初始化提交

backend/app/services/auth.py

@@ -0,0 +1,123 @@
+"""认证服务。"""
+
+from datetime import UTC, datetime, timedelta
+
+from jose import JWTError, jwt
+from pwdlib import PasswordHash
+from pwdlib.hashers.argon2 import Argon2Hasher
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import settings
+from app.core.errors import AppError
+from app.core.ids import new_user_id
+from app.models.rbac import Permission, RolePermission, UserRole
+from app.models.user import User
+
+_pwd = PasswordHash([Argon2Hasher()])
+
+
+def hash_password(plain: str) -> str:
+    return _pwd.hash(plain)
+
+
+def verify_password(plain: str, hash: str) -> bool:
+    return _pwd.verify(plain, hash)
+
+
+def _jwt_secret() -> str:
+    secret = settings.jwt_secret
+    if not secret:
+        raise AppError("service_unavailable", "JWT 未配置。")
+    return secret
+
+
+def create_access_token(subject: str, extra: dict | None = None) -> str:
+    secret = _jwt_secret()
+    now = datetime.now(UTC)
+    payload = {
+        "sub": subject,
+        "type": "access",
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.access_token_ttl),
+        **(extra or {}),
+    }
+    return jwt.encode(payload, secret, algorithm="HS256")
+
+
+def create_refresh_token(subject: str) -> str:
+    secret = _jwt_secret()
+    now = datetime.now(UTC)
+    payload = {
+        "sub": subject,
+        "type": "refresh",
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.refresh_token_ttl),
+    }
+    return jwt.encode(payload, secret, algorithm="HS256")
+
+
+def decode_token(token: str) -> dict:
+    secret = _jwt_secret()
+    try:
+        return jwt.decode(token, secret, algorithms=["HS256"])
+    except JWTError:
+        raise AppError("unauthorized", "Token 无效或已过期。") from None
+
+
+async def authenticate_user(db: AsyncSession, username: str, password: str) -> User:
+    result = await db.execute(select(User).where(User.username == username))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise AppError("unauthorized", "用户名或密码错误。")
+    if not user.is_active:
+        raise AppError("unauthorized", "用户已被禁用。")
+    if not verify_password(password, user.password_hash):
+        raise AppError("unauthorized", "用户名或密码错误。")
+    return user
+
+
+async def get_user_by_id(db: AsyncSession, user_id: str) -> User | None:
+    result = await db.execute(select(User).where(User.id == user_id))
+    return result.scalar_one_or_none()
+
+
+async def create_user(
+    db: AsyncSession,
+    username: str,
+    email: str,
+    password: str,
+    is_admin: bool = False,
+) -> User:
+    # 检查用户名和邮箱是否已使用
+    result = await db.execute(
+        select(User).where((User.username == username) | (User.email == email))
+    )
+    existing = result.scalar_one_or_none()
+    if existing is not None:
+        if existing.username == username:
+            raise AppError("conflict", "用户名已被注册。")
+        raise AppError("conflict", "邮箱已被注册。")
+
+    user = User(
+        id=new_user_id(),
+        username=username,
+        email=email,
+        password_hash=hash_password(password),
+        is_active=True,
+        is_admin=is_admin,
+    )
+    db.add(user)
+    await db.flush()
+    return user
+
+
+async def get_user_permissions(db: AsyncSession, user_id: str) -> list[str]:
+    """查询用户的所有权限（通过角色继承），返回 ``resource:action`` 字符串列表。"""
+    result = await db.execute(
+        select(Permission)
+        .join(RolePermission, Permission.id == RolePermission.permission_id)
+        .join(UserRole, RolePermission.role_id == UserRole.role_id)
+        .where(UserRole.user_id == user_id)
+    )
+    return [p.code for p in result.scalars().all()]