modify: auth插件拆分，将token签发部分交给网关

2026-09-10 16:43:43 +08:00
parent 5ec90a5575
commit c139b0c1d3
23 changed files with 691 additions and 290 deletions
@@ -0,0 +1,114 @@
+"""身份源插件共享逻辑：绑定查找、账号 find-or-create、平台 token 签发。
+
+账号落点：
+  - 已有绑定 → 直接映射到既有 users 账号（老用户换身份源登录也是同一账号体系）
+  - 无绑定 → 新建 users 账号（密码为随机值，本插件身份源不走密码登录）+ 绑定记录
+签发：
+  - chongming_auth.issue_token —— claims 契约与网关内置登录完全一致，
+    网关验签 / user_info 透传 / admin 判超管全部无缝生效
+"""
+import logging
+import secrets
+from datetime import datetime
+
+from chongming_auth import LoginPostResponse, Users, issue_token
+from chongming_config import get_config
+from chongming_database import Database
+from chongming_password import hash_password
+from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
+import time
+
+from .models import IdentityBinding
+
+logger = logging.getLogger("plugins.auth_oauth")
+
+# 演示身份源建号使用的占位密码（随机、不可用于密码登录）
+_UNUSABLE_PASSWORD_BYTES = 32
+
+
+async def _lookup_user(db: Database, provider: str,
+                       provider_uid: str) -> Users | None:
+    """按绑定关系定位既有账号；无绑定或账号已消失返回 None。"""
+    async with db.get_session() as session:
+        binding = (
+            await session.execute(
+                select(IdentityBinding).where(
+                    IdentityBinding.provider == provider,  # type: ignore
+                    IdentityBinding.provider_uid == provider_uid,  # type: ignore
+                )
+            )
+        ).scalar_one_or_none()
+        if binding is None:
+            return None
+        user = (
+            await session.execute(select(Users).where(Users.id == binding.user_id))  # type: ignore
+        ).scalar_one_or_none()
+        return user
+
+
+async def _create_user_with_binding(
+    db: Database, provider: str, provider_uid: str, profile: dict
+) -> None:
+    """新建 users 账号 + 绑定记录（同一事务）。
+
+    profile: {username, email, full_name?, avatar_url?}
+    """
+    async with db.get_session() as session:
+        user = Users(
+            username=str(profile.get("username", ""))[:50],
+            email=str(profile["email"]),
+            hashed_password=hash_password(secrets.token_urlsafe(_UNUSABLE_PASSWORD_BYTES)),
+            full_name=profile.get("full_name"),
+            avatar_url=profile.get("avatar_url"),
+            created_at=datetime.now(),
+            updated_at=datetime.now(),
+            is_active=True,
+        )
+        session.add(user)
+        await session.flush()  # 取 user.id 供绑定外键
+        session.add(IdentityBinding(
+            user_id=user.id, provider=provider, provider_uid=provider_uid,
+        )) # type: ignore
+        await session.commit()
+
+
+async def find_or_create_user(
+    db: Database, provider: str, provider_uid: str, profile: dict
+) -> tuple[Users | None, str]:
+    """按身份源 find-or-create 账号，返回 (user, message)。
+
+    user 非 None 即成功；唯一约束冲突（并发首登 / username·email 被占）时
+    回退到重查绑定，仍无则返回失败原因。
+    """
+    user = await _lookup_user(db, provider, provider_uid)
+    if user is not None:
+        return user, ""
+
+    try:
+        await _create_user_with_binding(db, provider, provider_uid, profile)
+    except IntegrityError as e:
+        logger.warning("[%s] 建号冲突（%s），尝试复用既有绑定: %s", provider, provider_uid, e)
+
+    user = await _lookup_user(db, provider, provider_uid)
+    if user is None:
+        return None, "创建用户失败（用户名或邮箱已被占用），请改用其他方式登录"
+    return user, ""
+
+
+def issue_login_response(user: Users) -> LoginPostResponse:
+    """按平台契约签发 token 并组装与内置登录同 shape 的响应。"""
+    security = get_config()["security"]
+    token = issue_token(
+        user, security["secret_key"], security["algorithm"],
+    )
+    return LoginPostResponse(
+        result="success", token=token, message="登录成功", timestamp=time.time()
+    )
+
+
+def fail_response(message: str) -> LoginPostResponse:
+    """业务失败（不抛异常）：result=fail + 原文案，保持与内置登录同 shape。"""
+    return LoginPostResponse(
+        result="fail", token="", message=message, timestamp=time.time()
+    )