fix version 1

module/base/passport/internal/logic/forget/reset.go

@@ -11,6 +11,7 @@ import (
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/utils"
+	"golang.org/x/crypto/bcrypt"
 )
 
 // 重罢密码
@@ -19,6 +20,13 @@ func Reset(ctx context.Context, in *pb.ForgetResetRequest) (reply *pb.StatusRepl
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 必须先通过 Verify 写入一次性重置票据，否则拒绝改密
+	resetKey := vars.ForgetResetTokenPrefix + in.Identity
+	if err := impl.RedisService.Client.Get(impl.RedisService.Ctx, resetKey).Err(); err != nil {
+		printer.Error("Forget reset token not found by identity %v error:%v", in.Identity, err)
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	pa, err := models.GetPassportAccountByField("identity", in.Identity)
 	if err != nil {
 		return nil, err
@@ -28,12 +36,26 @@ func Reset(ctx context.Context, in *pb.ForgetResetRequest) (reply *pb.StatusRepl
 		return nil, errcode.ErrPermissionDenied
 	}
 
-	err = impl.DBService.Model(&models.PassportAccount{}).Where("identity = ? ", pa.Identity).Update("password", utils.Md5(in.Password)).Error
+	salt := utils.UUID()
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(in.Password+salt), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, errcode.ErrInternal
+	}
+
+	err = impl.DBService.Model(&models.PassportAccount{}).Where("identity = ? ", pa.Identity).Updates(map[string]any{
+		"password": string(hashedPassword),
+		"salt":     salt,
+	}).Error
 	if err != nil {
 		printer.Error("Update passport account password by identity %+v error:%v", in.Identity, err)
 		return nil, errcode.ErrDB
 	}
 
+	// 改密成功后删除票据（一次性，防重放）
+	if err := impl.RedisService.Client.Del(impl.RedisService.Ctx, resetKey).Err(); err != nil {
+		printer.Error("Del forget reset token by identity %v error:%v", in.Identity, err)
+	}
+
 	return &pb.StatusReply{
 		Message: "OK",
 		Timeseq: time.Now().UnixMilli(),