gouki
c5982a5706
痛点：secret 多为历史留存，录入那一刻手上常常没有能出码的验证器，
原先「绑定必须 secret + 当前 6 位码校验通过」直接把用户挡在门外。
改为「能验则验，没验就标」，抄错风险由角标持续提醒 + 后置补验兜住。
- 后端：新增 otp_verified_at 记账；code 可选（填了必须通过，错码 400
且不覆盖已绑 secret）；POST /{id}/otp/verify 补验转正；更换 secret
一律重置为未验证；_migrate_assets_db 幂等补列并回填旧数据，避免升级
后全量误报未验证
- 前端：列表区分「2FA 已验证/未验证」徽章，展开区未验证提醒条 + 就地
补验输入；账号查看密码弹窗增加未验证提示；移除 CredentialModal.save()
里的必填预校验（这是留空保存连请求都不发出的根因）
- 测试：pytest 74 绿（新增契约反转 + 6 个补验用例 + 迁移回填用例）；
Playwright 端到端 13/13（留空保存 → 未验证角标 → 错码 400 保持未验证
→ 正码补验转正 → 移动端 375px 无横向溢出 → 无 JS 运行时报错）
- 文档：goal-spec §1/§2/§4/§5/§6/§7/§9 同步新决策，替换旧的必填校验约定
128 lines
4.4 KiB
Python
128 lines
4.4 KiB
Python
"""登录凭据（密码库）CRUD 路由
|
||
|
||
统一入口 /api/credentials，写操作（POST/PUT/DELETE）受 API Key 保护
|
||
（Tailscale 内网/本机放行，外部来源必须携带 X-API-Key）。
|
||
|
||
- 明文密码经 /{id}/password 专用接口解密返回（与账号 reveal 语义一致）
|
||
- 2FA 动态码由服务端生成（secret 永不出库），/{id}/otp 响应 no-store 防缓存残留
|
||
- 录入 secret 与校验它解耦：拿不到当前码可先存（标记未验证），后续 /{id}/otp/verify 补验
|
||
"""
|
||
|
||
from typing import List, Optional
|
||
|
||
from fastapi import APIRouter, Depends, Query, Response
|
||
from sqlmodel import Session
|
||
|
||
from app.core.security import require_api_key
|
||
from app.database import get_session
|
||
from app.schemas.credential import (
|
||
CredentialCreate,
|
||
CredentialRead,
|
||
CredentialUpdate,
|
||
OtpBindRequest,
|
||
OtpVerifyRequest,
|
||
)
|
||
from app.services import credential_service
|
||
|
||
router = APIRouter(prefix="/api/credentials", tags=["credentials"])
|
||
|
||
|
||
@router.get("", response_model=List[CredentialRead], summary="凭据列表（密码库，支持搜索/过滤）")
|
||
def list_credentials(
|
||
q: Optional[str] = Query(default=None, description="搜索站点/用户名/备注"),
|
||
login_type: Optional[str] = Query(default=None, description="登录方式：password/oauth/other"),
|
||
has_otp: Optional[bool] = Query(default=None, description="是否已绑定 2FA"),
|
||
session: Session = Depends(get_session),
|
||
):
|
||
return credential_service.list_credentials(
|
||
session, q=q, login_type=login_type, has_otp=has_otp
|
||
)
|
||
|
||
|
||
@router.post(
|
||
"",
|
||
response_model=CredentialRead,
|
||
status_code=201,
|
||
summary="创建凭据（可同时录入 2FA，动态码可选校验）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def create_credential(data: CredentialCreate, session: Session = Depends(get_session)):
|
||
return credential_service.create_credential(session, data)
|
||
|
||
|
||
@router.put(
|
||
"/{credential_id}",
|
||
response_model=CredentialRead,
|
||
summary="更新凭据（密码：留空不改，空串清除）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def update_credential(
|
||
credential_id: int, data: CredentialUpdate, session: Session = Depends(get_session)
|
||
):
|
||
return credential_service.update_credential(session, credential_id, data)
|
||
|
||
|
||
@router.delete(
|
||
"/{credential_id}",
|
||
summary="删除凭据（账号/资产不受影响，仅解除关联）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def delete_credential(credential_id: int, session: Session = Depends(get_session)) -> dict:
|
||
return credential_service.delete_credential(session, credential_id)
|
||
|
||
|
||
@router.get(
|
||
"/{credential_id}/password",
|
||
summary="查看凭据密码明文（解密返回）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def reveal_password(credential_id: int, session: Session = Depends(get_session)) -> dict:
|
||
return credential_service.reveal_password(session, credential_id)
|
||
|
||
|
||
@router.get(
|
||
"/{credential_id}/otp",
|
||
summary="获取当前 2FA 动态码（服务端生成，secret 不出库）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def current_otp(
|
||
credential_id: int, response: Response, session: Session = Depends(get_session)
|
||
) -> dict:
|
||
# 动态码禁止缓存（浏览器/代理），避免有效期内残留
|
||
response.headers["Cache-Control"] = "no-store"
|
||
return credential_service.current_otp(session, credential_id)
|
||
|
||
|
||
@router.put(
|
||
"/{credential_id}/otp",
|
||
response_model=CredentialRead,
|
||
summary="绑定/更换 2FA（动态码可选：提供则校验通过才落库，留空存为未验证）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def bind_otp(
|
||
credential_id: int, data: OtpBindRequest, session: Session = Depends(get_session)
|
||
):
|
||
return credential_service.bind_otp(session, credential_id, data)
|
||
|
||
|
||
@router.post(
|
||
"/{credential_id}/otp/verify",
|
||
response_model=CredentialRead,
|
||
summary="补验证 2FA（提交当前动态码，通过后解除「未验证」标记）",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def verify_otp(
|
||
credential_id: int, data: OtpVerifyRequest, session: Session = Depends(get_session)
|
||
):
|
||
return credential_service.verify_otp(session, credential_id, data)
|
||
|
||
|
||
@router.delete(
|
||
"/{credential_id}/otp",
|
||
response_model=CredentialRead,
|
||
summary="解绑 2FA",
|
||
dependencies=[Depends(require_api_key)],
|
||
)
|
||
def unbind_otp(credential_id: int, session: Session = Depends(get_session)):
|
||
return credential_service.unbind_otp(session, credential_id)
|