springbootAI 1.8.0__py3-none-any.whl

spring/security/secret_manager.py

@@ -0,0 +1,226 @@
+"""
+密钥管理器 (Secret Manager)
+
+生产级密钥管理：
+- 优先从环境变量读取（推荐与Vault/K8s Secrets/AWS Secrets Manager集成）
+- 支持 .env 文件（开发环境）
+- 支持 base64 编码密钥解码
+- 密钥脱敏（日志中不输出明文）
+- 密钥轮换支持
+"""
+
+import os
+import base64
+import logging
+import hashlib
+from typing import Optional, Dict, Any
+from pathlib import Path
+
+logger = logging.getLogger("Spring.Security.Secret")
+
+# 敏感配置键名模式
+_SENSITIVE_KEY_PATTERNS = {
+    'password', 'secret', 'token', 'key', 'credential',
+    'api_key', 'apikey', 'access_key', 'private_key',
+}
+
+
+def is_sensitive_key(key: str) -> bool:
+    """判断配置键是否为敏感字段"""
+    key_lower = key.lower()
+    return any(pattern in key_lower for pattern in _SENSITIVE_KEY_PATTERNS)
+
+
+def mask_secret(value: str, show_chars: int = 4) -> str:
+    """脱敏显示密钥，仅显示前后show_chars位"""
+    if not value or not isinstance(value, str):
+        return "***"
+    if len(value) <= show_chars * 2:
+        return "***"
+    return f"{value[:show_chars]}***{value[-show_chars:]}"
+
+
+class SecretManager:
+    """
+    密钥管理器
+
+    密钥加载优先级:
+    1. 环境变量 (SPRING_SECRETS_ 前缀或直接变量名)
+    2. Docker/K8s secrets 文件 (/run/secrets/{name})
+    3. .env 文件（仅开发环境，需显式启用）
+    """
+
+    _instance = None
+    _secrets: Dict[str, str] = {}
+    _initialized = False
+
+    def __new__(cls):
+        if cls._instance is None:
+            cls._instance = super().__new__(cls)
+        return cls._instance
+
+    def __init__(self):
+        if not self._initialized:
+            self._secrets = {}
+            self._initialized = False
+            self._init_from_env()
+
+    def _init_from_env(self):
+        """从环境变量初始化密钥"""
+        # 从 SPRING_SECRETS_ 前缀加载
+        prefix = "SPRING_SECRETS_"
+        for key, value in os.environ.items():
+            if key.startswith(prefix):
+                secret_name = key[len(prefix):].lower()
+                self._secrets[secret_name] = value
+                logger.debug(f"Loaded secret from env: {secret_name}={mask_secret(value)}")
+
+        # Docker/K8s secrets 文件
+        secrets_dir = os.getenv('SPRING_SECRETS_DIR', '/run/secrets')
+        secrets_path = Path(secrets_dir)
+        if secrets_path.exists() and secrets_path.is_dir():
+            for f in secrets_path.iterdir():
+                if f.is_file():
+                    name = f.name.lower().replace('-', '_')
+                    try:
+                        self._secrets[name] = f.read_text().strip()
+                        logger.debug(f"Loaded secret from file: {name}")
+                    except Exception as e:
+                        logger.warning(f"Failed to read secret file {f}: {e}")
+
+        # 开发环境：.env 文件
+        if os.getenv('SPRING_ENV', '').lower() in ('dev', 'development', 'local'):
+            env_file = Path('.env')
+            if env_file.exists():
+                try:
+                    for line in env_file.read_text().splitlines():
+                        line = line.strip()
+                        if line and not line.startswith('#') and '=' in line:
+                            k, v = line.split('=', 1)
+                            k = k.strip()
+                            v = v.strip().strip('"').strip("'")
+                            if k.startswith(prefix):
+                                secret_name = k[len(prefix):].lower()
+                                self._secrets[secret_name] = v
+                    logger.debug("Loaded secrets from .env file (development only)")
+                except Exception as e:
+                    logger.warning(f"Failed to read .env file: {e}")
+
+        self._initialized = True
+
+    def get_secret(self, name: str, default: Optional[str] = None,
+                   decode_base64: bool = False) -> Optional[str]:
+        """
+        获取密钥
+
+        Args:
+            name: 密钥名称（不区分大小写，自动转换下划线/连字符）
+            default: 默认值
+            decode_base64: 是否base64解码
+
+        Returns:
+            密钥值，不存在时返回default
+        """
+        name_normalized = name.lower().replace('-', '_')
+
+        # 1. 从已加载的secrets中查找
+        if name_normalized in self._secrets:
+            value = self._secrets[name_normalized]
+            return self._decode(value, decode_base64)
+
+        # 2. 直接从环境变量查找（支持DB_PASSWORD, REDIS_PASSWORD等标准命名）
+        env_variants = [
+            name.upper(),
+            name.upper().replace('.', '_'),
+            name.upper().replace('-', '_'),
+        ]
+        for env_name in env_variants:
+            if env_name in os.environ:
+                return self._decode(os.environ[env_name], decode_base64)
+
+        return default
+
+    def _decode(self, value: str, decode_base64: bool) -> str:
+        """解码密钥值"""
+        if decode_base64 and value:
+            try:
+                return base64.b64decode(value).decode('utf-8')
+            except Exception:
+                logger.warning("Failed to decode base64 secret, returning raw value")
+        return value
+
+    def require_secret(self, name: str, decode_base64: bool = False) -> str:
+        """获取必须存在的密钥，不存在则抛出异常"""
+        value = self.get_secret(name, decode_base64=decode_base64)
+        if value is None:
+            raise ValueError(f"Required secret '{name}' not found. "
+                             f"Set environment variable {name.upper()} or "
+                             f"SPRING_SECRETS_{name.upper()}")
+        return value
+
+    def get_database_password(self) -> str:
+        """获取数据库密码"""
+        return self.get_secret('db_password', '') or ''
+
+    def get_redis_password(self) -> str:
+        """获取Redis密码"""
+        return self.get_secret('redis_password', '') or ''
+
+    def get_rabbitmq_password(self) -> str:
+        """获取RabbitMQ密码"""
+        return self.get_secret('rabbitmq_password', '') or ''
+
+    def get_jwt_secret(self) -> str:
+        """获取JWT密钥"""
+        return self.require_secret('jwt_secret_key')
+
+    def get_nacos_password(self) -> str:
+        """获取Nacos密码"""
+        return self.get_secret('nacos_password', 'nacos') or 'nacos'
+
+    def set_secret(self, name: str, value: str) -> None:
+        """运行时设置密钥（用于密钥轮换）"""
+        name_normalized = name.lower().replace('-', '_')
+        self._secrets[name_normalized] = value
+        logger.info(f"Secret rotated: {name_normalized}")
+
+    def clear(self) -> None:
+        """清空所有密钥（测试用）"""
+        self._secrets.clear()
+        self._initialized = False
+
+    @classmethod
+    def reset(cls):
+        """重置单例（测试用）"""
+        cls._instance = None
+
+
+def resolve_secret_config(config: Dict[str, Any], prefix: str = "") -> Dict[str, Any]:
+    """
+    递归解析配置中的密钥引用
+
+    支持 ${secret:key_name} 或 ${secret:key_name:default} 格式
+    """
+    secret_mgr = SecretManager()
+    import re
+    _SECRET_PATTERN = re.compile(r'^\$\{secret:([^}:]+)(?::(.*))?\}$')
+
+    def _resolve(value, path=""):
+        if isinstance(value, dict):
+            return {k: _resolve(v, f"{path}.{k}" if path else k) for k, v in value.items()}
+        if isinstance(value, list):
+            return [_resolve(v, f"{path}[{i}]") for i, v in enumerate(value)]
+        if isinstance(value, str):
+            match = _SECRET_PATTERN.match(value)
+            if match:
+                secret_name = match.group(1)
+                default_val = match.group(2)
+                resolved = secret_mgr.get_secret(secret_name, default=default_val)
+                if resolved is None:
+                    if is_sensitive_key(path.split('.')[-1] if path else ''):
+                        logger.warning(f"Secret '{secret_name}' not found for config '{path}'")
+                    return default_val if default_val is not None else value
+                return resolved
+        return value
+
+    return _resolve(config)

spring/security/security_aop.py

@@ -0,0 +1,248 @@
+"""
+Spring Security AOP 切面实现
+提供认证授权功能
+"""
+from typing import Any, Callable, Dict, List
+import functools
+import inspect
+from spring.security.security_context import SecurityContext, SecurityContextHolder
+from spring.security.jwt_utils import jwt_utils
+
+
+class SecurityError(Exception):
+    """Base exception carrying an HTTP status for the web adapter."""
+
+    status_code = 500
+
+
+class AuthenticationError(SecurityError):
+    status_code = 401
+
+
+class AuthorizationError(SecurityError):
+    status_code = 403
+
+
+# ==================== @PreAuthorize 注解切面 ====================
+def pre_authorize_decorator(annotation):
+    """
+    @PreAuthorize 注解切面
+    支持表达式：
+    - hasRole('ROLE_ADMIN')
+    - hasAnyRole('ROLE_ADMIN', 'ROLE_USER')
+    - hasPermission('user:read')
+    - hasAnyPermission('user:read', 'user:write')
+    - authentication.name == 'admin'
+    """
+    def decorator(func: Callable) -> Callable:
+        def authorize() -> None:
+            expression = annotation.value
+            if not SecurityContextHolder.is_authenticated():
+                raise AuthenticationError("Authentication required")
+            if not _evaluate_expression(expression):
+                raise AuthorizationError("Access denied")
+
+        if inspect.iscoroutinefunction(func):
+            @functools.wraps(func)
+            async def async_wrapper(*args, **kwargs):
+                authorize()
+                return await func(*args, **kwargs)
+
+            return async_wrapper
+
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            authorize()
+            
+            return func(*args, **kwargs)
+        
+        return wrapper
+    return decorator
+
+
+def _evaluate_expression(expression: str) -> bool:
+    """
+    评估权限表达式
+    
+    Args:
+        expression: 权限表达式
+    
+    Returns:
+        是否满足条件
+    """
+    if not expression:
+        return True
+    
+    # 处理 hasRole 表达式
+    if expression.startswith('hasRole('):
+        role = expression.replace('hasRole(', '').replace(')', '').strip().strip("'\"")
+        return SecurityContextHolder.has_role(role)
+    
+    # 处理 hasAnyRole 表达式
+    if expression.startswith('hasAnyRole('):
+        roles_str = expression.replace('hasAnyRole(', '').replace(')', '').strip()
+        roles = [r.strip().strip("'\"") for r in roles_str.split(',')]
+        return SecurityContextHolder.has_any_role(*roles)
+    
+    # 处理 hasPermission 表达式
+    if expression.startswith('hasPermission('):
+        permission = expression.replace('hasPermission(', '').replace(')', '').strip().strip("'\"")
+        return SecurityContextHolder.has_permission(permission)
+    
+    # 处理 hasAnyPermission 表达式
+    if expression.startswith('hasAnyPermission('):
+        permissions_str = expression.replace('hasAnyPermission(', '').replace(')', '').strip()
+        permissions = [p.strip().strip("'\"") for p in permissions_str.split(',')]
+        return SecurityContextHolder.has_any_permission(*permissions)
+    
+    # 处理 authentication.name == 'xxx' 表达式
+    if 'authentication.name' in expression:
+        # 提取用户名
+        import re
+        match = re.search(r"authentication\.name\s*==\s*['\"]([^'\"]+)['\"]", expression)
+        if match:
+            expected_name = match.group(1)
+            authentication = SecurityContextHolder.get_authentication()
+            if authentication:
+                principal = authentication.get('principal', {})
+                if isinstance(principal, dict):
+                    name = principal.get('name', '')
+                else:
+                    name = str(principal)
+                return name == expected_name
+    
+    return False
+
+
+# ==================== @Secured 注解切面 ====================
+def secured_decorator(annotation):
+    """
+    @Secured 注解切面
+    检查当前用户是否拥有指定角色中的任一角色
+    """
+    def decorator(func: Callable) -> Callable:
+        def authorize() -> None:
+            roles = annotation.value
+            if not SecurityContextHolder.is_authenticated():
+                raise AuthenticationError("Authentication required")
+            if not SecurityContextHolder.has_any_role(*roles):
+                raise AuthorizationError(f"Required role(s) {roles}")
+
+        if inspect.iscoroutinefunction(func):
+            @functools.wraps(func)
+            async def async_wrapper(*args, **kwargs):
+                authorize()
+                return await func(*args, **kwargs)
+
+            return async_wrapper
+
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            authorize()
+            
+            return func(*args, **kwargs)
+        
+        return wrapper
+    return decorator
+
+
+# ==================== @Authenticate 注解切面 ====================
+def authenticate_decorator(annotation):
+    """
+    @Authenticate 注解切面
+    从请求头中获取 Token 并验证，设置安全上下文
+    """
+    def decorator(func: Callable) -> Callable:
+        def prepare_context(args, kwargs):
+            request = kwargs.pop('_spring_request', None)
+            token = kwargs.get('token') or kwargs.get('authorization')
+
+            accepted_parameters = inspect.signature(func).parameters
+            if 'token' not in accepted_parameters:
+                kwargs.pop('token', None)
+            if 'authorization' not in accepted_parameters:
+                kwargs.pop('authorization', None)
+
+            candidates = list(args)
+            if request is not None:
+                candidates.append(request)
+            if token is None:
+                for candidate in candidates:
+                    if hasattr(candidate, 'headers'):
+                        token = candidate.headers.get('Authorization')
+                        break
+
+            if isinstance(token, str) and token.lower().startswith('bearer '):
+                token = token[7:].strip()
+            if not token:
+                raise AuthenticationError("Token required")
+
+            try:
+                payload = jwt_utils.decode_token(token)
+            except Exception as exc:
+                raise AuthenticationError(f"Invalid token: {exc}") from exc
+
+            authentication = {
+                'principal': payload.get('user_id') or payload.get('sub'),
+                'credentials': token,
+                'roles': payload.get('roles', []),
+                'permissions': payload.get('permissions', []),
+                'details': payload,
+            }
+            context = SecurityContext()
+            context.authentication = authentication
+            context.principal = authentication['principal']
+            context.credentials = token
+            context.roles = authentication['roles']
+            context.permissions = authentication['permissions']
+            return SecurityContextHolder.set_context(context)
+
+        if inspect.iscoroutinefunction(func):
+            @functools.wraps(func)
+            async def async_wrapper(*args, **kwargs):
+                context_token = prepare_context(args, kwargs)
+                try:
+                    return await func(*args, **kwargs)
+                finally:
+                    SecurityContextHolder.reset_context(context_token)
+
+            return async_wrapper
+
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            context_token = prepare_context(args, kwargs)
+            try:
+                return func(*args, **kwargs)
+            finally:
+                SecurityContextHolder.reset_context(context_token)
+
+        return wrapper
+    return decorator
+
+
+# ==================== 注解处理映射 ====================
+SECURITY_ANNOTATION_DECORATORS = {
+    'PreAuthorize': pre_authorize_decorator,
+    'Secured': secured_decorator,
+    'Authenticate': authenticate_decorator,
+}
+
+
+def apply_security_annotations(target: Any, method: Callable) -> Callable:
+    """应用所有安全注解"""
+    annotations = getattr(method, '__spring_annotations__', [])
+    
+    wrapped = method
+    
+    # Authentication must be the outermost wrapper so it runs before checks.
+    ordered = sorted(
+        annotations,
+        key=lambda item: 1 if type(item).__name__ == 'Authenticate' else 0,
+    )
+    for annotation in ordered:
+        annotation_type = type(annotation).__name__
+        decorator_func = SECURITY_ANNOTATION_DECORATORS.get(annotation_type)
+        if decorator_func:
+            wrapped = decorator_func(annotation)(wrapped)
+    
+    return wrapped

spring/security/security_context.py

@@ -0,0 +1,172 @@
+"""
+安全上下文管理
+用于存储当前用户的认证信息
+"""
+from contextvars import ContextVar, Token
+from typing import Optional, Dict, Any, List
+
+
+class SecurityContext:
+    """安全上下文，存储当前用户信息"""
+    
+    def __init__(self):
+        self._authentication: Optional[Dict[str, Any]] = None
+        self._principal: Optional[Any] = None
+        self._credentials: Optional[str] = None
+        self._roles: List[str] = []
+        self._permissions: List[str] = []
+    
+    @property
+    def authentication(self) -> Optional[Dict[str, Any]]:
+        return self._authentication
+    
+    @authentication.setter
+    def authentication(self, value: Optional[Dict[str, Any]]):
+        self._authentication = value
+    
+    @property
+    def principal(self) -> Optional[Any]:
+        return self._principal
+    
+    @principal.setter
+    def principal(self, value: Optional[Any]):
+        self._principal = value
+    
+    @property
+    def credentials(self) -> Optional[str]:
+        return self._credentials
+    
+    @credentials.setter
+    def credentials(self, value: Optional[str]):
+        self._credentials = value
+    
+    @property
+    def roles(self) -> List[str]:
+        return self._roles
+    
+    @roles.setter
+    def roles(self, value: List[str]):
+        self._roles = value
+    
+    @property
+    def permissions(self) -> List[str]:
+        return self._permissions
+    
+    @permissions.setter
+    def permissions(self, value: List[str]):
+        self._permissions = value
+    
+    def is_authenticated(self) -> bool:
+        """判断当前用户是否已认证"""
+        return self._authentication is not None
+    
+    def has_role(self, role: str) -> bool:
+        """判断当前用户是否拥有指定角色"""
+        return role in self._roles
+    
+    def has_any_role(self, *roles: str) -> bool:
+        """判断当前用户是否拥有任一指定角色"""
+        return any(role in self._roles for role in roles)
+    
+    def has_permission(self, permission: str) -> bool:
+        """判断当前用户是否拥有指定权限"""
+        return permission in self._permissions
+    
+    def has_any_permission(self, *permissions: str) -> bool:
+        """判断当前用户是否拥有任一指定权限"""
+        return any(permission in self._permissions for permission in permissions)
+    
+    def clear(self):
+        """清除安全上下文"""
+        self._authentication = None
+        self._principal = None
+        self._credentials = None
+        self._roles = []
+        self._permissions = []
+
+
+class SecurityContextHolder:
+    """安全上下文持有者，隔离线程和 asyncio Task。"""
+    
+    _context_var: ContextVar[Optional[SecurityContext]] = ContextVar(
+        'spring_security_context', default=None
+    )
+    
+    @classmethod
+    def get_context(cls) -> SecurityContext:
+        """获取当前执行上下文的安全上下文"""
+        context = cls._context_var.get()
+        if context is None:
+            context = SecurityContext()
+            cls._context_var.set(context)
+        return context
+    
+    @classmethod
+    def set_context(cls, context: SecurityContext) -> Token:
+        """设置当前执行上下文并返回可用于恢复的 token"""
+        return cls._context_var.set(context)
+
+    @classmethod
+    def reset_context(cls, token: Token) -> None:
+        """恢复设置新上下文之前的安全上下文"""
+        cls._context_var.reset(token)
+    
+    @classmethod
+    def clear_context(cls):
+        """清除当前执行上下文，避免身份泄漏到后续调用"""
+        cls._context_var.set(SecurityContext())
+    
+    @classmethod
+    def get_authentication(cls) -> Optional[Dict[str, Any]]:
+        """获取当前认证信息"""
+        return cls.get_context().authentication
+    
+    @classmethod
+    def set_authentication(cls, authentication: Dict[str, Any]):
+        """设置当前认证信息"""
+        context = cls.get_context()
+        context.authentication = authentication
+        context.principal = authentication.get('principal')
+        context.credentials = authentication.get('credentials')
+        context.roles = authentication.get('roles', [])
+        context.permissions = authentication.get('permissions', [])
+    
+    @classmethod
+    def get_principal(cls) -> Optional[Any]:
+        """获取当前用户主体"""
+        return cls.get_context().principal
+    
+    @classmethod
+    def get_roles(cls) -> List[str]:
+        """获取当前用户角色列表"""
+        return cls.get_context().roles
+    
+    @classmethod
+    def get_permissions(cls) -> List[str]:
+        """获取当前用户权限列表"""
+        return cls.get_context().permissions
+    
+    @classmethod
+    def is_authenticated(cls) -> bool:
+        """判断当前用户是否已认证"""
+        return cls.get_context().is_authenticated()
+    
+    @classmethod
+    def has_role(cls, role: str) -> bool:
+        """判断当前用户是否拥有指定角色"""
+        return cls.get_context().has_role(role)
+    
+    @classmethod
+    def has_any_role(cls, *roles: str) -> bool:
+        """判断当前用户是否拥有任一指定角色"""
+        return cls.get_context().has_any_role(*roles)
+    
+    @classmethod
+    def has_permission(cls, permission: str) -> bool:
+        """判断当前用户是否拥有指定权限"""
+        return cls.get_context().has_permission(permission)
+    
+    @classmethod
+    def has_any_permission(cls, *permissions: str) -> bool:
+        """判断当前用户是否拥有任一指定权限"""
+        return cls.get_context().has_any_permission(*permissions)

spring/test/__init__.py

@@ -0,0 +1,45 @@
+"""SpringBootAI 测试切片模块（对齐 Spring Boot ``@SpringBootTest``/``@WebMvcTest``/``@DataJpaTest``）。
+
+模块组成（``spring.test.slicing``）：
+- ``SpringBootTest``：全量应用上下文，对齐 ``@SpringBootTest``。
+- ``WebMvcTest``：仅 Web 切片（指定 Controller + Mock 依赖 + FastAPI ``TestClient``）。
+- ``DataJpaTest``：仅数据切片（内存 SQLite + 建表 + ``PagingAndSortingRepository`` 工厂）。
+- ``TestPool``：内存连接池，供数据切片复用。
+
+典型用法（pytest）::
+
+    from spring.test import SpringBootTest, WebMvcTest, DataJpaTest
+
+    def test_full_context():
+        with SpringBootTest(App, config={"app": {"name": "demo"}}) as ctx:
+            svc = ctx.get_bean("user_service")
+            ...
+
+    def test_web_layer():
+        with WebMvcTest(controllers=[UserController]) as mvc:
+            resp = mvc.get_client().get("/users")
+            assert resp.status_code == 200
+
+    def test_data_layer():
+        with DataJpaTest(entities=[User]) as jpa:
+            repo = jpa.repository_for(User)
+            repo.save(User(name="tom"))
+
+设计原则：复用既有 ``ApplicationContext``/``WebApplicationContext``/``DdlAutoManager``/
+``PagingAndSortingRepository``，不重复造轮子；切片提供 ``close()`` 与上下文管理器语义。
+
+与 Java 的差异：
+- Spring Boot 切片用自动配置裁剪；本实现手动注册指定 Bean + Mock 依赖，更轻量直接。
+- ``@WebMvcTest`` 自动 Mock ``@Service``/``@Repository``；本实现 Mock 构造函数依赖。
+"""
+from .slicing import TestPool, SpringBootTest, WebMvcTest, DataJpaTest
+
+__version__ = "1.0.0"
+
+__all__ = [
+    "TestPool",
+    "SpringBootTest",
+    "WebMvcTest",
+    "DataJpaTest",
+    "__version__",
+]