host
0ed301b010
Add GET /oauth/{provider}/callback (code+state from query, client_id
and redirect_uri recovered from the state record) alongside the
existing POST callback. Callback now fetches real userinfo
(GitHub api.github.com/user, Google openidconnect userinfo) and
issues a usable local API key on success: new users get the
create_user key, existing users rotate (old key dead, audit
oauth_login + api_key_rotated). Key plaintext appears only once
on the success page/response; failures are 400 HTML/JSON without
secrets, and a missing client_secret fails before any network call.
State remains one-time, 10 minutes, provider/redirect_uri matched.
Tests: 10 new OAuth real-login tests pass; host 27, cloud 249
(4 skipped are the pre-existing real-Postgres tests).
Real end-to-end still needs a registered OAuth App and a public
HTTPS callback entry (server still binds localhost only).
200 lines
7.2 KiB
Python
200 lines
7.2 KiB
Python
"""认证与权限模块（云端架构，首版）。
|
||
|
||
认证方式：首版只用 API key + 哈希。
|
||
|
||
- 创建用户时用 ``secrets.token_urlsafe(32)`` 生成明文 key，仅返回给调用方一次；
|
||
库里只存 ``hashlib.sha256(api_key_plain.encode()).hexdigest()``，绝不存明文。
|
||
- 认证时对输入做同样的 sha256 再查库比对。
|
||
|
||
OAuth（GitHub/Google）是下一步接线：本模块不提供任何 OAuth 流程、
|
||
不编造假 OAuth 端点或假 token 校验，接线时再由控制面按真实
|
||
OAuth 协议接入，本模块的 API key 认证保持独立可用。
|
||
|
||
权限模型：项目内角色 viewer < contributor < maintainer < owner。
|
||
动作最低角色：read -> viewer，create_task -> contributor，
|
||
approve_merge -> maintainer，manage_project -> owner（仅 owner）。
|
||
未加入项目一律无权限。
|
||
|
||
审计：audit() 只追加，list_audit() 只读；本模块不提供删除或修改
|
||
审计记录的方法。
|
||
|
||
零第三方依赖，只用 Python 标准库。
|
||
"""
|
||
|
||
import hashlib
|
||
import secrets
|
||
import sqlite3
|
||
from cloud.db import connect as _db_connect
|
||
import time
|
||
import uuid
|
||
|
||
ROLES = ["viewer", "contributor", "maintainer", "owner"]
|
||
|
||
_ROLE_LEVEL = {role: i for i, role in enumerate(ROLES)}
|
||
|
||
_ACTION_MIN_ROLE = {
|
||
"read": "viewer",
|
||
"create_task": "contributor",
|
||
"approve_merge": "maintainer",
|
||
"manage_project": "owner",
|
||
}
|
||
|
||
|
||
class AuthStore:
|
||
"""基于 SQLite 的用户 / 项目成员 / 审计存储。"""
|
||
|
||
def __init__(self, db_path):
|
||
self.db_path = str(db_path)
|
||
self.conn = _db_connect(self.db_path)
|
||
self.conn.execute(
|
||
"CREATE TABLE IF NOT EXISTS users("
|
||
"id TEXT PRIMARY KEY, "
|
||
"username TEXT UNIQUE, "
|
||
"api_key_hash TEXT, "
|
||
"created_at REAL)"
|
||
)
|
||
self.conn.execute(
|
||
"CREATE TABLE IF NOT EXISTS project_members("
|
||
"project_id TEXT, "
|
||
"user_id TEXT, "
|
||
"role TEXT, "
|
||
"PRIMARY KEY(project_id, user_id))"
|
||
)
|
||
self.conn.execute(
|
||
"CREATE TABLE IF NOT EXISTS audit_log("
|
||
"id INTEGER PRIMARY KEY AUTOINCREMENT, "
|
||
"user_id TEXT, "
|
||
"project_id TEXT, "
|
||
"action TEXT, "
|
||
"detail TEXT, "
|
||
"created_at REAL)"
|
||
)
|
||
self.conn.commit()
|
||
|
||
def create_user(self, username):
|
||
"""创建用户，返回 (user_id, api_key_plain)，明文仅返回这一次。"""
|
||
user_id = uuid.uuid4().hex
|
||
api_key_plain = secrets.token_urlsafe(32)
|
||
api_key_hash = hashlib.sha256(api_key_plain.encode()).hexdigest()
|
||
self.conn.execute(
|
||
"INSERT INTO users(id, username, api_key_hash, created_at)"
|
||
" VALUES(?, ?, ?, ?)",
|
||
(user_id, username, api_key_hash, time.time()),
|
||
)
|
||
self.conn.commit()
|
||
return user_id, api_key_plain
|
||
|
||
def rotate_api_key(self, user_id):
|
||
"""轮换用户的 API key，返回新明文 key（只返回这一次）。
|
||
|
||
旧 key 的哈希即被替换，轮换后旧 key 立即失效。
|
||
用户不存在时抛 ValueError（调用方不得用它凭空建用户）。
|
||
"""
|
||
row = self.conn.execute(
|
||
"SELECT id FROM users WHERE id = ?", (user_id,)
|
||
).fetchone()
|
||
if row is None:
|
||
raise ValueError("unknown user: %r" % (user_id,))
|
||
api_key_plain = secrets.token_urlsafe(32)
|
||
api_key_hash = hashlib.sha256(api_key_plain.encode()).hexdigest()
|
||
self.conn.execute(
|
||
"UPDATE users SET api_key_hash = ? WHERE id = ?",
|
||
(api_key_hash, user_id),
|
||
)
|
||
self.conn.commit()
|
||
return api_key_plain
|
||
|
||
def authenticate(self, api_key):
|
||
"""用 API key 认证，成功返回 user_id，失败返回 None。"""
|
||
if not api_key:
|
||
return None
|
||
api_key_hash = hashlib.sha256(api_key.encode()).hexdigest()
|
||
row = self.conn.execute(
|
||
"SELECT id FROM users WHERE api_key_hash = ?", (api_key_hash,)
|
||
).fetchone()
|
||
return row[0] if row else None
|
||
|
||
def create_project(self, project_id, owner_user_id):
|
||
"""创建项目成员记录：指定用户为该项目的 owner。"""
|
||
self.conn.execute(
|
||
"INSERT OR REPLACE INTO project_members(project_id, user_id, role)"
|
||
" VALUES(?, ?, 'owner')",
|
||
(project_id, owner_user_id),
|
||
)
|
||
self.conn.commit()
|
||
|
||
def _member_role(self, project_id, user_id):
|
||
row = self.conn.execute(
|
||
"SELECT role FROM project_members"
|
||
" WHERE project_id = ? AND user_id = ?",
|
||
(project_id, user_id),
|
||
).fetchone()
|
||
return row[0] if row else None
|
||
|
||
def set_member(self, project_id, actor_user_id, target_user_id, role):
|
||
"""改成员角色：只有 owner 能改，否则 raise PermissionError；同时记审计。"""
|
||
if role not in ROLES:
|
||
raise ValueError("unknown role: %r" % (role,))
|
||
if self._member_role(project_id, actor_user_id) != "owner":
|
||
raise PermissionError(
|
||
"only project owner can change members"
|
||
)
|
||
self.conn.execute(
|
||
"INSERT OR REPLACE INTO project_members(project_id, user_id, role)"
|
||
" VALUES(?, ?, ?)",
|
||
(project_id, target_user_id, role),
|
||
)
|
||
self.conn.commit()
|
||
self.audit(
|
||
actor_user_id,
|
||
project_id,
|
||
"set_member",
|
||
"%s:%s" % (target_user_id, role),
|
||
)
|
||
|
||
def check_permission(self, user_id, project_id, action):
|
||
"""检查权限：满足最低角色返回 True，否则 False（含未加入项目）。"""
|
||
min_role = _ACTION_MIN_ROLE.get(action)
|
||
if min_role is None:
|
||
return False
|
||
role = self._member_role(project_id, user_id)
|
||
if role is None:
|
||
return False
|
||
return _ROLE_LEVEL[role] >= _ROLE_LEVEL[min_role]
|
||
|
||
def require_permission(self, user_id, project_id, action):
|
||
"""不满足权限时 raise PermissionError。"""
|
||
if not self.check_permission(user_id, project_id, action):
|
||
raise PermissionError(
|
||
"user %s lacks %s on project %s" % (user_id, action, project_id)
|
||
)
|
||
|
||
def audit(self, user_id, project_id, action, detail=""):
|
||
"""只追加一条审计记录。"""
|
||
self.conn.execute(
|
||
"INSERT INTO audit_log(user_id, project_id, action, detail, created_at)"
|
||
" VALUES(?, ?, ?, ?, ?)",
|
||
(user_id, project_id, action, detail, time.time()),
|
||
)
|
||
self.conn.commit()
|
||
|
||
def list_audit(self, project_id, limit=100):
|
||
"""按 created_at 倒序返回该项目的审计列表（dict）。"""
|
||
rows = self.conn.execute(
|
||
"SELECT id, user_id, project_id, action, detail, created_at"
|
||
" FROM audit_log WHERE project_id = ?"
|
||
" ORDER BY created_at DESC, id DESC LIMIT ?",
|
||
(project_id, limit),
|
||
).fetchall()
|
||
return [
|
||
{
|
||
"id": row[0],
|
||
"user_id": row[1],
|
||
"project_id": row[2],
|
||
"action": row[3],
|
||
"detail": row[4],
|
||
"created_at": row[5],
|
||
}
|
||
for row in rows
|
||
]
|