python-ddd-framework 0.3.2__py3-none-any.whl → 0.5.1__py3-none-any.whl

python_ddd_framework/identity/contracts.py

@@ -3,20 +3,22 @@
 from __future__ import annotations
 
 from collections.abc import Mapping
-from dataclasses import dataclass
-from datetime import datetime
+from dataclasses import dataclass, field, replace
+from datetime import datetime, timedelta
 from enum import Enum
 from typing import Annotated, Protocol
 from uuid import UUID
 
 from pydantic import BaseModel, ConfigDict, Field, SecretStr, field_validator, model_validator
 
-from ..application_services import ApplicationServiceContract
+from ..application_services import ApplicationServiceContract, PagedResult, PagedResultRequestDto
 from ..authorization import (
     CurrentUser,
     PermissionName,
     RolePermissionVersion,
 )
+from ..domain import OptimisticConcurrencyError
+from ..extensions.contracts import ExtensibleModel, ExtensionProperties, ExtensionTarget
 from ..options import BaseOptions
 
 IDENTITY_USERS_MANAGE = PermissionName("identity.users.manage")
@@ -28,6 +30,11 @@ class IdentityOptions(BaseOptions):
     audience: str
     active_kid: str
     keys: Mapping[str, SecretStr]
+    access_token_lifetime: timedelta = Field(default=timedelta(minutes=15), ge=timedelta(seconds=1))
+    refresh_inactivity_lifetime: timedelta = Field(default=timedelta(days=30), gt=timedelta(0))
+    refresh_absolute_lifetime: timedelta = Field(default=timedelta(days=90), gt=timedelta(0))
+    failed_attempt_limit: int = Field(default=5, ge=1)
+    lockout_duration: timedelta = Field(default=timedelta(minutes=15), ge=timedelta(seconds=1))
     seed_admin_username: str | None = None
     seed_admin_password: SecretStr | None = None
 
@@ -80,26 +87,80 @@ class RevokeTokenCommand(BaseModel):
     refresh_token: SecretStr
 
 
-class CreateUserCommand(BaseModel):
+class CreateUserCommand(ExtensibleModel):
     model_config = ConfigDict(frozen=True)
 
     username: Annotated[str, Field(min_length=1, max_length=120)]
     password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
 
+    @field_validator("username")
+    @classmethod
+    def _validate_username(cls, value: str) -> str:
+        _normalize_name(value, role="username")
+        return value.strip()
+
 
 class CreateRoleCommand(BaseModel):
     model_config = ConfigDict(frozen=True)
 
     name: Annotated[str, Field(min_length=1, max_length=120)]
 
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, value: str) -> str:
+        _normalize_name(value, role="role name")
+        return value.strip()
+
+
+class IdentityConcurrencyCommand(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    concurrency_version: Annotated[int, Field(ge=0)]
+
+
+class UpdateUserCommand(ExtensibleModel):
+    model_config = ConfigDict(frozen=True)
+
+    username: Annotated[str, Field(min_length=1, max_length=120)]
+    concurrency_version: Annotated[int, Field(ge=0)]
+
+    @field_validator("username")
+    @classmethod
+    def _validate_username(cls, value: str) -> str:
+        _normalize_name(value, role="username")
+        return value.strip()
+
+
+class SetUserActiveCommand(IdentityConcurrencyCommand):
+    is_active: bool
+
+
+class UpdateRoleCommand(IdentityConcurrencyCommand):
+    name: Annotated[str, Field(min_length=1, max_length=120)]
+
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, value: str) -> str:
+        _normalize_name(value, role="role name")
+        return value.strip()
+
+
+class ChangePasswordCommand(IdentityConcurrencyCommand):
+    old_password: SecretStr
+    new_password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
 
-class SetUserRolesCommand(BaseModel):
+
+class SetPasswordCommand(IdentityConcurrencyCommand):
+    new_password: Annotated[SecretStr, Field(min_length=12, max_length=1024)]
+
+
+class SetUserRolesCommand(IdentityConcurrencyCommand):
     model_config = ConfigDict(frozen=True)
 
     role_ids: tuple[UUID, ...]
 
 
-class SetRolePermissionsCommand(BaseModel):
+class SetRolePermissionsCommand(IdentityConcurrencyCommand):
     model_config = ConfigDict(frozen=True)
 
     permissions: tuple[str, ...]
@@ -113,12 +174,12 @@ class TokenPair:
     expires_in: int
 
 
-@dataclass(frozen=True, slots=True)
-class UserView:
+class UserView(ExtensibleModel):
     user_id: UUID
     username: str
     is_active: bool
     role_ids: tuple[UUID, ...]
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -126,6 +187,17 @@ class RoleView:
     role_id: UUID
     name: str
     permissions: tuple[str, ...]
+    concurrency_version: int
+
+
+class UserRolesView(BaseModel):
+    role_ids: tuple[UUID, ...]
+    concurrency_version: int
+
+
+class RolePermissionsView(BaseModel):
+    permissions: tuple[str, ...]
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -133,6 +205,7 @@ class CurrentUserView:
     user_id: UUID
     session_id: UUID
     username: str
+    concurrency_version: int
 
 
 @dataclass(frozen=True, slots=True)
@@ -145,6 +218,30 @@ class IdentityUser:
     failed_access_count: int
     lockout_end: datetime | None
     permission_version: int
+    extra_properties: ExtensionProperties = field(default_factory=ExtensionProperties)
+    concurrency_version: int = 0
+
+    def renamed(self, username: str, expected_version: int) -> IdentityUser:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            username=username.strip(),
+            normalized_username=_normalize_name(username, role="username"),
+            concurrency_version=self.concurrency_version + 1,
+        )
+
+    def with_active(self, is_active: bool, expected_version: int) -> IdentityUser:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            is_active=is_active,
+            concurrency_version=self.concurrency_version + (self.is_active != is_active),
+        )
+
+
+IDENTITY_USER_EXTENSION = ExtensionTarget(
+    "identity.user", (CreateUserCommand, UpdateUserCommand, UserView), IdentityUser
+)
 
 
 @dataclass(frozen=True, slots=True)
@@ -153,6 +250,16 @@ class IdentityRole:
     name: str
     normalized_name: str
     permission_version: int
+    concurrency_version: int = 0
+
+    def renamed(self, name: str, expected_version: int) -> IdentityRole:
+        _check_version(self.concurrency_version, expected_version)
+        return replace(
+            self,
+            name=name.strip(),
+            normalized_name=_normalize_name(name, role="role name"),
+            concurrency_version=self.concurrency_version + 1,
+        )
 
 
 @dataclass(frozen=True, slots=True)
@@ -188,17 +295,46 @@ class IdentityRepository(Protocol):
 
     async def create_user(self, user: IdentityUser) -> None: ...
 
-    async def list_users(self) -> tuple[UserView, ...]: ...
+    async def get_user(self, user_id: UUID) -> IdentityUser: ...
+
+    async def get_user_view(self, user_id: UUID) -> UserView: ...
+
+    async def list_users(self, query: PagedResultRequestDto) -> PagedResult[UserView]: ...
+
+    async def update_user(self, user_id: UUID, command: UpdateUserCommand) -> UserView: ...
+
+    async def set_user_active(self, user_id: UUID, command: SetUserActiveCommand) -> UserView: ...
+
+    async def delete_user(self, user_id: UUID, concurrency_version: int) -> None: ...
+
+    async def set_password(
+        self,
+        user_id: UUID,
+        password_hash: str,
+        concurrency_version: int,
+        *,
+        expected_password_hash: str | None = None,
+    ) -> None: ...
 
     async def create_role(self, role: IdentityRole) -> None: ...
 
     async def find_role_by_normalized_name(self, normalized_name: str) -> IdentityRole | None: ...
 
-    async def list_roles(self) -> tuple[RoleView, ...]: ...
+    async def get_role(self, role_id: UUID) -> RoleView: ...
+
+    async def list_roles(self, query: PagedResultRequestDto) -> PagedResult[RoleView]: ...
+
+    async def update_role(self, role_id: UUID, command: UpdateRoleCommand) -> RoleView: ...
 
-    async def set_user_roles(self, user_id: UUID, role_ids: tuple[UUID, ...]) -> None: ...
+    async def delete_role(self, role_id: UUID, concurrency_version: int) -> None: ...
 
-    async def set_role_permissions(self, role_id: UUID, permissions: tuple[str, ...]) -> None: ...
+    async def set_user_roles(
+        self, user_id: UUID, role_ids: tuple[UUID, ...], concurrency_version: int
+    ) -> UserRolesView: ...
+
+    async def set_role_permissions(
+        self, role_id: UUID, permissions: tuple[str, ...], concurrency_version: int
+    ) -> RolePermissionsView: ...
 
 
 class IdentityAccessStore(Protocol):
@@ -259,21 +395,45 @@ class AuthenticationApplicationService(ApplicationServiceContract, Protocol):
 
     async def me(self) -> CurrentUserView: ...
 
+    async def change_password(self, command: ChangePasswordCommand) -> None: ...
+
 
 class IdentityManagementApplicationService(ApplicationServiceContract, Protocol):
     async def create_user(self, command: CreateUserCommand) -> UserView: ...
 
-    async def get_users(self) -> tuple[UserView, ...]: ...
+    async def get_user(self, user_id: UUID) -> UserView: ...
+
+    async def get_users(self, query: PagedResultRequestDto) -> PagedResult[UserView]: ...
+
+    async def update_user(self, user_id: UUID, command: UpdateUserCommand) -> UserView: ...
+
+    async def set_user_active(self, user_id: UUID, command: SetUserActiveCommand) -> UserView: ...
+
+    async def delete_user(self, user_id: UUID, command: IdentityConcurrencyCommand) -> None: ...
+
+    async def set_password(self, user_id: UUID, command: SetPasswordCommand) -> None: ...
 
     async def create_role(self, command: CreateRoleCommand) -> RoleView: ...
 
-    async def get_roles(self) -> tuple[RoleView, ...]: ...
+    async def get_role(self, role_id: UUID) -> RoleView: ...
 
-    async def set_user_roles(self, user_id: UUID, command: SetUserRolesCommand) -> None: ...
+    async def get_roles(self, query: PagedResultRequestDto) -> PagedResult[RoleView]: ...
+
+    async def update_role(self, role_id: UUID, command: UpdateRoleCommand) -> RoleView: ...
+
+    async def delete_role(self, role_id: UUID, command: IdentityConcurrencyCommand) -> None: ...
+
+    async def get_user_roles(self, user_id: UUID) -> UserRolesView: ...
+
+    async def get_role_permissions(self, role_id: UUID) -> RolePermissionsView: ...
+
+    async def set_user_roles(
+        self, user_id: UUID, command: SetUserRolesCommand
+    ) -> UserRolesView: ...
 
     async def set_role_permissions(
         self, role_id: UUID, command: SetRolePermissionsCommand
-    ) -> None: ...
+    ) -> RolePermissionsView: ...
 
 
 def _normalize_name(value: str, *, role: str) -> str:
@@ -281,3 +441,8 @@ def _normalize_name(value: str, *, role: str) -> str:
     if not normalized or len(normalized) > 120:
         raise ValueError(f"{role} must contain between 1 and 120 characters")
     return normalized
+
+
+def _check_version(actual: int, expected: int) -> None:
+    if actual != expected:
+        raise OptimisticConcurrencyError

python_ddd_framework/identity/http_api.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from ..fastapi import ApplicationServiceRouteOverride, exposes_application_services
+from ..fastapi import ApplicationServiceRouteOverride, FastApiModule, exposes_application_services
 from ..modularity import AppModule
 from .contracts import AuthenticationApplicationService, IdentityManagementApplicationService
 from .module import IdentityModule
@@ -12,6 +12,83 @@ from .module import IdentityModule
     IdentityModule,
     root_path="identity",
     overrides=(
+        ApplicationServiceRouteOverride(
+            AuthenticationApplicationService,
+            method=AuthenticationApplicationService.change_password,
+            path="/auth/password",
+            verb="PUT",
+            operation_id="identity_change_password",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_user,
+            path="/identity/users/{user_id}",
+            verb="GET",
+            operation_id="identity_get_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.update_user,
+            path="/identity/users/{user_id}",
+            verb="PUT",
+            operation_id="identity_update_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.delete_user,
+            path="/identity/users/{user_id}",
+            verb="DELETE",
+            operation_id="identity_delete_user",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.set_user_active,
+            path="/identity/users/{user_id}/active",
+            verb="PUT",
+            operation_id="identity_set_user_active",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.set_password,
+            path="/identity/users/{user_id}/password",
+            verb="PUT",
+            operation_id="identity_set_password",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_user_roles,
+            path="/identity/users/{user_id}/roles",
+            verb="GET",
+            operation_id="identity_get_user_roles",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_role,
+            path="/identity/roles/{role_id}",
+            verb="GET",
+            operation_id="identity_get_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.update_role,
+            path="/identity/roles/{role_id}",
+            verb="PUT",
+            operation_id="identity_update_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.delete_role,
+            path="/identity/roles/{role_id}",
+            verb="DELETE",
+            operation_id="identity_delete_role",
+        ),
+        ApplicationServiceRouteOverride(
+            IdentityManagementApplicationService,
+            method=IdentityManagementApplicationService.get_role_permissions,
+            path="/identity/roles/{role_id}/permissions",
+            verb="GET",
+            operation_id="identity_get_role_permissions",
+        ),
         ApplicationServiceRouteOverride(
             AuthenticationApplicationService,
             method=AuthenticationApplicationService.login,
@@ -87,4 +164,4 @@ from .module import IdentityModule
     ),
 )
 class IdentityHttpApiModule(AppModule):
-    dependencies = (IdentityModule,)
+    dependencies = (FastApiModule,)

python_ddd_framework/identity/management.py

@@ -0,0 +1,166 @@
+"""Identity 管理用例；持久化并发与事务由 repository/UoW 负责。"""
+
+from __future__ import annotations
+
+from uuid import UUID, uuid4
+
+from ..application_services import (
+    ApplicationService,
+    PagedResult,
+    PagedResultRequestDto,
+    application_service,
+)
+from ..authorization import (
+    PermissionCatalog,
+    PermissionName,
+    authorize,
+)
+from .contracts import (
+    IDENTITY_ROLES_MANAGE,
+    IDENTITY_USERS_MANAGE,
+    CreateRoleCommand,
+    CreateUserCommand,
+    IdentityConcurrencyCommand,
+    IdentityManagementApplicationService,
+    IdentityRepository,
+    IdentityRole,
+    IdentityUser,
+    RolePermissionsView,
+    RoleView,
+    SetPasswordCommand,
+    SetRolePermissionsCommand,
+    SetUserActiveCommand,
+    SetUserRolesCommand,
+    UpdateRoleCommand,
+    UpdateUserCommand,
+    UserRolesView,
+    UserView,
+    _normalize_name,
+)
+from .errors import (
+    IdentityConflictError,
+    IdentityResourceNotFoundError,
+)
+from .passwords import PasswordHasher
+
+
+@application_service(provides=IdentityManagementApplicationService)
+class DefaultIdentityManagementApplicationService(ApplicationService):
+    def __init__(
+        self,
+        repository: IdentityRepository,
+        passwords: PasswordHasher,
+        permissions: PermissionCatalog,
+    ) -> None:
+        self._repository = repository
+        self._passwords = passwords
+        self._permissions = permissions
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def create_user(self, command: CreateUserCommand) -> UserView:
+        normalized = _normalize_name(command.username, role="username")
+        if await self._repository.find_user_by_normalized_username(normalized) is not None:
+            raise IdentityConflictError(resource="user")
+        user = IdentityUser(
+            user_id=uuid4(),
+            username=command.username.strip(),
+            normalized_username=normalized,
+            password_hash=await self._passwords.hash(command.password.get_secret_value()),
+            is_active=True,
+            failed_access_count=0,
+            lockout_end=None,
+            permission_version=0,
+            extra_properties=command.extra_properties,
+        )
+        await self._repository.create_user(user)
+        return UserView(
+            user_id=user.user_id,
+            username=user.username,
+            is_active=user.is_active,
+            role_ids=(),
+            extra_properties=user.extra_properties,
+            concurrency_version=user.concurrency_version,
+        )
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def get_users(self, query: PagedResultRequestDto) -> PagedResult[UserView]:
+        return await self._repository.list_users(query)
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def get_user(self, user_id: UUID) -> UserView:
+        return await self._repository.get_user_view(user_id)
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def update_user(self, user_id: UUID, command: UpdateUserCommand) -> UserView:
+        return await self._repository.update_user(user_id, command)
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def set_user_active(self, user_id: UUID, command: SetUserActiveCommand) -> UserView:
+        return await self._repository.set_user_active(user_id, command)
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def delete_user(self, user_id: UUID, command: IdentityConcurrencyCommand) -> None:
+        await self._repository.delete_user(user_id, command.concurrency_version)
+
+    @authorize(IDENTITY_USERS_MANAGE)
+    async def set_password(self, user_id: UUID, command: SetPasswordCommand) -> None:
+        password_hash = await self._passwords.hash(command.new_password.get_secret_value())
+        await self._repository.set_password(user_id, password_hash, command.concurrency_version)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def create_role(self, command: CreateRoleCommand) -> RoleView:
+        normalized = _normalize_name(command.name, role="role name")
+        if await self._repository.find_role_by_normalized_name(normalized) is not None:
+            raise IdentityConflictError(resource="role")
+        role = IdentityRole(uuid4(), command.name.strip(), normalized, 0)
+        await self._repository.create_role(role)
+        return RoleView(role.role_id, role.name, (), role.concurrency_version)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def get_roles(self, query: PagedResultRequestDto) -> PagedResult[RoleView]:
+        return await self._repository.list_roles(query)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def get_role(self, role_id: UUID) -> RoleView:
+        return await self._repository.get_role(role_id)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def update_role(self, role_id: UUID, command: UpdateRoleCommand) -> RoleView:
+        return await self._repository.update_role(role_id, command)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def delete_role(self, role_id: UUID, command: IdentityConcurrencyCommand) -> None:
+        await self._repository.delete_role(role_id, command.concurrency_version)
+
+    @authorize(IDENTITY_USERS_MANAGE, IDENTITY_ROLES_MANAGE)
+    async def get_user_roles(self, user_id: UUID) -> UserRolesView:
+        user = await self._repository.get_user_view(user_id)
+        return UserRolesView(role_ids=user.role_ids, concurrency_version=user.concurrency_version)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def get_role_permissions(self, role_id: UUID) -> RolePermissionsView:
+        role = await self._repository.get_role(role_id)
+        return RolePermissionsView(
+            permissions=role.permissions, concurrency_version=role.concurrency_version
+        )
+
+    @authorize(IDENTITY_USERS_MANAGE, IDENTITY_ROLES_MANAGE)
+    async def set_user_roles(self, user_id: UUID, command: SetUserRolesCommand) -> UserRolesView:
+        role_ids = tuple(dict.fromkeys(command.role_ids))
+        return await self._repository.set_user_roles(user_id, role_ids, command.concurrency_version)
+
+    @authorize(IDENTITY_ROLES_MANAGE)
+    async def set_role_permissions(
+        self, role_id: UUID, command: SetRolePermissionsCommand
+    ) -> RolePermissionsView:
+        names = tuple(PermissionName(item) for item in command.permissions)
+        if len(set(names)) != len(names):
+            raise IdentityConflictError(resource="role permission")
+        unknown = tuple(item for item in names if item not in self._permissions)
+        if unknown:
+            raise IdentityResourceNotFoundError(resource="permission")
+        return await self._repository.set_role_permissions(
+            role_id,
+            tuple(item.value for item in names),
+            command.concurrency_version,
+        )

python_ddd_framework/identity/module.py

@@ -5,14 +5,17 @@ from __future__ import annotations
 from dishka import Provider, Scope
 
 from ..authorization import AccessTokenAuthenticator, PermissionChecker
+from ..caching.module import CachingModule
+from ..extensions.contracts import ExtensionPoints
 from ..lifecycle import ConfigureContext
-from ..modularity import AppModule
+from ..modularity import AppModule, ModuleRef
+from ..seeding.module import DataSeedingModule
 from .contracts import (
+    IDENTITY_USER_EXTENSION,
     IdentityOptions,
 )
 from .passwords import PasswordHasher
 from .services import (
-    IDENTITY_PERMISSION_CACHE,
     IdentityAuthenticator,
     IdentityPermissionChecker,
 )
@@ -20,13 +23,18 @@ from .tokens import JwtTokenService
 
 
 class IdentityModule(AppModule):
+    extension_points = ExtensionPoints((IDENTITY_USER_EXTENSION,))
+    dependencies = (
+        DataSeedingModule,
+        CachingModule,
+        ModuleRef("python_ddd_framework.application_services.module:ApplicationServicesModule"),
+    )
     scan_packages = (
         "python_ddd_framework.identity.application",
+        "python_ddd_framework.identity.management",
         "python_ddd_framework.identity.permissions",
     )
 
-    cache_definitions = (IDENTITY_PERMISSION_CACHE,)
-
     def configure(self, context: ConfigureContext) -> None:
         context.configure(
             IdentityOptions,