增加通过认证码绑定设备和管理账户的功能，需要开启私有设备配置

增加登录用户鉴权
2026-07-24 08:03:53 +08:00 · 2025-02-17 15:53:48 +08:00
parent 325312327c
commit aa2d323951
14 changed files with 1052 additions and 274 deletions
@@ -4,18 +4,22 @@ import logging
 from aiohttp import web
 from core.utils.util import get_project_dir
 from config.private_config import PrivateConfig
+from manager.api.user_manager import UserManager  # 添加导入
+from core.utils.auth_code_gen import AuthCodeGenerator  # 添加导入

 logger = logging.getLogger(__name__)

 class ConfigHandler:
-    def __init__(self):
+    def __init__(self, session_manager):
+        self.session_manager = session_manager
+        self.user_manager = UserManager()  # 添加 user_manager 实例
        self.private_config_path = get_project_dir() + 'data/.private_config.yaml'
        self.config_path = get_project_dir() + 'config.yaml'
        # 如果存在.config.yaml文件，则使用该文件
        if os.path.exists(get_project_dir() + "data/.config.yaml"):
            self.config_path = get_project_dir() + "data/.config.yaml"
        with open(self.config_path, 'r', encoding='utf-8') as f:
-                self.config = yaml.safe_load(f)
+            self.config = yaml.safe_load(f)

    async def get_module_options(self, request):
        """Get all available module options from config.yaml"""
@@ -45,46 +49,41 @@ class ConfigHandler:
            })

    async def get_private_configs(self, request):
-        """获取所有私有配置设备列表及其配置"""
+        """只返回用户绑定的设备配置"""
        try:
+            username = request['username']
+            logger.info(f"Getting devices for user: {username}")
+            
+            # 从用户管理器获取用户的设备列表
+            user_devices = await self.user_manager.get_user_devices(username)
+            logger.info(f"User {username} has devices: {user_devices}")
+            
+            # 读取所有配置
+            all_configs = {}
            if os.path.exists(self.private_config_path):
                with open(self.private_config_path, 'r', encoding='utf-8') as f:
                    all_configs = yaml.safe_load(f) or {}
-            else:
-                all_configs = {}
-
-            # 转换配置为前端友好的格式
-            devices = []
-            for device_id, config in all_configs.items():
-                device_info = {
-                    'id': device_id,
-                    'config': {
-                        'selected_module': config.get('selected_module', {}),
-                        'prompt': config.get('prompt', ''),
-                        'last_chat_time': config.get('last_chat_time', ''),
-                        'nickname': config.get('nickname', '小智'),
-                        'modules': {
-                            'LLM': config.get('LLM', {}),
-                            'TTS': config.get('TTS', {}),
-                            'ASR': config.get('ASR', {}),
-                            'VAD': config.get('VAD', {})
-                        }
-                    }
-                }
-                devices.append(device_info)
-
+            
+            # 只返回用户有权限的设备配置
+            user_configs = {
+                device_id: config 
+                for device_id, config in all_configs.items()
+                if device_id in user_devices
+            }
+            
+            logger.info(f"Returning {len(user_configs)} device configs for user {username}")
            return web.json_response({
                'success': True,
-                'data': devices,
+                'data': user_configs,
                'message': '获取成功'
            })
-
+            
        except Exception as e:
-            logger.error(f"Error getting private configs: {str(e)}", exc_info=True)
+            logger.error(f"Error getting devices for user {request.get('username')}: {str(e)}", exc_info=True)
            return web.json_response({
                'success': False,
-                'message': '获取配置失败'
-            })
+                'message': f'获取设备列表失败: {str(e)}'
+            }, status=400)

    async def save_device_config(self, request):
        """保存单个设备的配置"""
@@ -92,6 +91,16 @@ class ConfigHandler:
            data = await request.json()
            device_id = data.get('id')
            config = data.get('config')
+            username = request['username']  # 从请求中获取用户名
+
+            # 检查设备所有权
+            user_devices = self.user_manager.get_user_devices(username)
+            if device_id not in user_devices:
+                return web.json_response({
+                    'success': False,
+                    'message': '无权操作此设备'
+                }, status=403)
+
            logger.info(f"Device config updated: {device_id} :\n{config}")
            if not device_id or not config:
                return web.json_response({
@@ -130,10 +139,20 @@ class ConfigHandler:
        try:
            data = await request.json()
            device_id = data.get('device_id')
-            
+            username = request['username']
+
+            # 检查设备所有权
+            user_devices = await self.user_manager.get_user_devices(username)
+            if device_id not in user_devices:
+                return web.json_response({
+                    'success': False,
+                    'message': '无权删除此设备'
+                }, status=403)
+
            # 使用PrivateConfig处理配置删除
            private_config = PrivateConfig(device_id, self.config)
            success = await private_config.delete_config()
+            await self.user_manager.remove_device(username, device_id)

            if not success:
                raise Exception("Failed to delete device config")
@@ -149,3 +168,59 @@ class ConfigHandler:
                'success': False,
                'message': f'删除配置失败: {str(e)}'
            })
+
+    async def bind_device(self, request):
+        """绑定设备到用户"""
+        try:
+            data = await request.json()
+            auth_code = data.get('auth_code')
+            username = request['username']
+
+            if not auth_code or len(auth_code) != 6:
+                return web.json_response({
+                    'success': False,
+                    'message': '请输入6位认证码'
+                }, status=400)
+
+            # 读取所有设备配置
+            with open(self.private_config_path, 'r', encoding='utf-8') as f:
+                all_configs = yaml.safe_load(f) or {}
+
+            # 查找匹配认证码的设备
+            device_found = None
+            for device_id, config in all_configs.items():
+                if config.get('auth_code') == auth_code and not config.get('owner'):
+                    device_found = device_id
+                    break
+
+            if not device_found:
+                return web.json_response({
+                    'success': False,
+                    'message': '认证码无效或设备已被绑定'
+                }, status=400)
+
+            # 使用 PrivateConfig 进行绑定
+            private_config = PrivateConfig(device_found, self.config, AuthCodeGenerator())
+            await private_config.load_or_create()
+            
+            # 绑定设备到用户 - 修改为异步调用
+            success = await private_config.bind_user(username)
+            if success:
+                # 同时更新用户的设备列表 - 修改为异步调用
+                await self.user_manager.add_device(username, device_found)
+                return web.json_response({
+                    'success': True,
+                    'message': '设备绑定成功'
+                })
+            else:
+                return web.json_response({
+                    'success': False,
+                    'message': '设备绑定失败'
+                }, status=500)
+
+        except Exception as e:
+            logger.error(f"Error binding device: {str(e)}", exc_info=True)
+            return web.json_response({
+                'success': False,
+                'message': f'绑定设备失败: {str(e)}'
+            }, status=500)
@@ -5,8 +5,9 @@ import datetime
 logger = logging.getLogger(__name__)

 class LoginHandler:
-    def __init__(self, config):
-        self.config = config
+    def __init__(self, user_manager, session_manager):
+        self.user_manager = user_manager
+        self.session_manager = session_manager

    async def handle_login(self, request):
        """处理登录请求"""
@@ -22,8 +23,8 @@ class LoginHandler:
                    'message': '用户名和密码不能为空'
                })

-            stored_user = self.config['get_user'](username)
-            if not stored_user or stored_user['password'] != self.config['hash_password'](password):
+            stored_user = await self.user_manager.get_user(username)
+            if not stored_user or stored_user['password'] != self.user_manager.hash_password(password):
                logger.warning(f"Failed login attempt for user {username} from {request.remote}")
                return web.json_response({
                    'success': False, 
@@ -31,14 +32,16 @@ class LoginHandler:
                })

            # 更新最后登录时间
-            self.config['update_user'](username, {
+            await self.user_manager.update_user(username, {
                'last_login': datetime.datetime.now().isoformat()
            })

-            logger.info(f"Successful login for user {username} from {request.remote}")
+            # 创建会话并返回session_id
+            session_id = self.session_manager.create_session(username)
            return web.json_response({
                'success': True, 
-                'message': '登录成功'
+                'message': '登录成功',
+                'session_id': session_id
            })

        except Exception as e:
@@ -1,14 +1,13 @@
 import logging
 from aiohttp import web
 import datetime
-from core.utils.util import check_password

 logger = logging.getLogger(__name__)


 class RegisterHandler:
-    def __init__(self, config):
-        self.config = config
+    def __init__(self, user_manager):
+        self.user_manager = user_manager

    async def handle_register(self, request):
        """处理注册请求"""
@@ -17,12 +16,6 @@ class RegisterHandler:
            username = data.get('username')
            password = data.get('password')

-            if not check_password(password):
-                return web.json_response({
-                    'success': False,
-                    'message': '密码必须包含大小写字母、数字且长度至少8位'
-                })
-
            if not username or not password:
                logger.warning(f"Registration attempt with empty credentials from {request.remote}")
                return web.json_response({
@@ -30,28 +23,23 @@ class RegisterHandler:
                    'message': '用户名和密码不能为空'
                })

-            users = self.config.get('users', {})
-            # 由于现在所有用户都能看到所有设备，从安全角度上考虑，只允许注册一个用户
-            # 未来绑定设备功能完成后，再放开任意注册
-            if len(users) >= 1:
-                return web.json_response({
-                    'success': False,
-                    'message': '系统已经初始化过了，如果忘记了密码，请直接删除“.secrets.yaml”文件，删除后重启本服务'
-                })
-
-            if username in users:
+            # 检查用户是否已存在
+            if await self.user_manager.get_user(username):
                logger.warning(f"Registration attempt with existing username {username} from {request.remote}")
                return web.json_response({
                    'success': False,
                    'message': '用户名已存在'
                })

-            # 存储新用户
-            self.config['users'][username] = {
-                'password': self.config['hash_password'](password),
-                'created_at': datetime.datetime.now().isoformat()
+            # 创建用户
+            user_data = {
+                'username': username,
+                'password': self.user_manager.hash_password(password),
+                'devices': [],
+                'created_at': datetime.datetime.now().isoformat(),
+                'last_login': ''
            }
-            self.config['save_user_data']()
+            await self.user_manager.add_user(username, user_data)

            logger.info(f"Successfully registered new user {username} from {request.remote}")
            return web.json_response({
@@ -60,7 +48,7 @@ class RegisterHandler:
            })

        except Exception as e:
-            logger.error(f"Registration error: {str(e)}", exc_info=True)
+            logger.error(f"Register error: {str(e)}", exc_info=True)
            return web.json_response({
                'success': False,
                'message': '注册失败，请稍后重试'
@@ -3,16 +3,15 @@ import yaml
 import hashlib
 import logging
 from core.utils.util import get_project_dir
+from core.utils.lock_manager import FileLockManager

 logger = logging.getLogger(__name__)

-
 class UserManager:
    def __init__(self):
        self.secrets_path = get_project_dir() + 'data/.secrets.yaml'
-        self.users = {}
+        self.lock_manager = FileLockManager()
        self.ensure_secrets_file()
-        self.load_user_data()

    def ensure_secrets_file(self):
        """确保 .secrets.yaml 文件存在"""
@@ -28,24 +27,51 @@ class UserManager:
            except Exception as e:
                logger.error(f"Failed to create .secrets.yaml: {e}")
                raise
-
-    def load_user_data(self):
-        """加载用户数据"""
+    
+    async def _load_user_data_internal(self):
+        """内部加载用户数据方法 - 不获取锁"""
        try:
            with open(self.secrets_path, 'r', encoding='utf-8') as f:
                data = yaml.safe_load(f) or {'users': {}}
-                self.users = data['users']
-                logger.info("Successfully loaded user data")
+                users = data['users']
+                logger.debug("Successfully loaded user data")
        except Exception as e:
            logger.error(f"Failed to load user data: {e}")
-            self.users = {}
+            users = {}
+        return users
+    
+    async def load_user_data(self):
+        """加载用户数据"""
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                users = await self._load_user_data_internal()
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
+            
+        except Exception as e:
+            logger.error(f"Failed to load user data: {e}")
+            users = {}
+        return users

-    def save_user_data(self):
-        """保存用户数据"""
+    async def _save_user_data_internal(self, users):
+        """内部保存用户数据方法 - 不获取锁"""
        try:
            with open(self.secrets_path, 'w', encoding='utf-8') as f:
-                yaml.dump({'users': self.users}, f)
-            logger.info("Successfully saved user data")
+                yaml.dump({'users': users}, f)
+            logger.debug("Successfully saved user data")
+        except Exception as e:
+            logger.error(f"Failed to save user data: {e}")
+            raise
+
+    async def save_user_data(self, users):
+        """外部保存用户数据方法 - 获取锁"""
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                await self._save_user_data_internal(users)
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
        except Exception as e:
            logger.error(f"Failed to save user data: {e}")
            raise
@@ -54,16 +80,95 @@ class UserManager:
        """密码哈希"""
        return hashlib.sha256(password.encode()).hexdigest()

-    def get_users(self):
-        """获取所有用户"""
-        return self.users
+    async def get_users(self):
+        """异步获取所有用户"""
+        users = await self.load_user_data()  # 确保获取最新数据
+        return users

-    def get_user(self, username):
-        """获取指定用户"""
-        return self.users.get(username)
+    async def get_user(self, username):
+        """异步获取指定用户"""
+        users = await self.load_user_data()  # 确保获取最新数据
+        return users.get(username)

-    def update_user(self, username, data):
+    async def add_user(self, username: str, user_data: dict):
+        """异步添加新用户"""
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                users = await self._load_user_data_internal()  # 确保获取最新数据
+                if username in users:
+                    raise ValueError("User already exists")
+                users[username] = user_data
+                await self._save_user_data_internal(users)
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
+        except Exception as e:
+            logger.error(f"Error adding user: {e}")
+            raise
+
+    async def update_user(self, username, data):
        """更新用户数据"""
-        if username in self.users:
-            self.users[username].update(data)
-            self.save_user_data()
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                users = await self._load_user_data_internal()  # 确保获取最新数据
+                if username in users:
+                    users[username].update(data)
+                    await self._save_user_data_internal(users)
+                    return True
+                return False
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
+        except Exception as e:
+            logger.error(f"Error updating user: {e}")
+            return False
+
+    async def get_user_devices(self, username: str) -> list:
+        """获取用户的设备列表"""
+        user = await self.get_user(username)
+        print(user)
+        if user and user.get('devices'):
+            return user['devices']
+        return []
+
+    async def add_device(self, username: str, device_id: str) -> bool:
+        """添加设备到用户的设备列表"""
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                users = await self._load_user_data_internal()  # 确保获取最新数据
+                user = users.get(username)  # 直接从内存获取，因为已经有锁
+                if not user:
+                    return False
+
+                if 'devices' not in user:
+                    user['devices'] = []
+
+                if device_id not in user['devices']:
+                    user['devices'].append(device_id)
+                    await self._save_user_data_internal(users)
+                return True
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
+        except Exception as e:
+            logger.error(f"Error adding device: {e}")
+            return False
+
+    async def remove_device(self, username: str, device_id: str) -> bool:
+        """从用户的设备列表中移除设备"""
+        try:
+            await self.lock_manager.acquire_lock(self.secrets_path)
+            try:
+                users = await self._load_user_data_internal()  # 确保获取最新数据
+                user = users.get(username)  # 直接从内存获取，因为已经有锁
+                if user and 'devices' in user:
+                    if device_id in user['devices']:
+                        user['devices'].remove(device_id)
+                        await self._save_user_data_internal(users)
+                        return True
+                return False
+            finally:
+                self.lock_manager.release_lock(self.secrets_path)
+        except Exception as e:
+            logger.error(f"Error removing device: {e}")
+            return False
@@ -13,26 +13,33 @@ from manager.api.login import LoginHandler
 from manager.api.register import RegisterHandler
 from manager.api.user_manager import UserManager
 from manager.api.config import ConfigHandler
+from manager.session import SessionManager
+from functools import wraps

 logger = logging.getLogger(__name__)

+def auth_required(handler):
+    """鉴权装饰器"""
+    @wraps(handler)
+    async def wrapper(self, request):
+        session_id = request.cookies.get('session_id')
+        username = self.session_manager.validate_session(session_id)
+        if not username:
+            return web.json_response({'error': 'Unauthorized'}, status=401)
+        # 将用户名添加到请求对象
+        request['username'] = username
+        return await handler(self, request)
+    return wrapper
+
 class WebUI:
    def __init__(self):
        self.app = web.Application()
        self.user_manager = UserManager()
+        self.session_manager = SessionManager()
        
        # 添加静态文件路径
        self.static_path = os.path.join(root_dir, 'manager', 'static', 'webui')
        
-        # 创建配置字典
-        self.config = {
-            'users': self.user_manager.get_users(),
-            'hash_password': self.user_manager.hash_password,
-            'save_user_data': self.user_manager.save_user_data,
-            'get_user': self.user_manager.get_user,
-            'update_user': self.user_manager.update_user
-        }
-        
        self.setup_routes()
        self.setup_cors()

@@ -52,18 +59,21 @@ class WebUI:

    def setup_routes(self):
        """设置路由"""
-        login_handler = LoginHandler(self.config)
-        register_handler = RegisterHandler(self.config)
-        config_handler = ConfigHandler()
+        login_handler = LoginHandler(self.user_manager, self.session_manager)
+        register_handler = RegisterHandler(self.user_manager)
+        config_handler = ConfigHandler(self.session_manager)
        
-        # API 路由
+        # Public APIs
        self.app.router.add_post('/api/login', login_handler.handle_login)
        self.app.router.add_post('/api/register', register_handler.handle_register)
-        self.app.router.add_get('/api/config/devices', config_handler.get_private_configs)
-        self.app.router.add_post('/api/config/device', config_handler.save_device_config)
-        self.app.router.add_get('/api/config/module-options', config_handler.get_module_options)
-        self.app.router.add_post('/api/config/save_device_config', config_handler.save_device_config)
-        self.app.router.add_post('/api/config/delete_device', config_handler.delete_device_config)
+
+        # Protected APIs
+        self.app.router.add_get('/api/config/devices', self.auth_wrapper(config_handler.get_private_configs))
+
+        self.app.router.add_get('/api/config/module-options', self.auth_wrapper(config_handler.get_module_options))
+        self.app.router.add_post('/api/config/save_device_config', self.auth_wrapper(config_handler.save_device_config))
+        self.app.router.add_post('/api/config/delete_device', self.auth_wrapper(config_handler.delete_device_config))
+        self.app.router.add_post('/api/config/bind_device', self.auth_wrapper(config_handler.bind_device))

        # 添加静态文件服务
        self.app.router.add_static('/assets/', path=os.path.join(self.static_path, 'assets'))
@@ -77,6 +87,26 @@ class WebUI:
            return web.FileResponse(index_file)
        return web.Response(status=404, text='Not found')

+    def auth_wrapper(self, handler):
+        """包装处理器添加鉴权"""
+        @wraps(handler)
+        async def wrapper(request):
+            # 从请求头获取session_id
+            session_id = request.headers.get('Authorization')
+            if not session_id:
+                logger.warning("No session_id in Authorization header")
+                return web.json_response({'error': 'Unauthorized'}, status=401)
+
+            username = self.session_manager.validate_session(session_id)
+            if not username:
+                logger.warning(f"Invalid session_id: {session_id}")
+                return web.json_response({'error': 'Unauthorized'}, status=401)
+                
+            request['username'] = username
+            logger.debug(f"Auth success for user: {username}")
+            return await handler(request)
+        return wrapper
+
    def run(self, host='0.0.0.0', port=8002):
        """运行服务器"""
        local_ip = get_local_ip()
@@ -0,0 +1,33 @@
+import time
+from typing import Dict, Optional
+
+class SessionManager:
+    def __init__(self):
+        self.sessions: Dict[str, Dict] = {}
+        self.session_timeout = 24 * 60 * 60  # 24小时过期
+        
+    def create_session(self, username: str) -> str:
+        """创建新会话"""
+        session_id = str(hash(f"{username}:{time.time()}"))
+        self.sessions[session_id] = {
+            'username': username,
+            'created_at': time.time()
+        }
+        return session_id
+        
+    def validate_session(self, session_id: str) -> Optional[str]:
+        """验证会话是否有效，返回用户名"""
+        if session_id not in self.sessions:
+            return None
+            
+        session = self.sessions[session_id]
+        if time.time() - session['created_at'] > self.session_timeout:
+            del self.sessions[session_id]
+            return None
+            
+        return session['username']
+        
+    def remove_session(self, session_id: str):
+        """删除会话"""
+        if session_id in self.sessions:
+            del self.sessions[session_id]