python-ddd-framework 0.3.2__py3-none-any.whl → 0.4.0__py3-none-any.whl

python_ddd_framework/identity/application.py

@@ -2,27 +2,23 @@
 
 from __future__ import annotations
 
-from datetime import UTC, datetime, timedelta
+from datetime import UTC, datetime
 from uuid import UUID, uuid4
 
-from ..application_services import ApplicationService, DataSeedContributor, application_service
+from ..application_services import ApplicationService, application_service
 from ..authorization import (
     CurrentUser,
     PermissionCatalog,
-    PermissionName,
     allow_anonymous,
     authorize,
 )
 from ..options import Options
+from ..seeding.contracts import DataSeedContributor
 from .contracts import (
-    IDENTITY_ROLES_MANAGE,
-    IDENTITY_USERS_MANAGE,
     AuthenticationApplicationService,
-    CreateRoleCommand,
-    CreateUserCommand,
+    ChangePasswordCommand,
     CurrentUserView,
     IdentityLoginStore,
-    IdentityManagementApplicationService,
     IdentityOptions,
     IdentityRepository,
     IdentityRole,
@@ -33,34 +29,24 @@ from .contracts import (
     RefreshSessionStore,
     RefreshTokenCommand,
     RevokeTokenCommand,
-    RoleView,
-    SetRolePermissionsCommand,
-    SetUserRolesCommand,
     TokenPair,
-    UserView,
     _normalize_name,
 )
 from .errors import (
-    IdentityConflictError,
-    IdentityResourceNotFoundError,
     InvalidCredentialsError,
 )
 from .passwords import PasswordHasher
 from .tokens import (
-    ACCESS_TOKEN_LIFETIME,
     BEARER_TOKEN_TYPE,
     JwtTokenService,
     hash_refresh_token,
     new_refresh_token,
 )
 
-FAILED_ATTEMPT_LIMIT = 5
-LOCKOUT_DURATION = timedelta(minutes=15)
-
 
 @authorize()
 @application_service(provides=AuthenticationApplicationService)
-class _AuthenticationApplicationService(ApplicationService):
+class DefaultAuthenticationApplicationService(ApplicationService):
     def __init__(
         self,
         login_store: IdentityLoginStore,
@@ -68,12 +54,16 @@ class _AuthenticationApplicationService(ApplicationService):
         passwords: PasswordHasher,
         tokens: JwtTokenService,
         current_user: CurrentUser,
+        repository: IdentityRepository,
+        options: Options[IdentityOptions],
     ) -> None:
         self._login_store = login_store
         self._sessions = sessions
         self._passwords = passwords
         self._tokens = tokens
         self._current_user = current_user
+        self._repository = repository
+        self._options = options.value
 
     @allow_anonymous
     async def login(self, command: LoginCommand) -> TokenPair:
@@ -95,8 +85,8 @@ class _AuthenticationApplicationService(ApplicationService):
                 await self._login_store.record_failure(
                     user.user_id,
                     now=now,
-                    attempt_limit=FAILED_ATTEMPT_LIMIT,
-                    lockout_duration_seconds=int(LOCKOUT_DURATION.total_seconds()),
+                    attempt_limit=self._options.failed_attempt_limit,
+                    lockout_duration_seconds=int(self._options.lockout_duration.total_seconds()),
                 )
             raise InvalidCredentialsError
 
@@ -146,6 +136,28 @@ class _AuthenticationApplicationService(ApplicationService):
             user_id=self._current_user.user_id,
             session_id=self._current_user.session_id,
             username=self._current_user.username,
+            concurrency_version=(
+                await self._repository.get_user(self._current_user.user_id)
+            ).concurrency_version,
+        )
+
+    async def change_password(self, command: ChangePasswordCommand) -> None:
+        user_id = self._current_user.user_id
+        if user_id is None:
+            raise InvalidCredentialsError
+        user = await self._repository.get_user(user_id)
+        verified, _ = await self._passwords.verify(
+            command.old_password.get_secret_value(), user.password_hash
+        )
+        if not verified:
+            raise InvalidCredentialsError
+        password_hash = await self._passwords.hash(command.new_password.get_secret_value())
+        # Hash 在线程计算；写入时重新核对版本及旧 hash，拒绝计算期间的凭据竞争。
+        await self._repository.set_password(
+            user_id,
+            password_hash,
+            command.concurrency_version,
+            expected_password_hash=user.password_hash,
         )
 
     def _token_pair(
@@ -159,77 +171,10 @@ class _AuthenticationApplicationService(ApplicationService):
             access_token=self._tokens.issue(session.user_id, session.session_id, now=now),
             refresh_token=refresh_token,
             token_type=BEARER_TOKEN_TYPE,
-            expires_in=int(ACCESS_TOKEN_LIFETIME.total_seconds()),
-        )
-
-
-@application_service(provides=IdentityManagementApplicationService)
-class _IdentityManagementApplicationService(ApplicationService):
-    def __init__(
-        self,
-        repository: IdentityRepository,
-        passwords: PasswordHasher,
-        permissions: PermissionCatalog,
-    ) -> None:
-        self._repository = repository
-        self._passwords = passwords
-        self._permissions = permissions
-
-    @authorize(IDENTITY_USERS_MANAGE)
-    async def create_user(self, command: CreateUserCommand) -> UserView:
-        normalized = _normalize_name(command.username, role="username")
-        if await self._repository.find_user_by_normalized_username(normalized) is not None:
-            raise IdentityConflictError(resource="user")
-        user = IdentityUser(
-            user_id=uuid4(),
-            username=command.username.strip(),
-            normalized_username=normalized,
-            password_hash=await self._passwords.hash(command.password.get_secret_value()),
-            is_active=True,
-            failed_access_count=0,
-            lockout_end=None,
-            permission_version=0,
+            expires_in=int(self._options.access_token_lifetime.total_seconds()),
         )
-        await self._repository.create_user(user)
-        return UserView(user.user_id, user.username, user.is_active, ())
 
-    @authorize(IDENTITY_USERS_MANAGE)
-    async def get_users(self) -> tuple[UserView, ...]:
-        return await self._repository.list_users()
 
-    @authorize(IDENTITY_ROLES_MANAGE)
-    async def create_role(self, command: CreateRoleCommand) -> RoleView:
-        normalized = _normalize_name(command.name, role="role name")
-        if await self._repository.find_role_by_normalized_name(normalized) is not None:
-            raise IdentityConflictError(resource="role")
-        role = IdentityRole(uuid4(), command.name.strip(), normalized, 0)
-        await self._repository.create_role(role)
-        return RoleView(role.role_id, role.name, ())
-
-    @authorize(IDENTITY_ROLES_MANAGE)
-    async def get_roles(self) -> tuple[RoleView, ...]:
-        return await self._repository.list_roles()
-
-    @authorize(IDENTITY_USERS_MANAGE, IDENTITY_ROLES_MANAGE)
-    async def set_user_roles(self, user_id: UUID, command: SetUserRolesCommand) -> None:
-        role_ids = tuple(dict.fromkeys(command.role_ids))
-        await self._repository.set_user_roles(user_id, role_ids)
-
-    @authorize(IDENTITY_ROLES_MANAGE)
-    async def set_role_permissions(self, role_id: UUID, command: SetRolePermissionsCommand) -> None:
-        names = tuple(PermissionName(item) for item in command.permissions)
-        if len(set(names)) != len(names):
-            raise IdentityConflictError(resource="role permission")
-        unknown = tuple(item for item in names if item not in self._permissions)
-        if unknown:
-            raise IdentityResourceNotFoundError(resource="permission")
-        await self._repository.set_role_permissions(
-            role_id,
-            tuple(item.value for item in names),
-        )
-
-
-@application_service()
 class IdentityAdminSeedContributor(DataSeedContributor):
     def __init__(
         self,
@@ -270,8 +215,11 @@ class IdentityAdminSeedContributor(DataSeedContributor):
         await self._repository.set_role_permissions(
             role.role_id,
             tuple(item.name.value for item in self._permissions.definitions),
+            role.concurrency_version,
+        )
+        await self._repository.set_user_roles(
+            user.user_id, (role.role_id,), user.concurrency_version
         )
-        await self._repository.set_user_roles(user.user_id, (role.role_id,))
 
 
 def _new_session(user_id: UUID, refresh_token: str, *, now: datetime) -> RefreshSession:

python_ddd_framework/identity/contracts.py

@@ -3,20 +3,22 @@
 from __future__ import annotations
 
 from collections.abc import Mapping
-from dataclasses import dataclass
-from datetime import datetime
+from dataclasses import dataclass, field, replace
+from datetime import datetime, timedelta
 from enum import Enum
 from typing import Annotated, Protocol
 from uuid import UUID
 
 from pydantic import BaseModel, ConfigDict, Field, SecretStr, field_validator, model_validator
 
-from ..application_services import ApplicationServiceContract
+from ..application_services import ApplicationServiceContract, PagedResult, PagedResultRequestDto
 from ..authorization import (
     CurrentUser,
     PermissionName,
     RolePermissionVersion,
 )
+from ..domain import OptimisticConcurrencyError
+from ..extensions.contracts import ExtensibleModel, ExtensionProperties, ExtensionTarget
 from ..options import BaseOptions
 
 IDENTITY_USERS_MANAGE = PermissionName("identity.users.manage")
@@ -28,6 +30,11 @@ class IdentityOptions(BaseOptions):
     audience: str
     active_kid: str
     keys: Mapping[str, SecretStr]
+    access_token_lifetime: timedelta = Field(default=timedelta(minutes=15), ge=timedelta(seconds=1))
+    refresh_inactivity_lifetime: timedelta = Field(default=timedelta(days=30), gt=timedelta(0))
+    refresh_absolute_lifetime: timedelta = Field(default=timedelta(days=90), gt=timedelta(0))
+    failed_attempt_limit: int = Field(default=5, ge=1)
+    lockout_duration: timedelta = Field(default=timedelta(minutes=15), ge=timedelta(seconds=1))
     seed_admin_username: str | None = None
     seed_admin_password: SecretStr | None = None
 
@@ -80,26 +87,80 @@ class RevokeTokenCommand(BaseModel):
     refresh_token: SecretStr
 
 
-class CreateUserCommand(BaseModel):
+class CreateUserCommand(ExtensibleModel):
     model_config = ConfigDict(frozen=True)
 
     username: Annotated[str, Field(min_length=1, max_length=120)]
     password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
 
+    @field_validator("username")
+    @classmethod
+    def _validate_username(cls, value: str) -> str:
+        _normalize_name(value, role="username")
+        return value.strip()
+
 
 class CreateRoleCommand(BaseModel):
     model_config = ConfigDict(frozen=True)
 
     name: Annotated[str, Field(min_length=1, max_length=120)]
 
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, value: str) -> str:
+        _normalize_name(value, role="role name")
+        return value.strip()
+
+
+class IdentityConcurrencyCommand(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    concurrency_version: Annotated[int, Field(ge=0)]
+
+
+class UpdateUserCommand(ExtensibleModel):
+    model_config = ConfigDict(frozen=True)
+
+    username: Annotated[str, Field(min_length=1, max_length=120)]
+    concurrency_version: Annotated[int, Field(ge=0)]
+
+    @field_validator("username")
+    @classmethod
+    def _validate_username(cls, value: str) -> str:
+        _normalize_name(value, role="username")
+        return value.strip()
+
+
+class SetUserActiveCommand(IdentityConcurrencyCommand):
+    is_active: bool
+
+
+class UpdateRoleCommand(IdentityConcurrencyCommand):
+    name: Annotated[str, Field(min_length=1, max_length=120)]
+
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, value: str) -> str:
+        _normalize_name(value, role="role name")
+        return value.strip()
+
+
+class ChangePasswordCommand(IdentityConcurrencyCommand):
+    old_password: SecretStr
+    new_password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
 
-class SetUserRolesCommand(BaseModel):
+
+class SetPasswordCommand(IdentityConcurrencyCommand):
+    new_password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
+
+
+class SetUserRolesCommand(IdentityConcurrencyCommand):
     model_config = ConfigDict(frozen=True)
 
     role_ids: tuple[UUID, ...]
 
 
-class SetRolePermissionsCommand(BaseModel):
+class SetRolePermissionsCommand(IdentityConcurrencyCommand):
     model_config = ConfigDict(frozen=True)
 
     permissions: tuple[str, ...]
@@ -113,12 +174,12 @@ class TokenPair:
     expires_in: int
 
 
-@dataclass(frozen=True, slots=True)
-class UserView:
+class UserView(ExtensibleModel):
     user_id: UUID
     username: str
     is_active: bool
     role_ids: tuple[UUID, ...]
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -126,6 +187,17 @@ class RoleView:
     role_id: UUID
     name: str
     permissions: tuple[str, ...]
+    concurrency_version: int
+
+
+class UserRolesView(BaseModel):
+    role_ids: tuple[UUID, ...]
+    concurrency_version: int
+
+
+class RolePermissionsView(BaseModel):
+    permissions: tuple[str, ...]
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -133,6 +205,7 @@ class CurrentUserView:
     user_id: UUID
     session_id: UUID
     username: str
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -145,6 +218,30 @@ class IdentityUser:
     failed_access_count: int
     lockout_end: datetime | None
     permission_version: int
+    extra_properties: ExtensionProperties = field(default_factory=ExtensionProperties)
+    concurrency_version: int = 0
+
+    def renamed(self, username: str, expected_version: int) -> IdentityUser:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            username=username.strip(),
+            normalized_username=_normalize_name(username, role="username"),
+            concurrency_version=self.concurrency_version + 1,
+        )
+
+    def with_active(self, is_active: bool, expected_version: int) -> IdentityUser:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            is_active=is_active,
+            concurrency_version=self.concurrency_version + (self.is_active != is_active),
+        )
+
+
+IDENTITY_USER_EXTENSION = ExtensionTarget(
+    "identity.user", (CreateUserCommand, UpdateUserCommand, UserView), IdentityUser
+)
 
 
 @dataclass(frozen=True, slots=True)
@@ -153,6 +250,16 @@ class IdentityRole:
     name: str
     normalized_name: str
     permission_version: int
+    concurrency_version: int = 0
+
+    def renamed(self, name: str, expected_version: int) -> IdentityRole:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            name=name.strip(),
+            normalized_name=_normalize_name(name, role="role name"),
+            concurrency_version=self.concurrency_version + 1,
+        )
 
 
 @dataclass(frozen=True, slots=True)
@@ -188,17 +295,46 @@ class IdentityRepository(Protocol):
 
     async def create_user(self, user: IdentityUser) -> None: ...
 
-    async def list_users(self) -> tuple[UserView, ...]: ...
+    async def get_user(self, user_id: UUID) -> IdentityUser: ...
+
+    async def get_user_view(self, user_id: UUID) -> UserView: ...
+
+    async def list_users(self, query: PagedResultRequestDto) -> PagedResult[UserView]: ...
+
+    async def update_user(self, user_id: UUID, command: UpdateUserCommand) -> UserView: ...
+
+    async def set_user_active(self, user_id: UUID, command: SetUserActiveCommand) -> UserView: ...
+
+    async def delete_user(self, user_id: UUID, concurrency_version: int) -> None: ...
+
+    async def set_password(
+        self,
+        user_id: UUID,
+        password_hash: str,
+        concurrency_version: int,
+        *,
+        expected_password_hash: str | None = None,
+    ) -> None: ...
 
     async def create_role(self, role: IdentityRole) -> None: ...
 
     async def find_role_by_normalized_name(self, normalized_name: str) -> IdentityRole | None: ...
 
-    async def list_roles(self) -> tuple[RoleView, ...]: ...
+    async def get_role(self, role_id: UUID) -> RoleView: ...
+
+    async def list_roles(self, query: PagedResultRequestDto) -> PagedResult[RoleView]: ...
+
+    async def update_role(self, role_id: UUID, command: UpdateRoleCommand) -> RoleView: ...
 
-    async def set_user_roles(self, user_id: UUID, role_ids: tuple[UUID, ...]) -> None: ...
+    async def delete_role(self, role_id: UUID, concurrency_version: int) -> None: ...
 
-    async def set_role_permissions(self, role_id: UUID, permissions: tuple[str, ...]) -> None: ...
+    async def set_user_roles(
+        self, user_id: UUID, role_ids: tuple[UUID, ...], concurrency_version: int
+    ) -> UserRolesView: ...
+
+    async def set_role_permissions(
+        self, role_id: UUID, permissions: tuple[str, ...], concurrency_version: int
+    ) -> RolePermissionsView: ...
 
 
 class IdentityAccessStore(Protocol):
@@ -259,21 +395,45 @@ class AuthenticationApplicationService(ApplicationServiceContract, Protocol):
 
     async def me(self) -> CurrentUserView: ...
 
+    async def change_password(self, command: ChangePasswordCommand) -> None: ...
+
 
 class IdentityManagementApplicationService(ApplicationServiceContract, Protocol):
     async def create_user(self, command: CreateUserCommand) -> UserView: ...
 
-    async def get_users(self) -> tuple[UserView, ...]: ...
+    async def get_user(self, user_id: UUID) -> UserView: ...
+
+    async def get_users(self, query: PagedResultRequestDto) -> PagedResult[UserView]: ...
+
+    async def update_user(self, user_id: UUID, command: UpdateUserCommand) -> UserView: ...
+
+    async def set_user_active(self, user_id: UUID, command: SetUserActiveCommand) -> UserView: ...
+
+    async def delete_user(self, user_id: UUID, command: IdentityConcurrencyCommand) -> None: ...
+
+    async def set_password(self, user_id: UUID, command: SetPasswordCommand) -> None: ...
 
     async def create_role(self, command: CreateRoleCommand) -> RoleView: ...
 
-    async def get_roles(self) -> tuple[RoleView, ...]: ...
+    async def get_role(self, role_id: UUID) -> RoleView: ...
 
-    async def set_user_roles(self, user_id: UUID, command: SetUserRolesCommand) -> None: ...
+    async def get_roles(self, query: PagedResultRequestDto) -> PagedResult[RoleView]: ...
+
+    async def update_role(self, role_id: UUID, command: UpdateRoleCommand) -> RoleView: ...
+
+    async def delete_role(self, role_id: UUID, command: IdentityConcurrencyCommand) -> None: ...
+
+    async def get_user_roles(self, user_id: UUID) -> UserRolesView: ...
+
+    async def get_role_permissions(self, role_id: UUID) -> RolePermissionsView: ...
+
+    async def set_user_roles(
+        self, user_id: UUID, command: SetUserRolesCommand
+    ) -> UserRolesView: ...
 
     async def set_role_permissions(
         self, role_id: UUID, command: SetRolePermissionsCommand
-    ) -> None: ...
+    ) -> RolePermissionsView: ...
 
 
 def _normalize_name(value: str, *, role: str) -> str:
@@ -281,3 +441,8 @@ def _normalize_name(value: str, *, role: str) -> str:
     if not normalized or len(normalized) > 120:
         raise ValueError(f"{role} must contain between 1 and 120 characters")
     return normalized
+
+
+def _check_version(actual: int, expected: int) -> None:
+    if actual != expected:
+        raise OptimisticConcurrencyError

python_ddd_framework/identity/http_api.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from ..fastapi import ApplicationServiceRouteOverride, exposes_application_services
+from ..fastapi import ApplicationServiceRouteOverride, FastApiModule, exposes_application_services
 from ..modularity import AppModule
 from .contracts import AuthenticationApplicationService, IdentityManagementApplicationService
 from .module import IdentityModule
@@ -12,6 +12,83 @@ from .module import IdentityModule
     IdentityModule,
     root_path="identity",
     overrides=(
+        ApplicationServiceRouteOverride(
+            AuthenticationApplicationService,
+            method=AuthenticationApplicationService.change_password,
+            path="/auth/password",
+            verb="PUT",
+            operation_id="identity_change_password",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_user,
+            path="/identity/users/{user_id}",
+            verb="GET",
+            operation_id="identity_get_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.update_user,
+            path="/identity/users/{user_id}",
+            verb="PUT",
+            operation_id="identity_update_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.delete_user,
+            path="/identity/users/{user_id}",
+            verb="DELETE",
+            operation_id="identity_delete_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.set_user_active,
+            path="/identity/users/{user_id}/active",
+            verb="PUT",
+            operation_id="identity_set_user_active",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.set_password,
+            path="/identity/users/{user_id}/password",
+            verb="PUT",
+            operation_id="identity_set_password",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_user_roles,
+            path="/identity/users/{user_id}/roles",
+            verb="GET",
+            operation_id="identity_get_user_roles",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_role,
+            path="/identity/roles/{role_id}",
+            verb="GET",
+            operation_id="identity_get_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.update_role,
+            path="/identity/roles/{role_id}",
+            verb="PUT",
+            operation_id="identity_update_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.delete_role,
+            path="/identity/roles/{role_id}",
+            verb="DELETE",
+            operation_id="identity_delete_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_role_permissions,
+            path="/identity/roles/{role_id}/permissions",
+            verb="GET",
+            operation_id="identity_get_role_permissions",
+        ),
         ApplicationServiceRouteOverride(
             AuthenticationApplicationService,
             method=AuthenticationApplicationService.login,
@@ -87,4 +164,4 @@ from .module import IdentityModule
     ),
 )
 class IdentityHttpApiModule(AppModule):
-    dependencies = (IdentityModule,)
+    dependencies = (FastApiModule,)