caiping/app/admin/controller/Login.php

<?php
/**
 * @copyright Copyright (c) 2021 勾股工作室
 * @license https://opensource.org/licenses/Apache-2.0
 * @link https://www.gougucms.com
 */

declare (strict_types = 1);

namespace app\admin\controller;

use app\admin\validate\UserCheck;
use think\exception\ValidateException;
use think\facade\Db;
use think\facade\Session;

class Login
{
    //登录
    public function index()
    {
        return View();
    }
    private $loginAttempts = [];
    private $maxAttempts = 5;
    private $lockDuration = 600; // 10 minutes

    //提交登录
    public function login_submit()
    {
        $param = get_params();
        // dump($param);
        try {
            validate(UserCheck::class)->check($param);
        } catch (ValidateException $e) {
            // 验证失败 输出错误信息
            return to_assign(1, $e->getError());
        }

        $ip = request()->ip();

        if (isset($this->loginAttempts[$ip])) {
            if ($this->loginAttempts[$ip]['count'] >= $this->maxAttempts &&
                time() - $this->loginAttempts[$ip]['last_attempt'] < $this->lockDuration) {
                return to_assign(1, '登录尝试次数过多，请稍后再试');
            } elseif (time() - $this->loginAttempts[$ip]['last_attempt'] >= $this->lockDuration) {
                $this->loginAttempts[$ip]['count'] = 0;
            }
        }

        $admin = Db::name('Admin')->where(['username' => $param['username']])->find();
        if (empty($admin)) {
            $this->recordFailedAttempt($ip);
            return to_assign(1, '用户名或密码错误');
        }
        $param['pwd'] = set_password($param['password'], $admin['salt']);
        if ($admin['pwd'] !== $param['pwd']) {
            $this->recordFailedAttempt($ip);
            return to_assign(1, '用户名或密码错误');
        }

        if ($admin['status'] !== 1) {
            return to_assign(1, '该用户禁止登录,请于系统所有者联系');
        }

        $data = [
            'last_login_time' => time(),
            'last_login_ip' => request()->ip(),
            'login_num' => $admin['login_num'] + 1,
        ];
        Db::name('admin')->where(['id' => $admin['id']])->update($data);
        $session_admin = get_config('app.session_admin');   // gougu_admin

        Session::set($session_admin, $admin);   // null
        $token = make_token();
        set_cache($token, $admin, 7200);
        $admin['token'] = $token;
        add_log('login', $admin['id'], $data);//添加登录日志

        return to_assign(0, '登录成功', ['uid' => $admin['id']]);
    }
    private function recordFailedAttempt($ip) {
        if (!isset($this->loginAttempts[$ip])) {
            $this->loginAttempts[$ip] = ['count' => 0, 'last_attempt' => 0];
//            halt($this->loginAttempts[$ip]);
        }
        $this->loginAttempts[$ip]['count']++;
        $this->loginAttempts[$ip]['last_attempt'] = time();
    }
    //退出登录
    public function login_out()
    {
        $session_admin = get_config('app.session_admin');
        Session::delete($session_admin);
        //redirect('/')->send();
        return to_assign(0, "退出成功");
    }
}