@kernel-sig/console 0.1.0

package/backend/app/services/credential_service.py

@@ -0,0 +1,105 @@
+"""凭据服务。
+
+职责：加密存储、按需解密、验证有效性。
+
+安全约束：
+- 明文永不回显，接口只暴露指纹
+- 解密仅在真正需要调用外部服务时发生，且不写入日志
+"""
+
+import uuid
+from datetime import UTC, datetime
+
+import structlog
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import Settings
+from app.core.crypto import CredentialCipher, fingerprint
+from app.core.exceptions import ConflictError, NotFoundError
+from app.models.credential import Credential, CredentialKind
+
+logger = structlog.get_logger(__name__)
+
+
+def _cipher(settings: Settings) -> CredentialCipher:
+    return CredentialCipher(secret_key=settings.secret_key)
+
+
+async def list_credentials(
+    session: AsyncSession, *, kind: CredentialKind | None = None
+) -> list[Credential]:
+    stmt = select(Credential).order_by(Credential.created_at.desc())
+    if kind is not None:
+        stmt = stmt.where(Credential.kind == kind)
+    return list((await session.scalars(stmt)).all())
+
+
+async def get_credential(session: AsyncSession, credential_id: uuid.UUID) -> Credential | None:
+    return await session.get(Credential, credential_id)
+
+
+async def create_credential(
+    session: AsyncSession,
+    settings: Settings,
+    *,
+    name: str,
+    kind: CredentialKind,
+    plaintext: str,
+    meta: dict | None = None,
+    created_by: uuid.UUID | None = None,
+) -> Credential:
+    existing = await session.scalar(select(Credential).where(Credential.name == name))
+    if existing is not None:
+        raise ConflictError(f"凭据名称 {name} 已存在")
+
+    cipher = _cipher(settings)
+    credential = Credential(
+        name=name,
+        kind=kind,
+        encrypted_value=cipher.encrypt(plaintext).encode("utf-8"),
+        fingerprint=fingerprint(plaintext),
+        meta=meta,
+        created_by=created_by,
+    )
+    session.add(credential)
+    await session.flush()
+    return credential
+
+
+async def update_credential_value(
+    session: AsyncSession, settings: Settings, credential: Credential, plaintext: str
+) -> Credential:
+    """轮换凭据明文。指纹随之更新。"""
+    cipher = _cipher(settings)
+    credential.encrypted_value = cipher.encrypt(plaintext).encode("utf-8")
+    credential.fingerprint = fingerprint(plaintext)
+    credential.last_verified_at = None
+    credential.last_verify_error = None
+    await session.flush()
+    return credential
+
+
+def reveal(settings: Settings, credential: Credential) -> str:
+    """解密凭据明文。
+
+    仅限在真正需要调用外部服务的路径上使用。返回值不得进入日志、
+    异常信息或任何面向用户的响应。
+    """
+    return _cipher(settings).decrypt(credential.encrypted_value.decode("utf-8"))
+
+
+def mark_verified(credential: Credential, *, error: str | None = None) -> None:
+    credential.last_verified_at = datetime.now(UTC) if error is None else None
+    credential.last_verify_error = error
+
+
+async def delete_credential(session: AsyncSession, credential: Credential) -> None:
+    await session.delete(credential)
+
+
+async def require_credential(session: AsyncSession, credential_id: uuid.UUID) -> Credential:
+    credential = await get_credential(session, credential_id)
+    if credential is None:
+        raise NotFoundError("凭据不存在", resource="credential", identifier=str(credential_id))
+    return credential

package/backend/app/services/pull_query.py

@@ -0,0 +1,273 @@
+"""PR 列表的筛选与分面计数。
+
+筛选条件只有一份定义，列表接口与分面接口共用 —— 两处各写一份必然漂移，
+表现为"筛选出 12 条，但分面里那一项的计数写着 15"，而这种偏差很难被发现。
+
+分面计数的关键在于**算某一维度的计数时要把该维度自己的筛选去掉**：
+否则勾上"CVE"之后，类别那一栏只剩下 CVE 一项非零，使用者除了全部清空
+没有别的办法把范围放宽。这是分面浏览能不能用的分水岭。
+"""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+from datetime import UTC, datetime, timedelta
+
+from sqlalchemy import Select, String, cast, exists, func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.domain.release import classify_branch
+from app.domain.review import is_bot
+from app.models.attention import AttentionItem
+from app.models.classification import Classification, PRKind, SubjectType
+from app.models.pull_request import PullRequest
+
+# 分面维度。顺序即展示顺序。
+DIMENSIONS: tuple[str, ...] = ("stage", "kind", "branch", "author", "attention")
+
+
+@dataclass
+class Selection:
+    """一组筛选条件。多维之间取交，同维之内取并。"""
+
+    state: str | None = None
+    stage: list[str] = field(default_factory=list)
+    kind: list[str] = field(default_factory=list)
+    branch: list[str] = field(default_factory=list)
+    author: list[str] = field(default_factory=list)
+    attention: list[str] = field(default_factory=list)
+    draft: bool | None = None
+    conflict: bool | None = None
+    search: str | None = None
+
+    waiting_days_gte: int | None = None
+    """已等待天数下限。首页「超 30 天未评审」这类指标要能点进来，
+    否则那只是一个无法追问的数字。"""
+
+    def without(self, dimension: str) -> Selection:
+        """去掉某一维度后的条件。分面计数用。"""
+        clone = Selection(
+            state=self.state,
+            stage=list(self.stage),
+            kind=list(self.kind),
+            branch=list(self.branch),
+            author=list(self.author),
+            attention=list(self.attention),
+            draft=self.draft,
+            conflict=self.conflict,
+            search=self.search,
+            waiting_days_gte=self.waiting_days_gte,
+        )
+        setattr(clone, dimension, [] if dimension != "draft" else None)
+        return clone
+
+
+@dataclass
+class FacetValue:
+    value: str
+    label: str
+    count: int
+    selected: bool = False
+
+
+@dataclass
+class Facet:
+    key: str
+    label: str
+    values: list[FacetValue]
+
+
+def apply_filters(
+    stmt: Select,
+    repository_id: uuid.UUID,
+    selection: Selection,
+    *,
+    branch_alias: dict[str, list[str]] | None = None,
+) -> Select:
+    """把筛选条件套到 PR 查询上。列表与分面共用。
+
+    ``branch_alias`` 是「规范化分支名 → 库中实际写法」的映射。筛选值用的是
+    规范化名（分面里显示的就是它），而 ``target_branch`` 存的是上游原始写法，
+    不展开就会筛不到任何东西 —— 而"勾了却空结果"比报错更难排查。
+    """
+    stmt = stmt.where(PullRequest.repository_id == repository_id)
+
+    if selection.state and selection.state != "all":
+        stmt = stmt.where(PullRequest.state == selection.state)
+    if selection.stage:
+        stmt = stmt.where(PullRequest.gate_stage.in_(selection.stage))
+    if selection.branch:
+        raw = [
+            name
+            for canonical in selection.branch
+            for name in (branch_alias or {}).get(canonical, [canonical])
+        ]
+        stmt = stmt.where(PullRequest.target_branch.in_(raw))
+    if selection.author:
+        stmt = stmt.where(PullRequest.author_login.in_(selection.author))
+    if selection.draft is not None:
+        stmt = stmt.where(PullRequest.draft.is_(selection.draft))
+    if selection.conflict is not None:
+        stmt = stmt.where(PullRequest.merge_conflict.is_(selection.conflict))
+    if selection.search:
+        pattern = f"%{selection.search}%"
+        stmt = stmt.where(
+            or_(
+                PullRequest.title.ilike(pattern),
+                cast(PullRequest.number, String).ilike(pattern),
+            )
+        )
+
+    if selection.kind:
+        stmt = stmt.where(
+            PullRequest.id.in_(
+                select(Classification.subject_id).where(
+                    Classification.subject_type == SubjectType.PULL_REQUEST,
+                    Classification.kind.in_([PRKind(value) for value in selection.kind]),
+                )
+            )
+        )
+    if selection.waiting_days_gte is not None:
+        # 等待时长以创建时间为起点。与 analytics 的 waiting_time_stats
+        # 用同一个口径，否则首页数字与点进来的列表对不上。
+        cutoff = datetime.now(UTC) - timedelta(days=selection.waiting_days_gte)
+        stmt = stmt.where(
+            PullRequest.atomgit_created_at.is_not(None),
+            PullRequest.atomgit_created_at < cutoff,
+        )
+    if selection.attention:
+        stmt = stmt.where(
+            exists().where(
+                AttentionItem.subject_id == PullRequest.id,
+                AttentionItem.resolved_at.is_(None),
+                AttentionItem.rule.in_(selection.attention),
+            )
+        )
+    return stmt
+
+
+async def _counts(
+    session: AsyncSession,
+    repository_id: uuid.UUID,
+    selection: Selection,
+    dimension: str,
+    *,
+    branch_alias: dict[str, list[str]] | None = None,
+) -> dict[str, int]:
+    """某一维度下的取值分布。"""
+    scoped = selection.without(dimension)
+
+    if dimension == "stage":
+        column = PullRequest.gate_stage
+        stmt = select(column, func.count()).group_by(column)
+    elif dimension == "branch":
+        column = PullRequest.target_branch
+        stmt = select(column, func.count()).group_by(column)
+    elif dimension == "author":
+        column = PullRequest.author_login
+        stmt = select(column, func.count()).where(column.is_not(None)).group_by(column)
+    elif dimension == "kind":
+        stmt = (
+            select(Classification.kind, func.count())
+            .select_from(PullRequest)
+            .join(
+                Classification,
+                (Classification.subject_id == PullRequest.id)
+                & (Classification.subject_type == SubjectType.PULL_REQUEST),
+            )
+            .where(PullRequest.repository_id == repository_id)
+            .group_by(Classification.kind)
+        )
+    elif dimension == "attention":
+        stmt = (
+            select(AttentionItem.rule, func.count(func.distinct(PullRequest.id)))
+            .select_from(PullRequest)
+            .join(AttentionItem, AttentionItem.subject_id == PullRequest.id)
+            .where(
+                PullRequest.repository_id == repository_id,
+                AttentionItem.resolved_at.is_(None),
+            )
+            .group_by(AttentionItem.rule)
+        )
+    else:
+        return {}
+
+    stmt = apply_filters(stmt, repository_id, scoped, branch_alias=branch_alias)
+    raw = {
+        str(row[0].value if hasattr(row[0], "value") else row[0]): row[1]
+        for row in (await session.execute(stmt)).all()
+    }
+
+    if dimension == "branch":
+        # 同一交付的多种写法在这里合并，否则分面里会出现两行同一个版本
+        merged: dict[str, int] = {}
+        for raw_name, count in raw.items():
+            merged[classify_branch(raw_name).name] = (
+                merged.get(classify_branch(raw_name).name, 0) + count
+            )
+        return merged
+    return raw
+
+
+# 每个维度最多列多少项。列表太长会让"找不到"取代"选得快"。
+DIMENSION_LIMIT = 14
+
+# 作者维度里机器人不参与 —— 它们不是人在选的维度
+_AUTHOR_LIMIT = 10
+
+
+async def build_facets(
+    session: AsyncSession,
+    repository_id: uuid.UUID,
+    selection: Selection,
+    *,
+    branch_alias: dict[str, list[str]] | None = None,
+) -> list[Facet]:
+    """构造各维度的分面。
+
+    取值按计数降序，零计数的取值**保留**（调用方把它们置灰）：
+    一个勾选框就重排一次的列表是点不准的。已被选中但本轮计数为零的取值
+    同样保留，否则使用者只能靠手改地址栏才能取消它。
+    """
+    facets: list[Facet] = []
+    for dimension in DIMENSIONS:
+        counts = await _counts(
+            session, repository_id, selection, dimension, branch_alias=branch_alias
+        )
+        chosen = set(getattr(selection, dimension) or [])
+
+        if dimension == "author":
+            counts = {name: count for name, count in counts.items() if not is_bot(name)}
+
+        items = sorted(counts.items(), key=lambda item: (-item[1], item[0]))
+        limit = _AUTHOR_LIMIT if dimension == "author" else DIMENSION_LIMIT
+        items = items[:limit]
+
+        # 选中的取值即使掉出前 N 也要保留
+        for value in chosen:
+            if value not in counts and value not in {item[0] for item in items}:
+                items.append((value, 0))
+
+        # label 只放原始值：门禁阶段与内容类别的中文名在前端已有单一来源
+        # （GATE_STAGE_META / KIND_META），后端再维护一份必然漂移。
+        facets.append(
+            Facet(
+                key=dimension,
+                label=DIMENSION_LABELS[dimension],
+                values=[
+                    FacetValue(value=value, label=value, count=count, selected=value in chosen)
+                    for value, count in items
+                ],
+            )
+        )
+    return facets
+
+
+DIMENSION_LABELS: dict[str, str] = {
+    "stage": "门禁阶段",
+    "kind": "内容类别",
+    "branch": "目标分支",
+    "author": "作者",
+    "attention": "关注规则",
+}