python-ddd-framework 0.3.2__py3-none-any.whl → 0.4.0__py3-none-any.whl

python_ddd_framework/identity/sqlalchemy/stores.py

@@ -3,231 +3,50 @@
 from __future__ import annotations
 
 from datetime import datetime, timedelta
-from hashlib import blake2b
 from uuid import UUID
 
-from sqlalchemy import func, select
-from sqlalchemy.exc import IntegrityError
-from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
 
 from ...authorization import CurrentUser, RolePermissionVersion
-from ...sqlalchemy import FrameworkAsyncSession, SqlAlchemySessionProvider
+from ...options import Options
+from ...sqlalchemy import FrameworkAsyncSession, SqlAlchemyModelCatalog
 from ...sqlalchemy.runtime import _SqlAlchemyEngineRegistry
 from ..contracts import (
-    IdentityRole,
+    IDENTITY_USER_EXTENSION,
+    IdentityOptions,
     IdentityUser,
     RefreshRotationResult,
     RefreshRotationStatus,
     RefreshSession,
-    RoleView,
-    UserView,
 )
-from ..errors import IdentityConflictError, IdentityResourceNotFoundError
-from ..tokens import REFRESH_ABSOLUTE_LIFETIME, REFRESH_INACTIVITY_LIFETIME
 from .models import (
     RefreshSessionRow,
     RolePermissionRow,
     RoleRow,
     UserRoleRow,
-    UserRow,
+    UserRowValues,
+)
+from .repository import _user_value
+from .session_security import (
+    _lock_identity_user,
+    _lock_refresh_family,
+    _revoke_family,
+    _session_is_active,
 )
-
-_REFRESH_FAMILY_LOCK_PERSON = b"pyplat.rfam.v1"
-
-
-class SqlAlchemyIdentityRepository:
-    __slots__ = ("_provider",)
-
-    def __init__(self, provider: SqlAlchemySessionProvider) -> None:
-        self._provider = provider
-
-    async def find_user_by_normalized_username(
-        self,
-        normalized_username: str,
-    ) -> IdentityUser | None:
-        async with self._provider.operation("find_user_by_normalized_username"):
-            session = await self._provider.get_session()
-            statement = select(UserRow).where(UserRow.normalized_username == normalized_username)
-            row = await session.scalar(statement)
-            return None if row is None else _user_value(row)
-
-    async def create_user(self, user: IdentityUser) -> None:
-        async with self._provider.operation("create_user"):
-            session = await self._provider.get_session()
-            session.add(
-                UserRow(
-                    user_id=user.user_id,
-                    username=user.username,
-                    normalized_username=user.normalized_username,
-                    password_hash=user.password_hash,
-                    is_active=user.is_active,
-                    failed_access_count=user.failed_access_count,
-                    lockout_end=user.lockout_end,
-                    permission_version=user.permission_version,
-                )
-            )
-            await self._flush_unique("user")
-
-    async def list_users(self) -> tuple[UserView, ...]:
-        async with self._provider.operation("list_users"):
-            session = await self._provider.get_session()
-            rows = tuple(
-                (await session.scalars(select(UserRow).order_by(UserRow.normalized_username))).all()
-            )
-            role_rows = (
-                await session.execute(
-                    select(UserRoleRow.user_id, UserRoleRow.role_id).order_by(
-                        UserRoleRow.user_id, UserRoleRow.role_id
-                    )
-                )
-            ).all()
-            roles_by_user: dict[UUID, list[UUID]] = {}
-            for user_id, role_id in role_rows:
-                roles_by_user.setdefault(user_id, []).append(role_id)
-            return tuple(
-                UserView(
-                    user_id=row.user_id,
-                    username=row.username,
-                    is_active=row.is_active,
-                    role_ids=tuple(roles_by_user.get(row.user_id, ())),
-                )
-                for row in rows
-            )
-
-    async def create_role(self, role: IdentityRole) -> None:
-        async with self._provider.operation("create_role"):
-            session = await self._provider.get_session()
-            session.add(
-                RoleRow(
-                    role_id=role.role_id,
-                    name=role.name,
-                    normalized_name=role.normalized_name,
-                    permission_version=role.permission_version,
-                )
-            )
-            await self._flush_unique("role")
-
-    async def find_role_by_normalized_name(self, normalized_name: str) -> IdentityRole | None:
-        async with self._provider.operation("find_role_by_normalized_name"):
-            session = await self._provider.get_session()
-            row = await session.scalar(
-                select(RoleRow).where(RoleRow.normalized_name == normalized_name)
-            )
-            return None if row is None else _role_value(row)
-
-    async def list_roles(self) -> tuple[RoleView, ...]:
-        async with self._provider.operation("list_roles"):
-            session = await self._provider.get_session()
-            roles = tuple(
-                (await session.scalars(select(RoleRow).order_by(RoleRow.normalized_name))).all()
-            )
-            permission_rows = (
-                await session.execute(
-                    select(RolePermissionRow.role_id, RolePermissionRow.permission_name).order_by(
-                        RolePermissionRow.role_id, RolePermissionRow.permission_name
-                    )
-                )
-            ).all()
-            permissions_by_role: dict[UUID, list[str]] = {}
-            for role_id, permission_name in permission_rows:
-                permissions_by_role.setdefault(role_id, []).append(permission_name)
-            return tuple(
-                RoleView(
-                    role_id=row.role_id,
-                    name=row.name,
-                    permissions=tuple(permissions_by_role.get(row.role_id, ())),
-                )
-                for row in roles
-            )
-
-    async def set_user_roles(self, user_id: UUID, role_ids: tuple[UUID, ...]) -> None:
-        async with self._provider.operation("set_user_roles"):
-            session = await self._provider.get_session()
-            user = await self._require_user(user_id, for_update=True)
-            requested = frozenset(role_ids)
-            roles = tuple(
-                (
-                    await session.scalars(
-                        select(RoleRow).where(RoleRow.role_id.in_(requested)).with_for_update()
-                    )
-                ).all()
-            )
-            if len(roles) != len(requested):
-                raise IdentityResourceNotFoundError(resource="role")
-            existing = tuple(
-                (
-                    await session.scalars(
-                        select(UserRoleRow).where(UserRoleRow.user_id == user_id).with_for_update()
-                    )
-                ).all()
-            )
-            current = frozenset(item.role_id for item in existing)
-            if current == requested:
-                return
-            for item in existing:
-                if item.role_id not in requested:
-                    await session.delete(item)
-            for role_id in sorted(requested - current):
-                session.add(UserRoleRow(user_id=user_id, role_id=role_id))
-            user.permission_version += 1
-
-    async def set_role_permissions(self, role_id: UUID, permissions: tuple[str, ...]) -> None:
-        async with self._provider.operation("set_role_permissions"):
-            session = await self._provider.get_session()
-            role = await self._require_role(role_id, for_update=True)
-            requested = frozenset(permissions)
-            existing = tuple(
-                (
-                    await session.scalars(
-                        select(RolePermissionRow)
-                        .where(RolePermissionRow.role_id == role_id)
-                        .with_for_update()
-                    )
-                ).all()
-            )
-            current = frozenset(item.permission_name for item in existing)
-            if current == requested:
-                return
-            for item in existing:
-                if item.permission_name not in requested:
-                    await session.delete(item)
-            for permission in sorted(requested - current):
-                session.add(RolePermissionRow(role_id=role_id, permission_name=permission))
-            role.permission_version += 1
-
-    async def _require_user(self, user_id: UUID, *, for_update: bool) -> UserRow:
-        session = await self._provider.get_session()
-        statement = select(UserRow).where(UserRow.user_id == user_id)
-        if for_update:
-            statement = statement.with_for_update()
-        row = await session.scalar(statement)
-        if row is None:
-            raise IdentityResourceNotFoundError(resource="user")
-        return row
-
-    async def _require_role(self, role_id: UUID, *, for_update: bool) -> RoleRow:
-        session = await self._provider.get_session()
-        statement = select(RoleRow).where(RoleRow.role_id == role_id)
-        if for_update:
-            statement = statement.with_for_update()
-        row = await session.scalar(statement)
-        if row is None:
-            raise IdentityResourceNotFoundError(resource="role")
-        return row
-
-    async def _flush_unique(self, resource: str) -> None:
-        session = await self._provider.get_session()
-        try:
-            await session.flush()
-        except IntegrityError:
-            raise IdentityConflictError(resource=resource) from None
 
 
 class SqlAlchemyIdentityAccessStore:
-    __slots__ = ("_engines",)
+    __slots__ = ("_engines", "_options", "_users")
 
-    def __init__(self, engines: _SqlAlchemyEngineRegistry) -> None:
+    def __init__(
+        self,
+        engines: _SqlAlchemyEngineRegistry,
+        models: SqlAlchemyModelCatalog,
+        options: Options[IdentityOptions],
+    ) -> None:
         self._engines = engines
+        self._users = models.extension_model(IDENTITY_USER_EXTENSION, UserRowValues)
+        self._options = options.value
 
     async def load_current_user(
         self,
@@ -237,7 +56,9 @@ class SqlAlchemyIdentityAccessStore:
     ) -> CurrentUser | None:
         async with self._session() as session:
             user = await session.scalar(
-                select(UserRow).where(UserRow.user_id == user_id, UserRow.is_active.is_(True))
+                select(self._users.model).where(
+                    self._users.model.user_id == user_id, self._users.model.is_active.is_(True)
+                )
             )
             refresh = await session.scalar(
                 select(RefreshSessionRow).where(
@@ -245,7 +66,11 @@ class SqlAlchemyIdentityAccessStore:
                     RefreshSessionRow.user_id == user_id,
                 )
             )
-            if user is None or refresh is None or not _session_is_active(refresh, now):
+            if (
+                user is None
+                or refresh is None
+                or not _session_is_active(refresh, now, self._options)
+            ):
                 return None
             role_rows = (
                 await session.execute(
@@ -300,17 +125,20 @@ class SqlAlchemyIdentityAccessStore:
 
 
 class SqlAlchemyIdentityLoginStore:
-    __slots__ = ("_engines",)
+    __slots__ = ("_engines", "_users")
 
-    def __init__(self, engines: _SqlAlchemyEngineRegistry) -> None:
+    def __init__(self, engines: _SqlAlchemyEngineRegistry, models: SqlAlchemyModelCatalog) -> None:
         self._engines = engines
+        self._users = models.extension_model(IDENTITY_USER_EXTENSION, UserRowValues)
 
     async def find_user(self, normalized_username: str) -> IdentityUser | None:
         async with self._session() as session:
             row = await session.scalar(
-                select(UserRow).where(UserRow.normalized_username == normalized_username)
+                select(self._users.model).where(
+                    self._users.model.normalized_username == normalized_username
+                )
             )
-            return None if row is None else _user_value(row)
+            return None if row is None else _user_value(row, self._users.read(row))
 
     async def record_failure(
         self,
@@ -321,8 +149,11 @@ class SqlAlchemyIdentityLoginStore:
         lockout_duration_seconds: int,
     ) -> None:
         async with self._session() as session, session.begin():
+            await _lock_identity_user(session, user_id)
             row = await session.scalar(
-                select(UserRow).where(UserRow.user_id == user_id).with_for_update()
+                select(self._users.model)
+                .where(self._users.model.user_id == user_id)
+                .with_for_update()
             )
             if row is None or not row.is_active:
                 return
@@ -349,8 +180,11 @@ class SqlAlchemyIdentityLoginStore:
         now: datetime,
     ) -> bool:
         async with self._session() as database, database.begin():
+            await _lock_identity_user(database, user_id)
             row = await database.scalar(
-                select(UserRow).where(UserRow.user_id == user_id).with_for_update()
+                select(self._users.model)
+                .where(self._users.model.user_id == user_id)
+                .with_for_update()
             )
             if (
                 row is None
@@ -371,10 +205,13 @@ class SqlAlchemyIdentityLoginStore:
 
 
 class SqlAlchemyRefreshSessionStore:
-    __slots__ = ("_engines",)
+    __slots__ = ("_engines", "_options")
 
-    def __init__(self, engines: _SqlAlchemyEngineRegistry) -> None:
+    def __init__(
+        self, engines: _SqlAlchemyEngineRegistry, options: Options[IdentityOptions]
+    ) -> None:
         self._engines = engines
+        self._options = options.value
 
     async def rotate(
         self,
@@ -385,13 +222,17 @@ class SqlAlchemyRefreshSessionStore:
         now: datetime,
     ) -> RefreshRotationResult:
         async with self._session() as session, session.begin():
-            family_id = await session.scalar(
-                select(RefreshSessionRow.family_id).where(
-                    RefreshSessionRow.token_hash == token_hash
+            identity = (
+                await session.execute(
+                    select(RefreshSessionRow.user_id, RefreshSessionRow.family_id).where(
+                        RefreshSessionRow.token_hash == token_hash
+                    )
                 )
-            )
-            if family_id is None:
+            ).one_or_none()
+            if identity is None:
                 return RefreshRotationResult(RefreshRotationStatus.NOT_FOUND, None)
+            user_id, family_id = identity
+            await _lock_identity_user(session, user_id)
             await _lock_refresh_family(session, family_id)
             current = await session.scalar(
                 select(RefreshSessionRow)
@@ -404,7 +245,7 @@ class SqlAlchemyRefreshSessionStore:
             if current.revoked_at is not None or current.replaced_by_session_id is not None:
                 await _revoke_family(session, current.family_id, now=now)
                 return RefreshRotationResult(RefreshRotationStatus.REUSED, None)
-            if not _session_is_active(current, now):
+            if not _session_is_active(current, now, self._options):
                 await _revoke_family(session, current.family_id, now=now)
                 return RefreshRotationResult(RefreshRotationStatus.EXPIRED, None)
 
@@ -425,13 +266,17 @@ class SqlAlchemyRefreshSessionStore:
 
     async def revoke(self, token_hash: str, *, now: datetime) -> None:
         async with self._session() as session, session.begin():
-            family_id = await session.scalar(
-                select(RefreshSessionRow.family_id).where(
-                    RefreshSessionRow.token_hash == token_hash
+            identity = (
+                await session.execute(
+                    select(RefreshSessionRow.user_id, RefreshSessionRow.family_id).where(
+                        RefreshSessionRow.token_hash == token_hash
+                    )
                 )
-            )
-            if family_id is None:
+            ).one_or_none()
+            if identity is None:
                 return
+            user_id, family_id = identity
+            await _lock_identity_user(session, user_id)
             await _lock_refresh_family(session, family_id)
             current = await session.scalar(
                 select(RefreshSessionRow)
@@ -446,72 +291,6 @@ class SqlAlchemyRefreshSessionStore:
         return FrameworkAsyncSession(self._engines.get("default"), expire_on_commit=False)
 
 
-async def _revoke_family(
-    session: AsyncSession,
-    family_id: UUID,
-    *,
-    now: datetime,
-) -> None:
-    rows = tuple(
-        (
-            await session.scalars(
-                select(RefreshSessionRow)
-                .where(RefreshSessionRow.family_id == family_id)
-                .with_for_update()
-            )
-        ).all()
-    )
-    for row in rows:
-        if row.revoked_at is None:
-            row.revoked_at = now
-
-
-async def _lock_refresh_family(session: AsyncSession, family_id: UUID) -> None:
-    # family 没有可锁的稳定 parent row；transaction advisory lock 在同一短事务内提供
-    # family -> token/family rows 的统一顺序，并随 commit/rollback 自动释放。
-    await session.scalar(select(func.pg_advisory_xact_lock(_refresh_family_lock_key(family_id))))
-
-
-def _refresh_family_lock_key(family_id: UUID) -> int:
-    digest = blake2b(
-        family_id.bytes,
-        digest_size=8,
-        person=_REFRESH_FAMILY_LOCK_PERSON,
-    ).digest()
-    return int.from_bytes(digest, byteorder="big", signed=True)
-
-
-def _session_is_active(row: RefreshSessionRow, now: datetime) -> bool:
-    return (
-        row.revoked_at is None
-        and row.replaced_by_session_id is None
-        and now - row.last_used_at < REFRESH_INACTIVITY_LIFETIME
-        and now - row.family_created_at < REFRESH_ABSOLUTE_LIFETIME
-    )
-
-
-def _user_value(row: UserRow) -> IdentityUser:
-    return IdentityUser(
-        user_id=row.user_id,
-        username=row.username,
-        normalized_username=row.normalized_username,
-        password_hash=row.password_hash,
-        is_active=row.is_active,
-        failed_access_count=row.failed_access_count,
-        lockout_end=row.lockout_end,
-        permission_version=row.permission_version,
-    )
-
-
-def _role_value(row: RoleRow) -> IdentityRole:
-    return IdentityRole(
-        role_id=row.role_id,
-        name=row.name,
-        normalized_name=row.normalized_name,
-        permission_version=row.permission_version,
-    )
-
-
 def _refresh_row(value: RefreshSession) -> RefreshSessionRow:
     return RefreshSessionRow(
         session_id=value.session_id,

python_ddd_framework/identity/tokens.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import hashlib
 import secrets
 from dataclasses import dataclass
-from datetime import UTC, datetime, timedelta
+from datetime import UTC, datetime
 from uuid import UUID, uuid4
 
 import jwt
@@ -14,9 +14,6 @@ from ..options import Options
 from .contracts import IdentityOptions
 from .errors import InvalidCredentialsError
 
-ACCESS_TOKEN_LIFETIME = timedelta(minutes=15)
-REFRESH_INACTIVITY_LIFETIME = timedelta(days=30)
-REFRESH_ABSOLUTE_LIFETIME = timedelta(days=90)
 ACCESS_TOKEN_TYPE = "access"
 BEARER_TOKEN_TYPE = "Bearer"
 
@@ -43,7 +40,7 @@ class JwtTokenService:
             "jti": str(uuid4()),
             "iat": issued,
             "nbf": issued,
-            "exp": issued + ACCESS_TOKEN_LIFETIME,
+            "exp": issued + self._options.access_token_lifetime,
             "typ": ACCESS_TOKEN_TYPE,
         }
         key = self._options.keys[self._options.active_kid].get_secret_value()

python_ddd_framework/{application_services/validation.py → invocation/arguments.py}

@@ -6,13 +6,15 @@ from collections.abc import Mapping
 
 from pydantic import ValidationError
 
-from .catalog import ApplicationServiceRegistration, _CompiledMethod
-from .errors import ApplicationServiceValidationError, ApplicationServiceValidationIssue
+from ..application_services.errors import (
+    ApplicationServiceValidationError,
+    ApplicationServiceValidationIssue,
+)
+from ..invocation.methods import _CompiledMethod
 
 
 async def _validate_arguments(
     method: _CompiledMethod,
-    registration: ApplicationServiceRegistration,
     args: tuple[object, ...],
     kwargs: dict[str, object],
 ) -> tuple[tuple[object, ...], dict[str, object]]:
@@ -22,7 +24,7 @@ async def _validate_arguments(
     except ValidationError as original_error:
         validation_error = _sanitize_validation_error(
             original_error,
-            registration=registration,
+            service=method.descriptor.service,
             method_name=method.name,
             parameter_names=method.parameter_names,
         )
@@ -33,7 +35,7 @@ async def _validate_arguments(
 def _sanitize_validation_error(
     error: ValidationError,
     *,
-    registration: ApplicationServiceRegistration,
+    service: type[object],
     method_name: str,
     parameter_names: frozenset[str],
 ) -> ApplicationServiceValidationError:
@@ -51,7 +53,7 @@ def _sanitize_validation_error(
         )
     )
     return ApplicationServiceValidationError(
-        service=registration.contract,
+        service=service,
         method_name=method_name,
         issues=issues,
     )

python_ddd_framework/invocation/contribution.py

@@ -0,0 +1,61 @@
+"""拦截规则归调用能力持有，贡献有效期复用模块 hook 屏障。"""
+
+import inspect
+from collections.abc import Callable
+
+from ..application_services.errors import ApplicationServiceDefinitionError
+from ..diagnostics.source import caller_source
+from ..invocation.interceptors import (
+    InterceptionStage,
+    Interceptor,
+    InterceptorRegistration,
+    _InterceptorRule,
+)
+from ..invocation.methods import ServiceMethod
+from ..lifecycle import ConfigureContext, PostConfigureContext
+from .module import InvocationModule
+
+
+def add_interceptor(
+    context: ConfigureContext | PostConfigureContext,
+    interceptor: type[Interceptor],
+    *,
+    match: Callable[[ServiceMethod], bool],
+    before: InterceptionStage = InterceptionStage.METHOD,
+) -> None:
+    context.services.require_active()
+    context.modules.require_dependency(
+        context.descriptor.key,
+        InvocationModule,
+        source=context.descriptor.declaration_source,
+    )
+    if (
+        not isinstance(interceptor, type)
+        or not issubclass(interceptor, Interceptor)
+        or inspect.isabstract(interceptor)
+        or not inspect.iscoroutinefunction(interceptor.intercept)
+    ):
+        raise ApplicationServiceDefinitionError(
+            symbol=str(interceptor),
+            reason="interceptor must implement async intercept",
+        )
+    if (
+        not callable(match)
+        or inspect.iscoroutinefunction(match)
+        or not isinstance(before, InterceptionStage)
+    ):
+        raise ApplicationServiceDefinitionError(
+            symbol=interceptor.__qualname__,
+            reason="interceptor requires a synchronous match and valid position",
+        )
+    context.modules.instance(InvocationModule)._rules.append(
+        _InterceptorRule(
+            InterceptorRegistration(
+                interceptor,
+                before,
+                context.descriptor.key,
+                caller_source(str(context.descriptor.key), depth=2),
+            ),
+            match,
+        )
+    )