cancan-microstack 0.0.1__py3-none-any.whl

cancan_microstack/services/opsbffsrv/application/auth_app.py

@@ -0,0 +1,285 @@
+"""认证用例编排 / Authentication application service (use case orchestration)."""
+import http
+from dataclasses import dataclass
+from typing import Optional
+
+from pydantic import BaseModel
+
+from linglong_web import LinglongConfig
+from linglong_web.utils import logger
+
+from cancan_microstack.public.const.opsbffsrv_error import OpsbffsrvAuthErrorCode
+from cancan_microstack.public.error import HTTPException
+from cancan_microstack.services.opsbffsrv.domain.auth import auth_domain
+from cancan_microstack.services.opsbffsrv.infrastructure.auth import (
+    captcha_service,
+    redis_store,
+    totp_service,
+)
+from cancan_microstack.services.opsbffsrv.infrastructure.db.operate.admin_user_operate import (
+    get_admin_user_by_id,
+    mark_totp_bound,
+    update_totp_secret,
+)
+
+
+# ── Request / Response schemas ───────────────────────────────────────────────
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+    captcha_id: str
+    captcha_answer: str
+
+
+class LoginResponse(BaseModel):
+    next_step: str  # "totp_bind" | "totp_verify"
+    temp_token: str
+
+
+class CaptchaResponse(BaseModel):
+    captcha_id: str
+    image_base64: str
+
+
+class TotpSetupResponse(BaseModel):
+    otpauth_uri: str
+    qr_code_base64: str
+
+
+class TempTokenRequest(BaseModel):
+    temp_token: str
+
+
+class TotpCodeRequest(BaseModel):
+    temp_token: str
+    totp_code: str
+
+
+class SessionResponse(BaseModel):
+    authenticated: bool
+    username: str
+
+
+# ── Application methods ──────────────────────────────────────────────────────
+
+async def _enforce_totp_attempt_limit(temp_token: str) -> None:
+    """TOTP 暴力破解防护：超过上限则失效 temp_token 并拒绝。
+
+    Guard against TOTP brute force: once the per-temp_token failure count
+    reaches the configured cap, invalidate the temp_token and reject the request.
+    Call this BEFORE verifying the TOTP code on each attempt.
+    """
+    max_failures = int(getattr(LinglongConfig, "AUTH_TOTP_MAX_FAILURES", 5))
+    fail_count = await redis_store.get_totp_fail_count(temp_token)
+    if fail_count >= max_failures:
+        # 失效 token，强制用户重新走密码登录流程
+        await redis_store.delete_temp_token(temp_token)
+        await redis_store.reset_totp_fail(temp_token)
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="Too many invalid TOTP attempts; please log in again",
+        )
+
+
+async def _record_totp_failure(temp_token: str) -> None:
+    """记录一次 TOTP 失败 / Record one TOTP failure for a temp token."""
+    temp_ttl = int(getattr(LinglongConfig, "AUTH_TEMP_TOKEN_TTL", 300))
+    await redis_store.increment_totp_fail(temp_token, ttl=temp_ttl)
+
+
+async def get_captcha() -> CaptchaResponse:
+    """生成并存储验证码 / Generate captcha and save to Redis."""
+    captcha_id, answer, image_base64 = captcha_service.generate_captcha()
+    captcha_ttl = int(LinglongConfig.get("AUTH_CAPTCHA_TTL", 60))
+    await redis_store.save_captcha(captcha_id, answer, ttl=captcha_ttl)
+    return CaptchaResponse(captcha_id=captcha_id, image_base64=image_base64)
+
+
+async def login(req: LoginRequest, client_ip: str) -> LoginResponse:
+    """登录入口 / Login: validate captcha → authenticate → return next step."""
+    # 1. 校验验证码
+    if not await auth_domain.validate_captcha(req.captcha_id, req.captcha_answer):
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.CAPTCHA_INVALID,
+            msg="Invalid captcha",
+        )
+
+    # 2. 认证
+    result = await auth_domain.authenticate(req.username, req.password, client_ip)
+    if not result.success:
+        status = (
+            http.HTTPStatus.FORBIDDEN.value
+            if result.error_code == "AUTH_IP_LOCKED"
+            else http.HTTPStatus.UNAUTHORIZED.value
+        )
+        code = {
+            "AUTH_IP_LOCKED": OpsbffsrvAuthErrorCode.IP_LOCKED,
+            "AUTH_CREDENTIALS_INVALID": OpsbffsrvAuthErrorCode.CREDENTIALS_INVALID,
+        }.get(result.error_code, OpsbffsrvAuthErrorCode.INTERNAL_ERROR)
+        raise HTTPException(status_code=status, error_code=code, msg=result.error_msg)
+
+    # 3. 返回下一步
+    next_step = "totp_bind" if not result.totp_bound else "totp_verify"
+    return LoginResponse(next_step=next_step, temp_token=result.temp_token)
+
+
+async def totp_setup(temp_token: str) -> TotpSetupResponse:
+    """获取 TOTP 绑定信息 / Get TOTP provisioning URI and QR code."""
+    user_id = await redis_store.get_temp_token(temp_token)
+    if user_id is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="Temp token invalid or expired",
+        )
+
+    user = await get_admin_user_by_id(user_id)
+    if user is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="User not found",
+        )
+
+    # 如果已有加密 secret 则解密复用，否则生成新的
+    if user.totp_secret_encrypted:
+        secret = totp_service.decrypt_secret(user.totp_secret_encrypted)
+    else:
+        secret = totp_service.generate_secret()
+        encrypted = totp_service.encrypt_secret(secret)
+        await update_totp_secret(user.id, encrypted)
+
+    uri = totp_service.get_provisioning_uri(secret, user.username)
+    qr_base64 = totp_service.generate_qr_base64(uri)
+
+    return TotpSetupResponse(otpauth_uri=uri, qr_code_base64=qr_base64)
+
+
+async def totp_bind(temp_token: str, totp_code: str) -> Optional[str]:
+    """完成 TOTP 绑定 / Bind TOTP: verify code → mark bound → create session.
+
+    Returns:
+        session token string on success.
+    """
+    user_id = await redis_store.get_temp_token(temp_token)
+    if user_id is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="Temp token invalid or expired",
+        )
+
+    # 暴力破解防护：超过上限直接失效 token
+    await _enforce_totp_attempt_limit(temp_token)
+
+    user = await get_admin_user_by_id(user_id)
+    if user is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="User not found",
+        )
+
+    if user.totp_bound:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.TOTP_ALREADY_BOUND,
+            msg="TOTP already bound",
+        )
+
+    if not user.totp_secret_encrypted:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.TOTP_INVALID,
+            msg="TOTP has not been set up",
+        )
+
+    secret = totp_service.decrypt_secret(user.totp_secret_encrypted)
+    if not totp_service.verify_totp(secret, totp_code):
+        await _record_totp_failure(temp_token)
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.TOTP_INVALID,
+            msg="Invalid TOTP code",
+        )
+
+    # 绑定成功
+    await mark_totp_bound(user.id)
+    await redis_store.delete_temp_token(temp_token)
+    await redis_store.reset_totp_fail(temp_token)
+    session_token = await auth_domain.create_session_token(user.id)
+    return session_token
+
+
+async def totp_verify(temp_token: str, totp_code: str) -> Optional[str]:
+    """常规 TOTP 验证 / Verify TOTP for regular login.
+
+    Returns:
+        session token string on success.
+    """
+    user_id = await redis_store.get_temp_token(temp_token)
+    if user_id is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="Temp token invalid or expired",
+        )
+
+    # 暴力破解防护：超过上限直接失效 token
+    await _enforce_totp_attempt_limit(temp_token)
+
+    user = await get_admin_user_by_id(user_id)
+    if user is None:
+        raise HTTPException(
+            status_code=http.HTTPStatus.UNAUTHORIZED.value,
+            error_code=OpsbffsrvAuthErrorCode.TEMP_TOKEN_INVALID,
+            msg="User not found",
+        )
+
+    if not user.totp_secret_encrypted:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.TOTP_INVALID,
+            msg="TOTP not configured",
+        )
+
+    secret = totp_service.decrypt_secret(user.totp_secret_encrypted)
+    if not totp_service.verify_totp(secret, totp_code):
+        await _record_totp_failure(temp_token)
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            error_code=OpsbffsrvAuthErrorCode.TOTP_INVALID,
+            msg="Invalid TOTP code",
+        )
+
+    # 验证成功
+    await redis_store.delete_temp_token(temp_token)
+    await redis_store.reset_totp_fail(temp_token)
+    session_token = await auth_domain.create_session_token(user.id)
+    return session_token
+
+
+async def logout(token: Optional[str]) -> None:
+    """登出 / Logout: revoke the session token in Redis (idempotent)."""
+    if token:
+        await auth_domain.revoke_session(token)
+
+
+async def check_session(token: str) -> Optional[SessionResponse]:
+    """检查 session 有效性 / Check if session token is valid.
+
+    Returns:
+        SessionResponse if valid, None if invalid.
+    """
+    user_id = await auth_domain.verify_session(token)
+    if user_id is None:
+        return None
+
+    user = await get_admin_user_by_id(user_id)
+    if user is None:
+        return None
+
+    return SessionResponse(authenticated=True, username=user.username)

cancan_microstack/services/opsbffsrv/application/caddy/access_log_analysis_app.py

@@ -0,0 +1,344 @@
+"""
+Caddy 访问日志应用服务
+协调访问日志接收、查询和分析的业务流程
+"""
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+)
+from datetime import datetime
+from linglong_web.utils import logger
+from cancan_microstack.public.schemas.caddy import CaddyAccessLog, AccessLogQuery
+from cancan_microstack.services.opsbffsrv.domain.caddy.access_log_analysis import AccessLogAnalysisDomain
+
+
+class AccessLogAnalysisApp:
+    """访问日志应用服务"""
+
+    def __init__(self):
+        self.domain = AccessLogAnalysisDomain()
+
+    async def ingest_single_log(self, log_data: Dict[str, Any]) -> Dict[str, Any]:
+        """
+        接收单条访问日志
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            结果字典
+        """
+        logger.debug("Ingesting single access log")
+
+        try:
+            log_entry = await self.domain.ingest_log_entry(log_data)
+
+            return {
+                "status": "success",
+                "log": log_entry
+            }
+        except ValueError as e:
+            logger.warning(f"Log ingestion failed: {e}")
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+        except Exception as e:
+            logger.error(f"Error ingesting log: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": "Internal server error"
+            }
+
+    async def ingest_batch_logs(self, log_lines: List[str]) -> Dict[str, Any]:
+        """
+        批量接收访问日志
+        
+        Args:
+            log_lines: JSON 格式的日志行列表
+            
+        Returns:
+            结果字典
+        """
+        logger.info(f"Ingesting batch of {len(log_lines)} logs")
+
+        try:
+            ingested_count = await self.domain.ingest_log_batch(log_lines)
+
+            return {
+                "status": "success",
+                "message": f"Successfully ingested {ingested_count} logs",
+                "count": ingested_count
+            }
+        except Exception as e:
+            logger.error(f"Error ingesting batch logs: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def search_logs(self, query: AccessLogQuery) -> List[CaddyAccessLog]:
+        """
+        搜索访问日志
+        
+        Args:
+            query: 查询参数
+            
+        Returns:
+            访问日志列表
+        """
+        logger.info("Searching access logs")
+
+        try:
+            return await self.domain.search_logs(query)
+        except ValueError as e:
+            logger.warning(f"Invalid query parameters: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Error searching logs: {e}", exc_info=True)
+            return []
+
+    async def get_log_details(self, log_id: int) -> Optional[CaddyAccessLog]:
+        """
+        获取访问日志详情
+        
+        Args:
+            log_id: 日志 ID
+            
+        Returns:
+            访问日志对象或 None
+        """
+        return await self.domain.get_log_details(log_id)
+
+    async def get_log_by_request_id(self, request_id: str) -> Optional[CaddyAccessLog]:
+        """
+        根据请求 ID 获取访问日志
+        
+        Args:
+            request_id: 请求 ID
+            
+        Returns:
+            访问日志对象或 None
+        """
+        return await self.domain.get_log_by_request_id(request_id)
+
+    async def get_logs_for_ip(self, client_ip: str, limit: int = 100) -> List[CaddyAccessLog]:
+        """
+        获取指定 IP 的访问日志
+        
+        Args:
+            client_ip: 客户端 IP
+            limit: 返回数量限制
+            
+        Returns:
+            访问日志列表
+        """
+        return await self.domain.get_logs_for_ip(client_ip, limit)
+
+    async def get_logs_for_service(self, service: str, limit: int = 100) -> List[CaddyAccessLog]:
+        """
+        获取指定服务的访问日志
+        
+        Args:
+            service: 服务名称
+            limit: 返回数量限制
+            
+        Returns:
+            访问日志列表
+        """
+        return await self.domain.get_logs_for_service(service, limit)
+
+    async def get_security_events(self, event_type: str = 'waf_blocked', limit: int = 100) -> Dict[str, Any]:
+        """
+        获取安全事件日志
+        
+        Args:
+            event_type: 事件类型（waf_blocked/rate_limited）
+            limit: 返回数量限制
+            
+        Returns:
+            安全事件数据
+        """
+        logger.info(f"Fetching security events: {event_type}")
+
+        try:
+            events = await self.domain.get_security_events(event_type, limit)
+
+            return {
+                "status": "success",
+                "event_type": event_type,
+                "count": len(events),
+                "data": events
+            }
+        except ValueError as e:
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+        except Exception as e:
+            logger.error(f"Error fetching security events: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def analyze_geographic_distribution(
+            self,
+            start_time: Optional[datetime] = None,
+            end_time: Optional[datetime] = None
+    ) -> Dict[str, Any]:
+        """
+        分析访问的地理分布
+        
+        Args:
+            start_time: 开始时间
+            end_time: 结束时间
+            
+        Returns:
+            地理分布数据
+        """
+        logger.info("Analyzing geographic distribution")
+
+        try:
+            distribution = await self.domain.analyze_geographic_distribution(start_time, end_time)
+
+            return {
+                "status": "success",
+                "data": distribution
+            }
+        except Exception as e:
+            logger.error(f"Error analyzing geographic distribution: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def analyze_status_code_distribution(
+            self,
+            start_time: Optional[datetime] = None,
+            end_time: Optional[datetime] = None
+    ) -> Dict[str, Any]:
+        """
+        分析 HTTP 状态码分布
+        
+        Args:
+            start_time: 开始时间
+            end_time: 结束时间
+            
+        Returns:
+            状态码分布数据
+        """
+        logger.info("Analyzing status code distribution")
+
+        try:
+            distribution = await self.domain.analyze_status_code_distribution(start_time, end_time)
+
+            return {
+                "status": "success",
+                "data": distribution
+            }
+        except Exception as e:
+            logger.error(f"Error analyzing status code distribution: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def detect_suspicious_ips(
+            self,
+            time_window: int = 60,
+            request_threshold: int = 1000
+    ) -> Dict[str, Any]:
+        """
+        检测可疑 IP（高频访问）
+        
+        Args:
+            time_window: 时间窗口（分钟）
+            request_threshold: 请求数阈值
+            
+        Returns:
+            可疑 IP 数据
+        """
+        logger.info(f"Detecting suspicious IPs: window={time_window}min, threshold={request_threshold}")
+
+        try:
+            suspicious_ips = await self.domain.detect_suspicious_ips(time_window, request_threshold)
+
+            return {
+                "status": "success",
+                "count": len(suspicious_ips),
+                "data": suspicious_ips
+            }
+        except Exception as e:
+            logger.error(f"Error detecting suspicious IPs: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def analyze_error_patterns(self, hours: int = 24) -> Dict[str, Any]:
+        """
+        分析错误模式
+        
+        Args:
+            hours: 过去多少小时
+            
+        Returns:
+            错误分析结果
+        """
+        logger.info(f"Analyzing error patterns for the past {hours} hours")
+
+        try:
+            error_analysis = await self.domain.analyze_error_patterns(hours)
+
+            # domain 返回 ErrorPatternAnalysis (pydantic)，需先 model_dump 才能展开
+            return {
+                "status": "success",
+                **error_analysis.model_dump()
+            }
+        except Exception as e:
+            logger.error(f"Error analyzing error patterns: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def cleanup_old_logs(self, days: int = 30) -> Dict[str, Any]:
+        """
+        清理旧的访问日志
+        
+        Args:
+            days: 保留天数
+            
+        Returns:
+            清理结果
+        """
+        logger.info(f"Cleaning up logs older than {days} days")
+
+        try:
+            deleted_count = await self.domain.cleanup_old_logs(days)
+
+            return {
+                "status": "success",
+                "message": f"Deleted {deleted_count} old access log records"
+            }
+        except Exception as e:
+            logger.error(f"Error cleaning up logs: {e}", exc_info=True)
+            return {
+                "status": "error",
+                "error": str(e)
+            }
+
+    async def get_log_count(self, filters: Optional[Dict[str, Any]] = None) -> int:
+        """
+        获取日志数量
+        
+        Args:
+            filters: 过滤条件
+            
+        Returns:
+            日志数量
+        """
+        return await self.domain.get_log_count(filters)