- 新增图像生成接口,支持试用、积分和自定义API Key模式 - 实现生成图片结果异步上传至MinIO存储,带重试机制 - 优化积分预扣除和异常退还逻辑,保障用户积分准确 - 添加获取生成历史记录接口,支持时间范围和分页 - 提供本地字典配置接口,支持模型、比例、提示模板和尺寸 - 实现图片批量上传接口,支持S3兼容对象存储 feat(admin): 增加管理员角色管理与权限分配接口 - 实现角色列表查询、角色创建、更新及删除功能 - 增加权限列表查询接口 - 实现用户角色分配接口,便于统一管理用户权限 - 增加系统字典增删查改接口,支持分类过滤和排序 - 权限控制全面覆盖管理接口,保证安全访问 feat(auth): 完善用户登录注册及权限相关接口与页面 - 实现手机号验证码发送及校验功能,保障注册安全 - 支持手机号注册、登录及退出接口,集成日志记录 - 增加修改密码功能,验证原密码后更新 - 提供动态导航菜单接口,基于权限展示不同菜单 - 实现管理界面路由及日志、角色、字典管理页面访问权限控制 - 添加系统日志查询接口,支持关键词和等级筛选 feat(app): 初始化Flask应用并配置蓝图与数据库 - 创建应用程序工厂,加载配置,初始化数据库和Redis客户端 - 注册认证、API及管理员蓝图,整合路由 - 根路由渲染主页模板 - 应用上下文中自动创建数据库表,保证运行环境准备完毕 feat(database): 提供数据库创建与迁移支持脚本 - 新增数据库创建脚本,支持自动检测是否已存在 - 添加数据库表初始化脚本,支持创建和删除所有表 - 实现RBAC权限初始化,包含基础权限和角色创建 - 新增字段手动修复脚本,添加用户API Key和积分字段 - 强制迁移脚本支持清理连接和修复表结构,初始化默认数据及角色分配 feat(config): 新增系统配置参数 - 配置数据库、Redis、Session和MinIO相关参数 - 添加AI接口地址及试用Key配置 - 集成阿里云短信服务配置及开发模式相关参数 feat(extensions): 初始化数据库、Redis和MinIO客户端 - 创建全局SQLAlchemy数据库实例和Redis客户端 - 配置基于boto3的MinIO兼容S3客户端 chore(logs): 添加示例系统日志文件 - 记录用户请求、验证码发送成功与失败的日志信息
214 lines
6.6 KiB
Python
214 lines
6.6 KiB
Python
import codecs
|
|
import re
|
|
from string import ascii_letters, ascii_lowercase, digits
|
|
from typing import Union, overload
|
|
|
|
BASCII_LOWERCASE = ascii_lowercase.encode("ascii")
|
|
BPCT_ALLOWED = {f"%{i:02X}".encode("ascii") for i in range(256)}
|
|
GEN_DELIMS = ":/?#[]@"
|
|
SUB_DELIMS_WITHOUT_QS = "!$'()*,"
|
|
SUB_DELIMS = SUB_DELIMS_WITHOUT_QS + "+&=;"
|
|
RESERVED = GEN_DELIMS + SUB_DELIMS
|
|
UNRESERVED = ascii_letters + digits + "-._~"
|
|
ALLOWED = UNRESERVED + SUB_DELIMS_WITHOUT_QS
|
|
|
|
|
|
_IS_HEX = re.compile(b"[A-Z0-9][A-Z0-9]")
|
|
_IS_HEX_STR = re.compile("[A-Fa-f0-9][A-Fa-f0-9]")
|
|
|
|
utf8_decoder = codecs.getincrementaldecoder("utf-8")
|
|
|
|
|
|
class _Quoter:
|
|
def __init__(
|
|
self,
|
|
*,
|
|
safe: str = "",
|
|
protected: str = "",
|
|
qs: bool = False,
|
|
requote: bool = True,
|
|
) -> None:
|
|
self._safe = safe
|
|
self._protected = protected
|
|
self._qs = qs
|
|
self._requote = requote
|
|
|
|
@overload
|
|
def __call__(self, val: str) -> str: ...
|
|
@overload
|
|
def __call__(self, val: None) -> None: ...
|
|
def __call__(self, val: Union[str, None]) -> Union[str, None]:
|
|
if val is None:
|
|
return None
|
|
if not isinstance(val, str):
|
|
raise TypeError("Argument should be str")
|
|
if not val:
|
|
return ""
|
|
bval = val.encode("utf8", errors="ignore")
|
|
ret = bytearray()
|
|
pct = bytearray()
|
|
safe = self._safe
|
|
safe += ALLOWED
|
|
if not self._qs:
|
|
safe += "+&=;"
|
|
safe += self._protected
|
|
bsafe = safe.encode("ascii")
|
|
idx = 0
|
|
while idx < len(bval):
|
|
ch = bval[idx]
|
|
idx += 1
|
|
|
|
if pct:
|
|
if ch in BASCII_LOWERCASE:
|
|
ch = ch - 32 # convert to uppercase
|
|
pct.append(ch)
|
|
if len(pct) == 3: # pragma: no branch # peephole optimizer
|
|
buf = pct[1:]
|
|
if not _IS_HEX.match(buf):
|
|
ret.extend(b"%25")
|
|
pct.clear()
|
|
idx -= 2
|
|
continue
|
|
try:
|
|
unquoted = chr(int(pct[1:].decode("ascii"), base=16))
|
|
except ValueError:
|
|
ret.extend(b"%25")
|
|
pct.clear()
|
|
idx -= 2
|
|
continue
|
|
|
|
if unquoted in self._protected:
|
|
ret.extend(pct)
|
|
elif unquoted in safe:
|
|
ret.append(ord(unquoted))
|
|
else:
|
|
ret.extend(pct)
|
|
pct.clear()
|
|
|
|
# special case, if we have only one char after "%"
|
|
elif len(pct) == 2 and idx == len(bval):
|
|
ret.extend(b"%25")
|
|
pct.clear()
|
|
idx -= 1
|
|
|
|
continue
|
|
|
|
elif ch == ord("%") and self._requote:
|
|
pct.clear()
|
|
pct.append(ch)
|
|
|
|
# special case if "%" is last char
|
|
if idx == len(bval):
|
|
ret.extend(b"%25")
|
|
|
|
continue
|
|
|
|
if self._qs and ch == ord(" "):
|
|
ret.append(ord("+"))
|
|
continue
|
|
if ch in bsafe:
|
|
ret.append(ch)
|
|
continue
|
|
|
|
ret.extend((f"%{ch:02X}").encode("ascii"))
|
|
|
|
ret2 = ret.decode("ascii")
|
|
if ret2 == val:
|
|
return val
|
|
return ret2
|
|
|
|
|
|
class _Unquoter:
|
|
def __init__(
|
|
self,
|
|
*,
|
|
ignore: str = "",
|
|
unsafe: str = "",
|
|
qs: bool = False,
|
|
plus: bool = False,
|
|
) -> None:
|
|
self._ignore = ignore
|
|
self._unsafe = unsafe
|
|
self._qs = qs
|
|
self._plus = plus # to match urllib.parse.unquote_plus
|
|
self._quoter = _Quoter()
|
|
self._qs_quoter = _Quoter(qs=True)
|
|
|
|
@overload
|
|
def __call__(self, val: str) -> str: ...
|
|
@overload
|
|
def __call__(self, val: None) -> None: ...
|
|
def __call__(self, val: Union[str, None]) -> Union[str, None]:
|
|
if val is None:
|
|
return None
|
|
if not isinstance(val, str):
|
|
raise TypeError("Argument should be str")
|
|
if not val:
|
|
return ""
|
|
decoder = utf8_decoder()
|
|
ret = []
|
|
idx = 0
|
|
while idx < len(val):
|
|
ch = val[idx]
|
|
idx += 1
|
|
if ch == "%" and idx <= len(val) - 2:
|
|
pct = val[idx : idx + 2]
|
|
if _IS_HEX_STR.fullmatch(pct):
|
|
b = bytes([int(pct, base=16)])
|
|
idx += 2
|
|
try:
|
|
unquoted = decoder.decode(b)
|
|
except UnicodeDecodeError:
|
|
start_pct = idx - 3 - len(decoder.buffer) * 3
|
|
ret.append(val[start_pct : idx - 3])
|
|
decoder.reset()
|
|
try:
|
|
unquoted = decoder.decode(b)
|
|
except UnicodeDecodeError:
|
|
ret.append(val[idx - 3 : idx])
|
|
continue
|
|
if not unquoted:
|
|
continue
|
|
if self._qs and unquoted in "+=&;":
|
|
to_add = self._qs_quoter(unquoted)
|
|
if to_add is None: # pragma: no cover
|
|
raise RuntimeError("Cannot quote None")
|
|
ret.append(to_add)
|
|
elif unquoted in self._unsafe or unquoted in self._ignore:
|
|
to_add = self._quoter(unquoted)
|
|
if to_add is None: # pragma: no cover
|
|
raise RuntimeError("Cannot quote None")
|
|
ret.append(to_add)
|
|
else:
|
|
ret.append(unquoted)
|
|
continue
|
|
|
|
if decoder.buffer:
|
|
start_pct = idx - 1 - len(decoder.buffer) * 3
|
|
ret.append(val[start_pct : idx - 1])
|
|
decoder.reset()
|
|
|
|
if ch == "+":
|
|
if (not self._qs and not self._plus) or ch in self._unsafe:
|
|
ret.append("+")
|
|
else:
|
|
ret.append(" ")
|
|
continue
|
|
|
|
if ch in self._unsafe:
|
|
ret.append("%")
|
|
h = hex(ord(ch)).upper()[2:]
|
|
for ch in h:
|
|
ret.append(ch)
|
|
continue
|
|
|
|
ret.append(ch)
|
|
|
|
if decoder.buffer:
|
|
ret.append(val[-len(decoder.buffer) * 3 :])
|
|
|
|
ret2 = "".join(ret)
|
|
if ret2 == val:
|
|
return val
|
|
return ret2
|