@kernel-sig/console 0.1.0

package/backend/alembic/versions/e5b27c9d3a41_downgrade_cve_without_ids.py

@@ -0,0 +1,54 @@
+"""修正判为 CVE 却没有 CVE 编号的记录
+
+Revision ID: e5b27c9d3a41
+Revises: c8e4f2a71b93
+
+平台的不变式是「kind=cve 必须带得出发现在正文里的 CVE 编号」，规则层天然
+满足（它正是靠匹配编号才判 cve 的），但 AI 层不满足：提示词把 cve 定义为
+"修复安全漏洞（出现 CVE 编号）"，输出 schema 里却根本没有 cve_ids 字段，
+于是模型凭"这是安全修复"的印象判出的 cve 一律没有编号。实测到的两条一条是
+给 ioctl 加权限检查的加固，一条是漏洞影响评估。
+
+留着它们，版本汇总里对外报的「CVE 数」就混进了未编号的安全加固 —— 那是
+要拿去汇报的数字；而 `_upsert(preserve_ai=True)` 又刻意不覆盖 AI 行，
+所以规则每 10 分钟重算一次也不会把它们修回来。代码侧已经堵住新增
+（classification_service.normalize_ai_kind），这里处理存量。
+
+只改自动判定的记录。人工指定不在此列：那是维护者的显式判断，
+平台不该替他改，他也可能知道编号之外的实情。
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "e5b27c9d3a41"
+down_revision: str | None = "c8e4f2a71b93"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+NOTE = "模型判为安全修复但正文无 CVE 编号，按缺陷修复记录"
+
+
+def upgrade() -> None:
+    op.execute(
+        f"""
+        UPDATE ksp_classification
+           SET kind = 'bugfix',
+               reason = CASE
+                   WHEN reason IS NULL OR reason = '' THEN '{NOTE}'
+                   ELSE reason || '（{NOTE}）'
+               END
+         WHERE kind = 'cve'
+           AND source <> 'manual'
+           AND (cve_ids IS NULL OR cardinality(cve_ids) = 0)
+        """
+    )
+
+
+def downgrade() -> None:
+    # 无法回退：原来的 cve 取值本身是错的，改回 bugfix 的那些记录也没有
+    # 留下"它原先是 cve"的痕迹。要回退只能从备份恢复。
+    raise NotImplementedError(
+        "该迁移修正的是错误数据，无法仅凭记录本身还原；如需回退请从备份恢复。"
+    )

package/backend/alembic/versions/ee3159a4eff0_add_sig_meeting_member_and_release_.py

@@ -0,0 +1,164 @@
+"""add sig meeting member and release branch tables
+
+Revision ID: ee3159a4eff0
+Revises: b41c9d7e5f28
+Create Date: 2026-09-16 16:09:23.848007
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = 'ee3159a4eff0'
+down_revision: str | None = 'b41c9d7e5f28'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('ksp_meeting',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('held_on', sa.Date(), nullable=False),
+    sa.Column('start_time', sa.String(length=8), nullable=True),
+    sa.Column('title', sa.String(length=128), nullable=False),
+    sa.Column('host', sa.String(length=64), nullable=True),
+    sa.Column('next_host', sa.String(length=64), nullable=True),
+    sa.Column('host_order', postgresql.ARRAY(sa.String(length=64)), nullable=True),
+    sa.Column('meeting_url', sa.String(length=512), nullable=True),
+    sa.Column('minutes_url', sa.String(length=512), nullable=True),
+    sa.Column('status', sa.String(length=16), nullable=False),
+    sa.Column('legacy', sa.Text(), nullable=True),
+    sa.Column('source_url', sa.String(length=512), nullable=False),
+    sa.Column('source_hash', sa.String(length=64), nullable=True),
+    sa.Column('last_synced_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_meeting')),
+    sa.UniqueConstraint('held_on', name='uq_ksp_meeting_held_on')
+    )
+    op.create_index(op.f('ix_ksp_meeting_status'), 'ksp_meeting', ['status'], unique=False)
+    op.create_table('ksp_release_branch',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('name', sa.String(length=64), nullable=False),
+    sa.Column('aliases', postgresql.ARRAY(sa.Text()), nullable=True),
+    sa.Column('kind', sa.String(length=16), nullable=False),
+    sa.Column('series', sa.String(length=32), nullable=True),
+    sa.Column('sp', sa.Integer(), nullable=True),
+    sa.Column('upstream_base', sa.String(length=16), nullable=True),
+    sa.Column('state', sa.String(length=16), nullable=False),
+    sa.Column('note', sa.Text(), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_release_branch')),
+    sa.UniqueConstraint('name', name='uq_ksp_release_branch_name')
+    )
+    op.create_table('ksp_sig_member',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('name', sa.String(length=128), nullable=False),
+    sa.Column('atomgit_id', sa.String(length=128), nullable=True),
+    sa.Column('gitee_id', sa.String(length=128), nullable=True),
+    sa.Column('github_id', sa.String(length=128), nullable=True),
+    sa.Column('email', sa.String(length=255), nullable=True),
+    sa.Column('role', sa.String(length=16), nullable=False),
+    sa.Column('org', sa.String(length=128), nullable=True),
+    sa.Column('is_active', sa.Boolean(), nullable=False),
+    sa.Column('source', sa.String(length=24), nullable=False),
+    sa.Column('source_url', sa.String(length=512), nullable=True),
+    sa.Column('last_synced_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_sig_member'))
+    )
+    op.create_index('ix_ksp_sig_member_atomgit', 'ksp_sig_member', ['atomgit_id'], unique=False)
+    op.create_index('ix_ksp_sig_member_email', 'ksp_sig_member', ['email'], unique=False)
+    op.create_index('ix_ksp_sig_member_role', 'ksp_sig_member', ['role'], unique=False)
+    op.create_table('ksp_subsystem_owner',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('module', sa.String(length=64), nullable=False),
+    sa.Column('section', sa.String(length=64), nullable=True),
+    sa.Column('paths', postgresql.ARRAY(sa.Text()), nullable=True),
+    sa.Column('committer_logins', postgresql.ARRAY(sa.Text()), nullable=True),
+    sa.Column('sequence', sa.Integer(), nullable=False),
+    sa.Column('source_url', sa.String(length=512), nullable=True),
+    sa.Column('last_synced_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_subsystem_owner')),
+    sa.UniqueConstraint('section', 'module', name='uq_ksp_subsystem_owner_section_module')
+    )
+    op.create_index('ix_ksp_subsystem_owner_paths', 'ksp_subsystem_owner', ['paths'], unique=False, postgresql_using='gin')
+    op.create_table('ksp_meeting_agenda',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('meeting_id', sa.UUID(), nullable=False),
+    sa.Column('sequence', sa.Integer(), nullable=False),
+    sa.Column('num', sa.String(length=8), nullable=True),
+    sa.Column('title', sa.Text(), nullable=False),
+    sa.Column('owner', sa.String(length=64), nullable=True),
+    sa.Column('body', sa.Text(), nullable=True),
+    sa.Column('pull_numbers', postgresql.ARRAY(sa.Integer()), nullable=True),
+    sa.Column('issue_numbers', postgresql.ARRAY(sa.Integer()), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.ForeignKeyConstraint(['meeting_id'], ['ksp_meeting.id'], name=op.f('fk_ksp_meeting_agenda_meeting_id_ksp_meeting'), ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_meeting_agenda')),
+    sa.UniqueConstraint('meeting_id', 'sequence', name='uq_ksp_meeting_agenda_seq')
+    )
+    op.create_index('ix_ksp_meeting_agenda_owner', 'ksp_meeting_agenda', ['owner'], unique=False)
+    op.create_table('ksp_release_report',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('meeting_id', sa.UUID(), nullable=False),
+    sa.Column('branch', sa.String(length=64), nullable=False),
+    sa.Column('from_tag', sa.String(length=32), nullable=True),
+    sa.Column('to_tag', sa.String(length=32), nullable=True),
+    sa.Column('patch_count', sa.Integer(), nullable=True),
+    sa.Column('listed_count', sa.Integer(), nullable=False),
+    sa.Column('iso_urls', postgresql.ARRAY(sa.String(length=512)), nullable=True),
+    sa.Column('cve_ids', postgresql.ARRAY(sa.String(length=32)), nullable=True),
+    sa.Column('groups', postgresql.JSONB(astext_type=sa.Text()), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.ForeignKeyConstraint(['meeting_id'], ['ksp_meeting.id'], name=op.f('fk_ksp_release_report_meeting_id_ksp_meeting'), ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_release_report')),
+    sa.UniqueConstraint('meeting_id', 'branch', name='uq_ksp_release_report_branch')
+    )
+    op.create_index('ix_ksp_release_report_branch', 'ksp_release_report', ['branch'], unique=False)
+    op.create_table('ksp_release_report_patch',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('report_id', sa.UUID(), nullable=False),
+    sa.Column('sequence', sa.Integer(), nullable=False),
+    sa.Column('group_name', sa.String(length=64), nullable=True),
+    sa.Column('title', sa.Text(), nullable=False),
+    sa.Column('pull_number', sa.Integer(), nullable=True),
+    sa.Column('url', sa.String(length=512), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.ForeignKeyConstraint(['report_id'], ['ksp_release_report.id'], name=op.f('fk_ksp_release_report_patch_report_id_ksp_release_report'), ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_release_report_patch'))
+    )
+    op.create_index('ix_ksp_release_report_patch_pull', 'ksp_release_report_patch', ['pull_number'], unique=False)
+    op.create_index('ix_ksp_release_report_patch_report', 'ksp_release_report_patch', ['report_id', 'sequence'], unique=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_index('ix_ksp_release_report_patch_report', table_name='ksp_release_report_patch')
+    op.drop_index('ix_ksp_release_report_patch_pull', table_name='ksp_release_report_patch')
+    op.drop_table('ksp_release_report_patch')
+    op.drop_index('ix_ksp_release_report_branch', table_name='ksp_release_report')
+    op.drop_table('ksp_release_report')
+    op.drop_index('ix_ksp_meeting_agenda_owner', table_name='ksp_meeting_agenda')
+    op.drop_table('ksp_meeting_agenda')
+    op.drop_index('ix_ksp_subsystem_owner_paths', table_name='ksp_subsystem_owner', postgresql_using='gin')
+    op.drop_table('ksp_subsystem_owner')
+    op.drop_index('ix_ksp_sig_member_role', table_name='ksp_sig_member')
+    op.drop_index('ix_ksp_sig_member_email', table_name='ksp_sig_member')
+    op.drop_index('ix_ksp_sig_member_atomgit', table_name='ksp_sig_member')
+    op.drop_table('ksp_sig_member')
+    op.drop_table('ksp_release_branch')
+    op.drop_index(op.f('ix_ksp_meeting_status'), table_name='ksp_meeting')
+    op.drop_table('ksp_meeting')
+    # ### end Alembic commands ###

package/backend/alembic/versions/fcf3c186d63b_attention_rule_subscriptions.py

@@ -0,0 +1,42 @@
+"""attention rule subscriptions
+
+Revision ID: fcf3c186d63b
+Revises: 4f8342e727fe
+Create Date: 2026-09-16 17:28:49.340034
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = 'fcf3c186d63b'
+down_revision: str | None = '4f8342e727fe'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('ksp_attention_rule_setting',
+    sa.Column('id', sa.UUID(), nullable=False),
+    sa.Column('rule', sa.String(length=32), nullable=False),
+    sa.Column('enabled', sa.Boolean(), nullable=False),
+    sa.Column('days', sa.Integer(), nullable=True),
+    sa.Column('subject_scope', sa.String(length=16), nullable=False),
+    sa.Column('note', sa.Text(), nullable=True),
+    sa.Column('updated_by', sa.UUID(), nullable=True),
+    sa.Column('effective_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_ksp_attention_rule_setting')),
+    sa.UniqueConstraint('rule', name='uq_ksp_attention_rule_setting_rule')
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_table('ksp_attention_rule_setting')
+    # ### end Alembic commands ###

package/backend/alembic.ini

@@ -0,0 +1,40 @@
+[alembic]
+script_location = alembic
+prepend_sys_path = .
+version_path_separator = os
+# sqlalchemy.url 有意不在此配置：改由 env.py 从应用 Settings 读取，
+# 避免数据库密码进入版本控制。
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

package/backend/app/api/deps.py

@@ -0,0 +1,74 @@
+"""FastAPI 依赖注入。"""
+
+from typing import Annotated
+
+from fastapi import Depends, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import Settings, get_settings
+from app.core.db import get_db_session
+from app.core.exceptions import ForbiddenError, UnauthorizedError
+from app.core.permissions import Permission, Role, role_has_permission
+from app.models.user import User
+from app.services import auth_service
+
+ACCESS_COOKIE = "ksc_access"
+REFRESH_COOKIE = "ksc_refresh"
+
+
+def get_app_settings() -> Settings:
+    return get_settings()
+
+
+async def get_current_user(
+    request: Request,
+    session: Annotated[AsyncSession, Depends(get_db_session)],
+    settings: Annotated[Settings, Depends(get_app_settings)],
+) -> User:
+    token = request.cookies.get(ACCESS_COOKIE)
+    if not token:
+        raise UnauthorizedError("未登录")
+    user = await auth_service.resolve_token(session, token, settings)
+
+    # 审计中间件在请求处理完成、数据库会话关闭之后才写日志，
+    # 此时 ORM 实例已 Detached，读属性会触发惰性加载而报错。
+    # 因此这里把归属信息以原始值形式存入 state，供中间件安全读取。
+    request.state.actor_user_id = user.id
+    request.state.actor_username = user.username
+    request.state.user = user
+    return user
+
+
+CurrentUserDep = Annotated[User, Depends(get_current_user)]
+SessionDep = Annotated[AsyncSession, Depends(get_db_session)]
+SettingsDep = Annotated[Settings, Depends(get_app_settings)]
+
+
+def require_permission(permission: Permission):
+    """生成一个校验指定权限的依赖。"""
+
+    async def _checker(user: CurrentUserDep) -> User:
+        if not role_has_permission(user.role, permission):
+            raise ForbiddenError(
+                f"需要 {permission.value} 权限",
+                required_permission=permission.value,
+                current_role=user.role.name,
+            )
+        return user
+
+    return _checker
+
+
+def require_role(minimum: Role):
+    """生成一个校验最低角色等级的依赖（利用 Role 的 IntEnum 层级）。"""
+
+    async def _checker(user: CurrentUserDep) -> User:
+        if user.role < minimum:
+            raise ForbiddenError(
+                f"需要 {minimum.label} 及以上权限",
+                required_role=minimum.name,
+                current_role=user.role.name,
+            )
+        return user
+
+    return _checker