chore: upgrade dependencies and secure passwords

module/ec/market/internal/logic/agency/create.go

@@ -7,6 +7,7 @@ import (
 
 	"bsm/full/module/ec/market/internal/impl"
 	"bsm/full/module/ec/market/internal/models"
+	"bsm/full/module/ec/market/internal/password"
 	pb "bsm/full/module/ec/market/pb"
 
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -23,15 +24,17 @@ func Create(ctx context.Context, in *pb.MarketAgenctyItem) (reply *pb.IdentitySt
 	if in.GetName() == "" || in.GetAccount() == "" || in.GetPassword() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	salt := utils.RandomString(8)
+	passwordHash, err := password.Hash(in.GetPassword())
+	if err != nil {
+		return nil, err
+	}
 	mktModel := &models.MarketAgency{
 		Std_IICUDS:     types.Std_IICUDS{Identity: utils.ULID(), Status: 1},
 		Name:           in.GetName(),
 		Avatar:         in.GetAvatar(),
 		Account:        in.GetAccount(),
 		Phone:          in.GetPhone(),
-		Password:       utils.Md5(in.Password + salt),
-		Salt:           salt,
+		Password:       passwordHash,
 		OrgName:        in.GetOrgName(),
 		OrgPhoto:       in.GetOrgPhoto(),
 		IDName:         in.GetIdName(),

module/ec/market/internal/logic/agency/login.go

@@ -7,11 +7,11 @@ import (
 
 	"bsm/full/module/ec/market/internal/impl"
 	"bsm/full/module/ec/market/internal/models"
+	"bsm/full/module/ec/market/internal/password"
 	pb "bsm/full/module/ec/market/pb"
 
 	"git.apinb.com/bsm-sdk/core/crypto/encipher"
 	"git.apinb.com/bsm-sdk/core/errcode"
-	"git.apinb.com/bsm-sdk/core/utils"
 	"gorm.io/gorm"
 )
 
@@ -31,7 +31,7 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
 		return nil, errcode.ErrDB
 	}
 	// 密码校验
-	if marketData.Password != utils.Md5(in.Password+marketData.Salt) {
+	if !password.Verify(marketData.Password, in.Password) {
 		return nil, errcode.ErrPassword
 	}
 

module/ec/market/internal/logic/agency/set_password.go

@@ -2,53 +2,51 @@ package agency
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log"
 	"time"
 
 	"bsm/full/module/ec/market/internal/impl"
 	"bsm/full/module/ec/market/internal/models"
+	"bsm/full/module/ec/market/internal/password"
 	pb "bsm/full/module/ec/market/pb"
 
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/service"
-	"git.apinb.com/bsm-sdk/core/utils"
 )
 
-// 更新密码
+// SetPassword updates an agency password.
 func SetPassword(ctx context.Context, in *pb.SetPasswordRequest) (reply *pb.IdentityStatusReply, err error) {
-	var (
-		identity string
-	)
 	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
-	identity = auth.Identity
-	fmt.Println("identity:", auth.Identity)
+	identity := auth.Identity
 	if in.GetIdentity() != "" {
 		identity = in.GetIdentity()
 	}
 	if in.GetOldPassword() == "" || in.GetNewPassword() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	// 获取当前角色数据
-	mktModel := models.MarketAgency{}
-	if err := impl.DBService.Where("identity = ?", identity).First(&mktModel).Error; err != nil {
-		log.Println("获取代理商数据失败：", err)
+
+	var agency models.MarketAgency
+	if err := impl.DBService.Where("identity = ?", identity).First(&agency).Error; err != nil {
+		log.Println("get agency failed:", err)
 		return nil, err
 	}
-
-	// 判断旧密码是否匹配
-	if utils.Md5(in.GetOldPassword()+mktModel.Salt) != mktModel.Password {
-		return nil, errors.New("旧密码错误")
+	if !password.Verify(agency.Password, in.GetOldPassword()) {
+		return nil, errcode.ErrPassword
 	}
 
-	// 设置新密码
-	newPwd := utils.Md5(in.GetNewPassword() + mktModel.Salt)
-	if err := impl.DBService.Model(&mktModel).Update("password", newPwd).Error; err != nil {
-		log.Println("更新密码失败：", err)
+	newPassword, err := password.Hash(in.GetNewPassword())
+	if err != nil {
+		return nil, fmt.Errorf("hash password: %w", err)
+	}
+	if err := impl.DBService.Model(&agency).Updates(map[string]any{
+		"password": newPassword,
+		"salt":     "",
+	}).Error; err != nil {
+		log.Println("update password failed:", err)
 		return nil, err
 	}
 
@@ -58,5 +56,4 @@ func SetPassword(ctx context.Context, in *pb.SetPasswordRequest) (reply *pb.Iden
 		Identity: identity,
 		Timeseq:  time.Now().UnixMilli(),
 	}, nil
-
 }

module/ec/market/internal/logic/supply/create.go

@@ -6,6 +6,7 @@ import (
 
 	"bsm/full/module/ec/market/internal/impl"
 	"bsm/full/module/ec/market/internal/models"
+	"bsm/full/module/ec/market/internal/password"
 	pb "bsm/full/module/ec/market/pb"
 
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -23,15 +24,17 @@ func Create(ctx context.Context, in *pb.MarketSupplyItem) (reply *pb.IdentitySta
 	if in.GetName() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	salt := utils.RandomString(8)
+	passwordHash, err := password.Hash(in.GetPassword())
+	if err != nil {
+		return nil, err
+	}
 	mktModel := &models.MarketSupply{
 		Std_IICUDS: types.Std_IICUDS{Identity: utils.ULID(), Status: 1},
 		Name:       in.GetName(),
 		// Avatar:         in.GetAvatar(),
 		Account:        in.GetAccount(),
 		Phone:          in.GetPhone(),
-		Password:       utils.Md5(in.Password + salt),
-		Salt:           salt,
+		Password:       passwordHash,
 		OrgName:        in.GetOrgName(),
 		Remark:         in.GetRemark(),
 		CommissionRate: in.GetCommissionRate(),

module/ec/market/internal/password/password.go

@@ -0,0 +1,12 @@
+package password
+
+import "golang.org/x/crypto/bcrypt"
+
+func Hash(plain string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
+	return string(hash), err
+}
+
+func Verify(hash, plain string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
+}

module/ec/market/internal/password/password_test.go

@@ -0,0 +1,13 @@
+package password
+
+import "testing"
+
+func TestHashAndVerify(t *testing.T) {
+	hash, err := Hash("correct horse battery staple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !Verify(hash, "correct horse battery staple") || Verify(hash, "wrong") {
+		t.Fatal("bcrypt verification failed")
+	}
+}