用户密码验证

密码的验证-锁定

import java.util.Map;

import javax.annotation.Resource;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import com.google.common.collect.Maps;
import com.inesa.basic.business.server.service.BasicUserInfoService;
import com.inesa.business.model.AuthorityResponse;
import com.inesa.business.model.BasicUserInfoVo;

@Component
public class AuthorityTools {

	@Resource
	private BasicUserInfoService userService;

	/**
	 * 允许的最大登录次数
	 */
	@Value("${authority.retry.limit:3}")
	private int retryLimit;

	/**
	 * 用户锁定时间
	 */
	@Value("#{${authority.retry.lock:5} * 60 * 1000L}")
	private long lockTime;

	/**
	 * 用户登录锁定时间
	 */
	private Map<Long, Long> userLockTime = Maps.newConcurrentMap();

	/**
	 * 用户登录失败次数
	 */
	private Map<Long, Integer> userLongTime = Maps.newConcurrentMap();

	/**
	 * 对信息进行加密
	 * 
	 * @param
	 * @return
	 */
	public String encoder(String password) {
		return CryptoUtil.encrypt(password);
	}

	/**
	 * 验证是否正确
	 * 
	 * @param username
	 * @param password 第几次登录
	 * @return
	 */
	public AuthorityResponse authority(String username, String password) {
		BasicUserInfoVo user = userService.findByUserName(username);

		// 验证用户是否存在
		if (user == null) {
			return AuthorityResponse.builder().check(false).error("用户不存在").build();
		}

		// 判断用户是否锁定
		if (userLockTime.containsKey(user.getId())) {
			if (System.currentTimeMillis() - userLockTime.get(user.getId()) < lockTime) {
				if (userLongTime.getOrDefault(user.getId(), 0) > retryLimit) {
					int minutes = (int) ((System.currentTimeMillis() - userLockTime.get(user.getId())) / 60000L);
					return AuthorityResponse.builder().check(false)
							.error(String.format("用户已锁定,请在%s分钟后重试", lockTime / 60000L - minutes)).build();
				}
			} else {
				// 如果上次登录失败的时间已经超过时间限制,重置登录失败的次数
				userLockTime.remove(user.getId());
				userLongTime.remove(user.getId());
			}
		}

		if (user.getState() == BasicUserInfoVo.DISABLE) {
			return AuthorityResponse.builder().check(false).error("用户已被禁用").build();
		}

		if (user.getState() == BasicUserInfoVo.LOCKED) {
			return AuthorityResponse.builder().check(false).error("用户已被锁定").build();
		}

		// 验证密码是否不正确
		if (!password.equals(user.getPassword())) {
			// 登录失败后更新登录失败的次数,以及更新登录失败的时间
			int retriedTimes = userLongTime.getOrDefault(user.getId(), 0);
			retriedTimes++;
			userLongTime.put(user.getId(), retriedTimes);
			userLockTime.put(user.getId(), System.currentTimeMillis());

			return AuthorityResponse.builder().check(false)
					.error("密码错误").build();
		}

		return AuthorityResponse.builder().userId(user.getId()).check(true).build();
	}
}