24024
af7c11d7f9
- 新增图像生成接口，支持试用、积分和自定义API Key模式 - 实现生成图片结果异步上传至MinIO存储，带重试机制 - 优化积分预扣除和异常退还逻辑，保障用户积分准确 - 添加获取生成历史记录接口，支持时间范围和分页 - 提供本地字典配置接口，支持模型、比例、提示模板和尺寸 - 实现图片批量上传接口，支持S3兼容对象存储 feat(admin): 增加管理员角色管理与权限分配接口 - 实现角色列表查询、角色创建、更新及删除功能 - 增加权限列表查询接口 - 实现用户角色分配接口，便于统一管理用户权限 - 增加系统字典增删查改接口，支持分类过滤和排序 - 权限控制全面覆盖管理接口，保证安全访问 feat(auth): 完善用户登录注册及权限相关接口与页面 - 实现手机号验证码发送及校验功能，保障注册安全 - 支持手机号注册、登录及退出接口，集成日志记录 - 增加修改密码功能，验证原密码后更新 - 提供动态导航菜单接口，基于权限展示不同菜单 - 实现管理界面路由及日志、角色、字典管理页面访问权限控制 - 添加系统日志查询接口，支持关键词和等级筛选 feat(app): 初始化Flask应用并配置蓝图与数据库 - 创建应用程序工厂，加载配置，初始化数据库和Redis客户端 - 注册认证、API及管理员蓝图，整合路由 - 根路由渲染主页模板 - 应用上下文中自动创建数据库表，保证运行环境准备完毕 feat(database): 提供数据库创建与迁移支持脚本 - 新增数据库创建脚本，支持自动检测是否已存在 - 添加数据库表初始化脚本，支持创建和删除所有表 - 实现RBAC权限初始化，包含基础权限和角色创建 - 新增字段手动修复脚本，添加用户API Key和积分字段 - 强制迁移脚本支持清理连接和修复表结构，初始化默认数据及角色分配 feat(config): 新增系统配置参数 - 配置数据库、Redis、Session和MinIO相关参数 - 添加AI接口地址及试用Key配置 - 集成阿里云短信服务配置及开发模式相关参数 feat(extensions): 初始化数据库、Redis和MinIO客户端 - 创建全局SQLAlchemy数据库实例和Redis客户端 - 配置基于boto3的MinIO兼容S3客户端 chore(logs): 添加示例系统日志文件 - 记录用户请求、验证码发送成功与失败的日志信息
125 lines
3.6 KiB
Python
125 lines
3.6 KiB
Python
# This file is dual licensed under the terms of the Apache License, Version
|
|
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
|
# for complete details.
|
|
|
|
from __future__ import annotations
|
|
|
|
import typing
|
|
|
|
from cryptography import utils
|
|
from cryptography.exceptions import AlreadyFinalized, InvalidKey
|
|
from cryptography.hazmat.primitives import constant_time, hashes, hmac
|
|
from cryptography.hazmat.primitives.kdf import KeyDerivationFunction
|
|
|
|
|
|
def _int_to_u32be(n: int) -> bytes:
|
|
return n.to_bytes(length=4, byteorder="big")
|
|
|
|
|
|
def _common_args_checks(
|
|
algorithm: hashes.HashAlgorithm,
|
|
length: int,
|
|
otherinfo: bytes | None,
|
|
) -> None:
|
|
max_length = algorithm.digest_size * (2**32 - 1)
|
|
if length > max_length:
|
|
raise ValueError(f"Cannot derive keys larger than {max_length} bits.")
|
|
if otherinfo is not None:
|
|
utils._check_bytes("otherinfo", otherinfo)
|
|
|
|
|
|
def _concatkdf_derive(
|
|
key_material: bytes,
|
|
length: int,
|
|
auxfn: typing.Callable[[], hashes.HashContext],
|
|
otherinfo: bytes,
|
|
) -> bytes:
|
|
utils._check_byteslike("key_material", key_material)
|
|
output = [b""]
|
|
outlen = 0
|
|
counter = 1
|
|
|
|
while length > outlen:
|
|
h = auxfn()
|
|
h.update(_int_to_u32be(counter))
|
|
h.update(key_material)
|
|
h.update(otherinfo)
|
|
output.append(h.finalize())
|
|
outlen += len(output[-1])
|
|
counter += 1
|
|
|
|
return b"".join(output)[:length]
|
|
|
|
|
|
class ConcatKDFHash(KeyDerivationFunction):
|
|
def __init__(
|
|
self,
|
|
algorithm: hashes.HashAlgorithm,
|
|
length: int,
|
|
otherinfo: bytes | None,
|
|
backend: typing.Any = None,
|
|
):
|
|
_common_args_checks(algorithm, length, otherinfo)
|
|
self._algorithm = algorithm
|
|
self._length = length
|
|
self._otherinfo: bytes = otherinfo if otherinfo is not None else b""
|
|
|
|
self._used = False
|
|
|
|
def _hash(self) -> hashes.Hash:
|
|
return hashes.Hash(self._algorithm)
|
|
|
|
def derive(self, key_material: bytes) -> bytes:
|
|
if self._used:
|
|
raise AlreadyFinalized
|
|
self._used = True
|
|
return _concatkdf_derive(
|
|
key_material, self._length, self._hash, self._otherinfo
|
|
)
|
|
|
|
def verify(self, key_material: bytes, expected_key: bytes) -> None:
|
|
if not constant_time.bytes_eq(self.derive(key_material), expected_key):
|
|
raise InvalidKey
|
|
|
|
|
|
class ConcatKDFHMAC(KeyDerivationFunction):
|
|
def __init__(
|
|
self,
|
|
algorithm: hashes.HashAlgorithm,
|
|
length: int,
|
|
salt: bytes | None,
|
|
otherinfo: bytes | None,
|
|
backend: typing.Any = None,
|
|
):
|
|
_common_args_checks(algorithm, length, otherinfo)
|
|
self._algorithm = algorithm
|
|
self._length = length
|
|
self._otherinfo: bytes = otherinfo if otherinfo is not None else b""
|
|
|
|
if algorithm.block_size is None:
|
|
raise TypeError(f"{algorithm.name} is unsupported for ConcatKDF")
|
|
|
|
if salt is None:
|
|
salt = b"\x00" * algorithm.block_size
|
|
else:
|
|
utils._check_bytes("salt", salt)
|
|
|
|
self._salt = salt
|
|
|
|
self._used = False
|
|
|
|
def _hmac(self) -> hmac.HMAC:
|
|
return hmac.HMAC(self._salt, self._algorithm)
|
|
|
|
def derive(self, key_material: bytes) -> bytes:
|
|
if self._used:
|
|
raise AlreadyFinalized
|
|
self._used = True
|
|
return _concatkdf_derive(
|
|
key_material, self._length, self._hmac, self._otherinfo
|
|
)
|
|
|
|
def verify(self, key_material: bytes, expected_key: bytes) -> None:
|
|
if not constant_time.bytes_eq(self.derive(key_material), expected_key):
|
|
raise InvalidKey
|