@kernel-sig/console 0.1.0

package/backend/app/services/attention_service.py

@@ -0,0 +1,432 @@
+"""关注项服务。
+
+把 domain.attention 的规则求值结果落库成一份可认领的待办队列。
+
+生命周期与「每次重算覆盖」的直觉不同，这里刻意保留状态：
+- 命中且此前已存在 → 刷新 severity/detail/evidence，**保留 first_detected_at**
+- 命中且此前不存在 → 新建
+- 不再命中 → 置 resolved_at，**不删除**
+
+不删除是因为「这条挂了多久才被处理」本身就是维护者要看的信号。
+若把 resolved 的行删掉，积压趋势就无从观察。
+
+一次求值用同一个 ``now`` 同时写入 last_evaluated_at，再用
+``last_evaluated_at < now`` 判定"本轮未再命中"。这样避免把上千个 id
+塞进 NOT IN 子句，也让判断与写入处于同一时间基准。
+"""
+
+from __future__ import annotations
+
+import uuid
+from collections.abc import Sequence
+from datetime import UTC, datetime
+
+import structlog
+from sqlalchemy import case, func, select, update
+from sqlalchemy.dialects.postgresql import insert as pg_insert
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.domain.attention import (
+    AttentionHit,
+    IssueSnapshot,
+    PullSnapshot,
+    Thresholds,
+    evaluate,
+    evaluate_issue,
+)
+from app.models.attention import AttentionItem, AttentionRule, AttentionSeverity
+from app.models.classification import Classification, SubjectType
+from app.models.issue import Issue
+from app.models.pull_request import PRCommit, PRFile, PullRequest
+from app.models.repository import Repository
+
+logger = structlog.get_logger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# 快照构造
+# ---------------------------------------------------------------------------
+
+
+async def _cve_ids_by_pull(
+    session: AsyncSession, pull_ids: Sequence[uuid.UUID]
+) -> dict[uuid.UUID, list[str]]:
+    if not pull_ids:
+        return {}
+    stmt = select(Classification.subject_id, Classification.cve_ids).where(
+        Classification.subject_type == SubjectType.PULL_REQUEST,
+        Classification.subject_id.in_(list(pull_ids)),
+        Classification.cve_ids.is_not(None),
+    )
+    return {row[0]: list(row[1]) for row in (await session.execute(stmt)).all() if row[1]}
+
+
+async def _binary_files_by_pull(
+    session: AsyncSession, pull_ids: Sequence[uuid.UUID]
+) -> dict[uuid.UUID, list[str]]:
+    """只取二进制文件。内核仓库禁止提交，这条规则必须有据可依。"""
+    if not pull_ids:
+        return {}
+    stmt = select(PRFile.pull_request_id, PRFile.filename).where(
+        PRFile.pull_request_id.in_(list(pull_ids)), PRFile.is_binary.is_(True)
+    )
+    result: dict[uuid.UUID, list[str]] = {}
+    for pull_id, filename in (await session.execute(stmt)).all():
+        result.setdefault(pull_id, []).append(filename)
+    return result
+
+
+async def _commit_stats_by_pull(
+    session: AsyncSession, pull_ids: Sequence[uuid.UUID]
+) -> dict[uuid.UUID, tuple[int, int]]:
+    """返回 {pull_id: (提交总数, 缺 Signed-off-by 的提交数)}。
+
+    签名链只在补丁正文里，因此这里用 SQL 的 JSON 数组长度判断，
+    而不是把全部提交读进内存。
+    """
+    if not pull_ids:
+        return {}
+    signed_off_len = func.coalesce(func.jsonb_array_length(PRCommit.signed_off_bys), 0)
+    stmt = (
+        select(
+            PRCommit.pull_request_id,
+            func.count(),
+            func.count().filter(signed_off_len == 0),
+        )
+        .where(PRCommit.pull_request_id.in_(list(pull_ids)))
+        .group_by(PRCommit.pull_request_id)
+    )
+    return {row[0]: (row[1], row[2]) for row in (await session.execute(stmt)).all()}
+
+
+def _pull_snapshot(
+    pull: PullRequest,
+    *,
+    cve_ids: list[str],
+    binary_files: list[str],
+    commit_stats: tuple[int, int],
+) -> PullSnapshot:
+    total_commits, missing_signoff = commit_stats
+    return PullSnapshot(
+        number=pull.number,
+        title=pull.title,
+        state=pull.state.value if hasattr(pull.state, "value") else str(pull.state),
+        gate_stage=pull.gate_stage,
+        created_at=pull.atomgit_created_at,
+        updated_at=pull.atomgit_updated_at,
+        is_draft=pull.draft,
+        merge_conflict=pull.merge_conflict,
+        label_names=pull.label_names or [],
+        cve_ids=cve_ids,
+        binary_files=binary_files,
+        commits_without_signed_off=missing_signoff,
+        total_commits=total_commits,
+    )
+
+
+def _issue_snapshot(issue: Issue) -> IssueSnapshot:
+    return IssueSnapshot(
+        number=issue.number,
+        title=issue.title,
+        state=issue.state,
+        created_at=issue.atomgit_created_at,
+        updated_at=issue.atomgit_updated_at,
+        issue_type=issue.issue_type,
+        priority=issue.priority_label,
+        assignee_login=issue.assignee_login,
+        label_names=issue.label_names or [],
+    )
+
+
+# ---------------------------------------------------------------------------
+# 求值与落库
+# ---------------------------------------------------------------------------
+
+
+def _row(
+    repository_id: uuid.UUID,
+    subject_type: SubjectType,
+    subject_id: uuid.UUID,
+    number: int,
+    title: str,
+    url: str | None,
+    hit: AttentionHit,
+    now: datetime,
+) -> dict:
+    return {
+        "id": uuid.uuid4(),
+        "repository_id": repository_id,
+        "subject_type": subject_type.value,
+        "subject_id": subject_id,
+        "subject_number": number,
+        "subject_title": title,
+        "subject_url": url,
+        "rule": AttentionRule(hit.rule.value).value,
+        "severity": AttentionSeverity(hit.severity.value).value,
+        "title": hit.title,
+        "detail": hit.detail,
+        "evidence": hit.evidence,
+        "last_evaluated_at": now,
+    }
+
+
+# 重算时刷新的列。first_detected_at / acknowledged_* 刻意不在其中：
+# 前者是"这条挂了多久"的依据，后者是人的决定，都不该被自动任务抹掉。
+_REFRESH_COLUMNS = (
+    "subject_number",
+    "subject_title",
+    "subject_url",
+    "severity",
+    "title",
+    "detail",
+    "evidence",
+    "last_evaluated_at",
+)
+
+
+async def _persist(
+    session: AsyncSession, rows: list[dict], *, repository_id: uuid.UUID, now: datetime
+) -> None:
+    for start in range(0, len(rows), 500):
+        chunk = rows[start : start + 500]
+        stmt = pg_insert(AttentionItem).values(chunk)
+        stmt = stmt.on_conflict_do_update(
+            constraint="uq_ksp_attention_subject_rule",
+            set_={col: getattr(stmt.excluded, col) for col in _REFRESH_COLUMNS},
+        )
+        await session.execute(stmt)
+
+    # 本轮没有再命中的，视为已解决。用时间基准而非 id 列表 ——
+    # 一次全量重算涉及上千条，NOT IN 的 id 列表既慢又容易踩参数上限。
+    #
+    # **必须限定在本仓库内**：不加这个条件时，重算 A 仓库会把 B 仓库
+    # 尚未评估过的条目一并标记为已解决 —— B 的队列当场清空，而这一轮
+    # 根本没看过它的数据。只有一个仓库时看不出来，纳管第二个就会。
+    await session.execute(
+        update(AttentionItem)
+        .where(
+            AttentionItem.repository_id == repository_id,
+            AttentionItem.resolved_at.is_(None),
+            AttentionItem.last_evaluated_at < now,
+        )
+        .values(resolved_at=now)
+    )
+
+
+async def compute_for_repository(
+    session: AsyncSession,
+    repository: Repository,
+    *,
+    thresholds: Thresholds | None = None,
+) -> dict:
+    """重算一个仓库的全部关注项。返回本轮统计。"""
+    now = datetime.now(UTC)
+    thresholds = thresholds or Thresholds()
+
+    pulls = list(
+        (
+            await session.scalars(
+                select(PullRequest).where(
+                    PullRequest.repository_id == repository.id,
+                    PullRequest.state == "open",
+                )
+            )
+        ).all()
+    )
+    issues = list(
+        (
+            await session.scalars(
+                select(Issue).where(Issue.repository_id == repository.id, Issue.state == "open")
+            )
+        ).all()
+    )
+
+    pull_ids = [pull.id for pull in pulls]
+    cves = await _cve_ids_by_pull(session, pull_ids)
+    binaries = await _binary_files_by_pull(session, pull_ids)
+    commits = await _commit_stats_by_pull(session, pull_ids)
+
+    rows: list[dict] = []
+    for pull in pulls:
+        snapshot = _pull_snapshot(
+            pull,
+            cve_ids=cves.get(pull.id, []),
+            binary_files=binaries.get(pull.id, []),
+            commit_stats=commits.get(pull.id, (0, 0)),
+        )
+        for hit in evaluate(snapshot, now=now, thresholds=thresholds):
+            rows.append(
+                _row(
+                    repository.id,
+                    SubjectType.PULL_REQUEST,
+                    pull.id,
+                    pull.number,
+                    pull.title,
+                    pull.html_url,
+                    hit,
+                    now,
+                )
+            )
+
+    for issue in issues:
+        for hit in evaluate_issue(_issue_snapshot(issue), now=now, thresholds=thresholds):
+            rows.append(
+                _row(
+                    repository.id,
+                    SubjectType.ISSUE,
+                    issue.id,
+                    issue.number,
+                    issue.title,
+                    issue.html_url,
+                    hit,
+                    now,
+                )
+            )
+
+    await _persist(session, rows, repository_id=repository.id, now=now)
+
+    open_count = await session.scalar(
+        select(func.count())
+        .select_from(AttentionItem)
+        .where(AttentionItem.repository_id == repository.id, AttentionItem.resolved_at.is_(None))
+    )
+
+    logger.info(
+        "attention_computed",
+        repository=repository.full_name,
+        hits=len(rows),
+        open=open_count,
+    )
+    return {
+        "evaluated_pulls": len(pulls),
+        "evaluated_issues": len(issues),
+        "open_items": open_count or 0,
+        "hits": len(rows),
+        "evaluated_at": now.isoformat(),
+    }
+
+
+# ---------------------------------------------------------------------------
+# 查询与认领
+# ---------------------------------------------------------------------------
+
+
+async def list_items(
+    session: AsyncSession,
+    *,
+    repository_id: uuid.UUID | None = None,
+    severities: Sequence[AttentionSeverity] = (),
+    rules: Sequence[AttentionRule] = (),
+    subject_type: SubjectType | None = None,
+    include_resolved: bool = False,
+    unacknowledged_only: bool = False,
+    limit: int = 50,
+    offset: int = 0,
+) -> tuple[list[AttentionItem], int]:
+    def apply_filters(stmt):
+        if repository_id is not None:
+            stmt = stmt.where(AttentionItem.repository_id == repository_id)
+        if severities:
+            stmt = stmt.where(AttentionItem.severity.in_(list(severities)))
+        if rules:
+            stmt = stmt.where(AttentionItem.rule.in_(list(rules)))
+        if subject_type is not None:
+            stmt = stmt.where(AttentionItem.subject_type == subject_type.value)
+        if not include_resolved:
+            stmt = stmt.where(AttentionItem.resolved_at.is_(None))
+        if unacknowledged_only:
+            stmt = stmt.where(AttentionItem.acknowledged_at.is_(None))
+        return stmt
+
+    # severity 是枚举，排序需按语义（blocker 最前）而非字母序，
+    # 因此用 CASE 映射成序号
+    severity_rank = _severity_rank()
+    stmt = (
+        apply_filters(select(AttentionItem))
+        .order_by(severity_rank, AttentionItem.first_detected_at)
+        .limit(limit)
+        .offset(offset)
+    )
+    count_stmt = apply_filters(select(func.count(AttentionItem.id)))
+
+    rows = list((await session.scalars(stmt)).all())
+    total = await session.scalar(count_stmt) or 0
+    return rows, total
+
+
+def _severity_rank():
+    """严重程度的排序表达式。blocker 最前，与 domain.attention.SEVERITY_ORDER 一致。"""
+    return case(
+        {
+            AttentionSeverity.BLOCKER: 0,
+            AttentionSeverity.CRITICAL: 1,
+            AttentionSeverity.WARNING: 2,
+            AttentionSeverity.INFO: 3,
+        },
+        value=AttentionItem.severity,
+        else_=9,
+    )
+
+
+async def severity_counts(session: AsyncSession, repository_id: uuid.UUID) -> dict[str, int]:
+    """未解决项的严重程度分布。界面顶部的筛选栏直接用它渲染。"""
+    stmt = (
+        select(AttentionItem.severity, func.count())
+        .where(
+            AttentionItem.repository_id == repository_id,
+            AttentionItem.resolved_at.is_(None),
+        )
+        .group_by(AttentionItem.severity)
+    )
+    counts = {row[0].value: row[1] for row in (await session.execute(stmt)).all()}
+    return {severity.value: counts.get(severity.value, 0) for severity in AttentionSeverity}
+
+
+async def rule_counts(session: AsyncSession, repository_id: uuid.UUID) -> dict[str, int]:
+    stmt = (
+        select(AttentionItem.rule, func.count())
+        .where(
+            AttentionItem.repository_id == repository_id,
+            AttentionItem.resolved_at.is_(None),
+        )
+        .group_by(AttentionItem.rule)
+    )
+    counts = {row[0].value: row[1] for row in (await session.execute(stmt)).all()}
+    return {rule.value: counts.get(rule.value, 0) for rule in AttentionRule}
+
+
+async def get_item(session: AsyncSession, item_id: uuid.UUID) -> AttentionItem | None:
+    return await session.get(AttentionItem, item_id)
+
+
+async def acknowledge(
+    session: AsyncSession, item: AttentionItem, user_id: uuid.UUID
+) -> AttentionItem:
+    """认领。已被他人认领时不覆盖，避免两个人同时处理时互相踩掉记录。"""
+    if item.acknowledged_by is None:
+        item.acknowledged_by = user_id
+        item.acknowledged_at = datetime.now(UTC)
+        await session.flush()
+    return item
+
+
+async def release(session: AsyncSession, item: AttentionItem) -> AttentionItem:
+    item.acknowledged_by = None
+    item.acknowledged_at = None
+    await session.flush()
+    return item
+
+
+async def items_for_subject(
+    session: AsyncSession, subject_type: SubjectType, subject_id: uuid.UUID
+) -> list[AttentionItem]:
+    stmt = (
+        select(AttentionItem)
+        .where(
+            AttentionItem.subject_type == subject_type.value,
+            AttentionItem.subject_id == subject_id,
+            AttentionItem.resolved_at.is_(None),
+        )
+        .order_by(_severity_rank(), AttentionItem.first_detected_at)
+    )
+    return list((await session.scalars(stmt)).all())

package/backend/app/services/auth_service.py

@@ -0,0 +1,74 @@
+"""认证服务：登录、令牌签发与解析。"""
+
+from datetime import UTC, datetime, timedelta
+
+import jwt
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import Settings
+from app.core.exceptions import UnauthorizedError
+from app.core.security import TokenType, create_token, decode_token, verify_password
+from app.models.user import User
+from app.services.user_service import get_user, get_user_by_username
+
+
+async def authenticate(session: AsyncSession, username: str, password: str) -> User:
+    """校验凭据。
+
+    用户不存在与密码错误返回同一个错误，避免用户名枚举。
+    """
+    user = await get_user_by_username(session, username)
+    if user is None or not verify_password(password, user.password_hash):
+        raise UnauthorizedError("用户名或密码错误")
+    if not user.is_active:
+        raise UnauthorizedError("账号已被禁用")
+
+    user.last_login_at = datetime.now(UTC)
+    await session.flush()
+    return user
+
+
+def issue_tokens(user: User, settings: Settings) -> tuple[str, str]:
+    access = create_token(
+        subject=str(user.id),
+        token_type=TokenType.ACCESS,
+        secret=settings.secret_key,
+        expires_delta=timedelta(minutes=settings.access_token_ttl_minutes),
+        extra_claims={"username": user.username, "role": user.role.name},
+    )
+    refresh = create_token(
+        subject=str(user.id),
+        token_type=TokenType.REFRESH,
+        secret=settings.secret_key,
+        expires_delta=timedelta(days=settings.refresh_token_ttl_days),
+    )
+    return access, refresh
+
+
+async def resolve_token(session: AsyncSession, token: str, settings: Settings) -> User:
+    """从访问令牌解析出用户。"""
+    try:
+        payload = decode_token(token, settings.secret_key, TokenType.ACCESS)
+    except jwt.ExpiredSignatureError as exc:
+        raise UnauthorizedError("登录已过期，请重新登录") from exc
+    except jwt.InvalidTokenError as exc:
+        raise UnauthorizedError("无效的访问令牌") from exc
+
+    user = await get_user(session, payload["sub"])
+    if user is None or not user.is_active:
+        raise UnauthorizedError("账号不存在或已被禁用")
+    return user
+
+
+async def resolve_refresh_token(session: AsyncSession, token: str, settings: Settings) -> User:
+    try:
+        payload = decode_token(token, settings.secret_key, TokenType.REFRESH)
+    except jwt.ExpiredSignatureError as exc:
+        raise UnauthorizedError("会话已过期，请重新登录") from exc
+    except jwt.InvalidTokenError as exc:
+        raise UnauthorizedError("无效的刷新令牌") from exc
+
+    user = await get_user(session, payload["sub"])
+    if user is None or not user.is_active:
+        raise UnauthorizedError("账号不存在或已被禁用")
+    return user