验证码优化

src/Jiaowu.Api/Controllers/AuthController.cs

@@ -4,6 +4,7 @@ using Jiaowu.Api.Domain.Academic;
 using Jiaowu.Api.Domain.Identity;
 using Jiaowu.Api.Infrastructure.Auth;
 using Jiaowu.Api.Infrastructure.Caching;
+using Lazy.Captcha.Core;
 using Jiaowu.Api.Infrastructure.Persistence;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
@@ -20,7 +21,7 @@ public sealed class AuthController(
     UserManager<ApplicationUser> userManager,
     IAuthSessionService authSessionService,
     ITwoFactorLoginTicketService twoFactorTickets,
-    ILoginCaptchaService loginCaptcha,
+    ICaptcha captcha,
     IAppCache cache) : ControllerBase
 {
     [AllowAnonymous]
@@ -139,30 +140,13 @@ public sealed class AuthController(
     [AllowAnonymous]
     [EnableRateLimiting("public-auth")]
     [HttpPost("login/captcha")]
-    public async Task<ActionResult<LoginCaptchaChallenge>> CreateLoginCaptcha(
-        LoginCaptchaCreateRequest request,
-        CancellationToken cancellationToken) =>
-        Ok(await loginCaptcha.CreateAsync(request.DeviceId, HttpContext, cancellationToken));
-
-    [AllowAnonymous]
-    [EnableRateLimiting("public-auth")]
-    [HttpPost("login/captcha/verify")]
-    public async Task<ActionResult<LoginCaptchaProofResponse>> VerifyLoginCaptcha(
-        LoginCaptchaVerifyRequest request,
-        CancellationToken cancellationToken)
+    public ActionResult<LazyLoginCaptchaResponse> CreateLoginCaptcha()
     {
-        var proof = await loginCaptcha.VerifyAsync(
-            new LoginCaptchaVerification(
-                request.ChallengeId,
-                request.DeviceId,
-                request.Text,
-                request.SliderX,
-                request.Clicks),
-            HttpContext,
-            cancellationToken);
-        return proof is null
-            ? Unauthorized(LoginCaptchaProblem())
-            : Ok(new LoginCaptchaProofResponse(proof));
+        var captchaId = Guid.NewGuid().ToString("N");
+        var generated = captcha.Generate(captchaId, expirySeconds: 120);
+        return Ok(new LazyLoginCaptchaResponse(
+            captchaId,
+            $"data:image/gif;base64,{Convert.ToBase64String(generated.Bytes)}"));
     }
 
     [AllowAnonymous]
@@ -172,11 +156,7 @@ public sealed class AuthController(
         LoginRequest request,
         CancellationToken cancellationToken)
     {
-        if (!await loginCaptcha.ConsumeProofAsync(
-                request.CaptchaTicket,
-                request.DeviceId,
-                HttpContext,
-                cancellationToken))
+        if (!captcha.Validate(request.CaptchaId, request.CaptchaCode))
             return Unauthorized(LoginCaptchaProblem());
         var user = await userManager.FindByNameAsync(request.UserName);
         if (user is null || !user.IsEnabled)
@@ -350,20 +330,11 @@ public sealed class AuthController(
 public sealed record LoginRequest(
     [Required, MaxLength(100)] string UserName,
     [Required, MaxLength(100)] string Password,
-    [Required, MinLength(32), MaxLength(128)] string CaptchaTicket,
-    [MaxLength(128)] string? DeviceId = null,
+    [Required, MinLength(16), MaxLength(64)] string CaptchaId,
+    [Required, MinLength(3), MaxLength(16)] string CaptchaCode,
     bool IsNativeApp = false);
 
-public sealed record LoginCaptchaCreateRequest([MaxLength(128)] string? DeviceId = null);
-
-public sealed record LoginCaptchaVerifyRequest(
-    [Required, MinLength(32), MaxLength(64)] string ChallengeId,
-    [MaxLength(128)] string? DeviceId,
-    [MaxLength(16)] string? Text,
-    [Range(0, 240)] int? SliderX,
-    [MaxLength(2)] IReadOnlyList<CaptchaPoint>? Clicks);
-
-public sealed record LoginCaptchaProofResponse(string CaptchaTicket);
+public sealed record LazyLoginCaptchaResponse(string CaptchaId, string ImageData);
 
 public sealed record TotpLoginRequest(
     [Required, MinLength(20), MaxLength(2048)] string TwoFactorTicket,