xiaoxia
ba7e056232
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (push) Successful in 0s
CI/CD Pipeline / Check push changed paths (push) Successful in 15s
CI/CD Pipeline / Build Staging API Image (push) Successful in 15s
CI/CD Pipeline / Build Staging Web Image (push) Successful in 26s
CI/CD Pipeline / Build Staging Worker Image (push) Successful in 44s
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (push) Successful in 1m4s
CI/CD Pipeline / Integration Tests (push) Successful in 4m1s
CI/CD Pipeline / Validate - Python (mypy + alembic) (push) Successful in 4m31s
CI/CD Pipeline / Validate - Style (push) Successful in 5m18s
CI/CD Pipeline / Frontend Unit Tests (push) Failing after 5m14s
CI/CD Pipeline / ACR Image Cleanup (push) Successful in 2m50s
CI/CD Pipeline / Staging API Integration Tests (push) Successful in 5m3s
CI/CD Pipeline / Staging E2E Tests (push) Failing after 5m13s
CI/CD Pipeline / Unit Tests (push) Successful in 11m3s
CI/CD Pipeline / Validate - Security (push) Successful in 11m26s
CI/CD Pipeline / Production Browser E2E (push) Has been skipped
CI/CD Pipeline / Deploy Production (push) Failing after 11h19m46s
CI/CD Pipeline / Retag skipped Staging Web Image (push) Failing after 11h29m13s
CI/CD Pipeline / PR Build Web Image (push) Failing after 11h30m2s
CI/CD Pipeline / PR Build API Image (push) Failing after 11h30m2s
CI/CD Pipeline / Build Production Worker Image (push) Failing after 11h19m4s
CI/CD Pipeline / Build Production Web Image (push) Failing after 11h19m4s
CI/CD Pipeline / Build Production API Image (push) Failing after 11h19m4s
CI/CD Pipeline / CI Gate (push) Failing after 11h19m4s
CI/CD Pipeline / Canary Release to Production (push) Failing after 11h18m59s
CI/CD Pipeline / PR Build Worker Image (push) Failing after 11h30m2s
CI/CD Pipeline / Retag skipped Staging Worker Image (push) Failing after 11h28m26s
CI/CD Pipeline / Retag skipped Staging API Image (push) Failing after 11h28m28s
CI/CD Pipeline / Frontend Lint (push) Failing after 11h30m5s
CI/CD Pipeline / Check if frontend-only change (push) Failing after 11h30m35s
Co-authored-by: xiaoxia <dev@xiaoxiajianji.com> Co-committed-by: xiaoxia <dev@xiaoxiajianji.com>
790 lines
27 KiB
Python
Executable File
790 lines
27 KiB
Python
Executable File
"""
|
||
from __future__ import annotations
|
||
Canonical authentication API routes.
|
||
|
||
The route layer is intentionally thin: repository construction lives in
|
||
app.dependencies and authentication behavior lives in application use cases.
|
||
"""
|
||
|
||
import logging
|
||
import os
|
||
from typing import Optional
|
||
|
||
import jwt
|
||
from app.auth import AuthenticatedUser, blacklist_token, get_current_user
|
||
from app.config import settings
|
||
from app.dependencies import get_auth_email_service, get_auth_session_store, get_db_session, get_user_repository
|
||
from fastapi import APIRouter, Depends, Header, HTTPException, Request, status
|
||
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
||
from pydantic import BaseModel, EmailStr, field_validator
|
||
|
||
from packages.adapters.redis import NoopSessionStore
|
||
from packages.adapters.smtp import NoopEmailService
|
||
from packages.application.auth.login_use_case import LoginRequest as LoginUseCaseRequest
|
||
from packages.application.auth.login_use_case import LoginUseCase
|
||
from packages.application.auth.login_use_case import RefreshTokenRequest as RefreshTokenUseCaseRequest
|
||
from packages.application.auth.login_use_case import RefreshTokenUseCase
|
||
from packages.application.auth.password_reset_use_case import RequestPasswordResetRequest as PasswordResetUseCaseRequest
|
||
from packages.application.auth.password_reset_use_case import (
|
||
RequestPasswordResetUseCase,
|
||
ResetPasswordRequest,
|
||
ResetPasswordUseCase,
|
||
)
|
||
from packages.application.auth.register_user_use_case import RegisterUserRequest as RegisterUseCaseRequest
|
||
from packages.application.auth.register_user_use_case import RegisterUserUseCase, VerifyEmailRequest, VerifyEmailUseCase
|
||
from packages.ports.user_repository import UserRepository
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
bearer_scheme = HTTPBearer(auto_error=False)
|
||
|
||
router = APIRouter(prefix="/auth", tags=["认证"])
|
||
|
||
|
||
class RegisterRequest(BaseModel):
|
||
email: EmailStr
|
||
password: str
|
||
username: str
|
||
display_name: Optional[str] = None
|
||
|
||
|
||
class RegisterResponse(BaseModel):
|
||
user_id: str
|
||
email: str
|
||
username: str
|
||
display_name: str
|
||
message: str
|
||
|
||
|
||
class LoginRequest(BaseModel):
|
||
email: EmailStr
|
||
password: str
|
||
|
||
|
||
class RefreshRequest(BaseModel):
|
||
refresh_token: str
|
||
|
||
|
||
class LoginResponse(BaseModel):
|
||
access_token: str
|
||
refresh_token: str
|
||
token_type: str = "bearer"
|
||
user_id: str
|
||
email: str
|
||
username: str
|
||
display_name: str
|
||
expires_in: int
|
||
|
||
|
||
class CurrentUserResponse(BaseModel):
|
||
user_id: str
|
||
email: str
|
||
username: str
|
||
display_name: str
|
||
email_verified: bool
|
||
phone: str = ""
|
||
phone_verified: bool = False
|
||
binding_complete: bool = False
|
||
wechat_bound: bool = False
|
||
profile_completed: bool = True
|
||
|
||
|
||
class UserProfileResponse(BaseModel):
|
||
"""用户资料负载（PATCH /me、绑定/解绑接口复用；字段与 GET /auth/me 一致，前端 normalizeUser 直接消费）"""
|
||
|
||
user_id: str
|
||
email: str
|
||
username: str
|
||
display_name: str
|
||
email_verified: bool
|
||
phone: str = ""
|
||
phone_verified: bool = False
|
||
binding_complete: bool = False
|
||
wechat_bound: bool = False
|
||
profile_completed: bool = True
|
||
|
||
|
||
class PasswordResetRequestModel(BaseModel):
|
||
email: EmailStr
|
||
|
||
|
||
class ResetPasswordModel(BaseModel):
|
||
token: str
|
||
new_password: str
|
||
|
||
|
||
class VerifyEmailRequestModel(BaseModel):
|
||
token: str
|
||
|
||
|
||
class MessageResponse(BaseModel):
|
||
message: str
|
||
|
||
|
||
@router.post("/register", response_model=RegisterResponse, status_code=status.HTTP_201_CREATED)
|
||
async def register(
|
||
request: RegisterRequest,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
email_service=Depends(get_auth_email_service),
|
||
db=Depends(get_db_session),
|
||
) -> RegisterResponse:
|
||
use_case = RegisterUserUseCase(
|
||
user_repository=user_repository,
|
||
base_url=settings.APP_BASE_URL,
|
||
email_service=email_service,
|
||
)
|
||
response, error = use_case.execute(
|
||
RegisterUseCaseRequest(
|
||
email=request.email,
|
||
password=request.password,
|
||
username=request.username,
|
||
display_name=request.display_name or request.username,
|
||
)
|
||
)
|
||
if error or response is None:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=_translate_auth_error(error))
|
||
|
||
# 新用户注册赠送 50 积分（失败不影响注册）
|
||
if settings.points_enabled:
|
||
try:
|
||
from packages.domain.points_service import PointsService
|
||
_svc = PointsService()
|
||
_svc.add_points(
|
||
user_id=response.user_id,
|
||
amount=50,
|
||
source="task_reward",
|
||
db=db,
|
||
description="新用户注册赠送",
|
||
)
|
||
except Exception as _bonus_err:
|
||
import logging
|
||
logging.getLogger(__name__).warning("注册送积分失败: user_id=%s err=%s", response.user_id, _bonus_err)
|
||
|
||
return RegisterResponse(
|
||
user_id=response.user_id,
|
||
email=response.email,
|
||
username=response.username,
|
||
display_name=response.display_name,
|
||
message="注册成功！",
|
||
)
|
||
|
||
|
||
@router.post("/login", response_model=LoginResponse)
|
||
async def login(
|
||
request: LoginRequest,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
session_store=Depends(get_auth_session_store),
|
||
) -> LoginResponse:
|
||
use_case = LoginUseCase(
|
||
user_repository=user_repository,
|
||
session_store=session_store,
|
||
jwt_secret_key=settings.JWT_SECRET_KEY,
|
||
)
|
||
response, error = use_case.execute(LoginUseCaseRequest(email=request.email, password=request.password))
|
||
if error or response is None:
|
||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="邮箱或密码错误")
|
||
|
||
return LoginResponse(
|
||
access_token=response.access_token,
|
||
refresh_token=response.refresh_token,
|
||
user_id=response.user_id,
|
||
email=response.email,
|
||
username=response.username,
|
||
display_name=response.display_name,
|
||
expires_in=response.expires_in,
|
||
)
|
||
|
||
|
||
@router.post("/refresh")
|
||
async def refresh(
|
||
request: RefreshRequest,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
session_store=Depends(get_auth_session_store),
|
||
) -> LoginResponse:
|
||
use_case = RefreshTokenUseCase(
|
||
user_repository=user_repository,
|
||
session_store=session_store,
|
||
)
|
||
response, error = use_case.execute(RefreshTokenUseCaseRequest(refresh_token=request.refresh_token))
|
||
if error or response is None:
|
||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or expired refresh token")
|
||
|
||
return LoginResponse(
|
||
access_token=response.access_token,
|
||
refresh_token=response.refresh_token,
|
||
user_id=response.user_id,
|
||
email=response.email,
|
||
username=response.username,
|
||
display_name=response.display_name,
|
||
expires_in=response.expires_in,
|
||
)
|
||
|
||
|
||
def _verify_email_token(token: str, user_repository: UserRepository) -> MessageResponse:
|
||
success, error = VerifyEmailUseCase(user_repository=user_repository).execute(VerifyEmailRequest(token=token))
|
||
if not success:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=error or "邮箱验证失败")
|
||
|
||
return MessageResponse(message="邮箱验证成功")
|
||
|
||
|
||
@router.get("/verify-email", response_model=MessageResponse)
|
||
async def verify_email(
|
||
token: str,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> MessageResponse:
|
||
return _verify_email_token(token, user_repository)
|
||
|
||
|
||
@router.post("/verify-email", response_model=MessageResponse)
|
||
async def verify_email_post(
|
||
request: VerifyEmailRequestModel,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> MessageResponse:
|
||
return _verify_email_token(request.token, user_repository)
|
||
|
||
|
||
@router.post("/forgot-password", response_model=MessageResponse, status_code=status.HTTP_202_ACCEPTED)
|
||
async def forgot_password(
|
||
request: PasswordResetRequestModel,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
email_service=Depends(get_auth_email_service),
|
||
) -> MessageResponse:
|
||
success, error = RequestPasswordResetUseCase(
|
||
user_repository=user_repository,
|
||
base_url=settings.APP_BASE_URL,
|
||
email_service=email_service,
|
||
).execute(PasswordResetUseCaseRequest(email=request.email))
|
||
if not success:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=error or "密码重置请求失败")
|
||
|
||
return MessageResponse(message="如果账户存在，密码重置邮件已发送")
|
||
|
||
|
||
@router.post("/reset-password", response_model=MessageResponse)
|
||
async def reset_password(
|
||
request: ResetPasswordModel,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> MessageResponse:
|
||
success, error = ResetPasswordUseCase(user_repository=user_repository).execute(
|
||
ResetPasswordRequest(token=request.token, new_password=request.new_password)
|
||
)
|
||
if not success:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=error or "密码重置失败")
|
||
|
||
return MessageResponse(message="密码重置成功")
|
||
|
||
|
||
@router.post("/logout")
|
||
async def logout(
|
||
credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
) -> MessageResponse:
|
||
"""登出 - 将当前 token 加入黑名单"""
|
||
|
||
if credentials:
|
||
try:
|
||
payload = jwt.decode(credentials.credentials, settings.JWT_SECRET_KEY, algorithms=["HS256"])
|
||
exp = payload.get("exp", 0)
|
||
blacklist_token(credentials.credentials, exp)
|
||
except Exception as e:
|
||
logger.warning(f"Operation failed in apps/api/app/api/routes/auth.py: {e}", exc_info=True)
|
||
return MessageResponse(message="已登出")
|
||
|
||
|
||
@router.get("/me", response_model=CurrentUserResponse)
|
||
async def get_current_user_info(
|
||
authenticated_user: AuthenticatedUser = Depends(get_current_user),
|
||
) -> CurrentUserResponse:
|
||
user = authenticated_user.user
|
||
binding_complete = user.phone_verified and user.email_verified and user.email and "@wechat.local" not in user.email
|
||
return CurrentUserResponse(
|
||
user_id=user.id,
|
||
email=user.email,
|
||
username=user.username,
|
||
display_name=user.display_name,
|
||
email_verified=user.email_verified,
|
||
phone=user.phone or "",
|
||
phone_verified=user.phone_verified,
|
||
binding_complete=binding_complete,
|
||
wechat_bound=bool(user.wechat_openid),
|
||
profile_completed=user.profile_completed,
|
||
)
|
||
|
||
|
||
class UpdateProfileRequest(BaseModel):
|
||
"""更新个人资料请求（当前仅支持昵称）"""
|
||
|
||
display_name: str
|
||
|
||
@field_validator("display_name")
|
||
@classmethod
|
||
def _validate_display_name(cls, v: str) -> str:
|
||
name = (v or "").strip()
|
||
if not name:
|
||
raise ValueError("昵称不能为空白")
|
||
if len(name) > 20:
|
||
raise ValueError("昵称长度需在 1-20 个字符之间")
|
||
return name
|
||
|
||
|
||
class UpdateProfileResponse(BaseModel):
|
||
"""更新资料响应：前端 normalizeUser(response.user) 直接消费"""
|
||
|
||
user: UserProfileResponse
|
||
|
||
|
||
@router.patch("/me", response_model=UpdateProfileResponse)
|
||
async def update_current_user_profile(
|
||
request: UpdateProfileRequest,
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> UpdateProfileResponse:
|
||
"""更新当前登录用户昵称（微信新用户首次设置昵称后置 profile_completed=True）。"""
|
||
user = current_user.user
|
||
user.display_name = request.display_name # 已 strip（validator）
|
||
if not user.profile_completed:
|
||
user.profile_completed = True
|
||
user_repository.save(user)
|
||
|
||
logger.info("[资料更新] 用户 %s 更新昵称，profile_completed=%s", user.id, user.profile_completed)
|
||
# 重新读取，确保返回的是持久化后的最新状态
|
||
fresh = user_repository.find_by_id(user.id) or user
|
||
return UpdateProfileResponse(user=_user_profile(fresh))
|
||
|
||
|
||
class _NoopSessionStore(NoopSessionStore):
|
||
pass
|
||
|
||
|
||
class _NoopEmailService(NoopEmailService):
|
||
pass
|
||
|
||
|
||
def _translate_auth_error(error: str | None) -> str:
|
||
translations = {
|
||
"Email already registered": "邮箱已被注册",
|
||
"Username already taken": "用户名已被使用",
|
||
"Username is required": "用户名不能为空",
|
||
"Display name is required": "显示名称不能为空",
|
||
}
|
||
return translations.get(error or "", error or "注册失败")
|
||
|
||
|
||
class WechatSyncRequest(BaseModel):
|
||
openid: str
|
||
unionid: Optional[str] = None
|
||
nickname: Optional[str] = None
|
||
avatar_url: Optional[str] = None
|
||
source: str = "miniapp"
|
||
|
||
|
||
class WechatSyncResponse(BaseModel):
|
||
access_token: str
|
||
token: str
|
||
refresh_token: str
|
||
user_id: str
|
||
user: dict
|
||
user_info: dict
|
||
is_new_user: bool
|
||
expires_in: int
|
||
|
||
|
||
def _get_internal_api_keys() -> list[str]:
|
||
"""获取内部 API Key 列表
|
||
|
||
优先级:
|
||
1. INTERNAL_API_KEYS 环境变量
|
||
2. /app/generated/internal_api_keys.txt 文件 (volume 持久化)
|
||
"""
|
||
env_keys = os.environ.get("INTERNAL_API_KEYS", "")
|
||
if env_keys:
|
||
return [k.strip() for k in env_keys.split(",") if k.strip()]
|
||
|
||
# 从持久化文件读取
|
||
try:
|
||
with open("/app/generated/internal_api_keys.txt", "r") as f:
|
||
content = f.read().strip()
|
||
if content:
|
||
return [k.strip() for k in content.split(",") if k.strip()]
|
||
except Exception:
|
||
logger.warning("无法读取内部 API 密钥文件，仅依赖环境变量配置", exc_info=True)
|
||
|
||
return []
|
||
|
||
|
||
def _verify_internal_api_key(x_api_key: str | None = Header(None)) -> bool:
|
||
"""验证内部 API Key
|
||
|
||
- 已配置时：必须匹配 INTERNAL_API_KEYS 中的 key
|
||
- 未配置且非生产环境：放行（方便开发）
|
||
- 未配置且生产环境：拒绝
|
||
"""
|
||
env = os.environ.get("APP_ENV", os.environ.get("ENV", "development")).lower()
|
||
key_list = _get_internal_api_keys()
|
||
|
||
if not key_list:
|
||
if env in ("production", "prod"):
|
||
raise HTTPException(status_code=401, detail="内部接口未配置 API Key")
|
||
return True
|
||
|
||
if x_api_key and x_api_key.strip() in key_list:
|
||
return True
|
||
|
||
raise HTTPException(status_code=401, detail="无效的 API Key")
|
||
|
||
|
||
@router.post("/wechat-sync", response_model=WechatSyncResponse, include_in_schema=False)
|
||
async def wechat_sync(
|
||
request: WechatSyncRequest,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
_: bool = Depends(_verify_internal_api_key),
|
||
) -> WechatSyncResponse:
|
||
"""
|
||
微信同步登录/注册（系统级内部接口）
|
||
|
||
由 BFF 层通过 API Key 调用，不直接面向终端用户。
|
||
根据 openid 查找或创建用户，返回 SaaS token。
|
||
"""
|
||
from packages.application.auth.wechat_sync_use_case import WechatSyncRequest as UseCaseRequest
|
||
from packages.application.auth.wechat_sync_use_case import (
|
||
WechatSyncUseCase,
|
||
)
|
||
|
||
use_case = WechatSyncUseCase(user_repository=user_repository)
|
||
use_case_request = UseCaseRequest(
|
||
openid=request.openid,
|
||
unionid=request.unionid,
|
||
nickname=request.nickname,
|
||
avatar_url=request.avatar_url,
|
||
source=request.source,
|
||
)
|
||
|
||
response, error = use_case.execute(use_case_request)
|
||
if error:
|
||
raise HTTPException(status_code=400, detail=error)
|
||
|
||
return WechatSyncResponse(**response.to_dict())
|
||
|
||
|
||
# ==================== 微信网页登录（OAuth） ====================
|
||
|
||
|
||
class WechatAuthUrlResponse(BaseModel):
|
||
auth_url: str
|
||
state: str
|
||
|
||
|
||
class WechatCallbackRequest(BaseModel):
|
||
code: str
|
||
state: str = ""
|
||
|
||
|
||
class WechatLoginResponse(BaseModel):
|
||
access_token: str
|
||
refresh_token: str
|
||
user_id: str
|
||
display_name: str
|
||
avatar_url: str = ""
|
||
is_new_user: bool
|
||
binding_complete: bool
|
||
expires_in: int
|
||
|
||
|
||
@router.get("/wechat/url", response_model=WechatAuthUrlResponse)
|
||
async def get_wechat_auth_url() -> WechatAuthUrlResponse:
|
||
"""获取微信扫码登录授权链接"""
|
||
from packages.application.auth.wechat_oauth_service import get_wechat_oauth_service
|
||
|
||
oauth_service = get_wechat_oauth_service()
|
||
auth_url, state = oauth_service.generate_auth_url()
|
||
return WechatAuthUrlResponse(auth_url=auth_url, state=state)
|
||
|
||
|
||
@router.post("/wechat/callback", response_model=WechatLoginResponse)
|
||
async def wechat_callback(
|
||
request: WechatCallbackRequest,
|
||
http_request: Request,
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> WechatLoginResponse:
|
||
"""微信登录回调处理"""
|
||
from packages.application.auth.wechat_oauth_service import get_wechat_oauth_service
|
||
from packages.application.auth.wechat_sync_use_case import WechatSyncRequest as SyncRequest
|
||
from packages.application.auth.wechat_sync_use_case import WechatSyncUseCase
|
||
|
||
# 回调可观测性：记录 UA（区分微信内置浏览器 MicroMessenger）与 state，
|
||
# 便于排查"停留 open.weixin.qq.com / 回调失败"类问题（#1718）
|
||
user_agent = http_request.headers.get("User-Agent", "")
|
||
is_wechat_browser = "MicroMessenger" in user_agent
|
||
logger.info(
|
||
"[微信回调] 收到回调: state=%s code_len=%d UA=%r 微信内置浏览器=%s",
|
||
(request.state or "")[:8],
|
||
len(request.code or ""),
|
||
user_agent[:200],
|
||
is_wechat_browser,
|
||
)
|
||
|
||
# 1. 用 code 换微信用户信息
|
||
oauth_service = get_wechat_oauth_service()
|
||
wechat_user, err = oauth_service.handle_callback(request.code, request.state)
|
||
if err:
|
||
# state 校验失败 / 微信 errcode 等错误原文已在 service 内 log，这里带上 UA 上下文
|
||
logger.warning("[微信回调] 处理失败: err=%s 微信内置浏览器=%s", err, is_wechat_browser)
|
||
raise HTTPException(status_code=400, detail=err)
|
||
logger.info(
|
||
"[微信回调] state 校验通过，微信用户信息获取成功: openid=%s unionid=%s",
|
||
wechat_user.openid[:8] if wechat_user.openid else "",
|
||
bool(wechat_user.unionid),
|
||
)
|
||
|
||
# 2. 同步登录/注册（复用 wechat-sync 逻辑）
|
||
use_case = WechatSyncUseCase(user_repository=user_repository)
|
||
sync_request = SyncRequest(
|
||
openid=wechat_user.openid,
|
||
unionid=wechat_user.unionid,
|
||
nickname=wechat_user.nickname,
|
||
avatar_url=wechat_user.avatar_url,
|
||
source="web",
|
||
)
|
||
response, err = use_case.execute(sync_request)
|
||
if err:
|
||
raise HTTPException(status_code=400, detail=err)
|
||
|
||
# 3. 判断绑定状态
|
||
user = user_repository.find_by_id(response.user_id)
|
||
binding_complete = False
|
||
if user:
|
||
binding_complete = bool(
|
||
user.phone_verified and user.email_verified and user.email and "@wechat.local" not in user.email
|
||
)
|
||
|
||
return WechatLoginResponse(
|
||
access_token=response.access_token,
|
||
refresh_token=response.refresh_token,
|
||
user_id=response.user_id,
|
||
display_name=response.nickname,
|
||
avatar_url=response.avatar_url or wechat_user.avatar_url,
|
||
is_new_user=response.is_new_user,
|
||
binding_complete=binding_complete,
|
||
expires_in=response.expires_in,
|
||
)
|
||
|
||
|
||
# ==================== 微信账号绑定/解绑（已登录用户） ====================
|
||
|
||
|
||
class WechatBindUrlResponse(BaseModel):
|
||
auth_url: str
|
||
state: str
|
||
|
||
|
||
class WechatBindCompleteRequest(BaseModel):
|
||
code: str
|
||
state: str = ""
|
||
|
||
|
||
class WechatBindCompleteResponse(BaseModel):
|
||
success: bool
|
||
user: UserProfileResponse
|
||
|
||
|
||
class WechatUnbindResponse(BaseModel):
|
||
success: bool
|
||
|
||
|
||
def _user_profile(user) -> UserProfileResponse:
|
||
binding_complete = bool(
|
||
user.phone_verified and user.email_verified and user.email and "@wechat.local" not in user.email
|
||
)
|
||
return UserProfileResponse(
|
||
user_id=user.id,
|
||
email=user.email,
|
||
username=user.username,
|
||
display_name=user.display_name,
|
||
email_verified=user.email_verified,
|
||
phone=user.phone or "",
|
||
phone_verified=user.phone_verified,
|
||
binding_complete=binding_complete,
|
||
wechat_bound=bool(user.wechat_openid),
|
||
profile_completed=user.profile_completed,
|
||
)
|
||
|
||
|
||
@router.get("/wechat/bind/url", response_model=WechatBindUrlResponse)
|
||
async def get_wechat_bind_url(
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
) -> WechatBindUrlResponse:
|
||
"""获取微信绑定授权链接（已登录用户场景）。state 经 Redis 存储做 CSRF 校验。"""
|
||
from packages.application.auth.wechat_oauth_service import get_wechat_oauth_service
|
||
|
||
oauth_service = get_wechat_oauth_service()
|
||
auth_url, state = oauth_service.generate_auth_url()
|
||
logger.info("[微信绑定] 用户 %s 请求绑定授权链接", current_user.user.id)
|
||
return WechatBindUrlResponse(auth_url=auth_url, state=state)
|
||
|
||
|
||
@router.post("/wechat/bind", response_model=WechatBindCompleteResponse)
|
||
async def wechat_bind(
|
||
request: WechatBindCompleteRequest,
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> WechatBindCompleteResponse:
|
||
"""微信绑定完成：扫码回调后用 code 换 openid，绑定到当前登录账号（不创建新用户）。"""
|
||
from packages.application.auth.wechat_bind_use_case import WechatBindRequest, WechatBindUseCase
|
||
from packages.application.auth.wechat_oauth_service import get_wechat_oauth_service
|
||
|
||
oauth_service = get_wechat_oauth_service()
|
||
wechat_user, err = oauth_service.handle_callback(request.code, request.state)
|
||
if err:
|
||
logger.warning("[微信绑定] 用户 %s 换取微信信息失败: %s", current_user.user.id, err)
|
||
raise HTTPException(status_code=400, detail=err)
|
||
|
||
use_case = WechatBindUseCase(user_repository=user_repository)
|
||
result, error, http_status = use_case.bind(
|
||
WechatBindRequest(
|
||
user_id=current_user.user.id,
|
||
openid=wechat_user.openid,
|
||
unionid=wechat_user.unionid or "",
|
||
)
|
||
)
|
||
if error:
|
||
logger.warning("[微信绑定] 用户 %s 绑定失败: %s", current_user.user.id, error)
|
||
raise HTTPException(status_code=http_status, detail=error)
|
||
|
||
logger.info("[微信绑定] 用户 %s 绑定成功 openid=%s", current_user.user.id, wechat_user.openid[:8])
|
||
return WechatBindCompleteResponse(success=True, user=_user_profile(result.user))
|
||
|
||
|
||
@router.delete("/wechat/bind", response_model=WechatUnbindResponse)
|
||
async def wechat_unbind(
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> WechatUnbindResponse:
|
||
"""解绑微信：需账号仍有其他登录方式（密码/手机/真实邮箱），否则拒绝。"""
|
||
from packages.application.auth.wechat_bind_use_case import WechatUnbindUseCase
|
||
|
||
use_case = WechatUnbindUseCase(user_repository=user_repository)
|
||
result, error, http_status = use_case.unbind(current_user.user.id)
|
||
if error:
|
||
logger.warning("[微信解绑] 用户 %s 解绑失败: %s", current_user.user.id, error)
|
||
raise HTTPException(status_code=http_status, detail=error)
|
||
|
||
logger.info("[微信解绑] 用户 %s 解绑成功", current_user.user.id)
|
||
return WechatUnbindResponse(success=True)
|
||
|
||
|
||
# ==================== 验证码 & 绑定 ====================
|
||
|
||
|
||
class SendVerificationCodeRequest(BaseModel):
|
||
target: str # phone / email
|
||
value: str
|
||
purpose: str # bind / login / reset_password
|
||
|
||
|
||
class SendVerificationCodeResponse(BaseModel):
|
||
expires_in: int
|
||
resend_after: int
|
||
|
||
|
||
class BindContactRequest(BaseModel):
|
||
phone: str = ""
|
||
phone_code: str = ""
|
||
email: str = ""
|
||
email_code: str = ""
|
||
|
||
|
||
class BindContactResponse(BaseModel):
|
||
success: bool
|
||
user: dict
|
||
|
||
|
||
@router.post("/send-verification-code", response_model=SendVerificationCodeResponse)
|
||
async def send_verification_code(
|
||
request: SendVerificationCodeRequest,
|
||
) -> SendVerificationCodeResponse:
|
||
"""发送验证码（手机或邮箱）"""
|
||
from app.dependencies import get_db_session
|
||
|
||
from packages.adapters.sms.sms_service import get_sms_service
|
||
from packages.adapters.smtp import get_email_service
|
||
from packages.adapters.sqlalchemy_impl.verification_code_repository import (
|
||
SQLAlchemyVerificationCodeRepository,
|
||
)
|
||
from packages.application.auth.bind_contact_use_case import SendVerificationCodeRequest as UseCaseRequest
|
||
from packages.application.auth.bind_contact_use_case import (
|
||
SendVerificationCodeUseCase,
|
||
)
|
||
from packages.application.auth.verification_code_service import VerificationCodeService
|
||
|
||
db = next(get_db_session())
|
||
repo = SQLAlchemyVerificationCodeRepository(db)
|
||
vc_service = VerificationCodeService(repo=repo)
|
||
sms_service = get_sms_service()
|
||
email_service = get_email_service()
|
||
|
||
use_case = SendVerificationCodeUseCase(
|
||
verification_code_service=vc_service,
|
||
sms_service=sms_service,
|
||
email_service=email_service,
|
||
)
|
||
uc_request = UseCaseRequest(
|
||
target=request.target,
|
||
value=request.value,
|
||
purpose=request.purpose,
|
||
)
|
||
response, err = use_case.execute(uc_request)
|
||
if err:
|
||
raise HTTPException(status_code=400, detail=err)
|
||
|
||
return SendVerificationCodeResponse(
|
||
expires_in=response.expires_in,
|
||
resend_after=response.resend_after,
|
||
)
|
||
|
||
|
||
@router.post("/bind-contact", response_model=BindContactResponse)
|
||
async def bind_contact(
|
||
request: BindContactRequest,
|
||
current_user: AuthenticatedUser = Depends(get_current_user),
|
||
user_repository: UserRepository = Depends(get_user_repository),
|
||
) -> BindContactResponse:
|
||
"""绑定手机号和/或邮箱（需登录态）"""
|
||
from app.dependencies import get_db_session
|
||
|
||
from packages.adapters.sqlalchemy_impl.verification_code_repository import (
|
||
SQLAlchemyVerificationCodeRepository,
|
||
)
|
||
from packages.application.auth.bind_contact_use_case import BindContactRequest as UseCaseRequest
|
||
from packages.application.auth.bind_contact_use_case import (
|
||
BindContactUseCase,
|
||
)
|
||
from packages.application.auth.verification_code_service import VerificationCodeService
|
||
|
||
db = next(get_db_session())
|
||
vc_repo = SQLAlchemyVerificationCodeRepository(db)
|
||
vc_service = VerificationCodeService(repo=vc_repo)
|
||
|
||
use_case = BindContactUseCase(
|
||
user_repository=user_repository,
|
||
verification_code_service=vc_service,
|
||
)
|
||
uc_request = UseCaseRequest(
|
||
user_id=current_user.user.id,
|
||
phone=request.phone,
|
||
phone_code=request.phone_code,
|
||
email=request.email,
|
||
email_code=request.email_code,
|
||
)
|
||
response, err = use_case.execute(uc_request)
|
||
if err:
|
||
raise HTTPException(status_code=400, detail=err)
|
||
|
||
return BindContactResponse(success=True, user=response.to_dict()["user"])
|
||
|
||
|
||
# ==================== 当前用户信息扩展 ====================
|
||
|
||
# 扩展 CurrentUserResponse 增加绑定状态字段（在原响应基础上补充）
|
||
# 通过给 get_current_user_info 返回值补充字段实现
|