479 lines
15 KiB
Python
479 lines
15 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""Account query and pick CLI commands."""
|
||
import json
|
||
import uuid
|
||
from typing import Optional
|
||
|
||
from db.accounts_repo import (
|
||
acquire_lease,
|
||
find_account_ids,
|
||
find_accounts,
|
||
find_credentials,
|
||
get_account_by_id,
|
||
get_active_lease_by_token,
|
||
update_account_last_used,
|
||
)
|
||
from db.connection import get_conn, init_db
|
||
from db.credentials_repo import (
|
||
CredentialNotEncryptedError,
|
||
list_credentials_by_account,
|
||
read_credential_plaintext,
|
||
)
|
||
from service._svc_common import (
|
||
PlatformCallerMeta,
|
||
_err_json,
|
||
_resolve_or_auto_register,
|
||
_resolve_or_fail,
|
||
_say,
|
||
_say_err,
|
||
)
|
||
from service.crypto import CredentialDecryptError
|
||
from service.master_key import MasterKeyMissingError
|
||
from util.logging_config import get_skill_logger
|
||
from util.platforms import seed_platforms
|
||
from util.runtime_paths import _runtime_paths_debug_text
|
||
|
||
|
||
def cmd_account_get(account_id, include_credentials: bool = False) -> None:
|
||
"""Get a single account by id. Returns JSON."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=account_get id=%r", account_id)
|
||
init_db()
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
log.warning("account_get_not_found id=%r", account_id)
|
||
_say(f"ERROR:ACCOUNT_NOT_FOUND 账号 id={account_id} 不存在。")
|
||
_say_err(_runtime_paths_debug_text())
|
||
return
|
||
if include_credentials:
|
||
creds = find_credentials(
|
||
platform_key=acc["platform_key"],
|
||
limit=20,
|
||
)
|
||
linked_creds = [c for c in creds if c["account_id"] == acc["id"]]
|
||
if not linked_creds:
|
||
linked_creds = [c for c in creds if c["account_id"] is None]
|
||
acc["credentials"] = [
|
||
{
|
||
"id": c["id"],
|
||
"credential_label": c["credential_label"],
|
||
"credential_type": c["credential_type"],
|
||
"secret_storage": c["secret_storage"],
|
||
"secret_ref": c["secret_ref"],
|
||
"secret_mask": c["secret_mask"],
|
||
"status": c["status"],
|
||
}
|
||
for c in linked_creds
|
||
]
|
||
_say(json.dumps(acc, ensure_ascii=False))
|
||
|
||
|
||
def cmd_account_get_credential(
|
||
account_id: int,
|
||
*,
|
||
reveal: bool = False,
|
||
lease_token: Optional[str] = None,
|
||
) -> None:
|
||
"""account get-credential — metadata or plaintext when lease proves access."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=account_get_credential id=%s reveal=%s", account_id, reveal)
|
||
|
||
init_db()
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
log.warning("account_get_credential_not_found id=%s", account_id)
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", f"账号 id={account_id} 不存在。"))
|
||
return
|
||
|
||
conn = get_conn()
|
||
try:
|
||
creds_all = list_credentials_by_account(conn, account_id)
|
||
creds = [c for c in creds_all if (c.get("status") or "").strip().lower() == "active"]
|
||
if not creds:
|
||
_say(_err_json(
|
||
"ERR_CREDENTIAL_MISSING",
|
||
f"账号 id={account_id} 没有活跃凭据。",
|
||
))
|
||
return
|
||
cred = creds[0]
|
||
|
||
base_out = {
|
||
"success": True,
|
||
"account_id": account_id,
|
||
"credential_id": cred["id"],
|
||
"credential_type": cred["credential_type"],
|
||
"secret_storage": cred["secret_storage"],
|
||
"secret_mask": cred["secret_mask"],
|
||
}
|
||
|
||
if not reveal:
|
||
_say(json.dumps(base_out, ensure_ascii=False))
|
||
return
|
||
|
||
tok = (lease_token or "").strip()
|
||
if not tok:
|
||
log.warning("account_get_credential_reveal_missing_token id=%s", account_id)
|
||
_say(_err_json(
|
||
"ERR_LEASE_INVALID",
|
||
"reveal 必须带 --lease-token。",
|
||
))
|
||
return
|
||
|
||
lease = get_active_lease_by_token(conn, tok)
|
||
lease_prefix = tok[:8]
|
||
if lease is None:
|
||
log.warning(
|
||
"account_get_credential_reveal_bad_lease id=%s lease_prefix=%s",
|
||
account_id,
|
||
lease_prefix,
|
||
)
|
||
_say(_err_json(
|
||
"ERR_LEASE_INVALID",
|
||
"lease token 无效或已过期",
|
||
))
|
||
return
|
||
|
||
if int(lease["account_id"]) != int(account_id):
|
||
log.warning(
|
||
"account_get_credential_reveal_lease_mismatch id=%s lease_account=%s lease_prefix=%s",
|
||
account_id,
|
||
lease["account_id"],
|
||
lease_prefix,
|
||
)
|
||
_say(_err_json(
|
||
"ERR_LEASE_INVALID",
|
||
"lease token 不属于该 account",
|
||
))
|
||
return
|
||
|
||
try:
|
||
pt = read_credential_plaintext(conn, int(cred["id"]))
|
||
except MasterKeyMissingError as e:
|
||
log.warning("account_get_credential_master_missing id=%s", account_id)
|
||
_say(_err_json("ERR_MASTER_KEY_MISSING", str(e)))
|
||
return
|
||
except CredentialDecryptError as e:
|
||
log.warning(
|
||
"account_get_credential_decrypt_failed id=%s cred_id=%s lease_prefix=%s",
|
||
account_id,
|
||
cred["id"],
|
||
lease_prefix,
|
||
)
|
||
_say(_err_json("ERR_CREDENTIAL_DECRYPT_FAILED", str(e)))
|
||
return
|
||
except CredentialNotEncryptedError:
|
||
out = {**base_out, "plaintext": None, "note": "credential storage=none, no plaintext to reveal"}
|
||
log.info(
|
||
"account_get_credential_reveal_note_plain id=%s cred_id=%s lease_prefix=%s",
|
||
account_id,
|
||
cred["id"],
|
||
lease_prefix,
|
||
)
|
||
_say(json.dumps(out, ensure_ascii=False))
|
||
return
|
||
|
||
log.info(
|
||
"account_get_credential_reveal_success account_id=%s cred_id=%s lease_prefix=%s",
|
||
account_id,
|
||
cred["id"],
|
||
lease_prefix,
|
||
)
|
||
_say(json.dumps({**base_out, "plaintext": pt}, ensure_ascii=False))
|
||
finally:
|
||
conn.close()
|
||
|
||
|
||
def cmd_get(account_id) -> None:
|
||
"""Legacy: get <id> — same as account get <id>."""
|
||
cmd_account_get(account_id, include_credentials=False)
|
||
|
||
|
||
def cmd_account_list(
|
||
platform_input: Optional[str] = None,
|
||
environment: Optional[str] = None,
|
||
tenant_id: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
login_id: Optional[str] = None,
|
||
label: Optional[str] = None,
|
||
limit: int = 200,
|
||
) -> None:
|
||
"""account list — output JSON array of accounts matching filters."""
|
||
log = get_skill_logger()
|
||
log.info(
|
||
"cli_start subcommand=account_list platform=%s env=%s tenant=%s role=%s login_id=%s label=%s",
|
||
platform_input,
|
||
environment,
|
||
tenant_id,
|
||
role,
|
||
login_id,
|
||
label,
|
||
)
|
||
init_db()
|
||
key = None
|
||
if platform_input and platform_input not in ("all", "全部", ""):
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
accounts = find_accounts(
|
||
platform_key=key,
|
||
environment=environment,
|
||
tenant_id=tenant_id,
|
||
role=role,
|
||
login_id=login_id,
|
||
label=label,
|
||
limit=limit,
|
||
)
|
||
_say(json.dumps(accounts, ensure_ascii=False))
|
||
|
||
|
||
def cmd_account_resolve(
|
||
*,
|
||
account_id: Optional[str] = None,
|
||
platform_input: Optional[str] = None,
|
||
login_id: Optional[str] = None,
|
||
label: Optional[str] = None,
|
||
query: Optional[str] = None,
|
||
) -> None:
|
||
"""Resolve one account by id, login_id, label, or free-form query.
|
||
|
||
Success: same JSON shape as ``account get``.
|
||
Errors: ACCOUNT_NOT_FOUND / NO_ACCOUNT / AMBIGUOUS_ACCOUNT / CLI_BAD_ARGS.
|
||
"""
|
||
log = get_skill_logger()
|
||
init_db()
|
||
|
||
aid_raw = (account_id or "").strip()
|
||
q = (query or "").strip()
|
||
lid = (login_id or "").strip()
|
||
lab = (label or "").strip()
|
||
|
||
# Free-form: digits → id; otherwise treat as login_id (then label fallback).
|
||
if q and not aid_raw and not lid and not lab:
|
||
if q.isdigit():
|
||
aid_raw = q
|
||
else:
|
||
lid = q
|
||
|
||
if aid_raw:
|
||
try:
|
||
aid = int(aid_raw)
|
||
except (TypeError, ValueError):
|
||
_say(_err_json("ERROR:CLI_BAD_ARGS", f"账号 id 必须是整数：{aid_raw}"))
|
||
return
|
||
acc = get_account_by_id(aid)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", f"账号 id={aid} 不存在。"))
|
||
return
|
||
log.info("account_resolve_by_id id=%s", aid)
|
||
_say(json.dumps(acc, ensure_ascii=False))
|
||
return
|
||
|
||
if not lid and not lab:
|
||
_say(_err_json(
|
||
"ERROR:CLI_BAD_ARGS",
|
||
"account resolve 需要 --id、<数字 query>、--login-id 或 --label（也可用 --query 用户名/手机号）。",
|
||
))
|
||
return
|
||
|
||
key = None
|
||
if platform_input and platform_input not in ("all", "全部", ""):
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
elif not platform_input:
|
||
# login_id/label without platform: search all platforms
|
||
key = None
|
||
|
||
matches = find_accounts(
|
||
platform_key=key,
|
||
login_id=lid or None,
|
||
label=lab or None,
|
||
status="active",
|
||
limit=20,
|
||
)
|
||
|
||
# If query was used as login_id and miss, retry as label.
|
||
if not matches and q and not login_id and not label and not q.isdigit():
|
||
matches = find_accounts(
|
||
platform_key=key,
|
||
label=q,
|
||
status="active",
|
||
limit=20,
|
||
)
|
||
|
||
if not matches:
|
||
ref = lid or lab or q
|
||
_say(_err_json(
|
||
"ERROR:NO_ACCOUNT",
|
||
f"未找到匹配的账号（ref={ref!r}"
|
||
+ (f", platform={key}" if key else "")
|
||
+ "）。",
|
||
))
|
||
return
|
||
if len(matches) > 1:
|
||
ids = [m.get("id") for m in matches[:10]]
|
||
_say(_err_json(
|
||
"ERROR:AMBIGUOUS_ACCOUNT",
|
||
f"匹配到多条账号，请改用 --id 或补充 --platform。候选 id={ids}",
|
||
))
|
||
return
|
||
|
||
acc = matches[0]
|
||
log.info(
|
||
"account_resolve_ok id=%s login_id=%s label=%s",
|
||
acc.get("id"),
|
||
acc.get("login_id"),
|
||
acc.get("account_label"),
|
||
)
|
||
_say(json.dumps(acc, ensure_ascii=False))
|
||
|
||
|
||
def cmd_list_json(platform_input: str, limit: int = 200) -> None:
|
||
"""Legacy: list-json <platform|all> [--limit N]"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=list_json filter=%r limit=%s", platform_input, limit)
|
||
init_db()
|
||
raw = (platform_input or "all").strip()
|
||
if not raw or raw.lower() == "all" or raw == "全部":
|
||
key = None
|
||
else:
|
||
key = _resolve_or_fail(raw)
|
||
if not key:
|
||
return
|
||
lim = max(1, min(int(limit), 500))
|
||
accounts = find_accounts(platform_key=key, limit=lim)
|
||
_say(json.dumps(accounts, ensure_ascii=False))
|
||
|
||
|
||
def cmd_account_pick_web(
|
||
platform_input: str,
|
||
environment: Optional[str] = None,
|
||
tenant_id: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
login_id: Optional[str] = None,
|
||
label: Optional[str] = None,
|
||
do_lease: bool = False,
|
||
ttl_sec: int = 900,
|
||
holder: Optional[str] = None,
|
||
purpose: Optional[str] = None,
|
||
platform_meta: Optional[PlatformCallerMeta] = None,
|
||
) -> None:
|
||
"""Pick a web/RPA account for use. Optionally acquire a lease."""
|
||
log = get_skill_logger()
|
||
log.info(
|
||
"account_pick_web_attempt platform=%s env=%s tenant=%s role=%s login_id=%s label=%s lease=%s",
|
||
platform_input,
|
||
environment,
|
||
tenant_id,
|
||
role,
|
||
login_id,
|
||
label,
|
||
do_lease,
|
||
)
|
||
|
||
key = _resolve_or_auto_register(platform_input, platform_meta)
|
||
if not key:
|
||
return
|
||
|
||
init_db()
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
finally:
|
||
conn.close()
|
||
|
||
lid = (login_id or "").strip() or None
|
||
lab = (label or "").strip() or None
|
||
|
||
# Human-ref filters should be unique; ambiguous active matches → explicit error.
|
||
if lid or lab:
|
||
active_matches = find_accounts(
|
||
platform_key=key,
|
||
environment=environment,
|
||
tenant_id=tenant_id,
|
||
role=role,
|
||
status="active",
|
||
login_id=lid,
|
||
label=lab,
|
||
limit=20,
|
||
)
|
||
if len(active_matches) > 1:
|
||
ids = [m.get("id") for m in active_matches[:10]]
|
||
_say(_err_json(
|
||
"ERROR:AMBIGUOUS_ACCOUNT",
|
||
f"login_id/label 匹配到多条账号，请改用 account get <id>。候选 id={ids}",
|
||
))
|
||
return
|
||
|
||
candidate_ids = find_account_ids(
|
||
platform_key=key,
|
||
environment=environment,
|
||
tenant_id=tenant_id,
|
||
role=role,
|
||
login_id=lid,
|
||
label=lab,
|
||
)
|
||
if not candidate_ids:
|
||
hint = ""
|
||
if lid or lab:
|
||
hint = f"（login_id={lid!r} label={lab!r}）"
|
||
_say(_err_json(
|
||
"ERROR:NO_ACCOUNT",
|
||
f"没有符合条件的可用账号{hint}（status=active 且未被其他 lease 占用）。",
|
||
))
|
||
return
|
||
|
||
picked_id = candidate_ids[0]
|
||
acc = get_account_by_id(picked_id)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", "选中的账号突然不存在了。"))
|
||
return
|
||
|
||
update_account_last_used(picked_id)
|
||
|
||
result = {
|
||
"id": acc["id"],
|
||
"platform_key": acc["platform_key"],
|
||
"account_label": acc["account_label"],
|
||
"login_id": acc["login_id"],
|
||
"profile_dir": acc["profile_dir"],
|
||
"url": acc["url"],
|
||
"tenant_id": acc["tenant_id"],
|
||
"environment": acc["environment"],
|
||
"role": acc["role"],
|
||
"provider_code": acc["provider_code"],
|
||
"session_status": acc["session_status"],
|
||
"auth_strategy": acc["auth_strategy"],
|
||
"session_persistent": acc["session_persistent"],
|
||
"device_fingerprint": acc.get("device_fingerprint"),
|
||
}
|
||
|
||
lease_info = None
|
||
if do_lease:
|
||
lease_token = uuid.uuid4().hex[:32]
|
||
resolved_holder = holder or "unknown"
|
||
try:
|
||
lease_info = acquire_lease(
|
||
account_id=picked_id,
|
||
lease_token=lease_token,
|
||
holder=resolved_holder,
|
||
purpose=purpose,
|
||
ttl_sec=ttl_sec,
|
||
)
|
||
result["lease_token"] = lease_info["lease_token"]
|
||
result["lease_expires_at"] = lease_info["expires_at"]
|
||
except ValueError as e:
|
||
log.warning("account_pick_web_lease_conflict id=%s", picked_id)
|
||
_say(_err_json("ERROR:LEASE_CONFLICT", str(e)))
|
||
return
|
||
|
||
log.info("account_pick_web_success id=%s token_prefix=%s",
|
||
picked_id, lease_info["lease_token"][:8] if lease_info else "none")
|
||
_say(json.dumps(result, ensure_ascii=False))
|
||
|
||
|
||
def cmd_pick_web(platform_input: str) -> None:
|
||
"""Legacy: pick-web <platform> — same as account pick-web without lease."""
|
||
cmd_account_pick_web(platform_input, do_lease=False)
|