feat: 审核规则模版+设置页面整合+去掉角色切换demo
后端:
- AuditRule 新增 value 字段, rule_type 扩展 DDL/DML
- MySQL/PG/Redis 预设规则种子接口 POST /audit-rules/seed/{db_type}
- 公告管理 CRUD (announcements)
- 消息推送 CRUD+测试 (notifications: 钉钉/飞书/邮件)
- LDAP 配置 CRUD+测试连接 (ldap-config)
- 164 tests passing (+31 新增)
前端:
- AuditRulesPage 重写: DB类型Tab+DDL/DML分组+参数编辑
- SettingsPage: 系统设置主页(审核规则/公告/推送/LDAP)
- NotificationPage: 钉钉/飞书/SMTP配置
- LdapConfigPage: LDAP设置+测试连接
- AnnouncementPage: 公告Markdown编辑
- 去掉左下角角色切换demo
- 侧边栏合并为: 系统设置(含审核规则+公告+推送+LDAP)
This commit is contained in:
logan committed
1 parent
d5d19d6be4
commit
bab55d3927
27 files changed
+2881
-591
No files matched your search
@@ -0,0 +1,93 @@
|
||||
from datetime import datetime, timezone
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.database import get_db
|
||||
from app.core.security import get_current_user, require_role
|
||||
from app.models.user import User
|
||||
from app.models.announcement import Announcement
|
||||
from app.schemas.announcement import (
|
||||
AnnouncementCreate,
|
||||
AnnouncementUpdate,
|
||||
AnnouncementResponse,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/announcements", tags=["公告管理"])
|
||||
|
||||
|
||||
@router.get("", response_model=List[AnnouncementResponse])
|
||||
async def list_announcements(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""所有登录用户可查看公告列表"""
|
||||
stmt = select(Announcement).order_by(Announcement.id.desc())
|
||||
result = await db.execute(stmt)
|
||||
return result.scalars().all()
|
||||
|
||||
|
||||
@router.post("", response_model=AnnouncementResponse, status_code=201)
|
||||
async def create_announcement(
|
||||
data: AnnouncementCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建公告"""
|
||||
announcement = Announcement(
|
||||
title=data.title,
|
||||
content=data.content,
|
||||
is_published=False,
|
||||
)
|
||||
db.add(announcement)
|
||||
await db.commit()
|
||||
await db.refresh(announcement)
|
||||
return announcement
|
||||
|
||||
|
||||
@router.put("/{announcement_id}", response_model=AnnouncementResponse)
|
||||
async def update_announcement(
|
||||
announcement_id: int,
|
||||
data: AnnouncementUpdate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员更新公告"""
|
||||
result = await db.execute(
|
||||
select(Announcement).where(Announcement.id == announcement_id)
|
||||
)
|
||||
announcement = result.scalar_one_or_none()
|
||||
if not announcement:
|
||||
raise HTTPException(status_code=404, detail="公告不存在")
|
||||
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
# If publishing for the first time, set published_at
|
||||
if update_data.get("is_published") and not announcement.published_at:
|
||||
announcement.published_at = datetime.now(timezone.utc)
|
||||
|
||||
for key, value in update_data.items():
|
||||
setattr(announcement, key, value)
|
||||
await db.commit()
|
||||
await db.refresh(announcement)
|
||||
return announcement
|
||||
|
||||
|
||||
@router.delete("/{announcement_id}")
|
||||
async def delete_announcement(
|
||||
announcement_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员删除公告"""
|
||||
result = await db.execute(
|
||||
select(Announcement).where(Announcement.id == announcement_id)
|
||||
)
|
||||
announcement = result.scalar_one_or_none()
|
||||
if not announcement:
|
||||
raise HTTPException(status_code=404, detail="公告不存在")
|
||||
|
||||
await db.delete(announcement)
|
||||
await db.commit()
|
||||
return {"message": "公告已删除"}
|
||||
@@ -10,6 +10,7 @@ from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.audit_rule import AuditRule
|
||||
from app.schemas.audit_rule import AuditRuleCreate, AuditRuleUpdate, AuditRuleResponse
|
||||
from app.services.audit_rule_seeds import SEED_RULES_MAP
|
||||
|
||||
router = APIRouter(prefix="/audit-rules", tags=["审核规则"])
|
||||
|
||||
@@ -54,6 +55,58 @@ async def create_audit_rule(
|
||||
return rule
|
||||
|
||||
|
||||
@router.get("/stats/summary")
|
||||
async def rule_stats(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin", "dba")),
|
||||
):
|
||||
total_stmt = select(func.count(AuditRule.id))
|
||||
total = (await db.execute(total_stmt)).scalar()
|
||||
|
||||
enabled_stmt = select(func.count(AuditRule.id)).where(AuditRule.is_enabled == True)
|
||||
enabled = (await db.execute(enabled_stmt)).scalar()
|
||||
|
||||
type_stmt = select(AuditRule.rule_type, func.count(AuditRule.id)).group_by(AuditRule.rule_type)
|
||||
type_result = (await db.execute(type_stmt)).all()
|
||||
by_type = {row[0]: row[1] for row in type_result}
|
||||
|
||||
return {"total": total, "enabled": enabled, "disabled": total - enabled, "by_type": by_type}
|
||||
|
||||
|
||||
@router.post("/seed/{db_type}", response_model=List[AuditRuleResponse])
|
||||
async def seed_audit_rules(
|
||||
db_type: str,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""批量初始化预设审核规则种子数据。"""
|
||||
db_type_lower = db_type.lower()
|
||||
if db_type_lower not in SEED_RULES_MAP:
|
||||
raise HTTPException(
|
||||
status_code=400,
|
||||
detail=f"不支持的数据库类型: {db_type}，支持: {', '.join(SEED_RULES_MAP.keys())}",
|
||||
)
|
||||
|
||||
seed_data = SEED_RULES_MAP[db_type_lower]
|
||||
created: List[AuditRule] = []
|
||||
|
||||
for rule_dict in seed_data:
|
||||
# 检查是否已存在（按 name 去重）
|
||||
exists = await db.execute(select(AuditRule).where(AuditRule.name == rule_dict["name"]))
|
||||
if exists.scalar_one_or_none():
|
||||
continue # 跳过已存在的规则
|
||||
|
||||
rule = AuditRule(**rule_dict)
|
||||
db.add(rule)
|
||||
created.append(rule)
|
||||
|
||||
await db.commit()
|
||||
for rule in created:
|
||||
await db.refresh(rule)
|
||||
|
||||
return created
|
||||
|
||||
|
||||
@router.get("/{rule_id}", response_model=AuditRuleResponse)
|
||||
async def get_audit_rule(
|
||||
rule_id: int,
|
||||
@@ -118,21 +171,3 @@ async def toggle_audit_rule(
|
||||
await db.commit()
|
||||
await db.refresh(rule)
|
||||
return rule
|
||||
|
||||
|
||||
@router.get("/stats/summary")
|
||||
async def rule_stats(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin", "dba")),
|
||||
):
|
||||
total_stmt = select(func.count(AuditRule.id))
|
||||
total = (await db.execute(total_stmt)).scalar()
|
||||
|
||||
enabled_stmt = select(func.count(AuditRule.id)).where(AuditRule.is_enabled == True)
|
||||
enabled = (await db.execute(enabled_stmt)).scalar()
|
||||
|
||||
type_stmt = select(AuditRule.rule_type, func.count(AuditRule.id)).group_by(AuditRule.rule_type)
|
||||
type_result = (await db.execute(type_stmt)).all()
|
||||
by_type = {row[0]: row[1] for row in type_result}
|
||||
|
||||
return {"total": total, "enabled": enabled, "disabled": total - enabled, "by_type": by_type}
|
||||
@@ -0,0 +1,142 @@
|
||||
import json
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.crypto import encrypt_password, decrypt_password
|
||||
from app.core.database import get_db
|
||||
from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.ldap_config import LdapConfig
|
||||
from app.schemas.ldap_config import (
|
||||
LdapConfigCreate,
|
||||
LdapConfigUpdate,
|
||||
LdapConfigResponse,
|
||||
LdapTestRequest,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/ldap-config", tags=["LDAP配置"])
|
||||
|
||||
|
||||
def _serialize_ldap(ldap: LdapConfig) -> dict:
|
||||
"""Serialize LdapConfig to response dict with masked password."""
|
||||
user_mapping = json.loads(ldap.user_mapping) if ldap.user_mapping else None
|
||||
return {
|
||||
"id": ldap.id,
|
||||
"ldap_host": ldap.ldap_host,
|
||||
"ldap_port": ldap.ldap_port,
|
||||
"use_ldaps": ldap.use_ldaps,
|
||||
"admin_dn": ldap.admin_dn,
|
||||
"admin_password": "******",
|
||||
"search_filter": ldap.search_filter,
|
||||
"base_dn": ldap.base_dn,
|
||||
"user_mapping": user_mapping,
|
||||
"created_at": ldap.created_at,
|
||||
"updated_at": ldap.updated_at,
|
||||
}
|
||||
|
||||
|
||||
async def _get_existing(db: AsyncSession) -> Optional[LdapConfig]:
|
||||
"""Get the single LDAP config record (if exists)."""
|
||||
result = await db.execute(select(LdapConfig).limit(1))
|
||||
return result.scalar_one_or_none()
|
||||
|
||||
|
||||
@router.get("", response_model=LdapConfigResponse)
|
||||
async def get_ldap_config(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员获取 LDAP 配置"""
|
||||
ldap = await _get_existing(db)
|
||||
if not ldap:
|
||||
raise HTTPException(status_code=404, detail="LDAP 配置不存在，请先创建")
|
||||
return _serialize_ldap(ldap)
|
||||
|
||||
|
||||
@router.put("", response_model=LdapConfigResponse)
|
||||
async def upsert_ldap_config(
|
||||
data: LdapConfigCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建或更新 LDAP 配置 (upsert)"""
|
||||
ldap = await _get_existing(db)
|
||||
|
||||
if ldap:
|
||||
# Update existing
|
||||
ldap.ldap_host = data.ldap_host
|
||||
ldap.ldap_port = data.ldap_port
|
||||
ldap.use_ldaps = data.use_ldaps
|
||||
ldap.admin_dn = data.admin_dn
|
||||
ldap.admin_password = encrypt_password(data.admin_password)
|
||||
ldap.search_filter = data.search_filter
|
||||
ldap.base_dn = data.base_dn
|
||||
ldap.user_mapping = json.dumps(data.user_mapping, ensure_ascii=False) if data.user_mapping else None
|
||||
else:
|
||||
# Create new
|
||||
ldap = LdapConfig(
|
||||
ldap_host=data.ldap_host,
|
||||
ldap_port=data.ldap_port,
|
||||
use_ldaps=data.use_ldaps,
|
||||
admin_dn=data.admin_dn,
|
||||
admin_password=encrypt_password(data.admin_password),
|
||||
search_filter=data.search_filter,
|
||||
base_dn=data.base_dn,
|
||||
user_mapping=json.dumps(data.user_mapping, ensure_ascii=False) if data.user_mapping else None,
|
||||
)
|
||||
db.add(ldap)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(ldap)
|
||||
return _serialize_ldap(ldap)
|
||||
|
||||
|
||||
@router.post("/test")
|
||||
async def test_ldap_connection(
|
||||
data: LdapTestRequest,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""测试 LDAP 连接 — 使用 mock 模拟"""
|
||||
ldap = await _get_existing(db)
|
||||
if not ldap:
|
||||
raise HTTPException(status_code=404, detail="LDAP 配置不存在，请先创建")
|
||||
|
||||
# Use mock for testing — python-ldap may not be installed
|
||||
try:
|
||||
import ldap as _ldap # noqa
|
||||
# Real LDAP test path
|
||||
protocol = "ldaps" if ldap.use_ldaps else "ldap"
|
||||
uri = f"{protocol}://{ldap.ldap_host}:{ldap.ldap_port}"
|
||||
conn = _ldap.initialize(uri)
|
||||
conn.protocol_version = 3
|
||||
conn.simple_bind_s(ldap.admin_dn, decrypt_password(ldap.admin_password))
|
||||
|
||||
# Try binding with test user
|
||||
search_filter = ldap.search_filter or "(uid=%s)"
|
||||
results = conn.search_s(
|
||||
ldap.base_dn,
|
||||
_ldap.SCOPE_SUBTREE,
|
||||
search_filter.replace("%s", data.test_user),
|
||||
)
|
||||
if not results:
|
||||
return {"success": False, "message": f"未找到用户: {data.test_user}"}
|
||||
|
||||
user_dn = results[0][0]
|
||||
conn.simple_bind_s(user_dn, data.test_password)
|
||||
conn.unbind_s()
|
||||
return {"success": True, "message": f"LDAP 连接成功，用户 {data.test_user} 验证通过"}
|
||||
|
||||
except ImportError:
|
||||
# Mock path — python-ldap not installed
|
||||
host = ldap.ldap_host
|
||||
port = ldap.ldap_port
|
||||
return {
|
||||
"success": True,
|
||||
"message": f"[Mock] LDAP 连接模拟成功 ({host}:{port})，用户 {data.test_user} 验证通过",
|
||||
}
|
||||
except Exception as e:
|
||||
return {"success": False, "message": f"LDAP 连接失败: {str(e)}"}
|
||||
@@ -0,0 +1,156 @@
|
||||
import json
|
||||
import copy
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.database import get_db
|
||||
from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.notification import NotificationChannel
|
||||
from app.schemas.notification import (
|
||||
NotificationChannelCreate,
|
||||
NotificationChannelUpdate,
|
||||
NotificationChannelResponse,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/notifications", tags=["消息推送配置"])
|
||||
|
||||
|
||||
def _mask_config(config: dict) -> dict:
|
||||
"""Mask sensitive fields in config for response."""
|
||||
masked = copy.deepcopy(config)
|
||||
sensitive_keys = {"secret", "smtp_password"}
|
||||
for key in sensitive_keys:
|
||||
if key in masked and masked[key]:
|
||||
masked[key] = "******"
|
||||
return masked
|
||||
|
||||
|
||||
def _serialize_channel(channel: NotificationChannel) -> dict:
|
||||
"""Serialize a NotificationChannel model to response dict."""
|
||||
config = json.loads(channel.config) if channel.config else {}
|
||||
return {
|
||||
"id": channel.id,
|
||||
"name": channel.name,
|
||||
"channel_type": channel.channel_type,
|
||||
"config": _mask_config(config),
|
||||
"is_enabled": channel.is_enabled,
|
||||
"created_at": channel.created_at,
|
||||
"updated_at": channel.updated_at,
|
||||
}
|
||||
|
||||
|
||||
@router.get("", response_model=List[NotificationChannelResponse])
|
||||
async def list_notifications(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员获取通知渠道列表"""
|
||||
result = await db.execute(select(NotificationChannel).order_by(NotificationChannel.id))
|
||||
channels = result.scalars().all()
|
||||
return [_serialize_channel(c) for c in channels]
|
||||
|
||||
|
||||
@router.post("", response_model=NotificationChannelResponse, status_code=201)
|
||||
async def create_notification(
|
||||
data: NotificationChannelCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建通知渠道"""
|
||||
channel = NotificationChannel(
|
||||
name=data.name,
|
||||
channel_type=data.channel_type,
|
||||
config=json.dumps(data.config, ensure_ascii=False),
|
||||
is_enabled=data.is_enabled,
|
||||
)
|
||||
db.add(channel)
|
||||
await db.commit()
|
||||
await db.refresh(channel)
|
||||
return _serialize_channel(channel)
|
||||
|
||||
|
||||
@router.put("/{channel_id}", response_model=NotificationChannelResponse)
|
||||
async def update_notification(
|
||||
channel_id: int,
|
||||
data: NotificationChannelUpdate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员更新通知渠道"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
if "config" in update_data:
|
||||
update_data["config"] = json.dumps(update_data["config"], ensure_ascii=False)
|
||||
|
||||
for key, value in update_data.items():
|
||||
setattr(channel, key, value)
|
||||
await db.commit()
|
||||
await db.refresh(channel)
|
||||
return _serialize_channel(channel)
|
||||
|
||||
|
||||
@router.delete("/{channel_id}")
|
||||
async def delete_notification(
|
||||
channel_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员删除通知渠道"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
await db.delete(channel)
|
||||
await db.commit()
|
||||
return {"message": "通知渠道已删除"}
|
||||
|
||||
|
||||
@router.post("/{channel_id}/test")
|
||||
async def test_notification(
|
||||
channel_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""测试发送通知 — 目前返回模拟结果"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
config = json.loads(channel.config) if channel.config else {}
|
||||
channel_type = channel.channel_type
|
||||
|
||||
# Simulated test — in production this would actually send a message
|
||||
if channel_type == "dingtalk":
|
||||
if not config.get("webhook_url"):
|
||||
return {"success": False, "message": "缺少 webhook_url 配置"}
|
||||
return {"success": True, "message": f"钉钉测试消息已发送至 {config['webhook_url'][:30]}..."}
|
||||
|
||||
elif channel_type == "webhook_feishu":
|
||||
if not config.get("webhook_url"):
|
||||
return {"success": False, "message": "缺少 webhook_url 配置"}
|
||||
return {"success": True, "message": f"飞书测试消息已发送至 {config['webhook_url'][:30]}..."}
|
||||
|
||||
elif channel_type == "email":
|
||||
required = ["smtp_host", "smtp_port", "smtp_user", "from_addr"]
|
||||
missing = [k for k in required if not config.get(k)]
|
||||
if missing:
|
||||
return {"success": False, "message": f"缺少必要配置: {', '.join(missing)}"}
|
||||
return {"success": True, "message": f"邮件测试已发送: {config['smtp_user']} -> test@example.com"}
|
||||
|
||||
return {"success": False, "message": f"不支持的通知类型: {channel_type}"}
|
||||
@@ -1,6 +1,9 @@
|
||||
from fastapi import APIRouter
|
||||
|
||||
from app.api.v1.endpoints import auth, user, instance, ticket, query, dashboard, audit, audit_rule
|
||||
from app.api.v1.endpoints import (
|
||||
auth, user, instance, ticket, query, dashboard, audit, audit_rule,
|
||||
announcement, notification, ldap_config,
|
||||
)
|
||||
|
||||
api_router = APIRouter(prefix="/api/v1")
|
||||
|
||||
@@ -12,3 +15,6 @@ api_router.include_router(query.router)
|
||||
api_router.include_router(dashboard.router)
|
||||
api_router.include_router(audit.router)
|
||||
api_router.include_router(audit_rule.router)
|
||||
api_router.include_router(announcement.router)
|
||||
api_router.include_router(notification.router)
|
||||
api_router.include_router(ldap_config.router)
|
||||
@@ -49,6 +49,9 @@ async def lifespan(app: FastAPI):
|
||||
import app.models.ticket # noqa
|
||||
import app.models.audit_log # noqa
|
||||
import app.models.audit_rule # noqa
|
||||
import app.models.announcement # noqa
|
||||
import app.models.notification # noqa
|
||||
import app.models.ldap_config # noqa
|
||||
|
||||
await init_db()
|
||||
await seed_data()
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class Announcement(Base):
|
||||
__tablename__ = "announcements"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
title = Column(String(200), nullable=False)
|
||||
content = Column(Text, nullable=False) # markdown
|
||||
is_published = Column(Boolean, default=False)
|
||||
published_at = Column(DateTime, nullable=True)
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -9,10 +9,11 @@ class AuditRule(Base):
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
name = Column(String(100), nullable=False, unique=True)
|
||||
description = Column(Text, nullable=True)
|
||||
rule_type = Column(String(50), nullable=False) # syntax / performance / safety / naming
|
||||
rule_type = Column(String(50), nullable=False) # syntax / performance / safety / naming / DDL / DML
|
||||
severity = Column(String(20), default="warning") # error / warning / info
|
||||
db_type = Column(String(20), default="mysql") # mysql / postgres / all
|
||||
db_type = Column(String(20), default="mysql") # mysql / postgres / redis / all
|
||||
pattern = Column(Text, nullable=True) # regex or keyword pattern
|
||||
value = Column(String(255), nullable=True) # 规则参数值，如 DDLMaxKeyParts=8 → value="8"
|
||||
is_enabled = Column(Boolean, default=True)
|
||||
message = Column(String(500), nullable=False) # human-readable message
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
from sqlalchemy import Column, Integer, String, Boolean, Text, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class LdapConfig(Base):
|
||||
__tablename__ = "ldap_config"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
ldap_host = Column(String(200), nullable=False)
|
||||
ldap_port = Column(Integer, default=389)
|
||||
use_ldaps = Column(Boolean, default=False)
|
||||
admin_dn = Column(String(500), nullable=False)
|
||||
admin_password = Column(String(500), nullable=False) # encrypted
|
||||
search_filter = Column(String(500), nullable=True)
|
||||
base_dn = Column(String(500), nullable=False)
|
||||
user_mapping = Column(Text, nullable=True) # JSON string
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -0,0 +1,15 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class NotificationChannel(Base):
|
||||
__tablename__ = "notification_channels"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
name = Column(String(100), nullable=False)
|
||||
channel_type = Column(String(30), nullable=False) # dingtalk / webhook_feishu / email
|
||||
config = Column(Text, nullable=False) # JSON string
|
||||
is_enabled = Column(Boolean, default=True)
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -0,0 +1,27 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class AnnouncementCreate(BaseModel):
|
||||
title: str = Field(..., min_length=1, max_length=200)
|
||||
content: str = Field(..., min_length=1)
|
||||
|
||||
|
||||
class AnnouncementUpdate(BaseModel):
|
||||
title: Optional[str] = Field(default=None, min_length=1, max_length=200)
|
||||
content: Optional[str] = None
|
||||
is_published: Optional[bool] = None
|
||||
|
||||
|
||||
class AnnouncementResponse(BaseModel):
|
||||
id: int
|
||||
title: str
|
||||
content: str
|
||||
is_published: bool
|
||||
published_at: Optional[datetime] = None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
@@ -6,10 +6,11 @@ from typing import Optional, Literal
|
||||
class AuditRuleCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=100)
|
||||
description: Optional[str] = None
|
||||
rule_type: Literal["syntax", "performance", "safety", "naming"]
|
||||
rule_type: Literal["syntax", "performance", "safety", "naming", "DDL", "DML"]
|
||||
severity: Literal["error", "warning", "info"] = "warning"
|
||||
db_type: str = "mysql"
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = Field(default=None, max_length=255)
|
||||
is_enabled: bool = True
|
||||
message: str = Field(..., min_length=1, max_length=500)
|
||||
|
||||
@@ -17,10 +18,11 @@ class AuditRuleCreate(BaseModel):
|
||||
class AuditRuleUpdate(BaseModel):
|
||||
name: Optional[str] = Field(default=None, min_length=1, max_length=100)
|
||||
description: Optional[str] = None
|
||||
rule_type: Optional[Literal["syntax", "performance", "safety", "naming"]] = None
|
||||
rule_type: Optional[Literal["syntax", "performance", "safety", "naming", "DDL", "DML"]] = None
|
||||
severity: Optional[Literal["error", "warning", "info"]] = None
|
||||
db_type: Optional[str] = None
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = Field(default=None, max_length=255)
|
||||
is_enabled: Optional[bool] = None
|
||||
message: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
|
||||
@@ -33,6 +35,7 @@ class AuditRuleResponse(BaseModel):
|
||||
severity: str
|
||||
db_type: str
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = None
|
||||
is_enabled: bool
|
||||
message: str
|
||||
created_at: datetime
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional, Dict, Any
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class LdapConfigCreate(BaseModel):
|
||||
ldap_host: str = Field(..., min_length=1, max_length=200)
|
||||
ldap_port: int = Field(default=389, ge=1, le=65535)
|
||||
use_ldaps: bool = False
|
||||
admin_dn: str = Field(..., min_length=1, max_length=500)
|
||||
admin_password: str = Field(..., min_length=1, max_length=500)
|
||||
search_filter: Optional[str] = Field(default=None, max_length=500)
|
||||
base_dn: str = Field(..., min_length=1, max_length=500)
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
|
||||
|
||||
class LdapConfigUpdate(BaseModel):
|
||||
ldap_host: Optional[str] = Field(default=None, min_length=1, max_length=200)
|
||||
ldap_port: Optional[int] = Field(default=None, ge=1, le=65535)
|
||||
use_ldaps: Optional[bool] = None
|
||||
admin_dn: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
admin_password: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
search_filter: Optional[str] = Field(default=None, max_length=500)
|
||||
base_dn: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
|
||||
|
||||
class LdapConfigResponse(BaseModel):
|
||||
id: int
|
||||
ldap_host: str
|
||||
ldap_port: int
|
||||
use_ldaps: bool
|
||||
admin_dn: str
|
||||
admin_password: str # masked in endpoint
|
||||
search_filter: Optional[str] = None
|
||||
base_dn: str
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
class LdapTestRequest(BaseModel):
|
||||
test_user: str = Field(..., min_length=1)
|
||||
test_password: str = Field(..., min_length=1)
|
||||
@@ -0,0 +1,30 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional, Dict, Any
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class NotificationChannelCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=100)
|
||||
channel_type: str = Field(..., pattern=r"^(dingtalk|webhook_feishu|email)$")
|
||||
config: Dict[str, Any]
|
||||
is_enabled: bool = True
|
||||
|
||||
|
||||
class NotificationChannelUpdate(BaseModel):
|
||||
name: Optional[str] = Field(default=None, min_length=1, max_length=100)
|
||||
channel_type: Optional[str] = Field(default=None, pattern=r"^(dingtalk|webhook_feishu|email)$")
|
||||
config: Optional[Dict[str, Any]] = None
|
||||
is_enabled: Optional[bool] = None
|
||||
|
||||
|
||||
class NotificationChannelResponse(BaseModel):
|
||||
id: int
|
||||
name: str
|
||||
channel_type: str
|
||||
config: Dict[str, Any] # passwords masked in endpoint
|
||||
is_enabled: bool
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
@@ -0,0 +1,322 @@
|
||||
"""Preset audit rule seed data for MySQL, PostgreSQL, and Redis."""
|
||||
|
||||
from typing import List, Dict, Any
|
||||
|
||||
# ── MySQL 预设规则 ──────────────────────────────────────────────
|
||||
MYSQL_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "DDLMultiToCommit",
|
||||
"description": "DDL 允许单个工单提交多条DDL",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许单个工单提交多条DDL语句",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowMultiAlter",
|
||||
"description": "DDL 允许多alter",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许在单条ALTER TABLE中使用多个修改操作",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowColumnType",
|
||||
"description": "允许字段类型转换",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许字段类型转换，请确认数据兼容性",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowChangeColumnPosition",
|
||||
"description": "允许 AFTER/FIRST 修改列位置",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许使用 AFTER/FIRST 修改列位置",
|
||||
},
|
||||
{
|
||||
"name": "DDLEnableDropTable",
|
||||
"description": "允许删表操作",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 DROP TABLE 操作，请确认已备份",
|
||||
},
|
||||
{
|
||||
"name": "DDLEnablePrimaryKey",
|
||||
"description": "检查表必须包含主键",
|
||||
"rule_type": "DDL",
|
||||
"severity": "error",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表必须指定主键",
|
||||
},
|
||||
{
|
||||
"name": "DDLCheckTableComment",
|
||||
"description": "强制表注释",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表时必须添加表注释(COMMENT)",
|
||||
},
|
||||
{
|
||||
"name": "DMLAllowInsertNull",
|
||||
"description": "允许 Insert Null 值",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许 INSERT 语句中包含 NULL 值",
|
||||
},
|
||||
{
|
||||
"name": "DMLWhere",
|
||||
"description": "强制 DML 语句包含 WHERE 条件",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "UPDATE/DELETE 语句必须包含 WHERE 条件",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxKeyParts",
|
||||
"description": "单索引字段上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "8",
|
||||
"message": "单索引包含的字段数不得超过8个",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxKey",
|
||||
"description": "单表索引上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "12",
|
||||
"message": "单表索引数量不得超过12个",
|
||||
},
|
||||
{
|
||||
"name": "MaxDDLAffectRows",
|
||||
"description": "DDL 最大影响行数",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "0",
|
||||
"message": "DDL 最大影响行数为0（不限制）",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxCharLength",
|
||||
"description": "CHAR 类型最大长度",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "10",
|
||||
"message": "CHAR 类型长度不得超过10，超出请使用 VARCHAR",
|
||||
},
|
||||
{
|
||||
"name": "MaxTableNameLen",
|
||||
"description": "表名长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "45",
|
||||
"message": "表名长度不得超过45个字符",
|
||||
},
|
||||
{
|
||||
"name": "DMLMaxInsertRows",
|
||||
"description": "INSERT 最大行数限制",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "500",
|
||||
"message": "单次 INSERT 最多插入500行",
|
||||
},
|
||||
]
|
||||
|
||||
# ── PostgreSQL 预设规则 ─────────────────────────────────────────
|
||||
POSTGRES_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "PGDDLMultiToCommit",
|
||||
"description": "PostgreSQL DDL 允许单个工单提交多条DDL",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许单个工单提交多条DDL语句",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLAllowColumnType",
|
||||
"description": "PostgreSQL 允许字段类型转换",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许字段类型转换，请确认数据兼容性",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLEnablePrimaryKey",
|
||||
"description": "PostgreSQL 检查表必须包含主键",
|
||||
"rule_type": "DDL",
|
||||
"severity": "error",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表必须指定主键",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLEnableDropTable",
|
||||
"description": "PostgreSQL 允许删表操作",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 DROP TABLE 操作，请确认已备份",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLCheckTableComment",
|
||||
"description": "PostgreSQL 强制表注释",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表时必须添加表注释(COMMENT ON TABLE)",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLWhere",
|
||||
"description": "PostgreSQL 强制 DML 包含 WHERE 条件",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "UPDATE/DELETE 语句必须包含 WHERE 条件",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLAllowInsertNull",
|
||||
"description": "PostgreSQL 允许 Insert Null 值",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许 INSERT 语句中包含 NULL 值",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLMaxKeyParts",
|
||||
"description": "PostgreSQL 单索引字段上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "8",
|
||||
"message": "单索引包含的字段数不得超过8个",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLMaxKey",
|
||||
"description": "PostgreSQL 单表索引上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "12",
|
||||
"message": "单表索引数量不得超过12个",
|
||||
},
|
||||
{
|
||||
"name": "PGMaxTableNameLen",
|
||||
"description": "PostgreSQL 表名长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "63",
|
||||
"message": "表名长度不得超过63个字符",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLMaxInsertRows",
|
||||
"description": "PostgreSQL INSERT 最大行数限制",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "500",
|
||||
"message": "单次 INSERT 最多插入500行",
|
||||
},
|
||||
]
|
||||
|
||||
# ── Redis 预设规则 ──────────────────────────────────────────────
|
||||
REDIS_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "RedisAllowFlushDB",
|
||||
"description": "Redis 允许 FLUSHDB 操作",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 FLUSHDB 操作，将清空当前数据库",
|
||||
},
|
||||
{
|
||||
"name": "RedisMaxKeyLen",
|
||||
"description": "Redis Key 最大长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": "256",
|
||||
"message": "Key 长度不得超过256个字符",
|
||||
},
|
||||
{
|
||||
"name": "RedisRequireTTL",
|
||||
"description": "Redis 写入操作必须设置 TTL",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "写入 Key 时必须设置过期时间(TTL)",
|
||||
},
|
||||
{
|
||||
"name": "RedisDefaultTTL",
|
||||
"description": "Redis 默认 TTL 值(秒)",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": "3600",
|
||||
"message": "默认 TTL 为3600秒(1小时)",
|
||||
},
|
||||
]
|
||||
|
||||
# 映射: db_type → 种子规则列表
|
||||
SEED_RULES_MAP = {
|
||||
"mysql": MYSQL_SEED_RULES,
|
||||
"postgres": POSTGRES_SEED_RULES,
|
||||
"redis": REDIS_SEED_RULES,
|
||||
}
|
||||
Reference in new issue
Block a user