create schema vulnscan_platform

-- 1. 用户表
CREATE TABLE `users` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '用户唯一标识',
  `username` varchar(50) NOT NULL COMMENT '用户名，用于登录',
  `password_hash` varchar(255) NOT NULL COMMENT '加密后的密码',
  `email` varchar(100) DEFAULT NULL COMMENT '电子邮箱',
  `role` varchar(20) NOT NULL DEFAULT 'USER' COMMENT '角色：ADMIN, USER',
  `is_active` tinyint(1) NOT NULL DEFAULT '1' COMMENT '账户是否启用（1启用，0禁用）',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '账户创建时间',
  `updated_at` timestamp NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP COMMENT '最后更新时间',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_users_username` (`username`),
  KEY `idx_users_role` (`role`),
  KEY `idx_users_created_at` (`created_at`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='系统用户表';

-- 2. 扫描任务主表
CREATE TABLE `scan_tasks` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '任务唯一标识',
  `user_id` bigint NOT NULL COMMENT '任务创建者ID',
  `task_name` varchar(100) NOT NULL COMMENT '任务名称',
  `target` text NOT NULL COMMENT '扫描目标（IP、域名、URL，支持逗号分隔）',
  `scan_policy` varchar(50) NOT NULL DEFAULT 'FULL' COMMENT '扫描策略：QUICK, FULL, WEB_ONLY等',
  `status` varchar(20) NOT NULL DEFAULT 'PENDING' COMMENT '任务状态：PENDING, RUNNING, COMPLETED, FAILED, CANCELLED',
  `progress` tinyint DEFAULT '0' COMMENT '任务进度（0-100）',
  `start_time` timestamp NULL DEFAULT NULL COMMENT '任务开始执行时间',
  `end_time` timestamp NULL DEFAULT NULL COMMENT '任务结束时间',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '任务创建时间',
  PRIMARY KEY (`id`),
  KEY `idx_tasks_user_id` (`user_id`),
  KEY `idx_tasks_status` (`status`),
  KEY `idx_tasks_created_at` (`created_at`),
  CONSTRAINT `fk_tasks_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='扫描任务主表';

CREATE TABLE `task_status_logs` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '日志ID',
  `task_id` bigint NOT NULL COMMENT '关联的任务ID',
  `stage` varchar(50) NOT NULL COMMENT '当前阶段：PORT_SCAN, WEB_CRAWL, VULN_SCAN等',
  `status` varchar(20) NOT NULL COMMENT '阶段状态：START, SUCCESS, WARNING, ERROR',
  `message` text COMMENT '状态详细信息或错误日志',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '日志记录时间',
  PRIMARY KEY (`id`),
  KEY `idx_logs_task_id` (`task_id`),
  KEY `idx_logs_created_at` (`created_at`),
  CONSTRAINT `fk_logs_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='任务状态详细日志表';

CREATE TABLE `assets` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '资产ID',
  `task_id` bigint NOT NULL COMMENT '所属扫描任务ID',
  `ip_address` varchar(45) DEFAULT NULL COMMENT 'IP地址（支持IPv6）',
  `hostname` varchar(255) DEFAULT NULL COMMENT '主机名',
  `os_guess` varchar(100) DEFAULT NULL COMMENT '猜测的操作系统',
  `last_seen` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '最后一次被发现的时间',
  PRIMARY KEY (`id`),
  KEY `idx_assets_task_id` (`task_id`),
  KEY `idx_assets_ip` (`ip_address`),
  CONSTRAINT `fk_assets_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='发现的网络资产表';

-- 5. 端口表
CREATE TABLE `ports` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '端口记录ID',
  `asset_id` bigint NOT NULL COMMENT '所属资产ID',
  `port_number` int NOT NULL COMMENT '端口号',
  `protocol` varchar(10) DEFAULT 'tcp' COMMENT '协议：tcp, udp',
  `service_name` varchar(100) DEFAULT NULL COMMENT '服务名称（如ssh, http）',
  `version_info` varchar(255) DEFAULT NULL COMMENT '服务版本信息',
  `state` varchar(20) NOT NULL DEFAULT 'unknown' COMMENT '端口状态：open, closed, filtered, unknown',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_ports_asset_port` (`asset_id`, `port_number`, `protocol`), -- 防止重复记录
  KEY `idx_ports_service` (`service_name`),
  CONSTRAINT `fk_ports_asset_id` FOREIGN KEY (`asset_id`) REFERENCES `assets` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='资产开放端口及服务表';

CREATE TABLE `vulnerabilities` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '漏洞记录ID',
  `task_id` bigint NOT NULL COMMENT '发现该漏洞的任务ID',
  `asset_id` bigint DEFAULT NULL COMMENT '关联的资产ID（可为空，如纯域名漏洞）',
  `port_id` bigint DEFAULT NULL COMMENT '关联的端口ID（可为空）',
  `vuln_type` varchar(50) NOT NULL COMMENT '漏洞类型：SQLi, XSS, WEAK_PASSWORD等',
  `title` varchar(255) NOT NULL COMMENT '漏洞标题',
  `risk_level` varchar(20) NOT NULL DEFAULT 'MEDIUM' COMMENT '风险等级：CRITICAL, HIGH, MEDIUM, LOW, INFO',
  `is_fixed` tinyint(1) NOT NULL DEFAULT '0' COMMENT '是否已修复（0未修复，1已修复）',
  `discovered_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '漏洞发现时间',
  PRIMARY KEY (`id`),
  KEY `idx_vulns_task_id` (`task_id`),
  KEY `idx_vulns_asset_id` (`asset_id`),
  KEY `idx_vulns_risk_level` (`risk_level`), -- 便于按风险级别筛选
  KEY `idx_vulns_discovered_at` (`discovered_at`),
  CONSTRAINT `fk_vulns_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_vulns_asset_id` FOREIGN KEY (`asset_id`) REFERENCES `assets` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_vulns_port_id` FOREIGN KEY (`port_id`) REFERENCES `ports` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='漏洞主表';

CREATE TABLE `vulnerability_details` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '详情ID',
  `vulnerability_id` bigint NOT NULL COMMENT '关联的漏洞ID',
  `description` text COMMENT '漏洞详细描述',
  `proof` text COMMENT '漏洞证据（如请求/响应包）',
  `recommendation` text COMMENT '修复建议',
  `cve_id` varchar(20) DEFAULT NULL COMMENT '关联的CVE编号（如CVE-2021-12345）',
  `scanner_source` varchar(50) DEFAULT NULL COMMENT '发现此漏洞的扫描器或插件名称',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_details_vuln_id` (`vulnerability_id`), -- 确保一个漏洞只有一条详情记录
  KEY `idx_details_cve_id` (`cve_id`),
  CONSTRAINT `fk_details_vuln_id` FOREIGN KEY (`vulnerability_id`) REFERENCES `vulnerabilities` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='漏洞详情表';

CREATE TABLE `reports` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '报告ID',
  `task_id` bigint NOT NULL COMMENT '关联的扫描任务ID',
  `user_id` bigint NOT NULL COMMENT '报告生成者ID',
  `title` varchar(255) NOT NULL COMMENT '报告标题',
  `summary` json DEFAULT NULL COMMENT '报告摘要JSON（包含统计信息）',
  `file_path` varchar(500) DEFAULT NULL COMMENT '生成的报告文件（PDF/HTML）存储路径',
  `generated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '报告生成时间',
  PRIMARY KEY (`id`),
  KEY `idx_reports_task_id` (`task_id`),
  KEY `idx_reports_user_id` (`user_id`),
  CONSTRAINT `fk_reports_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_reports_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='扫描报告表';

com.xueqiu.vulnscanpro
├── controller       # 接口层
│   ├── api
│   └── advice
├── service          # 业务逻辑层（处理任务管理、权限控制）
│   ├── impl
├── mapper           # 数据访问层
│
├── engine           # 核心执行层（放置 ScanEngine, NmapParser 等）
│
├── model            # 实体与 DTO
│   ├── entity
│   ├── dto
│   │   ├── request
│   │   └── response
│   └── vo
└── config           # 配置类等

<!--    lombok依赖    -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>

<!--   mybatis依赖     -->
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.3.0</version>
        </dependency>

package com.xueqiu.vulnscanpro.model.entity;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import java.time.LocalDateTime;

// 用户实体类
@Data
@NoArgsConstructor
@AllArgsConstructor
public class Users {
    private Long id;
    private String username;
    private String passwordHash;
    private String email;
    private String role;
    private Boolean isActive;
    private LocalDateTime createdAt;
    private LocalDateTime updatedAt;
}

<!--   Spring Security依赖   -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

package com.xueqiu.vulnscanpro.config;

@Configuration
@EnableWebSecurity // 该注解启用 Spring Security 的 web 安全功能。
@EnableMethodSecurity
@RequiredArgsConstructor // 配合private final 依赖注入
public class SecurityConfig {
    
    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    /**
     *
     * 配置http安全规则
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 禁用CSRF、CORS、表单登录、HTTP Basic 认证（API项目通常不需要）
            .csrf(csrf -> csrf.disable())
            .cors(cors -> cors.disable())
            .formLogin(form -> form.disable())
            .httpBasic(basic -> basic.disable())

            // 配置会话管理为无状态（适合前后端分离）
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

            // 配置授权规则
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/**").permitAll()  // 测试暂时允许所有接口访问

                   /*

                    // 公开访问的接口（不需要登录）
                    .requestMatchers("/api/auth/**").permitAll()  // 放行认证相关接口
                    // 其他所有请求都需要认证
                    .anyRequest().authenticated()

                    */
            )


                // 添加jwt过滤器
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)

                // ✅ 添加异常处理
                .exceptionHandling(ex -> ex
                        // 未认证时返回 401
                        .authenticationEntryPoint((request, response, authException) -> {
                            response.setStatus(401);
                            response.setContentType("application/json;charset=UTF-8");
                            response.getWriter().write("{\"error\":\"未登录，请先登录\"}");
                        })
                        // 没有权限时返回 403
                        .accessDeniedHandler((request, response, accessDeniedException) -> {
                            response.setStatus(403);
                            response.setContentType("application/json;charset=UTF-8");
                            response.getWriter().write("{\"error\":\"权限不足\"}");
                        })
                );

        return http.build();
    }

    /**
     *
     * 密码加密器配置
     */
    @Bean
    public PasswordEncoder passwordEncoder(){
        // 使用BCrypt强哈希算法加密密码
        return new BCryptPasswordEncoder();
    }


    /**
     * AuthenticationManager Bean（登录时需要用到）
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }


}

package com.xueqiu.vulnscanpro.service.impl;


@Slf4j
@Service
@RequiredArgsConstructor
public class UserDetailsServiceImpl implements UserDetailsService {

    private final UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        User user = userMapper.selectByUsername(username);

        log.info("从数据库查出的用户实体: id={}, username={}", user.getId(), user.getUsername());

        if (user == null) {
            throw new UsernameNotFoundException("用户不存在: " + username);
        }

        // 转换为 自定义的CustomUserDetails
        return new CustomUserDetails(
                user.getId(),
                user.getUsername(),
                user.getPasswordHash(),
                user.getIsActive(),
                Collections.singletonList(new SimpleGrantedAuthority("ROLE_" + user.getRole()))
        );
    }
}

<!--        jwt依赖     -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.11.5</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>

jwt:
	secret: "输入64B长度的字符串作为密钥" 
	expiration-ms: 86400000 # 24小时（单位：毫秒）

package com.xueqiu.vulnscanpro.utils;


@Slf4j
@Component
public class JwtTokenProvider {

    @Value ("${jwt.secret}")
    private String jwtSecret;

    @Value("${jwt.expiration-ms}")
    private long jwtExpirationInMs;

    private Key key;  // 密钥对象 用于登录时签名生成token 验证时校验token

    // 初始化加载密钥
    @PostConstruct
    public void init(){

        byte[] keyBytes = Decoders.BASE64.decode(jwtSecret);
        log.info("原始密钥字节长度: {} 位 ({}字节)", keyBytes.length * 8, keyBytes.length);
        if (keyBytes.length < 64) { // HS512需要至少64字节
            log.error("密钥长度不足！需要至少64字节(512位)，当前仅{}字节。", keyBytes.length);
            // 方案1: 抛异常让应用启动失败
            throw new IllegalArgumentException("JWT密钥长度不足，请使用至少64字节的Base64密钥");
        }

        // 将密钥字符串转换为Key对象
        this.key = Keys.hmacShaKeyFor(keyBytes);

        log.info("JWT密钥初始化成功，密钥长度: {} 位", keyBytes.length * 8);
    }


    /**
     * 根据认证信息生成JWT令牌
     */
    public String generateToken(Authentication authentication) {

        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();

        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + jwtExpirationInMs);

        // 将权限列表转换为逗号分隔的字符串
        String authorities = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(","));

        return Jwts.builder()
                .setSubject(userDetails.getUsername())
                .claim("userId", userDetails.getId())  // 将 userId 存入 Claim
                .claim("authorities",authorities) // 自定义声明：权限
                .setIssuedAt(now)
                .setExpiration(expiryDate)
                .signWith(key, SignatureAlgorithm.HS512)
                .compact();
    }


    /**
     * 从 Token 中提取用户名
     */
    public String getUsernameFromToken(String token) {

        Claims claims = Jwts.parserBuilder()
                .setSigningKey(key)
                .build()
                .parseClaimsJws(token)
                .getBody();

        return claims.getSubject();
    }


    // 从 Token 中提取 userId
    public Long getUserIdFromToken(String token) {
        Claims claims = Jwts.parserBuilder()
                .setSigningKey(key).build()
                .parseClaimsJws(token).getBody();
        return claims.get("userId", Long.class);
    }


    /**
     * 验证JWT令牌是否有效
     */
    public boolean validateToken(String token) {
        try {
            Jwts.parserBuilder()
                    .setSigningKey(key)
                    .build()
                    .parseClaimsJws(token);
            return true;
        } catch (SecurityException | MalformedJwtException e) {
            log.error("无效的JWT签名", e);
        } catch (ExpiredJwtException e) {
            log.error("JWT令牌已过期", e);
        } catch (UnsupportedJwtException e) {
            log.error("不支持的JWT令牌", e);
        } catch (IllegalArgumentException e) {
            log.error("JWT claims字符串为空", e);
        } catch (Exception e) {
            log.error("验证JWT令牌时发生错误", e);
        }
        return false;
    }


    /**
     *
     * 返回jwt令牌过期时间
     */
    public long getJwtExpirationInMs(){
        return jwtExpirationInMs;
    }



}

package com.xueqiu.vulnscanpro.filter;


@Slf4j
@Component
@RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtTokenProvider jwtTokenProvider;
//    private final UserDetailsService userDetailsService;


    private String getTokenFromRequest(HttpServletRequest request){
        String bearerToken = request.getHeader("Authorization");
        if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }


    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain) throws ServletException, IOException {

        try {
            // 1. 从请求头获取 Token
            String token = getTokenFromRequest(request);

            // 2. 验证 Token
            if(token != null && jwtTokenProvider.validateToken(token)){

                // 从 Token 中提取 ID
                Long userId = jwtTokenProvider.getUserIdFromToken(token);

                // 3. 从 Token 中提取用户名
                String username = jwtTokenProvider.getUsernameFromToken(token);


                // 4. 加载用户详情
//                UserDetails userDetails = userDetailsService.loadUserByUsername(username);

                CustomUserDetails userDetails = new CustomUserDetails(userId, username, "",true, new ArrayList<>()); // enabled先默认为true

                // 5. 创建认证对象
                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());

                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

                // 6. 设置到 Security Context
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }

        }
        catch (Exception e){
            log.error("无法设置用户认证");
        }

        filterChain.doFilter(request, response); // 过滤器放行
    }


}

<!--       Jakarta 数据验证依赖   -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

// LoginResponse类
package com.xueqiu.vulnscanpro.model.dto.response;

import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;

@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class LoginResponse {
    // JWT访问令牌
    private String accessToken;
    // 令牌类型，通常是 "Bearer"
    private String tokenType = "Bearer";
    // 令牌过期时间（毫秒时间戳）
    private Long expiresIn;
    // 用户基本信息
    private UserInfo userInfo;

    @Data
    @Builder
    public static class UserInfo{
        private Long id;
        private String username;
        private String email;
        private String role;
    }
}

<dependency>
    <groupId>cn.hutool</groupId>
    <artifactId>hutool-all</artifactId>
    <version>5.8.26</version> </dependency>

@GetMapping("/captcha")
public ApiResponse getCaptcha(){
    // 1. 生成线段干扰的验证码，宽100，高40
    LineCaptcha lineCaptcha = CaptchaUtil.createLineCaptcha(100,40);

    // 2. 获取验证码的字符（例如 "A1B2"）
    String code = lineCaptcha.getCode();

    // 3. 生成一个唯一标识符 (UUID)
    String uuid = UUID.randomUUID().toString();

    // 4. 存入 Store (如果是 Redis，设置过期时间比如 2 分钟)
    CAPTCHA_STORE.put(uuid,code);

    // 5. 将图片转为 Base64
    String imageBase64 = lineCaptcha.getImageBase64();

    // 6. 返回给前端：UUID 和 Base64图片
    Map<String, String> result = new HashMap<>();
    result.put("uuid", uuid);
    result.put("image", "data:image/png;base64," + imageBase64); // 前端可以直接放到 src 里

    return ApiResponse.success(result);

}

package com.xueqiu.vulnscanpro.model.dto.request;

import jakarta.validation.constraints.NotBlank;
import lombok.Data;

@Data
public class LoginRequest {
    @NotBlank(message = "用户名不能为空")
    private String username;

    @NotBlank(message = "密码不能为空")
    private String password;

    @NotBlank(message = "请输入验证码")
    private String captchaCode;  // 用户输入的验证码

    private String captchaUuid;  // 获取图片时拿到的 ID
    
}

 @PostMapping("/login")
    public ApiResponse login(@Valid @RequestBody LoginRequest loginRequest){

        log.info("=== 开始处理登录请求 ===");
        log.info("登录请求:{}", loginRequest);

        // 1. === 校验验证码逻辑 ===
        String uuid = loginRequest.getCaptchaUuid();
        String userInputCode = loginRequest.getCaptchaCode();

        // 从存储中取出正确答案
        String correctCode = CAPTCHA_STORE.get(uuid);

        if (correctCode == null) {
            return ApiResponse.error("验证码已过期，请刷新");
        }

        // 校验（不区分大小写）
        if (!correctCode.equalsIgnoreCase(userInputCode)) {
            return ApiResponse.error("验证码错误");
        }

        // 验证通过后，记得移除这个 Key，防止重复使用
        CAPTCHA_STORE.remove(uuid);

        try {
            // 调用Service进行认证并获取令牌
            LoginResponse loginResponse = authService.login(loginRequest);

            // 使用统一的成功响应格式返回
            return ApiResponse.success("登录成功",loginResponse);

        }
        catch (Exception e){
            log.error("登录失败");
            return ApiResponse.error("账号或密码错误");

        }
    }