feat: 优化发布清单和安装结构自动识别
This commit is contained in:
@@ -0,0 +1,248 @@
|
||||
import json
|
||||
import re
|
||||
from datetime import datetime, timezone
|
||||
from sqlite3 import IntegrityError
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Request
|
||||
|
||||
from app.core.security import (
|
||||
AdminPrincipal,
|
||||
ROLE_NAMES,
|
||||
ROLE_PERMISSIONS,
|
||||
admin_auth,
|
||||
decode_jwt_token,
|
||||
hash_password,
|
||||
normalize_roles,
|
||||
parse_utc_text,
|
||||
require_permission,
|
||||
token_digest,
|
||||
token_response_for_user,
|
||||
verify_password,
|
||||
)
|
||||
from app.repositories import admin_user_repository
|
||||
from app.schemas.admin_auth import (
|
||||
AdminLoginRequest,
|
||||
AdminUserCreateRequest,
|
||||
AdminUserResetPasswordRequest,
|
||||
AdminUserStatusRequest,
|
||||
AdminUserUpdateRequest,
|
||||
ChangePasswordRequest,
|
||||
RefreshTokenRequest,
|
||||
)
|
||||
|
||||
|
||||
router = APIRouter(tags=["admin-auth"])
|
||||
|
||||
VALID_ROLES = set(ROLE_PERMISSIONS.keys())
|
||||
|
||||
|
||||
def validate_username(username: str) -> str:
|
||||
value = username.strip()
|
||||
if not re.fullmatch(r"[A-Za-z0-9_.@-]{3,64}", value):
|
||||
raise HTTPException(status_code=400, detail="用户名只能包含字母、数字、下划线、点、@ 和短横线，长度 3-64")
|
||||
return value
|
||||
|
||||
|
||||
def validate_password(password: str) -> str:
|
||||
value = password.strip()
|
||||
if len(value) < 8:
|
||||
raise HTTPException(status_code=400, detail="密码至少需要 8 个字符")
|
||||
if len(value) > 128:
|
||||
raise HTTPException(status_code=400, detail="密码不能超过 128 个字符")
|
||||
return value
|
||||
|
||||
|
||||
def validate_roles(roles: list[str]) -> list[str]:
|
||||
result = []
|
||||
for role in roles:
|
||||
value = str(role).strip()
|
||||
if value:
|
||||
result.append(value)
|
||||
if not result:
|
||||
raise HTTPException(status_code=400, detail="至少选择一个角色")
|
||||
invalid = [role for role in result if role not in VALID_ROLES]
|
||||
if invalid:
|
||||
raise HTTPException(status_code=400, detail=f"未知角色：{', '.join(invalid)}")
|
||||
return result
|
||||
|
||||
|
||||
def public_user(row) -> dict:
|
||||
return {
|
||||
"id": row["id"],
|
||||
"username": row["username"],
|
||||
"display_name": row["display_name"] or row["username"],
|
||||
"roles": normalize_roles(row["roles"]),
|
||||
"status": row["status"],
|
||||
"created_at": row["created_at"],
|
||||
"updated_at": row["updated_at"],
|
||||
"last_login_at": row["last_login_at"],
|
||||
}
|
||||
|
||||
|
||||
def role_options() -> list[dict]:
|
||||
return [
|
||||
{
|
||||
"value": role,
|
||||
"label": ROLE_NAMES.get(role, role),
|
||||
"permissions": permissions,
|
||||
}
|
||||
for role, permissions in ROLE_PERMISSIONS.items()
|
||||
]
|
||||
|
||||
|
||||
@router.post("/login")
|
||||
def login(body: AdminLoginRequest, request: Request):
|
||||
username = body.username.strip()
|
||||
password = body.password
|
||||
row = admin_user_repository.get_user(username)
|
||||
if not row or row["status"] != "active" or not verify_password(password, row["password_hash"]):
|
||||
raise HTTPException(status_code=401, detail="用户名或密码错误")
|
||||
admin_user_repository.mark_login(username)
|
||||
return token_response_for_user(row, request)
|
||||
|
||||
|
||||
@router.post("/refresh-token")
|
||||
def refresh_token(body: RefreshTokenRequest, request: Request):
|
||||
payload = decode_jwt_token(body.refreshToken.strip(), "refresh")
|
||||
token_id = str(payload.get("jti") or "")
|
||||
username = str(payload.get("sub") or "")
|
||||
row = admin_user_repository.get_refresh_token(token_id)
|
||||
if not row or row["username"] != username or row["revoked_at"]:
|
||||
raise HTTPException(status_code=401, detail="刷新令牌无效")
|
||||
if row["token_hash"] != token_digest(body.refreshToken.strip()):
|
||||
raise HTTPException(status_code=401, detail="刷新令牌无效")
|
||||
if parse_utc_text(row["expires_at"]) <= datetime.now(timezone.utc):
|
||||
raise HTTPException(status_code=401, detail="刷新令牌已过期")
|
||||
user_row = admin_user_repository.get_user(username)
|
||||
if not user_row or user_row["status"] != "active":
|
||||
raise HTTPException(status_code=401, detail="管理员账号不存在或已禁用")
|
||||
admin_user_repository.revoke_refresh_token(token_id)
|
||||
return token_response_for_user(user_row, request)
|
||||
|
||||
|
||||
@router.get("/admin/auth/check")
|
||||
def admin_auth_check(principal: AdminPrincipal = Depends(admin_auth)):
|
||||
return {
|
||||
"code": 0,
|
||||
"msg": "管理员登录凭证有效",
|
||||
"username": principal.username,
|
||||
"nickname": principal.display_name,
|
||||
"roles": principal.roles,
|
||||
"permissions": principal.permissions,
|
||||
"auth_type": principal.auth_type,
|
||||
}
|
||||
|
||||
|
||||
@router.get("/admin/user/list")
|
||||
def admin_user_list(principal: AdminPrincipal = Depends(require_permission("admin:manage"))):
|
||||
return {
|
||||
"code": 0,
|
||||
"list": [public_user(row) for row in admin_user_repository.list_users()],
|
||||
"roles": role_options(),
|
||||
"current_username": principal.username,
|
||||
}
|
||||
|
||||
|
||||
@router.post("/admin/user/create")
|
||||
def admin_user_create(
|
||||
body: AdminUserCreateRequest,
|
||||
principal: AdminPrincipal = Depends(require_permission("admin:manage")),
|
||||
):
|
||||
username = validate_username(body.username)
|
||||
password = validate_password(body.password)
|
||||
roles = validate_roles(body.roles)
|
||||
display_name = body.display_name.strip() or username
|
||||
try:
|
||||
admin_user_repository.create_user(
|
||||
username,
|
||||
hash_password(password),
|
||||
display_name,
|
||||
json.dumps(roles, ensure_ascii=False),
|
||||
"active",
|
||||
)
|
||||
except IntegrityError:
|
||||
raise HTTPException(status_code=409, detail="用户名已存在")
|
||||
return {"code": 0, "msg": "管理员用户已创建"}
|
||||
|
||||
|
||||
@router.post("/admin/user/update")
|
||||
def admin_user_update(
|
||||
body: AdminUserUpdateRequest,
|
||||
principal: AdminPrincipal = Depends(require_permission("admin:manage")),
|
||||
):
|
||||
username = validate_username(body.username)
|
||||
row = admin_user_repository.get_user(username)
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail="管理员用户不存在")
|
||||
roles = validate_roles(body.roles)
|
||||
old_roles = normalize_roles(row["roles"])
|
||||
if "super_admin" in old_roles and "super_admin" not in roles:
|
||||
active_super_admins = admin_user_repository.count_active_super_admins()
|
||||
if row["status"] == "active" and active_super_admins <= 1:
|
||||
raise HTTPException(status_code=400, detail="不能移除最后一个可用超级管理员")
|
||||
display_name = body.display_name.strip() or username
|
||||
admin_user_repository.update_user_profile(
|
||||
username,
|
||||
display_name,
|
||||
json.dumps(roles, ensure_ascii=False),
|
||||
)
|
||||
return {"code": 0, "msg": "管理员用户已更新"}
|
||||
|
||||
|
||||
@router.post("/admin/user/status")
|
||||
def admin_user_status(
|
||||
body: AdminUserStatusRequest,
|
||||
principal: AdminPrincipal = Depends(require_permission("admin:manage")),
|
||||
):
|
||||
username = validate_username(body.username)
|
||||
status = body.status.strip()
|
||||
if status not in {"active", "disabled"}:
|
||||
raise HTTPException(status_code=400, detail="状态只能是 active 或 disabled")
|
||||
row = admin_user_repository.get_user(username)
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail="管理员用户不存在")
|
||||
roles = normalize_roles(row["roles"])
|
||||
if status == "disabled" and "super_admin" in roles:
|
||||
active_super_admins = admin_user_repository.count_active_super_admins()
|
||||
if row["status"] == "active" and active_super_admins <= 1:
|
||||
raise HTTPException(status_code=400, detail="不能禁用最后一个可用超级管理员")
|
||||
if username == principal.username and status == "disabled":
|
||||
raise HTTPException(status_code=400, detail="不能禁用当前登录账号")
|
||||
admin_user_repository.set_user_status(username, status)
|
||||
if status == "disabled":
|
||||
admin_user_repository.revoke_refresh_tokens_for_user(username)
|
||||
return {"code": 0, "msg": "管理员用户状态已更新"}
|
||||
|
||||
|
||||
@router.post("/admin/user/password/reset")
|
||||
def admin_user_reset_password(
|
||||
body: AdminUserResetPasswordRequest,
|
||||
principal: AdminPrincipal = Depends(require_permission("admin:manage")),
|
||||
):
|
||||
username = validate_username(body.username)
|
||||
new_password = validate_password(body.new_password)
|
||||
row = admin_user_repository.get_user(username)
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail="管理员用户不存在")
|
||||
admin_user_repository.update_password(username, hash_password(new_password))
|
||||
admin_user_repository.revoke_refresh_tokens_for_user(username)
|
||||
return {"code": 0, "msg": "管理员密码已重置"}
|
||||
|
||||
|
||||
@router.post("/admin/user/password/change")
|
||||
def change_password(
|
||||
body: ChangePasswordRequest,
|
||||
principal: AdminPrincipal = Depends(require_permission("admin:access")),
|
||||
):
|
||||
if principal.auth_type == "legacy_token":
|
||||
raise HTTPException(status_code=400, detail="兼容令牌登录不能修改用户密码，请使用用户名密码登录")
|
||||
new_password = body.new_password.strip()
|
||||
if len(new_password) < 8:
|
||||
raise HTTPException(status_code=400, detail="新密码至少需要 8 个字符")
|
||||
if len(new_password) > 128:
|
||||
raise HTTPException(status_code=400, detail="新密码不能超过 128 个字符")
|
||||
row = admin_user_repository.get_user(principal.username)
|
||||
if not row or not verify_password(body.current_password, row["password_hash"]):
|
||||
raise HTTPException(status_code=403, detail="当前密码错误")
|
||||
admin_user_repository.update_password(principal.username, hash_password(new_password))
|
||||
return {"code": 0, "msg": "密码已更新，请重新登录"}
|
||||
Reference in New Issue
Block a user