ctms/backend/app/services/collaboration_share_service.py

from __future__ import annotations

import base64
import binascii
import hashlib
import hmac
import uuid
from datetime import datetime, timedelta, timezone

from anyio import to_thread
from fastapi import HTTPException, status
from jose import JWTError, jwt
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.config import settings
from app.core.security import hash_password, verify_password
from app.models.collaboration import CollaborationFile, CollaborationShareLink
from app.schemas.collaboration import (
    CollaborationPublicShareMetadata,
    CollaborationShareAccessGrant,
    CollaborationShareLinkRead,
    CollaborationShareLinkUpdate,
)
from app.services import collaboration_service


SHARE_PATH = "/collaboration/share"
SHARE_ACCESS_TTL_SECONDS = 30 * 60
PASSWORD_FAILURE_WINDOW = timedelta(minutes=15)
PASSWORD_LOCK_DURATION = timedelta(minutes=15)
PASSWORD_FAILURE_LIMIT = 5
_ACCESS_PURPOSE = "ctms-collaboration-share-access"
_EXPIRY_DURATIONS = {
    "ONE_DAY": timedelta(days=1),
    "SEVEN_DAYS": timedelta(days=7),
    "THIRTY_DAYS": timedelta(days=30),
    "PERMANENT": None,
}


def _now() -> datetime:
    return datetime.now(timezone.utc)


def _signing_key() -> bytes:
    return hmac.new(
        settings.JWT_SECRET_KEY.encode("utf-8"),
        b"ctms-collaboration-share-v1",
        hashlib.sha256,
    ).digest()


def _b64encode(value: bytes) -> str:
    return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")


def _b64decode(value: str) -> bytes:
    padding = "=" * (-len(value) % 4)
    return base64.urlsafe_b64decode(f"{value}{padding}".encode("ascii"))


def share_token(link: CollaborationShareLink) -> str:
    payload = f"{link.id}.{link.token_version}".encode("ascii")
    signature = hmac.new(_signing_key(), payload, hashlib.sha256).digest()
    return f"{_b64encode(payload)}.{_b64encode(signature)}"


def _decode_share_token(value: str | None) -> tuple[uuid.UUID, int]:
    token = (value or "").strip()
    if not token or len(token) > 256 or token.count(".") != 1:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="共享链接不存在或已失效")
    encoded_payload, encoded_signature = token.split(".", 1)
    try:
        payload = _b64decode(encoded_payload)
        actual_signature = _b64decode(encoded_signature)
        if (
            not hmac.compare_digest(_b64encode(payload), encoded_payload)
            or not hmac.compare_digest(_b64encode(actual_signature), encoded_signature)
        ):
            raise ValueError("non-canonical token encoding")
        expected_signature = hmac.new(_signing_key(), payload, hashlib.sha256).digest()
        if not hmac.compare_digest(actual_signature, expected_signature):
            raise ValueError("signature mismatch")
        raw_id, raw_version = payload.decode("ascii").split(".", 1)
        return uuid.UUID(raw_id), int(raw_version)
    except (ValueError, UnicodeError, TypeError, binascii.Error) as exc:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="共享链接不存在或已失效") from exc


def _expiry_for_policy(policy: str, now: datetime) -> datetime | None:
    duration = _EXPIRY_DURATIONS[policy]
    return now + duration if duration else None


def _is_expired(link: CollaborationShareLink, now: datetime | None = None) -> bool:
    return bool(link.expires_at and link.expires_at <= (now or _now()))


async def _link_for_file(
    db: AsyncSession,
    item: CollaborationFile,
    user,
    *,
    create: bool,
    lock: bool = False,
) -> CollaborationShareLink | None:
    await collaboration_service.require_file_manager(db, item, user)
    statement = select(CollaborationShareLink).where(CollaborationShareLink.file_id == item.id)
    if lock:
        statement = statement.with_for_update()
    link = await db.scalar(statement)
    if link or not create:
        return link
    now = _now()
    link = CollaborationShareLink(
        file_id=item.id,
        enabled=False,
        access_mode="VIEW",
        expiry_policy="SEVEN_DAYS",
        expires_at=now + timedelta(days=7),
        created_by=user.id,
        updated_by=user.id,
    )
    db.add(link)
    await db.flush()
    return link


def share_link_read(link: CollaborationShareLink) -> CollaborationShareLinkRead:
    return CollaborationShareLinkRead(
        id=link.id,
        file_id=link.file_id,
        enabled=link.enabled,
        access_mode=link.access_mode,
        expiry_policy=link.expiry_policy,
        expires_at=link.expires_at,
        has_password=bool(link.password_hash),
        share_path=SHARE_PATH,
        share_token=share_token(link) if link.enabled else None,
        created_at=link.created_at,
        updated_at=link.updated_at,
    )


async def get_share_link(
    db: AsyncSession, item: CollaborationFile, user
) -> CollaborationShareLinkRead:
    link = await _link_for_file(db, item, user, create=True)
    assert link is not None
    await db.commit()
    await db.refresh(link)
    return share_link_read(link)


async def update_share_link(
    db: AsyncSession,
    item: CollaborationFile,
    payload: CollaborationShareLinkUpdate,
    user,
) -> CollaborationShareLinkRead:
    link = await _link_for_file(db, item, user, create=True, lock=True)
    assert link is not None
    now = _now()
    link.enabled = payload.enabled
    link.access_mode = payload.access_mode
    link.expiry_policy = payload.expiry_policy
    link.expires_at = _expiry_for_policy(payload.expiry_policy, now)
    link.updated_by = user.id
    if payload.password_mode == "SET":
        link.password_hash = await to_thread.run_sync(hash_password, payload.password or "")
        link.failed_attempts = 0
        link.last_failed_at = None
        link.locked_until = None
    elif payload.password_mode == "CLEAR":
        link.password_hash = None
        link.failed_attempts = 0
        link.last_failed_at = None
        link.locked_until = None
    await collaboration_service._audit(
        db,
        item,
        "COLLABORATION_SHARE_LINK_UPDATED",
        user,
        {
            "enabled": link.enabled,
            "access_mode": link.access_mode,
            "file_allow_export": item.allow_export,
            "expiry_policy": link.expiry_policy,
            "has_password": bool(link.password_hash),
        },
    )
    await db.commit()
    await db.refresh(link)
    return share_link_read(link)


async def resolve_active_share(
    db: AsyncSession,
    token: str | None,
    *,
    lock: bool = False,
) -> tuple[CollaborationShareLink, CollaborationFile]:
    link_id, version = _decode_share_token(token)
    statement = select(CollaborationShareLink).where(CollaborationShareLink.id == link_id)
    if lock:
        statement = statement.with_for_update()
    link = await db.scalar(statement)
    if not link or link.token_version != version or not link.enabled:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="共享链接不存在或已失效")
    if _is_expired(link):
        raise HTTPException(status_code=status.HTTP_410_GONE, detail="共享链接已过期")
    item = await db.get(CollaborationFile, link.file_id)
    if not item or item.deleted_at or item.status != "ACTIVE":
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="共享文件不存在或已停止共享")
    return link, item


async def public_metadata(
    db: AsyncSession, token: str | None
) -> CollaborationPublicShareMetadata:
    link, item = await resolve_active_share(db, token)
    return CollaborationPublicShareMetadata(
        file_name=item.title,
        file_type=item.file_type,
        access_mode="edit" if link.access_mode == "EDIT" else "view",
        allow_export=item.allow_export,
        requires_password=bool(link.password_hash),
        expires_at=link.expires_at,
    )


def _grant_token(link: CollaborationShareLink) -> CollaborationShareAccessGrant:
    now = _now()
    expires_at = now + timedelta(seconds=SHARE_ACCESS_TTL_SECONDS)
    if link.expires_at and link.expires_at < expires_at:
        expires_at = link.expires_at
    value = jwt.encode(
        {
            "purpose": _ACCESS_PURPOSE,
            "sub": str(link.id),
            "ver": link.token_version,
            "iat": int(now.timestamp()),
            "exp": int(expires_at.timestamp()),
        },
        _signing_key().hex(),
        algorithm="HS256",
    )
    return CollaborationShareAccessGrant(access_token=value, expires_at=expires_at)


async def verify_share_password(
    db: AsyncSession,
    token: str | None,
    password: str,
) -> CollaborationShareAccessGrant:
    link, _ = await resolve_active_share(db, token, lock=True)
    if not link.password_hash:
        return _grant_token(link)
    now = _now()
    if link.locked_until and link.locked_until > now:
        raise HTTPException(
            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
            detail="密码尝试次数过多，请稍后再试",
        )
    if link.last_failed_at and now - link.last_failed_at > PASSWORD_FAILURE_WINDOW:
        link.failed_attempts = 0
    valid = await to_thread.run_sync(verify_password, password, link.password_hash)
    if not valid:
        link.failed_attempts += 1
        link.last_failed_at = now
        if link.failed_attempts >= PASSWORD_FAILURE_LIMIT:
            link.locked_until = now + PASSWORD_LOCK_DURATION
        await db.commit()
        if link.locked_until:
            raise HTTPException(
                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                detail="密码尝试次数过多，请稍后再试",
            )
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="链接密码不正确")
    link.failed_attempts = 0
    link.last_failed_at = None
    link.locked_until = None
    await db.commit()
    return _grant_token(link)


def validate_access_grant(link: CollaborationShareLink, value: str | None) -> None:
    if not link.password_hash:
        return
    if not value:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="请输入链接密码")
    try:
        payload = jwt.decode(value, _signing_key().hex(), algorithms=["HS256"])
        if (
            payload.get("purpose") != _ACCESS_PURPOSE
            or not hmac.compare_digest(str(payload.get("sub") or ""), str(link.id))
            or payload.get("ver") != link.token_version
        ):
            raise JWTError("share grant mismatch")
    except JWTError as exc:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="链接访问凭证已失效") from exc