Simon
319 lines
8.8 KiB
Python
319 lines
8.8 KiB
Python
# =============================================================================
|
||
# 企微IT智能服务台 — 管理员用户服务
|
||
# =============================================================================
|
||
# 说明：管理员用户的 CRUD 操作服务
|
||
# =============================================================================
|
||
|
||
import secrets
|
||
import logging
|
||
from datetime import datetime
|
||
from typing import List, Optional, Tuple
|
||
|
||
import bcrypt
|
||
from sqlalchemy import select, func
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
|
||
from app.models.agent import Agent
|
||
from app.utils.error_codes import ErrorCode
|
||
from app.utils.response import AppException
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
|
||
class AdminUserService:
|
||
"""管理员用户服务。
|
||
|
||
提供管理员用户的增删改查、密码验证等功能。
|
||
"""
|
||
|
||
def __init__(self, db: AsyncSession):
|
||
"""初始化服务。
|
||
|
||
Args:
|
||
db: 数据库会话
|
||
"""
|
||
self.db = db
|
||
|
||
async def get_user_by_user_id(self, user_id: str) -> Optional[Agent]:
|
||
"""根据 user_id 查询管理员用户。
|
||
|
||
Args:
|
||
user_id: 企微用户ID
|
||
|
||
Returns:
|
||
Optional[Agent]: 管理员用户，不存在返回 None
|
||
"""
|
||
stmt = select(Agent).where(
|
||
Agent.user_id == user_id,
|
||
Agent.role.in_(["admin", "super_admin"]),
|
||
)
|
||
result = await self.db.execute(stmt)
|
||
return result.scalars().first()
|
||
|
||
async def get_user_by_id(self, id: str) -> Optional[Agent]:
|
||
"""根据 ID 查询管理员用户。
|
||
|
||
Args:
|
||
id: 用户ID
|
||
|
||
Returns:
|
||
Optional[Agent]: 管理员用户，不存在返回 None
|
||
"""
|
||
stmt = select(Agent).where(
|
||
Agent.id == id,
|
||
Agent.role.in_(["admin", "super_admin"]),
|
||
)
|
||
result = await self.db.execute(stmt)
|
||
return result.scalars().first()
|
||
|
||
async def list_admin_users(
|
||
self,
|
||
page: int = 1,
|
||
page_size: int = 20,
|
||
is_active: Optional[bool] = None,
|
||
) -> Tuple[List[Agent], int]:
|
||
"""查询管理员用户列表。
|
||
|
||
Args:
|
||
page: 页码（从1开始）
|
||
page_size: 每页数量
|
||
is_active: 按激活状态过滤
|
||
|
||
Returns:
|
||
Tuple[List[Agent], int]: (用户列表, 总数)
|
||
"""
|
||
# 构建查询
|
||
stmt = select(Agent).where(Agent.role.in_(["admin", "super_admin"]))
|
||
|
||
if is_active is not None:
|
||
stmt = stmt.where(Agent.status == ("online" if is_active else "offline"))
|
||
|
||
# 统计总数
|
||
count_stmt = select(func.count()).select_from(stmt.subquery())
|
||
total_result = await self.db.execute(count_stmt)
|
||
total = total_result.scalar() or 0
|
||
|
||
# 分页查询
|
||
stmt = stmt.order_by(Agent.created_at.desc())
|
||
stmt = stmt.offset((page - 1) * page_size).limit(page_size)
|
||
|
||
result = await self.db.execute(stmt)
|
||
items = list(result.scalars().all())
|
||
|
||
return items, total
|
||
|
||
async def create_admin_user(
|
||
self,
|
||
user_id: str,
|
||
name: str,
|
||
role: str = "admin",
|
||
password: Optional[str] = None,
|
||
) -> Agent:
|
||
"""创建管理员用户。
|
||
|
||
Args:
|
||
user_id: 企微用户ID
|
||
name: 姓名
|
||
role: 角色（admin/super_admin）
|
||
password: 初始密码（可选，不传则生成随机密码）
|
||
|
||
Returns:
|
||
Agent: 创建的用户
|
||
|
||
Raises:
|
||
AppException: 用户已存在
|
||
"""
|
||
# 检查是否已存在
|
||
existing = await self.get_user_by_user_id(user_id)
|
||
if existing:
|
||
raise AppException(ErrorCode.INVALID_PARAMETER, f"用户 {user_id} 已存在")
|
||
|
||
# 生成密码
|
||
if not password:
|
||
password = secrets.token_urlsafe(12) # 生成随机密码
|
||
|
||
# 密码哈希
|
||
password_hash = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
|
||
|
||
# 创建用户
|
||
agent = Agent(
|
||
user_id=user_id,
|
||
name=name,
|
||
role=role,
|
||
status="offline",
|
||
password_hash=password_hash,
|
||
current_load=0,
|
||
max_load=5,
|
||
)
|
||
self.db.add(agent)
|
||
await self.db.flush()
|
||
|
||
logger.info(f"创建管理员用户: user_id={user_id}, role={role}")
|
||
|
||
return agent
|
||
|
||
async def update_admin_user(
|
||
self,
|
||
id: str,
|
||
name: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
is_active: Optional[bool] = None,
|
||
) -> Agent:
|
||
"""更新管理员用户。
|
||
|
||
Args:
|
||
id: 用户ID
|
||
name: 姓名（可选）
|
||
role: 角色（可选）
|
||
is_active: 是否激活（可选）
|
||
|
||
Returns:
|
||
Agent: 更新后的用户
|
||
|
||
Raises:
|
||
AppException: 用户不存在
|
||
"""
|
||
agent = await self.get_user_by_id(id)
|
||
if not agent:
|
||
raise AppException(ErrorCode.NOT_FOUND, "用户不存在")
|
||
|
||
if name is not None:
|
||
agent.name = name
|
||
if role is not None:
|
||
agent.role = role
|
||
if is_active is not None:
|
||
agent.status = "online" if is_active else "offline"
|
||
|
||
agent.updated_at = datetime.now()
|
||
self.db.add(agent)
|
||
await self.db.flush()
|
||
|
||
logger.info(f"更新管理员用户: id={id}")
|
||
|
||
return agent
|
||
|
||
async def delete_admin_user(self, id: str) -> bool:
|
||
"""删除管理员用户。
|
||
|
||
Args:
|
||
id: 用户ID
|
||
|
||
Returns:
|
||
bool: 是否删除成功
|
||
|
||
Raises:
|
||
AppException: 用户不存在或无法删除超级管理员
|
||
"""
|
||
agent = await self.get_user_by_id(id)
|
||
if not agent:
|
||
raise AppException(ErrorCode.NOT_FOUND, "用户不存在")
|
||
|
||
# 不允许删除超级管理员
|
||
if agent.role == "super_admin":
|
||
raise AppException(ErrorCode.FORBIDDEN, "无法删除超级管理员")
|
||
|
||
await self.db.delete(agent)
|
||
await self.db.flush()
|
||
|
||
logger.info(f"删除管理员用户: id={id}")
|
||
|
||
return True
|
||
|
||
async def reset_password(self, id: str, new_password: str) -> Agent:
|
||
"""重置密码。
|
||
|
||
Args:
|
||
id: 用户ID
|
||
new_password: 新密码
|
||
|
||
Returns:
|
||
Agent: 更新后的用户
|
||
|
||
Raises:
|
||
AppException: 用户不存在
|
||
"""
|
||
agent = await self.get_user_by_id(id)
|
||
if not agent:
|
||
raise AppException(ErrorCode.NOT_FOUND, "用户不存在")
|
||
|
||
# 密码哈希
|
||
agent.password_hash = bcrypt.hashpw(new_password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
|
||
agent.updated_at = datetime.now()
|
||
self.db.add(agent)
|
||
await self.db.flush()
|
||
|
||
logger.info(f"重置密码: id={id}")
|
||
|
||
return agent
|
||
|
||
async def verify_password(self, user_id: str, password: str) -> Optional[Agent]:
|
||
"""验证密码。
|
||
|
||
Args:
|
||
user_id: 企微用户ID
|
||
password: 密码
|
||
|
||
Returns:
|
||
Optional[Agent]: 验证成功返回用户，否则返回 None
|
||
"""
|
||
agent = await self.get_user_by_user_id(user_id)
|
||
if not agent:
|
||
return None
|
||
|
||
# 检查密码
|
||
if not agent.password_hash:
|
||
return None
|
||
|
||
if not bcrypt.checkpw(password.encode("utf-8"), agent.password_hash.encode("utf-8")):
|
||
return None
|
||
|
||
return agent
|
||
|
||
|
||
async def init_super_admin(db: AsyncSession) -> Optional[Agent]:
|
||
"""初始化超级管理员。
|
||
|
||
从环境变量读取配置，创建超级管理员用户（如果不存在）。
|
||
|
||
环境变量：
|
||
ADMIN_USERNAME: 超级管理员用户名（必填）
|
||
ADMIN_PASSWORD: 超级管理员密码（必填）
|
||
ADMIN_NAME: 超级管理员姓名（可选，默认"超级管理员"）
|
||
|
||
Args:
|
||
db: 数据库会话
|
||
|
||
Returns:
|
||
Optional[Agent]: 创建/已有的超级管理员用户
|
||
"""
|
||
import os
|
||
|
||
admin_username = os.getenv("ADMIN_USERNAME")
|
||
admin_password = os.getenv("ADMIN_PASSWORD")
|
||
admin_name = os.getenv("ADMIN_NAME", "超级管理员")
|
||
|
||
if not admin_username or not admin_password:
|
||
logger.info("未配置超级管理员，跳过初始化")
|
||
return None
|
||
|
||
service = AdminUserService(db)
|
||
|
||
# 检查是否已存在
|
||
existing = await service.get_user_by_user_id(admin_username)
|
||
if existing:
|
||
logger.info(f"超级管理员已存在: user_id={admin_username}")
|
||
return existing
|
||
|
||
# 创建超级管理员
|
||
agent = await service.create_admin_user(
|
||
user_id=admin_username,
|
||
name=admin_name,
|
||
role="super_admin",
|
||
password=admin_password,
|
||
)
|
||
await db.commit()
|
||
|
||
logger.info(f"超级管理员初始化成功: user_id={admin_username}")
|
||
|
||
return agent
|