cancan-microstack 0.0.1__py3-none-any.whl

cancan_microstack/services/opsbffsrv/infrastructure/auth/redis_store.py

@@ -0,0 +1,131 @@
+"""Redis session / 限频 / 验证码存储 / Redis store for auth data."""
+from typing import Optional
+
+import redis.asyncio as aioredis
+
+from linglong_web import LinglongConfig
+
+_redis: Optional[aioredis.Redis] = None
+
+_KEY_PREFIX = "ops"
+
+
+async def _get_redis() -> aioredis.Redis:
+    """懒初始化 Redis 连接 / Lazy-initialize async Redis connection."""
+    global _redis
+    if _redis is None:
+        host = LinglongConfig.get("AUTH_REDIS_URL", "redis://redis.service:6379/0")
+        _redis = aioredis.from_url(host, decode_responses=True)
+    return _redis
+
+
+# ── Captcha ──────────────────────────────────────────────────────────────────
+
+async def save_captcha(captcha_id: str, answer: str, ttl: int = 60) -> None:
+    """存储验证码答案 / Save captcha answer to Redis."""
+    r = await _get_redis()
+    await r.setex(f"{_KEY_PREFIX}:captcha:{captcha_id}", ttl, answer.upper())
+
+
+async def get_and_delete_captcha(captcha_id: str) -> Optional[str]:
+    """获取并删除验证码（一次性消费）/ Get and delete captcha answer atomically."""
+    r = await _get_redis()
+    key = f"{_KEY_PREFIX}:captcha:{captcha_id}"
+    answer = await r.get(key)
+    if answer is not None:
+        await r.delete(key)
+    return answer
+
+
+# ── Session ──────────────────────────────────────────────────────────────────
+
+async def save_session(token: str, user_id: int, ttl: int = 86400) -> None:
+    """存储 session token / Save session token to Redis."""
+    r = await _get_redis()
+    await r.setex(f"{_KEY_PREFIX}:session:{token}", ttl, str(user_id))
+
+
+async def get_session(token: str) -> Optional[int]:
+    """获取 session 对应的 user_id / Get user_id from session token."""
+    r = await _get_redis()
+    val = await r.get(f"{_KEY_PREFIX}:session:{token}")
+    return int(val) if val is not None else None
+
+
+async def delete_session(token: str) -> None:
+    """删除 session token / Delete (revoke) a session token."""
+    r = await _get_redis()
+    await r.delete(f"{_KEY_PREFIX}:session:{token}")
+
+
+# ── Temp Token ───────────────────────────────────────────────────────────────
+
+async def save_temp_token(token: str, user_id: int, ttl: int = 300) -> None:
+    """存储临时 token / Save temp token for TOTP flow."""
+    r = await _get_redis()
+    await r.setex(f"{_KEY_PREFIX}:temp_token:{token}", ttl, str(user_id))
+
+
+async def get_temp_token(token: str) -> Optional[int]:
+    """获取临时 token 对应的 user_id / Get user_id from temp token."""
+    r = await _get_redis()
+    val = await r.get(f"{_KEY_PREFIX}:temp_token:{token}")
+    return int(val) if val is not None else None
+
+
+async def delete_temp_token(token: str) -> None:
+    """删除临时 token / Delete temp token."""
+    r = await _get_redis()
+    await r.delete(f"{_KEY_PREFIX}:temp_token:{token}")
+
+
+# ── IP Rate Limit ────────────────────────────────────────────────────────────
+
+async def get_ip_fail_count(ip: str) -> int:
+    """获取 IP 失败次数 / Get login failure count for an IP."""
+    r = await _get_redis()
+    val = await r.get(f"{_KEY_PREFIX}:rate_limit:ip:{ip}")
+    return int(val) if val is not None else 0
+
+
+async def increment_ip_fail(ip: str, ttl: int = 1800) -> int:
+    """递增 IP 失败计数 / Increment IP failure count with TTL."""
+    r = await _get_redis()
+    key = f"{_KEY_PREFIX}:rate_limit:ip:{ip}"
+    count = await r.incr(key)
+    await r.expire(key, ttl)
+    return count
+
+
+async def reset_ip_fail(ip: str) -> None:
+    """重置 IP 失败计数 / Reset IP failure count."""
+    r = await _get_redis()
+    await r.delete(f"{_KEY_PREFIX}:rate_limit:ip:{ip}")
+
+
+# ── TOTP Failure Count (per temp_token) ───────────────────────────────────────
+
+async def get_totp_fail_count(temp_token: str) -> int:
+    """获取 temp_token 的 TOTP 失败次数 / Get TOTP failure count for a temp token."""
+    r = await _get_redis()
+    val = await r.get(f"{_KEY_PREFIX}:totp_fail:{temp_token}")
+    return int(val) if val is not None else 0
+
+
+async def increment_totp_fail(temp_token: str, ttl: int = 300) -> int:
+    """递增 TOTP 失败计数 / Increment TOTP failure count with TTL.
+
+    TTL 跟随 temp_token 生命周期，避免计数长期残留。
+    TTL follows the temp_token lifetime so the counter does not linger.
+    """
+    r = await _get_redis()
+    key = f"{_KEY_PREFIX}:totp_fail:{temp_token}"
+    count = await r.incr(key)
+    await r.expire(key, ttl)
+    return count
+
+
+async def reset_totp_fail(temp_token: str) -> None:
+    """重置 TOTP 失败计数 / Reset TOTP failure count for a temp token."""
+    r = await _get_redis()
+    await r.delete(f"{_KEY_PREFIX}:totp_fail:{temp_token}")

cancan_microstack/services/opsbffsrv/infrastructure/auth/totp_service.py

@@ -0,0 +1,59 @@
+"""TOTP 封装 / TOTP service wrapping pyotp + Fernet encryption."""
+import base64
+import io
+
+import pyotp
+import qrcode
+from cryptography.fernet import Fernet
+
+from linglong_web import LinglongConfig
+
+
+def _get_fernet() -> Fernet:
+    """获取 Fernet 实例 / Get Fernet instance from config."""
+    key = LinglongConfig.get("AUTH_TOTP_FERNET_KEY")
+    if not key:
+        raise RuntimeError("AUTH_TOTP_FERNET_KEY is not configured")
+    return Fernet(key.encode("utf-8") if isinstance(key, str) else key)
+
+
+def generate_secret() -> str:
+    """生成 TOTP base32 secret / Generate a random TOTP base32 secret."""
+    return pyotp.random_base32()
+
+
+def encrypt_secret(secret: str) -> str:
+    """Fernet 加密 TOTP secret / Encrypt TOTP secret with Fernet."""
+    f = _get_fernet()
+    return f.encrypt(secret.encode("utf-8")).decode("utf-8")
+
+
+def decrypt_secret(encrypted: str) -> str:
+    """Fernet 解密 TOTP secret / Decrypt TOTP secret with Fernet."""
+    f = _get_fernet()
+    return f.decrypt(encrypted.encode("utf-8")).decode("utf-8")
+
+
+def verify_totp(secret: str, code: str) -> bool:
+    """验证 TOTP 码 / Verify a TOTP code against secret (±30s window)."""
+    totp = pyotp.TOTP(secret)
+    return totp.verify(code, valid_window=1)
+
+
+def get_provisioning_uri(secret: str, username: str) -> str:
+    """生成 otpauth URI / Generate provisioning URI for authenticator apps."""
+    issuer = LinglongConfig.get("AUTH_TOTP_ISSUER", "OPS Admin")
+    totp = pyotp.TOTP(secret)
+    return totp.provisioning_uri(name=username, issuer_name=issuer)
+
+
+def generate_qr_base64(uri: str) -> str:
+    """生成 QR 二维码 base64 / Generate QR code as data URI base64 PNG."""
+    qr = qrcode.QRCode(version=1, box_size=6, border=2)
+    qr.add_data(uri)
+    qr.make(fit=True)
+    img = qr.make_image(fill_color="black", back_color="white")
+    buf = io.BytesIO()
+    img.save(buf, format="PNG")
+    b64 = base64.b64encode(buf.getvalue()).decode("utf-8")
+    return f"data:image/png;base64,{b64}"

cancan_microstack/services/opsbffsrv/infrastructure/caddy/access_log_parser.py

@@ -0,0 +1,307 @@
+"""
+Caddy 访问日志解析器
+解析 Caddy JSON 格式的访问日志并提取关键信息
+"""
+from typing import (
+    Any,
+    Dict,
+    Optional,
+)
+import json
+from datetime import datetime, timezone
+from nanoid import generate
+from linglong_web.utils import logger
+from cancan_microstack.public.schemas.caddy import CaddyAccessLog
+from cancan_microstack.services.opsbffsrv.infrastructure.caddy.ip_geo_locator import ip_geo_locator
+
+
+class AccessLogParser:
+    """访问日志解析器"""
+
+    @staticmethod
+    def parse_json_log(log_line: str) -> Optional[CaddyAccessLog]:
+        """
+        解析 JSON 格式的访问日志行
+        
+        Args:
+            log_line: JSON 格式的日志行
+            
+        Returns:
+            访问日志对象或 None
+        """
+        try:
+            log_data = json.loads(log_line)
+            return AccessLogParser._build_access_log(log_data)
+        except json.JSONDecodeError as e:
+            logger.error(f"Failed to parse JSON log: {e}", exc_info=True)
+            return None
+        except Exception as e:
+            logger.error(f"Error parsing access log: {e}", exc_info=True)
+            return None
+
+    @staticmethod
+    def parse_dict_log(log_data: Dict[str, Any]) -> Optional[CaddyAccessLog]:
+        """
+        解析字典格式的访问日志
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            访问日志对象或 None
+        """
+        try:
+            return AccessLogParser._build_access_log(log_data)
+        except Exception as e:
+            logger.error(f"Error parsing access log dict: {e}", exc_info=True)
+            return None
+
+    @staticmethod
+    def _build_access_log(log_data: Dict[str, Any]) -> CaddyAccessLog:
+        """
+        从日志数据构建 CaddyAccessLog 对象
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            访问日志对象
+        """
+        # 提取基础信息
+        request = log_data.get("request", {})
+        response = log_data.get("resp_headers", {})
+
+        # 提取客户端 IP（处理代理情况）
+        client_ip = AccessLogParser._extract_client_ip(log_data)
+
+        # 提取请求 ID（优先使用 X-Linglong-Reqid，其次 X-Request-Id）
+        # Extract request ID preferring X-Linglong-Reqid, then X-Request-Id
+        request_id = (
+            log_data.get("request_id")
+            or response.get("X-Linglong-Reqid", [None])[0]
+            or response.get("X-Request-Id", [None])[0]
+            or generate()
+        )
+
+        # 提取时间戳
+        timestamp_str = log_data.get("ts") or log_data.get("timestamp")
+        timestamp = AccessLogParser._parse_timestamp(timestamp_str)
+
+        # 提取路径和查询字符串
+        uri = request.get("uri", "")
+        path, query_string = AccessLogParser._split_uri(uri)
+
+        # 获取 IP 地理位置信息
+        geo_info = ip_geo_locator.lookup(client_ip) if client_ip else {}
+
+        # 提取 WAF 信息
+        waf_action = log_data.get("waf_action")
+        waf_rule_id = log_data.get("waf_rule_id")
+        waf_score = log_data.get("waf_score")
+
+        # 提取限流信息
+        rate_limited = log_data.get("rate_limited", False)
+        rate_limit_rule = log_data.get("rate_limit_rule")
+
+        # 提取上游信息
+        upstream_info = log_data.get("upstream", {})
+
+        # 提取 TLS 信息
+        tls_info = request.get("tls", {})
+
+        # 构建访问日志对象
+        return CaddyAccessLog(
+            request_id=request_id,
+            timestamp=timestamp,
+            client_ip=client_ip,
+            client_port=AccessLogParser._extract_client_port(log_data),
+            user_agent=request.get("headers", {}).get("User-Agent", [None])[0],
+            referer=request.get("headers", {}).get("Referer", [None])[0],
+            country=geo_info.get("country"),
+            country_code=geo_info.get("country_code"),
+            region=geo_info.get("region"),
+            city=geo_info.get("city"),
+            latitude=geo_info.get("latitude"),
+            longitude=geo_info.get("longitude"),
+            timezone=geo_info.get("timezone"),
+            isp=geo_info.get("isp"),
+            method=request.get("method", "GET"),
+            protocol=request.get("proto", "HTTP/1.1"),
+            host=request.get("host"),
+            path=path,
+            query_string=query_string,
+            matched_route=log_data.get("matched_route"),
+            upstream_service=upstream_info.get("service"),
+            upstream_host=upstream_info.get("host"),
+            upstream_port=upstream_info.get("port"),
+            status_code=log_data.get("status", 0),
+            response_size=log_data.get("size"),
+            response_time=AccessLogParser._parse_duration(log_data.get("duration")),
+            waf_action=waf_action,
+            waf_rule_id=waf_rule_id,
+            waf_score=waf_score,
+            rate_limited=rate_limited,
+            rate_limit_rule=rate_limit_rule,
+            tls_version=tls_info.get("version"),
+            tls_cipher=tls_info.get("cipher_suite"),
+            log_metadata=AccessLogParser._extract_log_metadata(log_data),
+        )
+
+    @staticmethod
+    def _extract_client_ip(log_data: Dict[str, Any]) -> str:
+        """
+        提取客户端真实 IP
+        
+        优先级：X-Forwarded-For > X-Real-IP > remote_ip
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            客户端 IP
+        """
+        request = log_data.get("request", {})
+        headers = request.get("headers", {})
+
+        # 检查 X-Forwarded-For
+        x_forwarded_for = headers.get("X-Forwarded-For", [None])[0]
+        if x_forwarded_for:
+            # 取第一个 IP（客户端真实 IP）
+            return x_forwarded_for.split(',')[0].strip()
+
+        # 检查 X-Real-IP
+        x_real_ip = headers.get("X-Real-IP", [None])[0]
+        if x_real_ip:
+            return x_real_ip
+
+        # 使用 remote_ip
+        return request.get("remote_ip", "unknown")
+
+    @staticmethod
+    def _extract_client_port(log_data: Dict[str, Any]) -> Optional[int]:
+        """
+        提取客户端端口
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            客户端端口或 None
+        """
+        try:
+            remote_port = log_data.get("request", {}).get("remote_port")
+            if remote_port is not None:
+                return int(remote_port)
+
+            remote_addr = log_data.get("request", {}).get("remote_addr", "")
+            if ':' in remote_addr:
+                return int(remote_addr.split(':')[-1])
+        except Exception:
+            pass
+        return None
+
+    @staticmethod
+    def _parse_timestamp(timestamp_str: Optional[str]) -> datetime:
+        """
+        解析时间戳字符串
+        
+        Args:
+            timestamp_str: 时间戳字符串
+            
+        Returns:
+            datetime 对象
+        """
+        if not timestamp_str:
+            return datetime.now(timezone.utc)
+
+        try:
+            # Caddy 使用 Unix 时间戳（秒）
+            if isinstance(timestamp_str, (int, float)):
+                return datetime.fromtimestamp(timestamp_str, tz=timezone.utc)
+
+            # 尝试解析 ISO 格式
+            parsed = datetime.fromisoformat(str(timestamp_str).replace('Z', '+00:00'))
+            if parsed.tzinfo is None:
+                return parsed.replace(tzinfo=timezone.utc)
+            return parsed
+        except Exception as e:
+            logger.warning(f"Failed to parse timestamp '{timestamp_str}': {e}")
+            return datetime.now(timezone.utc)
+
+    @staticmethod
+    def _parse_duration(duration_str: Optional[Any]) -> Optional[int]:
+        """
+        解析持续时间字符串（转换为毫秒）
+        
+        Args:
+            duration_str: 持续时间字符串（如 "0.123s" 或 123000000 纳秒）
+            
+        Returns:
+            毫秒数或 None
+        """
+        if not duration_str:
+            return None
+
+        try:
+            # Caddy 常见格式：float 秒（如 0.0123）
+            if isinstance(duration_str, float):
+                return int(duration_str * 1000)
+
+            # 整数格式：兼容纳秒与毫秒
+            if isinstance(duration_str, int):
+                if duration_str > 1_000_000:
+                    return duration_str // 1_000_000  # 纳秒转毫秒
+                return duration_str
+
+            # 如果是字符串（如 "0.123s"）
+            if isinstance(duration_str, str):
+                if duration_str.endswith('s'):
+                    seconds = float(duration_str[:-1])
+                    return int(seconds * 1000)
+                elif duration_str.endswith('ms'):
+                    return int(float(duration_str[:-2]))
+        except Exception as e:
+            logger.warning(f"Failed to parse duration '{duration_str}': {e}")
+
+        return None
+
+    @staticmethod
+    def _split_uri(uri: str) -> tuple:
+        """
+        分割 URI 为路径和查询字符串
+        
+        Args:
+            uri: 完整 URI
+            
+        Returns:
+            (path, query_string) 元组
+        """
+        if '?' in uri:
+            parts = uri.split('?', 1)
+            return parts[0], parts[1]
+        return uri, None
+
+    @staticmethod
+    def _extract_log_metadata(log_data: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+        """
+        提取额外的元数据
+        
+        Args:
+            log_data: 日志数据字典
+            
+        Returns:
+            元数据字典或 None
+        """
+        log_metadata = {}
+
+        # 提取自定义字段
+        custom_fields = ["user_id", "session_id", "trace_id", "span_id"]
+        for field in custom_fields:
+            if field in log_data:
+                log_metadata[field] = log_data[field]
+
+        return log_metadata if log_metadata else None
+
+
+# 全局实例
+access_log_parser = AccessLogParser()