@kernel-sig/console 0.1.0

package/backend/app/services/user_service.py

@@ -0,0 +1,68 @@
+"""用户领域服务。"""
+
+import uuid
+
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.permissions import Role
+from app.core.security import hash_password
+from app.models.user import User
+
+
+async def get_user_by_username(session: AsyncSession, username: str) -> User | None:
+    """按用户名查找（不区分大小写）。"""
+    stmt = select(User).where(func.lower(User.username) == username.lower())
+    return await session.scalar(stmt)
+
+
+async def get_user(session: AsyncSession, user_id: uuid.UUID | str) -> User | None:
+    return await session.get(User, user_id)
+
+
+async def list_users(
+    session: AsyncSession, *, offset: int = 0, limit: int = 50
+) -> tuple[list[User], int]:
+    total = await session.scalar(select(func.count()).select_from(User)) or 0
+    stmt = select(User).order_by(User.created_at.desc()).offset(offset).limit(limit)
+    users = list((await session.scalars(stmt)).all())
+    return users, total
+
+
+async def create_user(
+    session: AsyncSession,
+    *,
+    username: str,
+    display_name: str,
+    email: str,
+    password: str,
+    role: Role = Role.VIEWER,
+    atomgit_login: str | None = None,
+) -> User:
+    if await get_user_by_username(session, username) is not None:
+        raise ValueError(f"用户名 {username} 已存在")
+
+    existing_email = await session.scalar(select(User).where(User.email == email))
+    if existing_email is not None:
+        raise ValueError(f"邮箱 {email} 已存在")
+
+    user = User(
+        username=username,
+        display_name=display_name,
+        email=email,
+        password_hash=hash_password(password),
+        role=role,
+        atomgit_login=atomgit_login,
+    )
+    session.add(user)
+    await session.flush()
+    return user
+
+
+async def set_password(session: AsyncSession, user: User, new_password: str) -> None:
+    user.password_hash = hash_password(new_password)
+    await session.flush()
+
+
+async def count_users(session: AsyncSession) -> int:
+    return await session.scalar(select(func.count()).select_from(User)) or 0

package/backend/app/worker.py

@@ -0,0 +1,389 @@
+"""后台 worker：定时轮询与异步分析。
+
+启动方式：``arq app.worker.WorkerSettings``（见 compose.yaml 的 worker 服务）。
+
+任务分四类，各自的节奏差异很大，**不合并**成一个"同步一切"的任务：
+- 列表同步快且必须及时（10 分钟一次），否则界面上的状态是过期的
+- 详情同步逐步推进（5 分钟一批），失败不该拖累列表
+- 分类与关注项求值是本地计算，零外部开销，跟在下游跑即可
+- AI 分析按次计费，必须限流并单独控制
+
+**并发防护**：ARQ 的 cron 默认 unique=True，同一任务不会并发执行。
+手动触发与定时任务之间可能重叠，这一点由 sync_service 的乐观并发
+（仅当远端 updated_at 不早于本地才覆盖）兜底，不会写坏数据。
+"""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+import httpx
+import structlog
+from arq import cron
+from sqlalchemy.exc import SQLAlchemyError
+
+from app.core.config import get_settings
+from app.core.db import dispose_engine, init_engine, session_scope
+from app.core.logging import configure_logging
+from app.core.queue import redis_settings_from
+from app.integrations.atomgit.client import AtomGitError
+
+logger = structlog.get_logger(__name__)
+
+# 每轮详情同步处理的 PR 数。单次请求量大时上游会限流，
+# 小批量高频比大批量低频更稳。
+DETAIL_BATCH = 50
+
+# 每轮 AI 分析处理的目标数。这是成本闸门 —— 调大意味着账单同步变大。
+AI_BATCH = 5
+
+
+def _every(minutes: int, offset: int = 0) -> set[int]:
+    """每 N 分钟触发一次的分钟集合。
+
+    刻意错开分钟点：所有任务都压在整点会让上游在瞬间收到成倍请求。
+    """
+    return set(range(offset % minutes, 60, minutes))
+
+
+async def _repository_ids(repository_id: str | None) -> list[str]:
+    """解析本次任务的目标仓库。
+
+    只返回 id，不返回 ORM 对象 —— 后续每个仓库在独立会话里重新加载，
+    避免跨会话持有已 detached 的实例。
+    """
+    from app.services import repository_service
+
+    async with session_scope() as session:
+        if repository_id:
+            repository = await repository_service.require_repository(session, repository_id)
+            return [str(repository.id)]
+        repositories = await repository_service.list_repositories(session)
+        return [str(repository.id) for repository in repositories]
+
+
+# ---------------------------------------------------------------------------
+# 同步
+# ---------------------------------------------------------------------------
+
+# 没配凭据的仓库会被同步层跳过（返回 None，见 sync_service._skip_without_credential）。
+# 这不是失败，所以如实报成 "skipped" 而不是 fail。
+_NO_CREDENTIAL = "skipped:未配置凭据"
+
+
+async def sync_pulls(ctx: dict, repository_id: str | None = None) -> dict:
+    """同步 PR 列表。只更新轻量字段，不拉详情。"""
+    from app.models.repository import SyncTrigger
+    from app.services import repository_service, sync_service
+
+    settings = get_settings()
+    results: dict[str, str] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            run = await sync_service.sync_pulls(
+                session, settings, repository, trigger=SyncTrigger.SCHEDULED
+            )
+            results[repository.full_name] = (
+                f"{run.status.value}:{run.items_fetched}" if run else _NO_CREDENTIAL
+            )
+    return {"repositories": results}
+
+
+async def sync_issues(ctx: dict, repository_id: str | None = None) -> dict:
+    from app.models.repository import SyncTrigger
+    from app.services import repository_service, sync_service
+
+    settings = get_settings()
+    results: dict[str, str] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            run = await sync_service.sync_issues(
+                session, settings, repository, trigger=SyncTrigger.SCHEDULED
+            )
+            results[repository.full_name] = (
+                f"{run.status.value}:{run.items_fetched}" if run else _NO_CREDENTIAL
+            )
+    return {"repositories": results}
+
+
+async def sync_pull_details(ctx: dict, repository_id: str | None = None, limit: int = DETAIL_BATCH):
+    """为内容有变化的 PR 补齐提交、文件与评审事件。"""
+    from app.models.repository import SyncTrigger
+    from app.services import repository_service, sync_service
+
+    settings = get_settings()
+    results: dict[str, str] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            run = await sync_service.sync_pull_details(
+                session, settings, repository, limit=limit, trigger=SyncTrigger.SCHEDULED
+            )
+            results[repository.full_name] = (
+                f"{run.status.value}:{run.items_updated}/{run.items_fetched}"
+                if run
+                else _NO_CREDENTIAL
+            )
+    return {"repositories": results}
+
+
+# ---------------------------------------------------------------------------
+# 分类与关注项
+# ---------------------------------------------------------------------------
+
+
+async def classify_repository(ctx: dict, repository_id: str | None = None) -> dict:
+    """对活动 PR/Issue 跑规则分类。
+
+    只处理 open 的：已合并/已关闭的分类结果不再产生任何可执行动作，
+    为它们消耗计算没有收益。
+    """
+    from sqlalchemy import select
+
+    from app.models.issue import Issue
+    from app.models.pull_request import PullRequest
+    from app.services import classification_service, repository_service
+
+    results: dict[str, str] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            # 规则分类覆盖全部状态，不只 open。合入的 PR 同样需要类别 ——
+            # 版本与分支页的"这一期合入了多少 CVE"就依赖它，而合入之后
+            # 状态变成 merged，再只按 open 筛选就永远统计不到。
+            # 规则是纯计算、无外部调用，多算的代价可以忽略。
+            pulls = list(
+                (
+                    await session.scalars(
+                        select(PullRequest).where(PullRequest.repository_id == repository.id)
+                    )
+                ).all()
+            )
+            issues = list(
+                (
+                    await session.scalars(
+                        select(Issue).where(
+                            Issue.repository_id == repository.id, Issue.state == "open"
+                        )
+                    )
+                ).all()
+            )
+            pulls_written = await classification_service.classify_pulls(session, repository, pulls)
+            issues_written = await classification_service.classify_issues(
+                session, repository, issues
+            )
+            results[repository.full_name] = f"pulls={pulls_written} issues={issues_written}"
+    return {"repositories": results}
+
+
+async def sync_sig_info(ctx: dict, repository_id: str | None = None) -> dict:
+    """同步 SIG 例会纪要与成员名单。
+
+    两者都与具体仓库无关（会议是全 SIG 的，名单来自 community 仓库），
+    但仍挂在仓库任务体系里：复用同一套 session 与凭据解析，
+    为此单开一条调度链不值得。
+
+    两件事都容错 —— 数据源都在平台之外，网络波动不该让定时任务报红：
+    纪要拉不到就跳过，名单拉不到就保留旧数据（``sync_roster``
+    在拿不到文档时不动现有数据）。
+    """
+    from app.services import credential_service, repository_service, sig_service
+
+    settings = get_settings()
+    result: dict[str, object] = {}
+
+    try:
+        text = await sig_service.fetch_etherpad()
+        async with session_scope() as session:
+            result["meetings"] = await sig_service.sync_meetings(session, text)
+    except httpx.HTTPError as exc:
+        logger.warning("etherpad_unavailable", error=str(exc)[:200])
+        result["meetings"] = "unavailable"
+
+    roster: dict[str, object] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            credential = await credential_service.get_credential(session, repository.credential_id)
+            if credential is None:
+                roster[repository.full_name] = "no_credential"
+                continue
+            async with repository_service.build_client(settings, repository, credential) as client:
+                sig_yaml, committers, _readme = await sig_service.fetch_sig_documents(client)
+            try:
+                roster[repository.full_name] = await sig_service.sync_roster(
+                    session, sig_info_yaml=sig_yaml, committers_md=committers
+                )
+            except (AtomGitError, SQLAlchemyError) as exc:
+                logger.warning("sig_roster_failed", error=str(exc)[:200])
+                roster[repository.full_name] = "failed"
+    result["roster"] = roster
+    return result
+
+
+async def compute_attention(ctx: dict, repository_id: str | None = None) -> dict:
+    """重算关注项队列。
+
+    必须在列表同步之后执行 —— 规则读的是 gate_stage、merge_conflict
+    这些派生列，列表同步没跑完时算出来的是上一轮的状态。
+    """
+    from app.services import attention_service, repository_service
+
+    results: dict[str, dict] = {}
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+            results[repository.full_name] = await attention_service.compute_for_repository(
+                session, repository
+            )
+    return {"repositories": results}
+
+
+# ---------------------------------------------------------------------------
+# AI 分析
+# ---------------------------------------------------------------------------
+
+
+async def run_ai_analysis(ctx: dict, repository_id: str | None = None, limit: int = AI_BATCH):
+    """对规则无法判定、或从未分析过的 PR 调用模型。
+
+    当前只做分类补判 —— 这是成本最低、且规则明确接不住的一块。
+    摘要与风险审查按需触发（analyze_pull_task），不做定时批量：
+    它们的单价高得多，无人阅读的结果等于纯支出。
+    """
+    from app.core.exceptions import ValidationError
+    from app.models.ai import AITask, AnalysisStatus
+    from app.services import ai_service, classification_service, repository_service
+
+    settings = get_settings()
+    results: dict[str, str] = {}
+
+    for repo_id in await _repository_ids(repository_id):
+        async with session_scope() as session:
+            repository = await repository_service.require_repository(session, repo_id)
+
+            # 先确认有可用模型再挑目标并动手。否则会挑出一批、逐个失败，
+            # 结果只能报一句 "classified=0/5"，看不出是没配模型还是模型出错。
+            try:
+                await ai_service.resolve_provider(session, AITask.CLASSIFY)
+            except ValidationError:
+                logger.info("ai_analysis_skipped_no_provider", repository=repository.full_name)
+                results[repository.full_name] = "skipped:no_provider"
+                continue
+
+            targets = await classification_service.pulls_missing_classification(
+                session, repository.id, limit=limit
+            )
+            # Issue 也补判。数量是 PR 的两倍且未判定率更高（46%，因为
+            # Issue 没有变更文件可供推断），因此单独限流：每轮只取一小批，
+            # 慢慢补完即可 —— 一次性判完既烧钱也没有必要。
+            issues = await classification_service.issues_missing_classification(
+                session, repository.id, limit=max(5, limit // 2)
+            )
+            if not targets and not issues:
+                continue
+
+            classified = 0
+            for pull in targets:
+                analysis = await ai_service.classify_subject(
+                    session, settings, repository, pull=pull
+                )
+                if analysis.status is AnalysisStatus.SUCCEEDED:
+                    classified += 1
+
+            issue_classified = 0
+            for issue in issues:
+                analysis = await ai_service.classify_subject(
+                    session, settings, repository, issue=issue
+                )
+                if analysis.status is AnalysisStatus.SUCCEEDED:
+                    issue_classified += 1
+
+            results[repository.full_name] = (
+                f"pr={classified}/{len(targets)} issue={issue_classified}/{len(issues)}"
+            )
+
+    return {"repositories": results}
+
+
+async def analyze_pull_task(ctx: dict, pull_id: str, task: str, force: bool = False) -> dict:
+    """按需触发的单条分析。供 API 入队使用。"""
+    from app.models.ai import AITask
+    from app.models.pull_request import PullRequest
+    from app.services import ai_service, repository_service
+
+    settings = get_settings()
+    async with session_scope() as session:
+        pull = await session.get(PullRequest, pull_id)
+        if pull is None:
+            return {"status": "not_found", "pull_id": pull_id}
+        repository = await repository_service.require_repository(session, pull.repository_id)
+        resolved = AITask(task)
+        target = await ai_service.build_target(session, task=resolved, pull=pull)
+        analysis = await ai_service.execute(session, settings, repository, target, force=force)
+        return {
+            "status": analysis.status.value,
+            "pull": pull.number,
+            "task": task,
+            "error": analysis.error,
+        }
+
+
+# ---------------------------------------------------------------------------
+# worker 装配
+# ---------------------------------------------------------------------------
+
+
+async def on_startup(ctx: dict) -> None:
+    settings = get_settings()
+    configure_logging(level=settings.log_level, json_output=settings.is_production)
+    init_engine(settings)
+    logger.info("worker_started", environment=settings.environment)
+
+
+async def on_shutdown(ctx: dict) -> None:
+    await dispose_engine()
+    logger.info("worker_stopped")
+
+
+class WorkerSettings:
+    # ClassVar 注解不改变运行期行为：ARQ 通过 __dict__ 读取这些属性，
+    # 注解只是告诉类型检查器它们是类级别的常量容器
+    functions: ClassVar[list] = [
+        sync_pulls,
+        sync_issues,
+        sync_pull_details,
+        classify_repository,
+        compute_attention,
+        run_ai_analysis,
+        analyze_pull_task,
+    ]
+
+    # 分钟点刻意错开：全部压在整点会让上游在瞬间收到成倍请求，
+    # 自己的数据库也会同时承受多个全量重算。
+    cron_jobs: ClassVar[list] = [
+        cron(sync_pulls, minute=_every(10, offset=1), timeout=600),
+        cron(sync_issues, minute=_every(30, offset=4), timeout=600),
+        cron(sync_pull_details, minute=_every(5, offset=3), timeout=900),
+        # 跟在列表同步之后：规则读的是列表同步写下的派生列
+        cron(classify_repository, minute=_every(10, offset=6), timeout=600),
+        cron(compute_attention, minute=_every(15, offset=7), timeout=600),
+        cron(run_ai_analysis, minute=_every(30, offset=9), timeout=1800),
+        # 例会纪要每天变一次就够了；成员名单更低频，但共用一条链成本很低
+        cron(sync_sig_info, hour={2, 14}, minute=_every(60, offset=13), timeout=900),
+    ]
+
+    on_startup = on_startup
+    on_shutdown = on_shutdown
+
+    # 并发度：同步任务是 IO 密集且受上游限流约束，4 路已足够；
+    # 再高只会更快撞上 429。
+    max_jobs = 4
+    job_timeout = 1800
+    keep_result = 3600
+    max_tries = 2
+
+    # ARQ 通过 __dict__ 读取本类属性，因此这里必须是实例而非可调用对象
+    redis_settings = redis_settings_from(get_settings())

package/backend/entrypoint.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# 容器入口：先跑迁移再起服务。
+# alembic upgrade head 是幂等的，重复启动不会重复应用。
+set -e
+
+echo "[entrypoint] 执行数据库迁移..."
+alembic upgrade head
+
+echo "[entrypoint] 启动 API..."
+exec uvicorn app.main:app --host 0.0.0.0 --port 8000 "$@"

package/backend/pyproject.toml

@@ -0,0 +1,68 @@
+[project]
+name = "kernel-sig-console"
+version = "0.1.0"
+description = "openEuler Kernel SIG 协作平台后端"
+requires-python = ">=3.12"
+dependencies = [
+    "fastapi>=0.115.6",
+    "uvicorn[standard]>=0.34.0",
+    "sqlalchemy[asyncio]>=2.0.36",
+    "asyncpg>=0.30.0",
+    "psycopg[binary]>=3.2.3",
+    "alembic>=1.14.0",
+    "pydantic>=2.10.4",
+    "pydantic-settings>=2.7.0",
+    "structlog>=24.4.0",
+    "argon2-cffi>=23.1.0",
+    "pyjwt>=2.10.1",
+    "cryptography>=44.0.0",
+    "httpx>=0.28.1",
+    "arq>=0.26.3",
+    "python-multipart>=0.0.20",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.3.4",
+    "pytest-asyncio>=0.25.0",
+    "pytest-cov>=6.0.0",
+    "ruff>=0.8.4",
+    "mypy>=1.14.0",
+]
+
+[build-system]
+requires = ["setuptools>=75"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+include = ["app*"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+exclude = ["alembic/versions"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "N", "UP", "B", "C4", "SIM", "RUF"]
+ignore = [
+    "E501",   # 行长由 formatter 决定
+    "RUF001", # 全角标点：本项目注释与文档有意使用中文，属误报
+    "RUF002",
+    "RUF003",
+]
+
+[tool.ruff.lint.isort]
+known-first-party = ["app"]
+
+[tool.mypy]
+python_version = "3.12"
+plugins = ["pydantic.mypy"]
+ignore_missing_imports = true
+warn_unused_ignores = true
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "session"
+testpaths = ["tests"]
+addopts = "-ra --strict-markers"
+filterwarnings = ["ignore::DeprecationWarning"]