mirror of
https://github.com/fawney19/Aether.git
synced 2026-09-02 09:20:22 +08:00
refactor: 移除 Python 后端源码，全面迁移至 Rust gateway 架构
- 删除全部 Python 源码 (src/) 及 Alembic 迁移脚本，归档至 _deprecated_py_src/ - 重构 Rust gateway ai_pipeline: 拆分 planner/finalize 模块，新增 contracts/adaptation 层 - 重组 handlers 模块为 admin/public/proxy/internal/shared 子模块结构 - 新增 executor 模块，引入 Rust 原生数据库迁移 (aether-data/migrations) - 简化 CI/Docker 构建流程，移除 base image 二级构建，统一为单一 app image - 移除 Python 相关基础设施文件 (entrypoint.sh, gunicorn_conf.py, Dockerfile.base)
This commit is contained in:
fawney19
5
_deprecated_py_src/services/auth/oauth/__init__.py
Normal file
5
_deprecated_py_src/services/auth/oauth/__init__.py
Normal file
@@ -0,0 +1,5 @@
|
||||
"""OAuth 认证相关服务。"""
|
||||
|
||||
from .service import OAuthService
|
||||
|
||||
__all__ = ["OAuthService"]
|
||||
111
_deprecated_py_src/services/auth/oauth/base.py
Normal file
111
_deprecated_py_src/services/auth/oauth/base.py
Normal file
@@ -0,0 +1,111 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from abc import ABC, abstractmethod
|
||||
from typing import TYPE_CHECKING
|
||||
from urllib.parse import urlencode, urlparse, urlunparse
|
||||
|
||||
import httpx
|
||||
|
||||
from src.services.auth.oauth.models import OAuthFlowError, OAuthToken, OAuthUserInfo
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.database import OAuthProvider
|
||||
|
||||
|
||||
class OAuthProviderBase(ABC):
|
||||
"""
|
||||
OAuth Provider 基类（稳定扩展点）。
|
||||
|
||||
v1 收敛点：仅实现 OAuth2 授权码流程所需的最小接口。
|
||||
"""
|
||||
|
||||
provider_type: str
|
||||
display_name: str
|
||||
|
||||
# 允许的 host 白名单（用于端点覆盖校验，支持子域名）
|
||||
allowed_domains: tuple[str, ...] = ()
|
||||
|
||||
authorization_url: str
|
||||
token_url: str
|
||||
userinfo_url: str
|
||||
default_scopes: tuple[str, ...] = ()
|
||||
|
||||
def get_effective_authorization_url(self, config: OAuthProvider) -> str:
|
||||
return config.authorization_url_override or self.authorization_url
|
||||
|
||||
def get_effective_token_url(self, config: OAuthProvider) -> str:
|
||||
return config.token_url_override or self.token_url
|
||||
|
||||
def get_effective_userinfo_url(self, config: OAuthProvider) -> str:
|
||||
return config.userinfo_url_override or self.userinfo_url
|
||||
|
||||
def get_effective_scopes(self, config: OAuthProvider) -> str:
|
||||
scopes = config.scopes or list(self.default_scopes)
|
||||
return " ".join(scopes)
|
||||
|
||||
def get_authorization_url(self, config: OAuthProvider, state: str) -> str:
|
||||
"""
|
||||
构造 provider 授权 URL。
|
||||
|
||||
redirect_uri 必须由服务端控制，不从客户端传入。
|
||||
"""
|
||||
base = self.get_effective_authorization_url(config)
|
||||
# 避免覆盖原有 query（若 provider 默认 url 带 query，保留）
|
||||
parsed = urlparse(base)
|
||||
query: dict[str, str] = {}
|
||||
if parsed.query:
|
||||
# 保留已有 query 参数
|
||||
for kv in parsed.query.split("&"):
|
||||
if not kv:
|
||||
continue
|
||||
if "=" in kv:
|
||||
k, v = kv.split("=", 1)
|
||||
query[k] = v
|
||||
else:
|
||||
query[kv] = ""
|
||||
|
||||
client_id = config.client_id
|
||||
redirect_uri = config.redirect_uri
|
||||
if not client_id or not redirect_uri:
|
||||
raise ValueError("OAuthProvider 配置不完整：client_id/redirect_uri 不能为空")
|
||||
|
||||
query.update(
|
||||
{
|
||||
"response_type": "code",
|
||||
"client_id": client_id,
|
||||
"redirect_uri": redirect_uri,
|
||||
"state": state,
|
||||
}
|
||||
)
|
||||
scopes = self.get_effective_scopes(config)
|
||||
if scopes:
|
||||
query["scope"] = scopes
|
||||
|
||||
return urlunparse(parsed._replace(query=urlencode(query)))
|
||||
|
||||
@abstractmethod
|
||||
async def exchange_code(self, config: OAuthProvider, code: str) -> OAuthToken:
|
||||
"""使用授权码兑换 token。"""
|
||||
|
||||
@abstractmethod
|
||||
async def get_user_info(self, config: OAuthProvider, access_token: str) -> OAuthUserInfo:
|
||||
"""获取用户信息。"""
|
||||
|
||||
async def _http_post_form(
|
||||
self,
|
||||
url: str,
|
||||
data: dict[str, str],
|
||||
*,
|
||||
timeout_seconds: float = 5.0,
|
||||
headers: dict[str, str] | None = None,
|
||||
) -> httpx.Response:
|
||||
raise OAuthFlowError("provider_unavailable", "OAuth 仅支持 Rust executor")
|
||||
|
||||
async def _http_get(
|
||||
self,
|
||||
url: str,
|
||||
*,
|
||||
timeout_seconds: float = 5.0,
|
||||
headers: dict[str, str] | None = None,
|
||||
) -> httpx.Response:
|
||||
raise OAuthFlowError("provider_unavailable", "OAuth 仅支持 Rust executor")
|
||||
31
_deprecated_py_src/services/auth/oauth/models.py
Normal file
31
_deprecated_py_src/services/auth/oauth/models.py
Normal file
@@ -0,0 +1,31 @@
|
||||
from dataclasses import dataclass
|
||||
from typing import Any
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class OAuthToken:
|
||||
access_token: str
|
||||
token_type: str = "bearer"
|
||||
refresh_token: str | None = None
|
||||
expires_in: int | None = None
|
||||
id_token: str | None = None
|
||||
scope: str | None = None
|
||||
raw: dict[str, Any] | None = None
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class OAuthUserInfo:
|
||||
id: str
|
||||
username: str | None = None
|
||||
email: str | None = None
|
||||
email_verified: bool | None = None
|
||||
raw: dict[str, Any] | None = None
|
||||
|
||||
|
||||
class OAuthFlowError(Exception):
|
||||
"""用于 OAuth 流程的可控错误（会映射到 error_code）。"""
|
||||
|
||||
def __init__(self, error_code: str, detail: str = ""):
|
||||
super().__init__(error_code)
|
||||
self.error_code = error_code
|
||||
self.detail = detail
|
||||
@@ -0,0 +1,5 @@
|
||||
"""内置 OAuth providers（v1）。"""
|
||||
|
||||
from .linuxdo import LinuxDoOAuthProvider
|
||||
|
||||
__all__ = ["LinuxDoOAuthProvider"]
|
||||
171
_deprecated_py_src/services/auth/oauth/providers/linuxdo.py
Normal file
171
_deprecated_py_src/services/auth/oauth/providers/linuxdo.py
Normal file
@@ -0,0 +1,171 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import base64
|
||||
from collections.abc import Awaitable, Callable
|
||||
from typing import TYPE_CHECKING, Any
|
||||
from urllib.parse import urlparse
|
||||
|
||||
import httpx
|
||||
|
||||
from src.core.logger import logger
|
||||
from src.services.auth.oauth.base import OAuthProviderBase
|
||||
from src.services.auth.oauth.models import OAuthFlowError, OAuthToken, OAuthUserInfo
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.database import OAuthProvider
|
||||
|
||||
|
||||
class LinuxDoOAuthProvider(OAuthProviderBase):
|
||||
"""
|
||||
LinuxDo OAuth Provider。
|
||||
|
||||
基于论坛信任等级（trust_level 0-4）的 OAuth2 认证，
|
||||
用于通过用户等级进行额度配给和频率限制。
|
||||
|
||||
参考：https://linux.do/t/topic/329408
|
||||
|
||||
返回的用户信息示例：
|
||||
{
|
||||
"id": 1,
|
||||
"username": "neo",
|
||||
"name": "Neo",
|
||||
"active": true,
|
||||
"trust_level": 4,
|
||||
"email": "u1@linux.do",
|
||||
"avatar_url": "https://linux.do/xxxx",
|
||||
"silenced": false
|
||||
}
|
||||
"""
|
||||
|
||||
provider_type = "linuxdo"
|
||||
display_name = "Linux Do"
|
||||
|
||||
allowed_domains = ("linux.do", "connect.linux.do", "connect.linuxdo.org")
|
||||
|
||||
# 默认端点
|
||||
authorization_url = "https://connect.linux.do/oauth2/authorize"
|
||||
token_url = "https://connect.linux.do/oauth2/token"
|
||||
userinfo_url = "https://connect.linux.do/api/user"
|
||||
backup_token_url = "https://connect.linuxdo.org/oauth2/token"
|
||||
backup_userinfo_url = "https://connect.linuxdo.org/api/user"
|
||||
|
||||
# LinuxDo 不需要 scope
|
||||
default_scopes = ()
|
||||
|
||||
@staticmethod
|
||||
def _build_basic_auth_header(client_id: str, client_secret: str) -> str:
|
||||
credentials = f"{client_id}:{client_secret}".encode("utf-8")
|
||||
return f"Basic {base64.b64encode(credentials).decode('ascii')}"
|
||||
|
||||
@staticmethod
|
||||
def _build_candidate_urls(primary_url: str, backup_url: str) -> list[str]:
|
||||
parsed = urlparse(primary_url)
|
||||
host = (parsed.hostname or "").lower().rstrip(".")
|
||||
backup_path = urlparse(backup_url).path
|
||||
urls = [primary_url]
|
||||
if parsed.scheme == "https" and host == "connect.linux.do" and parsed.path == backup_path:
|
||||
urls.append(backup_url)
|
||||
return urls
|
||||
|
||||
@staticmethod
|
||||
async def _request_with_fallback(
|
||||
candidate_urls: list[str],
|
||||
request_fn: Callable[[str], Awaitable[httpx.Response]],
|
||||
error_code: str,
|
||||
label: str,
|
||||
) -> httpx.Response:
|
||||
resp: httpx.Response | None = None
|
||||
for idx, url in enumerate(candidate_urls):
|
||||
try:
|
||||
resp = await request_fn(url)
|
||||
break
|
||||
except httpx.HTTPError as exc:
|
||||
if idx < len(candidate_urls) - 1:
|
||||
logger.warning("LinuxDo {} 端点不可达，尝试备用端点: {} ({})", label, url, exc)
|
||||
continue
|
||||
logger.warning("LinuxDo {} 请求失败: {} ({})", label, url, exc)
|
||||
raise OAuthFlowError(error_code, "transport_error") from exc
|
||||
if resp is None:
|
||||
raise OAuthFlowError(error_code, "no_response")
|
||||
return resp
|
||||
|
||||
async def exchange_code(self, config: OAuthProvider, code: str) -> OAuthToken:
|
||||
client_secret = config.get_client_secret()
|
||||
if not client_secret:
|
||||
raise OAuthFlowError("provider_unavailable", "client_secret 未配置")
|
||||
|
||||
redirect_uri = config.redirect_uri
|
||||
client_id = config.client_id
|
||||
if not redirect_uri or not client_id:
|
||||
raise OAuthFlowError("provider_unavailable", "redirect_uri/client_id 未配置")
|
||||
|
||||
candidate_urls = self._build_candidate_urls(
|
||||
self.get_effective_token_url(config), self.backup_token_url
|
||||
)
|
||||
headers = {
|
||||
"Authorization": self._build_basic_auth_header(client_id, client_secret),
|
||||
"Accept": "application/json",
|
||||
}
|
||||
resp = await self._request_with_fallback(
|
||||
candidate_urls,
|
||||
lambda url: self._http_post_form(
|
||||
url,
|
||||
data={
|
||||
"grant_type": "authorization_code",
|
||||
"code": code,
|
||||
"redirect_uri": redirect_uri,
|
||||
},
|
||||
headers=headers,
|
||||
),
|
||||
error_code="token_exchange_failed",
|
||||
label="token",
|
||||
)
|
||||
|
||||
if resp.status_code >= 400:
|
||||
logger.warning("LinuxDo token 兑换失败: status={}", resp.status_code)
|
||||
raise OAuthFlowError("token_exchange_failed", f"status={resp.status_code}")
|
||||
|
||||
data = resp.json()
|
||||
access_token = data.get("access_token")
|
||||
if not access_token:
|
||||
raise OAuthFlowError("token_exchange_failed", "missing access_token")
|
||||
|
||||
return OAuthToken(
|
||||
access_token=str(access_token),
|
||||
token_type=str(data.get("token_type") or "bearer"),
|
||||
refresh_token=(str(data["refresh_token"]) if data.get("refresh_token") else None),
|
||||
expires_in=(int(data["expires_in"]) if data.get("expires_in") is not None else None),
|
||||
id_token=(str(data["id_token"]) if data.get("id_token") else None),
|
||||
scope=(str(data["scope"]) if data.get("scope") else None),
|
||||
raw=data,
|
||||
)
|
||||
|
||||
async def get_user_info(self, config: OAuthProvider, access_token: str) -> OAuthUserInfo:
|
||||
candidate_urls = self._build_candidate_urls(
|
||||
self.get_effective_userinfo_url(config), self.backup_userinfo_url
|
||||
)
|
||||
resp = await self._request_with_fallback(
|
||||
candidate_urls,
|
||||
lambda url: self._http_get(url, headers={"Authorization": f"Bearer {access_token}"}),
|
||||
error_code="userinfo_fetch_failed",
|
||||
label="userinfo",
|
||||
)
|
||||
|
||||
if resp.status_code >= 400:
|
||||
logger.warning("LinuxDo userinfo 获取失败: status={}", resp.status_code)
|
||||
raise OAuthFlowError("userinfo_fetch_failed", f"status={resp.status_code}")
|
||||
|
||||
data: dict[str, Any] = resp.json()
|
||||
|
||||
# LinuxDo 返回的 id 是数字类型
|
||||
provider_user_id = data.get("id")
|
||||
if provider_user_id is None:
|
||||
raise OAuthFlowError("userinfo_fetch_failed", "missing user id")
|
||||
|
||||
return OAuthUserInfo(
|
||||
id=str(provider_user_id),
|
||||
username=data.get("username"),
|
||||
email=str(data["email"]).lower() if data.get("email") else None,
|
||||
email_verified=None, # LinuxDo 不返回此字段
|
||||
raw=data, # 包含 trust_level, active, silenced, avatar_url, name 等
|
||||
)
|
||||
95
_deprecated_py_src/services/auth/oauth/registry.py
Normal file
95
_deprecated_py_src/services/auth/oauth/registry.py
Normal file
@@ -0,0 +1,95 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass
|
||||
|
||||
from src.core.logger import logger
|
||||
from src.services.auth.oauth.base import OAuthProviderBase
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class SupportedOAuthType:
|
||||
provider_type: str
|
||||
display_name: str
|
||||
# 默认端点（用于前端 placeholder 展示）
|
||||
default_authorization_url: str
|
||||
default_token_url: str
|
||||
default_userinfo_url: str
|
||||
default_scopes: tuple[str, ...]
|
||||
|
||||
|
||||
class OAuthProviderRegistry:
|
||||
"""Provider 注册表（支持延迟 discover）。"""
|
||||
|
||||
def __init__(self) -> None:
|
||||
self._providers: dict[str, OAuthProviderBase] = {}
|
||||
self._discovered: bool = False
|
||||
|
||||
def discover_providers(self) -> None:
|
||||
"""发现并注册 providers（幂等）。"""
|
||||
if self._discovered:
|
||||
return
|
||||
self._discovered = True
|
||||
|
||||
# 1) 内置 providers（v1：至少保证 linuxdo 可用）
|
||||
try:
|
||||
from src.services.auth.oauth.providers.linuxdo import LinuxDoOAuthProvider
|
||||
|
||||
self.register(LinuxDoOAuthProvider())
|
||||
except Exception as exc:
|
||||
logger.warning("OAuth 内置 provider 加载失败: {}", exc)
|
||||
|
||||
# 2) entry_points 插件（可选）
|
||||
try:
|
||||
from importlib.metadata import entry_points
|
||||
|
||||
eps = entry_points()
|
||||
# Python 3.10+ 支持 select；旧接口返回 dict
|
||||
if hasattr(eps, "select"):
|
||||
candidates = list(eps.select(group="aether.oauth_providers")) # type: ignore[attr-defined]
|
||||
else:
|
||||
candidates = list(eps.get("aether.oauth_providers", [])) # type: ignore[call-arg]
|
||||
|
||||
for ep in candidates:
|
||||
try:
|
||||
loaded = ep.load()
|
||||
provider = loaded() if isinstance(loaded, type) else loaded
|
||||
if not isinstance(provider, OAuthProviderBase):
|
||||
logger.warning(
|
||||
"OAuth provider entry_point 无效: {} (type={})", ep.name, type(provider)
|
||||
)
|
||||
continue
|
||||
self.register(provider)
|
||||
except Exception as e:
|
||||
logger.warning("OAuth provider entry_point 加载失败: {}: {}", ep.name, e)
|
||||
except Exception as exc:
|
||||
# entry_points 不可用不影响主流程
|
||||
logger.debug("OAuth entry_points discover skipped: {}", exc)
|
||||
|
||||
def register(self, provider: OAuthProviderBase) -> None:
|
||||
self._providers[provider.provider_type] = provider
|
||||
|
||||
def get_provider(self, provider_type: str) -> OAuthProviderBase | None:
|
||||
return self._providers.get(provider_type)
|
||||
|
||||
def get_supported_types(self) -> list[SupportedOAuthType]:
|
||||
return [
|
||||
SupportedOAuthType(
|
||||
provider_type=p.provider_type,
|
||||
display_name=p.display_name,
|
||||
default_authorization_url=p.authorization_url,
|
||||
default_token_url=p.token_url,
|
||||
default_userinfo_url=p.userinfo_url,
|
||||
default_scopes=p.default_scopes,
|
||||
)
|
||||
for p in sorted(self._providers.values(), key=lambda x: x.provider_type)
|
||||
]
|
||||
|
||||
|
||||
_registry: OAuthProviderRegistry | None = None
|
||||
|
||||
|
||||
def get_oauth_provider_registry() -> OAuthProviderRegistry:
|
||||
global _registry
|
||||
if _registry is None:
|
||||
_registry = OAuthProviderRegistry()
|
||||
return _registry
|
||||
1069
_deprecated_py_src/services/auth/oauth/service.py
Normal file
1069
_deprecated_py_src/services/auth/oauth/service.py
Normal file
File diff suppressed because it is too large
Load Diff
145
_deprecated_py_src/services/auth/oauth/state.py
Normal file
145
_deprecated_py_src/services/auth/oauth/state.py
Normal file
@@ -0,0 +1,145 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import secrets
|
||||
import time
|
||||
from collections.abc import Awaitable
|
||||
from dataclasses import dataclass
|
||||
from typing import Any, cast
|
||||
|
||||
from redis.asyncio import Redis
|
||||
|
||||
OAUTH_STATE_TTL_SECONDS = 600
|
||||
OAUTH_STATE_KEY_PREFIX = "oauth_state:"
|
||||
|
||||
# OAuth bind token: 用于安全地在浏览器跳转时传递用户身份
|
||||
# 短期有效（5分钟），一次性使用
|
||||
OAUTH_BIND_TOKEN_TTL_SECONDS = 300
|
||||
OAUTH_BIND_TOKEN_KEY_PREFIX = "oauth_bind_token:"
|
||||
|
||||
|
||||
CONSUME_STATE_SCRIPT = r"""
|
||||
local value = redis.call("GET", KEYS[1])
|
||||
if value then
|
||||
redis.call("DEL", KEYS[1])
|
||||
end
|
||||
return value
|
||||
"""
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class OAuthStateData:
|
||||
nonce: str
|
||||
provider_type: str
|
||||
action: str # "login" | "bind"
|
||||
user_id: str | None
|
||||
client_device_id: str | None
|
||||
created_at: int
|
||||
|
||||
@classmethod
|
||||
def from_dict(cls, data: dict[str, Any]) -> OAuthStateData:
|
||||
return cls(
|
||||
nonce=str(data.get("nonce") or ""),
|
||||
provider_type=str(data.get("provider_type") or ""),
|
||||
action=str(data.get("action") or ""),
|
||||
user_id=data.get("user_id"),
|
||||
client_device_id=data.get("client_device_id"),
|
||||
created_at=int(data.get("created_at") or 0),
|
||||
)
|
||||
|
||||
|
||||
def _state_key(nonce: str) -> str:
|
||||
return f"{OAUTH_STATE_KEY_PREFIX}{nonce}"
|
||||
|
||||
|
||||
async def create_oauth_state(
|
||||
redis: Redis,
|
||||
*,
|
||||
provider_type: str,
|
||||
action: str,
|
||||
user_id: str | None = None,
|
||||
client_device_id: str | None = None,
|
||||
) -> str:
|
||||
nonce = secrets.token_urlsafe(24)
|
||||
data = {
|
||||
"nonce": nonce,
|
||||
"provider_type": provider_type,
|
||||
"action": action,
|
||||
"user_id": user_id,
|
||||
"client_device_id": client_device_id,
|
||||
"created_at": int(time.time()),
|
||||
}
|
||||
await redis.setex(_state_key(nonce), OAUTH_STATE_TTL_SECONDS, json.dumps(data))
|
||||
return nonce
|
||||
|
||||
|
||||
async def consume_oauth_state(redis: Redis, nonce: str) -> OAuthStateData | None:
|
||||
if not nonce:
|
||||
return None
|
||||
|
||||
key = _state_key(nonce)
|
||||
# redis-py 的类型标注在 sync/async 之间会出现 Union；这里明确按 async 处理。
|
||||
raw = await cast(Awaitable[str | None], redis.eval(CONSUME_STATE_SCRIPT, 1, key))
|
||||
if not raw:
|
||||
return None
|
||||
|
||||
try:
|
||||
parsed = json.loads(raw)
|
||||
except json.JSONDecodeError:
|
||||
return None
|
||||
|
||||
return OAuthStateData.from_dict(parsed)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class OAuthBindTokenData:
|
||||
"""OAuth 绑定临时令牌数据，用于浏览器跳转场景的安全认证"""
|
||||
|
||||
token: str
|
||||
user_id: str
|
||||
provider_type: str
|
||||
created_at: int
|
||||
|
||||
@classmethod
|
||||
def from_dict(cls, data: dict[str, Any]) -> OAuthBindTokenData:
|
||||
return cls(
|
||||
token=str(data.get("token") or ""),
|
||||
user_id=str(data.get("user_id") or ""),
|
||||
provider_type=str(data.get("provider_type") or ""),
|
||||
created_at=int(data.get("created_at") or 0),
|
||||
)
|
||||
|
||||
|
||||
def _bind_token_key(token: str) -> str:
|
||||
return f"{OAUTH_BIND_TOKEN_KEY_PREFIX}{token}"
|
||||
|
||||
|
||||
async def create_oauth_bind_token(redis: Redis, *, user_id: str, provider_type: str) -> str:
|
||||
"""创建一次性 OAuth 绑定令牌，用于浏览器跳转场景"""
|
||||
token = secrets.token_urlsafe(32)
|
||||
data = {
|
||||
"token": token,
|
||||
"user_id": user_id,
|
||||
"provider_type": provider_type,
|
||||
"created_at": int(time.time()),
|
||||
}
|
||||
await redis.setex(_bind_token_key(token), OAUTH_BIND_TOKEN_TTL_SECONDS, json.dumps(data))
|
||||
return token
|
||||
|
||||
|
||||
async def consume_oauth_bind_token(redis: Redis, token: str) -> OAuthBindTokenData | None:
|
||||
"""消费（验证并删除）OAuth 绑定令牌，返回令牌数据或 None"""
|
||||
if not token:
|
||||
return None
|
||||
|
||||
key = _bind_token_key(token)
|
||||
raw = await cast(Awaitable[str | None], redis.eval(CONSUME_STATE_SCRIPT, 1, key))
|
||||
if not raw:
|
||||
return None
|
||||
|
||||
try:
|
||||
parsed = json.loads(raw)
|
||||
except json.JSONDecodeError:
|
||||
return None
|
||||
|
||||
return OAuthBindTokenData.from_dict(parsed)
|
||||
Reference in New Issue
Block a user