JiuContinent
dc8605ce3f
refactor(core): 重构核心模块结构并更新导入路径 - 将配置相关的设置从 app.core.config 移除 - 将常量定义从 app.core.constants 移除 - 将数据库相关功能从 app.core.database 移除 - 将基础数据库模型从 app.core.db_base 移除 - 将敏感信息掩码功能从 app.core.masking 移除 - 将中间件定义从 app.core.middleware 移除 - 将操作保护功能从 app.core.operation_guard 移除 - 将分页工具从 app.core.pagination 移除 - 将请求上下文管理从 app.core.request_context 移除 - 将调度器功能从 app.core.scheduler 移除 - 将安全认证逻辑从 app.core.security 移除 - 将任务队列相关功能从 app.core.task_queue 移除 - 将时间工具从 app.core.time 移除 - 更新 alembic 配置中的 Base 模型导入路径 - 更新各模块中对重构后组件的引用路径 ```
99 lines
3.0 KiB
Python
99 lines
3.0 KiB
Python
from dataclasses import dataclass
|
|
from secrets import compare_digest
|
|
from typing import Any
|
|
|
|
from fastapi import Header, HTTPException, status
|
|
|
|
from app.core.config import get_settings
|
|
from app.core.constants import HttpHeader, SecurityErrorDetail
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ApiPrincipal:
|
|
"""Authenticated service principal derived from server-side configuration."""
|
|
|
|
actor: str
|
|
|
|
|
|
def require_api_key(
|
|
x_api_key: str | None = Header(default=None, alias=HttpHeader.X_API_KEY),
|
|
) -> ApiPrincipal:
|
|
"""Validate the internal API key header and return its service principal."""
|
|
|
|
settings = get_settings()
|
|
if not settings.api_key and not _has_enabled_keys(settings.api_keys):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail=SecurityErrorDetail.API_KEY_REQUIRED,
|
|
)
|
|
principal = _match_service_key(
|
|
x_api_key,
|
|
settings.api_key,
|
|
settings.api_actor,
|
|
settings.api_keys,
|
|
)
|
|
if principal is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail=SecurityErrorDetail.INVALID_API_KEY,
|
|
)
|
|
return principal
|
|
|
|
|
|
def require_audit_api_key(
|
|
x_audit_api_key: str | None = Header(
|
|
default=None,
|
|
alias=HttpHeader.X_AUDIT_API_KEY,
|
|
),
|
|
) -> ApiPrincipal:
|
|
"""Validate the audit API key and return the audit principal."""
|
|
|
|
settings = get_settings()
|
|
if not settings.audit_api_key and not _has_enabled_keys(settings.audit_api_keys):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail=SecurityErrorDetail.AUDIT_API_KEY_REQUIRED,
|
|
)
|
|
principal = _match_service_key(
|
|
x_audit_api_key,
|
|
settings.audit_api_key,
|
|
settings.audit_api_actor,
|
|
settings.audit_api_keys,
|
|
)
|
|
if principal is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail=SecurityErrorDetail.INVALID_AUDIT_API_KEY,
|
|
)
|
|
return principal
|
|
|
|
|
|
def _has_enabled_keys(configured_keys: list[dict[str, Any]]) -> bool:
|
|
return any(_key_enabled(item) and item.get("key") for item in configured_keys)
|
|
|
|
|
|
def _match_service_key(
|
|
provided_key: str | None,
|
|
legacy_key: str | None,
|
|
legacy_actor: str,
|
|
configured_keys: list[dict[str, Any]],
|
|
) -> ApiPrincipal | None:
|
|
if not provided_key:
|
|
return None
|
|
if legacy_key and compare_digest(provided_key, legacy_key):
|
|
return ApiPrincipal(actor=legacy_actor)
|
|
for item in configured_keys:
|
|
key = item.get("key")
|
|
if not key or not _key_enabled(item):
|
|
continue
|
|
if compare_digest(provided_key, str(key)):
|
|
return ApiPrincipal(actor=str(item.get("actor") or legacy_actor))
|
|
return None
|
|
|
|
|
|
def _key_enabled(item: dict[str, Any]) -> bool:
|
|
value = item.get("enabled", True)
|
|
if isinstance(value, bool):
|
|
return value
|
|
return str(value).strip().lower() not in {"0", "false", "no", "off", "disabled"}
|