创建独立用户与账号资源管理

package nexus.io.mosskb.controller;

import nexus.io.annotation.Get;
import nexus.io.annotation.Post;
import nexus.io.annotation.Put;
import nexus.io.annotation.Delete;
import nexus.io.mosskb.service.UserManagementService;
import nexus.io.tio.http.common.HttpRequest;
import com.alibaba.fastjson2.JSON;
import nexus.io.annotation.RequestPath;
import nexus.io.jfinal.aop.Aop;
import nexus.io.mosskb.service.KbUserService;
import nexus.io.model.result.ResultVo;

@RequestPath("/api/user_manage")
public class ApiUserManage {

  @Post("")
  public ResultVo create(HttpRequest request) {
    return Aop.get(UserManagementService.class).create(JSON.parseObject(request.getBodyString()));
  }

  @Put("/{id}")
  public ResultVo update(Long id, HttpRequest request) {
    return Aop.get(UserManagementService.class).update(id, JSON.parseObject(request.getBodyString()));
  }

  @Get("/{pageNo}/{pageSize}")
  public ResultVo page(Integer pageNo, Integer pageSize, String email_or_username) {
    return Aop.get(KbUserService.class).page(pageNo, pageSize, email_or_username);
  }

  @Put("/{id}/re_password")
  public ResultVo resetPassword(Long id, HttpRequest request) {
    return Aop.get(UserManagementService.class).resetPassword(id, JSON.parseObject(request.getBodyString()));
  }

  @Delete("/{id}")
  public ResultVo delete(Long id) {
    return Aop.get(UserManagementService.class).delete(id);
  }
}

package nexus.io.mosskb.controller;

import nexus.io.annotation.Get;
import nexus.io.annotation.RequestPath;
import nexus.io.db.activerecord.Db;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.boot.http.TioRequestContext;

@RequestPath("/api/valid")
public class ApiValidController {

  /** Active-account lookup used by the "create user" entry check. */
  private static final String ACTIVE_ROLE = """
      select role
      from moss_kb_user
      where id = ?
        and deleted = 0
        and is_active = true
      """;

  @Get("/user/{size}")
  public ResultVo users(Integer size) {
    Long userId = TioRequestContext.getUserIdLong();
    String role = Db.queryStr(ACTIVE_ROLE, userId);
    if ("ADMIN".equalsIgnoreCase(role)) {
      return ResultVo.ok(true);
    }
    return ResultVo.fail("仅管理员可以创建用户");
  }
}

package nexus.io.mosskb.service;

import java.util.Date;

import com.alibaba.fastjson2.JSONObject;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.utils.snowflake.SnowflakeIdUtils;

/** Administrator-managed local accounts; never accept roles or ownership from request bodies. */
public class UserManagementService {

  /** User names are 6-20 characters from a restricted set so they stay safe in URLs and exports. */
  private static final String USERNAME_PATTERN = "[A-Za-z0-9_.@-]{6,20}";

  /** Advisory lock key that serializes account creation across JVM instances. */
  private static final long CREATE_LOCK_KEY = 7335647387278176L;

  private static final String COUNT_BY_USERNAME = """
      select count(*)
      from moss_kb_user
      where username = ?
      """;

  private static final String ACCOUNT_BY_ID = """
      select id, role
      from moss_kb_user
      where id = ?
        and deleted = 0
      """;

  private static final String BUMP_TOKEN_VERSION = """
      update moss_kb_user
      set token_version = token_version + 1
      where id = ?
      """;

  private static final String RESET_PASSWORD = """
      update moss_kb_user
      set password = ?,
          token_version = token_version + 1,
          update_time = now()
      where id = ?
        and deleted = 0
      """;

  private static final String LOGICAL_DELETE = """
      update moss_kb_user
      set deleted = 1,
          is_active = false,
          token_version = token_version + 1,
          update_time = now()
      where id <> 1
        and upper(role) <> 'ADMIN'
        and id = ?
        and deleted = 0
      """;

  private static final String TAKE_CREATE_LOCK = """
      select pg_advisory_xact_lock(%d)
      """.formatted(CREATE_LOCK_KEY);

  public ResultVo create(JSONObject input) {
    String username = input.getString("username");
    String password = input.getString("password");
    if (username == null || !username.matches(USERNAME_PATTERN) || password == null || password.length() < 6
        || password.length() > 20) {
      return ResultVo.fail("用户名需为 6～20 位字母、数字或 _ . @ -，密码需为 6～20 位");
    }
    if (Db.queryLong(COUNT_BY_USERNAME, username) > 0) {
      return ResultVo.fail("用户名已存在");
    }
    Row user = Row.by("id", SnowflakeIdUtils.id()).set("username", username).set("password", UserPassword.hash(password))
        .set("role", "USER").set("is_active", true).set("source", "LOCAL").set("deleted", 0);
    for (String field : new String[] {"email", "phone", "nick_name"}) {
      String value = input.getString(field);
      if (value != null && value.length() > 254) {
        return ResultVo.fail("用户资料过长");
      }
      user.set(field, value == null ? "" : value);
    }
    // Serialize account creation across JVM instances to prevent duplicate names without changing existing records.
    boolean[] duplicate = {false};
    Db.tx(() -> {
      Db.query(TAKE_CREATE_LOCK);
      if (Db.queryLong(COUNT_BY_USERNAME, username) > 0) {
        duplicate[0] = true;
      } else {
        Db.save("moss_kb_user", user);
      }
      return true;
    });
    if (duplicate[0]) {
      return ResultVo.fail("用户名已存在");
    }
    return ResultVo.ok(JSONObject.of("id", user.getLong("id").toString(), "username", username, "role", "USER", "is_active", true));
  }
}

  public ResultVo update(Long id, JSONObject input) {
    Row existing = Db.findFirst(ACCOUNT_BY_ID, id);
    if (existing == null) {
      return ResultVo.fail("用户不存在");
    }
    Row update = Row.by("id", id);
    for (String field : new String[] {"email", "phone", "nick_name"}) {
      if (input.containsKey(field)) {
        String value = input.getString(field);
        if (value == null || value.length() > 254) {
          return ResultVo.fail("用户资料无效");
        }
        update.set(field, value);
      }
    }
    boolean activeChanged = input.containsKey("is_active");
    if (activeChanged) {
      if (id == 1L || "ADMIN".equalsIgnoreCase(existing.getStr("role"))) {
        return ResultVo.fail("不能禁用管理员");
      }
      update.set("is_active", input.getBooleanValue("is_active"));
    }
    update.set("update_time", new Date());
    Db.update("moss_kb_user", update);
    if (activeChanged) {
      Db.update(BUMP_TOKEN_VERSION, id);
    }
    return ResultVo.ok();
  }

  public ResultVo resetPassword(Long id, JSONObject input) {
    String password = input.getString("password");
    if (password == null || password.length() < 6 || password.length() > 20 || !password.equals(input.getString("re_password"))) {
      return ResultVo.fail("密码需为 6～20 位，且两次输入一致");
    }
    int updated = Db.update(RESET_PASSWORD, UserPassword.hash(password), id);
    return updated == 1 ? ResultVo.ok() : ResultVo.fail("用户不存在");
  }

  public ResultVo delete(Long id) {
    int updated = Db.update(LOGICAL_DELETE, id);
    return updated == 1 ? ResultVo.ok() : ResultVo.fail("用户不存在或不能删除管理员");
  }

package nexus.io.mosskb.service;

import java.util.List;

import com.jfinal.kit.Kv;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.kit.RowUtils;
import nexus.io.mosskb.vo.ResultPage;
import nexus.io.model.result.ResultVo;

public class KbUserService {

  private static final String PAGE_CONDITION = """
      where deleted = 0
        and (username ilike ? or email ilike ?)
      """;

  private static final String COUNT_USERS = """
      select count(*)
      from moss_kb_user
      """ + PAGE_CONDITION;

  private static final String PAGE_USERS = """
      select id, username, email, phone, is_active, role, nick_name, create_time, update_time, source
      from moss_kb_user
      """ + PAGE_CONDITION + """
      order by create_time desc
      limit ? offset ?
      """;

  public ResultVo page(Integer pageNo, Integer pageSize, String search) {
    int currentPage = Math.max(1, pageNo == null ? 1 : pageNo);
    int currentSize = Math.max(1, Math.min(100, pageSize == null ? 20 : pageSize));
    String term = "%" + (search == null ? "" : search) + "%";
    long total = Db.queryLong(COUNT_USERS, term, term);
    List<Row> rows = Db.find(PAGE_USERS, term, term, currentSize, (long) (currentPage - 1) * currentSize);
    return ResultVo.ok(new ResultPage<Kv>(currentPage, currentSize, (int) total, RowUtils.toKv(rows, false)));
  }
}

package nexus.io.mosskb.service;

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import nexus.io.tio.utils.crypto.Md5Utils;

public final class UserPassword {
  private UserPassword() { }

  public static String hash(String password) {
    byte[] salt = new byte[16];
    new SecureRandom().nextBytes(salt);
    return "pbkdf2$210000$" + Base64.getEncoder().encodeToString(salt) + "$"
        + Base64.getEncoder().encodeToString(derive(password, salt, 210000));
  }

  public static boolean matches(String password, String stored) {
    if (password == null || stored == null) {
      return false;
    }
    try {
      if (!stored.startsWith("pbkdf2$")) {
        return MessageDigest.isEqual(Md5Utils.md5Hex(password).getBytes(java.nio.charset.StandardCharsets.UTF_8), stored.getBytes(java.nio.charset.StandardCharsets.UTF_8));
      }
      String[] parts = stored.split("\\$");
      int rounds = Integer.parseInt(parts[1]);
      if (parts.length != 4 || rounds < 10000 || rounds > 1000000) {
        return false;
      }
      return MessageDigest.isEqual(derive(password, Base64.getDecoder().decode(parts[2]), rounds), Base64.getDecoder().decode(parts[3]));
    } catch (RuntimeException e) {
      return false;
    }
  }

  private static byte[] derive(String password, byte[] salt, int rounds) {
    PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, rounds, 256);
    try {
      return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded();
    } catch (java.security.GeneralSecurityException e) {
      throw new IllegalStateException("Password hashing unavailable", e);
    } finally {
      spec.clearPassword();
    }
  }
}

public ResultVo login(UserLoginReqVo vo) {
  if (vo == null || vo.getUsername() == null || vo.getPassword() == null) {
    return ResultVo.fail("用户名或者密码不正确");
  }
  Row account = Db.findFirst(ACCOUNT_BY_USERNAME, vo.getUsername());
  if (account == null || !UserPassword.matches(vo.getPassword(), account.getStr("password"))) {
    return ResultVo.fail("用户名或者密码不正确");
  }
  Long userId = account.getLong("id");
  String SECRET_KEY = TioAdminEnvUtils.getAdminSecretKey();
  String token = JwtUtils.createToken(SECRET_KEY, java.util.Map.of("userId", userId, "exp", System.currentTimeMillis() / 1000 + 3600, "token_version", account.getLong("token_version")));
  TokenManager.login(userId, token);
  return ResultVo.ok("成功", token);
}

package nexus.io.mosskb.inteceptor;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.jfinal.aop.Aop;
import nexus.io.mosskb.service.MossKbAuthService;
import nexus.io.mosskb.service.kb.ApplicationAccess;
import nexus.io.mosskb.service.kb.DatasetAccess;
import nexus.io.mosskb.service.kb.ModelAccess;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.http.common.HttpResponse;
import nexus.io.tio.http.common.HttpResponseStatus;
import nexus.io.tio.http.common.RequestLine;
import nexus.io.tio.http.server.intf.HttpRequestInterceptor;
import nexus.io.tio.utils.jwt.JwtUtils;

public class MossKbAuthInterceptor implements HttpRequestInterceptor {

  /** Administrator-only prefixes: account management, mail settings and team management. */
  private static final String[] ADMIN_ONLY_PREFIXES = {"/api/user_manage", "/api/email_setting", "/api/team"};

  private static final Pattern RESOURCE_PATH = Pattern.compile("^/api/(dataset|application|model)/(\\d+)(/.*)?$");

  /** Nested ids that must belong to the same dataset as the path. */
  private static final String[] NESTED_TYPES = {"document", "paragraph", "problem"};

  private static final String ACCOUNT_STATE = """
      select role, is_active, deleted, token_version
      from moss_kb_user
      where id = ?
      """;

  public HttpResponse doBeforeHandler(HttpRequest request, RequestLine requestLine, HttpResponse responseFromCache) {
    String authorization = request.getHeader("authorization");

    MossKbAuthService authService = Aop.get(MossKbAuthService.class);
    Long userId = authService.getIdByToken(authorization);

    if (userId == null) {
      HttpResponse response = TioRequestContext.getResponse();
      response.setStatus(HttpResponseStatus.C401);
      return response;
    }

    Row account = Db.findFirst(ACCOUNT_STATE, userId);
    boolean member = account != null;
    if (member && (!Boolean.TRUE.equals(account.getBoolean("is_active")) || account.getInt("deleted") != 0)) {
      return deny(HttpResponseStatus.C401);
    }
    if (member) {
      String rawToken = authorization.replaceFirst("(?i)^Bearer\\s+", "");
      Object revision = JwtUtils.getPayload(rawToken).get("token_version");
      long tokenVersion = revision == null ? 0 : Long.parseLong(revision.toString());
      if (tokenVersion != account.getLong("token_version")) {
        return deny(HttpResponseStatus.C401);
      }
    }

    String path = requestLine.getPath();
    if (requiresAdministrator(path) && (!member || !"ADMIN".equalsIgnoreCase(account.getStr("role")))) {
      return deny(HttpResponseStatus.C403);
    }
    if (!member && !isPublicPath(path)) {
      return deny(HttpResponseStatus.C403);
    }
    if (member && userId != 1L && !ownsRequestedResource(userId, path)) {
      return deny(HttpResponseStatus.C403);
    }

    TioRequestContext.setUserId(userId);
    return null;
  }
}

  /** Checks ownership of /api/{dataset|application|model}/{id} and of nested document, paragraph and problem ids. */
  private boolean ownsRequestedResource(Long userId, String path) {
    Matcher resource = RESOURCE_PATH.matcher(path);
    if (!resource.matches()) {
      return true;
    }
    String type = resource.group(1);
    String suffix = resource.group(3);
    Long id = Long.valueOf(resource.group(2));
    boolean page = !"model".equals(type) && suffix != null && suffix.matches("/\\d+");
    boolean chat = "application".equals(type) && suffix != null && suffix.startsWith("/chat/");
    boolean owns = page || chat || ("dataset".equals(type) ? DatasetAccess.owns(userId, id)
        : "application".equals(type) ? ApplicationAccess.owns(userId, id) : ModelAccess.owns(userId, id));
    if (!owns || !"dataset".equals(type) || suffix == null) {
      return owns;
    }
    return nestedIdsBelongToDataset(id, suffix);
  }

  private boolean nestedIdsBelongToDataset(Long datasetId, String suffix) {
    for (String child : NESTED_TYPES) {
      Matcher childId = Pattern.compile("/" + child + "/(\\d+)(?=/[a-z_]|$)").matcher(suffix);
      if (childId.find() && countChild(child, Long.valueOf(childId.group(1)), datasetId) == 0) {
        return false;
      }
    }
    return true;
  }

  private long countChild(String child, Long childId, Long datasetId) {
    String sql = switch (child) {
      case "document" -> COUNT_DOCUMENT;
      case "paragraph" -> COUNT_PARAGRAPH;
      default -> COUNT_PROBLEM;
    };
    return Db.queryLong(sql, childId, datasetId);
  }

  private static final String COUNT_DOCUMENT = """
      select count(*)
      from moss_kb_document
      where id = ?
        and dataset_id = ?
      """;

  private static final String COUNT_PARAGRAPH = """
      select count(*)
      from moss_kb_paragraph
      where id = ?
        and dataset_id = ?
      """;

  private static final String COUNT_PROBLEM = """
      select count(*)
      from moss_kb_problem
      where id = ?
        and dataset_id = ?
      """;