Chengfang Lu
7c43b44c57
Huaxu Sentinel Active Safety Platform with embedded algorithm code, Docker Compose setup, and vendored dataset scaffolds for clone-and-run. Co-authored-by: Cursor <cursoragent@cursor.com>
99 lines
3.2 KiB
Python
99 lines
3.2 KiB
Python
"""认证与用户管理 API。"""
|
||
from __future__ import annotations
|
||
|
||
from typing import Annotated, Any
|
||
from urllib.parse import urlencode
|
||
|
||
from fastapi import APIRouter, Depends, HTTPException
|
||
from fastapi.responses import RedirectResponse
|
||
from pydantic import BaseModel, Field
|
||
from sqlalchemy.orm import Session
|
||
|
||
from as_platform.auth.deps import get_current_user, require_permission
|
||
from as_platform.auth.feishu import build_authorize_url, exchange_code, is_feishu_configured, verify_state
|
||
from as_platform.auth.jwt import create_access_token
|
||
from as_platform.auth.users import get_or_create_dev_user, list_users, set_user_roles, upsert_feishu_user
|
||
from as_platform.config import DEV_AUTH_ENABLED, FRONTEND_URL
|
||
from as_platform.db.engine import get_db
|
||
from as_platform.db.init_db import user_to_dict
|
||
from as_platform.db.models import User
|
||
|
||
router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
|
||
|
||
|
||
class DevLoginBody(BaseModel):
|
||
name: str = "开发用户"
|
||
|
||
|
||
class SetRolesBody(BaseModel):
|
||
role_codes: list[str] = Field(default_factory=list)
|
||
|
||
|
||
@router.get("/config")
|
||
def auth_config() -> dict[str, Any]:
|
||
return {
|
||
"feishu_enabled": is_feishu_configured(),
|
||
"dev_auth_enabled": DEV_AUTH_ENABLED and not is_feishu_configured(),
|
||
}
|
||
|
||
|
||
@router.get("/feishu/authorize")
|
||
def feishu_authorize():
|
||
if not is_feishu_configured():
|
||
raise HTTPException(503, "未配置飞书应用，请设置 FEISHU_APP_ID / FEISHU_APP_SECRET")
|
||
url, _ = build_authorize_url()
|
||
return RedirectResponse(url)
|
||
|
||
|
||
@router.get("/feishu/callback")
|
||
def feishu_callback(code: str, state: str, db: Annotated[Session, Depends(get_db)]):
|
||
if not verify_state(state):
|
||
raise HTTPException(400, "无效的 state，请重新登录")
|
||
try:
|
||
info = exchange_code(code)
|
||
except Exception as e:
|
||
raise HTTPException(502, f"飞书登录失败: {e}") from e
|
||
user = upsert_feishu_user(db, info)
|
||
db.commit()
|
||
token = create_access_token(user.id)
|
||
# 避免 BrowserRouter 直达路径 404，统一回根路径并附带 token
|
||
qs = urlencode({"token": token})
|
||
return RedirectResponse(f"{FRONTEND_URL}/?{qs}")
|
||
|
||
|
||
@router.post("/dev/login")
|
||
def dev_login(body: DevLoginBody, db: Annotated[Session, Depends(get_db)]):
|
||
if not DEV_AUTH_ENABLED or is_feishu_configured():
|
||
raise HTTPException(403, "开发登录未启用")
|
||
user = get_or_create_dev_user(db, body.name)
|
||
db.commit()
|
||
token = create_access_token(user.id)
|
||
return {"access_token": token, "user": user_to_dict(user)}
|
||
|
||
|
||
@router.get("/me")
|
||
def auth_me(user: Annotated[User, Depends(get_current_user)]):
|
||
return user_to_dict(user)
|
||
|
||
|
||
@router.get("/users")
|
||
def auth_list_users(
|
||
_user: Annotated[User, Depends(require_permission("admin:users"))],
|
||
db: Annotated[Session, Depends(get_db)],
|
||
):
|
||
return {"items": [user_to_dict(u) for u in list_users(db)]}
|
||
|
||
|
||
@router.put("/users/{user_id}/roles")
|
||
def auth_set_roles(
|
||
user_id: int,
|
||
body: SetRolesBody,
|
||
_user: Annotated[User, Depends(require_permission("admin:users"))],
|
||
db: Annotated[Session, Depends(get_db)],
|
||
):
|
||
user = set_user_roles(db, user_id, body.role_codes)
|
||
if not user:
|
||
raise HTTPException(404, "用户不存在")
|
||
db.commit()
|
||
return user_to_dict(user)
|