"""API client, credential and least-privilege policy management.""" from __future__ import annotations import base64 import binascii from datetime import datetime, timedelta, timezone import hashlib import hmac import json import os from pathlib import Path import re import secrets import tempfile from typing import Any from urllib.parse import urlsplit import uuid from fastapi import HTTPException from app.config import settings from app.data_platform.mysql_db import ( data_pool_available, get_data_conn, get_provisioner_conn, ) from app.data_platform.mysql_service import ( ensure_platform_registry, list_project_table_entries, ) VALID_ACTIONS = {"metadata", "read", "create", "update", "delete"} _SSH_PUBLIC_KEY_RE = re.compile( r"^(ssh-rsa|ssh-ed25519)\s+([A-Za-z0-9+/]+={0,2})(?:\s+[^\r\n]{1,120})?$" ) _MYSQL_ACCOUNT_RE = re.compile(r"^dba_[a-f0-9]{12}$") def _ssh_field(blob: bytes, offset: int) -> tuple[bytes, int]: if offset + 4 > len(blob): raise ValueError("SSH 公钥内容不完整") length = int.from_bytes(blob[offset : offset + 4], "big") start = offset + 4 end = start + length if length > 4096 or end > len(blob): raise ValueError("SSH 公钥字段长度不正确") return blob[start:end], end def _mysql_account_sql(username: str, *, parameterized: bool = False) -> str: if not _MYSQL_ACCOUNT_RE.fullmatch(username): raise ValueError("DBeaver管理账号格式异常") # PyMySQL/aiomysql use percent-style parameter interpolation. A literal # host wildcard must therefore be doubled only in statements with %s. host = "%%" if parameterized else "%" return f"'{username}'@'{host}'" async def _ready() -> None: if not data_pool_available(): raise HTTPException( 503, "接口中心依赖的数据中心 MySQL 服务未连接", ) await ensure_platform_registry() def _decode_json(value: Any, fallback: Any) -> Any: if value is None: return fallback if isinstance(value, (list, dict)): return value if isinstance(value, (bytes, bytearray)): value = value.decode("utf-8") try: return json.loads(str(value)) except (TypeError, ValueError): return fallback def _safe(value: Any) -> Any: if isinstance(value, datetime): return value.isoformat() if isinstance(value, dict): return {key: _safe(item) for key, item in value.items()} if isinstance(value, list): return [_safe(item) for item in value] return value def _row(row: dict[str, Any] | None) -> dict[str, Any] | None: if row is None: return None result = {key: _safe(value) for key, value in dict(row).items()} for key in ( "actions_json", "readable_fields_json", "writable_fields_json", "row_filter_json", ): if key in result: result[key.removesuffix("_json")] = _decode_json(result.pop(key), [] if key != "row_filter_json" else {}) return result def _api_key_hash(api_key: str) -> str: pepper = settings.interface_api_secret or settings.auth_secret return hmac.new( pepper.encode("utf-8"), api_key.encode("utf-8"), hashlib.sha256, ).hexdigest() def _parse_expiry(value: Any) -> datetime: now = datetime.now(timezone.utc) if value in (None, ""): parsed = now + timedelta(days=settings.interface_api_default_expiry_days) elif isinstance(value, datetime): parsed = value else: try: parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00")) except ValueError as exc: raise ValueError("凭证过期时间格式不正确") from exc if parsed.tzinfo is None: parsed_utc = parsed.replace(tzinfo=timezone.utc) else: parsed_utc = parsed.astimezone(timezone.utc) if parsed_utc <= now: raise ValueError("凭证过期时间必须晚于当前时间") maximum = now + timedelta(days=settings.interface_api_max_expiry_days) if parsed_utc > maximum: raise ValueError( f"接口密钥最长只能签发 {settings.interface_api_max_expiry_days} 天" ) return parsed_utc.replace(tzinfo=None) async def interface_summary() -> dict[str, Any]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT (SELECT COUNT(*) FROM api_clients WHERE status='active') AS active_clients, (SELECT COUNT(*) FROM api_credentials WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at > CURRENT_TIMESTAMP(6))) AS active_credentials, (SELECT COUNT(*) FROM api_policies WHERE status='active') AS active_policies, (SELECT COUNT(*) FROM dbeaver_access_grants WHERE status='active') AS active_dbeaver_grants, (SELECT COUNT(*) FROM api_call_logs WHERE created_at >= CURRENT_TIMESTAMP(6) - INTERVAL 24 HOUR) AS calls_24h, (SELECT COUNT(*) FROM api_call_logs WHERE created_at >= CURRENT_TIMESTAMP(6) - INTERVAL 24 HOUR AND status_code >= 400) AS errors_24h """ ) summary = dict(await cur.fetchone()) mysql_url = urlsplit(settings.data_mysql_url) database_port = ( settings.data_mysql_admin_port or settings.data_mysql_public_port or mysql_url.port or 3306 ) ssh_host = ( settings.data_mysql_ssh_host.strip() or settings.data_mysql_public_host.strip() ) host_bind = settings.mysql_host_bind.strip() or "127.0.0.1" loopback_hosts = {"127.0.0.1", "localhost", "::1"} publicly_bound = host_bind not in loopback_hosts return { **{key: int(value or 0) for key, value in summary.items()}, "data_engine": "MySQL", "public_base_path": "/v1/openapi/data", "direct_database_access": "DBeaver / MySQL account (separate authorization)", "direct_access_enabled": settings.data_mysql_direct_access_enabled, # Legacy aliases retained for existing clients. New clients should # use the explicit SSH and database endpoint fields below. "direct_access_host": ssh_host, "direct_access_port": database_port, "direct_access_transport": settings.data_mysql_direct_transport, "ssh_tunnel_required": settings.data_mysql_ssh_tunnel_required, "ssh_host": ssh_host, "ssh_port": settings.data_mysql_ssh_port, "ssh_username": settings.data_mysql_ssh_username, "ssh_auth_method": settings.data_mysql_ssh_auth_method, "managed_access_enabled": settings.data_mysql_managed_access_enabled, "ssh_key_auto_install": bool( settings.data_mysql_ssh_authorized_keys_file.strip() ), "account_provisioning_ready": bool( settings.data_mysql_provisioner_user.strip() and settings.data_mysql_provisioner_password ), "ssh_host_key_fingerprint": _ssh_host_key_fingerprint(), "database_host": settings.data_mysql_admin_host.strip() or "127.0.0.1", "database_port": database_port, "database_account_policy": settings.data_mysql_admin_account_policy, "mysql_host_bind": host_bind, "mysql_publicly_bound": publicly_bound, "database_audit_enabled": settings.data_mysql_audit_enabled, "application_audit_enabled": True, "sql_console_write_enabled": settings.data_sql_console_write_enabled, "backup_enabled": settings.data_backup_enabled, "backup_encryption_required": settings.data_backup_encryption_required, "backup_retention_days": settings.data_backup_retention_days, } def _normalize_ssh_public_key(value: Any) -> tuple[str, str, str]: candidate = " ".join(str(value or "").strip().split()) match = _SSH_PUBLIC_KEY_RE.fullmatch(candidate) if not match: raise ValueError("SSH 公钥格式不正确，仅支持 RSA 或 ED25519 公钥") key_type, encoded = match.group(1), match.group(2) try: decoded = base64.b64decode(encoded, validate=True) except (binascii.Error, ValueError) as exc: raise ValueError("SSH 公钥内容不是有效的 Base64") from exc if len(decoded) < 48 or len(decoded) > 4096: raise ValueError("SSH 公钥长度不正确") embedded_type, offset = _ssh_field(decoded, 0) if embedded_type.decode("ascii", errors="ignore") != key_type: raise ValueError("SSH 公钥类型与内容不一致") if key_type == "ssh-ed25519": public_bytes, offset = _ssh_field(decoded, offset) if len(public_bytes) != 32: raise ValueError("ED25519 公钥长度不正确") else: exponent, offset = _ssh_field(decoded, offset) modulus, offset = _ssh_field(decoded, offset) exponent_value = int.from_bytes(exponent, "big") modulus_bits = int.from_bytes(modulus, "big").bit_length() if exponent_value < 3 or exponent_value % 2 == 0: raise ValueError("RSA 公钥指数不正确") if not 2048 <= modulus_bits <= 8192: raise ValueError("RSA 公钥必须为 2048–8192 位") if offset != len(decoded): raise ValueError("SSH 公钥包含多余数据") fingerprint = base64.b64encode(hashlib.sha256(decoded).digest()).decode().rstrip("=") return key_type, f"{key_type} {encoded}", f"SHA256:{fingerprint}" def _ssh_host_key_fingerprint() -> str: raw_path = settings.data_mysql_ssh_host_public_key_file.strip() if not raw_path: return "" path = Path(raw_path) try: if not path.is_absolute() or path.is_symlink() or path.stat().st_size > 8192: return "" _key_type, _public_key, fingerprint = _normalize_ssh_public_key( path.read_text(encoding="utf-8") ) return fingerprint except (OSError, UnicodeError, ValueError): return "" def _authorized_keys_path() -> Path: if not settings.data_mysql_managed_access_enabled: raise HTTPException(503, "DBeaver 管理接入尚未启用") raw_path = settings.data_mysql_ssh_authorized_keys_file.strip() if not raw_path: raise HTTPException(503, "服务器尚未配置 DBeaver SSH 公钥文件") path = Path(raw_path) if not path.is_absolute(): raise HTTPException(503, "DBeaver SSH 公钥文件必须使用绝对路径") return path def _write_authorized_keys(rows: list[dict[str, Any]]) -> None: target = _authorized_keys_path() target.parent.mkdir(parents=True, exist_ok=True) if target.is_symlink(): raise RuntimeError("拒绝写入符号链接形式的 SSH 公钥文件") lines = [ "# Managed by the Interface Center. Manual edits will be replaced." ] for item in rows: username = str(item["mysql_username"]) if not _MYSQL_ACCOUNT_RE.fullmatch(username): continue _key_type, public_key, _fingerprint = _normalize_ssh_public_key( item["ssh_public_key"] ) lines.append( 'restrict,port-forwarding,permitopen="127.0.0.1:3307" ' f"{public_key} nianxx:{item['id']}:{username}" ) content = "\n".join(lines) + "\n" file_descriptor, temporary_name = tempfile.mkstemp( prefix=".authorized_keys.", dir=str(target.parent) ) try: with os.fdopen(file_descriptor, "w", encoding="utf-8") as handle: handle.write(content) handle.flush() os.fsync(handle.fileno()) os.chmod(temporary_name, 0o600) os.replace(temporary_name, target) finally: if os.path.exists(temporary_name): os.unlink(temporary_name) async def _refresh_dbeaver_authorized_keys() -> None: async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT id, mysql_username, ssh_public_key FROM dbeaver_access_grants WHERE status='active' ORDER BY created_at """ ) rows = [dict(item) for item in await cur.fetchall()] _write_authorized_keys(rows) async def list_dbeaver_access_grants() -> list[dict[str, Any]]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT id, display_name, mysql_username, database_id, database_name, permission_level, ssh_key_type, ssh_key_fingerprint, created_by, status, revoked_at, created_at FROM dbeaver_access_grants ORDER BY created_at DESC """ ) return [_row(dict(item)) or {} for item in await cur.fetchall()] async def _write_dbeaver_audit( cur: Any, *, actor: str, action: str, grant_id: str, outcome: str, details: dict[str, Any], ) -> None: await cur.execute( """ INSERT INTO admin_action_logs ( actor, action_name, resource_type, resource_id, outcome, details_json ) VALUES (%s, %s, 'dbeaver_access', %s, %s, %s) """, (actor, action, grant_id, outcome, json.dumps(details, ensure_ascii=False)), ) def _mysql_access_details() -> dict[str, Any]: mysql_url = urlsplit(settings.data_mysql_url) return { "ssh_host": settings.data_mysql_ssh_host.strip(), "ssh_port": settings.data_mysql_ssh_port, "ssh_username": settings.data_mysql_ssh_username, "database_host": settings.data_mysql_admin_host.strip() or "127.0.0.1", "database_port": ( settings.data_mysql_admin_port or settings.data_mysql_public_port or mysql_url.port or 3306 ), } async def issue_dbeaver_access( body: dict[str, Any], actor: str ) -> dict[str, Any]: await _ready() _authorized_keys_path() display_name = str(body.get("display_name") or "").strip() database_id = str(body.get("database_id") or "").strip() permission = str(body.get("permission") or "read").strip().lower() if not display_name: raise ValueError("请输入数据管理员姓名") if len(display_name) > 100: raise ValueError("数据管理员姓名不能超过 100 个字符") if permission not in {"read", "write"}: raise ValueError("DBeaver 权限只能选择只读或读写") key_type, public_key, fingerprint = _normalize_ssh_public_key( body.get("public_key") ) grant_id = str(uuid.uuid4()) mysql_username = f"dba_{uuid.uuid4().hex[:12]}" mysql_password = secrets.token_urlsafe(24) account = _mysql_account_sql(mysql_username) parameterized_account = _mysql_account_sql(mysql_username, parameterized=True) database_name = "" created_account = False try: # Verify the shared key file before creating a database account. This # avoids issuing a credential that cannot be used by the SSH gateway. await _refresh_dbeaver_authorized_keys() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT database_name FROM project_databases WHERE project_id=%s AND status='ready' """, (database_id,), ) database = await cur.fetchone() if not database: raise ValueError("目标数据库不存在或尚未就绪") database_name = str(database["database_name"]) if not re.fullmatch(r"[A-Za-z][A-Za-z0-9_]{0,63}", database_name): raise ValueError("目标数据库编码不合法") await cur.execute( """ SELECT 1 FROM dbeaver_access_grants WHERE ssh_key_fingerprint=%s AND status='active' """, (fingerprint,), ) if await cur.fetchone(): raise ValueError("该 SSH 公钥已用于一个有效的管理账号") # CREATE USER and GRANT are intentionally isolated from the normal # Data Center connection. Only this short-lived broker account has # account-provisioning privileges. async with get_provisioner_conn() as provisioner_conn: async with provisioner_conn.cursor() as cur: await cur.execute( f"CREATE USER {parameterized_account} IDENTIFIED BY %s " "PASSWORD EXPIRE INTERVAL 90 DAY " "FAILED_LOGIN_ATTEMPTS 5 PASSWORD_LOCK_TIME 1", (mysql_password,), ) created_account = True privileges = "SELECT, SHOW VIEW" if permission == "write": privileges = "SELECT, INSERT, UPDATE, DELETE, SHOW VIEW" await cur.execute( f"GRANT {privileges} ON `{database_name}`.* TO {account}" ) await provisioner_conn.commit() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ INSERT INTO dbeaver_access_grants ( id, display_name, mysql_username, database_id, database_name, permission_level, ssh_key_type, ssh_public_key, ssh_key_fingerprint, created_by ) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s) """, ( grant_id, display_name, mysql_username, database_id, database_name, permission, key_type, public_key, fingerprint, actor, ), ) await _write_dbeaver_audit( cur, actor=actor, action="issue_dbeaver_access", grant_id=grant_id, outcome="success", details={ "database_id": database_id, "database_name": database_name, "mysql_username": mysql_username, "permission": permission, "ssh_key_fingerprint": fingerprint, }, ) await conn.commit() await _refresh_dbeaver_authorized_keys() except Exception as exc: if created_account: try: async with get_provisioner_conn() as cleanup_conn: async with cleanup_conn.cursor() as cleanup_cur: await cleanup_cur.execute(f"DROP USER IF EXISTS {account}") await cleanup_conn.commit() async with get_data_conn() as metadata_conn: async with metadata_conn.cursor() as cleanup_cur: await cleanup_cur.execute( "DELETE FROM dbeaver_access_grants WHERE id=%s", (grant_id,), ) await metadata_conn.commit() await _refresh_dbeaver_authorized_keys() except Exception: pass if isinstance(exc, ValueError): raise if isinstance(exc, HTTPException): raise raise HTTPException( 503, "DBeaver账号签发失败，请确认MySQL账号签发权限和SSH网关已完成部署", ) from exc return { "id": grant_id, "display_name": display_name, "mysql_username": mysql_username, "mysql_password": mysql_password, "password_shown_once": True, "database_id": database_id, "database_name": database_name, "permission_level": permission, "ssh_key_type": key_type, "ssh_key_fingerprint": fingerprint, "status": "active", **_mysql_access_details(), } async def revoke_dbeaver_access(grant_id: str, actor: str) -> dict[str, bool]: await _ready() _authorized_keys_path() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT mysql_username, database_id, database_name, status FROM dbeaver_access_grants WHERE id=%s """, (grant_id,), ) grant = await cur.fetchone() if not grant: raise ValueError("DBeaver管理账号不存在") username = str(grant["mysql_username"]) if not _MYSQL_ACCOUNT_RE.fullmatch(username): raise ValueError("DBeaver管理账号格式异常，已拒绝操作") if str(grant["status"]) == "active": try: async with get_provisioner_conn() as provisioner_conn: async with provisioner_conn.cursor() as cur: await cur.execute( f"DROP USER IF EXISTS {_mysql_account_sql(username)}" ) await provisioner_conn.commit() except Exception as exc: raise HTTPException(503, "MySQL管理账号撤销失败，请检查账号签发服务") from exc async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ UPDATE dbeaver_access_grants SET status='revoked', revoked_at=CURRENT_TIMESTAMP(6) WHERE id=%s """, (grant_id,), ) await _write_dbeaver_audit( cur, actor=actor, action="revoke_dbeaver_access", grant_id=grant_id, outcome="success", details={ "database_id": grant["database_id"], "database_name": grant["database_name"], "mysql_username": username, }, ) await conn.commit() try: await _refresh_dbeaver_authorized_keys() except Exception as exc: raise HTTPException(503, "账号已撤销，但SSH公钥同步失败，请重试撤销操作") from exc return {"ok": True} async def interface_catalog() -> list[dict[str, Any]]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT project_id, display_name, database_name FROM project_databases WHERE status='ready' ORDER BY display_name, project_id """ ) databases = [dict(item) for item in await cur.fetchall()] result = [] for database in databases: entries = await list_project_table_entries(str(database["project_id"])) result.append( { **_safe(database), "tables": [ { "code": definition.code, "label": definition.label, "group": definition.group, "fields": [field.as_dict() for field in definition.fields], } for definition, _origin, _source in entries ], } ) return result async def list_api_clients() -> list[dict[str, Any]]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT c.*, COUNT(DISTINCT CASE WHEN k.revoked_at IS NULL THEN k.id END) AS credential_count, COUNT(DISTINCT CASE WHEN p.status='active' THEN p.id END) AS policy_count FROM api_clients c LEFT JOIN api_credentials k ON k.client_id=c.id LEFT JOIN api_policies p ON p.client_id=c.id GROUP BY c.id ORDER BY c.created_at DESC """ ) return [_row(dict(item)) or {} for item in await cur.fetchall()] async def create_api_client(body: dict[str, Any], actor: str) -> dict[str, Any]: await _ready() name = str(body.get("name") or "").strip() if not name: raise ValueError("请输入应用或设备名称") if len(name) > 100: raise ValueError("应用或设备名称不能超过 100 个字符") client_id = str(uuid.uuid4()) async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ INSERT INTO api_clients (id, name, description, owner, status) VALUES (%s, %s, %s, %s, 'active') """, (client_id, name, str(body.get("description") or "")[:500], actor), ) await cur.execute("SELECT * FROM api_clients WHERE id=%s", (client_id,)) result = _row(await cur.fetchone()) or {} await conn.commit() return result async def update_api_client(client_id: str, body: dict[str, Any]) -> dict[str, Any]: await _ready() updates: list[str] = [] params: list[Any] = [] if "name" in body: name = str(body.get("name") or "").strip() if not name: raise ValueError("请输入应用或设备名称") updates.append("name=%s") params.append(name[:100]) if "description" in body: updates.append("description=%s") params.append(str(body.get("description") or "")[:500]) if "status" in body: status = str(body.get("status") or "") if status not in {"active", "disabled"}: raise ValueError("客户端状态不正确") updates.append("status=%s") params.append(status) if not updates: raise ValueError("没有可修改内容") async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( f"UPDATE api_clients SET {', '.join(updates)} WHERE id=%s", [*params, client_id], ) if cur.rowcount != 1: raise ValueError("接口客户端不存在") if body.get("status") == "disabled": await cur.execute( "UPDATE api_credentials SET revoked_at=CURRENT_TIMESTAMP(6) WHERE client_id=%s AND revoked_at IS NULL", (client_id,), ) await cur.execute( "UPDATE api_policies SET status='disabled' WHERE client_id=%s", (client_id,), ) await cur.execute("SELECT * FROM api_clients WHERE id=%s", (client_id,)) result = _row(await cur.fetchone()) or {} await conn.commit() return result async def delete_api_client(client_id: str) -> dict[str, bool]: await update_api_client(client_id, {"status": "disabled"}) async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( "UPDATE api_policies SET status='disabled' WHERE client_id=%s", (client_id,), ) await conn.commit() return {"ok": True} async def list_api_credentials(client_id: str | None = None) -> list[dict[str, Any]]: await _ready() where = "WHERE k.client_id=%s" if client_id else "" params = (client_id,) if client_id else () async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( f""" SELECT k.*, c.name AS client_name FROM api_credentials k JOIN api_clients c ON c.id=k.client_id {where} ORDER BY k.created_at DESC """, params, ) result = [_row(dict(item)) or {} for item in await cur.fetchall()] for item in result: item.pop("key_hash", None) return result async def issue_api_credential(client_id: str, body: dict[str, Any]) -> dict[str, Any]: await _ready() name = str(body.get("name") or "默认密钥").strip() or "默认密钥" expires_at = _parse_expiry(body.get("expires_at")) credential_id = str(uuid.uuid4()) prefix = f"dc_live_{secrets.token_hex(4)}" api_key = f"{prefix}.{secrets.token_urlsafe(32)}" async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( "SELECT 1 FROM api_clients WHERE id=%s AND status='active'", (client_id,), ) if not await cur.fetchone(): raise ValueError("接口客户端不存在或未启用") await cur.execute( """ INSERT INTO api_credentials ( id, client_id, name, key_prefix, key_hash, expires_at ) VALUES (%s, %s, %s, %s, %s, %s) """, (credential_id, client_id, name[:100], prefix, _api_key_hash(api_key), expires_at), ) await cur.execute("SELECT * FROM api_credentials WHERE id=%s", (credential_id,)) result = _row(await cur.fetchone()) or {} await conn.commit() result.pop("key_hash", None) result["api_key"] = api_key result["shown_once"] = True return result async def revoke_api_credential(credential_id: str) -> dict[str, bool]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ UPDATE api_credentials SET revoked_at=CURRENT_TIMESTAMP(6) WHERE id=%s AND revoked_at IS NULL """, (credential_id,), ) if cur.rowcount != 1: raise ValueError("接口密钥不存在或已撤销") await conn.commit() return {"ok": True} async def list_api_policies(client_id: str | None = None) -> list[dict[str, Any]]: await _ready() where = "WHERE p.client_id=%s" if client_id else "" params = (client_id,) if client_id else () async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( f""" SELECT p.*, c.name AS client_name, d.display_name AS database_name FROM api_policies p JOIN api_clients c ON c.id=p.client_id LEFT JOIN project_databases d ON d.project_id=p.database_id {where} ORDER BY p.created_at DESC """, params, ) return [_row(dict(item)) or {} for item in await cur.fetchall()] async def _validate_policy(body: dict[str, Any]) -> dict[str, Any]: client_id = str(body.get("client_id") or "").strip() database_id = str(body.get("database_id") or "").strip() table_code = str(body.get("table_code") or "*").strip() or "*" actions = sorted({str(value) for value in body.get("actions") or []}) invalid = sorted(set(actions) - VALID_ACTIONS) if not client_id or not database_id: raise ValueError("请选择接口客户端和数据库") if not actions: raise ValueError("请至少授予一个接口动作") if invalid: raise ValueError(f"不支持的接口动作：{', '.join(invalid)}") readable = [str(value) for value in body.get("readable_fields") or ["*"]] writable = [str(value) for value in body.get("writable_fields") or ["*"]] row_filter = body.get("row_filter") or {} if not isinstance(row_filter, dict): raise ValueError("行级数据范围必须是 JSON 对象") status = str(body.get("status") or "active") if status not in {"active", "disabled"}: raise ValueError("权限策略状态不正确") for field_code, expected in row_filter.items(): values = expected if isinstance(expected, list) else [expected] if any(isinstance(value, (dict, list)) for value in values): raise ValueError(f"行级范围 {field_code} 仅支持标量或标量数组") async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute("SELECT 1 FROM api_clients WHERE id=%s", (client_id,)) if not await cur.fetchone(): raise ValueError("接口客户端不存在") await cur.execute( "SELECT 1 FROM project_databases WHERE project_id=%s AND status='ready'", (database_id,), ) if not await cur.fetchone(): raise ValueError("数据中心数据库不存在") if table_code == "*": if readable != ["*"] or writable != ["*"] or row_filter: raise ValueError("授权全部表时，字段范围必须为 * 且不能设置跨表行过滤") else: entry = next( ( item for item in await list_project_table_entries(database_id) if item[0].code == table_code ), None, ) if not entry: raise ValueError("授权的数据表不存在") field_codes = {field.code for field in entry[0].fields} for label, fields in (("可读字段", readable), ("可写字段", writable)): unknown = sorted(set(fields) - field_codes - {"*"}) if unknown: raise ValueError(f"{label}不存在：{', '.join(unknown)}") unknown_scope = sorted(set(row_filter) - field_codes) if unknown_scope: raise ValueError(f"行级范围字段不存在：{', '.join(unknown_scope)}") return { "client_id": client_id, "database_id": database_id, "table_code": table_code, "actions": actions, "readable_fields": readable, "writable_fields": writable, "row_filter": row_filter, "status": status, } async def create_api_policy(body: dict[str, Any]) -> dict[str, Any]: await _ready() policy = await _validate_policy(body) policy_id = str(uuid.uuid4()) async with get_data_conn() as conn: async with conn.cursor() as cur: try: await cur.execute( """ INSERT INTO api_policies ( id, client_id, database_id, table_code, actions_json, readable_fields_json, writable_fields_json, row_filter_json, status ) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s) """, ( policy_id, policy["client_id"], policy["database_id"], policy["table_code"], json.dumps(policy["actions"], ensure_ascii=False), json.dumps(policy["readable_fields"], ensure_ascii=False), json.dumps(policy["writable_fields"], ensure_ascii=False), json.dumps(policy["row_filter"], ensure_ascii=False), policy["status"], ), ) except Exception as exc: raise ValueError("同一客户端、数据库和表只能创建一条权限策略") from exc await cur.execute("SELECT * FROM api_policies WHERE id=%s", (policy_id,)) result = _row(await cur.fetchone()) or {} await conn.commit() return result async def update_api_policy(policy_id: str, body: dict[str, Any]) -> dict[str, Any]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute("SELECT * FROM api_policies WHERE id=%s", (policy_id,)) current = _row(await cur.fetchone()) if not current: raise ValueError("权限策略不存在") merged = { "client_id": body.get("client_id", current["client_id"]), "database_id": body.get("database_id", current["database_id"]), "table_code": body.get("table_code", current["table_code"]), "actions": body.get("actions", current["actions"]), "readable_fields": body.get("readable_fields", current["readable_fields"]), "writable_fields": body.get("writable_fields", current["writable_fields"]), "row_filter": body.get("row_filter", current["row_filter"]), "status": body.get("status", current["status"]), } policy = await _validate_policy(merged) async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ UPDATE api_policies SET client_id=%s, database_id=%s, table_code=%s, actions_json=%s, readable_fields_json=%s, writable_fields_json=%s, row_filter_json=%s, status=%s WHERE id=%s """, ( policy["client_id"], policy["database_id"], policy["table_code"], json.dumps(policy["actions"], ensure_ascii=False), json.dumps(policy["readable_fields"], ensure_ascii=False), json.dumps(policy["writable_fields"], ensure_ascii=False), json.dumps(policy["row_filter"], ensure_ascii=False), policy["status"], policy_id, ), ) await cur.execute("SELECT * FROM api_policies WHERE id=%s", (policy_id,)) result = _row(await cur.fetchone()) or {} await conn.commit() return result async def delete_api_policy(policy_id: str) -> dict[str, bool]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute("DELETE FROM api_policies WHERE id=%s", (policy_id,)) if cur.rowcount != 1: raise ValueError("权限策略不存在") await conn.commit() return {"ok": True} async def list_api_call_logs(limit: int = 200) -> list[dict[str, Any]]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT l.*, c.name AS client_name FROM api_call_logs l LEFT JOIN api_clients c ON c.id=l.client_id ORDER BY l.created_at DESC LIMIT %s """, (max(1, min(1000, limit)),), ) return [_row(dict(item)) or {} for item in await cur.fetchall()] async def authenticate_api_key(api_key: str) -> dict[str, Any]: await _ready() if not api_key or "." not in api_key: raise HTTPException(401, "缺少或无效的接口密钥") key_hash = _api_key_hash(api_key) async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT k.id AS credential_id, k.client_id, k.key_prefix, k.expires_at, c.name AS client_name FROM api_credentials k JOIN api_clients c ON c.id=k.client_id WHERE k.key_hash=%s AND k.revoked_at IS NULL AND (k.expires_at IS NULL OR k.expires_at > CURRENT_TIMESTAMP(6)) AND c.status='active' """, (key_hash,), ) identity = _row(await cur.fetchone()) if not identity: raise HTTPException(401, "接口密钥无效、已撤销或已过期") await cur.execute( "UPDATE api_credentials SET last_used_at=CURRENT_TIMESTAMP(6) WHERE id=%s", (identity["credential_id"],), ) await conn.commit() return identity async def resolve_api_policy( client_id: str, database_id: str, table_code: str, action: str, ) -> dict[str, Any]: await _ready() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ SELECT * FROM api_policies WHERE client_id=%s AND database_id=%s AND table_code IN (%s, '*') AND status='active' ORDER BY (table_code=%s) DESC, updated_at DESC """, (client_id, database_id, table_code, table_code), ) policies = [_row(dict(item)) or {} for item in await cur.fetchall()] policy = next((item for item in policies if action in item["actions"]), None) if not policy: raise HTTPException(403, f"当前接口客户端没有 {action} 权限") return policy async def client_catalog(client_id: str) -> list[dict[str, Any]]: policies = [ item for item in await list_api_policies(client_id) if item["status"] == "active" ] catalog = await interface_catalog() result: list[dict[str, Any]] = [] for database in catalog: db_policies = [ item for item in policies if item["database_id"] == database["project_id"] and ({"metadata", "read"} & set(item["actions"])) ] if not db_policies: continue tables = [] for table in database["tables"]: policy = next( (item for item in db_policies if item["table_code"] == table["code"]), next((item for item in db_policies if item["table_code"] == "*"), None), ) if not policy: continue readable = set(policy["readable_fields"]) fields = table["fields"] if "*" in readable else [ field for field in table["fields"] if field["code"] in readable ] tables.append({ **table, "fields": fields, "actions": policy["actions"], }) if tables: result.append({ "project_id": database["project_id"], "display_name": database["display_name"], "tables": tables, }) return result async def write_api_call_log( *, request_id: str, identity: dict[str, Any] | None, method: str, path: str, database_id: str | None, table_code: str | None, action: str | None, status_code: int, duration_ms: float, source_ip: str | None, error_message: str | None = None, ) -> None: if not data_pool_available(): return await ensure_platform_registry() async with get_data_conn() as conn: async with conn.cursor() as cur: await cur.execute( """ INSERT INTO api_call_logs ( request_id, client_id, credential_id, method, path, database_id, table_code, action_name, status_code, duration_ms, source_ip, error_message ) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s) """, ( request_id, identity.get("client_id") if identity else None, identity.get("credential_id") if identity else None, method, path[:500], database_id, table_code, action, status_code, duration_ms, source_ip, (error_message or "")[:500] or None, ), ) await conn.commit()