Archived
snowy-yang
96af56cc27
拆掉两类垫片的最后一处：auth_system 原为同步 sqlite3 栈，web 层与 services 的
worker 只能靠 asyncio.to_thread 逐个桥接才不阻塞事件循环——每次 DB 访问都白付一次
线程池调度，且「同步调异步」的边界散落在 100+ 个调用点。B1 已把 worker 变成协程，
本批把访问层本身也迁到原生异步，两条线在此合拢。
改动（按子系统）：
- auth_system：db.py 照 core/db.py 现有范式重建为原生异步访问层（aiosqlite + WAL）
——读路径 _q 每次独立连接、无锁、可并发；写路径 _x / write_transaction 用
asyncio.Lock 串行化，写者不阻塞读者。users / cards / credits / ledger / logs /
settings / mail / geo / backup 九模块随之全部 async/await；security.py 是纯计算
（pbkdf2/normalize）不动。__init__ 去掉 _DB_LOCK 与 get_conn 导出。
- web：app / deps / billing / tasks_registry 与 routers/{admin_site,auth,music,
register,user} 直接 await，拆掉包裹的 to_thread。deps.secret_key 改 async，
连带 _parse_cookie 也 async（会话解析要读密钥）。
- services：_taskcore / tasks / downloads / podcast 的账本调用与查询直接 await。
4 处 start_task 调用点（download.py）确认已 await。
设计取舍（为什么这么做，而不是直接包一层）：
- 锁按**事件循环**隔离（_LOOP_LOCKS 以 id(loop) 为键）：asyncio.Lock 绑定创建它的
loop，应用主 loop 与测试各自的 loop 并存，跨 loop 复用会抛 "bound to a different
event loop"。
- WAL 切换用**独立锁** _wal_lock 而非 _write_lock：execute() 已持写锁，再在锁内
connect→_configure 会自锁死（asyncio.Lock 非重入）。切换 + 标记在专用锁内串行并
二次复查，否则并发首连会同时执行 PRAGMA journal_mode=WAL 争排他锁报
database is locked（core/db.py 同款教训，实测复现）。
- force_wal 保留：journal_mode 持久化在库文件头，库文件被删重建时新文件不继承，
必须重设。exists() 判定须在 aiosqlite.connect **之前**（connect 会创建空文件）。
- connect() 用 DB_PATH.parent 兜底建目录，优于 DATA_DIR：生产两者相同，但测试
monkeypatch 只换 DB_PATH 时兜底仍能命中正确目录。
留在 to_thread 上的仅剩**正当的阻塞卸载**，不是同步门面：PBKDF2 的 10 万次迭代
（登录链路每次都要跑）、smtplib 发信、备份文件的 copy2 / os.replace、secret.key
的文件 IO。原有 aria2 / downloader / zip 侧的 to_thread 未动。
不变量逐条保持（迁移只改执行模型，不改语义）：
- ledger_settle 幂等：账本非 open 直接 return 0，重启后重放不重复退款；
- 终态先到先得：_mark_task_terminal 对已 done/error/canceled 的任务直接 return，
堵住 canceled→error 的非法迁移边；
- settle 必须在任务锁**外**调用（ledger_settle 要抢 SQLite 写锁，busy 最长 15s，
持任务锁会让全站进度/提交/取消随库停摆）；
- reserve_and_open 的预扣与开账同事务，消除原两步之间的崩溃丢账窗口。
路径真源红线：DATA_DIR / DB_PATH / BACKUP_DIR / SECRET_KEY_PATH 仍是 auth_system.db
的**模块全局**（用与 core.db 相同的表达式，但**不是**它的别名）。测试只 patch
auth_system.db.*，若改成 core.db 的别名会静默把测试写到生产库。已核 data/site.db
读写前后 sha256 完全一致。
顺带清掉 get_conn：迁移后它只剩「转调 connect()」一层空壳、全仓零消费者（测试
直接开裸连接、备份用 db.connect()），保留等于留一条「拿裸连接自己写」的口子。
测试：19 个文件同步迁移——10 个文件的 web.deps.secret_key 替身改 async；
test_db_conn.py 的多线程首连用例按异步语义拆成 2 条（单 loop gather(16) 覆盖批量
并发首连、WAL 就绪后 8 线程各自 loop 建连覆盖跨 loop）；test_billing_scope.py 去掉
多余的 @pytest.mark.anyio；被 await 且**正常返回**的 monkeypatch 替身一律改 async
（仅 raise 的同步替身仍可用）。
门禁：ruff 全过 / pyright 0-0-0（standard 模式含 tests 与顶层模块）/ pytest
384 项全绿（0 失败 0 error 0 skipped；383→384 因 test_db_conn 拆用例）。
data/site.db 读写前后 sha256 一致（a19f5db…6487），无 -wal/-shm 边车残留。
下一步 B3：删 core/sync_http.py、core/async_bridge.py、core/http_errors.py 及
tests/test_async_bridge.py——三者在生产侧已零消费者（http_errors 仅 sync_http
自用，requests 已非声明依赖）。
419 lines
17 KiB
Python
419 lines
17 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""个人账号与公开播放端点。
|
||
|
||
端点：
|
||
- POST /api/v1/user/qr/create ↔ Flask /user/qr/create（扫码登录二维码 SVG）
|
||
- POST /api/v1/user/qr/check ↔ Flask /user/qr/check（轮询登录状态）
|
||
- POST /api/v1/user/status ↔ Flask /user/status
|
||
- POST /api/v1/user/logout ↔ Flask /user/logout
|
||
- POST /api/v1/user/playlists ↔ Flask /user/playlists
|
||
- POST /api/v1/user/playlist ↔ Flask /user/playlist
|
||
- POST /api/v1/user/collect ↔ Flask /user/collect（需站点登录）
|
||
- POST /api/v1/user/comment ↔ Flask /user/comment（需站点登录）
|
||
- POST/GET /api/v1/api/playlist/play ↔ Flask /api/playlist/play（需 API 密钥）
|
||
- POST/GET /api/v1/fe_error ↔ Flask /api/fe_error（前端错误上报）
|
||
|
||
说明：qrcode/QRLoginClient 属同步实现，经 asyncio.to_thread 执行；
|
||
公开播放 API 的逐曲直链解析由 ThreadPoolExecutor(4) 改为 asyncio.gather 并发
|
||
（并发度不变，但不再占用线程）。
|
||
"""
|
||
import asyncio
|
||
import hmac
|
||
import logging
|
||
from typing import Annotated, Any
|
||
|
||
from fastapi import APIRouter, Depends, Request
|
||
|
||
import music_api
|
||
from core import media
|
||
from core.config import VALID_QUALITY_LEVELS
|
||
from music_api import APIException
|
||
from web import ratelimit
|
||
from web.deps import SiteUser, current_user, require_login
|
||
from web.request_utils import cookies as _cookies
|
||
from web.request_utils import extract_id as _extract_id
|
||
from web.request_utils import request_data as _request_data
|
||
from web.request_utils import safe_int as _safe_int
|
||
from web.response import error, success
|
||
|
||
router = APIRouter()
|
||
|
||
LoginUser = Annotated[SiteUser, Depends(require_login)]
|
||
|
||
logger = logging.getLogger('web.user')
|
||
|
||
_MAX_PLAY_TRACKS = 500
|
||
_PLAY_CONCURRENCY = 4
|
||
|
||
|
||
|
||
|
||
|
||
async def _resolve_user_cookies(data: dict[str, Any], user: SiteUser | None, request: Request):
|
||
from web.routers.music import _resolve_user_cookies as _r
|
||
return await _r(data, user, request)
|
||
|
||
|
||
class _AnonUser:
|
||
"""未登录请求（个人解析路径）按非管理员处理。"""
|
||
id = 0
|
||
username = ''
|
||
role = 'user'
|
||
credits = 0
|
||
|
||
@property
|
||
def is_admin(self) -> bool:
|
||
return False
|
||
|
||
@property
|
||
def unlimited(self) -> bool:
|
||
return False
|
||
|
||
|
||
async def _mask(nick: str, user: SiteUser | None) -> str:
|
||
from web.routers.music import mask_server_nickname
|
||
return await mask_server_nickname(nick, user if user is not None else _AnonUser()) # type: ignore[arg-type]
|
||
|
||
|
||
# ============ 扫码登录 ============
|
||
|
||
@router.post('/user/qr/create')
|
||
async def user_qr_create(request: Request):
|
||
"""生成个人登录二维码（返回 SVG）。"""
|
||
await ratelimit.guard(request, bucket='free', limit=30, window=60)
|
||
from music_api.qr_client import QRLoginClient
|
||
|
||
try:
|
||
client = QRLoginClient('user_cookie.txt')
|
||
# QRLoginManager 已异步化：直接 await（不可再经 to_thread 包装协程）
|
||
unikey = await client.qr_manager.generate_qr_key()
|
||
if not unikey:
|
||
return error('生成二维码失败', 500)
|
||
|
||
def _render_svg(key: str) -> str:
|
||
import qrcode
|
||
from qrcode.image.svg import SvgPathImage
|
||
qr = qrcode.QRCode(error_correction=qrcode.constants.ERROR_CORRECT_M) # type: ignore[attr-defined]
|
||
qr.add_data(f'https://music.163.com/login?codekey={key}')
|
||
qr.make(fit=True)
|
||
svg = qr.make_image(image_factory=SvgPathImage).to_string()
|
||
return svg.decode('utf-8') if isinstance(svg, bytes) else svg
|
||
|
||
svg = await asyncio.to_thread(_render_svg, unikey)
|
||
except Exception:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
return success({'unikey': unikey, 'qr_svg': svg, 'expires_in': 180}, '二维码生成成功')
|
||
|
||
|
||
@router.post('/user/qr/check')
|
||
async def user_qr_check(
|
||
user: Annotated[SiteUser | None, Depends(current_user)],
|
||
request: Request,
|
||
):
|
||
"""轮询个人登录状态（不写服务器文件；站点登录时同步一份供后台查看）。"""
|
||
await ratelimit.guard(request, bucket='free', limit=30, window=60)
|
||
data = await _request_data(request)
|
||
unikey = data.get('unikey')
|
||
if not unikey:
|
||
return error('缺少 unikey 参数')
|
||
from music_api.qr_client import QRLoginClient
|
||
|
||
try:
|
||
client = QRLoginClient('user_cookie.txt')
|
||
# QRLoginManager.check_qr_login 已异步化：直接 await
|
||
code, cookie_dict = await client.qr_manager.check_qr_login(unikey)
|
||
except Exception:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
|
||
if code == 803:
|
||
musu_u = cookie_dict.get('MUSIC_U', '')
|
||
if not musu_u:
|
||
return error('登录成功但未获取到 Cookie', 500)
|
||
cookie = f'MUSIC_U={musu_u};os=pc;appver=8.9.70;'
|
||
if cookie_dict.get('__csrf'):
|
||
cookie += f"__csrf={cookie_dict['__csrf']};"
|
||
try:
|
||
if user is not None:
|
||
import auth_system
|
||
await auth_system.set_user_netease_cookie(user.username, cookie)
|
||
except Exception:
|
||
pass
|
||
logger.info('个人账号扫码登录成功（Cookie 已返回浏览器本地保存）')
|
||
return success({'status': 'success', 'cookie': cookie}, '登录成功，Cookie 已保存在本机浏览器')
|
||
if code == 801:
|
||
return success({'status': 'waiting'}, '等待扫码')
|
||
if code == 802:
|
||
return success({'status': 'scanned'}, '已扫码，请在手机上确认登录')
|
||
if code == 800:
|
||
return success({'status': 'expired'}, '二维码已过期')
|
||
return success({'status': 'failed', 'code': code}, '登录失败')
|
||
|
||
|
||
@router.post('/user/status')
|
||
async def user_status(
|
||
user: Annotated[SiteUser | None, Depends(current_user)],
|
||
request: Request,
|
||
):
|
||
"""个人用户登录状态与账号信息（Cookie 由浏览器本地保存并随请求传入）。"""
|
||
data = await _request_data(request)
|
||
cookies = await _resolve_user_cookies(data, user, request)
|
||
if not cookies:
|
||
return success({'cookie': {'is_valid': False}, 'user': None}, '个人账号未登录')
|
||
try:
|
||
info = await music_api.NeteaseAPI().get_account_info(cookies)
|
||
except Exception:
|
||
info = None
|
||
return success({'cookie': {'is_valid': info is not None}, 'user': info}, '获取个人登录状态成功')
|
||
|
||
|
||
@router.post('/user/logout')
|
||
async def user_logout():
|
||
"""退出个人账号登录（浏览器清除本地 Cookie 即可，服务器无可清除内容）。"""
|
||
return success({'is_valid': False}, '已退出登录')
|
||
|
||
|
||
@router.post('/user/playlists')
|
||
async def user_playlists(
|
||
user: Annotated[SiteUser | None, Depends(current_user)],
|
||
request: Request,
|
||
):
|
||
"""个人用户收藏/创建的歌单（含「我喜欢的音乐」）。"""
|
||
data = await _request_data(request)
|
||
cookies = await _resolve_user_cookies(data, user, request)
|
||
if not cookies:
|
||
return error('请先扫码登录你的网易云账号', 401)
|
||
api = music_api.NeteaseAPI()
|
||
try:
|
||
account = await api.get_account_info(cookies)
|
||
if not account or not account.get('userId'):
|
||
return error('获取账号信息失败，Cookie 可能已失效，请重新登录', 401)
|
||
playlists = await api.get_user_playlists(account['userId'], cookies)
|
||
except APIException:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
if isinstance(playlists, list):
|
||
for pl in playlists:
|
||
if isinstance(pl, dict):
|
||
if pl.get('name'):
|
||
pl['name'] = await _mask(pl['name'], user)
|
||
cr = pl.get('creator')
|
||
if isinstance(cr, dict) and cr.get('nickname'):
|
||
cr['nickname'] = await _mask(cr['nickname'], user)
|
||
return success({'user': account, 'playlists': playlists}, '获取个人歌单成功')
|
||
|
||
|
||
@router.post('/user/playlist')
|
||
async def user_playlist(
|
||
user: Annotated[SiteUser | None, Depends(current_user)],
|
||
request: Request,
|
||
):
|
||
"""个人歌单详情（个人 Cookie，支持「我喜欢的音乐」等私有歌单）。"""
|
||
data = await _request_data(request)
|
||
playlist_id = data.get('id')
|
||
if not playlist_id:
|
||
return error("参数 'playlist_id' 不能为空", 400)
|
||
cookies = await _resolve_user_cookies(data, user, request)
|
||
if not cookies:
|
||
return error('请先扫码登录你的网易云账号', 401)
|
||
playlist_id = _extract_id(playlist_id)
|
||
if not str(playlist_id).strip().isdigit():
|
||
return error('无效的歌单ID，请输入数字ID或分享链接')
|
||
try:
|
||
result = await music_api.NeteaseAPI().get_playlist_detail(int(playlist_id), cookies)
|
||
except APIException:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
if isinstance(result, dict):
|
||
pl = result.get('playlist')
|
||
if isinstance(pl, dict):
|
||
if pl.get('name'):
|
||
pl['name'] = await _mask(pl['name'], user)
|
||
cr = pl.get('creator')
|
||
if isinstance(cr, dict) and cr.get('nickname'):
|
||
cr['nickname'] = await _mask(cr['nickname'], user)
|
||
return success({'playlist': result}, '获取个人歌单详情成功')
|
||
|
||
|
||
@router.post('/user/collect')
|
||
async def user_collect(user: LoginUser, request: Request):
|
||
"""收藏/取消收藏歌单或专辑（真实收藏到个人账号）。"""
|
||
await ratelimit.guard(request, bucket='free', limit=30, window=60)
|
||
data = await _request_data(request)
|
||
cookies = await _resolve_user_cookies(data, user, request)
|
||
if not cookies:
|
||
return error('请先扫码登录你的网易云账号', 401)
|
||
collect_id = data.get('id')
|
||
collect_type = data.get('type', 'playlist')
|
||
action = _safe_int(data.get('action'), 1)
|
||
if not collect_id:
|
||
return error('缺少 id 参数')
|
||
if collect_type not in ('playlist', 'album'):
|
||
return error('type 仅支持 playlist/album')
|
||
if action not in (1, 2):
|
||
return error('action 仅支持 1(收藏)/2(取消)')
|
||
collect_id = _extract_id(collect_id)
|
||
if not str(collect_id).strip().isdigit():
|
||
return error('无效的ID，请输入数字ID或分享链接')
|
||
api = music_api.NeteaseAPI()
|
||
try:
|
||
if collect_type == 'album':
|
||
result = await api.subscribe_album(int(collect_id), cookies, action)
|
||
else:
|
||
result = await api.subscribe_playlist(int(collect_id), cookies, action)
|
||
except APIException:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
return success({'result': result}, '收藏成功' if action == 1 else '取消收藏成功')
|
||
|
||
|
||
@router.post('/user/comment')
|
||
async def user_comment(user: LoginUser, request: Request):
|
||
"""发送/回复歌曲评论（weapi，使用个人账号）。"""
|
||
await ratelimit.guard(request, bucket='free', limit=30, window=60)
|
||
data = await _request_data(request)
|
||
cookies = await _resolve_user_cookies(data, user, request)
|
||
if not cookies:
|
||
return error('请先扫码登录你的网易云账号', 401)
|
||
song_id = data.get('song_id') or data.get('id')
|
||
content = (data.get('content') or '').strip()
|
||
action = _safe_int(data.get('action'), 1)
|
||
comment_id = data.get('comment_id') or data.get('reply_to')
|
||
if not song_id:
|
||
return error('缺少歌曲 ID')
|
||
if not content:
|
||
return error('评论内容不能为空')
|
||
if len(content) > 140:
|
||
return error('评论内容不能超过 140 字')
|
||
if action not in (1, 2):
|
||
return error('action 仅支持 1(评论)/2(回复)')
|
||
if action == 2 and not comment_id:
|
||
return error('回复评论缺少目标评论 ID')
|
||
song_id = _extract_id(song_id)
|
||
if not str(song_id).isdigit():
|
||
return error('无效的歌曲 ID')
|
||
thread_id = f'R_SO_4_{song_id}'
|
||
reply_target = _safe_int(comment_id, 0) if comment_id else 0
|
||
if action == 2 and reply_target <= 0:
|
||
return error('回复评论的目标评论 ID 无效')
|
||
try:
|
||
result = await music_api.NeteaseAPI().post_comment(
|
||
thread_id, content, action, reply_target if reply_target > 0 else None, cookies)
|
||
except APIException:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
return success({'result': result}, '评论成功' if action == 1 else '回复成功')
|
||
|
||
|
||
# ============ 公开播放 API ============
|
||
|
||
@router.api_route('/api/playlist/play', methods=['GET', 'POST'])
|
||
async def playlist_play(request: Request):
|
||
"""公开歌单播放 API（需密钥；返回每首歌的可播放直链）。"""
|
||
await ratelimit.guard(request, bucket='free', limit=30, window=60)
|
||
data = await _request_data(request)
|
||
playlist_id = data.get('id')
|
||
level = data.get('level', 'lossless')
|
||
|
||
provided = str(data.get('key') or request.query_params.get('key') or '')
|
||
expected = await _get_setting('playlist_play_key', '')
|
||
if not expected or not provided or not hmac.compare_digest(provided, expected):
|
||
return error('需要有效的 API 密钥（请联系站点管理员获取）', 401)
|
||
|
||
if not playlist_id:
|
||
return error("参数 'playlist_id' 不能为空", 400)
|
||
if level not in VALID_QUALITY_LEVELS:
|
||
return error(f"无效的音质参数，支持: {', '.join(VALID_QUALITY_LEVELS)}")
|
||
limit = _safe_int(data.get('limit', 100), 100)
|
||
if limit < 0:
|
||
return error('limit 参数不能为负数')
|
||
limit = min(limit or _MAX_PLAY_TRACKS, _MAX_PLAY_TRACKS)
|
||
|
||
playlist_id = _extract_id(playlist_id)
|
||
if not str(playlist_id).strip().isdigit():
|
||
return error('无效的歌单ID，请输入数字ID或分享链接')
|
||
|
||
cookies = _cookies()
|
||
api = music_api.NeteaseAPI()
|
||
try:
|
||
detail = await api.get_playlist_detail(int(playlist_id), cookies)
|
||
except APIException:
|
||
return error('服务暂时不可用，请稍后再试', 500)
|
||
|
||
all_tracks = detail.get('tracks', [])
|
||
tracks = all_tracks[:limit]
|
||
|
||
sem = asyncio.Semaphore(_PLAY_CONCURRENCY)
|
||
|
||
async def _resolve(track):
|
||
async with sem:
|
||
try:
|
||
info = await api.get_song_url(track['id'], level, cookies)
|
||
arr = (info or {}).get('data') or []
|
||
if arr and arr[0] and arr[0].get('url'):
|
||
d = arr[0]
|
||
return {
|
||
'id': track['id'],
|
||
'name': track.get('name', ''),
|
||
'artists': track.get('artists', ''),
|
||
'album': track.get('album', ''),
|
||
'picUrl': track.get('picUrl', ''),
|
||
'url': d.get('url', ''),
|
||
'level': d.get('level', level),
|
||
'level_name': media.quality_display_name(d.get('level', level)),
|
||
'size': d.get('size', 0),
|
||
'size_formatted': media.format_file_size(d.get('size', 0)),
|
||
'type': d.get('type'),
|
||
'bitrate': d.get('br'),
|
||
}
|
||
except Exception:
|
||
pass
|
||
return None
|
||
|
||
resolved = await asyncio.gather(*[_resolve(t) for t in tracks])
|
||
playable = [r for r in resolved if r is not None]
|
||
skipped = len(resolved) - len(playable)
|
||
|
||
return success({
|
||
'playlist': {
|
||
'id': detail.get('id'),
|
||
'name': await _mask(detail.get('name', ''), None),
|
||
'coverImgUrl': detail.get('coverImgUrl', ''),
|
||
'creator': await _mask(detail.get('creator', ''), None),
|
||
'trackCount': detail.get('trackCount', len(all_tracks)),
|
||
},
|
||
'account': 'admin',
|
||
'level': level,
|
||
'level_name': media.quality_display_name(level),
|
||
'limit': limit or len(tracks),
|
||
'total': len(all_tracks),
|
||
'playable': len(playable),
|
||
'skipped': skipped,
|
||
'tracks': playable,
|
||
}, '获取歌单播放列表成功')
|
||
|
||
|
||
async def _get_setting(key: str, default: str = '') -> str:
|
||
from core import repo
|
||
return await repo.get_setting(key, default)
|
||
|
||
|
||
# ============ 前端错误上报 ============
|
||
|
||
@router.api_route('/api/fe_error', methods=['POST', 'GET'])
|
||
async def fe_error(request: Request):
|
||
"""前端错误日志上报（10 次/分/IP；字段截断清洗；仅写服务日志，不入库）。"""
|
||
if not ratelimit.rate_ok('fe:' + ratelimit.client_ip(request), 10, 60):
|
||
return error('上报过于频繁', 429)
|
||
data = await _request_data(request)
|
||
|
||
def _clean(key: str, n: int) -> str:
|
||
return str(data.get(key) or '')[:n].replace('\n', ' | ').replace('\r', '')
|
||
|
||
msg = _clean('msg', 200)
|
||
if not msg:
|
||
return error('缺少 msg 参数')
|
||
etype = _clean('type', 20) or 'error'
|
||
stack = _clean('stack', 800)
|
||
page = _clean('page', 120)
|
||
env = _clean('env', 200)
|
||
ip = ratelimit.client_ip(request)
|
||
logger.error('[前端错误] type=%s msg=%s page=%s ip=%s env=%s stack=%s',
|
||
etype, msg, page, ip, env, stack)
|
||
return success(None, '已记录')
|