"""LDAP配置管理API端点。""" import re from typing import Any, Dict, Optional from fastapi import APIRouter, Depends, Request from pydantic import BaseModel, Field, ValidationError, field_validator from sqlalchemy.orm import Session from src.api.base.admin_adapter import AdminApiAdapter from src.api.base.pipeline import ApiRequestPipeline from src.core.crypto import crypto_service from src.core.enums import AuthSource from src.core.exceptions import InvalidRequestException, translate_pydantic_error from src.core.logger import logger from src.database import get_db from src.models.database import AuditEventType, LDAPConfig, User, UserRole from src.services.system.audit import AuditService router = APIRouter(prefix="/api/admin/ldap", tags=["Admin - LDAP"]) pipeline = ApiRequestPipeline() # bcrypt 哈希格式正则：$2a$, $2b$, $2y$ + 2位cost + $ + 53字符(22位salt + 31位hash) BCRYPT_HASH_PATTERN = re.compile(r"^\$2[aby]\$\d{2}\$.{53}$") # ========== Request/Response Models ========== class LDAPConfigResponse(BaseModel): """LDAP配置响应（不返回密码）""" server_url: Optional[str] = None bind_dn: Optional[str] = None base_dn: Optional[str] = None has_bind_password: bool = False user_search_filter: str username_attr: str email_attr: str display_name_attr: str is_enabled: bool is_exclusive: bool use_starttls: bool connect_timeout: int class LDAPConfigUpdate(BaseModel): """LDAP配置更新请求""" server_url: str = Field(..., min_length=1, max_length=255) bind_dn: str = Field(..., min_length=1, max_length=255) # 允许空字符串表示"清除密码"；非空时自动 strip 并校验不能为空 bind_password: Optional[str] = Field(None, max_length=1024) base_dn: str = Field(..., min_length=1, max_length=255) user_search_filter: str = Field(default="(uid={username})", max_length=500) username_attr: str = Field(default="uid", max_length=50) email_attr: str = Field(default="mail", max_length=50) display_name_attr: str = Field(default="cn", max_length=50) is_enabled: bool = False is_exclusive: bool = False use_starttls: bool = False connect_timeout: int = Field(default=10, ge=1, le=60) # 单次操作超时，跨国网络建议 15-30 秒 @field_validator("bind_password") @classmethod def validate_bind_password(cls, v: Optional[str]) -> Optional[str]: if v is None or v == "": return v v = v.strip() if not v: raise ValueError("绑定密码不能为空") return v @field_validator("user_search_filter") @classmethod def validate_search_filter(cls, v: str) -> str: if "{username}" not in v: raise ValueError("搜索过滤器必须包含 {username} 占位符") # 验证括号匹配和嵌套正确性 depth = 0 for char in v: if char == "(": depth += 1 elif char == ")": depth -= 1 if depth < 0: raise ValueError("搜索过滤器括号不匹配") if depth != 0: raise ValueError("搜索过滤器括号不匹配") # 限制过滤器复杂度，防止构造复杂查询 # 检查嵌套层数而非括号总数 depth = 0 max_depth = 0 for char in v: if char == "(": depth += 1 max_depth = max(max_depth, depth) elif char == ")": depth -= 1 if max_depth > 5: raise ValueError("搜索过滤器嵌套层数过深（最多5层）") if len(v) > 200: raise ValueError("搜索过滤器过长（最多200字符）") return v class LDAPTestResponse(BaseModel): """LDAP连接测试响应""" success: bool message: str class LDAPConfigTest(BaseModel): """LDAP配置测试请求（全部可选，用于临时覆盖）""" server_url: Optional[str] = Field(None, min_length=1, max_length=255) bind_dn: Optional[str] = Field(None, min_length=1, max_length=255) bind_password: Optional[str] = Field(None, min_length=1) base_dn: Optional[str] = Field(None, min_length=1, max_length=255) user_search_filter: Optional[str] = Field(None, max_length=500) username_attr: Optional[str] = Field(None, max_length=50) email_attr: Optional[str] = Field(None, max_length=50) display_name_attr: Optional[str] = Field(None, max_length=50) is_enabled: Optional[bool] = None is_exclusive: Optional[bool] = None use_starttls: Optional[bool] = None connect_timeout: Optional[int] = Field(None, ge=1, le=60) @field_validator("user_search_filter") @classmethod def validate_search_filter(cls, v: Optional[str]) -> Optional[str]: if v is None: return v if "{username}" not in v: raise ValueError("搜索过滤器必须包含 {username} 占位符") # 验证括号匹配和嵌套正确性 depth = 0 for char in v: if char == "(": depth += 1 elif char == ")": depth -= 1 if depth < 0: raise ValueError("搜索过滤器括号不匹配") if depth != 0: raise ValueError("搜索过滤器括号不匹配") # 限制过滤器复杂度（检查嵌套层数而非括号总数） depth = 0 max_depth = 0 for char in v: if char == "(": depth += 1 max_depth = max(max_depth, depth) elif char == ")": depth -= 1 if max_depth > 5: raise ValueError("搜索过滤器嵌套层数过深（最多5层）") if len(v) > 200: raise ValueError("搜索过滤器过长（最多200字符）") return v # ========== API Endpoints ========== @router.get("/config") async def get_ldap_config(request: Request, db: Session = Depends(get_db)) -> Any: """获取LDAP配置（管理员）""" adapter = AdminGetLDAPConfigAdapter() return await pipeline.run(adapter=adapter, http_request=request, db=db, mode=adapter.mode) @router.put("/config") async def update_ldap_config(request: Request, db: Session = Depends(get_db)) -> Any: """更新LDAP配置（管理员）""" adapter = AdminUpdateLDAPConfigAdapter() return await pipeline.run(adapter=adapter, http_request=request, db=db, mode=adapter.mode) @router.post("/test") async def test_ldap_connection(request: Request, db: Session = Depends(get_db)) -> Any: """测试LDAP连接（管理员）""" adapter = AdminTestLDAPConnectionAdapter() return await pipeline.run(adapter=adapter, http_request=request, db=db, mode=adapter.mode) # ========== Adapters ========== class AdminGetLDAPConfigAdapter(AdminApiAdapter): async def handle(self, context) -> Dict[str, Any]: # type: ignore[override] db = context.db config = db.query(LDAPConfig).first() if not config: return LDAPConfigResponse( server_url=None, bind_dn=None, base_dn=None, has_bind_password=False, user_search_filter="(uid={username})", username_attr="uid", email_attr="mail", display_name_attr="cn", is_enabled=False, is_exclusive=False, use_starttls=False, connect_timeout=10, ).model_dump() return LDAPConfigResponse( server_url=config.server_url, bind_dn=config.bind_dn, base_dn=config.base_dn, has_bind_password=bool(config.bind_password_encrypted), user_search_filter=config.user_search_filter, username_attr=config.username_attr, email_attr=config.email_attr, display_name_attr=config.display_name_attr, is_enabled=config.is_enabled, is_exclusive=config.is_exclusive, use_starttls=config.use_starttls, connect_timeout=config.connect_timeout, ).model_dump() class AdminUpdateLDAPConfigAdapter(AdminApiAdapter): async def handle(self, context) -> Dict[str, str]: # type: ignore[override] db = context.db payload = context.ensure_json_body() try: config_update = LDAPConfigUpdate.model_validate(payload) except ValidationError as e: errors = e.errors() if errors: raise InvalidRequestException(translate_pydantic_error(errors[0])) raise InvalidRequestException("请求数据验证失败") # 使用行级锁防止并发修改导致的竞态条件 config = db.query(LDAPConfig).with_for_update().first() is_new_config = config is None if is_new_config: # 首次创建配置时必须提供密码 if not config_update.bind_password: raise InvalidRequestException("首次配置 LDAP 时必须设置绑定密码") config = LDAPConfig() db.add(config) # 需要启用 LDAP 且未提交新密码时，验证已保存密码可解密（避免开启后不可用） if config_update.is_enabled and config_update.bind_password is None: try: if not config.get_bind_password(): raise InvalidRequestException("启用 LDAP 认证 需要先设置绑定密码") except InvalidRequestException: raise except Exception: raise InvalidRequestException("绑定密码解密失败，请重新设置绑定密码") # 计算更新后的密码状态（用于校验是否可启用/独占） if config_update.bind_password is None: will_have_password = bool(config.bind_password_encrypted) elif config_update.bind_password == "": will_have_password = False else: will_have_password = True # 独占模式必须启用 LDAP 且必须有绑定密码（防止误锁定） if config_update.is_exclusive and not config_update.is_enabled: raise InvalidRequestException("仅允许 LDAP 登录 需要先启用 LDAP 认证") if config_update.is_enabled and not will_have_password: raise InvalidRequestException("启用 LDAP 认证 需要先设置绑定密码") if config_update.is_exclusive and not will_have_password: raise InvalidRequestException("仅允许 LDAP 登录 需要先设置绑定密码") config.server_url = config_update.server_url config.bind_dn = config_update.bind_dn config.base_dn = config_update.base_dn config.user_search_filter = config_update.user_search_filter config.username_attr = config_update.username_attr config.email_attr = config_update.email_attr config.display_name_attr = config_update.display_name_attr config.is_enabled = config_update.is_enabled config.is_exclusive = config_update.is_exclusive config.use_starttls = config_update.use_starttls config.connect_timeout = config_update.connect_timeout # 启用独占模式前检查是否有足够的本地管理员（防止锁定） # 使用 with_for_update() 阻塞锁防止竞态条件（移除 nowait 确保并发安全） if config_update.is_enabled and config_update.is_exclusive: local_admins = ( db.query(User) .filter( User.role == UserRole.ADMIN, User.auth_source == AuthSource.LOCAL, User.is_active.is_(True), User.is_deleted.is_(False), ) .with_for_update() .all() ) # 验证至少有一个管理员有有效的密码哈希（可以登录） # 使用严格的 bcrypt 格式校验：$2a$/$2b$/$2y$ + 2位cost + $ + 53字符 valid_admin_count = sum( 1 for admin in local_admins if admin.password_hash and isinstance(admin.password_hash, str) and BCRYPT_HASH_PATTERN.match(admin.password_hash) ) if valid_admin_count < 1: raise InvalidRequestException( "启用 LDAP 独占模式前，必须至少保留 1 个有效的本地管理员账户（含有效密码）作为紧急恢复通道" ) if config_update.bind_password is not None: if config_update.bind_password == "": # 显式清除密码（设置为 NULL） config.bind_password_encrypted = None password_changed = "cleared" else: config.bind_password_encrypted = crypto_service.encrypt(config_update.bind_password) password_changed = "updated" else: password_changed = None db.commit() # 记录审计日志 AuditService.log_event( db=db, event_type=AuditEventType.CONFIG_CHANGED, description=f"LDAP 配置已更新 (enabled={config_update.is_enabled}, exclusive={config_update.is_exclusive})", user_id=str(context.user.id) if context.user else None, metadata={ "server_url": config_update.server_url, "is_enabled": config_update.is_enabled, "is_exclusive": config_update.is_exclusive, "password_changed": password_changed, "is_new_config": is_new_config, }, ) return {"message": "LDAP配置更新成功"} class AdminTestLDAPConnectionAdapter(AdminApiAdapter): async def handle(self, context) -> Dict[str, Any]: # type: ignore[override] from src.services.auth.ldap import LDAPService db = context.db if context.json_body is not None: payload = context.json_body elif not context.raw_body: payload = {} else: payload = context.ensure_json_body() saved_config = db.query(LDAPConfig).first() try: overrides = LDAPConfigTest.model_validate(payload) except ValidationError as e: errors = e.errors() if errors: raise InvalidRequestException(translate_pydantic_error(errors[0])) raise InvalidRequestException("请求数据验证失败") config_data: Dict[str, Any] = {} if saved_config: config_data = { "server_url": saved_config.server_url, "bind_dn": saved_config.bind_dn, "base_dn": saved_config.base_dn, "user_search_filter": saved_config.user_search_filter, "username_attr": saved_config.username_attr, "email_attr": saved_config.email_attr, "display_name_attr": saved_config.display_name_attr, "use_starttls": saved_config.use_starttls, "connect_timeout": saved_config.connect_timeout, } # 应用前端传入的覆盖值 for field in [ "server_url", "bind_dn", "base_dn", "user_search_filter", "username_attr", "email_attr", "display_name_attr", "use_starttls", "is_enabled", "is_exclusive", "connect_timeout", ]: value = getattr(overrides, field) if value is not None: config_data[field] = value # bind_password 优先使用 overrides；否则使用已保存的密码（允许保存密码无法解密时依然用 overrides 测试） if overrides.bind_password is not None: config_data["bind_password"] = overrides.bind_password elif saved_config and saved_config.bind_password_encrypted: try: config_data["bind_password"] = crypto_service.decrypt( saved_config.bind_password_encrypted ) except Exception as e: logger.error(f"绑定密码解密失败: {type(e).__name__}: {e}") return LDAPTestResponse( success=False, message="绑定密码解密失败，请检查配置或重新设置密码" ).model_dump() # 必填字段检查 required_fields = ["server_url", "bind_dn", "base_dn", "bind_password"] missing = [f for f in required_fields if not config_data.get(f)] if missing: return LDAPTestResponse( success=False, message=f"缺少必要字段: {', '.join(missing)}" ).model_dump() success, message = LDAPService.test_connection_with_config(config_data) return LDAPTestResponse(success=success, message=message).model_dump()