337 lines
13 KiB
Python
337 lines
13 KiB
Python
"""
|
||
会会短信验证码登录代理（真实开放平台对接）
|
||
──────────────────────────────────────────────
|
||
严格按会会开放平台 sign.js 签名范式：
|
||
- 公共字段 appId/accessId/timestamp(12小时制hh)/signType/signVersion/accessSecret/nonce 合并业务参数
|
||
- 过滤空值 → 字典序排序 → k=v& 拼接 → 末尾追加 accessSecret=secretKey → MD5/SHA256 大写
|
||
- 认证服务基址 / appId / accessId / accessSecret / clientCode 走环境变量
|
||
真实端点（来自 fat-open 网关 usercenter 的 Swagger）：
|
||
- 发送验证码：POST {BASE}{HUIHUI_SMS_SEND_PATH} 默认 /open/mobile/sms/code （query 参数）
|
||
- 短信登录： POST {BASE}{HUIHUI_SMS_LOGIN_PATH} 默认 /open/login/token，loginType=code
|
||
登录成功后建/链本地 users 表（按会会 userId 唯一），签发本系统 app_token 作为会话。
|
||
无真实凭证时仍可走 DEV_MOCK 兜底联调。
|
||
"""
|
||
import os
|
||
import uuid
|
||
import random
|
||
import string
|
||
import hashlib
|
||
import httpx
|
||
from datetime import datetime, timezone, timedelta
|
||
|
||
from fastapi import APIRouter, Body, Depends, Header
|
||
from sqlalchemy.orm import Session
|
||
|
||
# 会会网关按北京时间(Asia/Shanghai, UTC+8)校验时间戳，容器默认 UTC 会导致签名被拒。
|
||
# 用固定 +8 偏移（不依赖 tzdata，slim 镜像缺 IANA 库时会抛 ZoneInfoNotFoundError）。
|
||
_CN_TZ = timezone(timedelta(hours=8))
|
||
|
||
from database import get_db
|
||
from models import User
|
||
from responses import ok, fail
|
||
|
||
router = APIRouter(tags=["会会账号"])
|
||
|
||
# ── 会会开放平台配置（环境变量）──
|
||
AUTH_BASE_URL = os.getenv("HUIHUI_AUTH_BASE_URL", "https://fat-open.99hui.com/api/usercenter")
|
||
APP_ID = os.getenv("HUIHUI_APP_ID", "")
|
||
ACCESS_ID = os.getenv("HUIHUI_ACCESS_ID", "")
|
||
ACCESS_SECRET = os.getenv("HUIHUI_ACCESS_SECRET", "")
|
||
CLIENT_CODE = os.getenv("HUIHUI_CLIENT_CODE", "")
|
||
SMS_SEND_PATH = os.getenv("HUIHUI_SMS_SEND_PATH", "/open/mobile/sms/code")
|
||
SMS_LOGIN_PATH = os.getenv("HUIHUI_SMS_LOGIN_PATH", "/open/login/token")
|
||
|
||
# 临时开发态：无真实会会凭证时，本地模拟短信收发，便于端到端联调。
|
||
DEV_MOCK = os.getenv("HUIHUI_DEV_MOCK", "false").lower() in ("1", "true", "yes")
|
||
_mock_codes: dict[str, tuple[str, float]] = {}
|
||
_MOCK_TTL = 300
|
||
|
||
|
||
# ── 签名体系（完全对应 sign.js）──
|
||
def _get_nonce() -> str:
|
||
# 与会会 sign.js 一致：base36 随机串
|
||
return "".join(random.choices(string.ascii_lowercase + string.digits, k=12))
|
||
|
||
|
||
def _get_timestamp() -> str:
|
||
# 与会会 sign.js 一致：yyyyMMddHHmmss（24 小时制大写 HH）。
|
||
# 实测：会会 common.format 走 24 小时制，用 12 小时制(%I)会被网关判"签名验证失败"。
|
||
# 必须用北京时间，否则容器(UTC)生成的时间戳与会会网关校验窗口偏差 8h 被拒。
|
||
return datetime.now(_CN_TZ).strftime("%Y%m%d%H%M%S")
|
||
|
||
|
||
def _make_sign(params: dict, secret_key: str, sign_type: str = "MD5") -> str:
|
||
SIGN_KEY = "signature"
|
||
SECRET_KEY = "accessSecret"
|
||
keys = sorted(params.keys())
|
||
parts = []
|
||
for k in keys:
|
||
if k in (SIGN_KEY, SECRET_KEY):
|
||
continue
|
||
v = params.get(k)
|
||
if v is None or v == "" or v == []:
|
||
continue
|
||
if isinstance(v, list):
|
||
continue
|
||
parts.append(f"{k}={v}")
|
||
sign_str = "&".join(parts) + f"&{SECRET_KEY}={secret_key}"
|
||
if sign_type.upper() == "SHA256":
|
||
return hashlib.sha256(sign_str.encode("utf-8")).hexdigest().upper()
|
||
return hashlib.md5(sign_str.encode("utf-8")).hexdigest().upper()
|
||
|
||
|
||
def _build_form(extra: dict) -> dict:
|
||
sign_type = "MD5"
|
||
sign_version = "1.0"
|
||
secret = ACCESS_SECRET
|
||
base = {
|
||
"appId": APP_ID,
|
||
"accessId": ACCESS_ID,
|
||
"timestamp": _get_timestamp(),
|
||
"signType": sign_type,
|
||
"signVersion": sign_version,
|
||
"accessSecret": secret,
|
||
"nonce": _get_nonce(),
|
||
}
|
||
base.update(extra)
|
||
signature = _make_sign(base, secret, sign_type) if secret else ""
|
||
base["signature"] = signature
|
||
base.pop("accessSecret", None) # 不发送密钥
|
||
return base
|
||
|
||
|
||
def _pick(d: dict, *keys, default=""):
|
||
for k in keys:
|
||
if d.get(k) not in (None, ""):
|
||
return d[k]
|
||
return default
|
||
|
||
|
||
def _cfg_ready() -> bool:
|
||
return bool(AUTH_BASE_URL and APP_ID and ACCESS_ID and ACCESS_SECRET)
|
||
|
||
|
||
def _call_huihui(path: str, params: dict, as_query: bool = False):
|
||
"""调用会会接口，返回 (ok: bool, payload: dict, http_status: int)"""
|
||
url = f"{AUTH_BASE_URL}{path}"
|
||
with httpx.Client(timeout=30, follow_redirects=True) as c:
|
||
if as_query:
|
||
resp = c.post(url, params=params)
|
||
else:
|
||
resp = c.post(url, data=params)
|
||
try:
|
||
data = resp.json()
|
||
except Exception:
|
||
return False, {"message": f"会会返回非JSON: {resp.text[:200]}"}, resp.status_code
|
||
# 会会统一包装 {code, message, data}
|
||
code = data.get("code")
|
||
if resp.status_code == 200 and code in (0, 200, "0", "200"):
|
||
return True, data, resp.status_code
|
||
return False, data, resp.status_code
|
||
|
||
|
||
@router.post("/huihui/sms/send")
|
||
def sms_send(body: dict = Body(...)):
|
||
"""请求会会发送短信验证码（真实开放平台 /open/mobile/sms/code）"""
|
||
phone = (body.get("phone") or "").strip()
|
||
if not phone or not phone.isdigit() or len(phone) != 11:
|
||
return fail("请输入正确的 11 位手机号", 400)
|
||
|
||
# 临时开发态：本地模拟发码
|
||
if DEV_MOCK and not _cfg_ready():
|
||
code = str(random.randint(100000, 999999))
|
||
_mock_codes[phone] = (code, datetime.now().timestamp() + _MOCK_TTL)
|
||
return ok({"sent": True, "devCode": code, "dev": True})
|
||
|
||
if not _cfg_ready():
|
||
return fail("会会短信服务未配置（缺少 HUIHUI_APP_ID / HUIHUI_ACCESS_ID / HUIHUI_ACCESS_SECRET）", 500)
|
||
|
||
# /open/mobile/sms/code：mobile 与公共字段均走 query
|
||
form = _build_form({"mobile": phone})
|
||
ok_flag, data, status = _call_huihui(SMS_SEND_PATH, form, as_query=True)
|
||
if not ok_flag:
|
||
return fail(data.get("message") or f"发送失败(HTTP {status})", 502)
|
||
return ok({"sent": True})
|
||
|
||
|
||
@router.post("/huihui/sms/login")
|
||
def sms_login(body: dict = Body(...), db: Session = Depends(get_db)):
|
||
"""短信验证码登录：调会会 /open/login/token(loginType=code) 换取 access_token + userId，落库并签发本系统会话"""
|
||
phone = (body.get("phone") or "").strip()
|
||
code = (body.get("code") or "").strip()
|
||
if not phone or not code:
|
||
return fail("手机号或验证码缺失", 400)
|
||
|
||
# 临时开发态：本地校验模拟码
|
||
if DEV_MOCK and not _cfg_ready():
|
||
rec = _mock_codes.get(phone)
|
||
if not rec or rec[1] < datetime.now().timestamp():
|
||
return fail("验证码已失效，请重新获取", 401)
|
||
if rec[0] != code:
|
||
return fail("验证码错误", 401)
|
||
_mock_codes.pop(phone, None)
|
||
return _issue_session(db, phone, {
|
||
"userId": f"dev_{phone}",
|
||
"nickname": f"会会用户{phone[-4:]}",
|
||
"avatarUrl": "",
|
||
"token": f"dev_token_{phone}",
|
||
})
|
||
|
||
if not _cfg_ready():
|
||
return fail("会会登录服务未配置", 500)
|
||
|
||
extra = {
|
||
"username": phone,
|
||
"password": code,
|
||
"loginType": "code",
|
||
"grantType": "password",
|
||
"isRegister": "true",
|
||
}
|
||
if CLIENT_CODE:
|
||
extra["clientCode"] = CLIENT_CODE
|
||
form = _build_form(extra)
|
||
ok_flag, data, status = _call_huihui(SMS_LOGIN_PATH, form, as_query=False)
|
||
if not ok_flag:
|
||
return fail(data.get("message") or f"登录失败(HTTP {status})", 401)
|
||
|
||
raw = data.get("data") or {}
|
||
user_info = raw.get("userInfo", {}) if isinstance(raw, dict) else {}
|
||
huihui_token = (
|
||
_pick(raw, "accessToken", "access_token", "token")
|
||
or _pick(user_info, "accessToken", "access_token", "token")
|
||
)
|
||
huihui_user_id = (
|
||
_pick(raw, "openid", "userId", "uid", "openId", "id")
|
||
or _pick(user_info, "openid", "userId", "uid", "openId", "id")
|
||
)
|
||
nickname = (
|
||
_pick(raw, "nickName", "nickname", "name", "userName")
|
||
or _pick(user_info, "nickName", "nickname", "name", "userName")
|
||
)
|
||
avatar_url = (
|
||
_pick(raw, "avatar", "avatarUrl", "headImgUrl", "headimgurl")
|
||
or _pick(user_info, "avatar", "avatarUrl", "headImgUrl", "headimgurl")
|
||
)
|
||
if not huihui_user_id:
|
||
return fail("会会未返回用户标识", 502)
|
||
|
||
return _issue_session(db, phone, {
|
||
"userId": huihui_user_id,
|
||
"nickname": nickname,
|
||
"avatarUrl": avatar_url,
|
||
"token": huihui_token,
|
||
})
|
||
|
||
|
||
@router.post("/huihui/pwd/login")
|
||
def pwd_login(body: dict = Body(...), db: Session = Depends(get_db)):
|
||
"""账号密码登录：调会会 /open/login/token(loginType=password) 换取 access_token + userId，落库并签发本系统会话。
|
||
与 news_service 既有对接完全一致：username=账号/手机号, password=密码, loginType=password, grantType=password, isRegister=false。
|
||
"""
|
||
account = (body.get("account") or "").strip()
|
||
password = (body.get("password") or "").strip()
|
||
if not account or not password:
|
||
return fail("账号或密码缺失", 400)
|
||
|
||
if not _cfg_ready():
|
||
return fail("会会登录服务未配置", 500)
|
||
|
||
extra = {
|
||
"username": account,
|
||
"password": password,
|
||
"loginType": "password",
|
||
"grantType": "password",
|
||
"isRegister": "false",
|
||
}
|
||
if CLIENT_CODE:
|
||
extra["clientCode"] = CLIENT_CODE
|
||
form = _build_form(extra)
|
||
ok_flag, data, status = _call_huihui(SMS_LOGIN_PATH, form, as_query=False)
|
||
if not ok_flag:
|
||
return fail(data.get("message") or f"登录失败(HTTP {status})", 401)
|
||
|
||
raw = data.get("data") or {}
|
||
user_info = raw.get("userInfo", {}) if isinstance(raw, dict) else {}
|
||
huihui_token = (
|
||
_pick(raw, "accessToken", "access_token", "token")
|
||
or _pick(user_info, "accessToken", "access_token", "token")
|
||
)
|
||
huihui_user_id = (
|
||
_pick(raw, "openid", "userId", "uid", "openId", "id")
|
||
or _pick(user_info, "openid", "userId", "uid", "openId", "id")
|
||
)
|
||
nickname = (
|
||
_pick(raw, "nickName", "nickname", "name", "userName")
|
||
or _pick(user_info, "nickName", "nickname", "name", "userName")
|
||
)
|
||
avatar_url = (
|
||
_pick(raw, "avatar", "avatarUrl", "headImgUrl", "headimgurl")
|
||
or _pick(user_info, "avatar", "avatarUrl", "headImgUrl", "headimgurl")
|
||
)
|
||
if not huihui_user_id:
|
||
return fail("会会未返回用户标识", 502)
|
||
|
||
# 账号即手机号时记录，便于资料展示；非手机号（用户名）则不覆盖已有 phone
|
||
phone = account if (account.isdigit() and len(account) == 11) else ""
|
||
return _issue_session(db, phone, {
|
||
"userId": huihui_user_id,
|
||
"nickname": nickname,
|
||
"avatarUrl": avatar_url,
|
||
"token": huihui_token,
|
||
})
|
||
|
||
|
||
def _issue_session(db: Session, phone: str, info: dict):
|
||
"""建/链本地用户并签发本系统会话 token"""
|
||
huihui_user_id = info.get("userId", "")
|
||
user = db.query(User).filter(User.huihui_user_id == huihui_user_id).first()
|
||
if not user:
|
||
user = User(huihui_user_id=huihui_user_id)
|
||
if phone:
|
||
user.phone = phone
|
||
if info.get("nickname"):
|
||
user.nickname = info["nickname"]
|
||
if info.get("avatarUrl"):
|
||
user.avatar_url = info["avatarUrl"]
|
||
user.huihui_token = info.get("token", "")
|
||
user.app_token = uuid.uuid4().hex
|
||
user.last_login_at = datetime.now()
|
||
db.add(user)
|
||
db.commit()
|
||
db.refresh(user)
|
||
|
||
return ok({
|
||
"token": user.app_token,
|
||
"user": user.to_dict(),
|
||
"huihui": {
|
||
"userId": huihui_user_id,
|
||
"nickname": info.get("nickname", ""),
|
||
"avatarUrl": info.get("avatarUrl", ""),
|
||
"token": info.get("token", ""),
|
||
},
|
||
})
|
||
|
||
|
||
@router.get("/huihui/me")
|
||
def me(authorization: str = Header(None), db: Session = Depends(get_db)):
|
||
"""当前登录用户信息（Bearer app_token）"""
|
||
if not authorization:
|
||
return fail("未登录", 401)
|
||
token = authorization.replace("Bearer ", "", 1).replace("bearer ", "", 1).strip()
|
||
user = db.query(User).filter(User.app_token == token).first()
|
||
if not user:
|
||
return fail("会话无效或已过期", 401)
|
||
return ok(user.to_dict())
|
||
|
||
|
||
@router.post("/huihui/logout")
|
||
def logout(authorization: str = Header(None), db: Session = Depends(get_db)):
|
||
"""退出登录（作废 app_token）"""
|
||
if authorization:
|
||
token = authorization.replace("Bearer ", "", 1).replace("bearer ", "", 1).strip()
|
||
user = db.query(User).filter(User.app_token == token).first()
|
||
if user:
|
||
user.app_token = ""
|
||
db.commit()
|
||
return ok({"success": True})
|