""" 用户管理服务 """ import asyncio from datetime import datetime, timedelta, timezone from typing import Any, Dict, List, Optional from sqlalchemy import and_, func from sqlalchemy.orm import Session from src.core.logger import logger from src.core.validators import EmailValidator, PasswordValidator, UsernameValidator from src.models.database import ApiKey, GlobalModel, Model, Provider, Usage, User, UserRole from src.services.cache.user_cache import UserCacheService from src.utils.transaction_manager import retry_on_database_error, transactional class UserService: """用户管理服务""" @staticmethod @transactional() @retry_on_database_error(max_retries=3) def create_user( db: Session, email: str, username: str, password: str, role: UserRole = UserRole.USER, quota_usd: Optional[float] = 10.0, ) -> User: """创建新用户，quota_usd 为 None 表示无限制""" # 验证邮箱格式 valid, error_msg = EmailValidator.validate(email) if not valid: raise ValueError(error_msg) # 验证用户名格式 valid, error_msg = UsernameValidator.validate(username) if not valid: raise ValueError(error_msg) # 验证密码复杂度 valid, error_msg = PasswordValidator.validate(password) if not valid: raise ValueError(error_msg) # 检查邮箱是否已存在 if db.query(User).filter(User.email == email).first(): raise ValueError(f"邮箱已存在: {email}") # 检查用户名是否已存在 if db.query(User).filter(User.username == username).first(): raise ValueError(f"用户名已存在: {username}") user = User( email=email, username=username, role=role, quota_usd=quota_usd, is_active=True, ) user.set_password(password) db.add(user) db.commit() # 立即提交事务,释放数据库锁 db.refresh(user) logger.info(f"创建新用户: {email} (ID: {user.id}, 角色: {role.value})") return user @staticmethod @transactional() def create_user_with_api_key( db: Session, email: str, username: str, password: str, api_key_name: str = "默认密钥", role: UserRole = UserRole.USER, quota_usd: Optional[float] = 10.0, concurrent_limit: int = 5, ) -> tuple[User, ApiKey]: """ 创建用户并同时创建API密钥（原子操作） Args: db: 数据库会话 email: 邮箱 username: 用户名 password: 密码 api_key_name: API密钥名称 role: 用户角色 quota_usd: USD配额，None 表示无限制 concurrent_limit: 并发限制 Returns: tuple[User, ApiKey]: 用户对象和API密钥对象 Raises: ValueError: 当验证失败时 """ # 创建用户 user = UserService.create_user( db=db, email=email, username=username, password=password, role=role, quota_usd=quota_usd ) # 导入API密钥服务（避免循环导入） from .apikey import ApiKeyService # 创建API密钥（返回值是 (api_key, plain_key)） api_key, plain_key = ApiKeyService.create_api_key( db=db, user_id=user.id, name=api_key_name, concurrent_limit=concurrent_limit ) logger.info(f"创建用户和API密钥完成: {email} (用户ID: {user.id}, 密钥ID: {api_key.id})") # 返回用户对象、API Key对象和明文密钥 return user, api_key, plain_key @staticmethod def get_user(db: Session, user_id: str) -> Optional[User]: """获取用户""" import random import time # 添加重试机制处理数据库并发问题 max_retries = 3 for attempt in range(max_retries): try: user = db.query(User).filter(User.id == user_id).first() return user except Exception as e: if attempt < max_retries - 1: # 添加随机延迟避免并发冲突 time.sleep(random.uniform(0.01, 0.05)) db.rollback() # 回滚事务 continue else: raise e @staticmethod def get_user_by_email(db: Session, email: str) -> Optional[User]: """通过邮箱获取用户""" return db.query(User).filter(User.email == email).first() @staticmethod def list_users( db: Session, skip: int = 0, limit: int = 100, role: Optional[UserRole] = None, is_active: Optional[bool] = None, ) -> List[User]: """列出用户""" query = db.query(User) if role: query = query.filter(User.role == role) if is_active is not None: query = query.filter(User.is_active == is_active) return query.offset(skip).limit(limit).all() @staticmethod @transactional() def update_user(db: Session, user_id: str, **kwargs) -> Optional[User]: """更新用户信息""" user = db.query(User).filter(User.id == user_id).first() if not user: return None # 可更新的字段 updatable_fields = [ "email", "username", "quota_usd", "is_active", "role", # 访问限制字段 "allowed_providers", "allowed_endpoints", "allowed_models", ] # 允许设置为 None 的字段（表示无限制） nullable_fields = ["quota_usd", "allowed_providers", "allowed_endpoints", "allowed_models"] for field, value in kwargs.items(): if field not in updatable_fields: continue # nullable_fields 中的字段允许设置为 None if field in nullable_fields: setattr(user, field, value) elif value is not None: setattr(user, field, value) # 如果提供了新密码 if "password" in kwargs and kwargs["password"]: # 验证新密码复杂度 valid, error_msg = PasswordValidator.validate(kwargs["password"]) if not valid: raise ValueError(error_msg) user.set_password(kwargs["password"]) user.updated_at = datetime.now(timezone.utc) db.commit() # 立即提交事务,释放数据库锁 db.refresh(user) # 清除用户缓存 asyncio.create_task(UserCacheService.invalidate_user_cache(user.id, user.email)) logger.debug(f"更新用户信息: {user.email} (ID: {user_id})") return user @staticmethod @transactional() def delete_user(db: Session, user_id: str) -> bool: """删除用户（硬删除） 删除流程： 1. 手动删除关联的子记录（避免 SQLAlchemy ORM 与数据库 CASCADE 冲突） 2. 删除用户记录 3. 历史 Usage 记录保留，user_id 会被数据库设为 NULL 4. 新用户注册时会有新的 UUID，看不到旧用户的记录 """ from src.models.database import ( AnnouncementRead, ApiKey, UserPreference, UserQuota, ) user = db.query(User).filter(User.id == user_id).first() if not user: return False # 记录删除信息用于日志 email = user.email # 手动删除子记录，避免 SQLAlchemy 的 ORM cascade 与数据库 CASCADE 冲突 # 这些表的数据库外键已经设置了 ON DELETE CASCADE，但 SQLAlchemy 会先尝试 UPDATE 设置为 NULL # 所以我们手动删除来避免这个问题 db.query(UserPreference).filter(UserPreference.user_id == user_id).delete( synchronize_session=False ) db.query(UserQuota).filter(UserQuota.user_id == user_id).delete(synchronize_session=False) db.query(AnnouncementRead).filter(AnnouncementRead.user_id == user_id).delete( synchronize_session=False ) api_key_count = db.query(ApiKey).filter(ApiKey.user_id == user_id).count() db.query(ApiKey).filter(ApiKey.user_id == user_id).delete(synchronize_session=False) # 现在删除用户（Usage, AuditLog, RequestAttempt 会通过数据库 SET NULL 保留） db.delete(user) db.commit() # 立即提交事务,释放数据库锁 # 清除用户缓存 asyncio.create_task(UserCacheService.invalidate_user_cache(user_id, email)) logger.info(f"删除用户: {email} (ID: {user_id}), 同时删除 {api_key_count} 个API密钥") return True @staticmethod @transactional() def change_password( db: Session, user_id: str, old_password: str, new_password: str ) -> tuple[bool, str]: """ 更改用户密码 Args: db: 数据库会话 user_id: 用户ID old_password: 旧密码 new_password: 新密码 Returns: (是否成功, 消息) """ user = db.query(User).filter(User.id == user_id).first() if not user: return False, "用户不存在" # 验证旧密码 if not user.verify_password(old_password): logger.warning(f"密码更改失败 - 旧密码错误: 用户ID {user_id}") return False, "旧密码错误" # 验证新密码复杂度 valid, error_msg = PasswordValidator.validate(new_password) if not valid: return False, error_msg # 检查新密码不能与旧密码相同 if old_password == new_password: return False, "新密码不能与旧密码相同" # 设置新密码 user.set_password(new_password) user.updated_at = datetime.now(timezone.utc) # 清除用户缓存 asyncio.create_task(UserCacheService.invalidate_user_cache(user.id, user.email)) logger.info(f"密码更改成功: 用户ID {user_id}") return True, "密码更改成功" @staticmethod def update_user_quota( db: Session, user_id: str, quota_usd: Optional[float] = None, ) -> Optional[User]: """更新用户配额""" user = db.query(User).filter(User.id == user_id).first() if not user: return None if quota_usd is not None: user.quota_usd = quota_usd db.commit() db.refresh(user) # 清除用户缓存 asyncio.create_task(UserCacheService.invalidate_user_cache(user.id, user.email)) logger.debug(f"更新用户配额: {user.email} (USD: {quota_usd})") return user @staticmethod def get_user_usage_stats( db: Session, user_id: str, start_date: Optional[datetime] = None, end_date: Optional[datetime] = None, ) -> Dict[str, Any]: """获取用户使用统计""" query = db.query(Usage).filter(Usage.user_id == user_id) if start_date: query = query.filter(Usage.created_at >= start_date) if end_date: query = query.filter(Usage.created_at <= end_date) # 统计数据 stats = db.query( func.count(Usage.id).label("total_requests"), func.sum(Usage.total_tokens).label("total_tokens"), func.sum(Usage.total_cost_usd).label("total_cost_usd"), func.avg(Usage.response_time_ms).label("avg_response_time"), ).filter(Usage.user_id == user_id) if start_date: stats = stats.filter(Usage.created_at >= start_date) if end_date: stats = stats.filter(Usage.created_at <= end_date) result = stats.first() # 按模型分组统计 model_stats = db.query( Usage.model, func.count(Usage.id).label("requests"), func.sum(Usage.total_tokens).label("tokens"), func.sum(Usage.total_cost_usd).label("cost_usd"), ).filter(Usage.user_id == user_id) if start_date: model_stats = model_stats.filter(Usage.created_at >= start_date) if end_date: model_stats = model_stats.filter(Usage.created_at <= end_date) model_stats = model_stats.group_by(Usage.model).all() return { "total_requests": result.total_requests or 0, "total_tokens": result.total_tokens or 0, "total_cost_usd": float(result.total_cost_usd or 0), "avg_response_time_ms": float(result.avg_response_time or 0), "by_model": [ { "model": stat.model, "requests": stat.requests, "tokens": stat.tokens, "cost_usd": float(stat.cost_usd), } for stat in model_stats ], } @staticmethod def get_user_available_models(db: Session, user: User) -> List[Model]: """获取用户可用的模型 新架构：通过 GlobalModel + Model 关联查询用户可用模型 逻辑：用户可用提供商 → Provider 的 Model 实现 → 关联的 GlobalModel """ # 获取用户可用的提供商 if user.role == UserRole.ADMIN: # 管理员可以使用所有活动提供商 provider_ids = [ p.id for p in db.query(Provider.id).filter(Provider.is_active == True).all() ] else: # 普通用户使用关联的提供商 provider_ids = [p.id for p in user.providers] if not provider_ids: return [] # 查询这些提供商的所有活跃 Model（关联 GlobalModel） models = ( db.query(Model) .join(GlobalModel, Model.global_model_id == GlobalModel.id) .filter( and_( Model.provider_id.in_(provider_ids), Model.is_active == True, GlobalModel.is_active == True, ) ) .all() ) logger.debug(f"用户 {user.email} 可用模型: {len(models)} 个 (提供商数: {len(provider_ids)})") return models