mirror of
https://github.com/jxxghp/MoviePilot.git
synced 2026-08-12 17:24:34 +08:00
514 lines
16 KiB
Python
514 lines
16 KiB
Python
"""
|
||
MFA (Multi-Factor Authentication) API 端点
|
||
包含 OTP 和 PassKey 相关功能
|
||
"""
|
||
|
||
from datetime import timedelta
|
||
from typing import Any, Annotated, Optional
|
||
|
||
from app.helper.sites import SitesHelper
|
||
from fastapi import APIRouter, Depends, HTTPException, Body, Request, Response
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
|
||
from app import schemas
|
||
from app.core import security
|
||
from app.core.config import settings
|
||
from app.db import get_async_db
|
||
from app.db.models.passkey import PassKey
|
||
from app.db.models.user import User
|
||
from app.db.systemconfig_oper import SystemConfigOper
|
||
from app.db.user_oper import get_current_active_user, get_current_active_user_async
|
||
from app.helper.passkey import (
|
||
PassKeyHelper,
|
||
PassKeyRegistrationOriginMismatchError,
|
||
PassKeyRegistrationVerificationError,
|
||
PasskeyChallengeStore,
|
||
)
|
||
from app.log import logger
|
||
from app.schemas.types import SystemConfigKey
|
||
from app.utils.otp import OtpUtils
|
||
|
||
router = APIRouter()
|
||
|
||
# ==================== 辅助函数 ====================
|
||
|
||
|
||
def _build_credential_list(passkeys: list[PassKey]) -> list[dict[str, Any]]:
|
||
"""
|
||
构建凭证列表
|
||
|
||
:param passkeys: PassKey 列表
|
||
:return: 凭证字典列表
|
||
"""
|
||
return (
|
||
[
|
||
{"credential_id": pk.credential_id, "transports": pk.transports}
|
||
for pk in passkeys
|
||
]
|
||
if passkeys
|
||
else []
|
||
)
|
||
|
||
|
||
def _extract_and_standardize_credential_id(credential: dict) -> str:
|
||
"""
|
||
从凭证中提取并标准化 credential_id
|
||
|
||
:param credential: 凭证字典
|
||
:return: 标准化后的 credential_id
|
||
:raises ValueError: 如果凭证无效
|
||
"""
|
||
credential_id_raw = credential.get("id") or credential.get("rawId")
|
||
if not credential_id_raw:
|
||
raise ValueError("无效的凭证")
|
||
return PassKeyHelper.standardize_credential_id(credential_id_raw)
|
||
|
||
|
||
def _verify_passkey_and_update(
|
||
credential: dict, challenge: str, passkey: PassKey
|
||
) -> tuple[bool, int]:
|
||
"""
|
||
验证 PassKey 并更新使用时间和签名计数
|
||
|
||
:param credential: 凭证字典
|
||
:param challenge: 挑战值
|
||
:param passkey: PassKey 对象
|
||
:return: (验证是否成功, 新的签名计数)
|
||
"""
|
||
success, new_sign_count = PassKeyHelper.verify_authentication_response(
|
||
credential=credential,
|
||
expected_challenge=challenge,
|
||
credential_public_key=passkey.public_key,
|
||
credential_current_sign_count=passkey.sign_count,
|
||
)
|
||
|
||
if success:
|
||
passkey.update_last_used(db=None, sign_count=new_sign_count)
|
||
|
||
return success, new_sign_count
|
||
|
||
|
||
# ==================== 请求模型 ====================
|
||
|
||
|
||
class OtpVerifyRequest(schemas.BaseModel):
|
||
"""OTP验证请求"""
|
||
|
||
uri: str
|
||
otpPassword: str
|
||
|
||
|
||
class OtpDisableRequest(schemas.BaseModel):
|
||
"""OTP禁用请求"""
|
||
|
||
password: str
|
||
|
||
|
||
class PassKeyDeleteRequest(schemas.BaseModel):
|
||
"""PassKey删除请求"""
|
||
|
||
passkey_id: int
|
||
password: str
|
||
|
||
|
||
# ==================== 通用 MFA 接口 ====================
|
||
|
||
|
||
@router.get(
|
||
"/status/{username}",
|
||
summary="判断用户是否开启二次验证",
|
||
response_model=schemas.Response,
|
||
)
|
||
async def mfa_status(username: str, db: AsyncSession = Depends(get_async_db)) -> Any:
|
||
"""
|
||
检查指定用户是否启用了二次验证
|
||
"""
|
||
user: User = await User.async_get_by_name(db, username)
|
||
if not user:
|
||
return schemas.Response(success=False)
|
||
|
||
# 检查是否启用了OTP
|
||
has_otp = user.is_otp
|
||
|
||
return schemas.Response(success=has_otp)
|
||
|
||
|
||
# ==================== OTP 相关接口 ====================
|
||
|
||
|
||
@router.post(
|
||
"/otp/generate", summary="生成 OTP 验证 URI", response_model=schemas.Response
|
||
)
|
||
def otp_generate(
|
||
current_user: Annotated[User, Depends(get_current_active_user)],
|
||
) -> Any:
|
||
"""生成 OTP 密钥及对应的 URI"""
|
||
secret, uri = OtpUtils.generate_secret_key(current_user.name)
|
||
return schemas.Response(success=secret != "", data={"secret": secret, "uri": uri})
|
||
|
||
|
||
@router.post("/otp/verify", summary="绑定并验证 OTP", response_model=schemas.Response)
|
||
async def otp_verify(
|
||
data: OtpVerifyRequest,
|
||
db: AsyncSession = Depends(get_async_db),
|
||
current_user: User = Depends(get_current_active_user_async),
|
||
) -> Any:
|
||
"""验证用户输入的 OTP 码，验证通过后正式开启 OTP 验证"""
|
||
if not OtpUtils.is_legal(data.uri, data.otpPassword):
|
||
return schemas.Response(success=False, message="验证码错误")
|
||
await current_user.async_update_otp_by_name(
|
||
db, current_user.name, True, OtpUtils.get_secret(data.uri)
|
||
)
|
||
return schemas.Response(success=True)
|
||
|
||
|
||
@router.post(
|
||
"/otp/disable", summary="关闭当前用户的 OTP 验证", response_model=schemas.Response
|
||
)
|
||
async def otp_disable(
|
||
data: OtpDisableRequest,
|
||
db: AsyncSession = Depends(get_async_db),
|
||
current_user: User = Depends(get_current_active_user_async),
|
||
) -> Any:
|
||
"""关闭当前用户的 OTP 验证功能"""
|
||
# 验证密码
|
||
if not security.verify_password(data.password, str(current_user.hashed_password)):
|
||
return schemas.Response(success=False, message="密码错误")
|
||
await current_user.async_update_otp_by_name(db, current_user.name, False, "")
|
||
return schemas.Response(success=True)
|
||
|
||
|
||
# ==================== PassKey 相关接口 ====================
|
||
|
||
|
||
class PassKeyRegistrationStart(schemas.BaseModel):
|
||
"""PassKey注册开始请求"""
|
||
|
||
name: str = "通行密钥"
|
||
|
||
|
||
class PassKeyRegistrationFinish(schemas.BaseModel):
|
||
"""PassKey注册完成请求"""
|
||
|
||
credential: dict
|
||
transaction_token: str
|
||
name: str = "通行密钥"
|
||
|
||
|
||
class PassKeyAuthenticationStart(schemas.BaseModel):
|
||
"""PassKey认证开始请求"""
|
||
|
||
username: Optional[str] = None
|
||
|
||
|
||
class PassKeyAuthenticationFinish(schemas.BaseModel):
|
||
"""PassKey认证完成请求"""
|
||
|
||
credential: dict
|
||
transaction_token: str
|
||
|
||
|
||
@router.post(
|
||
"/passkey/register/start",
|
||
summary="开始注册 PassKey",
|
||
response_model=schemas.Response,
|
||
)
|
||
def passkey_register_start(
|
||
current_user: Annotated[User, Depends(get_current_active_user)],
|
||
) -> Any:
|
||
"""开始注册 PassKey - 生成注册选项"""
|
||
try:
|
||
# 获取用户已有的PassKey
|
||
existing_passkeys = PassKey.get_by_user_id(db=None, user_id=current_user.id)
|
||
existing_credentials = (
|
||
_build_credential_list(existing_passkeys) if existing_passkeys else None
|
||
)
|
||
|
||
# 生成注册选项
|
||
options_json, challenge = PassKeyHelper.generate_registration_options(
|
||
user_id=current_user.id,
|
||
username=current_user.name,
|
||
display_name=current_user.settings.get("nickname")
|
||
if current_user.settings
|
||
else None,
|
||
existing_credentials=existing_credentials,
|
||
)
|
||
|
||
transaction_token = PasskeyChallengeStore.issue(
|
||
challenge=challenge,
|
||
purpose="registration",
|
||
user_id=current_user.id,
|
||
)
|
||
return schemas.Response(
|
||
success=True,
|
||
data={"options": options_json, "transaction_token": transaction_token},
|
||
)
|
||
except Exception as e:
|
||
logger.error(f"生成PassKey注册选项失败: {e}")
|
||
return schemas.Response(success=False, message=f"生成注册选项失败: {str(e)}")
|
||
|
||
|
||
@router.post(
|
||
"/passkey/register/finish",
|
||
summary="完成注册 PassKey",
|
||
response_model=schemas.Response,
|
||
)
|
||
def passkey_register_finish(
|
||
passkey_req: PassKeyRegistrationFinish,
|
||
current_user: Annotated[User, Depends(get_current_active_user)],
|
||
) -> Any:
|
||
"""完成注册 PassKey - 验证并保存凭证"""
|
||
try:
|
||
challenge_state = PasskeyChallengeStore.consume(
|
||
transaction_token=passkey_req.transaction_token,
|
||
purpose="registration",
|
||
)
|
||
if not challenge_state or challenge_state.user_id != current_user.id:
|
||
return schemas.Response(
|
||
success=False,
|
||
message="注册请求已失效，请重新发起注册",
|
||
)
|
||
|
||
# 验证注册响应
|
||
credential_id, public_key, sign_count, aaguid = (
|
||
PassKeyHelper.verify_registration_response(
|
||
credential=passkey_req.credential,
|
||
expected_challenge=challenge_state.challenge,
|
||
)
|
||
)
|
||
|
||
# 提取transports
|
||
transports = None
|
||
if (
|
||
"response" in passkey_req.credential
|
||
and "transports" in passkey_req.credential["response"]
|
||
):
|
||
transports = ",".join(passkey_req.credential["response"]["transports"])
|
||
|
||
# 保存到数据库
|
||
passkey = PassKey(
|
||
user_id=current_user.id,
|
||
credential_id=credential_id,
|
||
public_key=public_key,
|
||
sign_count=sign_count,
|
||
name=passkey_req.name or "通行密钥",
|
||
aaguid=aaguid,
|
||
transports=transports,
|
||
)
|
||
passkey.create()
|
||
|
||
logger.info(f"用户 {current_user.name} 成功注册PassKey: {passkey_req.name}")
|
||
|
||
return schemas.Response(success=True, message="通行密钥注册成功")
|
||
except PassKeyRegistrationOriginMismatchError:
|
||
return schemas.Response(
|
||
success=False,
|
||
message="访问域名与系统配置不一致，请使用配置的域名重试",
|
||
)
|
||
except PassKeyRegistrationVerificationError:
|
||
return schemas.Response(
|
||
success=False,
|
||
message="通行密钥注册验证失败，请重新发起注册后重试",
|
||
)
|
||
except Exception as e:
|
||
logger.error(f"注册PassKey失败: {e}")
|
||
return schemas.Response(success=False, message="通行密钥注册失败，请稍后重试")
|
||
|
||
|
||
@router.post(
|
||
"/passkey/authenticate/start",
|
||
summary="开始 PassKey 认证",
|
||
response_model=schemas.Response,
|
||
)
|
||
def passkey_authenticate_start(
|
||
passkey_req: PassKeyAuthenticationStart = Body(...),
|
||
) -> Any:
|
||
"""开始 PassKey 认证 - 生成认证选项"""
|
||
try:
|
||
existing_credentials = None
|
||
user_id = None
|
||
|
||
# 如果指定了用户名，只允许该用户的PassKey
|
||
if passkey_req.username:
|
||
user = User.get_by_name(db=None, name=passkey_req.username)
|
||
existing_passkeys = (
|
||
PassKey.get_by_user_id(db=None, user_id=user.id) if user else None
|
||
)
|
||
|
||
if not user or not existing_passkeys:
|
||
return schemas.Response(success=False, message="认证失败")
|
||
|
||
existing_credentials = _build_credential_list(existing_passkeys)
|
||
user_id = user.id
|
||
|
||
# 生成认证选项
|
||
options_json, challenge = PassKeyHelper.generate_authentication_options(
|
||
existing_credentials=existing_credentials
|
||
)
|
||
|
||
transaction_token = PasskeyChallengeStore.issue(
|
||
challenge=challenge,
|
||
purpose="authentication",
|
||
user_id=user_id,
|
||
)
|
||
return schemas.Response(
|
||
success=True,
|
||
data={"options": options_json, "transaction_token": transaction_token},
|
||
)
|
||
except Exception as e:
|
||
logger.error(f"生成PassKey认证选项失败: {e}")
|
||
return schemas.Response(success=False, message="认证失败")
|
||
|
||
|
||
@router.post(
|
||
"/passkey/authenticate/finish",
|
||
summary="完成 PassKey 认证",
|
||
response_model=schemas.Token,
|
||
)
|
||
def passkey_authenticate_finish(
|
||
request: Request, response: Response, passkey_req: PassKeyAuthenticationFinish
|
||
) -> Any:
|
||
"""完成 PassKey 认证 - 验证凭证并返回 token"""
|
||
try:
|
||
challenge_state = PasskeyChallengeStore.consume(
|
||
transaction_token=passkey_req.transaction_token,
|
||
purpose="authentication",
|
||
)
|
||
if not challenge_state:
|
||
raise HTTPException(status_code=401, detail="认证请求已失效")
|
||
|
||
# 提取并标准化凭证ID
|
||
try:
|
||
credential_id = _extract_and_standardize_credential_id(
|
||
passkey_req.credential
|
||
)
|
||
except ValueError as e:
|
||
logger.warning(f"PassKey认证失败，提供的凭证无效: {e}")
|
||
raise HTTPException(status_code=401, detail="认证失败")
|
||
|
||
# 查找PassKey并获取用户
|
||
passkey = PassKey.get_by_credential_id(db=None, credential_id=credential_id)
|
||
user = User.get_by_id(db=None, user_id=passkey.user_id) if passkey else None
|
||
if not passkey or not user or not user.is_active:
|
||
raise HTTPException(status_code=401, detail="认证失败")
|
||
if challenge_state.user_id is not None and challenge_state.user_id != user.id:
|
||
raise HTTPException(status_code=401, detail="认证失败")
|
||
|
||
# 验证认证响应并更新
|
||
success, _ = _verify_passkey_and_update(
|
||
credential=passkey_req.credential,
|
||
challenge=challenge_state.challenge,
|
||
passkey=passkey,
|
||
)
|
||
|
||
if not success:
|
||
raise HTTPException(status_code=401, detail="认证失败")
|
||
|
||
logger.info(f"用户 {user.name} 通过PassKey认证成功")
|
||
|
||
# 生成token
|
||
level = SitesHelper().auth_level
|
||
show_wizard = (
|
||
not SystemConfigOper().get(SystemConfigKey.SetupWizardState)
|
||
and not settings.ADVANCED_MODE
|
||
)
|
||
|
||
access_token = security.create_access_token(
|
||
userid=user.id,
|
||
username=user.name,
|
||
super_user=user.is_superuser,
|
||
expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES),
|
||
level=level,
|
||
)
|
||
security.set_or_refresh_resource_token_cookie(
|
||
request,
|
||
response,
|
||
schemas.TokenPayload(
|
||
sub=user.id,
|
||
username=user.name,
|
||
super_user=user.is_superuser,
|
||
level=level,
|
||
purpose="authentication",
|
||
),
|
||
)
|
||
|
||
return schemas.Token(
|
||
access_token=access_token,
|
||
token_type="bearer",
|
||
super_user=user.is_superuser,
|
||
user_id=user.id,
|
||
user_name=user.name,
|
||
avatar=user.avatar,
|
||
level=level,
|
||
permissions=user.permissions or {},
|
||
wizard=show_wizard,
|
||
)
|
||
except HTTPException:
|
||
raise
|
||
except Exception as e:
|
||
logger.error(f"PassKey认证失败: {e}")
|
||
raise HTTPException(status_code=401, detail="认证失败")
|
||
|
||
|
||
@router.get(
|
||
"/passkey/list",
|
||
summary="获取当前用户的 PassKey 列表",
|
||
response_model=schemas.Response,
|
||
)
|
||
def passkey_list(
|
||
current_user: Annotated[User, Depends(get_current_active_user)],
|
||
) -> Any:
|
||
"""获取当前用户的所有 PassKey"""
|
||
try:
|
||
passkeys = PassKey.get_by_user_id(db=None, user_id=current_user.id)
|
||
|
||
key_list = (
|
||
[
|
||
{
|
||
"id": pk.id,
|
||
"name": pk.name,
|
||
"created_at": pk.created_at.isoformat() if pk.created_at else None,
|
||
"last_used_at": pk.last_used_at.isoformat()
|
||
if pk.last_used_at
|
||
else None,
|
||
"aaguid": pk.aaguid,
|
||
"transports": pk.transports,
|
||
}
|
||
for pk in passkeys
|
||
]
|
||
if passkeys
|
||
else []
|
||
)
|
||
|
||
return schemas.Response(success=True, data=key_list)
|
||
except Exception as e:
|
||
logger.error(f"获取PassKey列表失败: {e}")
|
||
return schemas.Response(success=False, message=f"获取列表失败: {str(e)}")
|
||
|
||
|
||
@router.post("/passkey/delete", summary="删除 PassKey", response_model=schemas.Response)
|
||
async def passkey_delete(
|
||
data: PassKeyDeleteRequest,
|
||
current_user: User = Depends(get_current_active_user_async),
|
||
) -> Any:
|
||
"""删除指定的 PassKey"""
|
||
try:
|
||
# 验证密码
|
||
if not security.verify_password(
|
||
data.password, str(current_user.hashed_password)
|
||
):
|
||
return schemas.Response(success=False, message="密码错误")
|
||
|
||
success = PassKey.delete_by_id(
|
||
db=None, passkey_id=data.passkey_id, user_id=current_user.id
|
||
)
|
||
|
||
if success:
|
||
logger.info(f"用户 {current_user.name} 删除了PassKey: {data.passkey_id}")
|
||
return schemas.Response(success=True, message="通行密钥已删除")
|
||
else:
|
||
return schemas.Response(success=False, message="通行密钥不存在或无权删除")
|
||
except Exception as e:
|
||
logger.error(f"删除PassKey失败: {e}")
|
||
return schemas.Response(success=False, message=f"删除失败: {str(e)}")
|