# -*- coding: utf-8 -*- """认证操作端点（FastAPI 栈）——与 Flask 侧同名端点响应契约逐字段对齐。 已迁移： - POST /api/v1/auth/logout ↔ Flask /auth/logout（顶号：递增 login_seq + 删 Cookie） - POST /api/v1/auth/heartbeat ↔ Flask /auth/heartbeat - POST /api/v1/auth/ann_seen ↔ Flask /auth/ann_seen - POST /api/v1/auth/login ↔ Flask /auth/login（密码校验 + 失败锁定 + 管理员 2FA 转票据） 设计： - 登录失败锁定与管理员 2FA 票据表**复用 auth_routes 的模块级状态**，两栈共享同一份 计数/票据，避免「换个框架打就绕过锁定」。 - 密码校验（PBKDF2，10 万次迭代，CPU 密集）与库操作经 asyncio.to_thread 执行， 不阻塞事件循环。 - 会话 Cookie 由 core.session 签发（与 Flask 同格式同密钥），删 Cookie 亦同口径。 """ import asyncio import os import time from typing import Annotated from fastapi import APIRouter, Depends, Request from fastapi.responses import JSONResponse import auth_system as auth import web.deps as deps from core import db, repo from core import session as cs from web import ratelimit from web.deps import SiteUser, current_user from web.request_utils import ( request_data as _request_data, ) from web.response import error, success from web.serializers import format_credits as _format_credits from web.serializers import user_public as _user_public router = APIRouter() SESSION_COOKIE = 'session' _SESSION_MAX_AGE = 7 * 86400 def _cookie_kwargs() -> dict: secure = os.environ.get('ENABLE_SECURE_COOKIE', '').strip().lower() in ('1', 'true', 'yes') return {'max_age': _SESSION_MAX_AGE, 'httponly': True, 'samesite': 'lax', 'path': '/', 'secure': secure} def _login_response(payload: dict, message: str, uid: int, seq: int) -> JSONResponse: """构造带会话 Cookie 的成功响应（Cookie 格式与 Flask 一致）。""" resp = JSONResponse(content={'status': 200, 'success': True, 'message': message, 'data': payload}) cookie = cs.dumps(deps.secret_key(), { 'site_uid': uid, 'site_uid_seq': seq, 'site_uid_ts': int(time.time()), }) resp.set_cookie(SESSION_COOKIE, cookie, **_cookie_kwargs()) return resp @router.post('/auth/logout') async def logout(user: Annotated[SiteUser | None, Depends(current_user)]): """退出登录：递增 login_seq 使本账号全部已签发会话失效，并删除本机 Cookie。""" if user is not None: try: await db.execute( 'UPDATE users SET login_seq = COALESCE(login_seq, 0) + 1 WHERE id = ?', (user.id,)) except Exception: pass resp = JSONResponse(content={'status': 200, 'success': True, 'message': '已退出登录'}) resp.delete_cookie(SESSION_COOKIE) return resp @router.post('/auth/heartbeat') async def heartbeat(user: Annotated[SiteUser | None, Depends(current_user)]): """会话保活：返回最新次数；超限/失效给 401（expired 语义与 Flask 同）。""" if user is None: return error('登录已失效', 401, error_code='unauthorized') row = await repo.get_user_by_id(user.id) if row is None: return error('登录已失效', 401, error_code='unauthorized') credits = int(row.get('duration_seconds') or 0) if row.get('role') != 'admin' and credits != -1 and credits <= 0: return error('剩余次数已用完', 401, error_code='expired') return success({'duration_seconds': row.get('duration_seconds'), 'duration_text': _format_credits(credits)}) @router.post('/auth/ann_seen') async def ann_seen(user: Annotated[SiteUser | None, Depends(current_user)]): """标记公告已读（记录当前公告版本）。""" if user is not None: ann = await repo.get_announcement() await db.execute('UPDATE users SET ann_seen = ? WHERE id = ?', (ann.get('updated_at', ''), user.id)) return success() @router.post('/auth/login') async def login(request: Request): """登录：密码校验（含邮箱登录）、失败锁定、管理员两步验证转票据。""" from auth_routes import ( _admin2fa_issue, _admin2fa_mask, _login_fail_check, _login_fail_clear, _login_fail_locked_log_once, _login_fail_record, ) data = await _request_data(request) username = str(data.get('username') or '').strip() password = str(data.get('password') or '') ip = ratelimit.client_ip(request) if len(password) > 128: # 超长密码不做 PBKDF2（CPU 放大器），直接按密码错误拒绝 return error('用户名或密码错误') try: # 邮箱登录：含 @ 按归一化邮箱解析真实账号；锁定 key 用真实用户名 if '@' in username: iuser = await asyncio.to_thread(auth.get_user_by_email, username) lock_name = iuser['username'] if iuser else (auth._normalize_email(username) or username) else: iuser = None lock_name = username if not _login_fail_check(lock_name): if _login_fail_locked_log_once(lock_name): await asyncio.to_thread(auth.add_log, 'fail', lock_name, ip, '登录', '失败次数过多，临时锁定') return error('尝试过于频繁，该账号已临时锁定，请 10 分钟后再试') verify_name = iuser['username'] if iuser is not None else username user = await asyncio.to_thread(auth.verify_login, verify_name, password) if not user: _login_fail_record(lock_name) return error('用户名或密码错误') keys = user.keys() status = user['status'] if 'status' in keys else 1 if status == 2: reason = user['ban_reason'] if 'ban_reason' in keys else '' await asyncio.to_thread(auth.add_log, 'fail', lock_name, ip, '登录', f'封禁账号尝试登录: {reason}') return error('账号已被封禁' + (f'：{reason}' if reason else '') + '，请联系管理员') if status == 0: return error('账号已被禁用，请联系管理员') _login_fail_clear(lock_name) if user['role'] == 'admin': # 管理员一律转两步验证通道（密码正确才签发票据；未绑定邮箱 fail-closed） admin_email = user['email'] if 'email' in keys else '' if not admin_email: await asyncio.to_thread(auth.add_log, 'fail', lock_name, ip, '管理员登录', '未绑定邮箱，两步验证不可用') return error('管理员账号未绑定邮箱，请联系管理员先完成绑定') ticket = _admin2fa_issue(user) await asyncio.to_thread(auth.add_log, 'success', lock_name, ip, '管理员登录', '密码验证通过，待邮箱验证') return success({'ticket': ticket, 'email_masked': _admin2fa_mask(admin_email), 'username': user['username'], 'admin_2fa': True}, '密码验证通过，请完成邮箱验证') # 普通用户：建立会话（原子递增 login_seq 顶号） uid = int(user['id']) now = int(time.time()) await db.execute( 'UPDATE users SET last_active = ?, last_login = ?, ' 'login_seq = COALESCE(login_seq, 0) + 1 WHERE id = ?', (now, now, uid)) seq_row = await repo.get_user_by_id(uid) seq = int((seq_row or {}).get('login_seq') or 1) banned, _info = await asyncio.to_thread(auth.record_login_location, user, ip) if banned: await db.execute( 'UPDATE users SET login_seq = COALESCE(login_seq, 0) + 1 WHERE id = ?', (uid,)) return error('检测到账号在多个省份异常登录，已自动封禁，请联系管理员') fresh = await repo.get_user_by_id(uid) or {} return _login_response({ 'user': _user_public(fresh), 'duration_text': _format_credits(int(fresh.get('duration_seconds') or 0)), 'redirect': 'admin' if fresh.get('role') == 'admin' else 'user', }, '登录成功', uid, seq) except Exception: return error('登录失败，请稍后重试', 500) # ============ 管理员两步验证 Step2 / Step3 ============ @router.post('/auth/admin_login/email') async def admin_login_email(request: Request): """管理员 2FA Step2：比对绑定邮箱 → 发送 admin2fa 验证码。""" import hmac as _hmac from auth_routes import ( _ADMIN2FA_LAST_SEND, _ADMIN2FA_SEND_GAP, _ADMIN_2FA, _ADMIN_2FA_MAX_ATTEMPTS, _admin2fa_mask, _admin2fa_take, ) data = await _request_data(request) ip = ratelimit.client_ip(request) ticket, v = _admin2fa_take(str(data.get('ticket') or '')) if not v: return error('登录会话已过期，请重新开始登录', 401, error_code='admin_2fa_expired') email_input = auth._normalize_email(str(data.get('email') or '')) # 第二因子比对走常时比较 if (not email_input or not v.get('email') or not _hmac.compare_digest(email_input, v['email'])): v['attempts'] += 1 await asyncio.to_thread(auth.add_log, 'fail', v['username'], ip, '管理员登录', '绑定邮箱不匹配') if v['attempts'] >= _ADMIN_2FA_MAX_ATTEMPTS: _ADMIN_2FA.pop(ticket, None) return error('错误次数过多，请重新开始登录') return error(f'绑定邮箱不正确，还可尝试 {_ADMIN_2FA_MAX_ATTEMPTS - v["attempts"]} 次') last_send = _ADMIN2FA_LAST_SEND.get(v['username'], 0) if time.time() - last_send < _ADMIN2FA_SEND_GAP: return error('验证码发送过于频繁，请 1 分钟后再试') try: await asyncio.to_thread(auth.send_verify_code, v['email'], 'admin2fa') _ADMIN2FA_LAST_SEND[v['username']] = time.time() await asyncio.to_thread(auth.add_log, 'success', v['username'], ip, '管理员登录', f'绑定邮箱验证通过，验证码已发送（{_admin2fa_mask(v["email"])}）') return success(message='验证码已发送至管理员邮箱，请查收') except (ValueError, RuntimeError) as e: return error(str(e)) except Exception: return error('验证码发送失败，请稍后重试', 500) @router.post('/auth/admin_login/verify') async def admin_login_verify(request: Request): """管理员 2FA Step3：验证码原子消费 → 建立管理员会话。""" from auth_routes import ( _ADMIN_2FA, _ADMIN_2FA_MAX_ATTEMPTS, _admin2fa_take, ) data = await _request_data(request) ip = ratelimit.client_ip(request) ticket, v = _admin2fa_take(str(data.get('ticket') or '')) if not v: return error('登录会话已过期，请重新开始登录', 401, error_code='admin_2fa_expired') code = str(data.get('code') or '').strip() if not await asyncio.to_thread(auth.check_verify_code, v['email'], code, 'admin2fa'): v['attempts'] += 1 if v['attempts'] >= _ADMIN_2FA_MAX_ATTEMPTS: _ADMIN_2FA.pop(ticket, None) return error('错误次数过多，请重新开始登录') await asyncio.to_thread(auth.add_log, 'fail', v['username'], ip, '管理员登录', '验证码错误') return error('验证码错误或已过期') _ADMIN_2FA.pop(ticket, None) # 一次性 user = await asyncio.to_thread(auth.get_user_by_id, v['user_id']) if not user or user['role'] != 'admin': return error('登录会话已过期，请重新开始登录', 401, error_code='admin_2fa_expired') keys = user.keys() status = user['status'] if 'status' in keys else 1 if status == 2: await asyncio.to_thread(auth.add_log, 'fail', v['username'], ip, '管理员登录', '封禁账号尝试登录') return error('账号已被封禁，请联系管理员') if status == 0: return error('账号已被禁用，请联系管理员') uid = int(user['id']) now = int(time.time()) await db.execute('UPDATE users SET last_active=?, last_login=?, ' 'login_seq=COALESCE(login_seq,0)+1 WHERE id=?', (now, now, uid)) seq_row = await repo.get_user_by_id(uid) seq = int((seq_row or {}).get('login_seq') or 1) banned, _info = await asyncio.to_thread(auth.record_login_location, user, ip) if banned: await db.execute('UPDATE users SET login_seq = COALESCE(login_seq, 0) + 1 WHERE id = ?', (uid,)) return error('检测到账号在多个省份异常登录，已自动封禁，请联系管理员') fresh = await repo.get_user_by_id(uid) or {} await asyncio.to_thread(auth.add_log, 'success', v['username'], ip, '管理员登录', '两步验证通过') return _login_response({ 'user': _user_public(fresh), 'duration_text': _format_credits(int(fresh.get('duration_seconds') or 0)), 'redirect': 'admin', }, '登录成功', uid, seq)