99 lines
2.4 KiB
Go
99 lines
2.4 KiB
Go
package usecase
|
||
|
||
import (
|
||
"crypto/rand"
|
||
"math/big"
|
||
"unicode"
|
||
|
||
"apps/backend/internal/module/member/domain"
|
||
|
||
"golang.org/x/crypto/bcrypt"
|
||
)
|
||
|
||
// ValidatePasswordPolicy：≥12、含大寫、小寫、數字、符號。
|
||
// 規則與 apps/web/src/lib/passwordPolicy.ts 一致；文案見 domain.PasswordPolicyEN/ZH。
|
||
func ValidatePasswordPolicy(password string) error {
|
||
if password == "" || len([]rune(password)) < domain.PasswordMinLen {
|
||
return domain.ErrWeakPassword
|
||
}
|
||
var upper, lower, digit, symbol bool
|
||
for _, r := range password {
|
||
switch {
|
||
case unicode.IsUpper(r):
|
||
upper = true
|
||
case unicode.IsLower(r):
|
||
lower = true
|
||
case unicode.IsDigit(r):
|
||
digit = true
|
||
case unicode.IsPunct(r) || unicode.IsSymbol(r):
|
||
symbol = true
|
||
default:
|
||
// 空白等非字母數字也算符號類
|
||
if !unicode.IsLetter(r) && !unicode.IsDigit(r) {
|
||
symbol = true
|
||
}
|
||
}
|
||
}
|
||
if !upper || !lower || !digit || !symbol {
|
||
return domain.ErrWeakPassword
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// HashPassword validates policy then bcrypt.
|
||
func HashPassword(password string, cost int) (string, error) {
|
||
if err := ValidatePasswordPolicy(password); err != nil {
|
||
return "", err
|
||
}
|
||
if cost < bcrypt.MinCost {
|
||
cost = bcrypt.DefaultCost
|
||
}
|
||
bytes, err := bcrypt.GenerateFromPassword([]byte(password), cost)
|
||
return string(bytes), err
|
||
}
|
||
|
||
func CheckPasswordHash(password, hash string) bool {
|
||
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
|
||
}
|
||
|
||
func GetHashingCost(hashedPassword []byte) int {
|
||
cost, _ := bcrypt.Cost(hashedPassword)
|
||
return cost
|
||
}
|
||
|
||
// GenerateTempPassword 產生符合政策的臨時密碼（16 字元）。
|
||
func GenerateTempPassword() string {
|
||
const (
|
||
lower = "abcdefghijkmnopqrstuvwxyz"
|
||
upper = "ABCDEFGHJKLMNPQRSTUVWXYZ"
|
||
digits = "23456789"
|
||
symbols = "!@#$%^&*+-="
|
||
all = lower + upper + digits + symbols
|
||
)
|
||
pick := func(set string) byte {
|
||
n, err := rand.Int(rand.Reader, big.NewInt(int64(len(set))))
|
||
if err != nil {
|
||
return set[0]
|
||
}
|
||
return set[n.Int64()]
|
||
}
|
||
// 保證四類各至少 1
|
||
out := []byte{
|
||
pick(lower), pick(upper), pick(digits), pick(symbols),
|
||
}
|
||
// 16 ≥ PasswordMinLen(12)
|
||
for len(out) < 16 {
|
||
out = append(out, pick(all))
|
||
}
|
||
// shuffle
|
||
for i := len(out) - 1; i > 0; i-- {
|
||
jBig, err := rand.Int(rand.Reader, big.NewInt(int64(i+1)))
|
||
j := 0
|
||
if err == nil {
|
||
j = int(jBig.Int64())
|
||
}
|
||
out[i], out[j] = out[j], out[i]
|
||
}
|
||
return string(out)
|
||
}
|