02. 身份认证与会话安全

QJsonObject ClientLogic::makeAuthedRequest(const QString& cmd) const
{
    QJsonObject obj;
    obj["cmd"] = cmd;
    obj["from"] = currentUser;
    obj["token"] = authToken;
    obj["session_id"] = sessionId;
    return obj;
}

void ClientLogic::requestLogin(const QString& user, const QString& pwd)
{

    stopHeartbeat();
    currentUser.clear();
    authToken.clear();
    sessionId.clear();

    if (user.isEmpty() || pwd.isEmpty()) {
        emit sigLoginResult(false, "账号或密码不能为空");
        return;
    }

    if (m_loginPending) {
        emitUiLog("⚠️ 登录请求正在处理中，请勿重复点击");
        return;
    }

    m_loginPending = true;

    QJsonObject req;
    req["cmd"] = "login";
    req["user"] = user;
    req["pwd"] = pwd;

    netManager->sendJsonToServer(req);
}

void ClientLogic::startHeartbeat(int intervalSeconds)
{
    if (!m_heartbeatTimer) {
        return;
    }

    if (intervalSeconds <= 0) {
        intervalSeconds = 10;
    }

    m_heartbeatIntervalMs = intervalSeconds * 1000;
    m_missedHeartbeatCount = 0;

    m_heartbeatTimer->stop();
    m_heartbeatTimer->setInterval(m_heartbeatIntervalMs);
    m_heartbeatTimer->start();

    emitUiLog(QString("✅ 登录态心跳已启动，间隔 %1 秒").arg(intervalSeconds));
}

LoginSessionResult NetworkServer::createLoginSessionForUser(const std::string& username,
                                                            const sockaddr_in& client_addr)
{
    LoginSessionResult result;

    if (!isValidUserId(username)) {
        return result;
    }

    Session oldSession;
    bool hasOldSession = false;

    {
        std::lock_guard<std::mutex> lock(online_mutex);

        auto it = online_users.find(username);
        if (it != online_users.end()) {
            oldSession = it->second;
            hasOldSession = !oldSession.ip.empty() && oldSession.port > 0;
        }
    }

    result.token = makeRandomHexToken();
    result.sessionId = "sess_" + makeRandomHexToken();
    result.kickedOldSession = hasOldSession;

    {
        std::lock_guard<std::mutex> lock(token_mutex);

        auto oldTokenIt = user_to_token.find(username);
        if (oldTokenIt != user_to_token.end()) {
            token_to_user.erase(oldTokenIt->second);
        }

        user_to_token[username] = result.token;
        token_to_user[result.token] = username;
    }

    Session newSession = sessionFromAddr(client_addr);
    newSession.token = result.token;
    newSession.sessionId = result.sessionId;
    newSession.loginTime = nowSeconds();
    newSession.lastHeartbeat = newSession.loginTime;

    {
        std::lock_guard<std::mutex> lock(online_mutex);
        online_users[username] = newSession;
    }

    if (hasOldSession) {
        sockaddr_in oldAddr{};
        oldAddr.sin_family = AF_INET;

        if (inet_pton(AF_INET, oldSession.ip.c_str(), &oldAddr.sin_addr) == 1 &&
            oldSession.port > 0 && oldSession.port <= 65535) {
            oldAddr.sin_port = htons(static_cast<uint16_t>(oldSession.port));

            std::string reason = "账号已在其他客户端登录，当前客户端已下线";
            std::ostringstream oss;
            oss << "{\"cmd\":\"force_logout\",\"reason\":\"" << reason << "\"}";
            sendData(oss.str(), oldAddr);
        }
    }

    return result;
}

void BusinessHandler::handleLogin(const std::string& json_str, struct sockaddr_in client_addr) {
    try {
        json j = json::parse(json_str);
        std::string user = getStringField(j, "user");
        std::string pwd = getStringField(j, "pwd");

        json resp;
        resp["cmd"] = "login_resp";

        if (user.empty() || pwd.empty()) {
            resp["result"] = "fail";
            resp["msg"] = "账号或密码不能为空";
            net_server->sendData(resp.dump(), client_addr);
            return;
        }

        if (DBManager::getInstance().verifyLogin(user, pwd)) {
            resp["result"] = "success";
            resp["user"] = user;

            std::string ip = inet_ntoa(client_addr.sin_addr);
            int port = ntohs(client_addr.sin_port);

            LoginSessionResult session =
                net_server->createLoginSessionForUser(user, client_addr);

            if (session.token.empty() || session.sessionId.empty()) {
                resp["result"] = "fail";
                resp["msg"] = "创建登录会话失败，请稍后重试";
                net_server->sendData(resp.dump(), client_addr);
                return;
            }

            resp["token"] = session.token;
            resp["session_id"] = session.sessionId;
            resp["heartbeat_interval"] = 10;
            resp["session_timeout"] = 35;
            resp["kicked_old_session"] = session.kickedOldSession;

            std::cout << "✅ [用户登录] " << user
                      << " 登录成功，当前地址: " << ip << ":" << port
                      << "，session_id=" << session.sessionId
                      << "，旧会话踢出=" << (session.kickedOldSession ? "yes" : "no")
                      << "\n";
        } else {
            resp["result"] = "fail";
            resp["msg"] = "账号不存在或密码错误";
            std::cout << "❌ [登录拒绝] " << user << " 尝试登录失败\n";
        }

        net_server->sendData(resp.dump(), client_addr);
    } catch (std::exception& e) {
        std::cerr << "登录逻辑处理异常: " << e.what() << "\n";
    }
}

bool BusinessHandler::checkAuth(const json& j,
                                struct sockaddr_in client_addr,
                                std::string& out_user)
{
    out_user.clear();

    json resp;
    resp["cmd"] = "auth_failed";

    std::string from = getStringField(j, "from");
    std::string token = getStringField(j, "token");
    std::string sessionId = getStringField(j, "session_id");

    if (token.empty()) {
        resp["reason"] = "缺少 token，请重新登录";
        net_server->sendData(resp.dump(), client_addr);
        return false;
    }

    if (sessionId.empty()) {
        resp["reason"] = "缺少 session_id，请重新登录";
        net_server->sendData(resp.dump(), client_addr);
        return false;
    }

    if (from.empty()) {
        resp["reason"] = "缺少 from 字段，请重新登录";
        net_server->sendData(resp.dump(), client_addr);
        return false;
    }

    if (!net_server || !net_server->verifySession(from, token, sessionId)) {
        resp["reason"] = "登录状态已失效，请重新登录";
        net_server->sendData(resp.dump(), client_addr);
        return false;
    }

    net_server->refreshHeartbeat(from, token, sessionId, client_addr);

    out_user = from;
    return true;
}