【安全加密】撞库防护：登录接口的频控与画像

---login: 玩家登录触发，失败频控
function login(actor)
    local ip = Login.ipOf(actor)
    local uid = actor:GetUserId()
    local fails = Login.failCount(ip, uid)
    if fails >= 5 then
        local wait = math.min(2 ^ (fails - 5) * 30, 1800)
        sendmsg(actor, 1, "尝试过于频繁，请 " .. wait .. " 秒后再试")
        return false
    end
    Login.recordSuccess(uid, ip)
    return true
end

---密码错误时的计数
function Login.onWrongPass(uid, ip)
    Login.bump(ip)
    Login.bump(uid)
end

---登录画像：新设备与异地加验
function Login.riskCheck(actor)
    local devId = actor:GetDeviceId()
    local known = Login.knownDevices(actor:GetUserId())
    if not known[devId] then
        local ipRegion = Login.regionOf(actor)
        if ipRegion ~= Login.usualRegion(actor:GetUserId()) then
            -- 新设备且异地：要求二级校验
            sendmsg(actor, 1, "检测到新设备登录，请输入仓库密码")
            return "challenge"
        end
    end
    return "pass"
end