@kernel-sig/console 0.1.0

package/backend/app/models/user.py

@@ -0,0 +1,44 @@
+"""平台用户。"""
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, Enum, String, true
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.permissions import Role
+from app.models.base import Base, TimestampMixin
+
+
+class User(Base, TimestampMixin):
+    """平台账号。
+
+    ``atomgit_login`` 把平台用户与 AtomGit 上的身份对应起来，
+    是解析 ``lgtm-<username>`` 标签与归属评审工作量的关键。
+    """
+
+    __tablename__ = "ksp_user"
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    # unique + index 生成的是唯一索引，而非"唯一约束 + 普通索引"两份冗余结构
+    username: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    display_name: Mapped[str] = mapped_column(String(128), nullable=False)
+    email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
+
+    password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
+    role: Mapped[Role] = mapped_column(
+        Enum(Role, name="user_role", values_callable=lambda e: [m.name for m in e]),
+        default=Role.VIEWER,
+        nullable=False,
+        index=True,
+    )
+
+    atomgit_login: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
+    is_active: Mapped[bool] = mapped_column(
+        Boolean, default=True, server_default=true(), nullable=False
+    )
+    last_login_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    def __repr__(self) -> str:
+        return f"<User {self.username} role={self.role.name}>"

package/backend/app/schemas/ai.py

@@ -0,0 +1,120 @@
+"""AI 配置与分析结果 Schema。"""
+
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from app.models.ai import AIProviderKind, AITask, AnalysisStatus
+from app.models.classification import SubjectType
+
+
+class LLMProviderRead(BaseModel):
+    """只读视图。
+
+    base_url 与模型名可回显，凭据**不可** —— 接口只暴露凭据指纹，
+    与仓库凭据的处理保持一致。
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    kind: AIProviderKind
+    base_url: str
+    credential_id: uuid.UUID | None
+    model: str
+    temperature: float
+    max_tokens: int
+    timeout_seconds: int
+    enabled: bool
+    is_default: bool
+    last_used_at: datetime | None
+    last_error: str | None
+    created_at: datetime
+
+
+class LLMProviderCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=64)
+    base_url: str = Field(
+        min_length=1, max_length=255, description="如 https://api.deepseek.com/v1"
+    )
+    model: str = Field(min_length=1, max_length=128)
+    # 与仓库凭据共用凭据表：明文只在调用时解密，接口只回指纹
+    api_key: str | None = Field(default=None, description="留空表示该端点无需鉴权（本地 vLLM）")
+    temperature: float = Field(default=0.1, ge=0.0, le=2.0)
+    max_tokens: int = Field(default=4096, ge=1, le=200_000)
+    timeout_seconds: int = Field(default=180, ge=10, le=1800)
+    is_default: bool = False
+
+
+class LLMProviderUpdate(BaseModel):
+    base_url: str | None = Field(default=None, max_length=255)
+    model: str | None = Field(default=None, max_length=128)
+    api_key: str | None = None
+    temperature: float | None = Field(default=None, ge=0.0, le=2.0)
+    max_tokens: int | None = Field(default=None, ge=1, le=200_000)
+    timeout_seconds: int | None = Field(default=None, ge=10, le=1800)
+    enabled: bool | None = None
+    is_default: bool | None = None
+
+
+class TaskRoutingRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    task: AITask
+    provider_id: uuid.UUID
+    fallback_provider_id: uuid.UUID | None
+    system_prompt: str | None
+    enabled: bool
+
+
+class TaskRoutingUpsert(BaseModel):
+    provider_id: uuid.UUID
+    fallback_provider_id: uuid.UUID | None = None
+    system_prompt: str | None = None
+    enabled: bool = True
+
+
+class AIAnalysisRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    task: AITask
+    status: AnalysisStatus
+    provider_name: str | None
+    model: str | None
+    prompt_tokens: int
+    completion_tokens: int
+    result: dict | None
+    error: str | None
+    started_at: datetime | None
+    finished_at: datetime | None
+    created_at: datetime
+
+
+class AIUsage(BaseModel):
+    """用量统计。这是唯一按次计费的部分，必须能被看见。"""
+
+    analyses: int
+    succeeded: int
+    failed: int
+    prompt_tokens: int
+    completion_tokens: int
+    by_task: dict[str, int]
+
+
+class ProviderTestResult(BaseModel):
+    ok: bool
+    detail: str
+    latency_ms: int | None = None
+    model: str | None = None
+
+
+class AnalysisTrigger(BaseModel):
+    """触发一次按需分析。"""
+
+    task: AITask = AITask.SUMMARIZE
+    force: bool = Field(default=False, description="绕过输入指纹的幂等检查，重新调用模型")
+    subject_type: SubjectType = SubjectType.PULL_REQUEST

package/backend/app/schemas/attention.py

@@ -0,0 +1,43 @@
+"""关注项 Schema。"""
+
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict
+
+from app.models.attention import AttentionRule, AttentionSeverity
+from app.models.classification import SubjectType
+
+
+class AttentionItemRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    repository_id: uuid.UUID
+    subject_type: SubjectType
+    subject_id: uuid.UUID
+    subject_number: int
+    subject_title: str
+    subject_url: str | None
+    rule: AttentionRule
+    severity: AttentionSeverity
+    title: str
+    # 判定依据（等了几天、哪个文件是二进制、缺什么签名）。
+    # 没有它，维护者只能看到一个"有问题"的结论，无法据此决定要不要理。
+    detail: str | None
+    evidence: dict | None
+    first_detected_at: datetime
+    last_evaluated_at: datetime
+    acknowledged_by: uuid.UUID | None
+    acknowledged_at: datetime | None
+
+
+class AttentionCounts(BaseModel):
+    by_severity: dict[str, int]
+    by_rule: dict[str, int]
+    open_total: int
+
+
+class RuleDescription(BaseModel):
+    rule: AttentionRule
+    description: str

package/backend/app/schemas/auth.py

@@ -0,0 +1,26 @@
+"""认证相关 Schema。"""
+
+from pydantic import BaseModel, Field
+
+
+class LoginRequest(BaseModel):
+    username: str = Field(min_length=1, max_length=64)
+    password: str = Field(min_length=1, max_length=256)
+
+
+class SetupRequest(BaseModel):
+    username: str = Field(min_length=3, max_length=64)
+    display_name: str = Field(min_length=1, max_length=128)
+    email: str = Field(min_length=3, max_length=255)
+    password: str = Field(min_length=8, max_length=256)
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+
+
+class SetupStatus(BaseModel):
+    """前端据此决定跳登录页还是初始化页。"""
+
+    needs_setup: bool

package/backend/app/schemas/classification.py

@@ -0,0 +1,58 @@
+"""分类相关 Schema。"""
+
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, computed_field
+
+from app.domain.classification import subsystem_label
+from app.models.classification import ClassificationSource, PRKind, SubjectType
+
+
+class ClassificationRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    subject_type: SubjectType
+    subject_id: uuid.UUID
+    kind: PRKind
+    subsystem: str | None
+    related_subsystems: list[str] | None
+    cve_ids: list[str] | None
+    linked_issues: list[int] | None
+    confidence: float
+    source: ClassificationSource
+    rule_name: str | None
+    reason: str | None
+    is_override: bool
+    updated_at: datetime
+
+    @computed_field
+    @property
+    def subsystem_label(self) -> str | None:
+        """子系统的展示名由后端下发。
+
+        译名表只在领域层维护一份 —— 前端再存一份，新增子系统时
+        必然出现"后台认识、界面显示英文键名"的漂移。
+        """
+        return subsystem_label(self.subsystem) if self.subsystem else None
+
+
+class ClassificationOverride(BaseModel):
+    """人工指定分类。提交后自动任务不再改写这条记录。"""
+
+    kind: PRKind
+    subsystem: str | None = None
+
+
+class KindCount(BaseModel):
+    """按类型的计数。同时给出占比所需的分子分母由前端汇总。"""
+
+    kind: PRKind
+    count: int
+
+
+class SubsystemCount(BaseModel):
+    subsystem: str
+    label: str
+    count: int

package/backend/app/schemas/common.py

@@ -0,0 +1,43 @@
+"""通用响应 Schema。"""
+
+from collections.abc import Sequence
+
+from pydantic import BaseModel, Field
+
+
+class ProblemDetail(BaseModel):
+    """RFC 7807 错误响应体。"""
+
+    type: str = Field(description="错误类型 URI")
+    title: str
+    status: int
+    detail: str
+    instance: str | None = None
+    code: str | None = None
+    context: dict | None = None
+
+
+class Page[T](BaseModel):
+    """统一分页响应。"""
+
+    items: Sequence[T]
+    total: int
+    page: int
+    per_page: int
+
+    @classmethod
+    def create(cls, items: Sequence[T], total: int, page: int, per_page: int) -> "Page[T]":
+        return cls(items=items, total=total, page=page, per_page=per_page)
+
+
+class PageParams(BaseModel):
+    page: int = Field(default=1, ge=1)
+    per_page: int = Field(default=50, ge=1, le=200)
+
+    @property
+    def offset(self) -> int:
+        return (self.page - 1) * self.per_page
+
+
+class MessageResponse(BaseModel):
+    message: str

package/backend/app/schemas/pull_request.py

@@ -0,0 +1,214 @@
+"""Pull Request 与 Issue Schema。"""
+
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, field_validator
+
+from app.domain.review import GateStage
+from app.models.classification import PRKind
+
+
+class PullSummary(BaseModel):
+    """列表视图。刻意保持精简：1000+ 条记录，只带列表需要展示的字段。"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    # 详情页需要按仓库取分类、关注项等资源，因此随摘要一并下发，
+    # 免得前端为了一个 id 再发一次请求
+    repository_id: uuid.UUID
+    number: int
+    title: str
+    state: str
+    draft: bool
+    author_login: str | None
+    author_avatar_url: str | None
+    target_branch: str | None
+    label_names: list[str] | None
+    added_lines: int
+    removed_lines: int
+    changed_files: int
+    comments_count: int
+    gate_stage: GateStage
+    merge_conflict: bool
+    atomgit_created_at: datetime | None
+    atomgit_updated_at: datetime | None
+    merged_at: datetime | None
+    html_url: str | None
+
+
+class PullListItem(PullSummary):
+    """列表项。在摘要之上多带一个内容类别。
+
+    ``kind`` 不放进 ``PullSummary``：它不在 ``ksp_pull_request`` 表上，
+    由列表接口批量查分类表补齐。放进基类会让详情响应里多一个恒为 null
+    的同名字段，与详情自己的 ``classification`` 字段撞车。
+    为 null 表示尚无分类记录，与 ``unknown``（已分类但判不出来）不同。
+    """
+
+    kind: PRKind | None = None
+
+
+class PRCommitRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    sha: str
+    sequence: int
+    subject: str
+    author_name: str | None
+    author_email: str | None
+    committed_at: datetime | None
+    signed_off_bys: list[str] | None
+
+
+class PRFileRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    filename: str
+    status: str | None
+    additions: int
+    deletions: int
+    is_binary: bool
+    too_large: bool
+    diff: str | None
+
+
+class ReviewEventRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    event_type: str
+    actor_login: str
+    source: str
+    occurred_at: datetime
+
+
+class PRLabelRead(BaseModel):
+    """上游标签。
+
+    只取 name 与 color：AtomGit 的标签色是十六进制字面量，
+    下发给前端后由前端决定如何在深色底上呈现，
+    后端不预先映射成语义色 —— 那会丢掉"上游原本长什么样"这个信息。
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    name: str
+    color: str | None = None
+
+
+class PRCommentRead(BaseModel):
+    """评论原文。
+
+    只下发展示所需的字段：正文体积可能很大（机器人评论含 HTML 表格），
+    但内容本身就是维护者要看的东西，不做截断。
+
+    ``is_bot`` 由后端判定，前端不重复实现机器人识别 ——
+    两处各写一份规则必然漂移，表现为"同一个人有时算机器人有时不算"。
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    comment_id: str
+    comment_type: str | None
+    author_login: str
+    author_avatar_url: str | None
+    body: str
+    atomgit_created_at: datetime | None
+    is_bot: bool = False
+
+
+class PullDetail(PullSummary):
+    body: str | None
+    source_branch: str | None
+    mergeable: bool | None
+    mergeable_detail: dict | None = None
+
+    # 门禁推导结果：让前端无需复刻后端规则
+    blocking_reasons: list[str] = []
+    ready_to_merge: bool = False
+    lgtm_actors: list[str] = []
+
+    # 上游标签的原始形态（含颜色），与 label_names 并存：
+    # label_names 供筛选，labels 供展示
+    labels: list[PRLabelRead] = []
+
+    commits: list[PRCommitRead] = []
+    files: list[PRFileRead] = []
+    review_events: list[ReviewEventRead] = []
+    comments: list[PRCommentRead] = []
+
+    @field_validator("labels", mode="before")
+    @classmethod
+    def _empty_when_absent(cls, value: object) -> object:
+        """labels 列可为 NULL（列表同步尚未带标签的 PR）。
+
+        默认值只在字段缺席时生效，显式的 None 会走到校验 ——
+        这里归一成空列表，免得详情接口因为一个没同步过标签的 PR 而 500。
+        """
+        return [] if value is None else value
+
+
+class IssueSummary(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    number: int
+    title: str
+    state: str
+    issue_type: str | None
+    issue_state: str | None
+    priority_label: str | None
+    author_login: str | None
+    assignee_login: str | None
+    label_names: list[str] | None
+    comments_count: int
+    atomgit_created_at: datetime | None
+    atomgit_updated_at: datetime | None
+    html_url: str | None
+
+
+class IssueListItem(IssueSummary):
+    """Issue 列表项。在摘要之上多带一个内容类别。
+
+    与 PR 列表同样的理由：分类只在详情页可见的话，就无法按类别分流，
+    而 Issue 的数量（2000+）比 PR 更需要分流。
+    """
+
+    kind: PRKind | None = None
+
+
+class IssueDetail(IssueSummary):
+    body: str | None
+    finished_at: datetime | None
+
+
+class StageCount(BaseModel):
+    """门禁阶段计数，用于列表页的筛选标签。"""
+
+    stage: GateStage
+    count: int
+
+
+class FacetValueRead(BaseModel):
+    """分面里的一个取值。
+
+    ``count`` 是在**其余维度已勾选**、但**本维度未参与筛选**的前提下算出来的。
+    这正是它能用来放宽选择的原因：勾了 CVE 之后，分支栏仍显示各分支的真实数量。
+    """
+
+    value: str
+    label: str
+    count: int
+    selected: bool = False
+
+
+class FacetRead(BaseModel):
+    key: str
+    label: str
+    values: list[FacetValueRead] = []
+
+
+class FacetResponse(BaseModel):
+    total: int = 0
+    facets: list[FacetRead] = []

package/backend/app/schemas/repository.py

@@ -0,0 +1,94 @@
+"""仓库与凭据 Schema。"""
+
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from app.models.credential import CredentialKind
+
+
+class CredentialRead(BaseModel):
+    """凭据对外视图。**不含明文，只有指纹**。"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    kind: CredentialKind
+    fingerprint: str
+    meta: dict | None
+    last_verified_at: datetime | None
+    last_verify_error: str | None
+    created_at: datetime
+
+
+class CredentialCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=128)
+    kind: CredentialKind
+    # 明文只在创建/更新时传入，此后永不可读回
+    value: str = Field(min_length=1, max_length=512)
+    meta: dict | None = None
+
+
+class CredentialRotate(BaseModel):
+    value: str = Field(min_length=1, max_length=512)
+
+
+class RepositoryRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    owner: str
+    name: str
+    display_name: str | None
+    api_base_url: str
+    credential_id: uuid.UUID | None
+    default_branch: str | None
+    tracked_branches: list | None
+    sync_enabled: bool
+    sync_interval_seconds: int
+    backfill_days: int
+    last_sync_at: datetime | None
+    last_sync_error: str | None
+    created_at: datetime
+
+    webhook_path: str | None = None
+    pull_count: int | None = None
+    issue_count: int | None = None
+
+
+class RepositoryCreate(BaseModel):
+    owner: str = Field(min_length=1, max_length=128)
+    name: str = Field(min_length=1, max_length=128)
+    credential_id: uuid.UUID
+    display_name: str | None = Field(default=None, max_length=255)
+    api_base_url: str = Field(default="https://api.atomgit.com/api/v5", max_length=255)
+    tracked_branches: list[str] | None = None
+    backfill_days: int = Field(default=180, ge=1, le=3650)
+
+
+class RepositoryUpdate(BaseModel):
+    display_name: str | None = Field(default=None, max_length=255)
+    credential_id: uuid.UUID | None = None
+    tracked_branches: list[str] | None = None
+    sync_enabled: bool | None = None
+    sync_interval_seconds: int | None = Field(default=None, ge=60, le=86400)
+    backfill_days: int | None = Field(default=None, ge=1, le=3650)
+
+
+class SyncRunRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    resource: str
+    trigger: str
+    status: str
+    started_at: datetime
+    finished_at: datetime | None
+    api_calls: int
+    items_fetched: int
+    items_created: int
+    items_updated: int
+    items_failed: int
+    error: str | None