Kris
1f78c44b03
这是一个批量整理提交，包含以下主要改动： 1. 删除多处冗余的空行和未使用的导入 2. 修复文件末尾缺少换行符的问题 3. 调整部分模块的导入顺序与代码排版 4. 修复部分配置默认值与策略逻辑 5. 新增多个功能模块与辅助工具 6. 完善异常处理与日志记录 7. 修复速率限制、消息缓存、权限校验等逻辑bug 8. 废弃部分旧有API与配置项并添加警告提示
134 lines
4.3 KiB
Python
134 lines
4.3 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
from dataclasses import dataclass, field
|
|
from enum import StrEnum
|
|
from typing import Any
|
|
|
|
from yuxi.utils.logging_config import logger
|
|
|
|
_SLACK_ID_PATTERN = re.compile(r"^[UCW][A-Z0-9]+$")
|
|
|
|
|
|
class DmPolicy(StrEnum):
|
|
OPEN = "open"
|
|
PAIRING = "pairing"
|
|
ALLOWLIST = "allowlist"
|
|
DISABLED = "disabled"
|
|
|
|
|
|
class GroupPolicy(StrEnum):
|
|
OPEN = "open"
|
|
ALLOWLIST = "allowlist"
|
|
DISABLED = "disabled"
|
|
|
|
|
|
DM_POLICY_VALUES = frozenset(p.value for p in DmPolicy)
|
|
GROUP_POLICY_VALUES = frozenset(p.value for p in GroupPolicy)
|
|
|
|
DEFAULT_DM_POLICY = DmPolicy.ALLOWLIST
|
|
DEFAULT_GROUP_POLICY = GroupPolicy.ALLOWLIST
|
|
|
|
|
|
@dataclass
|
|
class SecurityConfig:
|
|
dm_policy: DmPolicy = DEFAULT_DM_POLICY
|
|
group_policy: GroupPolicy = DEFAULT_GROUP_POLICY
|
|
require_mention: bool = False
|
|
allow_from: set[str] = field(default_factory=set)
|
|
allow_from_wildcard: bool = False
|
|
|
|
@classmethod
|
|
def from_config(cls, config: dict[str, Any] | None) -> SecurityConfig:
|
|
if not config:
|
|
return cls()
|
|
|
|
dm_raw = str(config.get("dm_policy", config.get("DM_POLICY", ""))).strip().lower()
|
|
dm_policy = DmPolicy(dm_raw) if dm_raw in DM_POLICY_VALUES else DEFAULT_DM_POLICY
|
|
|
|
group_raw = str(config.get("group_policy", config.get("GROUP_POLICY", ""))).strip().lower()
|
|
group_policy = GroupPolicy(group_raw) if group_raw in GROUP_POLICY_VALUES else DEFAULT_GROUP_POLICY
|
|
|
|
require_mention = bool(config.get("require_mention", config.get("REQUIRE_MENTION", False)))
|
|
|
|
allow_from_raw = config.get("allow_from", config.get("ALLOW_FROM", []))
|
|
if isinstance(allow_from_raw, str):
|
|
allow_from_raw = [x.strip() for x in allow_from_raw.split(",") if x.strip()]
|
|
elif not isinstance(allow_from_raw, (list, tuple)):
|
|
allow_from_raw = []
|
|
allow_from = set()
|
|
allow_from_wildcard = False
|
|
for entry in allow_from_raw:
|
|
entry = str(entry).strip()
|
|
if entry == "*":
|
|
allow_from_wildcard = True
|
|
elif entry:
|
|
if not _SLACK_ID_PATTERN.match(entry):
|
|
logger.warning(
|
|
f"Slack allowlist entry '{entry}' does not look like a valid Slack ID "
|
|
f"(expected format: Uxxx... or Cxxx...). It will be ignored by security checks."
|
|
)
|
|
allow_from.add(entry)
|
|
|
|
return cls(
|
|
dm_policy=dm_policy,
|
|
group_policy=group_policy,
|
|
require_mention=require_mention,
|
|
allow_from=allow_from,
|
|
allow_from_wildcard=allow_from_wildcard,
|
|
)
|
|
|
|
def is_allowed_user(self, user_id: str) -> bool:
|
|
if self.allow_from_wildcard:
|
|
return True
|
|
if not self.allow_from:
|
|
return False
|
|
return user_id in self.allow_from
|
|
|
|
def is_allowed_channel(self, channel_id: str) -> bool:
|
|
if self.allow_from_wildcard:
|
|
return True
|
|
if not self.allow_from:
|
|
return False
|
|
return channel_id in self.allow_from
|
|
|
|
def is_allowed_dm(self, user_id: str) -> bool:
|
|
if self.dm_policy == DmPolicy.OPEN:
|
|
return True
|
|
if self.dm_policy == DmPolicy.DISABLED:
|
|
return False
|
|
if self.dm_policy == DmPolicy.PAIRING:
|
|
return True
|
|
if self.dm_policy == DmPolicy.ALLOWLIST:
|
|
return self.is_allowed_user(user_id)
|
|
return False
|
|
|
|
def is_allowed_group(self, channel_id: str) -> bool:
|
|
if self.group_policy == GroupPolicy.OPEN:
|
|
return True
|
|
if self.group_policy == GroupPolicy.DISABLED:
|
|
return False
|
|
if self.group_policy == GroupPolicy.ALLOWLIST:
|
|
return self.is_allowed_channel(channel_id)
|
|
return False
|
|
|
|
def should_require_mention(self, channel_id: str) -> bool:
|
|
return self.require_mention
|
|
|
|
def to_dict(self) -> dict[str, Any]:
|
|
return {
|
|
"dm_policy": self.dm_policy.value,
|
|
"group_policy": self.group_policy.value,
|
|
"require_mention": self.require_mention,
|
|
"allow_from": sorted(self.allow_from),
|
|
"allow_from_wildcard": self.allow_from_wildcard,
|
|
}
|
|
|
|
|
|
@dataclass
|
|
class SecurityDecision:
|
|
allowed: bool
|
|
reason: str = ""
|
|
requires_pairing: bool = False
|
|
pairing_code: str | None = None
|