workbuddy-portal/workbuddy_portal/config.py

# -*- coding: utf-8 -*-
"""基础配置。

刻意保持「薄」：凡是运行期要改的东西（cookie、调度周期、采集参数）都放数据库
settings 表，由后台页面维护；这里只放路径、密钥、默认值这类启动期常量。
"""
import json
import os
import secrets

# ---------------- 项目标识（单一来源）----------------
# 仓库名 / 镜像名 / compose 服务名 / 界面品牌都从这里取，避免多处硬编码走样。
PROJECT_NAME = "workbuddy-portal"          # 技术标识：目录、仓库、镜像名
PROJECT_TITLE = "WorkBuddy Portal"         # 界面品牌
PROJECT_DESC = "WorkBuddy 积分用量采集 / 存储 / 呈现一体化门户"

# 项目根（workbuddy-portal/）
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

# 数据 / 日志目录可用环境变量覆盖（容器里把卷挂到别处时不必改代码）。
DATA_DIR = os.environ.get("WB_DATA_DIR") or os.path.join(BASE_DIR, "data")
LOG_DIR = os.environ.get("WB_LOG_DIR") or os.path.join(BASE_DIR, "logs")
SQLITE_PATH = os.environ.get("WB_DB") or os.path.join(DATA_DIR, "usage.sqlite")
EXPORT_DIR = os.path.join(DATA_DIR, "exports")
APP_LOG = os.path.join(LOG_DIR, "app.log")
INSTANCE_FILE = os.path.join(DATA_DIR, "instance.json")

# 旧版脚本项目的存档（迁移用；--migrate-csv 默认读这里）
LEGACY_CSV_CANDIDATES = [
    os.path.join(os.path.dirname(BASE_DIR), "data", "usage_records.csv"),
    os.path.join(BASE_DIR, "data", "usage_records.csv"),
]

# ---------------- 云端接口 ----------------
API_BASE = "https://www.workbuddy.cn"
API_PATH = "/billing/meter/get-user-request-usage"

# ---------------- 采集参数默认值（可被 settings 表覆盖）----------------
DEFAULTS = {
    "api_base": API_BASE,
    "api_path": API_PATH,
    "page_size": "200",
    "rewind_minutes": "2",          # 断点回退分钟数
    "drift_tolerance_minutes": "5",  # 云端比本地早超过该值才告警
    "max_prompt": "2048",           # 0 表示不截断
    "verify_days": "0",             # 每次采集后做整日完整性校验的天数
    "timeout": "30",
    "ssl_verify": "1",              # 校验云端 HTTPS 证书（cookie 是凭证，不该裸奔）
    # 调度
    "schedule_enabled": "1",
    "schedule_times": "09:00,17:00",   # 每天固定时刻（逗号分隔，本地时区）
    "catch_up": "1",                    # 启动时补跑当天已错过且未执行的槽位
    "catch_up_grace_hours": "12",       # 超过该小时数就不再补跑
    # 凭证
    "cookie": "",
    "user_agent": ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
                   "(KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"),
}

# 页面展示用：哪些键属于「敏感」，在界面上做掩码
SECRET_KEYS = {"cookie"}

# 内部簿记键前缀：调度槽位标记等，**不属于用户可配置项**，
# 不在 /api/settings 里回传，也不允许通过接口写入。
INTERNAL_PREFIXES = ("slot:",)


def is_internal_key(key):
    return any(str(key).startswith(p) for p in INTERNAL_PREFIXES)


# ---------------- 设置项校验表 ----------------
# 这些键必须能安全地转成数字：后台页面是自由文本框，用户敲错一个字符
# 就会让采集在 int() 处抛 ValueError（历史 bug），所以写入时校验、读取时兜底。
# 值 = (最小值, 最大值, 单位说明)
NUM_SETTINGS = {
    "page_size":               (20, 1000, "条/页"),
    "rewind_minutes":          (0, 120, "分钟"),
    "drift_tolerance_minutes": (0, 720, "分钟"),
    "max_prompt":              (0, 20000, "字符"),
    "verify_days":             (0, 90, "天"),
    "timeout":                 (5, 300, "秒"),
    "catch_up_grace_hours":    (1, 168, "小时"),
}
BOOL_SETTINGS = {"schedule_enabled", "catch_up"}

_TRUE = ("1", "true", "yes", "on", "是", "启用")


def normalize_setting(key, raw):
    """校验并规范化单个设置值。

    返回 (value, error)：
      * value 为可直接写入 settings 表的字符串；error 非空时 value 为 None。
      * 未知键（不在 DEFAULTS 里）直接拒绝，避免接口被用来写任意键。
    """
    if key not in DEFAULTS:
        return None, "未知配置项：%s" % key
    if raw is None:
        return "", None

    if key in BOOL_SETTINGS:
        v = str(raw).strip().lower()
        if v in _TRUE:
            return "1", None
        if v in ("0", "false", "no", "off", "否", "停用", ""):
            return "0", None
        return None, "%s 只能是 0/1" % key

    if key in NUM_SETTINGS:
        lo, hi, unit = NUM_SETTINGS[key]
        try:
            n = int(float(str(raw).strip()))
        except (TypeError, ValueError):
            return None, "%s 必须是数字（%s）" % (key, unit)
        if not (lo <= n <= hi):
            return None, "%s 需在 %d ~ %d %s 之间" % (key, lo, hi, unit)
        return str(n), None

    if key == "schedule_times":
        from . import scheduler      # 局部导入避免循环依赖
        parsed = scheduler.parse_times(raw)
        if not parsed:
            return None, "每日时刻格式不对，正确写法如 09:00,17:00"
        return ",".join(parsed), None

    if key in ("api_base", "api_path"):
        v = str(raw).strip()
        if not v:
            return None, "%s 不能为空" % key
        if key == "api_base" and not v.startswith(("http://", "https://")):
            return None, "接口基址需以 http:// 或 https:// 开头"
        return v, None

    if key == "cookie":
        return str(raw).strip(), None

    return str(raw).strip(), None

# 服务
DEFAULT_HOST = "0.0.0.0"      # 局域网可访问
DEFAULT_PORT = 8848
SESSION_HOURS = 12
MAX_LOGIN_FAILS = 5           # 同 IP 连续失败次数
LOGIN_LOCK_MINUTES = 10


def ensure_dirs():
    for d in (DATA_DIR, LOG_DIR, EXPORT_DIR):
        os.makedirs(d, exist_ok=True)


def secret_key():
    """SECRET_KEY 持久化在 data/instance.json，避免每次重启把登录态全踢掉。"""
    ensure_dirs()
    data = {}
    if os.path.exists(INSTANCE_FILE):
        try:
            with open(INSTANCE_FILE, "r", encoding="utf-8") as f:
                data = json.load(f) or {}
        except (OSError, ValueError):
            data = {}
    key = data.get("secret_key")
    if not key:
        key = secrets.token_hex(32)
        data["secret_key"] = key
        with open(INSTANCE_FILE, "w", encoding="utf-8") as f:
            json.dump(data, f, ensure_ascii=False, indent=2)
    return key