ahp
422e6ed289
Expose learning, registration controls, mentor chat, realtime WebSocket, and staff administration.
351 lines
9.1 KiB
Go
351 lines
9.1 KiB
Go
package api
|
||
|
||
import (
|
||
"bytes"
|
||
"context"
|
||
"crypto/rand"
|
||
"crypto/sha256"
|
||
"encoding/base64"
|
||
"encoding/binary"
|
||
"encoding/hex"
|
||
"errors"
|
||
"fmt"
|
||
"image"
|
||
"image/color"
|
||
"image/draw"
|
||
"image/png"
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/redis/go-redis/v9"
|
||
)
|
||
|
||
const (
|
||
captchaTTL = 5 * time.Minute
|
||
captchaKeyPrefix = "pargar:captcha:"
|
||
captchaRateLimit int64 = 60
|
||
captchaCharset = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
|
||
captchaMinLen = 4
|
||
captchaMaxLen = 5
|
||
captchaImgW = 160
|
||
captchaImgH = 52
|
||
)
|
||
|
||
var (
|
||
errCaptchaUnavailable = errors.New("captcha unavailable")
|
||
errCaptchaRequired = errors.New("captcha required")
|
||
errCaptchaInvalid = errors.New("captcha invalid")
|
||
|
||
// 5×7 bitmap glyphs for A–Z and 0–9 (row-major, MSB = left).
|
||
captchaGlyphs = map[byte][7]byte{
|
||
'A': {0x0E, 0x11, 0x11, 0x1F, 0x11, 0x11, 0x11},
|
||
'B': {0x1E, 0x11, 0x11, 0x1E, 0x11, 0x11, 0x1E},
|
||
'C': {0x0E, 0x11, 0x10, 0x10, 0x10, 0x11, 0x0E},
|
||
'D': {0x1E, 0x11, 0x11, 0x11, 0x11, 0x11, 0x1E},
|
||
'E': {0x1F, 0x10, 0x10, 0x1E, 0x10, 0x10, 0x1F},
|
||
'F': {0x1F, 0x10, 0x10, 0x1E, 0x10, 0x10, 0x10},
|
||
'G': {0x0E, 0x11, 0x10, 0x17, 0x11, 0x11, 0x0E},
|
||
'H': {0x11, 0x11, 0x11, 0x1F, 0x11, 0x11, 0x11},
|
||
'J': {0x01, 0x01, 0x01, 0x01, 0x11, 0x11, 0x0E},
|
||
'K': {0x11, 0x12, 0x14, 0x18, 0x14, 0x12, 0x11},
|
||
'L': {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x1F},
|
||
'M': {0x11, 0x1B, 0x15, 0x15, 0x11, 0x11, 0x11},
|
||
'N': {0x11, 0x19, 0x15, 0x13, 0x11, 0x11, 0x11},
|
||
'P': {0x1E, 0x11, 0x11, 0x1E, 0x10, 0x10, 0x10},
|
||
'Q': {0x0E, 0x11, 0x11, 0x11, 0x15, 0x12, 0x0D},
|
||
'R': {0x1E, 0x11, 0x11, 0x1E, 0x14, 0x12, 0x11},
|
||
'S': {0x0E, 0x11, 0x10, 0x0E, 0x01, 0x11, 0x0E},
|
||
'T': {0x1F, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04},
|
||
'U': {0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x0E},
|
||
'V': {0x11, 0x11, 0x11, 0x11, 0x11, 0x0A, 0x04},
|
||
'W': {0x11, 0x11, 0x11, 0x15, 0x15, 0x1B, 0x11},
|
||
'X': {0x11, 0x11, 0x0A, 0x04, 0x0A, 0x11, 0x11},
|
||
'Y': {0x11, 0x11, 0x0A, 0x04, 0x04, 0x04, 0x04},
|
||
'Z': {0x1F, 0x01, 0x02, 0x04, 0x08, 0x10, 0x1F},
|
||
'2': {0x0E, 0x11, 0x01, 0x02, 0x04, 0x08, 0x1F},
|
||
'3': {0x0E, 0x11, 0x01, 0x06, 0x01, 0x11, 0x0E},
|
||
'4': {0x02, 0x06, 0x0A, 0x12, 0x1F, 0x02, 0x02},
|
||
'5': {0x1F, 0x10, 0x1E, 0x01, 0x01, 0x11, 0x0E},
|
||
'6': {0x06, 0x08, 0x10, 0x1E, 0x11, 0x11, 0x0E},
|
||
'7': {0x1F, 0x01, 0x02, 0x04, 0x08, 0x08, 0x08},
|
||
'8': {0x0E, 0x11, 0x11, 0x0E, 0x11, 0x11, 0x0E},
|
||
'9': {0x0E, 0x11, 0x11, 0x0F, 0x01, 0x02, 0x0C},
|
||
}
|
||
)
|
||
|
||
func captchaAnswerHash(answer string) string {
|
||
sum := sha256.Sum256([]byte(strings.TrimSpace(strings.ToUpper(answer))))
|
||
return hex.EncodeToString(sum[:])
|
||
}
|
||
|
||
func randBounded(maxExclusive int) (int, error) {
|
||
if maxExclusive <= 0 {
|
||
return 0, fmt.Errorf("invalid bound")
|
||
}
|
||
var buf [8]byte
|
||
if _, err := rand.Read(buf[:]); err != nil {
|
||
return 0, err
|
||
}
|
||
return int(binary.BigEndian.Uint64(buf[:]) % uint64(maxExclusive)), nil
|
||
}
|
||
|
||
func randomCaptchaText() (string, error) {
|
||
n := captchaMinLen
|
||
extra, err := randBounded(captchaMaxLen - captchaMinLen + 1)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
n += extra
|
||
out := make([]byte, n)
|
||
for i := range out {
|
||
idx, err := randBounded(len(captchaCharset))
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
out[i] = captchaCharset[idx]
|
||
}
|
||
return string(out), nil
|
||
}
|
||
|
||
func renderCaptchaPNG(text string) ([]byte, error) {
|
||
img := image.NewRGBA(image.Rect(0, 0, captchaImgW, captchaImgH))
|
||
bg := color.RGBA{R: 248, G: 250, B: 252, A: 255}
|
||
draw.Draw(img, img.Bounds(), &image.Uniform{C: bg}, image.Point{}, draw.Src)
|
||
|
||
// Light speckled noise.
|
||
for i := 0; i < 180; i++ {
|
||
x, err := randBounded(captchaImgW)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
y, err := randBounded(captchaImgH)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
shade, err := randBounded(80)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
c := uint8(160 + shade)
|
||
img.Set(x, y, color.RGBA{R: c, G: c, B: c, A: 255})
|
||
}
|
||
|
||
// A few interference lines.
|
||
ink := color.RGBA{R: 30, G: 41, B: 59, A: 255}
|
||
for i := 0; i < 3; i++ {
|
||
x0, err := randBounded(captchaImgW)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
y0, err := randBounded(captchaImgH)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
x1, err := randBounded(captchaImgW)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
y1, err := randBounded(captchaImgH)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
drawLine(img, x0, y0, x1, y1, color.RGBA{R: 148, G: 163, B: 184, A: 180})
|
||
}
|
||
|
||
scale := 3
|
||
glyphW := 5 * scale
|
||
gap := 4
|
||
totalW := len(text)*glyphW + (len(text)-1)*gap
|
||
startX := (captchaImgW - totalW) / 2
|
||
if startX < 4 {
|
||
startX = 4
|
||
}
|
||
baseY := (captchaImgH - 7*scale) / 2
|
||
|
||
for i := 0; i < len(text); i++ {
|
||
ch := text[i]
|
||
glyph, ok := captchaGlyphs[ch]
|
||
if !ok {
|
||
continue
|
||
}
|
||
jitter, err := randBounded(5)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
ox := startX + i*(glyphW+gap)
|
||
oy := baseY + jitter - 2
|
||
drawGlyph(img, ox, oy, glyph, scale, ink)
|
||
}
|
||
|
||
var buf bytes.Buffer
|
||
if err := png.Encode(&buf, img); err != nil {
|
||
return nil, err
|
||
}
|
||
return buf.Bytes(), nil
|
||
}
|
||
|
||
func drawGlyph(img *image.RGBA, ox, oy int, glyph [7]byte, scale int, c color.RGBA) {
|
||
for row := 0; row < 7; row++ {
|
||
bits := glyph[row]
|
||
for col := 0; col < 5; col++ {
|
||
if bits&(1<<uint(4-col)) == 0 {
|
||
continue
|
||
}
|
||
for dy := 0; dy < scale; dy++ {
|
||
for dx := 0; dx < scale; dx++ {
|
||
x := ox + col*scale + dx
|
||
y := oy + row*scale + dy
|
||
if x >= 0 && y >= 0 && x < img.Bounds().Dx() && y < img.Bounds().Dy() {
|
||
img.Set(x, y, c)
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
func drawLine(img *image.RGBA, x0, y0, x1, y1 int, c color.RGBA) {
|
||
dx := x1 - x0
|
||
if dx < 0 {
|
||
dx = -dx
|
||
}
|
||
dy := y1 - y0
|
||
if dy < 0 {
|
||
dy = -dy
|
||
}
|
||
sx, sy := 1, 1
|
||
if x0 > x1 {
|
||
sx = -1
|
||
}
|
||
if y0 > y1 {
|
||
sy = -1
|
||
}
|
||
err := dx - dy
|
||
for {
|
||
if x0 >= 0 && y0 >= 0 && x0 < img.Bounds().Dx() && y0 < img.Bounds().Dy() {
|
||
img.Set(x0, y0, c)
|
||
}
|
||
if x0 == x1 && y0 == y1 {
|
||
break
|
||
}
|
||
e2 := 2 * err
|
||
if e2 > -dy {
|
||
err -= dy
|
||
x0 += sx
|
||
}
|
||
if e2 < dx {
|
||
err += dx
|
||
y0 += sy
|
||
}
|
||
}
|
||
}
|
||
|
||
func captchaImageBase64(text string) (string, error) {
|
||
pngBytes, err := renderCaptchaPNG(text)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
return base64.StdEncoding.EncodeToString(pngBytes), nil
|
||
}
|
||
|
||
func (s *Server) handleCaptcha(w http.ResponseWriter, r *http.Request) {
|
||
if s.redis == nil {
|
||
if s.cfg.DevMode {
|
||
img, err := captchaImageBase64("A2B3")
|
||
if err != nil {
|
||
writeErr(w, http.StatusInternalServerError, "صدور کد امنیتی ممکن نشد")
|
||
return
|
||
}
|
||
resp := map[string]any{
|
||
"challengeId": "dev",
|
||
"imageBase64": img,
|
||
}
|
||
if s.cfg.CaptchaExposeAnswer {
|
||
resp["answer"] = "A2B3"
|
||
}
|
||
writeJSON(w, http.StatusOK, resp)
|
||
return
|
||
}
|
||
writeErr(w, http.StatusServiceUnavailable, "سرویس کد امنیتی در دسترس نیست")
|
||
return
|
||
}
|
||
|
||
text, err := randomCaptchaText()
|
||
if err != nil {
|
||
writeErr(w, http.StatusInternalServerError, "صدور کد امنیتی ممکن نشد")
|
||
return
|
||
}
|
||
img, err := captchaImageBase64(text)
|
||
if err != nil {
|
||
writeErr(w, http.StatusInternalServerError, "صدور کد امنیتی ممکن نشد")
|
||
return
|
||
}
|
||
|
||
raw := make([]byte, 16)
|
||
if _, err := rand.Read(raw); err != nil {
|
||
writeErr(w, http.StatusInternalServerError, "صدور کد امنیتی ممکن نشد")
|
||
return
|
||
}
|
||
id := hex.EncodeToString(raw)
|
||
key := captchaKeyPrefix + id
|
||
if err := s.redis.Set(r.Context(), key, captchaAnswerHash(text), captchaTTL).Err(); err != nil {
|
||
writeErr(w, http.StatusServiceUnavailable, "سرویس کد امنیتی در دسترس نیست")
|
||
return
|
||
}
|
||
|
||
resp := map[string]any{
|
||
"challengeId": id,
|
||
"imageBase64": img,
|
||
}
|
||
// Never expose plaintext answers in production. Local tests may opt in via
|
||
// CAPTCHA_EXPOSE_ANSWER=true combined with DEV_MODE=true.
|
||
if s.cfg.DevMode && s.cfg.CaptchaExposeAnswer {
|
||
resp["answer"] = text
|
||
}
|
||
writeJSON(w, http.StatusOK, resp)
|
||
}
|
||
|
||
// consumeCaptcha verifies and one-time-deletes a challenge. On any failure the
|
||
// challenge is consumed (or already gone) so the client must fetch a new one.
|
||
func (s *Server) consumeCaptcha(ctx context.Context, challengeID, answer string) error {
|
||
challengeID = strings.TrimSpace(challengeID)
|
||
answer = strings.TrimSpace(answer)
|
||
if challengeID == "" || answer == "" {
|
||
return errCaptchaRequired
|
||
}
|
||
|
||
if s.redis == nil {
|
||
if s.cfg.DevMode && challengeID == "dev" && strings.EqualFold(answer, "A2B3") {
|
||
return nil
|
||
}
|
||
return errCaptchaUnavailable
|
||
}
|
||
|
||
key := captchaKeyPrefix + challengeID
|
||
stored, err := s.redis.GetDel(ctx, key).Result()
|
||
if err == redis.Nil {
|
||
return errCaptchaInvalid
|
||
}
|
||
if err != nil {
|
||
return errCaptchaUnavailable
|
||
}
|
||
if stored != captchaAnswerHash(answer) {
|
||
return errCaptchaInvalid
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func captchaErrorMessage(err error) (int, string) {
|
||
switch {
|
||
case errors.Is(err, errCaptchaRequired):
|
||
return http.StatusBadRequest, "کد امنیتی الزامی است"
|
||
case errors.Is(err, errCaptchaInvalid):
|
||
return http.StatusBadRequest, "پاسخ کد امنیتی نادرست یا منقضی است"
|
||
case errors.Is(err, errCaptchaUnavailable):
|
||
return http.StatusServiceUnavailable, "سرویس کد امنیتی در دسترس نیست"
|
||
default:
|
||
return http.StatusBadRequest, "پاسخ کد امنیتی نادرست یا منقضی است"
|
||
}
|
||
}
|