101 lines
3.5 KiB
Python
101 lines
3.5 KiB
Python
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import hashlib
|
||
|
|
import time
|
||
|
|
from typing import Any
|
||
|
|
|
||
|
|
from yuxi.utils.logging_config import logger
|
||
|
|
|
||
|
|
SECRET_PREFIXES = ("corp_secret", "app_secret", "token", "bridge_url")
|
||
|
|
|
||
|
|
|
||
|
|
def _hash_credential(value: str) -> str:
|
||
|
|
return hashlib.sha256(value.encode()).hexdigest()[:16]
|
||
|
|
|
||
|
|
|
||
|
|
class WeChatSecretsAdapter:
|
||
|
|
def __init__(self):
|
||
|
|
self._watchlist: dict[str, str] = {}
|
||
|
|
self._subscribers: list[callable] = []
|
||
|
|
self._last_check: float = 0.0
|
||
|
|
self._check_interval: float = 5.0
|
||
|
|
|
||
|
|
def register_subscriber(self, callback: callable) -> None:
|
||
|
|
if callback not in self._subscribers:
|
||
|
|
self._subscribers.append(callback)
|
||
|
|
|
||
|
|
def _notify_subscribers(self, changed_keys: list[str]) -> None:
|
||
|
|
for cb in self._subscribers:
|
||
|
|
try:
|
||
|
|
cb(changed_keys)
|
||
|
|
except Exception as e:
|
||
|
|
logger.warning(f"[WeChat/Secrets] Subscriber error: {e}")
|
||
|
|
|
||
|
|
def build_watchlist(self, config: dict[str, Any]) -> dict[str, str]:
|
||
|
|
snap: dict[str, str] = {}
|
||
|
|
for key in SECRET_PREFIXES:
|
||
|
|
value = config.get(key)
|
||
|
|
if value:
|
||
|
|
snap[key] = _hash_credential(str(value))
|
||
|
|
accounts = config.get("accounts", {})
|
||
|
|
for account_id, acc_cfg in accounts.items():
|
||
|
|
for key in SECRET_PREFIXES:
|
||
|
|
value = acc_cfg.get(key)
|
||
|
|
if value:
|
||
|
|
snap[f"accounts.{account_id}.{key}"] = _hash_credential(str(value))
|
||
|
|
return snap
|
||
|
|
|
||
|
|
def detect_changes(self, config: dict[str, Any]) -> list[str]:
|
||
|
|
current = self.build_watchlist(config)
|
||
|
|
changed: list[str] = []
|
||
|
|
for key, digest in current.items():
|
||
|
|
if key in self._watchlist and self._watchlist[key] != digest:
|
||
|
|
changed.append(key)
|
||
|
|
self._watchlist = current
|
||
|
|
return changed
|
||
|
|
|
||
|
|
def should_check(self) -> bool:
|
||
|
|
now = time.monotonic()
|
||
|
|
if now - self._last_check >= self._check_interval:
|
||
|
|
self._last_check = now
|
||
|
|
return True
|
||
|
|
return False
|
||
|
|
|
||
|
|
async def monitor_and_reload(self, config: dict[str, Any], reload_fn: callable) -> None:
|
||
|
|
if not self.should_check():
|
||
|
|
return
|
||
|
|
changed = self.detect_changes(config)
|
||
|
|
if changed:
|
||
|
|
logger.info(f"[WeChat/Secrets] Credential changes detected: {changed}")
|
||
|
|
self._notify_subscribers(changed)
|
||
|
|
if reload_fn:
|
||
|
|
await reload_fn(changed)
|
||
|
|
|
||
|
|
def snapshot_secrets(self, config: dict[str, Any]) -> list[dict[str, Any]]:
|
||
|
|
items: list[dict[str, Any]] = []
|
||
|
|
for key in SECRET_PREFIXES:
|
||
|
|
value = config.get(key)
|
||
|
|
if value:
|
||
|
|
items.append(
|
||
|
|
{
|
||
|
|
"key": key,
|
||
|
|
"source": "root config",
|
||
|
|
"configured": True,
|
||
|
|
"digest_prefix": _hash_credential(str(value)),
|
||
|
|
}
|
||
|
|
)
|
||
|
|
accounts = config.get("accounts", {})
|
||
|
|
for account_id, acc_cfg in accounts.items():
|
||
|
|
for key in SECRET_PREFIXES:
|
||
|
|
value = acc_cfg.get(key)
|
||
|
|
if value:
|
||
|
|
items.append(
|
||
|
|
{
|
||
|
|
"key": key,
|
||
|
|
"source": f"accounts.{account_id}",
|
||
|
|
"configured": True,
|
||
|
|
"digest_prefix": _hash_credential(str(value)),
|
||
|
|
}
|
||
|
|
)
|
||
|
|
return items
|