feat(api): add client app service endpoints

backend/api/internal/logic/client/staff/auth.go

@@ -0,0 +1,123 @@
+// Package staff 实现工作人员 App 的服务端业务接口。
+package staff
+
+import (
+	"strings"
+
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	clientcommon "git.apinb.com/heqiapp/platforms/backend/api/internal/logic/client/common"
+	base "git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
+)
+
+var supportedRoles = map[string]bool{"delivery": true, "installer": true, "operations": true}
+
+// Login 登录启用且角色受支持、资质有效的工作人员账户。
+func Login(ctx *gin.Context) {
+	var request struct {
+		Phone           string `json:"phone" binding:"required"`
+		Mode            string `json:"mode" binding:"required,oneof=password verification_code"`
+		Password        string `json:"password"`
+		Code            string `json:"code"`
+		RequestIdentity string `json:"request_identity"`
+	}
+	if ctx.ShouldBindJSON(&request) != nil || !clientcommon.ValidPhone(request.Phone) {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	var account models.StaffAccount
+	if impl.DBService.Where("phone = ? AND status = ?", strings.TrimSpace(request.Phone), base.StatusEnable).First(&account).Error != nil ||
+		!supportedRoles[account.RoleCode] {
+		infra.Response.Error(ctx, errcode.ErrPassword)
+		return
+	}
+	valid := request.Mode == "password" && bcrypt.CompareHashAndPassword([]byte(account.PasswordHash), []byte(request.Password)) == nil
+	if request.Mode == "verification_code" {
+		valid = clientcommon.VerifyCode("service_app", account.Phone, "login", request.RequestIdentity, request.Code)
+	}
+	if !valid {
+		infra.Response.Error(ctx, errcode.ErrPassword)
+		return
+	}
+	accessToken, err := clientcommon.IssueToken(account.Identity, "service_app", account.RoleCode, map[string]string{"phone": account.Phone})
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"access_token": accessToken, "token_type": "JWT", "identity": account.Identity, "role_code": account.RoleCode})
+}
+
+// Profile 返回工作人员岗位和归属。
+func Profile(ctx *gin.Context) {
+	account, ok := clientcommon.StaffAccount(ctx)
+	if !ok {
+		return
+	}
+	infra.Response.Success(ctx, gin.H{
+		"identity": account.Identity, "name": account.Name, "phone": account.Phone, "avatar": account.Avatar,
+		"role_code": account.RoleCode, "work_status": account.WorkStatus,
+	})
+}
+
+// ChangePassword 修改当前工作人员登录密码。
+func ChangePassword(ctx *gin.Context) {
+	account, ok := clientcommon.StaffAccount(ctx)
+	if !ok {
+		return
+	}
+	var request struct {
+		CurrentPassword string `json:"current_password" binding:"required"`
+		NewPassword     string `json:"new_password" binding:"required"`
+	}
+	if ctx.ShouldBindJSON(&request) != nil || !base.IsValidAccountPassword(request.NewPassword) ||
+		bcrypt.CompareHashAndPassword([]byte(account.PasswordHash), []byte(request.CurrentPassword)) != nil {
+		infra.Response.Error(ctx, errcode.ErrPassword)
+		return
+	}
+	hash, err := base.PasswordHash(request.NewPassword)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	if err := impl.DBService.Model(&account).Update("password_hash", hash).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"changed": true})
+}
+
+// ResetPassword 使用验证码重置工作人员登录密码，不开放注册。
+func ResetPassword(ctx *gin.Context) {
+	var request struct {
+		Phone           string `json:"phone" binding:"required"`
+		NewPassword     string `json:"new_password" binding:"required"`
+		Code            string `json:"code" binding:"required"`
+		RequestIdentity string `json:"request_identity" binding:"required"`
+	}
+	if ctx.ShouldBindJSON(&request) != nil || !base.IsValidAccountPassword(request.NewPassword) ||
+		!clientcommon.VerifyCode("service_app", request.Phone, "reset_login_password", request.RequestIdentity, request.Code) {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	hash, err := base.PasswordHash(request.NewPassword)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	result := impl.DBService.Model(&models.StaffAccount{}).
+		Where("phone = ? AND status = ?", strings.TrimSpace(request.Phone), base.StatusEnable).
+		Update("password_hash", hash)
+	if result.Error != nil {
+		infra.Response.Error(ctx, result.Error)
+		return
+	}
+	if result.RowsAffected != 1 {
+		infra.Response.Error(ctx, errcode.ErrRecordNotFound)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"changed": true})
+}