password/password.go

@@ -0,0 +1,12 @@
+package password
+
+import "golang.org/x/crypto/bcrypt"
+
+func Hash(plain string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
+	return string(hash), err
+}
+
+func Verify(hash, plain string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
+}

module/ec/mall/internal/password/password_test.go

@@ -0,0 +1,13 @@
+package password
+
+import "testing"
+
+func TestHashAndVerify(t *testing.T) {
+	hash, err := Hash("correct horse battery staple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !Verify(hash, "correct horse battery staple") || Verify(hash, "wrong") {
+		t.Fatal("bcrypt verification failed")
+	}
+}