springbootAI 1.8.0__py3-none-any.whl

spring/security/jwt_utils.py

@@ -0,0 +1,281 @@
+"""
+JWT 工具类
+提供 Token 生成、验证、解析等功能
+"""
+import jwt
+import time
+import uuid
+import functools
+from typing import Optional, Dict, Any
+
+
+class _InstanceOrDefaultMethod:
+    """Bind to an explicit instance, or to the configured module singleton."""
+
+    def __init__(self, func):
+        self.func = func
+        functools.update_wrapper(self, func)
+
+    def __get__(self, instance, owner):
+        target = instance
+        if target is None:
+            target = globals().get('jwt_utils')
+            if target is None:
+                target = owner()
+        return self.func.__get__(target, owner)
+
+
+class JwtUtils:
+    """JWT工具类"""
+
+    ALLOWED_ALGORITHMS = {'HS256', 'HS384', 'HS512'}
+
+    def __init__(self, secret_key: str = None, algorithm: str = 'HS256'):
+        self.configure(secret_key=secret_key, algorithm=algorithm)
+
+    def configure(
+        self,
+        secret_key: Optional[str] = None,
+        algorithm: str = 'HS256',
+        issuer: Optional[str] = None,
+        audience: Optional[str] = None,
+        leeway: int = 0,
+    ) -> None:
+        normalized_algorithm = str(algorithm).upper()
+        if normalized_algorithm not in self.ALLOWED_ALGORITHMS:
+            raise ValueError(f"不允许的 JWT 算法: {normalized_algorithm}")
+        self.secret_key = secret_key or 'spring-python-secret-key-change-in-production'
+        self.algorithm = normalized_algorithm
+        self.issuer = issuer
+        self.audience = audience
+        self.leeway = max(0, int(leeway))
+    
+    @_InstanceOrDefaultMethod
+    def generate_token(self, payload: Dict[str, Any], expires_in: int = 3600) -> str:
+        """
+        生成 JWT Token
+        
+        Args:
+            payload: 载荷数据
+            expires_in: 过期时间（秒），默认1小时
+        
+        Returns:
+            JWT Token字符串
+        """
+        if expires_in <= 0:
+            raise ValueError("expires_in 必须大于 0")
+        now = int(time.time())
+        token_payload = {
+            **payload,
+            'exp': now + expires_in,
+            'iat': now,
+            'jti': str(uuid.uuid4()),
+            'token_type': 'access',
+        }
+        if self.issuer:
+            token_payload['iss'] = self.issuer
+        if self.audience:
+            token_payload['aud'] = self.audience
+        
+        return jwt.encode(token_payload, self.secret_key, algorithm=self.algorithm)
+    
+    @_InstanceOrDefaultMethod
+    def generate_refresh_token(self, payload: Dict[str, Any], expires_in: int = 86400) -> str:
+        """
+        生成刷新 Token
+        
+        Args:
+            payload: 载荷数据
+            expires_in: 过期时间（秒），默认24小时
+        
+        Returns:
+            刷新 Token 字符串
+        """
+        token = self.generate_token(payload, expires_in)
+        decoded = jwt.decode(token, options={'verify_signature': False})
+        decoded['token_type'] = 'refresh'
+        return jwt.encode(decoded, self.secret_key, algorithm=self.algorithm)
+    
+    @_InstanceOrDefaultMethod
+    def validate_token(self, token: str) -> bool:
+        """
+        验证 Token 是否有效
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            是否有效
+        """
+        try:
+            self.decode_token(token)
+            return True
+        except (jwt.PyJWTError, ValueError, TypeError):
+            return False
+
+    @_InstanceOrDefaultMethod
+    def verify_token(self, token: str) -> Dict[str, Any]:
+        """验证并返回 Token 载荷；无效 Token 会抛出解码异常。"""
+        return self.decode_token(token)
+    
+    @_InstanceOrDefaultMethod
+    def decode_token(self, token: str) -> Dict[str, Any]:
+        """
+        解码并验证 Token
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            解码后的载荷数据
+        
+        Raises:
+            jwt.ExpiredSignatureError: Token已过期
+            jwt.InvalidTokenError: Token无效
+        """
+        options = {
+            'require': ['exp', 'iat', 'jti', 'token_type'],
+            'verify_aud': self.audience is not None,
+            'verify_iss': self.issuer is not None,
+        }
+        return jwt.decode(
+            token,
+            self.secret_key,
+            algorithms=[self.algorithm],
+            audience=self.audience,
+            issuer=self.issuer,
+            leeway=self.leeway,
+            options=options,
+        )
+    
+    @_InstanceOrDefaultMethod
+    def get_payload(self, token: str) -> Dict[str, Any]:
+        """
+        获取 Token 载荷（不验证签名）
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            载荷数据
+        """
+        return jwt.decode(token, options={'verify_signature': False})
+    
+    @_InstanceOrDefaultMethod
+    def is_expired(self, token: str) -> bool:
+        """
+        检查 Token 是否已过期
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            是否已过期
+        """
+        try:
+            payload = self.get_payload(token)
+            exp = payload.get('exp', 0)
+            return time.time() > exp
+        except (jwt.PyJWTError, ValueError, TypeError):
+            return True
+    
+    @_InstanceOrDefaultMethod
+    def refresh_token(self, refresh_token: str, expires_in: int = 3600) -> str:
+        """
+        使用刷新 Token 生成新的访问 Token
+        
+        Args:
+            refresh_token: 刷新 Token
+            expires_in: 新 Token 过期时间（秒）
+        
+        Returns:
+            新的访问 Token
+        """
+        payload = self.decode_token(refresh_token)
+        if payload.get('token_type') != 'refresh':
+            raise jwt.InvalidTokenError("访问令牌不能用于刷新")
+        
+        # 移除过期时间相关字段
+        payload.pop('exp', None)
+        payload.pop('iat', None)
+        payload.pop('jti', None)
+        payload.pop('token_type', None)
+        
+        return self.generate_token(payload, expires_in)
+    
+    @_InstanceOrDefaultMethod
+    def extract_user_id(self, token: str) -> Optional[str]:
+        """
+        从 Token 中提取用户ID
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            用户ID
+        """
+        try:
+            payload = self.decode_token(token)
+            return payload.get('user_id') or payload.get('sub')
+        except (jwt.PyJWTError, ValueError, TypeError):
+            return None
+    
+    @_InstanceOrDefaultMethod
+    def extract_roles(self, token: str) -> list:
+        """
+        从 Token 中提取角色列表
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            角色列表
+        """
+        try:
+            payload = self.decode_token(token)
+            roles = payload.get('roles', [])
+            if isinstance(roles, str):
+                return [roles]
+            return roles
+        except (jwt.PyJWTError, ValueError, TypeError):
+            return []
+    
+    @_InstanceOrDefaultMethod
+    def extract_permissions(self, token: str) -> list:
+        """
+        从 Token 中提取权限列表
+        
+        Args:
+            token: JWT Token
+        
+        Returns:
+            权限列表
+        """
+        try:
+            payload = self.decode_token(token)
+            permissions = payload.get('permissions', [])
+            if isinstance(permissions, str):
+                return [permissions]
+            return permissions
+        except (jwt.PyJWTError, ValueError, TypeError):
+            return []
+
+
+# 创建全局 JWT 工具实例
+jwt_utils = JwtUtils()
+
+
+def init_jwt(config: dict) -> None:
+    """
+    初始化 JWT 配置
+    
+    Args:
+        config: JWT配置字典，包含secret_key等
+    """
+    jwt_utils.configure(
+        secret_key=config.get('secret_key', 'spring-python-secret-key-change-in-production'),
+        algorithm=config.get('algorithm', 'HS256'),
+        issuer=config.get('issuer'),
+        audience=config.get('audience'),
+        leeway=config.get('leeway', 0),
+    )

spring/security/replay_protection.py

@@ -0,0 +1,206 @@
+"""
+重放攻击防护 (Replay Attack Protection)
+
+防护机制:
+- Nonce + Timestamp 双重校验
+- 时间戳窗口 (默认5分钟)
+- Nonce 去重缓存 (Redis或内存)
+- 请求签名验证
+"""
+
+import time
+import hashlib
+import hmac
+import logging
+import threading
+from typing import Optional, Dict, Set, Tuple
+from collections import OrderedDict
+
+logger = logging.getLogger("Spring.Security.Replay")
+
+# 默认时间戳窗口（秒）
+DEFAULT_TIMESTAMP_WINDOW = 300
+# Nonce缓存最大容量（LRU）
+DEFAULT_NONCE_CACHE_SIZE = 100000
+# Nonce过期清理间隔（秒）
+NONCE_CLEANUP_INTERVAL = 60
+
+
+class NonceCache:
+    """线程安全的LRU Nonce缓存"""
+
+    def __init__(self, max_size: int = DEFAULT_NONCE_CACHE_SIZE, ttl: int = DEFAULT_TIMESTAMP_WINDOW):
+        self._cache: "OrderedDict[str, float]" = OrderedDict()
+        self._max_size = max_size
+        self._ttl = ttl
+        self._lock = threading.RLock()
+        self._last_cleanup = time.monotonic()
+
+    def _cleanup_expired(self):
+        """清理过期的nonce"""
+        now = time.time()
+        if time.monotonic() - self._last_cleanup < NONCE_CLEANUP_INTERVAL:
+            # 即使到了清理间隔，也只清理部分避免阻塞
+            expired_keys = []
+            for k, ts in list(self._cache.items()):
+                if now - ts > self._ttl:
+                    expired_keys.append(k)
+                else:
+                    break  # OrderedDict按插入顺序，前面过期后面也应该过期
+            for k in expired_keys:
+                self._cache.pop(k, None)
+        self._last_cleanup = time.monotonic()
+
+    def check_and_add(self, nonce: str) -> bool:
+        """
+        检查nonce是否已存在，不存在则添加
+
+        Returns:
+            True 如果nonce有效（未重复），False 如果重复
+        """
+        with self._lock:
+            self._cleanup_expired()
+
+            if nonce in self._cache:
+                return False
+
+            # 容量控制
+            while len(self._cache) >= self._max_size:
+                self._cache.popitem(last=False)
+
+            self._cache[nonce] = time.time()
+            return True
+
+
+class RedisNonceCache:
+    """基于Redis的分布式Nonce缓存"""
+
+    def __init__(self, redis_client, key_prefix: str = "springpy:nonce:", ttl: int = DEFAULT_TIMESTAMP_WINDOW):
+        self._redis = redis_client
+        self._prefix = key_prefix
+        self._ttl = ttl
+
+    def check_and_add(self, nonce: str) -> bool:
+        key = f"{self._prefix}{nonce}"
+        try:
+            # SET NX: 仅在key不存在时设置，成功返回True（nonce有效）
+            return bool(self._redis.set(key, '1', ex=self._ttl, nx=True))
+        except Exception as e:
+            logger.warning(f"Redis nonce check failed, falling back to allow: {e}")
+            return True  # Redis故障时降级为允许（由timestamp校验兜底）
+
+
+class ReplayProtection:
+    """
+    重放攻击保护器
+
+    Usage:
+        protector = ReplayProtection(secret_key="your-secret")
+        is_valid, reason = protector.validate_request(
+            timestamp=request.headers.get("X-Timestamp"),
+            nonce=request.headers.get("X-Nonce"),
+            signature=request.headers.get("X-Signature"),
+            body=request.body,
+        )
+    """
+
+    def __init__(self, secret_key: str,
+                 timestamp_window: int = DEFAULT_TIMESTAMP_WINDOW,
+                 nonce_cache=None,
+                 redis_client=None):
+        self.secret_key = secret_key.encode('utf-8')
+        self.timestamp_window = timestamp_window
+
+        if nonce_cache:
+            self.nonce_cache = nonce_cache
+        elif redis_client:
+            self.nonce_cache = RedisNonceCache(redis_client, ttl=timestamp_window)
+        else:
+            self.nonce_cache = NonceCache(ttl=timestamp_window)
+
+    def generate_signature(self, timestamp: str, nonce: str, body: str = "",
+                           method: str = "", path: str = "") -> str:
+        """
+        生成请求签名
+
+        签名字符串: METHOD\nPATH\nTIMESTAMP\nNONCE\nBODY_SHA256
+        """
+        body_hash = hashlib.sha256(body.encode('utf-8') if isinstance(body, str) else body).hexdigest()
+        message = f"{method.upper()}\n{path}\n{timestamp}\n{nonce}\n{body_hash}"
+        return hmac.new(self.secret_key, message.encode('utf-8'), hashlib.sha256).hexdigest()
+
+    def validate_request(self, timestamp: str, nonce: str,
+                         signature: str = "", body: str = "",
+                         method: str = "", path: str = "") -> Tuple[bool, str]:
+        """
+        验证请求是否为重放攻击
+
+        Args:
+            timestamp: 请求时间戳（毫秒或秒，自动检测）
+            nonce: 唯一请求标识
+            signature: 请求签名（可选）
+            body: 请求体（用于签名验证）
+            method: HTTP方法
+            path: 请求路径
+
+        Returns:
+            (is_valid, reason)
+        """
+        # 1. 验证时间戳
+        try:
+            ts = int(timestamp)
+            # 自动检测毫秒/秒
+            if ts > 1e12:
+                ts = ts / 1000
+            now = time.time()
+            if abs(now - ts) > self.timestamp_window:
+                return False, f"Timestamp expired: window={self.timestamp_window}s, diff={abs(now - ts):.1f}s"
+        except (ValueError, TypeError):
+            return False, "Invalid timestamp format"
+
+        # 2. 验证Nonce
+        if not nonce or len(nonce) < 8:
+            return False, "Invalid or missing nonce (minimum 8 characters)"
+
+        if not self.nonce_cache.check_and_add(nonce):
+            logger.warning(f"Replay attack detected: duplicate nonce {nonce[:8]}***")
+            return False, "Duplicate nonce detected (possible replay attack)"
+
+        # 3. 验证签名（如果提供）
+        if signature:
+            expected_sig = self.generate_signature(str(timestamp), nonce, body, method, path)
+            if not hmac.compare_digest(expected_sig, signature):
+                return False, "Invalid signature"
+
+        return True, "OK"
+
+    def validate_headers(self, headers: Dict[str, str], body: str = "",
+                         method: str = "", path: str = "") -> Tuple[bool, str]:
+        """从HTTP头验证请求"""
+        return self.validate_request(
+            timestamp=headers.get("x-timestamp", headers.get("X-Timestamp", "")),
+            nonce=headers.get("x-nonce", headers.get("X-Nonce", "")),
+            signature=headers.get("x-signature", headers.get("X-Signature", "")),
+            body=body,
+            method=method,
+            path=path,
+        )
+
+
+def create_replay_protection(secret_key: str = None, redis_client=None,
+                             **kwargs) -> Optional[ReplayProtection]:
+    """
+    工厂方法创建重放保护器
+
+    如果没有secret_key则返回None（不启用重放防护）
+    """
+    if not secret_key:
+        # 尝试从配置获取
+        try:
+            from spring.security.secret_manager import SecretManager
+            secret_key = SecretManager().get_jwt_secret()
+        except Exception:
+            return None
+    if not secret_key:
+        return None
+    return ReplayProtection(secret_key, redis_client=redis_client, **kwargs)