《游戏服务端编程实践》4.3.3 第三方账号绑定

// file: ch04/oauth/binding.go
// tier: L1
// verify: go test ./ch04/oauth/
package oauth

import (
	"context"
	"errors"
	"sync"
	"time"
)

var (
	ErrBindingExists  = errors.New("oauth: external id already bound")
	ErrBindingMissing = errors.New("oauth: binding not found")
	ErrLastAuthMethod = errors.New("oauth: cannot unbind the last login method")
	ErrRebindCooldown = errors.New("oauth: external id is in rebind cooldown")
)

type Binding struct {
	AccountID  string
	Provider   ProviderKind
	ExternalID string
	CreatedAt  time.Time
	UnboundAt  *time.Time
}

type BindingStore interface {
	Bind(ctx context.Context, accountID string, id Identity) (Binding, error)
	Unbind(ctx context.Context, accountID string, provider ProviderKind) error
	Resolve(ctx context.Context, provider ProviderKind, externalID string) (string, error)
}

type MemoryBindingStore struct {
	mu       sync.Mutex
	now      func() time.Time
	cooldown time.Duration
	active   map[string]Binding
	owners   map[string]string
	released map[string]time.Time
	history  []Binding
}

func NewMemoryBindingStore(cooldown time.Duration) *MemoryBindingStore {
	return &MemoryBindingStore{
		now:      time.Now,
		cooldown: cooldown,
		active:   make(map[string]Binding),
		owners:   make(map[string]string),
		released: make(map[string]time.Time),
	}
}

func accountKey(accountID string, provider ProviderKind) string {
	return accountID + "|" + string(provider)
}

func externalKey(provider ProviderKind, externalID string) string {
	return string(provider) + "|" + externalID
}

func (s *MemoryBindingStore) Bind(_ context.Context, accountID string, id Identity) (Binding, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	if accountID == "" || id.ExternalID == "" {
		return Binding{}, ErrBindingMissing
	}
	ek := externalKey(id.Provider, id.ExternalID)
	ak := accountKey(accountID, id.Provider)
	if owner, ok := s.owners[ek]; ok {
		if owner == accountID {
			if b, ok := s.active[ak]; ok && b.ExternalID == id.ExternalID {
				return b, nil
			}
		}
		return Binding{}, ErrBindingExists
	}
	if at, ok := s.released[ek]; ok && s.now().Before(at.Add(s.cooldown)) {
		return Binding{}, ErrRebindCooldown
	}
	if _, ok := s.active[ak]; ok {
		return Binding{}, ErrBindingExists
	}
	b := Binding{AccountID: accountID, Provider: id.Provider, ExternalID: id.ExternalID, CreatedAt: s.now()}
	s.active[ak] = b
	s.owners[ek] = accountID
	delete(s.released, ek)
	s.history = append(s.history, b)
	return b, nil
}

func (s *MemoryBindingStore) Unbind(_ context.Context, accountID string, provider ProviderKind) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	ak := accountKey(accountID, provider)
	b, ok := s.active[ak]
	if !ok {
		return ErrBindingMissing
	}
	if s.activeCountLocked(accountID) <= 1 {
		return ErrLastAuthMethod
	}
	now := s.now()
	b.UnboundAt = &now
	delete(s.active, ak)
	delete(s.owners, externalKey(provider, b.ExternalID))
	s.released[externalKey(provider, b.ExternalID)] = now
	s.history = append(s.history, b)
	return nil
}

func (s *MemoryBindingStore) Resolve(_ context.Context, provider ProviderKind, externalID string) (string, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	accountID, ok := s.owners[externalKey(provider, externalID)]
	if !ok {
		return "", ErrBindingMissing
	}
	return accountID, nil
}

func (s *MemoryBindingStore) History() []Binding {
	s.mu.Lock()
	defer s.mu.Unlock()
	out := make([]Binding, len(s.history))
	copy(out, s.history)
	return out
}

func (s *MemoryBindingStore) activeCountLocked(accountID string) int {
	n := 0
	for _, b := range s.active {
		if b.AccountID == accountID {
			n++
		}
	}
	return n
}

// file: ch04/oauth/binding_test.go
// tier: L1
// verify: go test ./ch04/oauth/
package oauth

import (
	"context"
	"errors"
	"testing"
	"time"
)

func googleIdentity(id string) Identity {
	return Identity{Provider: Google, ExternalID: id}
}

func TestBindRejectsSameExternalIDOnAnotherAccount(t *testing.T) {
	store := NewMemoryBindingStore(time.Hour)
	ctx := context.Background()
	if _, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1")); err != nil {
		t.Fatalf("first bind: %v", err)
	}
	if _, err := store.Bind(ctx, "acc-2", googleIdentity("sub-1")); !errors.Is(err, ErrBindingExists) {
		t.Fatalf("cross-account bind: got %v, want %v", err, ErrBindingExists)
	}
}

func TestBindRejectsSecondRecordForSameProvider(t *testing.T) {
	store := NewMemoryBindingStore(time.Hour)
	ctx := context.Background()
	if _, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1")); err != nil {
		t.Fatalf("first bind: %v", err)
	}
	if _, err := store.Bind(ctx, "acc-1", googleIdentity("sub-2")); !errors.Is(err, ErrBindingExists) {
		t.Fatalf("second google binding: got %v, want %v", err, ErrBindingExists)
	}
}

func TestResolveFailsAfterUnbindAndRespectsCooldown(t *testing.T) {
	store := NewMemoryBindingStore(time.Hour)
	ctx := context.Background()
	if _, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1")); err != nil {
		t.Fatalf("bind google: %v", err)
	}
	if _, err := store.Bind(ctx, "acc-1", Identity{Provider: WeChat, ExternalID: "openid-1"}); err != nil {
		t.Fatalf("bind wechat: %v", err)
	}
	if err := store.Unbind(ctx, "acc-1", Google); err != nil {
		t.Fatalf("unbind: %v", err)
	}
	if _, err := store.Resolve(ctx, Google, "sub-1"); !errors.Is(err, ErrBindingMissing) {
		t.Fatalf("resolve after unbind: got %v, want %v", err, ErrBindingMissing)
	}
	if _, err := store.Bind(ctx, "acc-2", googleIdentity("sub-1")); !errors.Is(err, ErrRebindCooldown) {
		t.Fatalf("rebind during cooldown: got %v, want %v", err, ErrRebindCooldown)
	}
}

func TestUnbindRejectsLastLoginMethod(t *testing.T) {
	store := NewMemoryBindingStore(time.Hour)
	ctx := context.Background()
	if _, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1")); err != nil {
		t.Fatalf("bind: %v", err)
	}
	if err := store.Unbind(ctx, "acc-1", Google); !errors.Is(err, ErrLastAuthMethod) {
		t.Fatalf("unbind last method: got %v, want %v", err, ErrLastAuthMethod)
	}
	if got, err := store.Resolve(ctx, Google, "sub-1"); err != nil || got != "acc-1" {
		t.Fatalf("binding should survive: got %q, %v", got, err)
	}
}

func TestBindIsIdempotent(t *testing.T) {
	store := NewMemoryBindingStore(time.Hour)
	ctx := context.Background()
	first, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1"))
	if err != nil {
		t.Fatalf("first bind: %v", err)
	}
	second, err := store.Bind(ctx, "acc-1", googleIdentity("sub-1"))
	if err != nil {
		t.Fatalf("idempotent bind: %v", err)
	}
	if !first.CreatedAt.Equal(second.CreatedAt) {
		t.Fatalf("idempotent bind changed createdAt: %v != %v", first.CreatedAt, second.CreatedAt)
	}
}