442 lines
18 KiB
Python
442 lines
18 KiB
Python
import asyncio
|
||
import binascii
|
||
import logging
|
||
import re
|
||
import uuid
|
||
from asyncio import Task
|
||
from base64 import b64encode
|
||
from datetime import datetime
|
||
from typing import Dict, Type, TypeVar
|
||
|
||
from cryptography.hazmat.backends import default_backend
|
||
from cryptography.hazmat.primitives import padding as symmetric_padding
|
||
from cryptography.hazmat.primitives.asymmetric import padding, rsa
|
||
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
|
||
from httpx import AsyncClient, RequestError
|
||
from httpx._types import HeaderTypes
|
||
|
||
from loveace.config.logger import LoggerMixin
|
||
from loveace.config.manager import config_manager
|
||
from loveace.service.model.service import Service
|
||
from loveace.service.remote.aufe.model.status import (
|
||
ECCheckStatus,
|
||
ECLoginStatus,
|
||
UAAPLoginStatus,
|
||
)
|
||
|
||
# 设置 HTTPX 日志级别为 CRITICAL
|
||
if not config_manager.get_settings().app.debug:
|
||
logging.getLogger("httpx").setLevel(logging.CRITICAL)
|
||
|
||
|
||
class SubClient:
|
||
|
||
async def aclose(self): ...
|
||
|
||
|
||
T_SubClient = TypeVar("T_SubClient", bound=SubClient)
|
||
|
||
|
||
class AUFEConnection:
|
||
userid: str
|
||
ec_password: str
|
||
password: str
|
||
_client: AsyncClient
|
||
twf_id: str
|
||
last_check: datetime
|
||
ec_logged: bool = False
|
||
uaap_logged: bool = False
|
||
trace_id: str
|
||
timeout: int = 30
|
||
_sub_clients: Dict[str, SubClient] = {}
|
||
|
||
def __init__(self, userid: str, ec_password: str, password: str):
|
||
self.userid = userid
|
||
self.ec_password = ec_password
|
||
self.password = password
|
||
self.last_check = datetime.now()
|
||
self.trace_id = str(uuid.uuid4().hex)
|
||
self.timeout = config_manager.get_settings().aufe.default_timeout
|
||
self.logger.info(
|
||
f"创建AUFE连接，用户ID: {self.userid}, Trace ID: {self.trace_id}，超时: {self.timeout}s"
|
||
)
|
||
|
||
@property
|
||
def logger(self) -> LoggerMixin:
|
||
return LoggerMixin(user_id=self.userid, trace_id=self.trace_id)
|
||
|
||
def start_client(self):
|
||
self._client = AsyncClient()
|
||
|
||
def health_checkpoint(self):
|
||
self.last_check = datetime.now()
|
||
|
||
async def health_check(self) -> bool:
|
||
delta = datetime.now() - self.last_check
|
||
self.logger.info(
|
||
f"AUFE连接健康检查，距离上次检查时间: {delta.total_seconds()}秒"
|
||
)
|
||
if delta.total_seconds() > 300: # 5分钟未检查则视为不健康
|
||
self.logger.warning("AUFE连接不健康，已超过5分钟未检查，将自动关闭")
|
||
return False
|
||
if self._client.is_closed:
|
||
self.logger.warning("AUFE连接已关闭")
|
||
return False
|
||
check_uaap = await self.check_uaap_login_status()
|
||
if not check_uaap.logged_in:
|
||
self.logger.warning("UAAP登录状态无效，可能需要重新登录")
|
||
return False
|
||
check_ec = await self.check_ec_login_status()
|
||
if not check_ec.logged_in:
|
||
self.logger.warning("EC登录状态无效，可能需要重新登录")
|
||
return False
|
||
return True
|
||
|
||
def inject_subclient(self, name: str, sub_client: SubClient):
|
||
"""
|
||
注入子客户端
|
||
该方法用于将子客户端的关闭方法绑定到主客户端上
|
||
以便在关闭主客户端时也能关闭子客户端
|
||
Args:
|
||
sub_client (SubClient): 子客户端实例，必须实现 aclose 方法
|
||
"""
|
||
self.logger.info(f"注入子客户端 {name}，类型: {type(sub_client).__name__}")
|
||
self._sub_clients[name] = sub_client
|
||
|
||
def get_subclient(
|
||
self, name: str, type_sub_client: Type[T_SubClient]
|
||
) -> T_SubClient | None:
|
||
"""
|
||
获取已注入的子客户端
|
||
Args:
|
||
name (str): 子客户端名称
|
||
type_sub_client (Type[T_SubClient]): 子客户端类型，用于类型检查
|
||
Returns:
|
||
T_SubClient: 子客户端实例
|
||
Raises:
|
||
ValueError: 如果子客户端不存在或类型不匹配
|
||
"""
|
||
if name not in self._sub_clients:
|
||
return None
|
||
sub_client = self._sub_clients[name]
|
||
if not isinstance(sub_client, type_sub_client):
|
||
return None
|
||
return sub_client
|
||
|
||
async def close_client(self):
|
||
await self._client.aclose()
|
||
for sub_client in self._sub_clients.values():
|
||
self.logger.info(f"正在关闭子客户端 {type(sub_client).__name__}")
|
||
await sub_client.aclose()
|
||
self._sub_clients.clear()
|
||
|
||
async def ec_login(self) -> ECLoginStatus:
|
||
"""
|
||
使用用户名和密码登录AUFE
|
||
"""
|
||
try:
|
||
# 初始请求获取认证参数
|
||
response = await self._client.get(
|
||
f"{config_manager.get_settings().aufe.server_url}/por/login_auth.csp?apiversion=1"
|
||
)
|
||
if twfid_g := re.search(r"<TwfID>(.*)</TwfID>", response.text):
|
||
self.twf_id = twfid_g.group(1)
|
||
else:
|
||
self.logger.error("错误: 响应中未找到TwfID。")
|
||
return ECLoginStatus(fail_not_found_twfid=True)
|
||
self.logger.info(f"Twf Id: {self.twf_id[:5]}******")
|
||
if rsa_key_g := re.search(
|
||
r"<RSA_ENCRYPT_KEY>(.*)</RSA_ENCRYPT_KEY>", response.text
|
||
):
|
||
rsa_key = rsa_key_g.group(1)
|
||
else:
|
||
self.logger.error("错误: 响应中未找到RSA_ENCRYPT_KEY。")
|
||
return ECLoginStatus(fail_not_found_rsa_key=True)
|
||
self.logger.info(f"RSA密钥: {rsa_key[:5]}******")
|
||
if rsa_exp_match := re.search(
|
||
r"<RSA_ENCRYPT_EXP>(.*)</RSA_ENCRYPT_EXP>", response.text
|
||
):
|
||
rsa_exp = rsa_exp_match.group(1)
|
||
else:
|
||
self.logger.error("错误: 响应中未找到RSA_ENCRYPT_EXP。")
|
||
return ECLoginStatus(fail_not_found_rsa_exp=True)
|
||
self.logger.info(f"RSA指数: {rsa_exp[:5]}******")
|
||
if csrf_match := re.search(
|
||
r"<CSRF_RAND_CODE>(.*)</CSRF_RAND_CODE>", response.text
|
||
):
|
||
csrf_code = csrf_match.group(1)
|
||
password_to_encrypt = self.password + "_" + csrf_code
|
||
else:
|
||
self.logger.error("错误: 响应中未找到CSRF_RAND_CODE。")
|
||
return ECLoginStatus(fail_not_found_csrf_code=True)
|
||
self.logger.info(f"CSRF代码: {csrf_code[:5]}******")
|
||
# 创建RSA密钥并加密密码
|
||
rsa_exp_int = int(rsa_exp)
|
||
rsa_modulus = int(rsa_key, 16)
|
||
public_numbers = rsa.RSAPublicNumbers(e=rsa_exp_int, n=rsa_modulus)
|
||
public_key = public_numbers.public_key(default_backend())
|
||
encrypted_password = public_key.encrypt(
|
||
password_to_encrypt.encode("utf-8"), padding.PKCS1v15()
|
||
)
|
||
encrypted_password_hex = binascii.hexlify(encrypted_password).decode(
|
||
"ascii"
|
||
)
|
||
self.logger.info(f"加密后密码: {encrypted_password_hex[:5]}******")
|
||
self.logger.info("开始执行登录请求")
|
||
login_response = await self._client.post(
|
||
f"{config_manager.get_settings().aufe.server_url}/por/login_psw.csp?anti_replay=1&encrypt=1&type=cs",
|
||
data={
|
||
"svpn_rand_code": "",
|
||
"mitm": "",
|
||
"svpn_req_randcode": csrf_code,
|
||
"svpn_name": self.userid,
|
||
"svpn_password": encrypted_password_hex,
|
||
},
|
||
cookies={"TWFID": self.twf_id},
|
||
timeout=10000,
|
||
)
|
||
self.logger.info(f"登录响应: {login_response.text[:10]}******")
|
||
# 检查登录结果
|
||
if "<Result>1</Result>" in login_response.text:
|
||
self.logger.info("登录成功")
|
||
self._client.cookies.set("TWFID", self.twf_id)
|
||
self.ec_logged = True
|
||
return ECLoginStatus(success=True)
|
||
elif "Invalid username or password!" in login_response.text:
|
||
self.logger.error("登录失败: 用户名或密码错误")
|
||
return ECLoginStatus(fail_invalid_credentials=True)
|
||
elif "[CDATA[maybe attacked]]" in login_response.text or "CAPTCHA required" in login_response.text:
|
||
self.logger.error("登录失败: 可能受到攻击或需要验证码")
|
||
return ECLoginStatus(fail_maybe_attacked=True)
|
||
else:
|
||
self.logger.error(f"登录失败: {login_response.text}")
|
||
return ECLoginStatus(fail_unknown_error=True)
|
||
|
||
except RequestError as e:
|
||
self.logger.error(f"登录连接错误: {str(e)}")
|
||
return ECLoginStatus(fail_network_error=True)
|
||
except Exception as e:
|
||
self.logger.error(f"登录失败: {e}")
|
||
return ECLoginStatus(fail_unknown_error=True)
|
||
|
||
async def check_ec_login_status(self) -> ECCheckStatus:
|
||
"""
|
||
检查当前登录状态
|
||
"""
|
||
if not self.ec_logged:
|
||
return ECCheckStatus(logged_in=False)
|
||
try:
|
||
response = await self._client.get(
|
||
config_manager.get_settings().aufe.ec_check_url,
|
||
)
|
||
if response.status_code == 200:
|
||
self.logger.info("登录状态有效")
|
||
return ECCheckStatus(logged_in=True)
|
||
else:
|
||
self.logger.warning("登录状态无效，可能需要重新登录")
|
||
return ECCheckStatus(logged_in=False)
|
||
except RequestError as e:
|
||
self.logger.error(f"检查登录状态连接错误: {str(e)}")
|
||
return ECCheckStatus(fail_network_error=True)
|
||
except Exception as e:
|
||
self.logger.error(f"检查登录状态失败: {e}")
|
||
return ECCheckStatus(fail_unknown_error=True)
|
||
|
||
async def uaap_login(self) -> UAAPLoginStatus:
|
||
"""
|
||
使用用户名和密码登录UAAP
|
||
"""
|
||
try:
|
||
# 初始请求获取登录页面
|
||
response = await self._client.get(
|
||
config_manager.get_settings().aufe.uaap_login_url
|
||
)
|
||
if lt_match := re.search(r'name="lt" value="(.*?)"', response.text):
|
||
lt_value = lt_match.group(1)
|
||
else:
|
||
self.logger.error("错误: 登录页面中未找到lt参数。")
|
||
return UAAPLoginStatus(fail_not_found_lt=True)
|
||
self.logger.info(f"lt参数: {lt_value[:5]}******")
|
||
if execution_match := re.search(
|
||
r'name="execution" value="(.*?)"', response.text
|
||
):
|
||
execution_value = execution_match.group(1)
|
||
else:
|
||
self.logger.error("错误: 登录页面中未找到execution参数。")
|
||
return UAAPLoginStatus(fail_not_found_execution=True)
|
||
self.logger.info(f"execution参数: {execution_value[:5]}******")
|
||
# 处理密钥 - CryptoJS使用的是8字节密钥
|
||
key_bytes = lt_value.encode("utf-8")[:8]
|
||
# 如果密钥不足8字节，则用0填充
|
||
if len(key_bytes) < 8:
|
||
key_bytes = key_bytes + b"\0" * (8 - len(key_bytes))
|
||
|
||
# 处理明文数据 - 确保是字节类型
|
||
password_bytes = self.password.encode("utf-8")
|
||
|
||
# 使用PKCS7填充
|
||
padder = symmetric_padding.PKCS7(64).padder()
|
||
padded_data = padder.update(password_bytes) + padder.finalize()
|
||
|
||
# 创建DES加密器 - ECB模式
|
||
cipher = Cipher(
|
||
algorithms.TripleDES(key_bytes), modes.ECB(), backend=default_backend()
|
||
)
|
||
encryptor = cipher.encryptor()
|
||
|
||
# 加密数据
|
||
encrypted = encryptor.update(padded_data) + encryptor.finalize()
|
||
|
||
# 提交登录表单
|
||
login_response = await self._client.post(
|
||
config_manager.get_settings().aufe.uaap_login_url,
|
||
data={
|
||
"username": self.userid,
|
||
"password": b64encode(encrypted).decode("utf-8"),
|
||
"lt": lt_value,
|
||
"execution": execution_value,
|
||
"_eventId": "submit",
|
||
"submit": "LOGIN",
|
||
},
|
||
timeout=10000,
|
||
)
|
||
# 检查登录结果
|
||
if (
|
||
login_response.status_code == 302
|
||
and "Location" in login_response.headers
|
||
):
|
||
redirect_url = login_response.headers["Location"]
|
||
if redirect_url.startswith(
|
||
config_manager.get_settings().aufe.uaap_check_url
|
||
):
|
||
self.logger.info("UAAP登录成功")
|
||
self.uaap_logged = True
|
||
return UAAPLoginStatus(success=True)
|
||
elif "Invalid username or password" in login_response.text:
|
||
self.logger.error("UAAP登录失败: 用户名或密码错误")
|
||
return UAAPLoginStatus(fail_invalid_credentials=True)
|
||
else:
|
||
self.logger.error(f"UAAP登录失败: {login_response.text}")
|
||
return UAAPLoginStatus(fail_unknown_error=True)
|
||
return UAAPLoginStatus(fail_unknown_error=True)
|
||
|
||
except RequestError as e:
|
||
self.logger.error(f"UAAP登录连接错误: {str(e)}")
|
||
return UAAPLoginStatus(fail_network_error=True)
|
||
except Exception as e:
|
||
self.logger.error(f"UAAP登录失败: {e}")
|
||
return UAAPLoginStatus(fail_unknown_error=True)
|
||
|
||
async def check_uaap_login_status(self) -> ECCheckStatus:
|
||
"""
|
||
检查当前UAAP登录状态
|
||
"""
|
||
return ECCheckStatus(logged_in=self.uaap_logged)
|
||
|
||
@property
|
||
def client(self) -> AsyncClient:
|
||
"""
|
||
获取HTTP客户端实例
|
||
注意: 此客户端只适用于教务系统，其他系统请查看具体 Service 实现
|
||
"""
|
||
self.health_checkpoint()
|
||
return self._client
|
||
|
||
@property
|
||
def empty_client(self, headers: HeaderTypes | None = None) -> AsyncClient:
|
||
"""
|
||
获取一个新的空白HTTP客户端实例，用于子系统构建请求
|
||
"""
|
||
self.health_checkpoint()
|
||
return AsyncClient(headers=headers)
|
||
|
||
|
||
class AUFEService(Service):
|
||
"""
|
||
AUFE服务类
|
||
该类用于管理多个AUFE连接实例，提供获取或创建连接的功能
|
||
并定期清理不健康的连接
|
||
"""
|
||
|
||
sessions: dict[str, AUFEConnection] = {}
|
||
logger: LoggerMixin
|
||
task: Task
|
||
|
||
def __init__(self):
|
||
# AUFEService 的 logger 不需要 trace_id，因为它是服务级别的日志
|
||
self.logger = LoggerMixin(user_id="AUFEService", trace_id="")
|
||
|
||
async def get_or_create_connection(
|
||
self, userid: str, ec_password: str, password: str
|
||
) -> AUFEConnection:
|
||
"""
|
||
获取或创建AUFE连接
|
||
该方法会检查现有连接的健康状态，如果不健康则重新创建连接
|
||
注意，获取实例后请尽快操作登录，否则可能因为连接不健康而需要重新创建
|
||
Args:
|
||
userid (str): 用户ID
|
||
ec_password (str): EC系统密码
|
||
password (str): UAAP密码
|
||
Returns:
|
||
AUFEConnection: AUFE连接实例
|
||
"""
|
||
if userid not in self.sessions:
|
||
self.sessions[userid] = AUFEConnection(
|
||
userid=userid, ec_password=ec_password, password=password
|
||
)
|
||
self.sessions[userid].start_client()
|
||
return self.sessions[userid]
|
||
return self.sessions[userid]
|
||
|
||
async def _loop_cleanup(self):
|
||
"""
|
||
清理不健康的AUFE连接
|
||
"""
|
||
to_remove = []
|
||
for userid, connection in self.sessions.items():
|
||
if not await connection.health_check():
|
||
self.logger.info(f"用户 {userid} 的AUFE连接不健康，正在关闭连接")
|
||
await connection.close_client()
|
||
self.logger.info(f"用户 {userid} 的AUFE连接已关闭，正在移除连接")
|
||
to_remove.append(userid)
|
||
self.logger.info(f"用户 {userid} 的AUFE连接已移除")
|
||
for userid in to_remove:
|
||
del self.sessions[userid]
|
||
|
||
async def loop_cleanup_task(self):
|
||
"""
|
||
定期清理不健康的AUFE连接 ASYNC TASK
|
||
该任务每5分钟运行一次，检查所有连接的健康状态，并清理不健康的连接
|
||
该任务应在应用启动时运行，并在应用关闭时取消
|
||
"""
|
||
while True:
|
||
await asyncio.sleep(60) # 每分钟检查一次
|
||
await self._loop_cleanup()
|
||
|
||
async def initialize(self):
|
||
"""
|
||
初始化AUFE服务
|
||
该方法在应用启动时调用，用于启动清理任务
|
||
"""
|
||
self.logger.info("初始化AUFE服务")
|
||
self.task = asyncio.create_task(self.loop_cleanup_task())
|
||
self.logger.info("AUFE服务初始化完成")
|
||
|
||
async def shutdown(self):
|
||
"""
|
||
关闭AUFE服务
|
||
该方法在应用关闭时调用，用于关闭所有连接
|
||
"""
|
||
self.logger.info("关闭AUFE服务")
|
||
for userid, connection in self.sessions.items():
|
||
self.logger.info(f"正在关闭用户 {userid} 的AUFE连接")
|
||
await connection.close_client()
|
||
self.logger.info(f"用户 {userid} 的AUFE连接已关闭")
|
||
self.sessions.clear()
|
||
self.task.cancel()
|
||
try:
|
||
await self.task
|
||
except asyncio.CancelledError:
|
||
self.logger.info("AUFE服务已关闭")
|
||
pass
|