"""公共接口（Web 登录、刷新 Token、登出；用户模型对齐 docs/sql/zkxw.sql 基线）""" import os from typing import Optional from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile, File from sqlalchemy.exc import OperationalError from sqlalchemy.orm import Session from app.core.database import get_db from app.core.security import verify_password from app.core.auth import ( create_access_token, create_refresh_token, decode_token, get_current_user_by_token, extend_session, is_refresh_token_valid, is_session_valid, revoke_refresh_token, revoke_session, store_refresh_token, store_session, ) from app.core.response import success_response, error_response from app.core.config import settings from app.core.storage import storage from app.core.avatar_url import extract_avatar_storage_key from app.models.models import SysUser from app.crud.user import user_crud from app.core.utils import generate_uuid from app.core import login_crypto from app.services.web_auth_roles import ( get_user_role_names, iter_user_menu_perm_codes, resolve_web_role_for_user, user_has_active_roles, ) from app.schemas.auth import ProfileUpdateRequest from app.crud.user import update_user, change_password router = APIRouter(prefix="", tags=["公共接口"]) def _avatar_url_field(user: SysUser) -> Optional[str]: """返回库中原始头像路径，由前端按 VITE_MINIO_BASE_URL 拼展示 URL。""" raw = getattr(user, "avatar", None) if not raw: return None s = str(raw).strip() return s if s else None def _build_user_info_payload(user: SysUser, web_role: str, role_names: list = None) -> dict: """与 web-admin `userInfo` 字段约定一致。""" phone = (getattr(user, "phone_no", None) or "").strip() or None return { "id": user.id, "username": user.user_no, "realName": user.nick_name, "phone": phone, "email": (getattr(user, "email", None) or "").strip() or None, "sex": getattr(user, "sex", None) or "0", "remark": (getattr(user, "remark", None) or "").strip() or None, "role": web_role, "roleNames": role_names or [], "regionId": user.dept_id, "regionName": None, "avatarUrl": _avatar_url_field(user), } def _build_current_user_payload(current_user: dict) -> dict: """组装 current-user 接口响应。""" au = current_user.get("avatar_url") avatar_url = str(au).strip() if au else None return { "id": current_user.get("user_id"), "username": current_user.get("username"), "realName": current_user.get("real_name"), "phone": current_user.get("phone"), "email": current_user.get("email"), "sex": current_user.get("sex") or "0", "remark": current_user.get("remark"), "role": current_user.get("role"), "roleNames": current_user.get("role_names") or current_user.get("roleNames") or [], "isSuperAdmin": current_user.get("role") == "super_admin", "regionId": current_user.get("region_id"), "regionName": None, "regionIds": [], "isActive": current_user.get("is_active"), "avatarUrl": avatar_url if avatar_url else None, } async def _resolve_current_user_from_request(request: Request, db: Session) -> dict: authorization = request.headers.get("Authorization", "") if not authorization.startswith("Bearer "): raise HTTPException(status_code=401, detail="未授权") token = authorization.replace("Bearer ", "") return await get_current_user_by_token(token=token, db=db) def _jwt_user_payload(user: SysUser, web_role: str) -> dict: return { "sub": user.id, "username": user.user_no, "role": web_role, "region_id": user.dept_id, "real_name": user.nick_name, } @router.get("/web/auth/login-rsa-public-key", response_model=dict) async def web_login_rsa_public_key(): """Web 端登录用 RSA 公钥（PKCS#1 v1.5，与 JSEncrypt 一致）""" login_crypto.ensure_initialized() return success_response({"publicKeyPem": login_crypto.get_public_pem()}) @router.post("/web/auth/login", response_model=dict) async def web_login( request: Request, body: dict, db: Session = Depends(get_db), ): """Web 端登录：账号为 sys_user.user_no，密码为 sys_user.password（bcrypt）。""" login_crypto.ensure_initialized() user_no, password, cred_err = login_crypto.extract_login_credentials(body) if cred_err: return error_response(400, cred_err) user = user_crud.get_by_user_no(db, user_no) if not user: return error_response(401, "用户名或密码错误") pwd_hash = getattr(user, "password", None) or "" if not verify_password(password, pwd_hash): return error_response(401, "用户名或密码错误") if user.status != "1": return error_response(403, "账号已被停用，请联系管理员") if not user_has_active_roles(db, user.id): return error_response(403, "账号未分配角色，请联系管理员") web_role = resolve_web_role_for_user(db, user.id) role_names = get_user_role_names(db, user.id) session_id = generate_uuid() access_jti = generate_uuid() refresh_jti = generate_uuid() access_token = create_access_token( data=_jwt_user_payload(user, web_role), session_id=session_id, token_jti=access_jti, ) refresh_token = create_refresh_token( data={ "sub": user.id, "username": user.user_no, "role": web_role, }, session_id=session_id, refresh_jti=refresh_jti, ) await store_session(session_id=session_id, user_id=user.id) await store_refresh_token(refresh_jti=refresh_jti, user_id=user.id) return success_response( { "token": access_token, "refreshToken": refresh_token, "expiresIn": settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60, "userInfo": _build_user_info_payload(user, web_role, role_names), } ) @router.post("/web/auth/refresh-token", response_model=dict) async def refresh_token(body: dict, db: Session = Depends(get_db)): """刷新 Token""" refresh_token_val = body.get("refreshToken") if not refresh_token_val: return error_response(400, "refreshToken不能为空") try: payload = decode_token(refresh_token_val) if payload.get("type") != "refresh": return error_response(401, "无效的refreshToken") session_id = payload.get("sid") refresh_jti = payload.get("jti") if not await is_session_valid(session_id=session_id): return error_response(401, "refreshToken已失效，请重新登录") if not await is_refresh_token_valid(refresh_jti=refresh_jti): return error_response(401, "无效的refreshToken") user_id = payload.get("sub") user = user_crud.get(db, user_id) if not user or user.del_flag != 0 or user.status != "1": return error_response(401, "用户不存在或已禁用") web_role = resolve_web_role_for_user(db, user.id) await revoke_refresh_token(refresh_jti=refresh_jti) await extend_session(session_id=session_id) new_access_jti = generate_uuid() new_refresh_jti = generate_uuid() new_access_token = create_access_token( data=_jwt_user_payload(user, web_role), session_id=session_id, token_jti=new_access_jti, ) new_refresh_token = create_refresh_token( data={ "sub": user.id, "username": user.user_no, "role": web_role, }, session_id=session_id, refresh_jti=new_refresh_jti, ) await store_refresh_token(refresh_jti=new_refresh_jti, user_id=user.id) return success_response( { "token": new_access_token, "refreshToken": new_refresh_token, "expiresIn": settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60, } ) except HTTPException: return error_response(401, "refreshToken已过期") @router.post("/web/auth/logout", response_model=dict) async def logout(request: Request): """登出：吊销 Redis 会话（若已配置 REDIS_HOST）。""" authorization = request.headers.get("Authorization", "") if not authorization.startswith("Bearer "): return error_response(401, "未授权") token = authorization.replace("Bearer ", "") try: payload = decode_token(token) session_id = payload.get("sid") if session_id: await revoke_session(session_id=session_id) except HTTPException: return error_response(401, "Token无效或已过期") return success_response({"message": "登出成功"}) @router.get("/web/auth/current-user", response_model=dict) async def get_current_user_profile(request: Request, db: Session = Depends(get_db)): """获取当前用户信息（与 sys_user 字段对应）。""" try: current_user = await _resolve_current_user_from_request(request, db) return success_response(_build_current_user_payload(current_user)) except HTTPException: return error_response(401, "Token无效或已过期") @router.put("/web/auth/profile", response_model=dict) async def update_current_user_profile( request: Request, body: ProfileUpdateRequest, db: Session = Depends(get_db), ): """当前用户更新个人信息（手机号、邮箱、性别、备注）。""" try: current_user = await _resolve_current_user_from_request(request, db) user_id = current_user.get("user_id") if not user_id: return error_response(401, "未授权") payload = body.model_dump(exclude_unset=True, by_alias=False) update_user( db, user_id, phone_no=payload.get("phone_no"), email=payload.get("email"), sex=payload.get("sex"), remark=payload.get("remark"), avatar=payload.get("avatar"), user_id_updater=user_id, ) user = user_crud.get(db, user_id) if not user: return error_response(404, "用户不存在") web_role = resolve_web_role_for_user(db, user.id) role_names = get_user_role_names(db, user.id) return success_response(_build_user_info_payload(user, web_role, role_names)) except HTTPException: return error_response(401, "Token无效或已过期") except ValueError as exc: return error_response(400, str(exc)) @router.post("/web/auth/change-password", response_model=dict) async def change_current_user_password( request: Request, body: dict, db: Session = Depends(get_db), ): """当前用户修改密码。""" try: current_user = await _resolve_current_user_from_request(request, db) user_id = current_user.get("user_id") if not user_id: return error_response(401, "未授权") old_password = (body.get("oldPassword") or body.get("old_password") or "").strip() new_password = (body.get("newPassword") or body.get("new_password") or "").strip() if not old_password: return error_response(400, "请输入原密码") if len(new_password) < 6: return error_response(400, "新密码长度不能少于6位") change_password(db, user_id, old_password, new_password) return success_response({"message": "密码修改成功"}) except HTTPException: return error_response(401, "Token无效或已过期") except ValueError as exc: return error_response(400, str(exc)) _AVATAR_MAX_BYTES = 2 * 1024 * 1024 _AVATAR_ALLOWED_EXT = {".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp"} @router.post("/web/auth/upload-avatar", response_model=dict) async def upload_current_user_avatar( request: Request, file: UploadFile = File(...), db: Session = Depends(get_db), ): """当前用户上传头像（仅图片，最大 2MB）。""" try: await _resolve_current_user_from_request(request, db) except HTTPException: return error_response(401, "Token无效或已过期") if not file or not file.filename: return error_response(400, "请选择图片") ext = os.path.splitext(file.filename)[1].lower() if ext not in _AVATAR_ALLOWED_EXT: return error_response(400, "仅支持 JPG、PNG、GIF、WEBP、BMP 格式") content_type = (file.content_type or "").lower() if content_type and not content_type.startswith("image/"): return error_response(400, "仅支持上传图片文件") try: file_content = await file.read() if not file_content: return error_response(400, "文件内容为空") if len(file_content) > _AVATAR_MAX_BYTES: return error_response(400, "头像大小不能超过 2MB") url = storage.upload_file(file_content, file.filename, "avatar") stored_url = extract_avatar_storage_key(url) return success_response({"url": stored_url}) except Exception as exc: return error_response(500, f"上传失败: {str(exc)}") @router.get("/web/auth/menu-codes", response_model=dict) async def get_web_auth_menu_codes(request: Request, db: Session = Depends(get_db)): """获取当前用户菜单权限标识（sys_menu.perms，经角色继承）。""" authorization = request.headers.get("Authorization", "") if not authorization.startswith("Bearer "): return error_response(401, "未授权") token = authorization.replace("Bearer ", "") try: current_user = await get_current_user_by_token(token=token, db=db) role = current_user.get("role") if role == "super_admin": return success_response( { "isSuperAdmin": True, "all": True, "menuCodes": [], } ) try: codes = iter_user_menu_perm_codes(db, current_user.get("user_id") or "") menu_codes = sorted(codes) except OperationalError: menu_codes = [] return success_response( { "isSuperAdmin": False, "all": False, "menuCodes": menu_codes, } ) except HTTPException: return error_response(401, "Token无效或已过期")