完善邮件验证与密码重置安全流程

2026-06-30 09:44:24 +08:00
parent 6c2bcc59b2
commit b25055775e
27 changed files with 4437 additions and 526 deletions
@@ -0,0 +1,94 @@
+"""add email verification settings
+
+Revision ID: 20260629_01
+Revises: 20260608_01
+Create Date: 2026-06-29 11:20:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+
+revision: str = "20260629_01"
+down_revision: Union[str, None] = "20260608_01"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _uuid_column() -> sa.Column:
+    return sa.Column(
+        "id",
+        postgresql.UUID(as_uuid=True),
+        primary_key=True,
+        nullable=False,
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    smtp_security = postgresql.ENUM("NONE", "SSL", "STARTTLS", name="smtp_security", create_type=False)
+    email_purpose = postgresql.ENUM("REGISTER", "PASSWORD_RESET", name="email_verification_purpose", create_type=False)
+    smtp_security.create(bind, checkfirst=True)
+    email_purpose.create(bind, checkfirst=True)
+
+    if not _table_exists(inspector, "system_email_settings"):
+        op.create_table(
+            "system_email_settings",
+            _uuid_column(),
+            sa.Column("smtp_host", sa.String(length=255), nullable=False),
+            sa.Column("smtp_port", sa.Integer(), nullable=False),
+            sa.Column("smtp_security", smtp_security, server_default="SSL", nullable=False),
+            sa.Column("smtp_username", sa.String(length=255), nullable=False),
+            sa.Column("smtp_password_encrypted", sa.Text(), nullable=True),
+            sa.Column("sender_email", sa.String(length=255), nullable=False),
+            sa.Column("sender_name", sa.String(length=255), nullable=True),
+            sa.Column("allowed_register_domain", sa.String(length=255), nullable=False),
+            sa.Column("verification_code_ttl_minutes", sa.Integer(), nullable=False),
+            sa.Column("send_cooldown_seconds", sa.Integer(), nullable=False),
+            sa.Column("max_verify_attempts", sa.Integer(), nullable=False),
+            sa.Column("updated_by", postgresql.UUID(as_uuid=True), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.ForeignKeyConstraint(["updated_by"], ["users.id"]),
+        )
+
+    if not _table_exists(inspector, "email_verification_codes"):
+        op.create_table(
+            "email_verification_codes",
+            _uuid_column(),
+            sa.Column("email", sa.String(length=255), nullable=False),
+            sa.Column("purpose", email_purpose, server_default="REGISTER", nullable=False),
+            sa.Column("code_hash", sa.String(length=255), nullable=False),
+            sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("verified_at", sa.DateTime(timezone=True), nullable=True),
+            sa.Column("attempt_count", sa.Integer(), server_default="0", nullable=False),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        )
+        op.create_index(
+            "ix_email_verification_codes_email",
+            "email_verification_codes",
+            ["email"],
+            unique=False,
+        )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if _table_exists(inspector, "email_verification_codes"):
+        op.drop_index("ix_email_verification_codes_email", table_name="email_verification_codes")
+        op.drop_table("email_verification_codes")
+    if _table_exists(inspector, "system_email_settings"):
+        op.drop_table("system_email_settings")
+    sa.Enum("REGISTER", "PASSWORD_RESET", name="email_verification_purpose").drop(bind, checkfirst=True)
+    sa.Enum("NONE", "SSL", "STARTTLS", name="smtp_security").drop(bind, checkfirst=True)