239 lines
7.3 KiB
Python
239 lines
7.3 KiB
Python
"""认证模块"""
|
|
from datetime import datetime, timedelta
|
|
from typing import Optional
|
|
|
|
from redis import exceptions as redis_exceptions
|
|
from fastapi import Depends, HTTPException, status, Request
|
|
from fastapi.security import OAuth2PasswordBearer
|
|
from jose import JWTError, jwt
|
|
|
|
from app.core.context import current_user_dept_id
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.core.config import settings
|
|
from app.core.database import get_db
|
|
from app.core.redis_client import get_sync_redis_client
|
|
from app.crud.user import user_crud
|
|
from app.services.web_auth_roles import resolve_web_role_for_user
|
|
|
|
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/public/login")
|
|
|
|
REFRESH_TOKEN_EXPIRE_DAYS = 7
|
|
REFRESH_TOKEN_EXPIRE_SECONDS = int(timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS).total_seconds())
|
|
|
|
|
|
def _session_key(session_id: str) -> str:
|
|
return f"auth:sessions:{session_id}"
|
|
|
|
|
|
def _refresh_key(refresh_jti: str) -> str:
|
|
return f"auth:refresh:{refresh_jti}"
|
|
|
|
|
|
def _redis_call_safe(fn):
|
|
"""同步 Redis 调用；失败时返回 None 供调用方降级。"""
|
|
r = get_sync_redis_client()
|
|
if r is None:
|
|
return None
|
|
try:
|
|
return fn(r)
|
|
except (redis_exceptions.TimeoutError, redis_exceptions.ConnectionError, redis_exceptions.RedisError):
|
|
return None
|
|
|
|
|
|
def store_session(session_id: str, user_id: str) -> None:
|
|
"""写入会话（用于强制失效）"""
|
|
_redis_call_safe(lambda r: r.set(_session_key(session_id), user_id, ex=REFRESH_TOKEN_EXPIRE_SECONDS))
|
|
|
|
|
|
def revoke_session(session_id: str) -> None:
|
|
"""撤销会话（登出/强制失效）"""
|
|
_redis_call_safe(lambda r: r.delete(_session_key(session_id)))
|
|
|
|
|
|
def extend_session(session_id: str) -> None:
|
|
"""刷新会话 TTL（已登录用户每次 API 校验通过后滑动续期）"""
|
|
if not session_id:
|
|
return
|
|
_redis_call_safe(lambda r: r.expire(_session_key(session_id), REFRESH_TOKEN_EXPIRE_SECONDS))
|
|
|
|
|
|
def is_session_valid(session_id: str) -> bool:
|
|
"""检查会话是否仍然有效"""
|
|
if get_sync_redis_client() is None:
|
|
return True
|
|
if not session_id:
|
|
return False
|
|
exists = _redis_call_safe(lambda r: r.exists(_session_key(session_id)))
|
|
if exists is None:
|
|
return True
|
|
return exists > 0
|
|
|
|
|
|
def store_refresh_token(refresh_jti: str, user_id: str) -> None:
|
|
"""写入 refreshToken（用于 one-time 使用/吊销）"""
|
|
_redis_call_safe(
|
|
lambda r: r.set(_refresh_key(refresh_jti), user_id, ex=REFRESH_TOKEN_EXPIRE_SECONDS)
|
|
)
|
|
|
|
|
|
def is_refresh_token_valid(refresh_jti: str) -> bool:
|
|
if get_sync_redis_client() is None:
|
|
return True
|
|
if not refresh_jti:
|
|
return False
|
|
exists = _redis_call_safe(lambda r: r.exists(_refresh_key(refresh_jti)))
|
|
if exists is None:
|
|
return True
|
|
return exists > 0
|
|
|
|
|
|
def revoke_refresh_token(refresh_jti: str) -> None:
|
|
_redis_call_safe(lambda r: r.delete(_refresh_key(refresh_jti)))
|
|
|
|
|
|
def create_access_token(
|
|
data: dict,
|
|
session_id: str,
|
|
token_jti: str,
|
|
expires_delta: Optional[timedelta] = None,
|
|
) -> str:
|
|
"""创建JWT访问令牌"""
|
|
to_encode = data.copy()
|
|
if expires_delta:
|
|
expire = datetime.utcnow() + expires_delta
|
|
else:
|
|
expire = datetime.utcnow() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
|
|
to_encode.update(
|
|
{
|
|
"exp": expire,
|
|
"type": "access",
|
|
"sid": session_id,
|
|
"jti": token_jti,
|
|
}
|
|
)
|
|
encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
return encoded_jwt
|
|
|
|
|
|
def create_refresh_token(data: dict, session_id: str, refresh_jti: str) -> str:
|
|
"""创建刷新令牌"""
|
|
to_encode = data.copy()
|
|
expire = datetime.utcnow() + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
|
|
to_encode.update(
|
|
{
|
|
"exp": expire,
|
|
"type": "refresh",
|
|
"sid": session_id,
|
|
"jti": refresh_jti,
|
|
}
|
|
)
|
|
encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
return encoded_jwt
|
|
|
|
|
|
def decode_token(token: str) -> dict:
|
|
"""解码JWT令牌"""
|
|
try:
|
|
payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
|
|
return payload
|
|
except JWTError:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="无效的认证凭据",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
|
|
def get_current_user_by_token(token: str, db: Session) -> dict:
|
|
"""根据 token 获取当前用户（包含 Redis 会话校验；会话滑动续期）"""
|
|
payload = decode_token(token)
|
|
|
|
user_id: str = payload.get("sub")
|
|
session_id: str = payload.get("sid")
|
|
|
|
if not is_session_valid(session_id):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Token无效或已过期",
|
|
)
|
|
|
|
extend_session(session_id)
|
|
|
|
if user_id is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="无效的认证凭据",
|
|
)
|
|
|
|
user = user_crud.get(db, user_id)
|
|
if not user or getattr(user, "del_flag", 0) != 0:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="用户不存在或已删除",
|
|
)
|
|
|
|
if getattr(user, "status", "1") != "1":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="用户已被禁用",
|
|
)
|
|
|
|
web_role = resolve_web_role_for_user(db, user.id)
|
|
|
|
phone = (getattr(user, "phone_no", None) or "").strip() or None
|
|
email = (getattr(user, "email", None) or "").strip() or None
|
|
avatar = getattr(user, "avatar", None)
|
|
|
|
current_user_dept_id.set(user.dept_id or "")
|
|
|
|
tenant_no = (getattr(user, "tenant_no", None) or "").strip() or settings.DEFAULT_TENANT_NO
|
|
|
|
return {
|
|
"user_id": user.id,
|
|
"username": user.user_no,
|
|
"real_name": user.nick_name,
|
|
"role": web_role,
|
|
"region_id": user.dept_id,
|
|
"tenant_no": tenant_no,
|
|
"phone": phone,
|
|
"email": email,
|
|
"avatar_url": avatar,
|
|
"is_active": user.status == "1",
|
|
}
|
|
|
|
|
|
def get_current_user(
|
|
token: str = Depends(oauth2_scheme),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""获取当前用户（sync 依赖，配合 sync 路由在线程池执行，避免阻塞事件循环）。"""
|
|
return get_current_user_by_token(token, db)
|
|
|
|
|
|
def get_current_user_simple(token: str = Depends(oauth2_scheme)) -> dict:
|
|
"""简化版获取当前用户（不查数据库）"""
|
|
payload = decode_token(token)
|
|
user_id: str = payload.get("sub")
|
|
if user_id is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="无效的认证凭据",
|
|
)
|
|
current_user_dept_id.set(payload.get("region_id") or "")
|
|
return {
|
|
"user_id": user_id,
|
|
"username": payload.get("username"),
|
|
"role": payload.get("role"),
|
|
"region_id": payload.get("region_id"),
|
|
"real_name": payload.get("real_name"),
|
|
}
|
|
|
|
|
|
def get_client_ip(request: Request) -> str:
|
|
"""获取客户端IP"""
|
|
forwarded = request.headers.get("X-Forwarded-For")
|
|
if forwarded:
|
|
return forwarded.split(",")[0].strip()
|
|
return request.client.host if request.client else "unknown"
|