cancan-microstack 0.0.1__py3-none-any.whl

cancan_microstack/services/opsbffsrv/interface/api/caddy/certificate_api.py

@@ -0,0 +1,235 @@
+"""
+Caddy 证书管理 API 接口
+
+提供 HTTPS 证书的 CRUD 操作、续期管理、统计等功能
+"""
+from typing import Optional
+import http
+
+from pydantic import BaseModel, Field
+
+from linglong_web.utils import logger
+from linglong_web import build_success_response
+from linglong_web import limiter
+from cancan_microstack.public.schemas.common import APIResponse
+from cancan_microstack.public.schemas.caddy import CaddyCertificateCreate, CaddyCertificateUpdate
+from cancan_microstack.public.error import HTTPException
+from cancan_microstack.public.const.opsbffsrv_error import \
+    OpsbffsrvCaddyRouteErrorCode as ErrorCode  # Using generic error codes or specific ones if available
+from cancan_microstack.services.opsbffsrv.application.caddy.certificate_management_app import CertificateManagementApp
+
+# 应用层实例
+_cert_app = CertificateManagementApp()
+
+
+class ToggleAutoRenewPayload(BaseModel):
+    """切换证书自动续期请求体 / Toggle certificate auto-renew request payload"""
+
+    enabled: bool = Field(
+        ...,
+        description="目标自动续期状态 / Desired auto-renew state",
+    )
+
+
+@limiter("20/second")
+async def register_certificate_handler(cert_data: CaddyCertificateCreate) -> APIResponse[dict]:
+    """
+    注册证书
+    
+    Args:
+        cert_data: 证书数据
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"注册证书: domain={cert_data.domain}")
+    result = await _cert_app.register_certificate(cert_data)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=result.get("message", "注册证书失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def update_certificate_handler(cert_id: int, cert_data: CaddyCertificateUpdate) -> APIResponse[dict]:
+    """
+    更新证书信息
+    
+    Args:
+        cert_id: 证书ID
+        cert_data: 更新数据
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"更新证书: id={cert_id}")
+    result = await _cert_app.update_certificate(cert_id, cert_data)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=result.get("message", "更新证书失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def get_certificate_handler(cert_id: int) -> APIResponse[dict]:
+    """
+    获取证书详情
+    
+    Args:
+        cert_id: 证书ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"获取证书: id={cert_id}")
+    cert = await _cert_app.get_certificate(cert_id)
+
+    if cert:
+        return build_success_response(data=cert.model_dump(exclude={"private_key_pem"}))
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.NOT_FOUND.value,
+            msg="证书不存在"
+        )
+
+
+@limiter("20/second")
+async def list_certificates_handler(
+        domain: Optional[str] = None,
+        status: Optional[str] = None
+) -> APIResponse[dict]:
+    """
+    列出证书（支持过滤）
+    
+    Args:
+        domain: 域名过滤
+        status: 状态过滤（active/expiring/expired/renewing/revoked）
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"列出证书: domain={domain}, status={status}")
+    certs = await _cert_app.list_certificates(domain=domain, status=status)
+
+    return build_success_response(data={
+        "certificates": [c.model_dump(exclude={"private_key_pem"}) for c in certs],
+        "total": len(certs)
+    })
+
+
+@limiter("10/second")
+async def delete_certificate_handler(cert_id: int) -> APIResponse[dict]:
+    """
+    删除证书
+    
+    Args:
+        cert_id: 证书ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"删除证书: id={cert_id}")
+    result = await _cert_app.delete_certificate(cert_id)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=result.get("message", "删除证书失败"),
+            detail=str(result)
+        )
+
+
+@limiter("5/second")
+async def renew_certificate_handler(cert_id: int) -> APIResponse[dict]:
+    """
+    手动续期证书
+    
+    Args:
+        cert_id: 证书ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"手动续期证书: id={cert_id}")
+    result = await _cert_app.renew_certificate_manually(cert_id)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=result.get("message", "续期证书失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def toggle_auto_renew_handler(cert_id: int, payload: ToggleAutoRenewPayload) -> APIResponse[dict]:
+    """
+    切换证书自动续期状态
+
+    Args:
+        cert_id: 证书ID
+        payload: 请求体，包含目标自动续期状态 enabled
+
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"切换证书自动续期: id={cert_id}, enabled={payload.enabled}")
+    result = await _cert_app.toggle_auto_renew(cert_id, payload.enabled)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=result.get("message", "切换自动续期失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def list_expiring_certificates_handler(days: int = 30) -> APIResponse[dict]:
+    """
+    列出即将过期的证书
+    
+    Args:
+        days: 天数阈值（默认30天）
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"列出即将过期证书: days={days}")
+    certs = await _cert_app.list_expiring_certificates(days)
+
+    return build_success_response(data={
+        "expiring_certificates": [c.model_dump(exclude={"private_key_pem"}) for c in certs],
+        "total": len(certs),
+        "days_threshold": days
+    })
+
+
+@limiter("20/second")
+async def get_certificate_statistics_handler() -> APIResponse[dict]:
+    """
+    获取证书统计信息
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info("获取证书统计信息")
+    stats = await _cert_app.get_certificate_statistics()
+
+    return build_success_response(data=stats)

cancan_microstack/services/opsbffsrv/interface/api/caddy/rate_limit_api.py

@@ -0,0 +1,302 @@
+"""
+Caddy 限流管理 API 接口
+
+提供限流规则的 CRUD 操作、IP 白黑名单管理、统计等功能
+"""
+from typing import (
+    List,
+    Optional,
+)
+import http
+
+from pydantic import (
+    BaseModel,
+    Field,
+)
+
+from linglong_web.utils import logger
+from linglong_web import build_success_response
+from cancan_microstack.public.schemas.common import APIResponse
+from linglong_web import limiter
+from cancan_microstack.public.schemas.caddy import CaddyRateLimitCreate, CaddyRateLimitUpdate
+from cancan_microstack.public.error import HTTPException
+from cancan_microstack.services.opsbffsrv.application.caddy.rate_limit_management_app import RateLimitManagementApp
+
+# 应用层实例
+_rate_limit_app = RateLimitManagementApp()
+
+
+class _IPListPayload(BaseModel):
+    """IP 列表请求体
+    IP list payload
+    """
+
+    ips: List[str] = Field(default_factory=list)
+
+
+def _extract_error_message(result: dict, default_message: str) -> str:
+    """统一提取错误信息
+    Extract normalized error message
+    """
+    return result.get("message") or result.get("error") or default_message
+
+
+@limiter("20/second")
+async def create_rate_limit_handler(rule_data: CaddyRateLimitCreate) -> APIResponse[dict]:
+    """
+    创建限流规则
+    
+    Args:
+        rule_data: 限流规则数据
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"创建限流规则: name={rule_data.rule_name}")
+    result = await _rate_limit_app.create_rate_limit(rule_data)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "创建限流规则失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def update_rate_limit_handler(rule_id: int, rule_data: CaddyRateLimitUpdate) -> APIResponse[dict]:
+    """
+    更新限流规则
+    
+    Args:
+        rule_id: 规则ID
+        rule_data: 更新数据
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"更新限流规则: id={rule_id}")
+    result = await _rate_limit_app.update_rate_limit(rule_id, rule_data)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "更新限流规则失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def get_rate_limit_handler(rule_id: int) -> APIResponse[dict]:
+    """
+    获取单个限流规则
+    
+    Args:
+        rule_id: 规则ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"获取限流规则: id={rule_id}")
+    rule = await _rate_limit_app.get_rate_limit(rule_id)
+
+    if rule:
+        return build_success_response(data=rule.model_dump())
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.NOT_FOUND.value,
+            msg="限流规则不存在"
+        )
+
+
+@limiter("20/second")
+async def list_rate_limits_handler(
+        match_type: Optional[str] = None,
+        is_enabled: Optional[bool] = None
+) -> APIResponse[dict]:
+    """
+    列出限流规则（支持过滤）
+    
+    Args:
+        match_type: 匹配类型（path/header/ip/query）
+        is_enabled: 启用状态
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"列出限流规则: type={match_type}, enabled={is_enabled}")
+    rules = await _rate_limit_app.list_rate_limits(
+        match_type=match_type,
+        is_enabled=is_enabled
+    )
+
+    return build_success_response(data={
+        "rules": [r.model_dump() for r in rules],
+        "total": len(rules)
+    })
+
+
+@limiter("10/second")
+async def delete_rate_limit_handler(rule_id: int) -> APIResponse[dict]:
+    """
+    删除限流规则
+    
+    Args:
+        rule_id: 规则ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"删除限流规则: id={rule_id}")
+    result = await _rate_limit_app.delete_rate_limit(rule_id)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "删除限流规则失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def toggle_rate_limit_handler(rule_id: int) -> APIResponse[dict]:
+    """
+    切换限流规则启用状态
+    
+    Args:
+        rule_id: 规则ID
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"切换限流规则状态: id={rule_id}")
+    result = await _rate_limit_app.toggle_rate_limit(rule_id)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "切换限流规则状态失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def add_whitelist_ips_handler(rule_id: int, payload: _IPListPayload) -> APIResponse[dict]:
+    """
+    添加IP白名单
+    
+    Args:
+        rule_id: 规则ID
+        ips: IP列表
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"添加IP白名单: rule_id={rule_id}, count={len(payload.ips)}")
+    result = await _rate_limit_app.add_whitelist_ips(rule_id, payload.ips)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "添加IP白名单失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def remove_whitelist_ips_handler(rule_id: int, payload: _IPListPayload) -> APIResponse[dict]:
+    """
+    移除IP白名单
+    
+    Args:
+        rule_id: 规则ID
+        ips: IP列表
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"移除IP白名单: rule_id={rule_id}, count={len(payload.ips)}")
+    result = await _rate_limit_app.remove_whitelist_ips(rule_id, payload.ips)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "移除IP白名单失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def add_blacklist_ips_handler(rule_id: int, payload: _IPListPayload) -> APIResponse[dict]:
+    """
+    添加IP黑名单
+    
+    Args:
+        rule_id: 规则ID
+        ips: IP列表
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"添加IP黑名单: rule_id={rule_id}, count={len(payload.ips)}")
+    result = await _rate_limit_app.add_blacklist_ips(rule_id, payload.ips)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "添加IP黑名单失败"),
+            detail=str(result)
+        )
+
+
+@limiter("10/second")
+async def remove_blacklist_ips_handler(rule_id: int, payload: _IPListPayload) -> APIResponse[dict]:
+    """
+    移除IP黑名单
+    
+    Args:
+        rule_id: 规则ID
+        ips: IP列表
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info(f"移除IP黑名单: rule_id={rule_id}, count={len(payload.ips)}")
+    result = await _rate_limit_app.remove_blacklist_ips(rule_id, payload.ips)
+
+    if result.get("status") == "success":
+        return build_success_response(data=result)
+    else:
+        raise HTTPException(
+            status_code=http.HTTPStatus.BAD_REQUEST.value,
+            msg=_extract_error_message(result, "移除IP黑名单失败"),
+            detail=str(result)
+        )
+
+
+@limiter("20/second")
+async def get_rate_limit_statistics_handler() -> APIResponse[dict]:
+    """
+    获取限流统计信息
+    
+    Returns:
+        统一响应格式
+    """
+    logger.info("获取限流统计信息")
+    stats = await _rate_limit_app.get_rate_limit_statistics()
+
+    return build_success_response(data=stats)