mdbq 4.0.127__py3-none-any.whl → 4.0.129__py3-none-any.whl

mdbq/__version__.py

@@ -1 +1 @@
-VERSION = '4.0.127'
+VERSION = '4.0.129'

mdbq/auth/auth_backend.py

@@ -37,6 +37,75 @@ except ImportError:
     request = None
 
 
+# 角色权限配置
+ROLE_PERMISSIONS = {
+    "super_admin": [
+        # 所有权限
+        "read", "write", "delete", "admin", "database",
+        "execute", "import", "export", "backup", "restore",
+        "create", "update", "publish", "moderate",
+        "configure", "settings", "maintenance",
+        "user_management", "role_management", "permission_management",
+        "view_logs", "view_analytics", "audit", "monitor",
+        "security_audit", "access_control",
+        "api_read", "api_write", "webhook", "integration",
+        "file_upload", "file_download", "file_manage",
+        "resource_quota", "storage_manage"
+    ],
+    
+    "admin": [
+        # 管理员权限（除了系统级配置）
+        "read", "write", "delete", "database",
+        "execute", "import", "export", "backup",
+        "create", "update", "publish", "moderate",
+        "user_management", "view_logs", "view_analytics",
+        "audit", "monitor", "api_read", "api_write",
+        "file_upload", "file_download", "file_manage"
+    ],
+    
+    "manager": [
+        # 经理权限
+        "read", "write", "database",
+        "create", "update", "publish", "moderate",
+        "import", "export", "view_analytics",
+        "api_read", "file_upload", "file_download"
+    ],
+    
+    "editor": [
+        # 编辑权限
+        "read", "write", "create", "update",
+        "file_upload", "file_download", "api_read"
+    ],
+
+    "user": [
+        # 普通用户权限
+        "read", "write", "create", "update", "database", 
+        "file_upload", "file_download", "api_read"
+    ],
+
+    "vi_user": [
+        # 降级的用户权限
+        "read", "database", 
+        "file_upload", "file_download", "api_read"
+    ],
+    
+    "viewer": [
+        # 只读权限
+        "read", "view_analytics", "file_download"
+    ],
+    
+    "api_user": [
+        # API专用用户
+        "api_read", "api_write", "read", "write"
+    ],
+    
+    "auditor": [
+        # 审计员权限
+        "read", "view_logs", "view_analytics", "audit", "monitor"
+    ]
+}
+
+
 class StandaloneAuthManager:
     """独立的身份验证管理器"""
     
@@ -155,7 +224,7 @@ class StandaloneAuthManager:
                     password_hash VARCHAR(128) NOT NULL,
                     password_plain TEXT NOT NULL,
                     salt VARCHAR(64) NOT NULL,
-                    role ENUM('admin', 'user', 'manager') NOT NULL DEFAULT 'user',
+                    role ENUM('super_admin', 'admin', 'manager', 'editor', 'user', 'viewer', 'api_user', 'auditor') NOT NULL DEFAULT 'user',
                     permissions JSON DEFAULT (JSON_ARRAY()),
                     is_active TINYINT(1) NOT NULL DEFAULT 1,
                     created_at TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
@@ -429,7 +498,7 @@ class StandaloneAuthManager:
             
             # 设置默认权限
             if permissions is None:
-                permissions = ['read'] if role == 'user' else ['read', 'write']
+                permissions = ROLE_PERMISSIONS.get(role, ['read'])
             permissions_json = json.dumps(permissions)
             
             # 创建新用户

mdbq/auth/crypto.py

@@ -118,7 +118,7 @@ class KeyManager:
             return public_key_pem
             
         except Exception as e:
-            self.logger.error(f"读取公钥失败: {str(e)}")
+            self.logger.error("读取公钥失败", {'error': str(e)})
             return None
     
     def get_private_key(self) -> Optional[Any]:
@@ -154,7 +154,7 @@ class KeyManager:
             return private_key
             
         except Exception as e:
-            self.logger.error(f"读取私钥失败: {str(e)}")
+            self.logger.error("读取私钥失败", {'error': str(e)})
             return None
     
     def clear_cache(self):
@@ -177,36 +177,59 @@ class CryptoService:
         try:
             # 解析加密数据
             encrypted_data = json.loads(base64.b64decode(encrypted_token))
-            
+
             # 获取私钥
             private_key = self.key_manager.get_private_key()
             if not private_key:
+                self.logger.error("无法获取私钥")
                 return None
             
             # 解密AES密钥
             encrypted_aes_key = base64.b64decode(encrypted_data['key'])
-            aes_key = private_key.decrypt(
-                encrypted_aes_key,
-                padding.OAEP(
-                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
-                    algorithm=hashes.SHA256(),
-                    label=None
+            
+            # 使用SHA-512加密算法
+            try:
+                aes_key = private_key.decrypt(
+                    encrypted_aes_key,
+                    padding.OAEP(
+                        mgf=padding.MGF1(algorithm=hashes.SHA512()),
+                        algorithm=hashes.SHA512(),
+                        label=None
+                    )
                 )
-            )
+            except Exception as decrypt_error:
+                self.logger.error("RSA解密失败", {'error': str(decrypt_error)})
             
             # 解密数据
             iv = base64.b64decode(encrypted_data['iv'])
             ciphertext = base64.b64decode(encrypted_data['ciphertext'])
             
-            aesgcm = AESGCM(aes_key)
-            decrypted_data = aesgcm.decrypt(iv, ciphertext, None)
+            # 检查是否有认证标签（AES-GCM需要）
+            if 'tag' in encrypted_data:
+                tag = base64.b64decode(encrypted_data['tag'])
+                # 将tag附加到密文末尾（AES-GCM标准做法）
+                ciphertext_with_tag = ciphertext + tag
+            else:
+                # 如果没有tag，假设密文已经包含tag
+                ciphertext_with_tag = ciphertext
+            
+            try:
+                aesgcm = AESGCM(aes_key)
+                decrypted_data = aesgcm.decrypt(iv, ciphertext_with_tag, None)
+            except Exception as aes_error:
+                self.logger.error("AES-GCM解密失败", {'error': str(aes_error)})
+                return None
             
             # 解析JSON
-            payload = json.loads(decrypted_data.decode('utf-8'))
-            return payload
+            try:
+                payload = json.loads(decrypted_data.decode('utf-8'))
+                return payload
+            except json.JSONDecodeError as json_error:
+                self.logger.error("JSON解析失败", {'error': str(json_error)})
+                return None
             
         except Exception as e:
-            self.logger.error(f"解密失败: {str(e)}")
+            self.logger.error("解密失败", {'error': str(e)})
             return None
 
 
@@ -260,7 +283,7 @@ class Validator:
             return True
             
         except Exception as e:
-            self.logger.error(f"Nonce验证失败: {str(e)}")
+            self.logger.error("Nonce验证失败", {'error': str(e)})
             return False
     
     def validate(self, payload: Dict[str, Any]) -> bool:
@@ -362,6 +385,25 @@ class OptimizedCryptoManager:
         """
         return self.crypto_service.decrypt_token(encrypted_token)
     
+    def validate_payload(self, payload: Dict[str, Any]) -> bool:
+        """
+        验证解密后的载荷数据
+        
+        Args:
+            payload: 解密后的载荷数据
+            
+        Returns:
+            验证是否通过
+        """
+        if not payload:
+            return False
+        
+        try:
+            return self.validator.validate(payload)
+        except Exception as e:
+            self.logger.error("载荷验证异常", {'error': str(e)})
+            return False
+    
     def get_public_key(self) -> Optional[str]:
         """获取PEM格式的公钥字符串"""
         return self.key_manager.get_public_key()

{mdbq-4.0.127.dist-info → mdbq-4.0.129.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdbq
-Version: 4.0.127
+Version: 4.0.129
 Home-page: https://pypi.org/project/mdbq
 Author: xigua, 
 Author-email: 2587125111@qq.com

{mdbq-4.0.127.dist-info → mdbq-4.0.129.dist-info}/RECORD

@@ -1,8 +1,8 @@
 mdbq/__init__.py,sha256=Il5Q9ATdX8yXqVxtP_nYqUhExzxPC_qk_WXQ_4h0exg,16
-mdbq/__version__.py,sha256=1iNADEmkQ5cyRDGKiYqPAGaqowFHtuw0E9k0KMu7_mI,19
+mdbq/__version__.py,sha256=jp1E2MHjKBlC7Viq_dGjHn-n6wM-iPGTZ_L6qNhwcwc,19
 mdbq/auth/__init__.py,sha256=pnPMAt63sh1B6kEvmutUuro46zVf2v2YDAG7q-jV_To,24
-mdbq/auth/auth_backend.py,sha256=FGyl3EYcVAqHuCd5oojFC9A4Tl88F0YVAfMIKEfforQ,97822
-mdbq/auth/crypto.py,sha256=4fElTdT1DTmKhI9cwhjan5mX6NOZtRsDQk2o_IBxpic,14297
+mdbq/auth/auth_backend.py,sha256=n-oarg5Gv_vM2OjZvPqMyqnHCjPeBqV5eXp-WoAk6cM,99909
+mdbq/auth/crypto.py,sha256=fcZRFCnrKVVdWDUx_zds51ynFYwS9DBvJOrRQVldrfM,15931
 mdbq/auth/rate_limiter.py,sha256=1m_Paxp8pDNpmyoFGRpFMVOJpbmeIvfVcfiQ2oH72qM,32850
 mdbq/js/__init__.py,sha256=hpMi3_ZKwIWkzc0LnKL-SY9AS-7PYFHq0izYTgEvxjc,30
 mdbq/js/jc.py,sha256=6Rgf1WqaJJ1oevpn-pt08gXKbX5hjoQaV6uZGCAGbYw,13177
@@ -35,7 +35,7 @@ mdbq/route/routes.py,sha256=QVGfTvDgu0CpcKCvk1ra74H8uojgqTLUav1fnVAqLEA,29433
 mdbq/selenium/__init__.py,sha256=AKzeEceqZyvqn2dEDoJSzDQnbuENkJSHAlbHAD0u0ZI,10
 mdbq/selenium/get_driver.py,sha256=1NTlVUE6QsyjTrVVVqTO2LOnYf578ccFWlWnvIXGtic,20903
 mdbq/spider/__init__.py,sha256=RBMFXGy_jd1HXZhngB2T2XTvJqki8P_Fr-pBcwijnew,18
-mdbq-4.0.127.dist-info/METADATA,sha256=wCrc5FfiDE4x0-vaMm39GQfFhXDLxcxpwH46swnFUv0,365
-mdbq-4.0.127.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-mdbq-4.0.127.dist-info/top_level.txt,sha256=2FQ-uLnCSB-OwFiWntzmwosW3X2Xqsg0ewh1axsaylA,5
-mdbq-4.0.127.dist-info/RECORD,,
+mdbq-4.0.129.dist-info/METADATA,sha256=DB7USbwiD3-cSUA6AFusybJuOShQakubfaTA6RFFYRo,365
+mdbq-4.0.129.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+mdbq-4.0.129.dist-info/top_level.txt,sha256=2FQ-uLnCSB-OwFiWntzmwosW3X2Xqsg0ewh1axsaylA,5
+mdbq-4.0.129.dist-info/RECORD,,