Archived
snowy-yang
838d635bc5
上一次重构（8446166）声称「pyright 0 错误」，但 pyproject 里 pyright 的 include 只覆盖 core/web/services —— 根目录 6 个应用模块与整个 tests/ 从未被检查，而 requests→sync_http 迁移的遗留恰好全部藏在那里。补齐 include 后立刻暴露 7 errors + 9 warnings，其中数处在运行时静默失效。 修复： - services/runtime.py：删除 _podcast_billing_count/_billing_ids_count 两个 无调用方的死函数。它们仍调用 api_service._safe_get_request_data()，而该方法 在剥离 Flask 时已被删除，异常又被 except 吞掉 —— 一旦被调用，播客/歌单计费 恒为 1 次且不报任何错。路由层已各自实现同口径版本，故整体删除。 - web/routers/admin_site.py：备份上传的类型判定必须用 starlette 的 UploadFile。 fastapi.UploadFile 是它的子类，而 request.form() 返回基类实例，用错会让 isinstance 恒为 False，把每一次真实上传都判成「请选择数据库文件」。 已补 4 例真实 multipart 回归测试，并用变异测试确认能抓住该缺陷。 - auth_system.py：修正 create_user（实返 sqlite3.Row|None）与 list_cards （实返 (cards,total) 元组）与实现不符的返回注解；注解一改正，立刻暴露出被它 掩盖的 register.py 中 int(user['id']) 未做 None 检查的 500 崩溃路径，已补守卫。 - music_downloader.py：修正注解引用的 core.sync_http.Response（正确名应为 SyncResponse）；封面缓存淘汰不再读类型为 Optional 的 deque.maxlen，改用命名常量。 - services/runtime.py：zip worker 的 result.music_info 可能为 None，原样使用会 炸掉整批任务，改为按单曲失败处理。 - music_api.py：三处 isinstance 三元表达式收敛为 _as_dict() 帮助函数。 - web/main.py：文档串移除已删除的 Flask 兜底描述，补充 data/ 相对 CWD 解析的提醒。 验证：ruff check 通过；pyright 0 errors / 0 warnings（filesAnalyzed=67）； pytest 144 passed；真实 uvicorn 启动冒烟通过（/health、/、静态资源 200， 未鉴权管理端点 403）。生产库仅做只读 integrity_check，未被写入。
225 lines
10 KiB
Python
225 lines
10 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""注册 / 找回密码 / 卡密 / 验证码（FastAPI 栈）——与 Flask 侧响应契约逐字段对齐。
|
||
|
||
已迁移：
|
||
- POST /api/v1/auth/send_code ↔ Flask /auth/send_code
|
||
- POST /api/v1/auth/register ↔ Flask /auth/register
|
||
- POST /api/v1/auth/trial ↔ Flask /auth/trial
|
||
- POST /api/v1/auth/redeem ↔ Flask /auth/redeem
|
||
- POST /api/v1/auth/forgot_password ↔ Flask /auth/forgot_password
|
||
|
||
说明：
|
||
- 同步的 auth_system 调用（SQLite 事务、邮件 SMTP、PBKDF2）经 asyncio.to_thread 执行，
|
||
不阻塞事件循环；行为与 Flask 完全一致。
|
||
- 发码 IP 限流复用 web.auth_state 的模块级状态 `_SEND_CODE_IP`。
|
||
- 失败锁定/验证码消费等安全口径逐字保留。
|
||
"""
|
||
import asyncio
|
||
import os
|
||
import sqlite3
|
||
import time
|
||
from typing import Annotated
|
||
|
||
from fastapi import APIRouter, Depends, Request
|
||
from fastapi.responses import JSONResponse
|
||
|
||
import auth_system as auth
|
||
import web.deps as deps
|
||
from core import db, repo
|
||
from core import session as cs
|
||
from web import ratelimit
|
||
from web.deps import SiteUser, current_user
|
||
from web.request_utils import (
|
||
request_data as _request_data,
|
||
)
|
||
from web.response import error, success
|
||
from web.serializers import user_public as _user_public
|
||
|
||
router = APIRouter()
|
||
|
||
SESSION_COOKIE = 'session'
|
||
_SESSION_MAX_AGE = 7 * 86400
|
||
|
||
|
||
|
||
|
||
def _login_cookie_response(payload: dict, message: str, uid: int, seq: int,
|
||
secure: bool) -> JSONResponse:
|
||
resp = JSONResponse(content={'status': 200, 'success': True, 'message': message, 'data': payload})
|
||
cookie = cs.dumps(deps.secret_key(), {'site_uid': uid, 'site_uid_seq': seq,
|
||
'site_uid_ts': int(time.time())})
|
||
resp.set_cookie(SESSION_COOKIE, cookie, max_age=_SESSION_MAX_AGE, httponly=True,
|
||
samesite='lax', path='/', secure=secure)
|
||
return resp
|
||
|
||
|
||
async def _safe_register_credits() -> int:
|
||
try:
|
||
credits = int(await repo.get_setting('register_credits', str(auth.DEFAULT_REGISTER_CREDITS)) or 0)
|
||
except (TypeError, ValueError):
|
||
return auth.DEFAULT_REGISTER_CREDITS
|
||
return max(0, credits)
|
||
|
||
|
||
@router.post('/auth/send_code')
|
||
async def send_code(request: Request):
|
||
"""发送邮箱验证码（注册/找回用途隔离）。"""
|
||
from web.auth_state import _send_code_ip_check
|
||
ip = ratelimit.client_ip(request)
|
||
if not _send_code_ip_check(ip):
|
||
return error('验证码请求过于频繁，请稍后再试')
|
||
data = await _request_data(request)
|
||
email = str(data.get('email') or '').strip()
|
||
purpose = str(data.get('purpose') or 'register').strip()
|
||
if purpose not in ('register', 'reset'):
|
||
return error('验证码用途不正确')
|
||
try:
|
||
await asyncio.to_thread(auth.send_verify_code, email, purpose)
|
||
return success(message='验证码已发送，请查收邮箱')
|
||
except (ValueError, RuntimeError) as e:
|
||
return error(str(e))
|
||
except Exception:
|
||
return error('验证码发送失败，请稍后重试', 500)
|
||
|
||
|
||
@router.post('/auth/trial')
|
||
async def trial():
|
||
"""试用已并入注册：注册即送 N 次。"""
|
||
return error(f'注册即送 {await _safe_register_credits()} 次免费下载次数，请直接注册账号')
|
||
|
||
|
||
@router.post('/auth/redeem')
|
||
async def redeem(user: Annotated[SiteUser | None, Depends(current_user)], request: Request):
|
||
"""卡密充值。"""
|
||
if user is None:
|
||
return error('请先登录', 401, error_code='unauthorized')
|
||
ip = ratelimit.client_ip(request)
|
||
data = await _request_data(request)
|
||
code = str(data.get('code') or '')
|
||
try:
|
||
credits, remaining = await asyncio.to_thread(auth.redeem_card, code, user.username)
|
||
await asyncio.to_thread(auth.add_log, 'success', user.username, ip, '卡密充值',
|
||
f'{code[:4]}**** · +{credits} 次')
|
||
return success({'credits': credits, 'duration_seconds': remaining,
|
||
'duration_text': auth.format_credits(remaining)},
|
||
f'充值成功，+{credits} 次')
|
||
except ValueError as e:
|
||
await asyncio.to_thread(auth.add_log, 'fail', user.username, ip, '卡密充值', str(e))
|
||
return error(str(e))
|
||
except Exception:
|
||
return error('充值失败，请稍后重试', 500)
|
||
|
||
|
||
@router.post('/auth/forgot_password')
|
||
async def forgot_password(request: Request):
|
||
"""自助找回密码：邮箱验证码 → 重置密码并踢下全部会话（响应防枚举）。"""
|
||
data = await _request_data(request)
|
||
email = auth._normalize_email(str(data.get('email') or ''))
|
||
code = str(data.get('code') or '').strip()
|
||
newpwd = str(data.get('password') or '')
|
||
if len(newpwd) < 8 or len(newpwd) > 128:
|
||
return error('新密码长度需在 8-128 位之间')
|
||
if not email:
|
||
return error('缺少邮箱')
|
||
try:
|
||
if not await asyncio.to_thread(auth.check_verify_code, email, code, 'reset'):
|
||
return error('邮箱验证码错误或已过期')
|
||
user = await asyncio.to_thread(auth.get_user_by_email, email)
|
||
if not user:
|
||
return error('邮箱验证码错误或已过期')
|
||
if user['role'] == 'admin':
|
||
# 管理员不走自助找回（2FA 保护，统一防枚举文案）
|
||
return error('邮箱验证码错误或已过期')
|
||
await asyncio.to_thread(auth.reset_password, user['id'], newpwd)
|
||
await asyncio.to_thread(auth.add_log, 'success', user['username'],
|
||
ratelimit.client_ip(request), '自助找回密码', '邮箱验证码重置')
|
||
return success(message='密码已重置，请使用新密码登录（所有设备已下线）')
|
||
except Exception:
|
||
return error('重置失败，请稍后重试', 500)
|
||
|
||
|
||
@router.post('/auth/register')
|
||
async def register(request: Request):
|
||
"""注册：验证码校验 → 用户名/邮箱查重 → 防刷双闸 → 建号赠送 → 建立会话。"""
|
||
from web.auth_state import re_username_ok
|
||
|
||
data = await _request_data(request)
|
||
username = str(data.get('username') or '').strip()
|
||
password = str(data.get('password') or '')
|
||
email = auth._normalize_email(str(data.get('email') or ''))
|
||
code = str(data.get('code') or '').strip()
|
||
device_id = str(data.get('device_id') or '').strip()[:64]
|
||
ip = ratelimit.client_ip(request)
|
||
|
||
if str(data.get('agree') or '').strip() != '1':
|
||
return error('请先阅读并同意《用户协议》与《隐私政策》')
|
||
if not (3 <= len(username) <= 20 and re_username_ok(username)):
|
||
return error('用户名需 3-20 位，仅支持中文、字母、数字、下划线，且不能纯下划线')
|
||
if len(password) < 8 or len(password) > 128:
|
||
return error('密码长度需在 8-128 位之间')
|
||
if len(email) > 254:
|
||
return error('邮箱格式不正确')
|
||
|
||
try:
|
||
code_ttl = await asyncio.to_thread(auth.check_verify_code, email, code, 'register')
|
||
if not code_ttl:
|
||
return error('邮箱验证码错误或已过期')
|
||
if await asyncio.to_thread(auth.get_user_by_name, username):
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
return error('用户名已被注册')
|
||
if email and await asyncio.to_thread(auth.get_user_by_email, email):
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
return error('该邮箱已被注册，请更换邮箱或联系管理员')
|
||
|
||
device_used_flag = bool(device_id) and await asyncio.to_thread(auth.device_used, device_id)
|
||
if ip and await asyncio.to_thread(auth.register_ip_exceeded, ip):
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
await asyncio.to_thread(auth.add_log, 'fail', username, ip, '注册', '同 IP 24h 注册次数超限')
|
||
return error('当前网络注册过于频繁，请 24 小时后再试或联系管理员')
|
||
|
||
credits = await _safe_register_credits()
|
||
if credits < 0:
|
||
credits = 0
|
||
if device_used_flag:
|
||
credits = 0 # 同设备重复注册：账号照建，不再赠送
|
||
|
||
try:
|
||
user = await asyncio.to_thread(
|
||
auth.create_user, username, password, email=email, credits=credits,
|
||
device_id=device_id, ip=ip,
|
||
ua=str(request.headers.get('user-agent') or ''),
|
||
register_ip_limit=3, register_device_once=True)
|
||
except sqlite3.IntegrityError:
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
return error('用户名或邮箱已被注册，请换一个再试')
|
||
except ValueError as e:
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
await asyncio.to_thread(auth.add_log, 'fail', username, ip, '注册', str(e))
|
||
return error(str(e))
|
||
|
||
# 建号事务已提交却读不回（并发删除/库损坏）：按注册失败处理并把验证码还回去，
|
||
# 不让 user['id'] 直接 TypeError 崩成 500
|
||
if user is None:
|
||
await asyncio.to_thread(auth.restore_verify_code, email, code, code_ttl, 'register')
|
||
await asyncio.to_thread(auth.add_log, 'fail', username, ip, '注册', '建号后读取用户失败')
|
||
return error('注册失败，请稍后重试')
|
||
|
||
# 建立会话（login_seq 递增 + 签发 Cookie）
|
||
uid = int(user['id'])
|
||
now = int(time.time())
|
||
await db.execute('UPDATE users SET last_active=?, last_login=?, '
|
||
'login_seq=COALESCE(login_seq,0)+1 WHERE id=?', (now, now, uid))
|
||
fresh = await repo.get_user_by_id(uid) or {}
|
||
seq = int(fresh.get('login_seq') or 1)
|
||
credits = min(credits, max(0, int(fresh.get('duration_seconds') or 0)))
|
||
await asyncio.to_thread(auth.add_log, 'success', username, ip, '注册账号',
|
||
f'赠送 {credits} 次' if credits else '未赠送次数')
|
||
secure = os.environ.get('ENABLE_SECURE_COOKIE', '').strip().lower() in ('1', 'true', 'yes')
|
||
return _login_cookie_response({
|
||
'user': _user_public(fresh),
|
||
'duration_text': auth.format_credits(int(fresh.get('duration_seconds') or 0)),
|
||
'redirect': 'admin' if fresh.get('role') == 'admin' else 'user',
|
||
}, '注册成功' + (f'，已赠送 {credits} 次下载次数' if credits else ''), uid, seq, secure)
|
||
except Exception:
|
||
return error('注册失败，请稍后重试', 500)
|