"""认证服务：JWT 签发、企微 OAuth、密码校验。""" import jwt import bcrypt import time import hashlib import re import secrets import requests from datetime import datetime, timedelta from flask import current_app from insurance.config import get_config as _get_wecom_config from insurance.db.compat import db from insurance.models.email_verification import EmailVerificationCode from insurance.models.wecom_user import WeComUserMapping from insurance.utils.email import EmailSendError, send_email class AuthService: """认证业务逻辑。""" CODE_EXPIRE_MINUTES = 10 CODE_RESEND_SECONDS = 60 CODE_MAX_ATTEMPTS = 5 def _normalize_email(self, email: str) -> str: return (email or "").strip().lower() def _validate_email(self, email: str) -> bool: return bool(re.match(r"^[^@\s]+@[^@\s]+\.[^@\s]+$", email or "")) def _validate_password(self, password: str) -> str: if not password or len(password) < 8 or len(password) > 128: return "密码长度需在 8-128 之间" if not any(c.isalpha() for c in password) or not any(c.isdigit() for c in password): return "密码需包含字母和数字" return "" def _hash_code(self, email: str, purpose: str, code: str) -> str: secret = current_app.config.get("JWT_SECRET", "change-this") raw = f"{email}:{purpose}:{code}:{secret}" return hashlib.sha256(raw.encode()).hexdigest() def _user_payload(self, mapping: WeComUserMapping) -> dict: return { "id": str(mapping.id), "username": mapping.username, "email": mapping.email, "real_name": mapping.real_name, "wecom_userid": mapping.wecom_userid, "role": mapping.role, "department": mapping.department or "", } def send_email_code(self, email: str, purpose: str, ip: str = "") -> dict: """发送注册或找回密码验证码。""" email = self._normalize_email(email) if purpose not in ("register", "reset_password"): return {"code": 1001, "message": "验证码用途无效", "data": None} if not self._validate_email(email): return {"code": 1001, "message": "邮箱格式不正确", "data": None} if purpose == "register": existing = db.session.query(WeComUserMapping).filter_by(email=email).first() if existing: return {"code": 1001, "message": "邮箱已被注册", "data": None} elif not db.session.query(WeComUserMapping).filter_by(email=email).first(): return {"code": 0, "message": "验证码已发送", "data": None} now = datetime.utcnow() latest = db.session.query(EmailVerificationCode).filter_by( email=email, purpose=purpose, ).order_by(EmailVerificationCode.created_at.desc()).first() if latest and latest.created_at and latest.created_at > now - timedelta(seconds=self.CODE_RESEND_SECONDS): return {"code": 1001, "message": "验证码发送过于频繁，请稍后再试", "data": None} code = f"{secrets.randbelow(1000000):06d}" record = EmailVerificationCode( email=email, purpose=purpose, code_hash=self._hash_code(email, purpose, code), expires_at=now + timedelta(minutes=self.CODE_EXPIRE_MINUTES), ip=ip, ) subject = "保险智能客服系统验证码" action = "注册账号" if purpose == "register" else "重置密码" content = ( f"您正在{action}，验证码为：{code}\n\n" f"验证码 {self.CODE_EXPIRE_MINUTES} 分钟内有效。" ) db.session.add(record) try: db.session.flush() if not send_email(email, subject, content): db.session.rollback() return {"code": 5001, "message": "邮件服务未配置，请联系管理员", "data": None} except EmailSendError as e: db.session.rollback() current_app.logger.warning("发送邮箱验证码失败: %s", e) return {"code": 5001, "message": e.user_message, "data": None} except Exception: db.session.rollback() current_app.logger.exception("发送邮箱验证码失败") return {"code": 5001, "message": "验证码发送失败，请稍后重试", "data": None} try: db.session.commit() except Exception: db.session.rollback() raise return {"code": 0, "message": "验证码已发送", "data": None} def _verify_email_code(self, email: str, purpose: str, code: str, commit_success: bool = True) -> tuple[bool, str]: email = self._normalize_email(email) code = (code or "").strip() if not code: return False, "请输入邮箱验证码" record = db.session.query(EmailVerificationCode).filter_by( email=email, purpose=purpose, consumed_at=None, ).order_by(EmailVerificationCode.created_at.desc()).first() now = datetime.utcnow() if not record or record.expires_at < now: return False, "验证码已过期，请重新获取" if (record.attempts or 0) >= self.CODE_MAX_ATTEMPTS: return False, "验证码错误次数过多，请重新获取" record.attempts = (record.attempts or 0) + 1 if record.code_hash != self._hash_code(email, purpose, code): db.session.commit() return False, "验证码错误" record.consumed_at = now if commit_success: db.session.commit() return True, "" def wework_login(self, code: str, state: str) -> dict: """企微 OAuth 登录：code 换 token -> 获取用户信息 -> 签发 JWT。""" corp_id = _get_wecom_config("WECOM_CORP_ID") secret = _get_wecom_config("WECOM_SECRET") # 1. 用 code 换取企微 access_token token_url = "https://qyapi.weixin.qq.com/cgi-bin/gettoken" resp = requests.get(token_url, params={"corpid": corp_id, "corpsecret": secret}) token_data = resp.json() if token_data.get("errcode") != 0: return {"code": 3001, "message": "企微 API 调用失败", "data": None} access_token = token_data["access_token"] # 2. 用 code 换取 userid（标准企微 OAuth 流程） getuserinfo_url = "https://qyapi.weixin.qq.com/cgi-bin/user/getuserinfo" resp = requests.get(getuserinfo_url, params={"access_token": access_token, "code": code}) user_info = resp.json() if user_info.get("errcode") != 0: return {"code": 3001, "message": "获取企微用户信息失败", "data": None} wecom_userid = user_info.get("userid", "") # 3. 用 userid 获取详细用户信息 user_detail_url = "https://qyapi.weixin.qq.com/cgi-bin/user/get" resp = requests.get(user_detail_url, params={"access_token": access_token, "userid": wecom_userid}) user_data = resp.json() if user_data.get("errcode") != 0: return {"code": 3001, "message": "获取企微用户详情失败", "data": None} username = user_data.get("name", "") department = user_data.get("department", [""])[0] if user_data.get("department") else "" # 4. 查找或创建用户映射 mapping = db.session.query(WeComUserMapping).filter_by(wecom_userid=wecom_userid).first() if not mapping: mapping = WeComUserMapping( wecom_userid=wecom_userid, internal_user_id=f"wecom_{wecom_userid}", username=username, department=str(department), role="sales", ) db.session.add(mapping) try: db.session.commit() except Exception: db.session.rollback() raise # 4. 签发 JWT token = self._generate_token(mapping.id, mapping.role, mapping.department or "") return { "code": 0, "data": { "token": token, "expires_in": current_app.config.get("JWT_EXPIRE_SECONDS", 7200), "user": self._user_payload(mapping), }, } def register(self, username: str, password: str, email: str, real_name: str, verification_code: str) -> dict: """用户注册。""" email = self._normalize_email(email) real_name = (real_name or "").strip() # 用户名校验 if not username or len(username) < 3 or len(username) > 64: return {"code": 1001, "message": "用户名长度需在 3-64 之间", "data": None} if not self._validate_email(email): return {"code": 1001, "message": "邮箱格式不正确", "data": None} if not real_name or len(real_name) > 128: return {"code": 1001, "message": "请输入真实姓名", "data": None} # 密码校验 password_error = self._validate_password(password) if password_error: return {"code": 1001, "message": password_error, "data": None} # 检查用户名是否已存在 existing = db.session.query(WeComUserMapping).filter_by(username=username).first() if existing: return {"code": 1001, "message": "用户名已存在", "data": None} existing_email = db.session.query(WeComUserMapping).filter_by(email=email).first() if existing_email: return {"code": 1001, "message": "邮箱已被注册", "data": None} ok, message = self._verify_email_code(email, "register", verification_code, commit_success=False) if not ok: return {"code": 1001, "message": message, "data": None} # 生成密码哈希 password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode() # 创建用户 import uuid mapping = WeComUserMapping( wecom_userid=f"local_{uuid.uuid4().hex[:8]}", internal_user_id=f"user_{uuid.uuid4().hex[:8]}", username=username, email=email, real_name=real_name, email_verified="true", password_hash=password_hash, role="client", status="active", ) db.session.add(mapping) try: db.session.commit() except Exception: db.session.rollback() raise # 同步到 Dify accounts 表 self._sync_to_dify(username, password, mapping.id, email) # 签发 JWT token = self._generate_token(mapping.id, mapping.role) from insurance.utils.audit import log_operation log_operation(str(mapping.id), "register", "user", str(mapping.id)) return { "code": 0, "data": { "token": token, "expires_in": current_app.config.get("JWT_EXPIRE_SECONDS", 7200), "user": self._user_payload(mapping), }, } def _sync_to_dify(self, username: str, password: str, local_user_id: int, email: str = "") -> bool: """同步用户到 Dify accounts 表。""" try: from insurance.db.compat import db import uuid as uuid_mod from datetime import datetime, timezone # 检查 Dify 中是否已存在同名用户 result = db.session.execute( db.text("SELECT id FROM accounts WHERE name = :name"), {"name": username} ) existing = result.fetchone() if existing: # 已存在，记录映射关系 return True # 创建 Dify 账号 account_id = str(uuid_mod.uuid4()) account_email = email or f"{username}@baodan.local" now = datetime.now(timezone.utc) # Dify 期望密码已经是 bcrypt 哈希后的值 password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode() # 插入 accounts 表 db.session.execute( db.text(""" INSERT INTO accounts (id, name, email, password, avatar, interface_language, interface_theme, timezone, last_login_at, last_active_at, status, created_at, updated_at) VALUES (:id, :name, :email, :password, '', 'zh-Hans', 'light', 'Asia/Shanghai', :now, :now, 'active', :now, :now) """), { "id": account_id, "name": username, "email": account_email, "password": password_hash, "now": now, } ) # 获取默认租户 tenant_result = db.session.execute( db.text("SELECT id FROM tenants LIMIT 1") ) tenant = tenant_result.fetchone() if tenant: # 关联到租户 db.session.execute( db.text(""" INSERT INTO tenant_account_joins (id, tenant_id, account_id, role, invited_by, created_at, updated_at) VALUES (:id, :tenant_id, :account_id, 'normal', NULL, :now, :now) """), { "id": str(uuid_mod.uuid4()), "tenant_id": str(tenant[0]), "account_id": account_id, "now": now, } ) db.session.commit() return True except Exception as e: # 同步失败不影响注册 print(f"同步到 Dify 失败: {e}") db.session.rollback() return False def password_login(self, username: str, password: str) -> dict: """账密登录：bcrypt 校验，返回 JWT。""" mapping = db.session.query(WeComUserMapping).filter_by(username=username).first() if not mapping or not mapping.password_hash: return {"code": 1002, "message": "用户名或密码错误", "data": None} if not bcrypt.checkpw(password.encode(), mapping.password_hash.encode()): return {"code": 1002, "message": "用户名或密码错误", "data": None} if mapping.status != "active": return {"code": 1002, "message": "账号已停用", "data": None} token = self._generate_token(mapping.id, mapping.role, mapping.department or "") from insurance.utils.audit import log_operation log_operation(str(mapping.id), "login", "user", str(mapping.id)) return { "code": 0, "data": { "token": token, "expires_in": current_app.config.get("JWT_EXPIRE_SECONDS", 7200), "user": self._user_payload(mapping), }, } def refresh_token(self, user_id: str) -> dict: """刷新 Token：签发新的 JWT。""" mapping = db.session.query(WeComUserMapping).filter_by(id=int(user_id)).first() if not mapping: return {"code": 1002, "message": "用户不存在", "data": None} token = self._generate_token(mapping.id, mapping.role, mapping.department or "") return { "code": 0, "data": { "token": token, "expires_in": current_app.config.get("JWT_EXPIRE_SECONDS", 7200), }, } def change_password(self, user_id: str, old_password: str, new_password: str) -> dict: """修改密码。""" mapping = db.session.query(WeComUserMapping).filter_by(id=int(user_id)).first() if not mapping: return {"code": 1005, "message": "用户不存在", "data": None} if not mapping.password_hash: return {"code": 1002, "message": "该账号无密码，请使用企微登录", "data": None} if not bcrypt.checkpw(old_password.encode(), mapping.password_hash.encode()): return {"code": 1002, "message": "旧密码错误", "data": None} mapping.password_hash = bcrypt.hashpw(new_password.encode(), bcrypt.gensalt()).decode() try: db.session.commit() except Exception: db.session.rollback() raise self._sync_password_to_dify(mapping.username, new_password) from insurance.utils.audit import log_operation log_operation(user_id, "change_password", "user", user_id) return {"code": 0, "message": "密码修改成功", "data": None} def reset_password(self, email: str, verification_code: str, new_password: str) -> dict: """通过邮箱验证码重置密码。""" email = self._normalize_email(email) password_error = self._validate_password(new_password) if password_error: return {"code": 1001, "message": password_error, "data": None} ok, message = self._verify_email_code(email, "reset_password", verification_code, commit_success=False) if not ok: return {"code": 1001, "message": message, "data": None} mapping = db.session.query(WeComUserMapping).filter_by(email=email).first() if not mapping: return {"code": 1005, "message": "用户不存在", "data": None} mapping.password_hash = bcrypt.hashpw(new_password.encode(), bcrypt.gensalt()).decode() mapping.email_verified = "true" try: db.session.commit() except Exception: db.session.rollback() raise self._sync_password_to_dify(mapping.username, new_password) from insurance.utils.audit import log_operation log_operation(str(mapping.id), "reset_password", "user", str(mapping.id)) return {"code": 0, "message": "密码重置成功", "data": None} def _sync_password_to_dify(self, username: str, password: str) -> bool: """同步本地密码到 Dify accounts 表。""" try: password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode() db.session.execute( db.text("UPDATE accounts SET password = :password, updated_at = :updated_at WHERE name = :name"), {"password": password_hash, "updated_at": datetime.utcnow(), "name": username} ) db.session.commit() return True except Exception as e: print(f"同步密码到 Dify 失败: {e}") db.session.rollback() return False def logout(self, token: str, user_id: str) -> dict: """吊销 Token：加入 Redis 黑名单。""" try: from insurance.db.compat import redis_client expire = current_app.config.get("JWT_EXPIRE_SECONDS", 7200) redis_client.setex(f"token:blacklist:{token}", expire, "1") except Exception: pass # Redis 不可用时仍允许 logout from insurance.utils.audit import log_operation log_operation(user_id, "logout", "user", user_id) return {"code": 0, "message": "success", "data": None} def _generate_token(self, user_id: int, role: str, department: str = "") -> str: """生成 JWT Token。""" secret = current_app.config.get("JWT_SECRET", "change-this") expire = int(current_app.config.get("JWT_EXPIRE_SECONDS", 7200)) payload = { "user_id": str(user_id), "role": role, "department": department, "exp": int(time.time()) + expire, "iat": int(time.time()), } return jwt.encode(payload, secret, algorithm="HS256")