Genarrative/server-rs/crates/api-server/src/password_management.rs

use axum::{
    Json,
    extract::{Extension, State},
    http::{HeaderMap, StatusCode},
    response::IntoResponse,
};
use module_auth::{ChangePasswordInput, PasswordEntryError, ResetPasswordInput};
use shared_contracts::auth::{
    PasswordChangeRequest, PasswordChangeResponse, PasswordResetRequest, PasswordResetResponse,
};
use time::OffsetDateTime;
use tracing::warn;

use crate::{
    api_response::json_success_body,
    auth::AuthenticatedAccessToken,
    auth_payload::map_auth_user_payload,
    auth_session::{
        attach_set_cookie_header, build_clear_refresh_session_cookie_header,
        build_refresh_session_cookie_header, create_auth_session_and_sync,
        record_daily_login_tracking_event_after_auth_success,
    },
    http_error::AppError,
    phone_auth::map_phone_auth_error,
    request_context::RequestContext,
    session_client::resolve_session_client_context,
    state::AppState,
};

pub async fn change_password(
    State(state): State<AppState>,
    Extension(request_context): Extension<RequestContext>,
    Extension(authenticated): Extension<AuthenticatedAccessToken>,
    Json(payload): Json<PasswordChangeRequest>,
) -> Result<impl IntoResponse, AppError> {
    let result = state
        .password_entry_service()
        .change_password_and_revoke_all_sessions(
            ChangePasswordInput {
                user_id: authenticated.claims().user_id().to_string(),
                current_password: payload.current_password,
                new_password: payload.new_password,
            },
            OffsetDateTime::now_utc(),
        )
        .await
        .map_err(map_password_management_error)?;
    state
        .sync_auth_store_tables_to_spacetime()
        .await
        .map_err(|error| {
            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR)
                .with_message(format!("同步认证状态失败：{error}"))
        })?;

    let mut headers = HeaderMap::new();
    attach_set_cookie_header(
        &mut headers,
        build_clear_refresh_session_cookie_header(&state)?,
    );

    Ok((
        headers,
        json_success_body(
            Some(&request_context),
            PasswordChangeResponse {
                user: map_auth_user_payload(result.user),
            },
        ),
    ))
}

pub async fn reset_password(
    State(state): State<AppState>,
    Extension(request_context): Extension<RequestContext>,
    headers: HeaderMap,
    Json(payload): Json<PasswordResetRequest>,
) -> Result<impl IntoResponse, AppError> {
    if !state.config.sms_auth_enabled {
        return Err(
            AppError::from_status(StatusCode::BAD_REQUEST).with_message("手机号登录暂未启用")
        );
    }

    // reset_password 消费的是跨节点共享的短期验证码；先恢复正式投影，
    // 避免发码节点与消费节点的本机工作集不一致。
    state
        .refresh_auth_store_from_spacetime()
        .await
        .map_err(|error| {
            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR)
                .with_message(format!("刷新短信验证码状态失败：{error}"))
        })?;

    let result = match state
        .phone_auth_service()
        .reset_password(
            ResetPasswordInput {
                country_code: payload.country_code,
                pure_phone_number: payload.pure_phone_number,
                verify_code: payload.code,
                new_password: payload.new_password,
            },
            OffsetDateTime::now_utc(),
        )
        .await
    {
        Ok(result) => result,
        Err(error) => {
            if let Err(sync_error) = state.sync_auth_store_tables_to_spacetime().await {
                warn!(error = %sync_error, "重置密码失败后的短信验证码状态同步失败");
                return Err(AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR)
                    .with_message("同步短信验证码状态失败"));
            }
            return Err(map_phone_auth_error(error));
        }
    };
    state
        .sync_auth_store_tables_to_spacetime()
        .await
        .map_err(|error| {
            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR)
                .with_message(format!("同步认证状态失败：{error}"))
        })?;
    let session_client = resolve_session_client_context(&headers);
    if let Err(error) = crate::external_api_keys::ensure_llm_router_account_after_auth_success(
        &state,
        &request_context,
        &result.user.id,
    )
    .await
    {
        warn!(
            request_id = request_context.request_id(),
            user_id = %result.user.id,
            error = %error,
            "密码重置后的 LLM Router 账号准备失败；不发放登录会话"
        );
        return Err(AppError::from_status(StatusCode::SERVICE_UNAVAILABLE)
            .with_message("账号服务暂不可用，请稍后重试"));
    }
    let signed_session = create_auth_session_and_sync(
        &state,
        &result.user,
        &session_client,
        module_auth::AuthLoginMethod::Password,
    )
    .await?;
    record_daily_login_tracking_event_after_auth_success(
        &state,
        &request_context,
        &result.user.id,
        module_auth::AuthLoginMethod::Password,
    )
    .await;

    let mut headers = HeaderMap::new();
    attach_set_cookie_header(
        &mut headers,
        build_refresh_session_cookie_header(&state, &signed_session.refresh_token)?,
    );

    Ok((
        headers,
        json_success_body(
            Some(&request_context),
            PasswordResetResponse {
                token: signed_session.access_token,
                user: map_auth_user_payload(result.user),
            },
        ),
    ))
}

fn map_password_management_error(error: PasswordEntryError) -> AppError {
    match error {
        PasswordEntryError::InvalidPhoneNumber
        | PasswordEntryError::UnsupportedPhoneCountryCode
        | PasswordEntryError::InvalidPublicUserCode => {
            AppError::from_status(StatusCode::BAD_REQUEST).with_message(error.to_string())
        }
        PasswordEntryError::InvalidDisplayName
        | PasswordEntryError::InvalidAvatarDataUrl
        | PasswordEntryError::EmptyProfileUpdate => {
            AppError::from_status(StatusCode::BAD_REQUEST).with_message(error.to_string())
        }
        PasswordEntryError::InvalidPasswordLength => AppError::from_status(StatusCode::BAD_REQUEST)
            .with_message("密码长度需要在 6 到 128 位之间"),
        PasswordEntryError::InvalidCredentials => {
            AppError::from_status(StatusCode::UNAUTHORIZED).with_message("当前密码错误")
        }
        PasswordEntryError::UserNotFound => AppError::from_status(StatusCode::UNAUTHORIZED)
            .with_message("当前登录态已失效，请重新登录"),
        PasswordEntryError::Store(_) | PasswordEntryError::PasswordHash(_) => {
            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error.to_string())
        }
    }
}