HSAP/platform/as_platform/auth/feishu.py

"""飞书 OAuth 登录。"""
from __future__ import annotations

import secrets
import urllib.parse
from datetime import datetime, timedelta, timezone
from typing import Any

import httpx
from jose import JWTError, jwt

from as_platform.config import FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_REDIRECT_URI, JWT_SECRET

FEISHU_AUTHORIZE_URL = "https://passport.feishu.cn/suite/passport/oauth/authorize"
FEISHU_TOKEN_URL = "https://open.feishu.cn/open-apis/authen/v1/access_token"
FEISHU_USER_URL = "https://open.feishu.cn/open-apis/authen/v1/user_info"
FEISHU_TENANT_TOKEN_URL = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
FEISHU_CONTACT_USER_URL = "https://open.feishu.cn/open-apis/contact/v3/users/{user_id}"
FEISHU_CONTACT_USERS_URL = "https://open.feishu.cn/open-apis/contact/v3/users"
FEISHU_DEPARTMENTS_URL = "https://open.feishu.cn/open-apis/contact/v3/departments"

STATE_ALG = "HS256"
STATE_EXPIRE_MINUTES = 10


def is_feishu_configured() -> bool:
    return bool(FEISHU_APP_ID and FEISHU_APP_SECRET)


def build_authorize_url() -> tuple[str, str]:
    # 使用签名 state，避免服务重启/多进程导致内存 state 丢失
    now = datetime.now(timezone.utc)
    state = jwt.encode(
        {
            "nonce": secrets.token_urlsafe(12),
            "iat": int(now.timestamp()),
            "exp": int((now + timedelta(minutes=STATE_EXPIRE_MINUTES)).timestamp()),
            "typ": "feishu_oauth_state",
        },
        JWT_SECRET,
        algorithm=STATE_ALG,
    )
    params = {
        "client_id": FEISHU_APP_ID,
        "redirect_uri": FEISHU_REDIRECT_URI,
        "response_type": "code",
        "state": state,
    }
    return f"{FEISHU_AUTHORIZE_URL}?{urllib.parse.urlencode(params)}", state


def verify_state(state: str) -> bool:
    try:
        payload = jwt.decode(state, JWT_SECRET, algorithms=[STATE_ALG])
        return payload.get("typ") == "feishu_oauth_state"
    except JWTError:
        return False


def exchange_code(code: str) -> dict[str, Any]:
    """用授权码换 user_access_token 并拉取用户信息。"""
    with httpx.Client(timeout=30.0) as client:
        token_resp = client.post(
            FEISHU_TOKEN_URL,
            json={
                "grant_type": "authorization_code",
                "code": code,
                "app_id": FEISHU_APP_ID,
                "app_secret": FEISHU_APP_SECRET,
            },
        )
        token_resp.raise_for_status()
        token_data = token_resp.json()
        if token_data.get("code") != 0:
            raise RuntimeError(token_data.get("msg") or "飞书 token 交换失败")

        access_token = token_data["data"]["access_token"]
        user_resp = client.get(
            FEISHU_USER_URL,
            headers={"Authorization": f"Bearer {access_token}"},
        )
        user_resp.raise_for_status()
        user_data = user_resp.json()
        if user_data.get("code") != 0:
            raise RuntimeError(user_data.get("msg") or "飞书用户信息获取失败")

        info = user_data["data"]
        department_ids: list[str] = []
        user_id = info.get("user_id")
        tenant_key = info.get("tenant_key")
        open_id = info.get("open_id") or info.get("openId")
        if open_id:
            try:
                tenant_access_token = _get_tenant_access_token(client)
                contact_user = _get_contact_user_profile(client, tenant_access_token, open_id)
                user_id = contact_user.get("user_id") or user_id
                tenant_key = contact_user.get("tenant_key") or tenant_key
                raw_department_ids = contact_user.get("department_ids")
                if isinstance(raw_department_ids, list):
                    department_ids = [str(x) for x in raw_department_ids if x]
            except Exception:
                # 联系人接口失败时不阻断登录
                department_ids = []

        return {
            "open_id": open_id,
            "union_id": info.get("union_id") or info.get("unionId"),
            "user_id": user_id,
            "tenant_key": tenant_key,
            "department_ids": department_ids,
            "name": info.get("name") or info.get("en_name") or "飞书用户",
            "email": info.get("email") or info.get("enterprise_email"),
            "avatar_url": info.get("avatar_url") or info.get("avatar_big"),
        }


def _get_tenant_access_token(client: httpx.Client) -> str:
    resp = client.post(
        FEISHU_TENANT_TOKEN_URL,
        json={"app_id": FEISHU_APP_ID, "app_secret": FEISHU_APP_SECRET},
    )
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") != 0:
        raise RuntimeError(data.get("msg") or "飞书 tenant token 获取失败")
    token = data.get("tenant_access_token")
    if not token:
        raise RuntimeError("飞书 tenant token 为空")
    return token


def _get_contact_user_profile(
    client: httpx.Client, tenant_access_token: str, open_id: str
) -> dict[str, Any]:
    resp = client.get(
        FEISHU_CONTACT_USER_URL.format(user_id=urllib.parse.quote(open_id, safe="")),
        params={"user_id_type": "open_id", "department_id_type": "open_department_id"},
        headers={"Authorization": f"Bearer {tenant_access_token}"},
    )
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") != 0:
        raise RuntimeError(data.get("msg") or "飞书联系人信息获取失败")
    return data.get("data", {}).get("user", {})


def fetch_feishu_users(page_size: int = 100) -> tuple[list[dict[str, Any]], dict[str, str]]:
    """从飞书通讯录批量拉取用户列表并获取部门名称映射，返回 (users, dept_name_map)。
    如果应用无通讯录权限则返回空列表。"""
    if not is_feishu_configured():
        return [], {}

    try:
        with httpx.Client(timeout=30) as client:
            token = _get_tenant_access_token(client)

        # 先获取部门列表（如果应用有通讯录权限）
        dept_map: dict[str, str] = {}
        try:
            page_token = ""
            while True:
                params: dict[str, str | int] = {"page_size": 100, "department_id_type": "open_department_id"}
                if page_token:
                    params["page_token"] = page_token
                resp = client.get(FEISHU_DEPARTMENTS_URL, params=params, headers={"Authorization": f"Bearer {token}"})
                if resp.status_code >= 400:
                    break  # 无部门权限，跳过
                d = resp.json()
                if d.get("code") == 0:
                    for item in d.get("data", {}).get("items", []):
                        dept_map[item.get("open_department_id", "")] = item.get("name", "")
                page_token = d.get("data", {}).get("page_token", "")
                if not page_token:
                    break
        except Exception:
            pass  # 无需部门信息也可同步用户

            # 再获取用户列表（如无通讯录权限则跳过）
            users: list[dict[str, Any]] = []
            try:
                page_token = ""
                while True:
                    params = {
                        "user_id_type": "open_id",
                        "department_id_type": "open_department_id",
                        "page_size": min(page_size, 100),
                    }
                    if page_token:
                        params["page_token"] = page_token  # type: ignore
                    resp = client.get(FEISHU_CONTACT_USERS_URL, params=params, headers={"Authorization": f"Bearer {token}"})  # type: ignore
                    if resp.status_code >= 400:
                        break
                    d = resp.json()
                    if d.get("code") == 0:
                        for item in d.get("data", {}).get("items", []):
                            users.append({
                                "open_id": item.get("open_id"),
                                "union_id": item.get("union_id"),
                                "user_id": item.get("user_id"),
                                "name": item.get("name"),
                                "email": item.get("email"),
                                "mobile": item.get("mobile"),
                                "avatar_url": item.get("avatar", {}).get("avatar_240") if isinstance(item.get("avatar"), dict) else None,
                                "department_ids": item.get("department_ids", []),
                            })
                    page_token = d.get("data", {}).get("page_token", "")
                    if not page_token:
                        break
            except Exception:
                pass  # 无通讯录权限，跳过用户列表拉取

            return users, dept_map
    except Exception:
        return [], {}


def sync_feishu_users_to_db(db: Session) -> dict[str, int]:
    """同步飞书用户到数据库，返回 {created, updated, total}。"""
    users, dept_map = fetch_feishu_users()
    created, updated = 0, 0
    for info in users:
        open_id = info.get("open_id")
        if not open_id:
            continue
        user = db.query(User).filter(User.feishu_open_id == open_id).first()
        if not user:
            user = User(feishu_open_id=open_id)
            db.add(user)
            created += 1
        else:
            updated += 1
        user.feishu_union_id = info.get("union_id") or user.feishu_union_id
        user.feishu_user_id = info.get("user_id") or user.feishu_user_id
        user.name = info.get("name") or user.name
        user.email = info.get("email") or user.email or user.email
        user.avatar_url = info.get("avatar_url") or user.avatar_url
        dept_ids = info.get("department_ids")
        if isinstance(dept_ids, list) and dept_ids:
            dept_names = [dept_map.get(str(did), str(did)) for did in dept_ids]
            user.feishu_department_ids_json = json.dumps(dept_names, ensure_ascii=False)
        user.is_active = True
    db.flush()
    return {"created": created, "updated": updated, "total": len(users)}