Merge pull request #52 from yyyCode/feat/slider-captcha

feat(security): 发码接口接入滑动验证码（自研加固）

Author: yyyCode

OpenBlog-business/src/main/java/com/yqz/openblog/config/AuthSecurityProperties.java

@@ -45,15 +45,46 @@ public void setEmailCode(EmailCode emailCode) {
         this.emailCode = emailCode;
     }
 
+    /**
+     * 滑动验证码：服务端随机生成缺口图，客户端算出缺口 x 并提交拖动轨迹。
+     * 强度上限为「拦掉不做图像分析的脚本、抬高随手写脚本的成本」——缺口位置存在 Redis，
+     * 客户端只能从像素里解出来；而会写局部统计或接缝分析的人仍能解出，这是滑块验证码这一
+     * 形态的固有上限。真正的门禁是坐标容差 + 一次性消费 + 网关限流，轨迹阈值一律<b>偏向不误伤真人</b>。
+     */
     public static class Slider {
         /**
-         * 是否要求登录/注册前先完成「滑到尽头」验证（Redis 记录一次性凭证）。
+         * 是否要求发码前先完成滑动验证（Redis 记录一次性凭证）。
          */
         private boolean enabled = false;
         /**
          * challenge / 通过标记有效时间（秒）。
          */
         private int ttlSeconds = 300;
+        /**
+         * 允许的落点误差（像素）。容差 6px / 随机空间 176px → 盲猜单次命中率约 3.4%。
+         */
+        private int tolerancePx = 6;
+        /**
+         * 拖动最短耗时（毫秒），低于此值判为机器瞬移。
+         * <p>
+         * 刻意取 100 而非更高：滑块最远要拖 272 图像像素（约 340 CSS px），快甩一下就能在
+         * 200ms 内完成，阈值取 200 会误伤真实用户。100ms 仍远高于脚本瞬移的耗时。
+         */
+        private int minDurationMs = 100;
+        /**
+         * 拖动最长耗时（毫秒），超时判为非人工（也防慢速重放）。
+         */
+        private int maxDurationMs = 30000;
+        /**
+         * 轨迹最少采样点数。
+         */
+        private int minTrailPoints = 5;
+        /**
+         * 速度变异系数下限。取相邻采样点间平均速度（px/ms）序列，要求 标准差/均值 >= 本值，
+         * 即拒绝完全匀速的「机器直线」。启发式阈值，非强保证——前端采样位置取整后，恒速拖动
+         * 的速度也会自然出现起伏，故它只拦得住数学上完美匀速的提交。
+         */
+        private double minSpeedCv = 0.05;
 
         public boolean isEnabled() {
             return enabled;
@@ -70,6 +101,46 @@ public int getTtlSeconds() {
         public void setTtlSeconds(int ttlSeconds) {
             this.ttlSeconds = ttlSeconds;
         }
+
+        public int getTolerancePx() {
+            return tolerancePx;
+        }
+
+        public void setTolerancePx(int tolerancePx) {
+            this.tolerancePx = tolerancePx;
+        }
+
+        public int getMinDurationMs() {
+            return minDurationMs;
+        }
+
+        public void setMinDurationMs(int minDurationMs) {
+            this.minDurationMs = minDurationMs;
+        }
+
+        public int getMaxDurationMs() {
+            return maxDurationMs;
+        }
+
+        public void setMaxDurationMs(int maxDurationMs) {
+            this.maxDurationMs = maxDurationMs;
+        }
+
+        public int getMinTrailPoints() {
+            return minTrailPoints;
+        }
+
+        public void setMinTrailPoints(int minTrailPoints) {
+            this.minTrailPoints = minTrailPoints;
+        }
+
+        public double getMinSpeedCv() {
+            return minSpeedCv;
+        }
+
+        public void setMinSpeedCv(double minSpeedCv) {
+            this.minSpeedCv = minSpeedCv;
+        }
     }
 
     public static class LoginLockout {

OpenBlog-business/src/main/java/com/yqz/openblog/user/controller/AuthController.java

@@ -45,14 +45,15 @@ public ApiResponse<SliderChallengeResponse> sliderChallenge(HttpServletRequest r
     public ApiResponse<Void> sliderComplete(
             @RequestBody @Valid SliderCompleteRequest req,
             HttpServletRequest request) {
-        sliderVerificationService.complete(request, req.getChallengeId());
+        sliderVerificationService.complete(request, req);
         return ApiResponse.ok();
     }
 
     @PostMapping("/auth/email-code")
     public ApiResponse<EmailCodeResponse> emailCode(@RequestBody @Valid EmailCodeRequest req) {
         EmailCodeResponse resp = new EmailCodeResponse();
-        resp.setCooldownSeconds(emailCodeService.sendCode(req.getEmail(), req.getPurpose()));
+        resp.setCooldownSeconds(emailCodeService.sendCode(
+                req.getEmail(), req.getPurpose(), req.getSliderChallengeId()));
         return ApiResponse.ok(resp);
     }
 

OpenBlog-business/src/main/java/com/yqz/openblog/user/dto/EmailCodeRequest.java

@@ -20,6 +20,11 @@ public class EmailCodeRequest {
 
     private String purpose;
 
+    /**
+     * 滑动验证通过后的一次性凭证。滑块开关关闭时可不传（服务端直接放行）。
+     */
+    private String sliderChallengeId;
+
     public String getEmail() {
         return email;
     }
@@ -35,4 +40,12 @@ public String getPurpose() {
     public void setPurpose(String purpose) {
         this.purpose = purpose;
     }
+
+    public String getSliderChallengeId() {
+        return sliderChallengeId;
+    }
+
+    public void setSliderChallengeId(String sliderChallengeId) {
+        this.sliderChallengeId = sliderChallengeId;
+    }
 }

OpenBlog-business/src/main/java/com/yqz/openblog/user/dto/LoginRequest.java

@@ -9,11 +9,6 @@ public class LoginRequest {
     @NotBlank
     private String password;
 
-    /**
-     * 滑动验证通过后得到的 challengeId（{@code openblog.auth-security.slider.enabled=false} 时可不传）。
-     */
-    private String sliderChallengeId;
-
     public String getAccount() {
         return account;
     }
@@ -29,13 +24,5 @@ public String getPassword() {
     public void setPassword(String password) {
         this.password = password;
     }
-
-    public String getSliderChallengeId() {
-        return sliderChallengeId;
-    }
-
-    public void setSliderChallengeId(String sliderChallengeId) {
-        this.sliderChallengeId = sliderChallengeId;
-    }
 }
 

OpenBlog-business/src/main/java/com/yqz/openblog/user/dto/RegisterRequest.java

@@ -29,8 +29,6 @@ public class RegisterRequest {
     @Pattern(regexp = "^\\d{6}$", message = "验证码格式不正确")
     private String code;
 
-    private String sliderChallengeId;
-
     public String getUsername() {
         return username;
     }
@@ -62,13 +60,5 @@ public String getCode() {
     public void setCode(String code) {
         this.code = code;
     }
-
-    public String getSliderChallengeId() {
-        return sliderChallengeId;
-    }
-
-    public void setSliderChallengeId(String sliderChallengeId) {
-        this.sliderChallengeId = sliderChallengeId;
-    }
 }
 

OpenBlog-business/src/main/java/com/yqz/openblog/user/dto/SliderChallengeResponse.java

@@ -1,12 +1,21 @@
 package com.yqz.openblog.user.dto;
 
 /**
- * 滑动验证：先拉取 challengeId，滑到尽头后调用 {@code /auth/slider-complete}，再登录时带上同一 id。
+ * 滑动验证：拉取 challengeId 与图片，拖动完成后调用 {@code /auth/slider-complete} 提交落点与轨迹。
+ * <p>
+ * {@code enabled=false} 时其余字段均为 null，前端据此不渲染滑块直接发码。
+ * 缺口真值坐标<b>不在响应中</b>——只存服务端 Redis，客户端需从底图像素自行解出。
  */
 public class SliderChallengeResponse {
 
     private boolean enabled;
     private String challengeId;
+    /** 带缺口的底图，data URI。 */
+    private String background;
+    /** 滑块块图，data URI。 */
+    private String slider;
+    /** 滑块块的初始纵坐标（缺口 y 与之一致，故纵向无需拖动）。 */
+    private Integer sliderY;
 
     public boolean isEnabled() {
         return enabled;
@@ -23,4 +32,28 @@ public String getChallengeId() {
     public void setChallengeId(String challengeId) {
         this.challengeId = challengeId;
     }
+
+    public String getBackground() {
+        return background;
+    }
+
+    public void setBackground(String background) {
+        this.background = background;
+    }
+
+    public String getSlider() {
+        return slider;
+    }
+
+    public void setSlider(String slider) {
+        this.slider = slider;
+    }
+
+    public Integer getSliderY() {
+        return sliderY;
+    }
+
+    public void setSliderY(Integer sliderY) {
+        this.sliderY = sliderY;
+    }
 }

OpenBlog-business/src/main/java/com/yqz/openblog/user/dto/SliderCompleteRequest.java

@@ -2,16 +2,69 @@
 
 import jakarta.validation.constraints.NotBlank;
 
+import java.util.List;
+
+/**
+ * 滑动验证提交：落点 x 与拖动轨迹。
+ * <p>
+ * {@code x} 用包装类型而非 {@code int}：缺字段时得到 4001「请先完成滑动验证」，
+ * 与其它滑块失败同码，而不是落到参数校验的通用错误码上。轨迹各字段同理。
+ */
 public class SliderCompleteRequest {
 
     @NotBlank
     private String challengeId;
 
+    /** 滑块最终横向落点（像素，原点为底图左边缘）。 */
+    private Integer x;
+
+    /** 拖动采样轨迹，按时间递增。用于识别"算出答案后瞬移过去"的机器行为。 */
+    private List<TrailPoint> trail;
+
     public String getChallengeId() {
         return challengeId;
     }
 
     public void setChallengeId(String challengeId) {
         this.challengeId = challengeId;
     }
+
+    public Integer getX() {
+        return x;
+    }
+
+    public void setX(Integer x) {
+        this.x = x;
+    }
+
+    public List<TrailPoint> getTrail() {
+        return trail;
+    }
+
+    public void setTrail(List<TrailPoint> trail) {
+        this.trail = trail;
+    }
+
+    /** 轨迹采样点：{@code t} 为相对拖动开始的毫秒偏移。 */
+    public static class TrailPoint {
+
+        private Integer x;
+        private Long t;
+
+        public Integer getX() {
+            return x;
+        }
+
+        public void setX(Integer x) {
+            this.x = x;
+        }
+
+        public Long getT() {
+            return t;
+        }
+
+        public void setT(Long t) {
+            this.t = t;
+        }
+    }
 }

OpenBlog-business/src/main/java/com/yqz/openblog/user/service/AuthService.java

@@ -45,7 +45,6 @@ public class AuthService {
     private final JwtService jwtService;
     private final com.yqz.openblog.security.JwtProperties jwtProperties;
     private final CurrentUser currentUser;
-    private final SliderVerificationService sliderVerificationService;
     private final LoginLockoutService loginLockoutService;
     private final AccountDeviceService accountDeviceService;
     private final MediaService mediaService;
@@ -65,7 +64,6 @@ public AuthService(UserMapper userMapper,
                         JwtService jwtService,
                         com.yqz.openblog.security.JwtProperties jwtProperties,
                         CurrentUser currentUser,
-                        SliderVerificationService sliderVerificationService,
                         LoginLockoutService loginLockoutService,
                         AccountDeviceService accountDeviceService,
                         MediaService mediaService,
@@ -77,7 +75,6 @@ public AuthService(UserMapper userMapper,
         this.jwtService = jwtService;
         this.jwtProperties = jwtProperties;
         this.currentUser = currentUser;
-        this.sliderVerificationService = sliderVerificationService;
         this.loginLockoutService = loginLockoutService;
         this.accountDeviceService = accountDeviceService;
         this.mediaService = mediaService;
@@ -88,7 +85,6 @@ public AuthService(UserMapper userMapper,
     }
 
     public AuthResponse register(RegisterRequest req) {
-        sliderVerificationService.verifyAndConsume(req.getSliderChallengeId());
         // 用户名归一化：去掉首尾空白（DTO 层 @Pattern 已禁空白字符，此处为绕过校验的内部调用兜底）
         String username = req.getUsername() == null ? null : req.getUsername().trim();
 
@@ -141,7 +137,6 @@ public AuthResponse login(LoginRequest req) {
         String fp = currentDeviceFingerprint();
         loginLockoutService.assertNotLocked(ipSeg);
         loginLockoutService.assertNotDeviceLocked(fp);
-        sliderVerificationService.verifyAndConsume(req.getSliderChallengeId());
 
         User user = userMapper.selectOne(Wrappers.lambdaQuery(User.class).eq(User::getUsername, req.getAccount()));
         if (user == null) {

OpenBlog-business/src/main/java/com/yqz/openblog/user/service/EmailCodeService.java

@@ -52,6 +52,7 @@ public class EmailCodeService {
     private final AuthSecurityProperties authSecurityProperties;
     private final UserMapper userMapper;
     private final EmailValidator emailValidator;
+    private final SliderVerificationService sliderVerificationService;
 
     /** Dubbo 调统一通知服务。retries=0：同步链路 messageId 为空 → 渠道每次生成新幂等键，重试会重复发信。 */
     @DubboReference(retries = 0, timeout = 5000)
@@ -60,21 +61,28 @@ public class EmailCodeService {
     public EmailCodeService(RedisOps redisOps,
                             AuthSecurityProperties authSecurityProperties,
                             UserMapper userMapper,
-                            EmailValidator emailValidator) {
+                            EmailValidator emailValidator,
+                            SliderVerificationService sliderVerificationService) {
         this.redisOps = redisOps;
         this.authSecurityProperties = authSecurityProperties;
         this.userMapper = userMapper;
         this.emailValidator = emailValidator;
+        this.sliderVerificationService = sliderVerificationService;
     }
 
     /**
      * 发送验证码到指定邮箱，返回冷却秒数（供前端倒计时）。
      * purpose=register：邮箱需未注册（注册流程）；purpose=reset：邮箱需已注册（找回/修改密码流程），
-     * 主题与邮件模板随用途区分。前置流程：邮箱格式白名单 → 注册态校验 → 冷却检查 →
+     * 主题与邮件模板随用途区分。前置流程：滑动验证 → 邮箱格式白名单 → 注册态校验 → 冷却检查 →
      * 生成 6 位码入 Redis → 通知层发信（Email 渠道 → Dubbo）。
      * 发信失败时删除已落库的验证码与冷却键，让用户可立即重试。
+     * <p>
+     * 滑动验证必须排在冷却 SETNX <b>之前</b>：冷却键是「发信前占位」，若滑块在占位之后再校验，
+     * 一次失败的滑块会白占满一个冷却周期，用户需空等才能重试（与下方两个 catch 释放冷却同源）。
+     * 置于最前则滑块失败直接抛 4001，完全不触碰冷却键。
      */
-    public int sendCode(String rawEmail, String purpose) {
+    public int sendCode(String rawEmail, String purpose, String sliderChallengeId) {
+        sliderVerificationService.verifyAndConsume(sliderChallengeId);
         String email = normalizeEmail(rawEmail);
 
         String emailError = emailValidator.validate(email);