完善邮件验证与密码重置安全流程
This commit is contained in:
Cheng Zhou
@@ -0,0 +1,94 @@
|
||||
"""add email verification settings
|
||||
|
||||
Revision ID: 20260629_01
|
||||
Revises: 20260608_01
|
||||
Create Date: 2026-06-29 11:20:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
|
||||
revision: str = "20260629_01"
|
||||
down_revision: Union[str, None] = "20260608_01"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
|
||||
return table_name in inspector.get_table_names()
|
||||
|
||||
|
||||
def _uuid_column() -> sa.Column:
|
||||
return sa.Column(
|
||||
"id",
|
||||
postgresql.UUID(as_uuid=True),
|
||||
primary_key=True,
|
||||
nullable=False,
|
||||
)
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
|
||||
smtp_security = postgresql.ENUM("NONE", "SSL", "STARTTLS", name="smtp_security", create_type=False)
|
||||
email_purpose = postgresql.ENUM("REGISTER", "PASSWORD_RESET", name="email_verification_purpose", create_type=False)
|
||||
smtp_security.create(bind, checkfirst=True)
|
||||
email_purpose.create(bind, checkfirst=True)
|
||||
|
||||
if not _table_exists(inspector, "system_email_settings"):
|
||||
op.create_table(
|
||||
"system_email_settings",
|
||||
_uuid_column(),
|
||||
sa.Column("smtp_host", sa.String(length=255), nullable=False),
|
||||
sa.Column("smtp_port", sa.Integer(), nullable=False),
|
||||
sa.Column("smtp_security", smtp_security, server_default="SSL", nullable=False),
|
||||
sa.Column("smtp_username", sa.String(length=255), nullable=False),
|
||||
sa.Column("smtp_password_encrypted", sa.Text(), nullable=True),
|
||||
sa.Column("sender_email", sa.String(length=255), nullable=False),
|
||||
sa.Column("sender_name", sa.String(length=255), nullable=True),
|
||||
sa.Column("allowed_register_domain", sa.String(length=255), nullable=False),
|
||||
sa.Column("verification_code_ttl_minutes", sa.Integer(), nullable=False),
|
||||
sa.Column("send_cooldown_seconds", sa.Integer(), nullable=False),
|
||||
sa.Column("max_verify_attempts", sa.Integer(), nullable=False),
|
||||
sa.Column("updated_by", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
||||
sa.ForeignKeyConstraint(["updated_by"], ["users.id"]),
|
||||
)
|
||||
|
||||
if not _table_exists(inspector, "email_verification_codes"):
|
||||
op.create_table(
|
||||
"email_verification_codes",
|
||||
_uuid_column(),
|
||||
sa.Column("email", sa.String(length=255), nullable=False),
|
||||
sa.Column("purpose", email_purpose, server_default="REGISTER", nullable=False),
|
||||
sa.Column("code_hash", sa.String(length=255), nullable=False),
|
||||
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("verified_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("attempt_count", sa.Integer(), server_default="0", nullable=False),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
||||
)
|
||||
op.create_index(
|
||||
"ix_email_verification_codes_email",
|
||||
"email_verification_codes",
|
||||
["email"],
|
||||
unique=False,
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
if _table_exists(inspector, "email_verification_codes"):
|
||||
op.drop_index("ix_email_verification_codes_email", table_name="email_verification_codes")
|
||||
op.drop_table("email_verification_codes")
|
||||
if _table_exists(inspector, "system_email_settings"):
|
||||
op.drop_table("system_email_settings")
|
||||
sa.Enum("REGISTER", "PASSWORD_RESET", name="email_verification_purpose").drop(bind, checkfirst=True)
|
||||
sa.Enum("NONE", "SSL", "STARTTLS", name="smtp_security").drop(bind, checkfirst=True)
|
||||
@@ -0,0 +1,40 @@
|
||||
"""default multiple register email domains
|
||||
|
||||
Revision ID: 20260629_02
|
||||
Revises: 20260629_01
|
||||
Create Date: 2026-06-29 12:30:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
revision: str = "20260629_02"
|
||||
down_revision: Union[str, None] = "20260629_01"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
if "system_email_settings" in inspector.get_table_names():
|
||||
op.execute(
|
||||
"UPDATE system_email_settings "
|
||||
"SET allowed_register_domain = 'huapont.cn,qq.com' "
|
||||
"WHERE allowed_register_domain IN ('huapont.cn', '@huapont.cn')"
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
if "system_email_settings" in inspector.get_table_names():
|
||||
op.execute(
|
||||
"UPDATE system_email_settings "
|
||||
"SET allowed_register_domain = 'huapont.cn' "
|
||||
"WHERE allowed_register_domain = 'huapont.cn,qq.com'"
|
||||
)
|
||||
@@ -0,0 +1,123 @@
|
||||
"""email settings per register domain
|
||||
|
||||
Revision ID: 20260629_03
|
||||
Revises: 20260629_02
|
||||
Create Date: 2026-06-29 14:20:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
import uuid
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
|
||||
revision: str = "20260629_03"
|
||||
down_revision: Union[str, None] = "20260629_02"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
|
||||
return table_name in inspector.get_table_names()
|
||||
|
||||
|
||||
def _column_exists(inspector: sa.Inspector, table_name: str, column_name: str) -> bool:
|
||||
return any(column["name"] == column_name for column in inspector.get_columns(table_name))
|
||||
|
||||
|
||||
def _normalize_domains(value: str | None) -> list[str]:
|
||||
domains: list[str] = []
|
||||
for item in (value or "huapont.cn,qq.com").replace("，", ",").split(","):
|
||||
domain = item.strip().lower().lstrip("@")
|
||||
if domain and domain not in domains:
|
||||
domains.append(domain)
|
||||
return domains or ["huapont.cn", "qq.com"]
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
if not _table_exists(inspector, "system_email_settings"):
|
||||
return
|
||||
|
||||
if not _column_exists(inspector, "system_email_settings", "register_domain"):
|
||||
op.add_column("system_email_settings", sa.Column("register_domain", sa.String(length=255), nullable=True))
|
||||
|
||||
rows = bind.execute(sa.text("SELECT * FROM system_email_settings ORDER BY created_at ASC")).mappings().all()
|
||||
for row in rows:
|
||||
domains = _normalize_domains(row.get("allowed_register_domain"))
|
||||
primary_domain = domains[0]
|
||||
bind.execute(
|
||||
sa.text(
|
||||
"UPDATE system_email_settings "
|
||||
"SET register_domain = :register_domain, allowed_register_domain = :register_domain "
|
||||
"WHERE id = :id"
|
||||
),
|
||||
{"register_domain": primary_domain, "id": row["id"]},
|
||||
)
|
||||
for domain in domains[1:]:
|
||||
exists = bind.execute(
|
||||
sa.text("SELECT 1 FROM system_email_settings WHERE register_domain = :register_domain"),
|
||||
{"register_domain": domain},
|
||||
).first()
|
||||
if exists:
|
||||
continue
|
||||
bind.execute(
|
||||
sa.text(
|
||||
"""
|
||||
INSERT INTO system_email_settings (
|
||||
id, register_domain, smtp_host, smtp_port, smtp_security, smtp_username,
|
||||
smtp_password_encrypted, sender_email, sender_name, allowed_register_domain,
|
||||
verification_code_ttl_minutes, send_cooldown_seconds, max_verify_attempts,
|
||||
updated_by, created_at, updated_at
|
||||
) VALUES (
|
||||
:id, :register_domain, :smtp_host, :smtp_port, :smtp_security, :smtp_username,
|
||||
:smtp_password_encrypted, :sender_email, :sender_name, :allowed_register_domain,
|
||||
:verification_code_ttl_minutes, :send_cooldown_seconds, :max_verify_attempts,
|
||||
:updated_by, now(), now()
|
||||
)
|
||||
"""
|
||||
),
|
||||
{
|
||||
"id": uuid.uuid4(),
|
||||
"register_domain": domain,
|
||||
"smtp_host": row["smtp_host"],
|
||||
"smtp_port": row["smtp_port"],
|
||||
"smtp_security": row["smtp_security"],
|
||||
"smtp_username": row["smtp_username"],
|
||||
"smtp_password_encrypted": row["smtp_password_encrypted"],
|
||||
"sender_email": row["sender_email"],
|
||||
"sender_name": row["sender_name"],
|
||||
"allowed_register_domain": domain,
|
||||
"verification_code_ttl_minutes": row["verification_code_ttl_minutes"],
|
||||
"send_cooldown_seconds": row["send_cooldown_seconds"],
|
||||
"max_verify_attempts": row["max_verify_attempts"],
|
||||
"updated_by": row["updated_by"],
|
||||
},
|
||||
)
|
||||
|
||||
op.alter_column("system_email_settings", "register_domain", existing_type=sa.String(length=255), nullable=False)
|
||||
op.create_unique_constraint(
|
||||
"uq_system_email_settings_register_domain",
|
||||
"system_email_settings",
|
||||
["register_domain"],
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
inspector = sa.inspect(bind)
|
||||
if not _table_exists(inspector, "system_email_settings"):
|
||||
return
|
||||
uniques = {item["name"] for item in inspector.get_unique_constraints("system_email_settings")}
|
||||
if "uq_system_email_settings_register_domain" in uniques:
|
||||
op.drop_constraint(
|
||||
"uq_system_email_settings_register_domain",
|
||||
"system_email_settings",
|
||||
type_="unique",
|
||||
)
|
||||
if _column_exists(inspector, "system_email_settings", "register_domain"):
|
||||
op.drop_column("system_email_settings", "register_domain")
|
||||
@@ -0,0 +1,26 @@
|
||||
"""add password reset email purpose
|
||||
|
||||
Revision ID: 20260629_04
|
||||
Revises: 20260629_03
|
||||
Create Date: 2026-06-29 16:50:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
|
||||
|
||||
revision: str = "20260629_04"
|
||||
down_revision: Union[str, None] = "20260629_03"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.execute("ALTER TYPE email_verification_purpose ADD VALUE IF NOT EXISTS 'PASSWORD_RESET'")
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# PostgreSQL enum values cannot be removed safely without recreating the type.
|
||||
pass
|
||||
@@ -0,0 +1,26 @@
|
||||
"""add password reset link email purpose
|
||||
|
||||
Revision ID: 20260630_01
|
||||
Revises: 20260629_04
|
||||
Create Date: 2026-06-30 10:30:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
|
||||
|
||||
revision: str = "20260630_01"
|
||||
down_revision: Union[str, None] = "20260629_04"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.execute("ALTER TYPE email_verification_purpose ADD VALUE IF NOT EXISTS 'PASSWORD_RESET_LINK'")
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# PostgreSQL enum values cannot be removed safely without recreating the type.
|
||||
pass
|
||||
Reference in New Issue
Block a user