188 lines
7.2 KiB
Python
188 lines
7.2 KiB
Python
"""Auth: 两条 login 路径,签同款 JWT(§7 D' 过渡形态)。
|
|
|
|
模型:
|
|
- `PLATFORM_KEY` env(必填):platform 服务端 / zcbot 间机器对机器共享密钥
|
|
- `JWT_SECRET` env(必填):HS256 签 token;泄漏 = 任意伪造,与 PLATFORM_KEY 同级保护
|
|
- `POST /v1/auth/login {user_id, platform_key}` → JWT(platform 服务端用,自带 user_id 注入)
|
|
- `POST /v1/auth/login_password {email, password}` → JWT
|
|
(dev SPA 用,users.email UNIQUE + users.password_hash bcrypt 校验;0005 加 UNIQUE)
|
|
- 后续 `/v1/*`(除 /healthz、/docs、/openapi.json、/、/v1/auth/login*)走 `Authorization: Bearer <jwt>`
|
|
- Token TTL: `ZCBOT_JWT_TTL_SECONDS` env 覆盖,默 7 天
|
|
|
|
发用户:`.venv/Scripts/python.exe main.py user add --email X --password Y`,后台直接
|
|
bcrypt + INSERT users;撤用户 `DELETE FROM users WHERE email=...`(messages CASCADE,
|
|
tasks 通过 FK 拦,要先 DELETE 该 user 的 tasks)。
|
|
|
|
OIDC(D')替换:只动 `/v1/auth/login` 实现(校验 ID token 代替 key);password 路径
|
|
真发布时下线。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import time
|
|
from typing import Optional
|
|
from uuid import UUID
|
|
|
|
import bcrypt
|
|
import jwt
|
|
from fastapi import Depends, HTTPException
|
|
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
|
from sqlalchemy import select
|
|
|
|
from core.storage import session_scope
|
|
from core.storage.models import User
|
|
|
|
|
|
_DEFAULT_TTL_SECONDS = 7 * 24 * 3600 # 7d
|
|
|
|
|
|
class AuthConfig:
|
|
"""App 启动时一次性读 env + 校验存在性;create_app 调 `AuthConfig.from_env()` 拿到。"""
|
|
|
|
def __init__(self, platform_key: str, jwt_secret: str, ttl_seconds: int):
|
|
self.platform_key = platform_key
|
|
self.jwt_secret = jwt_secret
|
|
self.ttl_seconds = ttl_seconds
|
|
|
|
@classmethod
|
|
def from_env(cls) -> "AuthConfig":
|
|
key = os.environ.get("PLATFORM_KEY", "").strip()
|
|
secret = os.environ.get("JWT_SECRET", "").strip()
|
|
missing = []
|
|
if not key:
|
|
missing.append("PLATFORM_KEY")
|
|
if not secret:
|
|
missing.append("JWT_SECRET")
|
|
if missing:
|
|
raise RuntimeError(
|
|
f"{', '.join(missing)} env not set. zcbot web requires both:\n"
|
|
" PLATFORM_KEY=<shared secret between platform and zcbot>\n"
|
|
" JWT_SECRET=<HMAC secret used to sign session tokens>"
|
|
)
|
|
ttl_raw = os.environ.get("ZCBOT_JWT_TTL_SECONDS", "").strip()
|
|
try:
|
|
ttl = int(ttl_raw) if ttl_raw else _DEFAULT_TTL_SECONDS
|
|
except ValueError:
|
|
raise RuntimeError(
|
|
f"ZCBOT_JWT_TTL_SECONDS must be int seconds, got {ttl_raw!r}"
|
|
)
|
|
if ttl <= 0:
|
|
raise RuntimeError(f"ZCBOT_JWT_TTL_SECONDS must be > 0, got {ttl}")
|
|
return cls(platform_key=key, jwt_secret=secret, ttl_seconds=ttl)
|
|
|
|
|
|
def hash_password(password: str) -> str:
|
|
"""bcrypt 哈希(默认 cost=12)。返 ASCII str(bcrypt 标准格式 `$2b$12$...`),直接落 DB。"""
|
|
return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
|
|
|
|
|
|
def verify_password(password: str, stored_hash: str) -> bool:
|
|
"""常数时间比对。stored_hash 是 DB 里 users.password_hash 列。"""
|
|
try:
|
|
return bcrypt.checkpw(password.encode("utf-8"), stored_hash.encode("ascii"))
|
|
except (ValueError, TypeError):
|
|
# stored_hash 格式坏(手工 INSERT 乱写)/ 不是 ASCII → 视作不匹配,别 500
|
|
return False
|
|
|
|
|
|
def resolve_user_by_email(email: str, password: str) -> Optional[tuple[UUID, str]]:
|
|
"""email + password → `(user_id, email)`;不匹配返 None(空表 / 邮箱不存在 / 密码错都走这条)。
|
|
|
|
单次 SELECT + bcrypt verify;不缓存,改密码 / 删账号下次 login 立即生效。
|
|
bcrypt.checkpw 本身是 constant-time;查不到也要跑一次 dummy hash 防 timing oracle
|
|
(5 人级别用户无所谓,但顺手做)。
|
|
"""
|
|
e = (email or "").strip().lower()
|
|
if not e or not password:
|
|
return None
|
|
with session_scope() as s:
|
|
row = s.execute(
|
|
select(User.user_id, User.email, User.password_hash).where(User.email == e)
|
|
).first()
|
|
if row is None:
|
|
# 避免 timing oracle:用户不存在时也跑一次同等开销的 verify
|
|
bcrypt.checkpw(b"x", b"$2b$12$" + b"." * 53)
|
|
return None
|
|
if not row.password_hash:
|
|
return None # 用户存在但没设密码(platform_key 入口建的)
|
|
if not verify_password(password, row.password_hash):
|
|
return None
|
|
return row.user_id, row.email
|
|
|
|
|
|
def mint_token(cfg: AuthConfig, user_id: UUID) -> tuple[str, int]:
|
|
"""签 JWT。返回 `(token, exp_unix_seconds)`。"""
|
|
now = int(time.time())
|
|
exp = now + cfg.ttl_seconds
|
|
payload = {"sub": str(user_id), "iat": now, "exp": exp}
|
|
token = jwt.encode(payload, cfg.jwt_secret, algorithm="HS256")
|
|
return token, exp
|
|
|
|
|
|
def verify_token(cfg: AuthConfig, token: str) -> UUID:
|
|
"""验签 + 取 sub。失败抛 HTTPException 401。"""
|
|
try:
|
|
payload = jwt.decode(token, cfg.jwt_secret, algorithms=["HS256"])
|
|
except jwt.ExpiredSignatureError:
|
|
raise HTTPException(401, "token expired")
|
|
except jwt.InvalidTokenError as e:
|
|
raise HTTPException(401, f"invalid token: {e}")
|
|
sub = payload.get("sub", "")
|
|
try:
|
|
return UUID(sub)
|
|
except (ValueError, TypeError):
|
|
raise HTTPException(401, f"invalid sub in token: {sub!r}")
|
|
|
|
|
|
def ensure_user_row(user_id: UUID) -> None:
|
|
"""幂等 INSERT 一行 users 占位(`ON CONFLICT DO NOTHING`)。
|
|
|
|
platform_key 登录入口用 — 平台直传的 user_id 可能是 zcbot 没见过的,首次登录建行
|
|
避免下游 FK 失败。邮箱密码登录走 `main.py user add` 已经写好 users 行,不走这条。
|
|
"""
|
|
from sqlalchemy.dialects.postgresql import insert
|
|
stmt = insert(User).values(user_id=user_id).on_conflict_do_nothing(
|
|
index_elements=["user_id"]
|
|
)
|
|
with session_scope() as s:
|
|
s.execute(stmt)
|
|
|
|
|
|
# ──────────────── FastAPI Depends ────────────────
|
|
# auto_error=False 让我们自己出 401 文案,而不是 FastAPI 默认 "Not authenticated"
|
|
_bearer = HTTPBearer(auto_error=False)
|
|
|
|
|
|
def make_require_user(cfg: AuthConfig):
|
|
"""工厂:返回一个 Depends 函数,闭包持有 cfg(避免 app 启动后改 env)。
|
|
|
|
用法:
|
|
require_user = make_require_user(cfg)
|
|
@app.get("/v1/...", dependencies=[Depends(require_user)])
|
|
def route(user_id: UUID = Depends(require_user)):
|
|
...
|
|
实际使用建议直接 `user_id: UUID = Depends(require_user)`,既验签又拿到 user_id。
|
|
"""
|
|
async def require_user(
|
|
creds: Optional[HTTPAuthorizationCredentials] = Depends(_bearer),
|
|
) -> UUID:
|
|
if creds is None or not creds.credentials:
|
|
raise HTTPException(401, "missing Authorization: Bearer <token>")
|
|
if creds.scheme.lower() != "bearer":
|
|
raise HTTPException(401, f"unsupported auth scheme: {creds.scheme!r}")
|
|
return verify_token(cfg, creds.credentials)
|
|
|
|
return require_user
|
|
|
|
|
|
__all__ = [
|
|
"AuthConfig",
|
|
"ensure_user_row",
|
|
"hash_password",
|
|
"make_require_user",
|
|
"mint_token",
|
|
"resolve_user_by_email",
|
|
"verify_password",
|
|
"verify_token",
|
|
]
|