mdbq 4.0.127__tar.gz → 4.0.129__tar.gz

{mdbq-4.0.127 → mdbq-4.0.129}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdbq
-Version: 4.0.127
+Version: 4.0.129
 Home-page: https://pypi.org/project/mdbq
 Author: xigua, 
 Author-email: 2587125111@qq.com

mdbq-4.0.129/mdbq/__version__.py

@@ -0,0 +1 @@
+VERSION = '4.0.129'

{mdbq-4.0.127 → mdbq-4.0.129}/mdbq/auth/auth_backend.py

@@ -37,6 +37,75 @@ except ImportError:
     request = None
 
 
+# 角色权限配置
+ROLE_PERMISSIONS = {
+    "super_admin": [
+        # 所有权限
+        "read", "write", "delete", "admin", "database",
+        "execute", "import", "export", "backup", "restore",
+        "create", "update", "publish", "moderate",
+        "configure", "settings", "maintenance",
+        "user_management", "role_management", "permission_management",
+        "view_logs", "view_analytics", "audit", "monitor",
+        "security_audit", "access_control",
+        "api_read", "api_write", "webhook", "integration",
+        "file_upload", "file_download", "file_manage",
+        "resource_quota", "storage_manage"
+    ],
+    
+    "admin": [
+        # 管理员权限（除了系统级配置）
+        "read", "write", "delete", "database",
+        "execute", "import", "export", "backup",
+        "create", "update", "publish", "moderate",
+        "user_management", "view_logs", "view_analytics",
+        "audit", "monitor", "api_read", "api_write",
+        "file_upload", "file_download", "file_manage"
+    ],
+    
+    "manager": [
+        # 经理权限
+        "read", "write", "database",
+        "create", "update", "publish", "moderate",
+        "import", "export", "view_analytics",
+        "api_read", "file_upload", "file_download"
+    ],
+    
+    "editor": [
+        # 编辑权限
+        "read", "write", "create", "update",
+        "file_upload", "file_download", "api_read"
+    ],
+
+    "user": [
+        # 普通用户权限
+        "read", "write", "create", "update", "database", 
+        "file_upload", "file_download", "api_read"
+    ],
+
+    "vi_user": [
+        # 降级的用户权限
+        "read", "database", 
+        "file_upload", "file_download", "api_read"
+    ],
+    
+    "viewer": [
+        # 只读权限
+        "read", "view_analytics", "file_download"
+    ],
+    
+    "api_user": [
+        # API专用用户
+        "api_read", "api_write", "read", "write"
+    ],
+    
+    "auditor": [
+        # 审计员权限
+        "read", "view_logs", "view_analytics", "audit", "monitor"
+    ]
+}
+
+
 class StandaloneAuthManager:
     """独立的身份验证管理器"""
     
@@ -155,7 +224,7 @@ class StandaloneAuthManager:
                     password_hash VARCHAR(128) NOT NULL,
                     password_plain TEXT NOT NULL,
                     salt VARCHAR(64) NOT NULL,
-                    role ENUM('admin', 'user', 'manager') NOT NULL DEFAULT 'user',
+                    role ENUM('super_admin', 'admin', 'manager', 'editor', 'user', 'viewer', 'api_user', 'auditor') NOT NULL DEFAULT 'user',
                     permissions JSON DEFAULT (JSON_ARRAY()),
                     is_active TINYINT(1) NOT NULL DEFAULT 1,
                     created_at TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
@@ -429,7 +498,7 @@ class StandaloneAuthManager:
             
             # 设置默认权限
             if permissions is None:
-                permissions = ['read'] if role == 'user' else ['read', 'write']
+                permissions = ROLE_PERMISSIONS.get(role, ['read'])
             permissions_json = json.dumps(permissions)
             
             # 创建新用户

{mdbq-4.0.127 → mdbq-4.0.129}/mdbq/auth/crypto.py

@@ -118,7 +118,7 @@ class KeyManager:
             return public_key_pem
             
         except Exception as e:
-            self.logger.error(f"读取公钥失败: {str(e)}")
+            self.logger.error("读取公钥失败", {'error': str(e)})
             return None
     
     def get_private_key(self) -> Optional[Any]:
@@ -154,7 +154,7 @@ class KeyManager:
             return private_key
             
         except Exception as e:
-            self.logger.error(f"读取私钥失败: {str(e)}")
+            self.logger.error("读取私钥失败", {'error': str(e)})
             return None
     
     def clear_cache(self):
@@ -177,36 +177,59 @@ class CryptoService:
         try:
             # 解析加密数据
             encrypted_data = json.loads(base64.b64decode(encrypted_token))
-            
+
             # 获取私钥
             private_key = self.key_manager.get_private_key()
             if not private_key:
+                self.logger.error("无法获取私钥")
                 return None
             
             # 解密AES密钥
             encrypted_aes_key = base64.b64decode(encrypted_data['key'])
-            aes_key = private_key.decrypt(
-                encrypted_aes_key,
-                padding.OAEP(
-                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
-                    algorithm=hashes.SHA256(),
-                    label=None
+            
+            # 使用SHA-512加密算法
+            try:
+                aes_key = private_key.decrypt(
+                    encrypted_aes_key,
+                    padding.OAEP(
+                        mgf=padding.MGF1(algorithm=hashes.SHA512()),
+                        algorithm=hashes.SHA512(),
+                        label=None
+                    )
                 )
-            )
+            except Exception as decrypt_error:
+                self.logger.error("RSA解密失败", {'error': str(decrypt_error)})
             
             # 解密数据
             iv = base64.b64decode(encrypted_data['iv'])
             ciphertext = base64.b64decode(encrypted_data['ciphertext'])
             
-            aesgcm = AESGCM(aes_key)
-            decrypted_data = aesgcm.decrypt(iv, ciphertext, None)
+            # 检查是否有认证标签（AES-GCM需要）
+            if 'tag' in encrypted_data:
+                tag = base64.b64decode(encrypted_data['tag'])
+                # 将tag附加到密文末尾（AES-GCM标准做法）
+                ciphertext_with_tag = ciphertext + tag
+            else:
+                # 如果没有tag，假设密文已经包含tag
+                ciphertext_with_tag = ciphertext
+            
+            try:
+                aesgcm = AESGCM(aes_key)
+                decrypted_data = aesgcm.decrypt(iv, ciphertext_with_tag, None)
+            except Exception as aes_error:
+                self.logger.error("AES-GCM解密失败", {'error': str(aes_error)})
+                return None
             
             # 解析JSON
-            payload = json.loads(decrypted_data.decode('utf-8'))
-            return payload
+            try:
+                payload = json.loads(decrypted_data.decode('utf-8'))
+                return payload
+            except json.JSONDecodeError as json_error:
+                self.logger.error("JSON解析失败", {'error': str(json_error)})
+                return None
             
         except Exception as e:
-            self.logger.error(f"解密失败: {str(e)}")
+            self.logger.error("解密失败", {'error': str(e)})
             return None
 
 
@@ -260,7 +283,7 @@ class Validator:
             return True
             
         except Exception as e:
-            self.logger.error(f"Nonce验证失败: {str(e)}")
+            self.logger.error("Nonce验证失败", {'error': str(e)})
             return False
     
     def validate(self, payload: Dict[str, Any]) -> bool:
@@ -362,6 +385,25 @@ class OptimizedCryptoManager:
         """
         return self.crypto_service.decrypt_token(encrypted_token)
     
+    def validate_payload(self, payload: Dict[str, Any]) -> bool:
+        """
+        验证解密后的载荷数据
+        
+        Args:
+            payload: 解密后的载荷数据
+            
+        Returns:
+            验证是否通过
+        """
+        if not payload:
+            return False
+        
+        try:
+            return self.validator.validate(payload)
+        except Exception as e:
+            self.logger.error("载荷验证异常", {'error': str(e)})
+            return False
+    
     def get_public_key(self) -> Optional[str]:
         """获取PEM格式的公钥字符串"""
         return self.key_manager.get_public_key()

{mdbq-4.0.127 → mdbq-4.0.129}/mdbq.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdbq
-Version: 4.0.127
+Version: 4.0.129
 Home-page: https://pypi.org/project/mdbq
 Author: xigua, 
 Author-email: 2587125111@qq.com

mdbq-4.0.127/mdbq/__version__.py

@@ -1 +0,0 @@
-VERSION = '4.0.127'