dwy-auth 0.1.0__tar.gz

dwy_auth-0.1.0/.gitignore

@@ -0,0 +1,44 @@
+node_modules/
+.build/
+.build-ios/
+.swiftpm/
+dist/
+private-dist/
+.DS_Store
+*.tsbuildinfo
+
+# Python
+__pycache__/
+*.pyc
+*.egg-info/
+build/
+.venv/
+.pytest_cache/
+.ruff_cache/
+
+# Environment
+.env
+*.env
+.superpowers/
+
+# Keys
+.key
+/.npmrc
+
+# Local Claude Code settings
+.claude/settings.local.json
+# dwy 本机缓存（sync-state.json 等同步状态，每机不同，不入库）
+.dwy/
+dwy-cli/.agents/
+dwy-cli/.claude/
+dwy-cli/.codex/
+dwy-cli/.cursor/
+dwy-cli/.opencode/
+dwy-cli/AGENTS.md
+
+# uv lock (library should not lock dependencies)
+backend/uv.lock
+.playwright-mcp/
+.pentest-results/
+.gstack/
+.codegraph/

dwy_auth-0.1.0/CHANGELOG.md

@@ -0,0 +1,8 @@
+# dwy-auth
+
+## 0.1.0
+
+- 首次通过 GitHub Actions OIDC 发布到公开 PyPI，导入命名空间为 `dwy_auth`。
+- 提供独立 `AuthRuntime`、身份提供方合同与可替换 `SessionBackend`；应用持有用户模型、数据库会话和迁移，核心不依赖 EAPI 或 FastAPI。
+- 支持 Google 身份、可选邮箱密码认证、令牌轮换、设备撤销与账户删除；配置、邮件发送器和存储资源由宿主注入。
+- 保留需要 EAPI 的服务、HTTP 路由与管理员 Cookie 兼容接口；通过 `dwyeapi[auth]==0.12.0` 安装配套集成。

dwy_auth-0.1.0/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: dwy-auth
+Version: 0.1.0
+Summary: Google and email/password user sessions and independent administrator Cookie authentication for EAPI
+Requires-Python: <3.13,>=3.11
+Requires-Dist: anyio>=4.0.0
+Requires-Dist: bcrypt>=4.0.0
+Requires-Dist: google-auth[requests]==2.62.0
+Requires-Dist: pydantic==2.13.4
+Requires-Dist: python-jose[cryptography]>=3.3.0
+Requires-Dist: sqlalchemy[asyncio]==2.0.49
+Provides-Extra: dev
+Requires-Dist: aiosqlite==0.22.1; extra == 'dev'
+Requires-Dist: alembic==1.18.4; extra == 'dev'
+Requires-Dist: httpx==0.28.1; extra == 'dev'
+Requires-Dist: pytest-asyncio==1.3.0; extra == 'dev'
+Requires-Dist: pytest==9.0.3; extra == 'dev'
+Requires-Dist: ruff==0.15.12; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# dwy-auth
+
+New integrations use `AuthRuntime` with application-owned users and a replaceable `SessionBackend`. See [runtime integration](../../../docs/auth-runtime-integration.md). The authentication core is independent of EAPI and FastAPI; the legacy service, HTTP and administrator interfaces below require EAPI when used.
+
+Python distribution `dwy-auth==0.1.0`, import `dwy_auth`. Install the independent core from public PyPI with `pip install "dwy-auth==0.1.0"`. For the EAPI integration and compatibility interfaces, install `pip install "dwyeapi[auth]==0.12.0"`; this includes `dwy-auth` and the EAPI email SDK. Source remains in a private repository; registry releases use `.github/workflows/publish-auth.yml` with GitHub Actions OIDC. The Google user entry and administrator Cookie entry are separate. No dependency on app-cloud or cloud-kernel; no environment variables or global database are read by this package.
+
+When upgrading a preview integration, update both the dependency name and Python imports. The new wheel exports only `dwy_auth`; no legacy namespace alias is shipped. The source package is `backend/packages/auth` and release tags use `dwy-auth@VERSION`.
+
+User authentication uses the existing Google subject identity, app-scoped SQL tables, 15-minute opaque access tokens, rotating refresh families, device revocation and transactional account deletion. The application owns its engine/session factory, metadata and Alembic history. No migrations are created or run automatically. Google configuration accepts one explicit Web OAuth audience; a missing configuration closes login.
+
+```python
+from fastapi import FastAPI
+from dwyeapi.exceptions import register_exception_handlers
+from dwy_auth import AuthService, GoogleConfig, OfficialGoogleVerifier, build_auth_tables, install_auth_routes
+
+# metadata and sessions are owned by this application.
+service = AuthService("myapp", sessions, build_auth_tables(metadata), OfficialGoogleVerifier(
+    GoogleConfig(client_id=google_client_id)
+))
+app = FastAPI()
+register_exception_handlers(app)
+install_auth_routes(app, service, authorization_limit=8192)
+```
+
+`dwyeapi.identity.Principal` and `IdentityVerifier` are the canonical identity contract. `create_identity_dependency(app_id, verifier, authorization_limit=...)` binds business routes to an explicitly chosen application/verifier. `install_auth_routes` uses its AuthService by default and accepts an explicitly injected trusted `identity_verifier` for existing host adapters. The host must apply request-body limits before parsing (the Google token schema separately limits token length to 16384 characters). Validation errors installed by this package omit submitted credentials.
+
+```python
+from dwy_auth.admin import AdminAuthConfig, install_admin_auth
+
+admin = install_admin_auth(app, AdminAuthConfig(
+    username=admin_username,
+    password=admin_password,
+    secure_cookie=True,
+    origin="https://admin.example.com",
+))
+# Protect host-owned business routes with Depends(admin.require_admin).
+# Also add Depends(admin.same_origin) to host-owned mutation routes.
+```
+
+Admin paths remain `/api/admin/auth/login`, `/me`, `/logout`. Cookies remain HttpOnly, SameSite=Strict, scoped to `/api/admin`; production callers explicitly enable Secure and enforce their deployment password policy. A configured origin is matched exactly. Without one, an Origin header must match the request scheme/host; forwarded headers are not trusted. Requests without Origin preserve the existing API contract. Standalone admin installation bounds auth request bodies at 4096 bytes and forbids caching. A host that already protects every admin path can pass `install_security=False` and retain that middleware.
+
+Admin state is in memory: restarting revokes every session, with one host worker required for this existing implementation. Sessions, rate limits and credentials are independent of user access/refresh tokens. The binding grants no user Principal and contains no business queries or configuration storage.
+
+Run `pytest tests` from this directory with the dev extra installed. `tests/packaging_smoke.py` additionally runs against installed wheels in a clean environment and asserts the host, kernel and business packages are absent. PostgreSQL concurrency cases need an explicitly provided `APP_CLOUD_TEST_POSTGRES_URL`.
+
+## Email/password authentication
+
+Email/password is opt-in. Email accounts have stable random UUIDs and an independent unique `(app_id,email)` credential; email normalization only trims and lowercases. A Google account with the same email is never merged. New/reset passwords require at least 15 Unicode code points and at most 72 UTF-8 bytes; login accepts nonempty existing passwords up to 72 bytes. Passwords are never trimmed or truncated. EAPI bcrypt executes in a bounded worker pool (4 concurrent, at most 32 queued/running per service); cancellation keeps running work charged to this budget.
+
+```python
+from dwy_auth import EmailAuthConfig, EapiEmailCodeSender, SessionPolicy
+from dwyeapi.providers.email import make_email_provider
+
+# email_settings and challenge_secret come from the host's validated settings.
+# Every worker must share the same secret (at least 32 bytes). Never commit it.
+provider = make_email_provider(email_settings)
+service = AuthService(
+    "myapp", sessions, build_auth_tables(metadata), google_verifier,
+    email_sender=EapiEmailCodeSender(provider),
+    email_config=EmailAuthConfig(challenge_secret=challenge_secret),
+    session_policy=SessionPolicy(refresh_ttl=180 * 86400, rolling_refresh=True),
+)
+install_auth_routes(app, service)
+```
+
+Use the matching EAPI version containing `EmailProviderBase.send_verification_code`. This public transport-only method reuses existing Resend templates/domain policy and does not access Redis. Match the provider template TTL with `EmailAuthConfig.code_ttl`. The host owns the email sender/provider lifecycle. Without email configuration all email routes fail closed with `EMAIL_NOT_CONFIGURED`.
+
+Both authentication HTTP installers accept an optional `Accept-Language` header (maximum 512 characters) for email codes. Any valid `zh`/`zh-*` range with nonzero quality selects Chinese; missing, malformed, excluded (`zh;q=0`), or other languages select English. The subject, HTML, and plain-text body use the same language. The current Apple client explicitly sends `zh` for a Chinese first preferred language and `en` otherwise. Language is passed per call and never changes code identity or resend limits.
+
+Custom senders must accept `send(email, code, purpose, *, language="en")`; custom EAPI providers must accept `_send(target, code, *, language="en")`. Programmatic calls may pass `send_email_code(..., language="zh")`; only `zh` and `en` are supported. Configure `resend.subject` for Chinese and `resend.subject_en` for English. English brand taglines/slogans use `brand_tagline_en`/`brand_slogan_en` (empty by default), without falling back to Chinese promotional copy. Brand names remain as configured.
+
+| POST path | JSON input | SUCCESS data |
+|---|---|---|
+| `/api/v1/auth/email/code` | `email,purpose` (`register` or `password_reset`) | `challenge_id,expires_in,resend_after,code_length` |
+| `/api/v1/auth/register` | `email,password,code,challenge_id,device_id` | Existing `TokenResponse`; automatically logged in |
+| `/api/v1/auth/login` | `email,password,device_id` | Existing `TokenResponse` |
+| `/api/v1/auth/password/reset` | `email,password,code,challenge_id` | `{"status":"completed"}`; all existing user sessions revoked |
+
+Codes are six digits, expire after 300 seconds and have a 60-second resend cooldown by default. Response `expires_in` and `resend_after` report actual remaining database deadlines after delivery; a delivery that outlasts the challenge fails and removes that challenge. Only a successful delivery activates a challenge; a new delivered challenge invalidates older challenges for the same app/email/purpose. The database stores an HMAC bound to app/email/purpose/challenge, never the code. Conditional updates make consumption single-use; failed-attempt counters commit independently so business rollback cannot replenish attempts. Each challenge allows at most five attempts. Atomic SQL budgets apply per app, peer IP, purpose/email and action; send limits are 50/IP/hour, 1000/app/hour, 10/email/purpose/hour; verification is 100/IP/15min and 20/email/purpose/15min; login is 100/IP/15min and 10/email/15min. Expired counters/challenges are pruned on use. Configure trusted proxy middleware at the host if deployed behind a proxy; request forwarding headers are not read directly. Continue enforcing host request-body and ingress limits.
+
+Errors never echo submitted secrets. Public codes are `EMAIL_INVALID`, `PASSWORD_INVALID`, `EMAIL_PURPOSE_INVALID`, `EMAIL_CODE_INVALID` (wrong/expired/used/exhausted), `EMAIL_ALREADY_REGISTERED`, `CREDENTIALS_INVALID`, `EMAIL_RATE_LIMITED`, `EMAIL_NOT_CONFIGURED`, `EMAIL_DELIVERY_FAILED`. Schema validation uses the existing `VALIDATION_ERROR` envelope. Failed delivery remains charged to resend budgets to prevent abusive retries. Delivery to existing and unknown accounts follows the same public send contract.
+
+The default `SessionPolicy()` retains the existing fixed 30-day refresh deadline and 15-minute access lifetime. Explicit rolling policy extends refresh validity to 180 days on successful refresh. Old refresh digests remain replay evidence for at most `replay_retention` (default 30 days) and expire independently, so normal 15-minute refreshes do not accumulate a lifetime 4096 cap. The 4096 limit still bounds *unexpired* evidence (normal 30-day use is 2880); an abusive burst gets 429 without invalidating the current token. Refresh replay, device revocation and account deletion remain enforced. Account deletion removes email credentials/challenges transactionally; it preserves the anonymized UUID for independent purchase ledgers.
+
+### Host Alembic migration
+
+Fresh applications include all six auth tables via `build_auth_tables(metadata)` in their own migration. Existing Google-only databases must migrate before enabling the new package; `metadata.create_all` does not alter the old non-nullable subject column. Add a revision to the **host** Alembic history:
+
+```python
+from alembic import op
+from dwy_auth.migrations import upgrade_email_auth
+
+# revision/down_revision belong to the host migration history.
+def upgrade():
+    upgrade_email_auth(op)
+```
+
+The helper makes `auth_users.google_subject` nullable and creates `auth_password_credentials`, `auth_email_challenges`, `auth_rate_limits`; existing UUIDs, sessions and Google subjects remain untouched. PostgreSQL alters the column in place. SQLite uses Alembic batch mode; hosts with foreign keys enabled must follow Alembic's SQLite foreign-key PRAGMA procedure outside the transaction. Downgrade is intentionally host-owned: email-only users have null Google subjects, so restoring NOT NULL requires an explicit data-retention decision. Do not run this helper at application startup. `tests/test_email_auth.py` migrates a populated legacy Google schema and verifies both existing sessions and new email registration afterward.

dwy_auth-0.1.0/README.md

@@ -0,0 +1,98 @@
+# dwy-auth
+
+New integrations use `AuthRuntime` with application-owned users and a replaceable `SessionBackend`. See [runtime integration](../../../docs/auth-runtime-integration.md). The authentication core is independent of EAPI and FastAPI; the legacy service, HTTP and administrator interfaces below require EAPI when used.
+
+Python distribution `dwy-auth==0.1.0`, import `dwy_auth`. Install the independent core from public PyPI with `pip install "dwy-auth==0.1.0"`. For the EAPI integration and compatibility interfaces, install `pip install "dwyeapi[auth]==0.12.0"`; this includes `dwy-auth` and the EAPI email SDK. Source remains in a private repository; registry releases use `.github/workflows/publish-auth.yml` with GitHub Actions OIDC. The Google user entry and administrator Cookie entry are separate. No dependency on app-cloud or cloud-kernel; no environment variables or global database are read by this package.
+
+When upgrading a preview integration, update both the dependency name and Python imports. The new wheel exports only `dwy_auth`; no legacy namespace alias is shipped. The source package is `backend/packages/auth` and release tags use `dwy-auth@VERSION`.
+
+User authentication uses the existing Google subject identity, app-scoped SQL tables, 15-minute opaque access tokens, rotating refresh families, device revocation and transactional account deletion. The application owns its engine/session factory, metadata and Alembic history. No migrations are created or run automatically. Google configuration accepts one explicit Web OAuth audience; a missing configuration closes login.
+
+```python
+from fastapi import FastAPI
+from dwyeapi.exceptions import register_exception_handlers
+from dwy_auth import AuthService, GoogleConfig, OfficialGoogleVerifier, build_auth_tables, install_auth_routes
+
+# metadata and sessions are owned by this application.
+service = AuthService("myapp", sessions, build_auth_tables(metadata), OfficialGoogleVerifier(
+    GoogleConfig(client_id=google_client_id)
+))
+app = FastAPI()
+register_exception_handlers(app)
+install_auth_routes(app, service, authorization_limit=8192)
+```
+
+`dwyeapi.identity.Principal` and `IdentityVerifier` are the canonical identity contract. `create_identity_dependency(app_id, verifier, authorization_limit=...)` binds business routes to an explicitly chosen application/verifier. `install_auth_routes` uses its AuthService by default and accepts an explicitly injected trusted `identity_verifier` for existing host adapters. The host must apply request-body limits before parsing (the Google token schema separately limits token length to 16384 characters). Validation errors installed by this package omit submitted credentials.
+
+```python
+from dwy_auth.admin import AdminAuthConfig, install_admin_auth
+
+admin = install_admin_auth(app, AdminAuthConfig(
+    username=admin_username,
+    password=admin_password,
+    secure_cookie=True,
+    origin="https://admin.example.com",
+))
+# Protect host-owned business routes with Depends(admin.require_admin).
+# Also add Depends(admin.same_origin) to host-owned mutation routes.
+```
+
+Admin paths remain `/api/admin/auth/login`, `/me`, `/logout`. Cookies remain HttpOnly, SameSite=Strict, scoped to `/api/admin`; production callers explicitly enable Secure and enforce their deployment password policy. A configured origin is matched exactly. Without one, an Origin header must match the request scheme/host; forwarded headers are not trusted. Requests without Origin preserve the existing API contract. Standalone admin installation bounds auth request bodies at 4096 bytes and forbids caching. A host that already protects every admin path can pass `install_security=False` and retain that middleware.
+
+Admin state is in memory: restarting revokes every session, with one host worker required for this existing implementation. Sessions, rate limits and credentials are independent of user access/refresh tokens. The binding grants no user Principal and contains no business queries or configuration storage.
+
+Run `pytest tests` from this directory with the dev extra installed. `tests/packaging_smoke.py` additionally runs against installed wheels in a clean environment and asserts the host, kernel and business packages are absent. PostgreSQL concurrency cases need an explicitly provided `APP_CLOUD_TEST_POSTGRES_URL`.
+
+## Email/password authentication
+
+Email/password is opt-in. Email accounts have stable random UUIDs and an independent unique `(app_id,email)` credential; email normalization only trims and lowercases. A Google account with the same email is never merged. New/reset passwords require at least 15 Unicode code points and at most 72 UTF-8 bytes; login accepts nonempty existing passwords up to 72 bytes. Passwords are never trimmed or truncated. EAPI bcrypt executes in a bounded worker pool (4 concurrent, at most 32 queued/running per service); cancellation keeps running work charged to this budget.
+
+```python
+from dwy_auth import EmailAuthConfig, EapiEmailCodeSender, SessionPolicy
+from dwyeapi.providers.email import make_email_provider
+
+# email_settings and challenge_secret come from the host's validated settings.
+# Every worker must share the same secret (at least 32 bytes). Never commit it.
+provider = make_email_provider(email_settings)
+service = AuthService(
+    "myapp", sessions, build_auth_tables(metadata), google_verifier,
+    email_sender=EapiEmailCodeSender(provider),
+    email_config=EmailAuthConfig(challenge_secret=challenge_secret),
+    session_policy=SessionPolicy(refresh_ttl=180 * 86400, rolling_refresh=True),
+)
+install_auth_routes(app, service)
+```
+
+Use the matching EAPI version containing `EmailProviderBase.send_verification_code`. This public transport-only method reuses existing Resend templates/domain policy and does not access Redis. Match the provider template TTL with `EmailAuthConfig.code_ttl`. The host owns the email sender/provider lifecycle. Without email configuration all email routes fail closed with `EMAIL_NOT_CONFIGURED`.
+
+Both authentication HTTP installers accept an optional `Accept-Language` header (maximum 512 characters) for email codes. Any valid `zh`/`zh-*` range with nonzero quality selects Chinese; missing, malformed, excluded (`zh;q=0`), or other languages select English. The subject, HTML, and plain-text body use the same language. The current Apple client explicitly sends `zh` for a Chinese first preferred language and `en` otherwise. Language is passed per call and never changes code identity or resend limits.
+
+Custom senders must accept `send(email, code, purpose, *, language="en")`; custom EAPI providers must accept `_send(target, code, *, language="en")`. Programmatic calls may pass `send_email_code(..., language="zh")`; only `zh` and `en` are supported. Configure `resend.subject` for Chinese and `resend.subject_en` for English. English brand taglines/slogans use `brand_tagline_en`/`brand_slogan_en` (empty by default), without falling back to Chinese promotional copy. Brand names remain as configured.
+
+| POST path | JSON input | SUCCESS data |
+|---|---|---|
+| `/api/v1/auth/email/code` | `email,purpose` (`register` or `password_reset`) | `challenge_id,expires_in,resend_after,code_length` |
+| `/api/v1/auth/register` | `email,password,code,challenge_id,device_id` | Existing `TokenResponse`; automatically logged in |
+| `/api/v1/auth/login` | `email,password,device_id` | Existing `TokenResponse` |
+| `/api/v1/auth/password/reset` | `email,password,code,challenge_id` | `{"status":"completed"}`; all existing user sessions revoked |
+
+Codes are six digits, expire after 300 seconds and have a 60-second resend cooldown by default. Response `expires_in` and `resend_after` report actual remaining database deadlines after delivery; a delivery that outlasts the challenge fails and removes that challenge. Only a successful delivery activates a challenge; a new delivered challenge invalidates older challenges for the same app/email/purpose. The database stores an HMAC bound to app/email/purpose/challenge, never the code. Conditional updates make consumption single-use; failed-attempt counters commit independently so business rollback cannot replenish attempts. Each challenge allows at most five attempts. Atomic SQL budgets apply per app, peer IP, purpose/email and action; send limits are 50/IP/hour, 1000/app/hour, 10/email/purpose/hour; verification is 100/IP/15min and 20/email/purpose/15min; login is 100/IP/15min and 10/email/15min. Expired counters/challenges are pruned on use. Configure trusted proxy middleware at the host if deployed behind a proxy; request forwarding headers are not read directly. Continue enforcing host request-body and ingress limits.
+
+Errors never echo submitted secrets. Public codes are `EMAIL_INVALID`, `PASSWORD_INVALID`, `EMAIL_PURPOSE_INVALID`, `EMAIL_CODE_INVALID` (wrong/expired/used/exhausted), `EMAIL_ALREADY_REGISTERED`, `CREDENTIALS_INVALID`, `EMAIL_RATE_LIMITED`, `EMAIL_NOT_CONFIGURED`, `EMAIL_DELIVERY_FAILED`. Schema validation uses the existing `VALIDATION_ERROR` envelope. Failed delivery remains charged to resend budgets to prevent abusive retries. Delivery to existing and unknown accounts follows the same public send contract.
+
+The default `SessionPolicy()` retains the existing fixed 30-day refresh deadline and 15-minute access lifetime. Explicit rolling policy extends refresh validity to 180 days on successful refresh. Old refresh digests remain replay evidence for at most `replay_retention` (default 30 days) and expire independently, so normal 15-minute refreshes do not accumulate a lifetime 4096 cap. The 4096 limit still bounds *unexpired* evidence (normal 30-day use is 2880); an abusive burst gets 429 without invalidating the current token. Refresh replay, device revocation and account deletion remain enforced. Account deletion removes email credentials/challenges transactionally; it preserves the anonymized UUID for independent purchase ledgers.
+
+### Host Alembic migration
+
+Fresh applications include all six auth tables via `build_auth_tables(metadata)` in their own migration. Existing Google-only databases must migrate before enabling the new package; `metadata.create_all` does not alter the old non-nullable subject column. Add a revision to the **host** Alembic history:
+
+```python
+from alembic import op
+from dwy_auth.migrations import upgrade_email_auth
+
+# revision/down_revision belong to the host migration history.
+def upgrade():
+    upgrade_email_auth(op)
+```
+
+The helper makes `auth_users.google_subject` nullable and creates `auth_password_credentials`, `auth_email_challenges`, `auth_rate_limits`; existing UUIDs, sessions and Google subjects remain untouched. PostgreSQL alters the column in place. SQLite uses Alembic batch mode; hosts with foreign keys enabled must follow Alembic's SQLite foreign-key PRAGMA procedure outside the transaction. Downgrade is intentionally host-owned: email-only users have null Google subjects, so restoring NOT NULL requires an explicit data-retention decision. Do not run this helper at application startup. `tests/test_email_auth.py` migrates a populated legacy Google schema and verifies both existing sessions and new email registration afterward.

dwy_auth-0.1.0/pyproject.toml

@@ -0,0 +1,28 @@
+[project]
+name = "dwy-auth"
+version = "0.1.0"
+description = "Google and email/password user sessions and independent administrator Cookie authentication for EAPI"
+readme = "README.md"
+requires-python = ">=3.11,<3.13"
+dependencies = ["SQLAlchemy[asyncio]==2.0.49", "pydantic==2.13.4", "google-auth[requests]==2.62.0", "anyio>=4.0.0", "bcrypt>=4.0.0", "python-jose[cryptography]>=3.3.0"]
+
+[build-system]
+requires = ["hatchling==1.27.0"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/dwy_auth"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 110
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B"]
+
+[project.optional-dependencies]
+dev = ["pytest==9.0.3", "pytest-asyncio==1.3.0", "httpx==0.28.1", "aiosqlite==0.22.1", "ruff==0.15.12", "alembic==1.18.4"]

dwy_auth-0.1.0/src/dwy_auth/__init__.py

@@ -0,0 +1,92 @@
+"""独立认证核心；旧 EAPI 服务/HTTP 入口按需加载，不成为核心的反向依赖。"""
+
+from importlib import import_module
+
+from .contracts import AuthPrincipal, SessionBackend, SessionTokens, VerifiedIdentity
+from .email_auth import (
+    EapiEmailCodeSender,
+    EmailAuthConfig,
+    EmailCodeChallenge,
+    EmailCodeSender,
+    SessionPolicy,
+)
+from .google import OfficialGoogleVerifier
+from .models import (
+    AccountDeletion,
+    AuthError,
+    DevicePage,
+    DeviceQuery,
+    DeviceSummary,
+    GoogleConfig,
+    GoogleIdentity,
+    GoogleVerifier,
+    TokenResponse,
+    UserProfile,
+)
+from .session_backend import JWTSessionBackend
+from .session_storage import SessionTables, register_session_tables
+from .storage import AuthTables, build_auth_tables
+
+# 兼容旧消费者的显式导入；import dwy_auth 不隐式加载 EAPI/FastAPI。
+_LAZY_EXPORTS = {
+    "AuthService": (".service", "AuthService"),
+    "install_auth_routes": (".http", "install_auth_routes"),
+    "AuthRuntime": (".runtime", "AuthRuntime"),
+    "RuntimeTables": (".runtime_storage", "RuntimeTables"),
+    "build_runtime_tables": (".runtime_storage", "build_runtime_tables"),
+    "SubjectAdapter": (".subjects", "SubjectAdapter"),
+    "SubjectRegistration": (".subjects", "SubjectRegistration"),
+    "ExternalIdentity": (".providers", "ExternalIdentity"),
+    "ExternalIdentityProvider": (".providers", "ExternalIdentityProvider"),
+    "GoogleIdentityProvider": (".providers", "GoogleIdentityProvider"),
+}
+
+
+def __getattr__(name: str):
+    """保留既有入口；新 runtime 使用独立合同，不依赖旧业务用户表。"""
+    target = _LAZY_EXPORTS.get(name)
+    if target is None:
+        raise AttributeError(name)
+    module, attribute = target
+    value = getattr(import_module(module, __name__), attribute)
+    globals()[name] = value
+    return value
+
+
+__all__ = [
+    "AuthPrincipal",
+    "AuthRuntime",
+    "ExternalIdentity",
+    "ExternalIdentityProvider",
+    "GoogleIdentityProvider",
+    "JWTSessionBackend",
+    "RuntimeTables",
+    "SessionBackend",
+    "SessionTables",
+    "SessionTokens",
+    "SubjectAdapter",
+    "SubjectRegistration",
+    "VerifiedIdentity",
+    "build_runtime_tables",
+    "register_session_tables",
+    "AccountDeletion",
+    "AuthError",
+    "EmailAuthConfig",
+    "EapiEmailCodeSender",
+    "EmailCodeSender",
+    "EmailCodeChallenge",
+    "SessionPolicy",
+    "AuthService",
+    "AuthTables",
+    "DevicePage",
+    "DeviceQuery",
+    "DeviceSummary",
+    "GoogleConfig",
+    "GoogleIdentity",
+    "GoogleVerifier",
+    "OfficialGoogleVerifier",
+    "TokenResponse",
+    "UserProfile",
+    "build_auth_tables",
+    "install_auth_routes",
+]

dwy_auth-0.1.0/src/dwy_auth/admin/__init__.py

@@ -0,0 +1,14 @@
+"""管理员 Cookie 认证入口，与 Google 用户会话独立。"""
+
+from .config import AdminAuthConfig
+from .http import AdminAuthBinding, install_admin_auth
+from .service import COOKIE_NAME, AdminAuth, AdminSession
+
+__all__ = [
+    "COOKIE_NAME",
+    "AdminAuth",
+    "AdminAuthBinding",
+    "AdminAuthConfig",
+    "AdminSession",
+    "install_admin_auth",
+]

dwy_auth-0.1.0/src/dwy_auth/admin/config.py

@@ -0,0 +1,40 @@
+"""管理员认证配置由宿主显式注入，不读取环境变量或业务配置。"""
+
+from urllib.parse import urlsplit
+
+from pydantic import AnyHttpUrl, BaseModel, ConfigDict, Field, SecretStr, field_validator
+
+
+class AdminAuthConfig(BaseModel):
+    """一个独立管理员 Cookie 边界；生产宿主负责启用策略与密码强度。"""
+
+    model_config = ConfigDict(extra="forbid", frozen=True, hide_input_in_errors=True)
+    username: str = Field(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_.@-]+$")
+    password: SecretStr = Field(min_length=12, max_length=256, repr=False)
+    session_seconds: int = Field(default=28800, ge=300, le=86400)
+    secure_cookie: bool = False
+    origin: str | None = Field(default=None, max_length=2048)
+
+    @field_validator("origin")
+    @classmethod
+    def validate_origin(cls, value: str | None) -> str | None:
+        """只接受单个完整 HTTP origin，保持与可信部署值精确比较。"""
+        if value is None:
+            return None
+        if any(ord(char) <= 32 or ord(char) == 127 for char in value):
+            raise ValueError("origin must be a single HTTP origin")
+        parsed = urlsplit(value)
+        if (
+            parsed.scheme not in {"http", "https"}
+            or not parsed.netloc
+            or parsed.path
+            or "?" in value
+            or "#" in value
+            or "\\" in value
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.netloc.endswith(":")
+        ):
+            raise ValueError("origin must contain only scheme, host and optional port")
+        AnyHttpUrl(value)
+        return value

dwy_auth-0.1.0/src/dwy_auth/admin/http.py

@@ -0,0 +1,175 @@
+"""独立 Cookie 登录装配；业务路由只复用返回的依赖，不进入认证包。"""
+
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Annotated
+from urllib.parse import urlsplit
+
+from dwyeapi import ApiResponse
+from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, Response
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, ConfigDict, Field
+from starlette.concurrency import run_in_threadpool
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from ..http import install_safe_validation_handler
+from .config import AdminAuthConfig
+from .service import COOKIE_NAME, AdminAuth
+
+
+class LoginRequest(BaseModel):
+    """固定有界登录 schema，错误响应不得回显密码。"""
+
+    model_config = ConfigDict(extra="forbid", hide_input_in_errors=True)
+    username: str = Field(min_length=1, max_length=64)
+    password: str = Field(min_length=1, max_length=256, repr=False)
+
+
+class AdminSecurityMiddleware:
+    """独立登录装配的有界请求与禁止缓存，不读取或拦截业务请求。"""
+
+    def __init__(self, app: ASGIApp):
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send):
+        if scope["type"] != "http" or not scope["path"].startswith("/api/admin/auth/"):
+            await self.app(scope, receive, send)
+            return
+
+        async def secure_send(message: Message):
+            if message["type"] == "http.response.start":
+                message["headers"] = [
+                    *message.get("headers", []),
+                    (b"cache-control", b"no-store"),
+                    (b"x-content-type-options", b"nosniff"),
+                ]
+            await send(message)
+
+        body = bytearray()
+        while True:
+            message = await receive()
+            if message["type"] == "http.disconnect":
+                return
+            chunk = message.get("body", b"")
+            if len(body) + len(chunk) > 4096:
+                response = JSONResponse(
+                    status_code=413,
+                    content=ApiResponse(code="REQUEST_TOO_LARGE", message="请求体超过限制").model_dump(),
+                )
+                await response(scope, receive, secure_send)
+                return
+            body.extend(chunk)
+            if not message.get("more_body", False):
+                break
+        delivered = False
+
+        async def replay() -> Message:
+            nonlocal delivered
+            if not delivered:
+                delivered = True
+                return {"type": "http.request", "body": bytes(body), "more_body": False}
+            return await receive()
+
+        await self.app(scope, replay, secure_send)
+
+
+@dataclass(frozen=True)
+class AdminAuthBinding:
+    """供宿主业务装配使用的管理员依赖，不授予任何用户 Principal。"""
+
+    auth: AdminAuth
+    require_admin: Callable[[Request], Awaitable[str]]
+    same_origin: Callable[[Request], Awaitable[None]]
+
+
+def install_admin_auth(
+    app: FastAPI, config: AdminAuthConfig, *, install_security: bool = True
+) -> AdminAuthBinding:
+    """装配登录、当前会话及退出；宿主可保留覆盖全部管理 API 的既有安全中间件。"""
+    auth = AdminAuth(config)
+    app.state.admin_auth = auth
+    install_safe_validation_handler(app)
+    if install_security:
+        app.add_middleware(AdminSecurityMiddleware)
+    router = APIRouter(prefix="/api/admin", tags=["admin"])
+
+    async def same_origin(request: Request):
+        """JSON + Strict cookie 为默认边界，额外拒绝带跨域 Origin 的写请求。"""
+        origin = request.headers.get("origin")
+        if origin is not None:
+            if len(origin) > 2048:
+                raise HTTPException(403)
+            if config.origin is not None:
+                if origin != config.origin:
+                    raise HTTPException(403)
+                return
+            try:
+                parsed = urlsplit(origin)
+            except ValueError:
+                # 无效 IPv6 等外部输入不能穿过解析边界成为内部错误。
+                raise HTTPException(403) from None
+            if parsed.scheme != request.url.scheme or parsed.netloc != request.url.netloc:
+                raise HTTPException(403)
+
+    async def require_admin(request: Request) -> str:
+        """仅接受宿主 cookie，不能将任一应用 Bearer 提升为管理员。"""
+        token = request.cookies.get(COOKIE_NAME, "")
+        session = auth.resolve(token)
+        if session is None:
+            raise HTTPException(401)
+        return session.username
+
+    @router.post("/auth/login", dependencies=[Depends(same_origin)])
+    async def login(body: LoginRequest, request: Request, response: Response):
+        """失败原因统一；密码派生移到框架线程池避免阻塞事件循环。"""
+        address = request.client.host if request.client else "unknown"
+        if not auth.allow_attempt(address):
+            # 通用 HTTPException handler 刻意丢弃 detail；此处只返回固定安全文案。
+            return JSONResponse(
+                status_code=429,
+                content=ApiResponse(
+                    code="ADMIN_RATE_LIMITED", message="登录尝试过于频繁，请在5分钟后重试"
+                ).model_dump(mode="json"),
+                headers={"Retry-After": "300"},
+            )
+        if not await run_in_threadpool(auth.authenticate, body.username, body.password):
+            return JSONResponse(
+                status_code=401,
+                content=ApiResponse(code="ADMIN_INVALID_CREDENTIALS", message="用户名或密码错误").model_dump(
+                    mode="json"
+                ),
+            )
+        previous = request.cookies.get(COOKIE_NAME, "")
+        if previous:
+            auth.revoke(previous)
+        response.set_cookie(
+            COOKIE_NAME,
+            auth.create_session(),
+            max_age=auth.lifetime,
+            httponly=True,
+            secure=config.secure_cookie,
+            samesite="strict",
+            path="/api/admin",
+        )
+        return ApiResponse.ok({"username": auth.username})
+
+    @router.get("/auth/me")
+    async def me(username: Annotated[str, Depends(require_admin)]):
+        """刷新页面只确认管理身份，不读取业务库。"""
+        return ApiResponse.ok({"username": username})
+
+    @router.post("/auth/logout", dependencies=[Depends(require_admin), Depends(same_origin)])
+    async def logout(request: Request, response: Response):
+        """退出即时撤销服务端状态，删除 cookie 使用一致路径与安全属性。"""
+        auth.revoke(request.cookies[COOKIE_NAME])
+        response.delete_cookie(
+            COOKIE_NAME,
+            path="/api/admin",
+            httponly=True,
+            secure=config.secure_cookie,
+            samesite="strict",
+        )
+        return ApiResponse.ok(None)
+
+    app.include_router(router)
+    return AdminAuthBinding(auth, require_admin, same_origin)