feat: 核心模块增强 — 加密 + 运行时配置 + 日志缓冲

- crypto.py: API Key 加密/解密工具 - runtime_config.py: 运行时动态配置管理 - log_buffer.py: 内存日志缓冲区 - config.py: 新增加密配置项 - http_client.py: 增强重试和错误处理
2026-09-19 11:58:03 +08:00
parent b3e2c52b49
commit 786f10aa11
57 changed files with 3178 additions and 488 deletions
@@ -0,0 +1,136 @@
+"""管理后台认证路由:密码登录 → HttpOnly Cookie 会话;支持在线修改密码。
+
+管理员密码以 scrypt 哈希存于数据库(.env 明文仅作初始值,启动时自动迁移为哈希)。
+修改密码会改变会话签名密钥,所有已登录会话随之失效,需重新登录。
+"""
+from __future__ import annotations
+
+import logging
+import secrets
+import time
+from collections import defaultdict, deque
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from pydantic import BaseModel
+
+from src.api.deps import (
+    SESSION_COOKIE,
+    auth_configured,
+    create_session_token,
+    get_session_secret,
+    require_admin,
+    verify_session_token,
+)
+from src.core import crypto
+from src.core.config import settings
+from src.core.runtime_config import (
+    get_admin_password_hash,
+    get_setting_origin,
+    set_admin_password_hash,
+    verify_admin_password,
+)
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
+
+# 简易防爆破:10 分钟窗口内同一 IP 连续失败 5 次即锁定 10 分钟(内存态,重启清零)
+_MAX_FAILS = 5
+_WINDOW_SECONDS = 600
+_fail_times: dict[str, deque[float]] = defaultdict(deque)
+
+# 新密码强度要求
+_MIN_PASSWORD_LEN = 8
+_MAX_PASSWORD_LEN = 128
+
+
+class LoginIn(BaseModel):
+    password: str
+
+
+class PasswordChangeIn(BaseModel):
+    current_password: str
+    new_password: str
+
+
+def _client_ip(request: Request) -> str:
+    return request.client.host if request.client else "unknown"
+
+
+def _is_locked(ip: str) -> bool:
+    dq = _fail_times.get(ip)
+    if not dq:
+        return False
+    now = time.time()
+    while dq and now - dq[0] > _WINDOW_SECONDS:
+        dq.popleft()
+    return len(dq) >= _MAX_FAILS
+
+
+@router.post("/login")
+async def login(body: LoginIn, request: Request, response: Response):
+    ip = _client_ip(request)
+    if not (await get_admin_password_hash() or settings.ADMIN_PASSWORD):
+        raise HTTPException(status_code=503, detail="服务器未配置管理员密码,登录不可用")
+    if _is_locked(ip):
+        logger.warning("管理员登录尝试过于频繁 (ip=%s)", ip)
+        raise HTTPException(status_code=429, detail="失败次数过多,请 10 分钟后再试")
+    if not await verify_admin_password(body.password):
+        _fail_times[ip].append(time.time())
+        logger.warning("管理员登录失败 (ip=%s)", ip)
+        raise HTTPException(status_code=401, detail="密码错误")
+
+    _fail_times.pop(ip, None)
+    response.set_cookie(
+        key=SESSION_COOKIE,
+        value=create_session_token(await get_session_secret()),
+        max_age=settings.ADMIN_SESSION_TTL_HOURS * 3600,
+        httponly=True,
+        samesite="lax",
+        path="/",
+    )
+    logger.info("管理员登录成功 (ip=%s)", ip)
+    return {"ok": True, "expires_in_hours": settings.ADMIN_SESSION_TTL_HOURS}
+
+
+@router.post("/logout")
+async def logout(response: Response):
+    response.delete_cookie(key=SESSION_COOKIE, path="/")
+    return {"ok": True}
+
+
+@router.get("/me")
+async def me(request: Request):
+    """前端登录门禁探测。未启用鉴权时视为已登录(本地开发模式)。"""
+    token = request.cookies.get(SESSION_COOKIE)
+    authenticated = not await auth_configured() or bool(
+        token and verify_session_token(token, await get_session_secret())
+    )
+    has_hash = bool(await get_admin_password_hash())
+    return {
+        "authenticated": authenticated,
+        "enabled": await auth_configured(),
+        "password_origin": "db" if has_hash else ("env" if settings.ADMIN_PASSWORD else "none"),
+    }
+
+
+@router.post("/change-password", dependencies=[Depends(require_admin)])
+async def change_password(body: PasswordChangeIn, request: Request, response: Response):
+    """修改管理员密码:验证当前密码 → 写运行时覆盖 → 清除会话(全端登出)。"""
+    if not await auth_configured():
+        raise HTTPException(status_code=503, detail="服务器未配置管理员密码,无法修改")
+    if not await verify_admin_password(body.current_password):
+        logger.warning("修改密码失败:当前密码错误 (ip=%s)", _client_ip(request))
+        raise HTTPException(status_code=401, detail="当前密码错误")
+
+    new = body.new_password
+    if not (_MIN_PASSWORD_LEN <= len(new) <= _MAX_PASSWORD_LEN):
+        raise HTTPException(status_code=400, detail=f"新密码长度需在 {_MIN_PASSWORD_LEN}-{_MAX_PASSWORD_LEN} 位之间")
+    if await verify_admin_password(new):
+        raise HTTPException(status_code=400, detail="新密码不能与当前密码相同")
+
+    await set_admin_password_hash(crypto.hash_password(new))
+    # 密码即会话签名密钥,修改后所有旧会话失效;主动清除当前 Cookie 要求重新登录
+    response.delete_cookie(key=SESSION_COOKIE, path="/")
+    logger.info("管理员密码已修改 (ip=%s),所有会话已失效", _client_ip(request))
+    return {"ok": True, "message": "密码已修改,请用新密码重新登录"}