fix version 1

2026-09-22 21:15:34 +08:00
parent 9f86366638
commit d63d7e8b3a
277 changed files with 9959 additions and 1514 deletions
--- a/module/base/sender/internal/logic/sms/const.go
+++ b/module/base/sender/internal/logic/sms/const.go
@@ -5,4 +5,8 @@ const (
 	KeyPrefix         = "/SMS/Code/"
 	BlackListCacheKey = "/SMS/BlackList/"
 	LimitCacheKey     = "/SMS/LimitCacheKey/"
+	// VerifyFailCacheKey 验证码连续校验失败次数键前缀
+	VerifyFailCacheKey = "/SMS/VerifyFail/"
+	// MaxVerifyFail 同一手机号允许的最大连续校验失败次数
+	MaxVerifyFail = 5
 )
--- a/module/base/sender/internal/logic/sms/send.go
+++ b/module/base/sender/internal/logic/sms/send.go
@@ -26,6 +26,11 @@ import (
 func Send(ctx context.Context, in *pb.SmsSendRequest) (reply *pb.SmsReply, err error) {
 	var smsCode string

+	// 验证码配置缺失时返回明确错误，避免运行期空指针 panic
+	if config.Spec.Code == nil {
+		return nil, excode.ErrCodeConfig
+	}
+
 	if in.GetPhone() == "" || !VerifyPhone(in.GetPhone()) {
 		return nil, excode.ErrPhone
 	}
@@ -33,25 +38,27 @@ func Send(ctx context.Context, in *pb.SmsSendRequest) (reply *pb.SmsReply, err e
 		return nil, excode.ErrTemplate
 	}

-	// 是否验证黑名单
-	if impl.RedisService.Client.SIsMember(impl.RedisService.Ctx, BlackListCacheKey, in.GetPhone()).Val() {
+	// 是否验证黑名单：Redis 黑名单集合与配置黑名单任一命中即拦截
+	if impl.RedisService.Client.SIsMember(impl.RedisService.Ctx, BlackListCacheKey, in.GetPhone()).Val() ||
+		inBlackListConf(in.GetPhone()) {
 		return nil, excode.ErrInBlackList
 	}

 	// 每天限制
 	limitKey := LimitCacheKey + time.Now().Format(FormatDay) + in.GetPhone()

-	// check limit
+	// check limit：发送前校验，达到上限即拒绝
 	twice, err := impl.RedisService.Client.Get(impl.RedisService.Ctx, limitKey).Int()
 	if err != nil && !errors.Is(err, redis.Nil) {
 		return nil, errcode.ErrRedis
 	}
-	if twice > config.Spec.Code.MaxSentLimit {
+	if config.Spec.Code.MaxSentLimit > 0 && twice >= config.Spec.Code.MaxSentLimit {
 		return nil, excode.ErrSentLimit
 	}

 	// 从redis获取验证码，如果没有重新生成
 	key := KeyPrefix + in.GetPhone()
+	expire := time.Second * time.Duration(config.Spec.Code.Expire)
 	if in.GetIsGenCode() {
 		//验证码最少4位，最大10位。
 		if config.Spec.Code.Length < 4 || config.Spec.Code.Length > 10 {
@@ -59,20 +66,40 @@ func Send(ctx context.Context, in *pb.SmsSendRequest) (reply *pb.SmsReply, err e
 		}

 		// 新生成验证码
-		smsCode = GenValidateCode(config.Spec.Code.Length)
+		newCode := GenValidateCode(config.Spec.Code.Length)
 		//sms code write to redis
-		expire := time.Second * time.Duration(config.Spec.Code.Expire)
-		impl.RedisService.Client.SetNX(impl.RedisService.Ctx, key, smsCode, expire)
-	} else {
-		// 获取验证码
-		if code, ok := in.Paramters["code"]; ok {
-			smsCode = code
-		} else {
-			return nil, excode.ErrCode
+		ok, err := impl.RedisService.Client.SetNX(impl.RedisService.Ctx, key, newCode, expire).Result()
+		if err != nil {
+			return nil, errcode.ErrRedis
 		}
+		if ok {
+			smsCode = newCode
+			// 新码写入成功，重置该号码的校验失败计数
+			impl.RedisService.Client.Del(impl.RedisService.Ctx, VerifyFailCacheKey+in.GetPhone())
+		} else {
+			// 键已存在：不覆盖Redis中的旧码，必须发送实际保存的验证码，否则用户收码后校验不过
+			exist, err := impl.RedisService.Client.Get(impl.RedisService.Ctx, key).Result()
+			if err != nil {
+				return nil, errcode.ErrRedis
+			}
+			smsCode = exist
+		}
+	} else {
+		// 不生成新码时仅允许复用Redis中已有的验证码，禁止调用方自行指定验证码内容
+		exist, err := impl.RedisService.Client.Get(impl.RedisService.Ctx, key).Result()
+		if err != nil {
+			if errors.Is(err, redis.Nil) {
+				return nil, excode.ErrExpired
+			}
+			return nil, errcode.ErrRedis
+		}
+		smsCode = exist
 	}

 	var result map[string]interface{}
+	if impl.Provider == nil {
+		return nil, excode.ErrProviderIsNil
+	}
 	switch strings.ToLower(in.GetProvider()) {
 	case "aliyun":
 		if impl.Provider.Aliyun == nil {
@@ -92,6 +119,17 @@ func Send(ctx context.Context, in *pb.SmsSendRequest) (reply *pb.SmsReply, err e
 		return nil, err
 	}

+	// 未返回发送结果的实现不能视为发送成功
+	if result == nil {
+		return nil, excode.ErrNotImplement
+	}
+
+	// 发送成功后累计当日发送量，并在首次计数时把过期时间设到当天结束
+	count := impl.RedisService.Client.Incr(impl.RedisService.Ctx, limitKey).Val()
+	if count == 1 {
+		impl.RedisService.Client.ExpireAt(impl.RedisService.Ctx, limitKey, endOfDay(time.Now()))
+	}
+
 	jsonBytes, _ := json.Marshal(result)
 	fmt.Println("短信发送结果:", string(jsonBytes))
 	return &pb.SmsReply{
@@ -99,12 +137,31 @@ func Send(ctx context.Context, in *pb.SmsSendRequest) (reply *pb.SmsReply, err e
 	}, nil
 }

+// inBlackListConf 判断号码是否命中配置中的短信黑名单
+func inBlackListConf(phone string) bool {
+	for _, v := range config.Spec.Code.BlackListFilter {
+		if v == phone {
+			return true
+		}
+	}
+	return false
+}
+
+// endOfDay 返回当天23:59:59，用于设置日发送量计数键的过期时间
+func endOfDay(t time.Time) time.Time {
+	return time.Date(t.Year(), t.Month(), t.Day(), 23, 59, 59, 0, t.Location())
+}
+
 func AliyunSender(args *pb.SmsSendRequest, code string) (map[string]any, error) {
 	// 构建发送参数
 	var templateParam = map[string]any{
 		"code": code,
 	}
 	for key, val := range args.Paramters {
+		// 验证码字段由服务端生成或从Redis读取，禁止调用方覆盖
+		if key == "code" {
+			continue
+		}
 		templateParam[key] = val
 	}
 	jsonBytes, _ := json.Marshal(templateParam)
@@ -149,7 +206,9 @@ func AliyunSender(args *pb.SmsSendRequest, code string) (map[string]any, error)
 }

 func TencentSender(args *pb.SmsSendRequest) (map[string]any, error) {
-	return nil, nil
+	// 腾讯云短信需要账号级 SmsSdkAppId 与有序的模板参数，现有 proto/config 均无法提供，
+	// 因此显式返回未实现错误，绝不能返回 nil,nil 让调用方误判为发送成功。
+	return nil, excode.ErrNotImplement
 }

 func VerifyPhone(phone string) bool {
--- a/module/base/sender/internal/logic/sms/verify.go
+++ b/module/base/sender/internal/logic/sms/verify.go
@@ -2,6 +2,7 @@ package sms

 import (
 	"context"
+	"time"

 	"bsm/full/module/base/sender/internal/excode"
 	"bsm/full/module/base/sender/internal/impl"
@@ -26,13 +27,30 @@ func Verify(ctx context.Context, in *pb.SmsVerifyRequest) (reply *pb.SmsReply, e
 	}
 	//check code
 	if code == in.Code {
+		// 校验成功：删除验证码与失败计数，验证码一次性使用，避免重放
+		failKey := VerifyFailCacheKey + in.GetPhone()
+		impl.RedisService.Client.Del(impl.RedisService.Ctx, key)
+		impl.RedisService.Client.Del(impl.RedisService.Ctx, failKey)
 		return &pb.SmsReply{
 			Reply: "true",
 		}, nil
 	}

-	//verify pass ; delete the requestId
-	impl.RedisService.Client.Del(impl.RedisService.Ctx, key)
+	// 校验失败：累计连续失败次数，达到上限后验证码作废，避免暴力枚举
+	failKey := VerifyFailCacheKey + in.GetPhone()
+	count := impl.RedisService.Client.Incr(impl.RedisService.Ctx, failKey).Val()
+	if count == 1 {
+		ttl := impl.RedisService.Client.TTL(impl.RedisService.Ctx, key).Val()
+		if ttl <= 0 {
+			ttl = 300 * time.Second
+		}
+		impl.RedisService.Client.Expire(impl.RedisService.Ctx, failKey, ttl)
+	}
+	if count >= MaxVerifyFail {
+		impl.RedisService.Client.Del(impl.RedisService.Ctx, key)
+		impl.RedisService.Client.Del(impl.RedisService.Ctx, failKey)
+		return nil, excode.ErrCodeVerifyTooMany
+	}

 	return &pb.SmsReply{
 		Reply: "false",