24024
af7c11d7f9
- 新增图像生成接口，支持试用、积分和自定义API Key模式 - 实现生成图片结果异步上传至MinIO存储，带重试机制 - 优化积分预扣除和异常退还逻辑，保障用户积分准确 - 添加获取生成历史记录接口，支持时间范围和分页 - 提供本地字典配置接口，支持模型、比例、提示模板和尺寸 - 实现图片批量上传接口，支持S3兼容对象存储 feat(admin): 增加管理员角色管理与权限分配接口 - 实现角色列表查询、角色创建、更新及删除功能 - 增加权限列表查询接口 - 实现用户角色分配接口，便于统一管理用户权限 - 增加系统字典增删查改接口，支持分类过滤和排序 - 权限控制全面覆盖管理接口，保证安全访问 feat(auth): 完善用户登录注册及权限相关接口与页面 - 实现手机号验证码发送及校验功能，保障注册安全 - 支持手机号注册、登录及退出接口，集成日志记录 - 增加修改密码功能，验证原密码后更新 - 提供动态导航菜单接口，基于权限展示不同菜单 - 实现管理界面路由及日志、角色、字典管理页面访问权限控制 - 添加系统日志查询接口，支持关键词和等级筛选 feat(app): 初始化Flask应用并配置蓝图与数据库 - 创建应用程序工厂，加载配置，初始化数据库和Redis客户端 - 注册认证、API及管理员蓝图，整合路由 - 根路由渲染主页模板 - 应用上下文中自动创建数据库表，保证运行环境准备完毕 feat(database): 提供数据库创建与迁移支持脚本 - 新增数据库创建脚本，支持自动检测是否已存在 - 添加数据库表初始化脚本，支持创建和删除所有表 - 实现RBAC权限初始化，包含基础权限和角色创建 - 新增字段手动修复脚本，添加用户API Key和积分字段 - 强制迁移脚本支持清理连接和修复表结构，初始化默认数据及角色分配 feat(config): 新增系统配置参数 - 配置数据库、Redis、Session和MinIO相关参数 - 添加AI接口地址及试用Key配置 - 集成阿里云短信服务配置及开发模式相关参数 feat(extensions): 初始化数据库、Redis和MinIO客户端 - 创建全局SQLAlchemy数据库实例和Redis客户端 - 配置基于boto3的MinIO兼容S3客户端 chore(logs): 添加示例系统日志文件 - 记录用户请求、验证码发送成功与失败的日志信息
122 lines
4.1 KiB
Python
122 lines
4.1 KiB
Python
import re
|
|
from typing import TYPE_CHECKING, Tuple, Type, TypeVar
|
|
|
|
from .typedefs import Handler, Middleware
|
|
from .web_exceptions import HTTPMove, HTTPPermanentRedirect
|
|
from .web_request import Request
|
|
from .web_response import StreamResponse
|
|
from .web_urldispatcher import SystemRoute
|
|
|
|
__all__ = (
|
|
"middleware",
|
|
"normalize_path_middleware",
|
|
)
|
|
|
|
if TYPE_CHECKING:
|
|
from .web_app import Application
|
|
|
|
_Func = TypeVar("_Func")
|
|
|
|
|
|
async def _check_request_resolves(request: Request, path: str) -> Tuple[bool, Request]:
|
|
alt_request = request.clone(rel_url=path)
|
|
|
|
match_info = await request.app.router.resolve(alt_request)
|
|
alt_request._match_info = match_info
|
|
|
|
if match_info.http_exception is None:
|
|
return True, alt_request
|
|
|
|
return False, request
|
|
|
|
|
|
def middleware(f: _Func) -> _Func:
|
|
f.__middleware_version__ = 1 # type: ignore[attr-defined]
|
|
return f
|
|
|
|
|
|
def normalize_path_middleware(
|
|
*,
|
|
append_slash: bool = True,
|
|
remove_slash: bool = False,
|
|
merge_slashes: bool = True,
|
|
redirect_class: Type[HTTPMove] = HTTPPermanentRedirect,
|
|
) -> Middleware:
|
|
"""Factory for producing a middleware that normalizes the path of a request.
|
|
|
|
Normalizing means:
|
|
- Add or remove a trailing slash to the path.
|
|
- Double slashes are replaced by one.
|
|
|
|
The middleware returns as soon as it finds a path that resolves
|
|
correctly. The order if both merge and append/remove are enabled is
|
|
1) merge slashes
|
|
2) append/remove slash
|
|
3) both merge slashes and append/remove slash.
|
|
If the path resolves with at least one of those conditions, it will
|
|
redirect to the new path.
|
|
|
|
Only one of `append_slash` and `remove_slash` can be enabled. If both
|
|
are `True` the factory will raise an assertion error
|
|
|
|
If `append_slash` is `True` the middleware will append a slash when
|
|
needed. If a resource is defined with trailing slash and the request
|
|
comes without it, it will append it automatically.
|
|
|
|
If `remove_slash` is `True`, `append_slash` must be `False`. When enabled
|
|
the middleware will remove trailing slashes and redirect if the resource
|
|
is defined
|
|
|
|
If merge_slashes is True, merge multiple consecutive slashes in the
|
|
path into one.
|
|
"""
|
|
correct_configuration = not (append_slash and remove_slash)
|
|
assert correct_configuration, "Cannot both remove and append slash"
|
|
|
|
@middleware
|
|
async def impl(request: Request, handler: Handler) -> StreamResponse:
|
|
if isinstance(request.match_info.route, SystemRoute):
|
|
paths_to_check = []
|
|
if "?" in request.raw_path:
|
|
path, query = request.raw_path.split("?", 1)
|
|
query = "?" + query
|
|
else:
|
|
query = ""
|
|
path = request.raw_path
|
|
|
|
if merge_slashes:
|
|
paths_to_check.append(re.sub("//+", "/", path))
|
|
if append_slash and not request.path.endswith("/"):
|
|
paths_to_check.append(path + "/")
|
|
if remove_slash and request.path.endswith("/"):
|
|
paths_to_check.append(path[:-1])
|
|
if merge_slashes and append_slash:
|
|
paths_to_check.append(re.sub("//+", "/", path + "/"))
|
|
if merge_slashes and remove_slash:
|
|
merged_slashes = re.sub("//+", "/", path)
|
|
paths_to_check.append(merged_slashes[:-1])
|
|
|
|
for path in paths_to_check:
|
|
path = re.sub("^//+", "/", path) # SECURITY: GHSA-v6wp-4m6f-gcjg
|
|
resolves, request = await _check_request_resolves(request, path)
|
|
if resolves:
|
|
raise redirect_class(request.raw_path + query)
|
|
|
|
return await handler(request)
|
|
|
|
return impl
|
|
|
|
|
|
def _fix_request_current_app(app: "Application") -> Middleware:
|
|
@middleware
|
|
async def impl(request: Request, handler: Handler) -> StreamResponse:
|
|
match_info = request.match_info
|
|
prev = match_info.current_app
|
|
match_info.current_app = app
|
|
try:
|
|
return await handler(request)
|
|
finally:
|
|
match_info.current_app = prev
|
|
|
|
return impl
|