uc-integration 0.1.0__py3-none-any.whl

uc_integration/__init__.py

@@ -0,0 +1,64 @@
+# uc_integration — 用户中心 SSO / 主数据同步（Fred 子系统可安装模块）
+"""安装后可直接 import；在 Fred 下通过 modules/ symlink 自动注册蓝图。"""
+from __future__ import annotations
+
+import importlib.util
+import sys
+import types
+from pathlib import Path
+
+__version__ = '0.1.0'
+
+
+def _ensure_fred_style_aliases() -> None:
+	"""将 backend/{service,schema,...} 注册为 uc_integration.*，并预加载 .py 文件。
+
+	对齐 Fred `_register_backend_submodules`：仅建空包会导致
+	`from uc_integration.schema.X import Y` 在部分加载顺序下失败。
+	"""
+	backend = Path(__file__).resolve().parent / 'backend'
+	if not backend.is_dir():
+		return
+	for subdir in backend.iterdir():
+		if not subdir.is_dir() or subdir.name.startswith('_') or subdir.name == 'controller':
+			continue
+		pkg_name = f'uc_integration.{subdir.name}'
+		if pkg_name not in sys.modules:
+			mod = types.ModuleType(pkg_name)
+			mod.__path__ = [str(subdir)]
+			mod.__file__ = str(subdir / '__init__.py')
+			mod.__package__ = pkg_name
+			sys.modules[pkg_name] = mod
+			setattr(sys.modules[__name__], subdir.name, mod)
+		else:
+			mod = sys.modules[pkg_name]
+			if not getattr(mod, '__path__', None):
+				mod.__path__ = [str(subdir)]
+
+		init_file = subdir / '__init__.py'
+		if init_file.exists() and not getattr(mod, '__file__', None):
+			mod.__file__ = str(init_file)
+
+		for py_file in subdir.glob('*.py'):
+			if py_file.name.startswith('__'):
+				continue
+			file_mod_name = f'{pkg_name}.{py_file.stem}'
+			if file_mod_name in sys.modules:
+				continue
+			try:
+				spec = importlib.util.spec_from_file_location(file_mod_name, py_file)
+				if not spec or not spec.loader:
+					continue
+				file_mod = importlib.util.module_from_spec(spec)
+				sys.modules[file_mod_name] = file_mod
+				spec.loader.exec_module(file_mod)
+				setattr(mod, py_file.stem, file_mod)
+			except Exception:
+				sys.modules.pop(file_mod_name, None)
+
+
+_ensure_fred_style_aliases()
+
+from .backend import uc_integration, get_admin_role, get_subsystem_code  # noqa: E402
+
+__all__ = ['uc_integration', 'get_admin_role', 'get_subsystem_code', '__version__']

uc_integration/backend/__init__.py

@@ -0,0 +1,42 @@
+# -*- coding: utf-8
+"""蓝图入口：url_prefix 由 UC_SUBSYSTEM_CODE 动态推导。"""
+from flask_smorest import Blueprint
+
+
+def get_subsystem_code() -> str:
+	"""子系统编码：优先 Config.UC_SUBSYSTEM_CODE，否则 DEFAULT_MODULE。"""
+	try:
+		from flask import current_app, has_app_context
+		if has_app_context():
+			code = (current_app.config.get('UC_SUBSYSTEM_CODE') or '').strip()
+			if code:
+				return code
+			return (current_app.config.get('DEFAULT_MODULE') or 'app').strip()
+	except Exception:
+		pass
+	try:
+		from common.config.Config import Config
+		code = (getattr(Config, 'UC_SUBSYSTEM_CODE', None) or '').strip()
+		if code:
+			return code
+		return (getattr(Config, 'DEFAULT_MODULE', None) or 'app').strip()
+	except Exception:
+		return 'app'
+
+
+def get_admin_role() -> str:
+	"""从 DEFAULT_MODULE 推导管理员角色：{subsystem}_admin。"""
+	from flask import current_app
+	subsystem = (current_app.config.get('DEFAULT_MODULE') or get_subsystem_code()).strip()
+	return f'{subsystem}_admin'
+
+
+uc_integration = Blueprint(
+	'uc_integration',
+	__name__,
+	url_prefix=f'/{get_subsystem_code()}/uc_integration',
+)
+
+# SSO：/{UC_SUBSYSTEM_CODE}/uc_integration/auth/sso/*
+# 同步：/{UC_SUBSYSTEM_CODE}/uc_integration/internal/uc-sync
+# controller 由 Fred 扫描 modules/uc_integration/backend/controller/

uc_integration/backend/controller/SsoAuthController.py

@@ -0,0 +1,47 @@
+# -*- coding: utf-8
+"""SSO 换票接口：UC code / accessToken → 本地 JWT。"""
+from flask import abort, current_app
+from flask.views import MethodView
+from flask_babelplus import gettext
+
+from uc_integration import uc_integration
+from uc_integration.schema.SsoAuthSchema import (
+	SsoExchangeBodySchema,
+	SsoRefreshBodySchema,
+	SsoExchangeResponseSchema,
+)
+from uc_integration.service.SsoAuthService import SsoAuthService
+
+
+@uc_integration.route('/auth/sso/config')
+class SsoConfigController(MethodView):
+	def get(self):
+		"""子系统前端读取登录方式（无需登录）。"""
+		mode = (current_app.config.get('SSO_LOGIN_MODE') or 'local').strip().lower()
+		if mode not in ('uc', 'local'):
+			mode = 'local'
+		base_url = (current_app.config.get('USER_CENTER_BASE_URL') or '').strip().rstrip('/')
+		if not base_url:
+			abort(500, description=gettext('用户中心地址未配置（USER_CENTER_BASE_URL）'))
+		return {
+			'loginMode': mode,
+			'userCenterBaseUrl': base_url,
+		}
+
+
+@uc_integration.route('/auth/sso/exchange')
+class SsoExchangeController(MethodView):
+	@uc_integration.arguments(SsoExchangeBodySchema)
+	@uc_integration.response(200, SsoExchangeResponseSchema)
+	def post(self, args):
+		"""用 UC 授权码或 accessToken 兑换本子系统 JWT（服务端调 UC）。"""
+		return SsoAuthService().sso_exchange(args)
+
+
+@uc_integration.route('/auth/sso/refresh')
+class SsoRefreshController(MethodView):
+	@uc_integration.arguments(SsoRefreshBodySchema)
+	@uc_integration.response(200, SsoExchangeResponseSchema)
+	def post(self, args):
+		"""UC refreshToken 续期并重新签发本地 JWT。"""
+		return SsoAuthService().sso_refresh(args)

uc_integration/backend/controller/UcDataSyncController.py

@@ -0,0 +1,62 @@
+# coding: utf-8
+"""
+UC 主数据同步接口
+
+接收 user-center 推送的用户、组织架构、门店等主数据，保存到本地数据库。
+- POST /{subsystem}/uc_integration/internal/uc-sync  接收推送
+- GET  /{subsystem}/uc_integration/internal/uc-sync  健康检查
+
+安全策略：
+- 仅允许本机（127.0.0.1 / ::1）访问
+- 校验请求头 X-UC-Internal-Secret 与本地 USER_CENTER_INTERNAL_SECRET 一致
+"""
+from flask import abort, current_app, request
+from flask.views import MethodView
+from flask_babelplus import gettext
+from functools import wraps
+
+from uc_integration import uc_integration
+from uc_integration.service.UcDataSyncService import UcDataSyncService
+
+_LOCALHOST_ADDRS = frozenset({'127.0.0.1', '::1'})
+
+
+def _verify_local_internal_access() -> None:
+	"""校验请求来自本机且携带正确的内部密钥。"""
+	remote = (request.remote_addr or '').strip()
+	if remote not in _LOCALHOST_ADDRS:
+		abort(403, description=gettext('仅允许本机访问'))
+
+	expected = (current_app.config.get('USER_CENTER_INTERNAL_SECRET') or '').strip()
+	if not expected:
+		abort(501, description=gettext('内部同步密钥未配置（USER_CENTER_INTERNAL_SECRET）'))
+
+	provided = (request.headers.get('X-UC-Internal-Secret') or '').strip()
+	if provided != expected:
+		abort(403, description=gettext('无权访问同步接口'))
+
+
+def uc_sync_local_only(f):
+	"""装饰器：限制仅本机 + 正确密钥可访问。"""
+	@wraps(f)
+	def wrapper(*args, **kwargs):
+		_verify_local_internal_access()
+		return f(*args, **kwargs)
+	return wrapper
+
+
+@uc_integration.route('/internal/uc-sync')
+class UcDataSyncController(MethodView):
+
+	@uc_sync_local_only
+	@uc_integration.response(200)
+	def post(self):
+		"""接收 UC 推送的用户、组织、门店主数据（仅本机）。"""
+		payload = request.get_json(silent=True) or {}
+		return UcDataSyncService().sync(payload)
+
+	@uc_sync_local_only
+	@uc_integration.response(200)
+	def get(self):
+		"""同步接口健康检查（仅本机），返回各镜像表有效记录数。"""
+		return UcDataSyncService.health_check()

uc_integration/backend/controller/__init__.py

@@ -0,0 +1,49 @@
+# coding: utf-8
+"""业务 API 认证装饰器：仅认本地 JWT。"""
+from functools import wraps
+import json
+
+from flask import abort, g, request
+from flask_babelplus import gettext
+from flask_jwt_extended import decode_token
+
+
+def _extract_bearer_token() -> str:
+	auth = request.headers.get('Authorization') or ''
+	if auth.lower().startswith('bearer '):
+		return auth[7:].strip()
+	return ''
+
+
+def _try_admin_jwt(token: str) -> bool:
+	from uc_integration.backend import get_admin_role
+	try:
+		decoded = decode_token(token)
+	except Exception:
+		return False
+	roles = decoded.get('role')
+	admin_role = get_admin_role()
+	if isinstance(roles, list):
+		if 'uc_integration' not in roles and admin_role not in roles:
+			return False
+	elif roles not in ('uc_integration', admin_role):
+		return False
+	identity = json.loads(decoded['sub'])
+	g.uc_user_id = identity.get('username') or str(identity.get('id'))
+	g.uc_identity = identity
+	return True
+
+
+def public_api(f):
+	"""业务 API 仅认本地 JWT（uc_integration 或子系统管理员角色）。"""
+
+	@wraps(f)
+	def wrapper(*args, **kwargs):
+		token = _extract_bearer_token()
+		if not token:
+			abort(401, description=gettext('请先登录'))
+		if not _try_admin_jwt(token):
+			abort(401, description=gettext('请先登录'))
+		return f(*args, **kwargs)
+
+	return wrapper

uc_integration/backend/deps.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8
+"""宿主依赖惰性解析：避免包安装时强绑 model.model。"""
+from __future__ import annotations
+
+
+def get_db():
+	"""返回宿主 Flask-SQLAlchemy db 实例。"""
+	from model.model import db
+	return db
+
+
+def get_uc_user_model():
+	"""返回宿主 UcUser ORM 类。"""
+	from model.model import UcUser
+	return UcUser
+
+
+def get_uc_models():
+	"""返回门店 scope 所需的 UC 镜像表模型。"""
+	from model.model import UcDept, UcDeptUserRelation, UcStore, UcUser, db
+	return {
+		'UcDept': UcDept,
+		'UcDeptUserRelation': UcDeptUserRelation,
+		'UcStore': UcStore,
+		'UcUser': UcUser,
+		'db': db,
+	}

uc_integration/backend/schema/SsoAuthSchema.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8
+"""SSO 换票接口 Schema 定义。"""
+from marshmallow import Schema, fields
+
+
+class SsoExchangeBodySchema(Schema):
+	code = fields.Str(metadata={'description': 'UC 跨域回跳一次性授权码'})
+	accessToken = fields.Str(metadata={'description': 'UC accessToken（同域兜底）'})
+	refreshToken = fields.Str(metadata={'description': 'UC refreshToken（可选）'})
+
+
+class SsoRefreshBodySchema(Schema):
+	refreshToken = fields.Str(required=True, metadata={'description': 'UC refreshToken'})
+
+
+class SsoExchangeResponseSchema(Schema):
+	id = fields.Int()
+	username = fields.Str()
+	name = fields.Str()
+	role = fields.Str(metadata={'description': '业务角色 manager/employee'})
+	access_token = fields.Str()
+	refresh_token = fields.Str()
+	uc_access_token = fields.Str()
+	uc_refresh_token = fields.Str()
+	store_id = fields.Int(metadata={'description': '当前门店 ID'})
+	storeId = fields.Int(metadata={'description': '当前门店 ID（驼峰）'})
+	store_ids = fields.List(fields.Int(), metadata={'description': '可访问门店 ID 列表'})
+	storeIds = fields.List(fields.Int(), metadata={'description': '可访问门店 ID 列表（驼峰）'})
+	store_name = fields.Str(metadata={'description': '门店名称（来自 uc_store）'})
+	uc = fields.Dict(
+		metadata={'description': 'UC 换票/校验原样返回（完整透传，不做字段裁剪）'},
+	)

uc_integration/backend/service/SsoAuthService.py

@@ -0,0 +1,301 @@
+# -*- coding: utf-8
+"""SSO 换票：UC code / accessToken → 本地 JWT。
+
+- UC 返回原样写入 identity['uc']（不做字段白名单）
+- 可选门店 scope（store_id / store_ids / role），由 UC_INCLUDE_STORE_SCOPE 控制
+"""
+from __future__ import annotations
+
+import copy
+import json
+
+from flask import abort, current_app
+from flask_babelplus import gettext
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy import text
+
+from uc_integration.service.UserCenterClient import UserCenterClient
+from fred_admin.common.Utils import Utils
+from uc_integration.backend.deps import get_db, get_uc_user_model
+
+
+class SsoAuthService:
+	def sso_exchange(self, args: dict) -> dict:
+		"""浏览器 callback 换票：优先 code，否则 accessToken。"""
+		auth_code = (args.get('code') or '').strip()
+		access_token = (args.get('accessToken') or args.get('access_token') or '').strip()
+		refresh_token = (args.get('refreshToken') or args.get('refresh_token') or '').strip() or None
+
+		uc_payload = {}
+		if auth_code:
+			uc_tokens = UserCenterClient().exchange_sso_code(auth_code)
+			access_token = (uc_tokens.get('accessToken') or '').strip()
+			refresh_token = (uc_tokens.get('refreshToken') or '').strip() or refresh_token
+			uc_payload = self._capture_uc_payload(uc_tokens)
+		else:
+			if not access_token:
+				abort(400, description=gettext('code 或 accessToken 不能为空'))
+			validated = UserCenterClient().validate_token(access_token)
+			uc_payload = self._capture_uc_payload(validated)
+
+		if not access_token:
+			abort(401, description=gettext('授权码无效或已过期'))
+		user_code = uc_payload.get('code')
+		if not user_code:
+			abort(401, description=gettext('登录凭证无效或已过期'))
+
+		return self._build_local_session(user_code, uc_payload, access_token, refresh_token)
+
+	def sso_refresh(self, args: dict) -> dict:
+		"""UC refreshToken 续期并重新签发本地 JWT。"""
+		refresh_token = (args.get('refreshToken') or args.get('refresh_token') or '').strip()
+		if not refresh_token:
+			abort(400, description=gettext('refreshToken 不能为空'))
+		tokens = UserCenterClient().refresh_token(refresh_token)
+		access_token = (tokens.get('accessToken') or '').strip()
+		if not access_token:
+			abort(401, description=gettext('登录凭证无效或已过期'))
+		validated = UserCenterClient().validate_token(access_token)
+		uc_payload = self._capture_uc_payload(validated)
+		user_code = uc_payload.get('code')
+		if not user_code:
+			abort(401, description=gettext('登录凭证无效或已过期'))
+		new_refresh = (tokens.get('refreshToken') or refresh_token).strip() or None
+		return self._build_local_session(user_code, uc_payload, access_token, new_refresh)
+
+	def _capture_uc_payload(self, uc_data: dict) -> dict:
+		"""原样保留 UC 返回；仅额外解析本地登录必需字段。"""
+		raw = copy.deepcopy(uc_data) if isinstance(uc_data, dict) else {}
+		current_app.logger.info('SSO UC raw response: %s', raw)
+
+		profile = (
+			raw.get('userProfile')
+			or raw.get('user_profile')
+			or raw.get('profile')
+			or {}
+		)
+		if not isinstance(profile, dict):
+			profile = {}
+		store = profile.get('store') or {}
+		if not isinstance(store, dict):
+			store = {}
+		stores = profile.get('stores') or []
+		if not isinstance(stores, list):
+			stores = []
+
+		is_store_manager = profile.get('is_store_manager')
+		if is_store_manager is None:
+			is_store_manager = profile.get('isStoreManager')
+
+		code = (
+			profile.get('code')
+			or profile.get('username')
+			or raw.get('userId')
+			or raw.get('user_id')
+			or raw.get('userName')
+			or raw.get('userCode')
+			or ''
+		)
+		code = code.strip() if isinstance(code, str) else str(code or '').strip()
+
+		store_id = (
+			store.get('id')
+			or profile.get('default_store_id')
+			or raw.get('store_id')
+			or raw.get('storeId')
+		)
+		try:
+			store_id = int(store_id) if store_id else None
+		except (TypeError, ValueError):
+			store_id = None
+
+		name = (
+			profile.get('name')
+			or profile.get('real_name')
+			or raw.get('name')
+			or raw.get('userName')
+			or raw.get('nickName')
+			or code
+		)
+		name = name.strip() if isinstance(name, str) else str(name or code).strip()
+
+		mobile = profile.get('mobile') or raw.get('mobile') or raw.get('phone') or ''
+		mobile = mobile.strip() if isinstance(mobile, str) else str(mobile or '').strip()
+
+		avatar = profile.get('avatar') or raw.get('avatar') or ''
+		avatar = avatar.strip() if isinstance(avatar, str) else str(avatar or '').strip()
+
+		return {
+			'raw': raw,
+			'code': code,
+			'name': name,
+			'mobile': mobile,
+			'avatar': avatar,
+			'store_id': store_id,
+			'store': store if store else None,
+			'stores': stores,
+			'is_store_manager': bool(is_store_manager) if is_store_manager is not None else None,
+		}
+
+	def _include_store_scope(self) -> bool:
+		val = current_app.config.get('UC_INCLUDE_STORE_SCOPE', True)
+		return bool(val)
+
+	def _store_fallback_first(self) -> bool:
+		val = current_app.config.get('UC_STORE_FALLBACK_FIRST', True)
+		return bool(val)
+
+	def _build_local_session(
+		self,
+		user_code: str,
+		uc_payload: dict | None = None,
+		uc_access_token: str | None = None,
+		uc_refresh_token: str | None = None,
+	) -> dict:
+		from uc_integration.backend import get_admin_role
+		try:
+			info = uc_payload or {}
+			uc_raw = info.get('raw') if isinstance(info.get('raw'), dict) else {}
+			user = self._resolve_user(user_code, info)
+
+			store_id = None
+			store_ids: list[int] = []
+			role = None
+
+			if self._include_store_scope():
+				from uc_integration.service.UcStoreScopeService import UcStoreScopeService
+				scope = UcStoreScopeService().resolve_profile_scope(
+					store=info.get('store'),
+					stores=info.get('stores'),
+					is_store_manager=info.get('is_store_manager'),
+					fallback_user=user,
+				)
+				store_id = self._resolve_store_id(scope.get('store_id'))
+				for sid in scope.get('store_ids') or []:
+					resolved = self._resolve_store_id(sid)
+					if resolved is not None and resolved not in store_ids:
+						store_ids.append(resolved)
+				if store_id is not None and store_id not in store_ids:
+					store_ids = [store_id, *store_ids]
+				if store_id is None and len(store_ids) == 1:
+					store_id = store_ids[0]
+				role = scope.get('role') or 'employee'
+			else:
+				store_id = self._resolve_store_id(info.get('store_id'))
+
+			store_name = self._resolve_store_name(store_id)
+			identity = {
+				'id': user.id,
+				'username': user.code,
+				'name': user.name,
+				'uc': uc_raw,
+			}
+			if role is not None:
+				identity['role'] = role
+			if store_ids:
+				identity['store_ids'] = store_ids
+			if store_id is not None:
+				identity['store_id'] = store_id
+
+			admin_role = get_admin_role()
+			claims = {
+				'role': ['uc_integration', admin_role],
+				'store_id': store_id,
+			}
+			if store_ids:
+				claims['store_ids'] = store_ids
+			if role is not None:
+				claims['uc_role'] = role
+
+			token = Utils.create_token(
+				identity=json.dumps(identity, ensure_ascii=False, default=str),
+				claims=claims,
+			)
+			payload = {
+				**identity,
+				**token,
+			}
+			if store_ids:
+				payload['storeIds'] = store_ids
+			if role is not None:
+				payload['role'] = role
+			if store_id is not None:
+				payload['storeId'] = store_id
+			if store_name:
+				payload['store_name'] = store_name
+			if uc_access_token:
+				payload['uc_access_token'] = uc_access_token
+			if uc_refresh_token:
+				payload['uc_refresh_token'] = uc_refresh_token
+			return payload
+		except SQLAlchemyError:
+			current_app.logger.exception('SSO local session failed for user %s', user_code)
+			abort(503, description=gettext('本地数据库未初始化或不可用'))
+
+	def _provision_uc_user(self, user_code: str, uc_user_info: dict | None = None):
+		UcUser = get_uc_user_model()
+		db = get_db()
+		code = (user_code or '').strip()
+		info = uc_user_info or {}
+		user = UcUser(
+			code=code,
+			name=info.get('name') or code,
+			mobile=info.get('mobile') or '',
+			avatar=info.get('avatar') or '',
+			status=1,
+			is_deleted=0,
+		)
+		db.session.add(user)
+		db.session.flush()
+		current_app.logger.info('SSO provisioned uc_user %s (name=%s) for uc user %s', code, user.name, user_code)
+		return user
+
+	def _resolve_user(self, user_code: str, uc_user_info: dict | None = None):
+		UcUser = get_uc_user_model()
+		code = (user_code or '').strip()
+		if not code:
+			abort(400, description=gettext('用户标识不能为空'))
+		user = UcUser.query.filter_by(code=code, is_deleted=0, status=1).first()
+		if user:
+			return user
+		return self._provision_uc_user(user_code, uc_user_info)
+
+	def _resolve_store_name(self, store_id: int | None) -> str | None:
+		if not store_id:
+			return None
+		db = get_db()
+		try:
+			row = db.session.execute(
+				text('SELECT name FROM uc_store WHERE id = :sid AND is_deleted = 0'),
+				{'sid': int(store_id)},
+			).mappings().first()
+			if row:
+				return (row['name'] or '').strip()
+		except Exception:
+			pass
+		return None
+
+	def _resolve_store_id(self, uc_store_id: int | None) -> int | None:
+		db = get_db()
+		if uc_store_id:
+			try:
+				row = db.session.execute(
+					text('SELECT id FROM uc_store WHERE id = :sid AND is_deleted = 0'),
+					{'sid': int(uc_store_id)},
+				).mappings().first()
+				if row:
+					return int(row['id'])
+			except Exception:
+				pass
+			if not self._store_fallback_first():
+				return None
+		if self._store_fallback_first():
+			try:
+				row = db.session.execute(
+					text('SELECT id FROM uc_store WHERE is_deleted = 0 ORDER BY id LIMIT 1'),
+				).mappings().first()
+				if row:
+					return int(row['id'])
+			except Exception:
+				pass
+		return uc_store_id if self._store_fallback_first() else None