黑马点评：短信登录与 Redis 用户态 DTO

import java.util.*;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.*;

public class Main {
  record Key(String subject, String purpose) {}
  record Challenge(String code, long expiresAt, int attemptsLeft) {}
  static final class OtpStore {
    private final Map<Key,Challenge> records = new HashMap<>();
    synchronized void issue(Key key, String code, long expiresAt) {
      if (key.subject()==null || key.subject().isBlank() || key.purpose()==null ||
          key.purpose().isBlank() || code==null || !code.matches("[0-9]{6}") || expiresAt<=0)
        throw new IllegalArgumentException("challenge");
      records.put(key,new Challenge(code,expiresAt,3)); // 新发行使同用途旧码失效
    }
    synchronized boolean verify(Key key, String supplied, long now) {
      if (now<0) throw new IllegalArgumentException("time");
      Challenge c=records.get(key);
      if (c==null) return false;
      if (now>=c.expiresAt()) { records.remove(key); return false; } // 到期边界不再有效
      boolean format=supplied!=null && supplied.matches("[0-9]{6}");
      boolean equal=format && MessageDigest.isEqual(
          c.code().getBytes(StandardCharsets.US_ASCII),
          supplied.getBytes(StandardCharsets.US_ASCII));
      if (equal) { records.remove(key); return true; } // 匹配与消费在同一原子边界内
      if (c.attemptsLeft()==1) records.remove(key);
      else records.put(key,new Challenge(c.code(),c.expiresAt(),c.attemptsLeft()-1));
      return false; // 格式错误也消耗现存挑战的验证预算
    }
  }
  static void check(boolean ok) { if(!ok) throw new AssertionError(); }
  public static void main(String[] args) throws Exception {
    OtpStore s=new OtpStore();
    Key login=new Key("account-1","LOGIN"), reset=new Key("account-1","RESET");
    s.issue(login,"123456",100);
    check(!s.verify(login,"000000",1) && s.verify(login,"123456",2));
    check(!s.verify(login,"123456",3));
    s.issue(login,"123456",100);
    check(!s.verify(login,"123456",100));
    s.issue(login,"123456",200);
    check(!s.verify(login,"x",101) && !s.verify(login,"000000",102) &&
          !s.verify(login,"111111",103) && !s.verify(login,"123456",104));
    s.issue(login,"123456",200); s.issue(login,"654321",200);
    check(!s.verify(login,"123456",110) && s.verify(login,"654321",111));
    s.issue(login,"123456",200); s.issue(reset,"654321",200);
    check(s.verify(reset,"654321",112) && s.verify(login,"123456",112));
    check(!s.verify(new Key("missing","LOGIN"),"123456",113));
    s.issue(login,"123456",200);
    ExecutorService pool=Executors.newFixedThreadPool(2);
    CountDownLatch start=new CountDownLatch(1);
    try {
      Callable<Boolean> call=() -> { start.await(); return s.verify(login,"123456",120); };
      Future<Boolean> a=pool.submit(call), b=pool.submit(call);
      start.countDown();
      check((a.get()?1:0)+(b.get()?1:0)==1); // 并发重放只能消费成功一次
    } finally { pool.shutdownNow(); }
    System.out.println("8 OTP lifecycle checks passed");
  }
}