cndb 0.1.1__py3-none-any.whl

cndb/__init__.py

@@ -0,0 +1,7 @@
+"""cndb - 通用数据库管理平台。."""
+
+from __future__ import annotations
+
+__all__ = ["__version__"]
+
+__version__ = "0.1.1"

cndb/accounts/__init__.py

@@ -0,0 +1 @@
+"""accounts - 用户与认证应用."""

cndb/accounts/admin.py

@@ -0,0 +1,16 @@
+"""用户后台注册."""
+
+from __future__ import annotations
+
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin as DjangoUserAdmin
+
+from cndb.accounts.models import User
+
+
+@admin.register(User)
+class UserAdmin(DjangoUserAdmin):
+    """用户后台：补充昵称展示."""
+
+    list_display = ("id", "username", "nickname", "email", "is_active", "date_joined")
+    fieldsets = (*DjangoUserAdmin.fieldsets, ("扩展信息", {"fields": ("nickname",)}))

cndb/accounts/apps.py

@@ -0,0 +1,12 @@
+"""accounts 应用配置."""
+
+from __future__ import annotations
+
+from django.apps import AppConfig
+
+
+class AccountsConfig(AppConfig):
+    """用户与认证应用配置."""
+
+    name = "cndb.accounts"
+    verbose_name = "用户"

cndb/accounts/migrations/0001_initial.py

@@ -0,0 +1,44 @@
+# Generated by Django 5.2.17 on 2026-09-01 12:31
+
+import django.contrib.auth.models
+import django.contrib.auth.validators
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='User',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
+                ('email', models.EmailField(blank=True, max_length=254, verbose_name='email address')),
+                ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
+                ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
+                ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
+                ('nickname', models.CharField(blank=True, max_length=150, verbose_name='昵称')),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'verbose_name': '用户',
+                'verbose_name_plural': '用户',
+            },
+            managers=[
+                ('objects', django.contrib.auth.models.UserManager()),
+            ],
+        ),
+    ]

cndb/accounts/models.py

@@ -0,0 +1,20 @@
+"""用户模型."""
+
+from __future__ import annotations
+
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+
+
+class User(AbstractUser):
+    """平台用户：扩展 Django 内置用户，增加昵称用于界面展示."""
+
+    nickname = models.CharField("昵称", max_length=150, blank=True)
+
+    class Meta:
+        verbose_name = "用户"
+        verbose_name_plural = "用户"
+
+    def __str__(self) -> str:
+        """返回用户名便于后台展示."""
+        return self.username  # type: ignore[bad-return]

cndb/accounts/serializers.py

@@ -0,0 +1,58 @@
+"""用户序列化器：注册、登录与个人信息."""
+
+from __future__ import annotations
+
+from django.contrib.auth import authenticate
+from django.contrib.auth.password_validation import validate_password
+from rest_framework import serializers
+from rest_framework.exceptions import AuthenticationFailed
+
+from cndb.accounts.models import User
+
+
+class RegisterSerializer(serializers.ModelSerializer):
+    """注册请求：创建用户并校验密码强度."""
+
+    password = serializers.CharField(write_only=True, trim_whitespace=False, label="密码")
+
+    class Meta:
+        model = User
+        fields = ("id", "username", "email", "nickname", "password")
+        read_only_fields = ("id",)
+        extra_kwargs = {"email": {"required": True}}
+
+    def validate_password(self, value: str) -> str:
+        """按全局密码校验器检查强度."""
+        validate_password(value)
+        return value
+
+    def create(self, validated_data: dict[str, object]) -> User:
+        """使用 create_user 完成密码哈希后落库."""
+        return User.objects.create_user(**validated_data)  # type: ignore[arg-type]
+
+
+class LoginSerializer(serializers.Serializer):
+    """登录请求：校验用户名与密码."""
+
+    username = serializers.CharField(label="用户名")
+    password = serializers.CharField(write_only=True, trim_whitespace=False, label="密码")
+
+    def validate(self, attrs: dict[str, str]) -> dict[str, object]:
+        """认证失败统一抛 AuthenticationFailed，避免泄露具体原因."""
+        user = authenticate(
+            request=self.context.get("request"),
+            username=attrs["username"],
+            password=attrs["password"],
+        )
+        if user is None:
+            raise AuthenticationFailed("用户名或密码错误")
+        return {**attrs, "user": user}
+
+
+class UserSerializer(serializers.ModelSerializer):
+    """用户信息：注册响应与个人信息读写共用."""
+
+    class Meta:
+        model = User
+        fields = ("id", "username", "email", "nickname", "date_joined")
+        read_only_fields = ("id", "username", "date_joined")

cndb/accounts/urls.py

@@ -0,0 +1,14 @@
+"""accounts 路由."""
+
+from __future__ import annotations
+
+from django.urls import path
+
+from cndb.accounts.views import LoginView, LogoutView, MeView, RegisterView
+
+urlpatterns = [
+    path("register/", RegisterView.as_view(), name="auth-register"),
+    path("login/", LoginView.as_view(), name="auth-login"),
+    path("logout/", LogoutView.as_view(), name="auth-logout"),
+    path("me/", MeView.as_view(), name="auth-me"),
+]

cndb/accounts/views.py

@@ -0,0 +1,59 @@
+"""认证 API 视图：注册、登录、登出与个人信息."""
+
+from __future__ import annotations
+
+from django.contrib.auth import login, logout
+from rest_framework import generics, permissions
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from cndb.accounts.models import User
+from cndb.accounts.serializers import LoginSerializer, RegisterSerializer, UserSerializer
+
+
+class RegisterView(generics.CreateAPIView):
+    """注册：创建用户并直接建立会话."""
+
+    permission_classes = [permissions.AllowAny]
+    serializer_class = RegisterSerializer
+
+    def create(self, request: Request, *_args: object, **_kwargs: object) -> Response:
+        """校验、创建用户并登录会话，返回用户信息."""
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        user = serializer.save()
+        login(request, user)
+        return Response(UserSerializer(user).data, status=201)
+
+
+class LoginView(APIView):
+    """登录：校验凭证并建立会话."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def post(self, request: Request) -> Response:
+        """校验用户名密码，成功返回用户信息."""
+        serializer = LoginSerializer(data=request.data, context={"request": request})
+        serializer.is_valid(raise_exception=True)
+        login(request, serializer.validated_data["user"])  # type: ignore[arg-type]
+        return Response(UserSerializer(serializer.validated_data["user"]).data)  # type: ignore[arg-type]
+
+
+class LogoutView(APIView):
+    """登出：销毁当前会话."""
+
+    def post(self, request: Request) -> Response:
+        """销毁会话并返回 204."""
+        logout(request)
+        return Response(status=204)
+
+
+class MeView(generics.RetrieveUpdateAPIView):
+    """个人信息：读取与更新昵称、邮箱."""
+
+    serializer_class = UserSerializer
+
+    def get_object(self) -> User:
+        """当前登录用户."""
+        return self.request.user  # type: ignore[return-value]

cndb/asgi.py

@@ -0,0 +1,11 @@
+"""ASGI 入口."""
+
+from __future__ import annotations
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "cndb.settings.prod")
+
+application = get_asgi_application()

cndb/settings/__init__.py

@@ -0,0 +1 @@
+"""Django 配置包：按环境拆分为 base/dev/test/prod 模块."""

cndb/settings/base.py

@@ -0,0 +1,124 @@
+"""Django 基础配置：所有环境共享."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+# 项目根目录（src layout：settings/base.py 上溯 4 级到仓库根）
+BASE_DIR = Path(__file__).resolve().parents[3]
+
+# 安全密钥：生产环境必须通过环境变量注入，开发环境使用不安全默认值
+SECRET_KEY = os.environ.get("CNDB_SECRET_KEY", "dev-insecure-secret-key")
+
+DEBUG = False
+
+ALLOWED_HOSTS: list[str] = []
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    # 三方
+    "rest_framework",
+    # 平台应用
+    "cndb.accounts",
+    "cndb.workspaces",
+    "cndb.tables",
+    "cndb.tokens",
+    "cndb.webui",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "cndb.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "cndb.wsgi.application"
+ASGI_APPLICATION = "cndb.asgi.application"
+
+# 数据库：默认 SQLite（开发/测试），CNDB_DB=postgres 切换 PostgreSQL
+if os.environ.get("CNDB_DB", "sqlite").lower() == "postgres":
+    DATABASES = {
+        "default": {
+            "ENGINE": "django.db.backends.postgresql",
+            "NAME": os.environ.get("CNDB_DB_NAME", "cndb"),
+            "USER": os.environ.get("CNDB_DB_USER", "cndb"),
+            "PASSWORD": os.environ.get("CNDB_DB_PASSWORD", ""),
+            "HOST": os.environ.get("CNDB_DB_HOST", "localhost"),
+            "PORT": os.environ.get("CNDB_DB_PORT", "5432"),
+        },
+    }
+else:
+    _SQLITE_PATH = BASE_DIR / "data" / "cndb.sqlite3"
+    _SQLITE_PATH.parent.mkdir(parents=True, exist_ok=True)
+    DATABASES = {
+        "default": {
+            "ENGINE": "django.db.backends.sqlite3",
+            "NAME": _SQLITE_PATH,
+        },
+    }
+
+# 自定义用户模型
+AUTH_USER_MODEL = "accounts.User"
+
+# 登录页地址：未登录访问主应用时重定向到 webui 登录页
+LOGIN_URL = "/login/"
+
+AUTH_PASSWORD_VALIDATORS = [
+    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
+    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
+    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
+    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
+]
+
+LANGUAGE_CODE = "zh-hans"
+
+TIME_ZONE = "Asia/Shanghai"
+
+USE_I18N = True
+
+USE_TZ = True
+
+STATIC_URL = "static/"
+
+STATIC_ROOT = BASE_DIR / "staticfiles"
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+# DRF 全局配置：会话 + Token 认证，默认需登录，分页每页 50 条
+REST_FRAMEWORK = {
+    "DEFAULT_AUTHENTICATION_CLASSES": [
+        "cndb.tokens.authentication.TokenAuthentication",
+        "rest_framework.authentication.SessionAuthentication",
+    ],
+    "DEFAULT_PERMISSION_CLASSES": [
+        "rest_framework.permissions.IsAuthenticated",
+    ],
+    "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
+    "PAGE_SIZE": 50,
+}

cndb/settings/dev.py

@@ -0,0 +1,9 @@
+"""开发环境配置."""
+
+from __future__ import annotations
+
+from .base import *
+
+DEBUG = True
+
+ALLOWED_HOSTS = ["*"]

cndb/settings/prod.py

@@ -0,0 +1,22 @@
+"""生产环境配置."""
+
+from __future__ import annotations
+
+import os
+
+from django.core.exceptions import ImproperlyConfigured
+
+from .base import *
+
+
+def _require_secret_key() -> str:
+    """生产环境必须通过环境变量提供密钥，缺失即拒绝启动。"""
+    key = os.environ.get("CNDB_SECRET_KEY")
+    if not key:
+        raise ImproperlyConfigured("生产环境必须设置环境变量 CNDB_SECRET_KEY")
+    return key
+
+
+SECRET_KEY = _require_secret_key()
+
+ALLOWED_HOSTS = [h for h in os.environ.get("CNDB_ALLOWED_HOSTS", "").split(",") if h]

cndb/settings/test.py

@@ -0,0 +1,16 @@
+"""测试环境配置：SQLite 内存库 + 快速密码哈希."""
+
+from __future__ import annotations
+
+from .base import *
+
+DEBUG = False
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": ":memory:",
+    },
+}
+
+PASSWORD_HASHERS = ["django.contrib.auth.hashers.MD5PasswordHasher"]

cndb/tables/__init__.py

@@ -0,0 +1 @@
+"""tables - 数据表元数据中心应用."""

cndb/tables/access.py

@@ -0,0 +1,161 @@
+"""表级访问策略链：动作定义、策略协议与链式裁决.
+
+策略链是表域权限的统一入口：动作（TableAction）声明"做什么"，
+链上各策略（TableAccessPolicy）独立裁决"能否做"，任一环节拒绝即短路。
+后续行级/字段级权限、Token 范围等以新策略环节接入，不改既有调用方.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from enum import Enum, auto
+
+from django.contrib.auth.models import AbstractBaseUser
+
+from cndb.tables.models import DataTable, TablePermission
+from cndb.tables.query import RowQuery, compile_filters
+from cndb.workspaces.models import Workspace, WorkspaceMember
+from cndb.workspaces.permissions import get_member_role, has_role
+
+
+class TableAction(Enum):
+    """表级动作集合：读写分离，为后续行级/字段级扩展预留粒度."""
+
+    READ = auto()
+    EDIT_RECORDS = auto()
+    EDIT_VIEWS = auto()
+    EDIT_SCHEMA = auto()
+
+
+@dataclass(frozen=True)
+class AccessVerdict:
+    """策略裁决结果：拒绝时 reason 为对外可见的原因."""
+
+    allowed: bool
+    reason: str = ""
+
+
+@dataclass(frozen=True)
+class AccessContext:
+    """访问上下文：工作区必有，动作落在具体表时才有表."""
+
+    workspace: Workspace
+    table: DataTable | None = None
+
+
+class TableAccessPolicy(ABC):
+    """访问策略协议：链上每一环独立裁决."""
+
+    @abstractmethod
+    def check(self, user: AbstractBaseUser | None, context: AccessContext, action: TableAction) -> AccessVerdict:
+        """对给定用户、上下文与动作给出裁决."""
+
+
+class WorkspaceRolePolicy(TableAccessPolicy):
+    """工作区角色策略：动作须达到该动作的最低角色."""
+
+    _MIN_ROLE: dict[TableAction, str] = {
+        TableAction.READ: WorkspaceMember.Role.VIEWER,
+        TableAction.EDIT_RECORDS: WorkspaceMember.Role.EDITOR,
+        TableAction.EDIT_VIEWS: WorkspaceMember.Role.EDITOR,
+        TableAction.EDIT_SCHEMA: WorkspaceMember.Role.EDITOR,
+    }
+    _DENY_REASON: dict[TableAction, str] = {
+        TableAction.READ: "需要工作区成员身份",
+        TableAction.EDIT_RECORDS: "需要编辑者及以上权限",
+        TableAction.EDIT_VIEWS: "需要编辑者及以上权限",
+        TableAction.EDIT_SCHEMA: "需要编辑者及以上权限",
+    }
+
+    def check(self, user: AbstractBaseUser | None, context: AccessContext, action: TableAction) -> AccessVerdict:
+        """按动作最低角色裁决，非成员一律拒绝."""
+        minimum = self._MIN_ROLE[action]
+        if has_role(user, context.workspace, minimum):
+            return AccessVerdict(True)
+        return AccessVerdict(False, self._DENY_REASON[action])
+
+
+class TableOverridePolicy(TableAccessPolicy):
+    """表级角色覆盖策略：表权限对象对动作收紧最低角色，OWNER 豁免."""
+
+    _OVERRIDE_FIELD: dict[TableAction, str] = {
+        TableAction.READ: "read_role",
+        TableAction.EDIT_RECORDS: "edit_records_role",
+        TableAction.EDIT_VIEWS: "edit_views_role",
+        TableAction.EDIT_SCHEMA: "edit_schema_role",
+    }
+
+    def check(self, user: AbstractBaseUser | None, context: AccessContext, action: TableAction) -> AccessVerdict:
+        """表无权限对象或动作未覆盖时放行；覆盖则按覆盖角色裁决，OWNER 豁免."""
+        table = context.table
+        if table is None:
+            return AccessVerdict(True)
+        if get_member_role(user, context.workspace) == WorkspaceMember.Role.OWNER:
+            return AccessVerdict(True)
+        permission = TablePermission.objects.filter(table=table).only(*self._OVERRIDE_FIELD.values()).first()
+        if permission is None:
+            return AccessVerdict(True)
+        override = str(getattr(permission, self._OVERRIDE_FIELD[action]) or "")
+        if not override:
+            return AccessVerdict(True)
+        if has_role(user, context.workspace, override):
+            return AccessVerdict(True)
+        return AccessVerdict(False, "当前角色不足以访问该表")
+
+
+# 策略链：按序裁决，任一环节拒绝即短路；后续权限维度以新环节追加
+POLICIES: list[TableAccessPolicy] = [WorkspaceRolePolicy(), TableOverridePolicy()]
+
+
+def check_access(user: AbstractBaseUser | None, context: AccessContext, action: TableAction) -> AccessVerdict:
+    """链式裁决入口：遍历策略链，首个拒绝环节的结果即最终结果."""
+    for policy in POLICIES:
+        verdict = policy.check(user, context, action)
+        if not verdict.allowed:
+            return verdict
+    return AccessVerdict(True)
+
+
+def check_table_access(user: AbstractBaseUser | None, table: DataTable, action: TableAction) -> AccessVerdict:
+    """表级动作裁决便捷入口."""
+    return check_access(user, AccessContext(workspace=table.workspace, table=table), action)  # type: ignore[bad-argument-type]
+
+
+def check_workspace_access(user: AbstractBaseUser | None, workspace: Workspace, action: TableAction) -> AccessVerdict:
+    """工作区级动作裁决便捷入口（如建表，表尚不存在）."""
+    return check_access(user, AccessContext(workspace=workspace), action)
+
+
+def _table_permission(table: DataTable) -> TablePermission | None:
+    """读取表权限对象，无则返回 None."""
+    return TablePermission.objects.filter(table=table).first()
+
+
+def row_scope(user: AbstractBaseUser | None, table: DataTable) -> RowQuery | None:
+    """行级访问范围：表权限配置了行级过滤时编译为 RowQuery（AND 并入业务查询）.
+
+    OWNER 不受行级过滤限制；规则编译失败视为无限制（保存期已校验，此处仅防御）.
+    """
+    permission = _table_permission(table)
+    if permission is None or not permission.row_filters:
+        return None
+    if get_member_role(user, table.workspace) == WorkspaceMember.Role.OWNER:  # type: ignore[bad-argument-type]
+        return None
+    where, params = compile_filters(table, permission.row_filters, str(permission.row_filter_type))  # type: ignore[bad-argument-type]
+    return RowQuery(where=where, params=params)
+
+
+def hidden_field_names(user: AbstractBaseUser | None, table: DataTable) -> set[str]:
+    """字段级隐藏：返回当前用户角色不可见的字段名集合（OWNER 全可见）."""
+    permission = _table_permission(table)
+    if permission is None or not permission.hidden_fields:
+        return set()
+    role = get_member_role(user, table.workspace)  # type: ignore[bad-argument-type]
+    if role == WorkspaceMember.Role.OWNER:
+        return set()
+    hidden: set[str] = set()
+    for field_name, minimum in permission.hidden_fields.items():
+        if role is None or not has_role(user, table.workspace, str(minimum)):  # type: ignore[bad-argument-type]
+            hidden.add(str(field_name))
+    return hidden

cndb/tables/admin.py

@@ -0,0 +1,23 @@
+"""数据表后台注册."""
+
+from __future__ import annotations
+
+from django.contrib import admin
+
+from cndb.tables.models import DataField, DataTable
+
+
+@admin.register(DataTable)
+class DataTableAdmin(admin.ModelAdmin):
+    """数据表后台."""
+
+    list_display = ("id", "name", "workspace", "db_table_name", "trashed", "created_on")
+    list_filter = ("trashed",)
+
+
+@admin.register(DataField)
+class DataFieldAdmin(admin.ModelAdmin):
+    """数据字段后台."""
+
+    list_display = ("id", "name", "table", "field_type", "required", "trashed", "order")
+    list_filter = ("field_type", "required", "trashed")