《互联网产品的服务端架构·产品、流量与基础能力》3.3 账号安全：撞库、风控与找回

// file: internal/account/security.go
// tier: L1
// verify: go test ./internal/account/

package account

import (
	"fmt"
	"time"
)

// Attempt 是一次登录尝试的事实记录。密码是否正确只影响 Success，
// 账号与 IP 都必须保留，因为撞库和防爆破看的是不同维度。
type Attempt struct {
	AccountID string
	IP        string
	Success   bool
	At        time.Time
}

// Throttle 用滑动窗口分别统计账号维度和 IP 维度的失败次数。
// 账号维度防定向爆破，IP 维度防同一来源横扫多个账号。
type Throttle struct {
	Window      time.Duration
	MaxFailures int

	accounts map[string][]time.Time
	ips      map[string][]time.Time
}

// NewThrottle 创建窗口与阈值都为正数的限流器。
func NewThrottle(window time.Duration, maxFailures int) (*Throttle, error) {
	if window <= 0 {
		return nil, fmt.Errorf("account: throttle window must be positive")
	}
	if maxFailures <= 0 {
		return nil, fmt.Errorf("account: max failures must be positive")
	}
	return &Throttle{
		Window:      window,
		MaxFailures: maxFailures,
		accounts:    make(map[string][]time.Time),
		ips:         make(map[string][]time.Time),
	}, nil
}

func (t *Throttle) init() error {
	if t.Window <= 0 {
		return fmt.Errorf("account: throttle window must be positive")
	}
	if t.MaxFailures <= 0 {
		return fmt.Errorf("account: max failures must be positive")
	}
	if t.accounts == nil {
		t.accounts = make(map[string][]time.Time)
	}
	if t.ips == nil {
		t.ips = make(map[string][]time.Time)
	}
	return nil
}

// Record 记录一次尝试。成功会同时清零该账号与该 IP 的失败计数，
// 因为成功登录说明当前来源不再处于可疑状态。
func (t *Throttle) Record(a Attempt) error {
	if err := t.init(); err != nil {
		return err
	}
	if a.AccountID == "" || a.IP == "" {
		return fmt.Errorf("account: attempt account and ip are required")
	}
	if a.Success {
		delete(t.accounts, a.AccountID)
		delete(t.ips, a.IP)
		return nil
	}
	t.accounts[a.AccountID] = append(t.accounts[a.AccountID], a.At)
	t.ips[a.IP] = append(t.ips[a.IP], a.At)
	return nil
}

// Allow 判断当前账号与 IP 是否还能继续尝试。返回的第二个值是可读原因，
// 便于网关记录日志和前端提示，而不是只给一个布尔值。
func (t *Throttle) Allow(accountID, ip string, now time.Time) (bool, string) {
	if err := t.init(); err != nil {
		return false, err.Error()
	}
	if accountID == "" || ip == "" {
		return false, "account and ip are required"
	}

	cutoff := now.Add(-t.Window)
	t.accounts[accountID] = prune(t.accounts[accountID], cutoff)
	t.ips[ip] = prune(t.ips[ip], cutoff)

	if n := len(t.accounts[accountID]); n >= t.MaxFailures {
		return false, fmt.Sprintf("account %s: %d failures within %s", accountID, n, t.Window)
	}
	if n := len(t.ips[ip]); n >= t.MaxFailures {
		return false, fmt.Sprintf("ip %s: %d failures within %s", ip, n, t.Window)
	}
	return true, "allowed"
}

// prune 只保留严格晚于 cutoff 的记录，使窗口随 now 滑动。
func prune(times []time.Time, cutoff time.Time) []time.Time {
	kept := times[:0]
	for _, at := range times {
		if at.After(cutoff) {
			kept = append(kept, at)
		}
	}
	return kept
}

// file: internal/account/security_test.go
// tier: L1
// verify: go test ./internal/account/

package account

import (
	"strings"
	"testing"
	"time"
)

func fail(t *testing.T, th *Throttle, account, ip string, at time.Time) {
	t.Helper()
	if err := th.Record(Attempt{AccountID: account, IP: ip, At: at}); err != nil {
		t.Fatal(err)
	}
}

func TestAllowCountsAccountDimension(t *testing.T) {
	th, err := NewThrottle(time.Minute, 3)
	if err != nil {
		t.Fatal(err)
	}
	now := time.Date(2026, 10, 28, 10, 0, 0, 0, time.UTC)
	for i, ip := range []string{"10.0.0.1", "10.0.0.2", "10.0.0.3"} {
		fail(t, th, "a1", ip, now.Add(time.Duration(i)*time.Second))
	}

	ok, reason := th.Allow("a1", "10.0.0.99", now.Add(5*time.Second))
	if ok {
		t.Fatal("want rejection after three account failures")
	}
	if !strings.Contains(reason, "account") {
		t.Fatalf("reason = %q, want account dimension", reason)
	}

	ok, _ = th.Allow("a2", "10.0.0.99", now.Add(5*time.Second))
	if !ok {
		t.Fatal("another account should still be allowed")
	}
}

func TestAllowCountsIPDimension(t *testing.T) {
	th, err := NewThrottle(time.Minute, 3)
	if err != nil {
		t.Fatal(err)
	}
	now := time.Date(2026, 10, 28, 10, 0, 0, 0, time.UTC)
	for i, account := range []string{"a1", "a2", "a3"} {
		fail(t, th, account, "10.0.0.7", now.Add(time.Duration(i)*time.Second))
	}

	ok, reason := th.Allow("a-fresh", "10.0.0.7", now.Add(5*time.Second))
	if ok {
		t.Fatal("want rejection after three failures from one IP")
	}
	if !strings.Contains(reason, "ip") {
		t.Fatalf("reason = %q, want ip dimension", reason)
	}

	ok, _ = th.Allow("a-fresh", "10.0.0.8", now.Add(5*time.Second))
	if !ok {
		t.Fatal("fresh IP should still be allowed")
	}
}

func TestAllowSlideWindow(t *testing.T) {
	th, err := NewThrottle(time.Minute, 2)
	if err != nil {
		t.Fatal(err)
	}
	now := time.Date(2026, 10, 28, 10, 0, 0, 0, time.UTC)
	fail(t, th, "a1", "10.0.0.1", now)
	fail(t, th, "a1", "10.0.0.1", now.Add(10*time.Second))

	if ok, _ := th.Allow("a1", "10.0.0.1", now.Add(20*time.Second)); ok {
		t.Fatal("want rejection inside the window")
	}
	if ok, _ := th.Allow("a1", "10.0.0.1", now.Add(2*time.Minute)); !ok {
		t.Fatal("both failures should have slid out of the window")
	}
}

func TestSuccessClearsCounters(t *testing.T) {
	th, err := NewThrottle(time.Minute, 2)
	if err != nil {
		t.Fatal(err)
	}
	now := time.Date(2026, 10, 28, 10, 0, 0, 0, time.UTC)
	fail(t, th, "a1", "10.0.0.1", now)
	fail(t, th, "a1", "10.0.0.1", now.Add(time.Second))
	if ok, _ := th.Allow("a1", "10.0.0.1", now.Add(2*time.Second)); ok {
		t.Fatal("want rejection before success")
	}

	if err := th.Record(Attempt{AccountID: "a1", IP: "10.0.0.1", Success: true, At: now.Add(3 * time.Second)}); err != nil {
		t.Fatal(err)
	}
	if ok, reason := th.Allow("a1", "10.0.0.1", now.Add(4*time.Second)); !ok {
		t.Fatalf("success should clear counters, reason = %q", reason)
	}
}

func TestThrottleValidatesInput(t *testing.T) {
	if _, err := NewThrottle(0, 3); err == nil {
		t.Fatal("want error for zero window")
	}
	if _, err := NewThrottle(time.Minute, 0); err == nil {
		t.Fatal("want error for zero max failures")
	}
	th, _ := NewThrottle(time.Minute, 3)
	if err := th.Record(Attempt{At: time.Now()}); err == nil {
		t.Fatal("want error for empty account and ip")
	}
}

cd .local/checks/webapp-lab && go test ./internal/account/ -run 'TestAllow|TestSuccess' -count=1

ok  	webapp/internal/account	0.281s