bsm-infra/full
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade dependencies and secure passwords

Browse Source
This commit is contained in:
yanweidong
2026-08-10 12:53:23 +08:00
parent 1a1fa521c0
commit 581a503883
53 changed files with 298 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
module/ec/market/go.mod
View File

@@ -12,10 +12,12 @@ tool (
)
require (
git.apinb.com/bsm-sdk/core v0.2.0
git.apinb.com/bsm-sdk/core v0.2.1
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
github.com/patrickmn/go-cache v2.1.0+incompatible
go.etcd.io/etcd/client/pkg/v3 v3.7.1
go.etcd.io/etcd/client/v3 v3.7.1
golang.org/x/crypto v0.54.0
google.golang.org/grpc v1.83.0
google.golang.org/protobuf v1.36.11
gorm.io/driver/mysql v1.6.0

6
module/ec/market/go.sum
View File

@@ -1,5 +1,7 @@
filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
git.apinb.com/bsm-sdk/core v0.2.1 h1:1kpbdij3qOlf1DmKTq3coIXSgLth5iJHJ3LvVZnjaXM=
git.apinb.com/bsm-sdk/core v0.2.1/go.mod h1:BL/aGHujCWdxrKZrWaiebmLx69J0OrTVv5XfugbbyhE=
git.apinb.com/bsm-tools/protoc-gen-slc v0.0.13 h1:RGg2R2kHz6IAD7scH6So2FlZYctFUDxqWR8i/+fMfOU=
git.apinb.com/bsm-tools/protoc-gen-slc v0.0.13/go.mod h1:NpJaupVAxmyBleRMAug4mGS6BQV2E32rtuiqQzj1b+A=
git.apinb.com/bsm-tools/protoc-gen-ts v0.0.2 h1:T9C1kY6iIHl5cZ7xyNgV2xlPNWxXmaWfTbD8AzpBB9M=
@@ -55,6 +57,8 @@ github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o
github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
github.com/oklog/ulid/v2 v2.1.2 h1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=
github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
@@ -100,6 +104,8 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=

9
module/ec/market/internal/logic/agency/create.go
View File

@@ -7,6 +7,7 @@ import (
"bsm/full/module/ec/market/internal/impl"
"bsm/full/module/ec/market/internal/models"
"bsm/full/module/ec/market/internal/password"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -23,15 +24,17 @@ func Create(ctx context.Context, in *pb.MarketAgenctyItem) (reply *pb.IdentitySt
if in.GetName() == "" || in.GetAccount() == "" || in.GetPassword() == "" {
return nil, errcode.ErrInvalidArgument
}
salt := utils.RandomString(8)
passwordHash, err := password.Hash(in.GetPassword())
if err != nil {
return nil, err
}
mktModel := &models.MarketAgency{
Std_IICUDS: types.Std_IICUDS{Identity: utils.ULID(), Status: 1},
Name: in.GetName(),
Avatar: in.GetAvatar(),
Account: in.GetAccount(),
Phone: in.GetPhone(),
Password: utils.Md5(in.Password + salt),
Salt: salt,
Password: passwordHash,
OrgName: in.GetOrgName(),
OrgPhoto: in.GetOrgPhoto(),
IDName: in.GetIdName(),

4
module/ec/market/internal/logic/agency/login.go
View File

@@ -7,11 +7,11 @@ import (
"bsm/full/module/ec/market/internal/impl"
"bsm/full/module/ec/market/internal/models"
"bsm/full/module/ec/market/internal/password"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/crypto/encipher"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/utils"
"gorm.io/gorm"
)
@@ -31,7 +31,7 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
return nil, errcode.ErrDB
}
// 密码校验
if marketData.Password != utils.Md5(in.Password+marketData.Salt) {
if !password.Verify(marketData.Password, in.Password) {
return nil, errcode.ErrPassword
}

39
module/ec/market/internal/logic/agency/set_password.go
View File

@@ -2,53 +2,51 @@ package agency
import (
"context"
"errors"
"fmt"
"log"
"time"
"bsm/full/module/ec/market/internal/impl"
"bsm/full/module/ec/market/internal/models"
"bsm/full/module/ec/market/internal/password"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
"git.apinb.com/bsm-sdk/core/utils"
)
// 更新密码
// SetPassword updates an agency password.
func SetPassword(ctx context.Context, in *pb.SetPasswordRequest) (reply *pb.IdentityStatusReply, err error) {
var (
identity string
)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
identity = auth.Identity
fmt.Println("identity:", auth.Identity)
identity := auth.Identity
if in.GetIdentity() != "" {
identity = in.GetIdentity()
}
if in.GetOldPassword() == "" || in.GetNewPassword() == "" {
return nil, errcode.ErrInvalidArgument
}
// 获取当前角色数据
mktModel := models.MarketAgency{}
if err := impl.DBService.Where("identity = ?", identity).First(&mktModel).Error; err != nil {
log.Println("获取代理商数据失败：", err)
var agency models.MarketAgency
if err := impl.DBService.Where("identity = ?", identity).First(&agency).Error; err != nil {
log.Println("get agency failed:", err)
return nil, err
}
// 判断旧密码是否匹配
if utils.Md5(in.GetOldPassword()+mktModel.Salt) != mktModel.Password {
return nil, errors.New("旧密码错误")
if !password.Verify(agency.Password, in.GetOldPassword()) {
return nil, errcode.ErrPassword
}
// 设置新密码
newPwd := utils.Md5(in.GetNewPassword() + mktModel.Salt)
if err := impl.DBService.Model(&mktModel).Update("password", newPwd).Error; err != nil {
log.Println("更新密码失败：", err)
newPassword, err := password.Hash(in.GetNewPassword())
if err != nil {
return nil, fmt.Errorf("hash password: %w", err)
}
if err := impl.DBService.Model(&agency).Updates(map[string]any{
"password": newPassword,
"salt": "",
}).Error; err != nil {
log.Println("update password failed:", err)
return nil, err
}
@@ -58,5 +56,4 @@ func SetPassword(ctx context.Context, in *pb.SetPasswordRequest) (reply *pb.Iden
Identity: identity,
Timeseq: time.Now().UnixMilli(),
}, nil
}

9
module/ec/market/internal/logic/supply/create.go
View File

@@ -6,6 +6,7 @@ import (
"bsm/full/module/ec/market/internal/impl"
"bsm/full/module/ec/market/internal/models"
"bsm/full/module/ec/market/internal/password"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -23,15 +24,17 @@ func Create(ctx context.Context, in *pb.MarketSupplyItem) (reply *pb.IdentitySta
if in.GetName() == "" {
return nil, errcode.ErrInvalidArgument
}
salt := utils.RandomString(8)
passwordHash, err := password.Hash(in.GetPassword())
if err != nil {
return nil, err
}
mktModel := &models.MarketSupply{
Std_IICUDS: types.Std_IICUDS{Identity: utils.ULID(), Status: 1},
Name: in.GetName(),
// Avatar: in.GetAvatar(),
Account: in.GetAccount(),
Phone: in.GetPhone(),
Password: utils.Md5(in.Password + salt),
Salt: salt,
Password: passwordHash,
OrgName: in.GetOrgName(),
Remark: in.GetRemark(),
CommissionRate: in.GetCommissionRate(),

12
module/ec/market/internal/password/password.go Normal file
View File

@@ -0,0 +1,12 @@
package password
import "golang.org/x/crypto/bcrypt"
func Hash(plain string) (string, error) {
hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
return string(hash), err
}
func Verify(hash, plain string) bool {
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
}

13
module/ec/market/internal/password/password_test.go Normal file
View File

@@ -0,0 +1,13 @@
package password
import "testing"
func TestHashAndVerify(t *testing.T) {
hash, err := Hash("correct horse battery staple")
if err != nil {
t.Fatal(err)
}
if !Verify(hash, "correct horse battery staple") || Verify(hash, "wrong") {
t.Fatal("bcrypt verification failed")
}
}