yml2213
00125fbfc4
S1 加好了列，本提交把**读与写一起切**过去。这是设计里「同一份数据的读与写必须
在同一个提交里切」的要求：先切读或先切写都会出现「写账号、读记录」的中间态，
跑起来不报错，只是默默用错数据。
## 核心改动
**判定「谁有 CK」不再借道登录记录**
- `cookie_holding_filter()` / `cookie_operable_filter()` / `cookie_holding_account_ids_query()`
/ `visible_douyu_task_accounts()` 全部改为作用于 `Account`；
- `cookie_operable_filter()` 的「在途排除」仍查 `login_tasks`（那是**某次尝试**的属性），
用 `NOT EXISTS` 子查询 + 迁移 0042 新增的 `(account_id, attempt_status)` 索引；
- 删除死代码 `latest_cookie_login_task()`；`latest_cookie()` 改为直接读账号。
**CK 写入**
- `_write_login_success()` 写 `Account.cookie / cookie_updated_at / cookie_source`；
- `_mark_attempt_failed()` 改看**账号**有没有 CK（决定是否沿用旧的失败语义）；
- 检测模式的 `task.cookie = ""` **不再清空账号的 CK**（见下「行为变更」）。
**自动化作业按账号调度**
- `ck_health`：`_select_tasks` → `_select_accounts`，`db.query(Account)`；新增
`count_remaining()`（刻意不带 LIMIT，否则积压数恒等于批次上限）；
- `ck_relogin`：同样按账号选行；结算改为「账号 + 本轮尝试记录」，
退避进度写账号；`settle_fresh_results(batch_id)` 按 `attempt_batch_id` 配对，
`run_ck_relogin` 把 **account_ids** 交给 runner；
- 顺带让**没有任何登录历史的账号**也能被巡检/重登（以前它们永远进不了队列）。
**登录批次**
- `LoginBatchRunner` 去掉 `relogin_task_ids`，重登与登录统一走 `account_ids`；
- 批次行复用逻辑重写：只保证「同一账号不并发两行」，不再关心「哪一行持有 CK」。
失败行复用同时看 `attempt_status`（账号有 CK 时 `_mark_attempt_failed` 刻意不动
`status`，只看 status 会永远命不中 → 每次失败刷一行）。
**删除护栏语义变更（用户可感知）**
- 去掉「持有 CK 的记录不可删」——CK 在账号上，删历史不再影响登录态，历史终于可清理；
- **保留**「在途尝试不可删」（批次线程正拿着那条记录）。
## 行为变更（需评审）
1. **账号检测不再清空 CK**。旧代码在 check 模式写 `task.cookie = ""`，而那时记录的
cookie 就是账号唯一凭证 —— 一次「批量检测」会把账号登录态删掉。解耦后
「检测账号凭据」与「CK 是否有效」本就是两件事（后者归 `ck_health` 判），
继续清空等于凭空制造不可逆的数据丢失（重登当前成功率极低）。
2. **Cookie 页的记录单位从「登录记录」变成「账号」**，所有接口的 id 入参/出参
变成 `account_id`；`DELETE /cookies/{id}` 清的是该账号的 CK，**必写审计**。
3. 重复检测从「同一账号多行持 CK」改为「**同一个 CK 出现在多个账号上**」——
后者才是真风险（两个账号共用一个登录态）。用 sha256 指纹分组：
CK 是 AES-GCM + 随机 nonce 加密，**同一明文每次密文都不同**，比密文永远比不出重复。
## 修掉一个真实并发缺陷
`_write_login_success` 原先被传入 `self.db`（runner 主会话），而它是在**工作线程**里
用 `worker_db` 执行的。`emit()` 会往 `account_events` 插一行，其 `account_id` 外键对
`accounts` 那一行加**共享锁**；这把锁加在另一个会话上，紧接着本会话的
`UPDATE accounts SET cookie=...` 就被自己人挡住 —— 实测 **50 秒后
`Lock wait timeout exceeded`，登录明明成功却写不回 CK**（改造前 UPDATE 打在
`login_tasks` 上所以没撞上）。改为传 `worker_db`：事件本就该和状态变更同事务提交，
顺带修掉跨线程共用一个 Session 的隐患。
## 验证
- 全量 pytest **368 passed / 6 skipped**；迁移链 3 passed；
- 前端 `tsc -b && vite build` 通过；
- `ruff check` / `ruff format --check` 全绿（顺带修掉 main 上遗留的 F821）；
- 新增/改写的关键回归：**删掉全部登录历史后账号的 CK 与健康状态仍在**、
**无登录历史的账号也能进巡检队列**、结算不碰 CK、删除护栏改为在途语义。
仍未做（设计里排期的后续阶段）：`account_lifecycle` 状态收口（S3）、事件发射点补齐（S4）、
业务事实直发事件（S5）、账号页重构（S6）。注意 `status` 目前只有模型默认值与迁移回填，
所以 `disabled/archived` 还没有任何写入方——S3 落地时要把自动化选行的状态过滤一起补上。
348 lines
12 KiB
Python
348 lines
12 KiB
Python
"""CK 操作页的权限隔离、脱敏与重登入口。
|
|
|
|
2026-10-04 CK 解耦后本页面的**记录单位从「登录记录」变成「账号」**：
|
|
CK 与健康/重登进度都挂在 `accounts` 上，所有接口的 id 都是 account_id。
|
|
"""
|
|
|
|
from types import SimpleNamespace
|
|
from typing import cast
|
|
from unittest.mock import patch
|
|
|
|
import pytest
|
|
|
|
from tests.support.db import get_test_engine, make_test_session
|
|
from web.backend.models import Account, LoginTask, ProxyConfig, User
|
|
from web.backend.routers.cookies import (
|
|
check_cookie_operations,
|
|
get_cookie,
|
|
list_cookie_operation_tags,
|
|
list_cookie_operations,
|
|
list_cookies,
|
|
relogin_invalid_cookie_operations,
|
|
)
|
|
from web.backend.services.cookie_check_service import check_douyu_cookie
|
|
from web.backend.services.login_service import (
|
|
LoginBatchRunner,
|
|
cleanup_orphan_login_tasks,
|
|
cleanup_orphan_relogin_tasks,
|
|
)
|
|
|
|
|
|
class TestCookieOperation:
|
|
def setup_method(self):
|
|
self.engine = get_test_engine()
|
|
self.session = make_test_session(self.engine)
|
|
|
|
self.support = User(username="support", password_hash="hash", role="support")
|
|
self.other_support = User(
|
|
username="other", password_hash="hash", role="support"
|
|
)
|
|
self.session.add_all([self.support, self.other_support])
|
|
self.session.commit()
|
|
|
|
# CK 挂在账号上（2026-10-04 CK 解耦），所以「CK 记录」就是账号本身。
|
|
self.owned_account = Account(
|
|
username="owned-account",
|
|
password="owned-password",
|
|
email="owned@example.com",
|
|
email_password="mail-password",
|
|
assigned_to=self.support.id,
|
|
cookie="owned-secret",
|
|
)
|
|
self.other_account = Account(
|
|
username="other-account",
|
|
password="other-password",
|
|
email="other@example.com",
|
|
email_password="mail-password",
|
|
assigned_to=self.other_support.id,
|
|
cookie="other-secret",
|
|
)
|
|
self.session.add_all([self.owned_account, self.other_account])
|
|
self.session.commit()
|
|
|
|
def teardown_method(self):
|
|
self.session.close()
|
|
|
|
def test_support_operation_list_is_scoped_and_never_returns_credentials(self):
|
|
result = list_cookie_operations(
|
|
search="",
|
|
tag="",
|
|
page=1,
|
|
page_size=20,
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert result["total"] == 1
|
|
assert result["items"] == [
|
|
{
|
|
"id": self.owned_account.id,
|
|
"account_username": "owned-account",
|
|
"tag": "",
|
|
"ck_check_status": "",
|
|
"ck_checked_at": None,
|
|
"created_at": None,
|
|
"relogin_status": "",
|
|
"relogin_message": "",
|
|
"relogin_batch_id": "",
|
|
}
|
|
]
|
|
assert "owned-secret" not in str(result)
|
|
assert "owned-password" not in str(result)
|
|
|
|
def test_support_cannot_use_cookie_management_endpoints(self):
|
|
with pytest.raises(Exception, match="cookie:view"):
|
|
list_cookies(db=self.session, current=self.support)
|
|
with pytest.raises(Exception, match="cookie:view"):
|
|
get_cookie(self.owned_account.id, db=self.session, current=self.support)
|
|
|
|
def test_cookie_list_filters_by_account_tag(self):
|
|
admin = User(username="admin", password_hash="hash", role="super_admin")
|
|
self.session.add(admin)
|
|
self.owned_account.tag = "A组"
|
|
self.other_account.tag = "B组"
|
|
self.session.commit()
|
|
|
|
result = list_cookies(
|
|
search="",
|
|
tag="A组",
|
|
account_names="",
|
|
page=1,
|
|
page_size=20,
|
|
include_cookie=False,
|
|
db=self.session,
|
|
current=admin,
|
|
)
|
|
|
|
assert isinstance(result, dict)
|
|
assert result["total"] == 1
|
|
assert [item["id"] for item in result["items"]] == [self.owned_account.id]
|
|
|
|
def test_support_operation_tag_filter_and_list_stay_scoped(self):
|
|
self.owned_account.tag = "我的标签"
|
|
self.other_account.tag = "别人的标签"
|
|
self.session.commit()
|
|
|
|
tags = list_cookie_operation_tags(db=self.session, current=self.support)
|
|
result = list_cookie_operations(
|
|
search="",
|
|
tag="别人的标签",
|
|
page=1,
|
|
page_size=20,
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert tags == ["我的标签"]
|
|
assert result["total"] == 0
|
|
|
|
@patch("web.backend.routers.cookies._check_one_cookie")
|
|
def test_support_can_check_only_assigned_cookie(self, check_one_cookie):
|
|
check_one_cookie.return_value = {
|
|
"id": self.owned_account.id,
|
|
"valid": True,
|
|
"message": "有效",
|
|
"fish_ball": 9,
|
|
"nickname": "tester",
|
|
"level": 1,
|
|
"checked_at": "2026-01-01T00:00:00+00:00",
|
|
}
|
|
|
|
result = check_cookie_operations(
|
|
ids=f"{self.owned_account.id},{self.other_account.id}",
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert [item["id"] for item in result["results"]] == [self.owned_account.id]
|
|
self.session.refresh(self.owned_account)
|
|
self.session.refresh(self.other_account)
|
|
# 检测结论写在账号上，且只写了被授权的那一个
|
|
assert self.owned_account.ck_check_status == "valid"
|
|
assert self.other_account.ck_check_status == ""
|
|
|
|
def test_operation_permission_does_not_allow_unrelated_users(self):
|
|
no_permission_user = SimpleNamespace(
|
|
id=999,
|
|
username="no-permission",
|
|
role="support",
|
|
custom_permissions=[],
|
|
)
|
|
with pytest.raises(Exception, match="cookie:operate"):
|
|
list_cookie_operations(
|
|
search="",
|
|
tag="",
|
|
page=1,
|
|
page_size=20,
|
|
db=self.session,
|
|
current=cast(User, no_permission_user),
|
|
)
|
|
|
|
def test_relogin_failed_account_stays_visible_and_can_be_checked(self):
|
|
# 重登进度就写在账号上：判失效 + 有待重试时间 = 排队中
|
|
self.owned_account.ck_check_status = "invalid"
|
|
self.owned_account.relogin_last_error = "重新登录失败: 密码错误"
|
|
self.session.commit()
|
|
|
|
result = list_cookie_operations(
|
|
search="",
|
|
tag="",
|
|
page=1,
|
|
page_size=20,
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert result["total"] == 1
|
|
assert result["items"][0]["relogin_status"] == "relogin_failed"
|
|
assert "重新登录失败" in result["items"][0]["relogin_message"]
|
|
# 重登失败不影响账号持有的 CK
|
|
assert self.owned_account.cookie == "owned-secret"
|
|
|
|
def test_relogin_pending_account_is_reported_as_pending(self):
|
|
self.owned_account.ck_check_status = "invalid"
|
|
from datetime import UTC, datetime, timedelta
|
|
|
|
self.owned_account.relogin_next_at = datetime.now(UTC) + timedelta(hours=1)
|
|
self.session.commit()
|
|
|
|
result = list_cookie_operations(
|
|
search="",
|
|
tag="",
|
|
page=1,
|
|
page_size=20,
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert result["items"][0]["relogin_status"] == "relogin_pending"
|
|
|
|
def test_service_restart_cleans_orphan_relogin_tasks(self):
|
|
attempt = LoginTask(
|
|
batch_id="orphan-relogin",
|
|
account_id=self.owned_account.id,
|
|
created_by=self.support.id,
|
|
status="success",
|
|
attempt_status="running",
|
|
attempt_message="正在重新登录，旧 Cookie 保留中",
|
|
)
|
|
self.session.add(attempt)
|
|
self.session.commit()
|
|
|
|
cleaned = cleanup_orphan_relogin_tasks(self.session)
|
|
|
|
assert cleaned == 1
|
|
self.session.refresh(attempt)
|
|
self.session.refresh(self.owned_account)
|
|
# 只收敛尝试状态，账号的 CK 原封不动
|
|
assert attempt.attempt_status == "failed"
|
|
assert "服务重启" in attempt.attempt_message
|
|
assert self.owned_account.cookie == "owned-secret"
|
|
|
|
def test_service_restart_cleans_orphan_login_tasks(self):
|
|
"""普通登录批次遗留的在途尝试必须收敛，且不动账号的旧 CK。"""
|
|
attempt = LoginTask(
|
|
batch_id="orphan-login",
|
|
account_id=self.owned_account.id,
|
|
created_by=self.support.id,
|
|
status="success",
|
|
attempt_status="pending",
|
|
)
|
|
self.session.add(attempt)
|
|
self.session.commit()
|
|
|
|
cleaned = cleanup_orphan_login_tasks(self.session)
|
|
|
|
assert cleaned == 1
|
|
self.session.refresh(attempt)
|
|
self.session.refresh(self.owned_account)
|
|
assert attempt.attempt_status == "failed"
|
|
assert "服务重启" in attempt.attempt_message
|
|
assert self.owned_account.cookie == "owned-secret"
|
|
|
|
def test_service_restart_cleans_legacy_in_flight_status(self):
|
|
"""升级前直接把状态写在 status 上的在途记录也要能收敛。"""
|
|
attempt = LoginTask(
|
|
batch_id="legacy-inflight",
|
|
account_id=self.owned_account.id,
|
|
created_by=self.support.id,
|
|
status="relogin_running",
|
|
attempt_status="",
|
|
)
|
|
self.session.add(attempt)
|
|
self.session.commit()
|
|
|
|
cleaned = cleanup_orphan_login_tasks(self.session)
|
|
|
|
assert cleaned == 1
|
|
self.session.refresh(attempt)
|
|
assert attempt.attempt_status == "failed"
|
|
assert self.owned_account.cookie == "owned-secret"
|
|
|
|
def test_runner_copies_proxy_config_before_background_execution(self):
|
|
proxy = ProxyConfig(
|
|
enabled=True,
|
|
http="http://127.0.0.1:8080",
|
|
https="",
|
|
api_url="",
|
|
whitelist_enabled=False,
|
|
whitelist_platform=None,
|
|
whitelist_credentials=None,
|
|
whitelist_uid="",
|
|
whitelist_ukey="",
|
|
)
|
|
runner = LoginBatchRunner(
|
|
db=self.session,
|
|
account_ids=[],
|
|
created_by=self.support.id,
|
|
creator_permissions=[],
|
|
proxy_config=proxy,
|
|
)
|
|
proxy.http = "http://changed.example:8080"
|
|
|
|
proxy_dict, _ = runner._resolve_static_proxy()
|
|
|
|
assert proxy_dict == {
|
|
"http": "http://127.0.0.1:8080",
|
|
"https": "http://127.0.0.1:8080",
|
|
}
|
|
|
|
@patch("web.backend.services.cookie_check_service.requests.get")
|
|
def test_cookie_check_uses_new_cookie_result(self, mock_get):
|
|
mock_get.side_effect = [
|
|
SimpleNamespace(json=lambda: {"error": 0, "data": {"count": 9}}),
|
|
SimpleNamespace(
|
|
json=lambda: {"error": 0, "data": {"nn": "new-name", "lv": 12}}
|
|
),
|
|
]
|
|
|
|
result = check_douyu_cookie("new-cookie")
|
|
|
|
assert result["valid"]
|
|
assert result["fish_ball"] == 9
|
|
assert result["nickname"] == "new-name"
|
|
assert result["level"] == 12
|
|
|
|
@patch("web.backend.routers.cookies._start_relogin_accounts")
|
|
def test_relogin_invalid_only_targets_support_visible_accounts(self, start_relogin):
|
|
self.owned_account.ck_check_status = "invalid"
|
|
self.other_account.ck_check_status = "invalid"
|
|
self.session.commit()
|
|
start_relogin.return_value = {
|
|
"batch_id": "batch",
|
|
"count": 1,
|
|
"skipped": 0,
|
|
"success": True,
|
|
}
|
|
|
|
result = relogin_invalid_cookie_operations(
|
|
search="",
|
|
tag="",
|
|
db=self.session,
|
|
current=self.support,
|
|
)
|
|
|
|
assert result["success"]
|
|
selected_accounts = start_relogin.call_args.args[0]
|
|
assert [account.id for account in selected_accounts] == [self.owned_account.id]
|