442 lines
16 KiB
Python
442 lines
16 KiB
Python
from datetime import datetime, timezone, timedelta
|
|
|
|
CST = timezone(timedelta(hours=8))
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.config import settings
|
|
from app.dependencies import (
|
|
get_current_user,
|
|
get_current_user_allow_password_pending,
|
|
get_db,
|
|
security,
|
|
)
|
|
from fastapi.security import HTTPAuthorizationCredentials
|
|
from app.models.system_config import SystemConfig
|
|
from app.models.user import User
|
|
from app.schemas.auth import (
|
|
ChangePasswordRequest,
|
|
ChangeUsernameRequest,
|
|
LoginRequest,
|
|
RegisterRequest,
|
|
SetPasswordRequest,
|
|
SmsLoginRequest,
|
|
)
|
|
from app.schemas.user import UserOut
|
|
from app.services.auth import (
|
|
authenticate_user,
|
|
create_access_token,
|
|
decode_access_token,
|
|
get_user_by_phone,
|
|
hash_password,
|
|
verify_password,
|
|
)
|
|
from app.utils.device import detect_device_type
|
|
from app.services.sms import verify_sms_code
|
|
from app.services.resource_capacity_service import get_user_resource_capacity_usage
|
|
from app.enums.credit_balance import CreditBalanceSourceType, CreditLevel
|
|
from app.services.credit.ledger_service import grant_credits
|
|
from app.services.credit.query_service import attach_credit_snapshot, get_available_credits
|
|
from app.services.credit.time_policy import add_natural_months
|
|
from app.utils.id_gen import generate_id
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
def _validate_captcha_if_needed(captcha_token: str | None) -> None:
|
|
# 保留原密码登录的图形验证码逻辑，不改成短信验证码。
|
|
if settings.SMS_MOCK:
|
|
return
|
|
if not captcha_token:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="需要验证码",
|
|
)
|
|
token_sub = decode_access_token(captcha_token)
|
|
if not token_sub or not token_sub.startswith("captcha:"):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="验证码无效或已过期",
|
|
)
|
|
|
|
|
|
def _token_response(user: User, remember_me: bool = False, device_type: str = "pc") -> dict:
|
|
user.credits = round(user.credits, 2)
|
|
# 按设备类型递增对应版本号 — 单设备登录（同端互斥）
|
|
if device_type == "mobile":
|
|
user.mobile_token_version = (user.mobile_token_version or 0) + 1
|
|
version = user.mobile_token_version
|
|
else:
|
|
user.pc_token_version = (user.pc_token_version or 0) + 1
|
|
version = user.pc_token_version
|
|
token = create_access_token(user.id, remember_me, version, device_type)
|
|
return {
|
|
"access_token": token,
|
|
"token_type": "bearer",
|
|
"user": UserOut.model_validate(user),
|
|
"must_set_password": bool(user.user_type == "frontend" and not user.hashed_password),
|
|
}
|
|
|
|
|
|
async def _assign_default_frontend_menus(db: AsyncSession, user: User) -> None:
|
|
from app.models.menu_config import MenuConfig
|
|
|
|
result = await db.execute(
|
|
select(MenuConfig).where(
|
|
MenuConfig.is_default == True,
|
|
MenuConfig.is_active == True,
|
|
MenuConfig.menu_target.in_(["frontend", "both"]),
|
|
MenuConfig.menu_type == "page",
|
|
)
|
|
)
|
|
default_menus = result.scalars().all()
|
|
if default_menus:
|
|
user.allowed_menus = [m.path for m in default_menus if m.path]
|
|
|
|
|
|
async def _get_register_credits(db: AsyncSession) -> int:
|
|
result = await db.execute(
|
|
select(SystemConfig.value).where(SystemConfig.key == "user_register_credits").limit(1)
|
|
)
|
|
value = result.scalar_one_or_none()
|
|
return int(value) if value else 100
|
|
|
|
|
|
async def _add_register_credit_record(db: AsyncSession, user: User, credits: int) -> None:
|
|
if credits <= 0:
|
|
attach_credit_snapshot(user, 0)
|
|
return
|
|
now = datetime.now(timezone.utc)
|
|
result = await grant_credits(
|
|
db,
|
|
user_id=user.id,
|
|
amount=credits,
|
|
description=f"注册赠送 {credits} 积分",
|
|
source_type=CreditBalanceSourceType.REGISTER_GIFT.value,
|
|
source_id=user.id,
|
|
valid_from=now,
|
|
expires_at=add_natural_months(now, 1),
|
|
credit_level=CreditLevel.PROMOTIONAL.value,
|
|
related_id=user.id,
|
|
biz_key=f"register-gift:{user.id}",
|
|
request_time=now,
|
|
)
|
|
attach_credit_snapshot(user, result.balance_after)
|
|
|
|
|
|
async def _handle_daily_login_credits(db: AsyncSession, user: User) -> None:
|
|
enabled_result = await db.execute(
|
|
select(SystemConfig.value).where(SystemConfig.key == "user_login_credits_enabled").limit(1)
|
|
)
|
|
if enabled_result.scalar_one_or_none() != "true":
|
|
attach_credit_snapshot(user, await get_available_credits(db, user.id))
|
|
return
|
|
credits_result = await db.execute(
|
|
select(SystemConfig.value).where(SystemConfig.key == "user_login_credits").limit(1)
|
|
)
|
|
credits = int(credits_result.scalar_one_or_none() or "0")
|
|
now_cst = datetime.now(CST)
|
|
if credits > 0:
|
|
next_midnight_cst = datetime.combine(now_cst.date() + timedelta(days=1), datetime.min.time(), tzinfo=CST)
|
|
result = await grant_credits(
|
|
db,
|
|
user_id=user.id,
|
|
amount=credits,
|
|
description=f"每日登录赠送 {credits} 积分",
|
|
source_type=CreditBalanceSourceType.DAILY_LOGIN.value,
|
|
source_id=now_cst.date().isoformat(),
|
|
valid_from=now_cst,
|
|
expires_at=next_midnight_cst,
|
|
credit_level=CreditLevel.PROMOTIONAL.value,
|
|
related_id=user.id,
|
|
biz_key=f"daily-login:{user.id}:{now_cst.date().isoformat()}",
|
|
request_time=now_cst,
|
|
)
|
|
attach_credit_snapshot(user, result.balance_after)
|
|
else:
|
|
attach_credit_snapshot(user, await get_available_credits(db, user.id))
|
|
|
|
|
|
@router.post(
|
|
"/login",
|
|
summary="客户端密码登录",
|
|
description="保留原有用户名/手机号 + 密码登录。仅允许 frontend 用户登录；管理员仍使用 /auth/admin-login。",
|
|
)
|
|
async def login(req: LoginRequest, request: Request, db: AsyncSession = Depends(get_db)):
|
|
_validate_captcha_if_needed(req.captcha_token)
|
|
|
|
user = await authenticate_user(db, req.username, req.password)
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="用户名或密码错误",
|
|
)
|
|
|
|
# Only allow frontend users to login via this endpoint
|
|
if user.user_type != "frontend":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="该账号不允许在此登录",
|
|
)
|
|
|
|
await _handle_daily_login_credits(db, user)
|
|
user.last_login_at = datetime.now(CST)
|
|
await db.flush()
|
|
device_type = detect_device_type(request.headers.get("user-agent"))
|
|
return _token_response(user, req.remember_me, device_type)
|
|
|
|
|
|
@router.post(
|
|
"/sms-login",
|
|
summary="客户端短信验证码登录",
|
|
description="新增兼容登录方式：手机号 + 短信验证码登录。不覆盖 /auth/login 密码登录。仅允许 frontend 用户登录。",
|
|
)
|
|
async def sms_login(req: SmsLoginRequest, request: Request, db: AsyncSession = Depends(get_db)):
|
|
ok = await verify_sms_code(req.phone, req.code, "login")
|
|
if not ok:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="验证码错误或已过期",
|
|
)
|
|
|
|
user = await get_user_by_phone(db, req.phone)
|
|
if not user or not user.is_active:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="账号不存在或已禁用",
|
|
)
|
|
if user.user_type != "frontend":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="该账号不允许在此登录",
|
|
)
|
|
|
|
await _handle_daily_login_credits(db, user)
|
|
user.last_login_at = datetime.now(CST)
|
|
await db.flush()
|
|
device_type = detect_device_type(request.headers.get("user-agent"))
|
|
return _token_response(user, req.remember_me, device_type)
|
|
|
|
|
|
@router.post(
|
|
"/register",
|
|
summary="客户端手机号短信注册",
|
|
description="手机号 + 注册短信验证码注册。注册成功后 username 默认等于手机号，不生成密码；前端需根据 must_set_password 引导用户设置密码。",
|
|
)
|
|
async def register(req: RegisterRequest, request: Request, db: AsyncSession = Depends(get_db)):
|
|
ok = await verify_sms_code(req.phone, req.code, "register")
|
|
if not ok:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="验证码错误或已过期",
|
|
)
|
|
|
|
existing_phone = await db.execute(select(User).where(User.phone == req.phone).limit(1))
|
|
if existing_phone.scalar_one_or_none():
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="该手机号已注册",
|
|
)
|
|
|
|
register_credits = await _get_register_credits(db)
|
|
|
|
user = User(
|
|
id=generate_id(),
|
|
username=req.phone,
|
|
phone=req.phone,
|
|
hashed_password=hash_password(req.password),
|
|
password_set_at=datetime.now(CST),
|
|
is_admin=False,
|
|
user_type="frontend",
|
|
)
|
|
db.add(user)
|
|
await db.flush()
|
|
|
|
await _add_register_credit_record(db, user, register_credits)
|
|
await _assign_default_frontend_menus(db, user)
|
|
|
|
user.credits = round(user.credits, 2)
|
|
# 按设备类型递增对应版本号
|
|
device_type = detect_device_type(request.headers.get("user-agent"))
|
|
if device_type == "mobile":
|
|
user.mobile_token_version = (user.mobile_token_version or 0) + 1
|
|
version = user.mobile_token_version
|
|
else:
|
|
user.pc_token_version = (user.pc_token_version or 0) + 1
|
|
version = user.pc_token_version
|
|
token = create_access_token(user.id, False, version, device_type)
|
|
return {
|
|
"access_token": token,
|
|
"token_type": "bearer",
|
|
"user": UserOut.model_validate(user),
|
|
"must_set_password": True,
|
|
}
|
|
|
|
|
|
@router.post("/logout")
|
|
async def logout(
|
|
credentials: HTTPAuthorizationCredentials | None = Depends(security),
|
|
current_user: User = Depends(get_current_user_allow_password_pending),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
# 按设备类型递增对应版本号 — 使当前 token 失效
|
|
device_type = "pc"
|
|
if credentials:
|
|
payload = decode_access_token(credentials.credentials)
|
|
if payload:
|
|
device_type = payload.get("dev", "pc")
|
|
if device_type == "mobile":
|
|
current_user.mobile_token_version = (current_user.mobile_token_version or 0) + 1
|
|
else:
|
|
current_user.pc_token_version = (current_user.pc_token_version or 0) + 1
|
|
await db.flush()
|
|
return {"message": "ok"}
|
|
|
|
|
|
@router.get("/me", response_model=UserOut)
|
|
async def get_me(
|
|
current_user: User = Depends(get_current_user_allow_password_pending),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
current_user.username = "用户"+current_user.username[-4:] if current_user.username == current_user.phone else current_user.username
|
|
current_user.credits = round(current_user.credits, 2)
|
|
resource_capacity = await get_user_resource_capacity_usage(db, current_user.id)
|
|
|
|
# 计算 is_team_manager 和 team_name
|
|
is_team_manager = False
|
|
team_name = None
|
|
if current_user.team_id:
|
|
from app.services.team_manager_service import is_team_manager
|
|
from app.services.team_service import batch_get_team_name_map
|
|
is_team_manager = await is_team_manager(db, current_user.id, current_user.team_id)
|
|
name_map = await batch_get_team_name_map(db, [current_user.team_id])
|
|
team_name = name_map.get(current_user.team_id)
|
|
|
|
return UserOut.model_validate(current_user).model_copy(
|
|
update={
|
|
"resource_capacity": resource_capacity,
|
|
"is_team_manager": is_team_manager,
|
|
"team_id": current_user.team_id,
|
|
"team_name": team_name,
|
|
}
|
|
)
|
|
|
|
|
|
@router.post(
|
|
"/set-password",
|
|
summary="设置登录密码",
|
|
description="短信注册或短信登录后，用户没有密码时调用该接口设置密码。该接口允许未设置密码用户访问。",
|
|
)
|
|
async def set_password(
|
|
req: SetPasswordRequest,
|
|
current_user: User = Depends(get_current_user_allow_password_pending),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
if len(req.new_password) < 6:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="密码至少6位",
|
|
)
|
|
|
|
current_user.hashed_password = hash_password(req.new_password)
|
|
current_user.password_set_at = datetime.now(CST)
|
|
await db.flush()
|
|
return {"message": "密码设置成功", "must_set_password": False}
|
|
|
|
|
|
@router.post("/change-password")
|
|
async def change_password(
|
|
req: ChangePasswordRequest,
|
|
current_user: User = Depends(get_current_user),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
if not verify_password(req.old_password, current_user.hashed_password):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="原密码错误",
|
|
)
|
|
|
|
if len(req.new_password) < 6:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="密码至少6位",
|
|
)
|
|
|
|
current_user.hashed_password = hash_password(req.new_password)
|
|
current_user.password_set_at = datetime.now(CST)
|
|
await db.flush()
|
|
return {"message": "密码修改成功"}
|
|
|
|
|
|
@router.post("/change-username")
|
|
async def change_username(
|
|
req: ChangeUsernameRequest,
|
|
current_user: User = Depends(get_current_user),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
current_user.username = req.new_username.strip()
|
|
await db.flush()
|
|
return {"message": "用户名修改成功"}
|
|
|
|
|
|
@router.get("/site-info")
|
|
async def get_site_info(db: AsyncSession = Depends(get_db)):
|
|
"""Public endpoint returning site name, logo, agreement and copyright info."""
|
|
result = await db.execute(
|
|
select(SystemConfig).where(SystemConfig.key.in_([
|
|
"site_name", "site_logo", "user_agreement_privacy_url", "site_copyright", "operation_manual", "login_bg_video", "optimize_hold_credits", "site_banner", "site_banner_version"
|
|
]))
|
|
)
|
|
configs = result.scalars().all()
|
|
info = {c.key: c.value for c in configs}
|
|
|
|
# Helper function to convert relative path to full URL
|
|
def to_full_url(path: str | None) -> str:
|
|
if not path:
|
|
return ""
|
|
# If already absolute URL, return as-is
|
|
if path.startswith("http://") or path.startswith("https://"):
|
|
return path
|
|
# Convert relative path to full URL
|
|
base_url = settings.BASE_URL.rstrip("/")
|
|
return f"{base_url}{path}"
|
|
|
|
return {
|
|
"site_name": info.get("site_name", "智创"),
|
|
"site_logo": to_full_url(info.get("site_logo")),
|
|
"user_agreement_privacy_url": to_full_url(info.get("user_agreement_privacy_url")),
|
|
"site_copyright": info.get("site_copyright", "© 2026 智创 版权所有"),
|
|
"operation_manual": info.get("operation_manual", ""),
|
|
"login_bg_video": to_full_url(info.get("login_bg_video")) if info.get("login_bg_video") else "",
|
|
"optimize_hold_credits": int(info.get("optimize_hold_credits") or 5),
|
|
"site_banner": info.get("site_banner", ""),
|
|
"site_banner_version": int(info.get("site_banner_version") or 0),
|
|
}
|
|
|
|
|
|
@router.post("/admin-login")
|
|
async def admin_login(req: LoginRequest, request: Request, db: AsyncSession = Depends(get_db)):
|
|
"""Admin-only login endpoint."""
|
|
user = await authenticate_user(db, req.username, req.password)
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="用户名或密码错误",
|
|
)
|
|
|
|
if user.user_type != "admin":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="该账号不是管理员账号",
|
|
)
|
|
|
|
user.last_login_at = datetime.now(CST)
|
|
await db.flush()
|
|
|
|
device_type = detect_device_type(request.headers.get("user-agent"))
|
|
token = create_access_token(user.id, req.remember_me, 0, device_type)
|
|
user.credits = round(user.credits, 2)
|
|
return {"access_token": token, "token_type": "bearer", "user": UserOut.model_validate(user)}
|