ffca168dbe
功能: - 通知提醒系统: 还款日提醒、逾期提醒、系统消息横幅、登录时通知 - 通知中心UI: 铃铛图标 + 下拉列表 + 未读徽章 - 定时任务: APScheduler 每小时检查即将到期的还款 - 邮件通知: SMTP 发送还款提醒和安全警告 - 异常登录通知: 3/5/10次失败触发网页和邮件通知 安全: - 登录安全告警: 异常登录次数达到阈值时发送通知 - 密码重置链接: 一次性使用, 5分钟有效期 - 登录频率限制: IP级和账户级限制 技术: - 后端: FastAPI + SQLAlchemy + PostgreSQL - 前端: 纯 HTML/CSS/JS - 部署: Docker Compose (新增 build 配置)
152 lines
5.1 KiB
Python
152 lines
5.1 KiB
Python
from fastapi import FastAPI, Request
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.responses import JSONResponse
|
|
from contextlib import asynccontextmanager
|
|
from app.core.config import get_settings
|
|
from app.core.database import engine, async_session
|
|
from app.models.models import Base, User, Debt, RepaymentPlan, RepaymentRecord, Group
|
|
from app.core.security import hash_password
|
|
from app.api import auth, debts, repayments, admin, loans, notifications
|
|
from sqlalchemy import select, text
|
|
|
|
settings = get_settings()
|
|
|
|
METHOD_REV = {"equal_installment": "e", "interest_first": "p", "lump_sum": "i"}
|
|
|
|
|
|
async def seed_admin():
|
|
async with engine.begin() as conn:
|
|
await conn.run_sync(Base.metadata.create_all)
|
|
async with async_session() as db:
|
|
result = await db.execute(select(User))
|
|
existing = result.scalars().all()
|
|
if not existing:
|
|
admin_user = User(
|
|
email="admin",
|
|
password_hash=hash_password(settings.ADMIN_PASSWORD),
|
|
nickname="管理员",
|
|
role="admin",
|
|
)
|
|
db.add(admin_user)
|
|
test_user = User(
|
|
email="test",
|
|
password_hash=hash_password("test123"),
|
|
nickname="测试用户",
|
|
role="user",
|
|
)
|
|
db.add(test_user)
|
|
await db.commit()
|
|
|
|
|
|
async def migrate_account_names():
|
|
async with async_session() as db:
|
|
result = await db.execute(select(User))
|
|
users = result.scalars().all()
|
|
for u in users:
|
|
if "@" in u.email:
|
|
new_email = u.email.split("@")[0]
|
|
existing = await db.execute(select(User).where(User.email == new_email, User.id != u.id))
|
|
if not existing.scalar_one_or_none():
|
|
u.email = new_email
|
|
await db.commit()
|
|
|
|
|
|
async def migrate_add_real_email():
|
|
async with engine.begin() as conn:
|
|
await conn.execute(text(
|
|
"ALTER TABLE users ADD COLUMN IF NOT EXISTS real_email VARCHAR(255) DEFAULT ''"
|
|
))
|
|
|
|
|
|
async def migrate_debt_data():
|
|
async with async_session() as db:
|
|
result = await db.execute(select(Debt).where(Debt.schedule_data == None))
|
|
debts = result.scalars().all()
|
|
for debt in debts:
|
|
plans_result = await db.execute(
|
|
select(RepaymentPlan).where(RepaymentPlan.debt_id == debt.id).order_by(RepaymentPlan.due_date)
|
|
)
|
|
plans = plans_result.scalars().all()
|
|
|
|
schedule = []
|
|
paid_periods = []
|
|
for p in plans:
|
|
item = {
|
|
"p": p.principal_due / 100,
|
|
"date": p.due_date.strftime("%Y-%m-%d") if p.due_date else "",
|
|
"pay": p.total_due / 100,
|
|
"pr": p.principal_due / 100,
|
|
"it": p.interest_due / 100,
|
|
"rp": 0,
|
|
}
|
|
schedule.append(item)
|
|
if p.status == "paid":
|
|
paid_periods.append(len(schedule))
|
|
|
|
remaining = debt.amount / 100
|
|
for item in schedule:
|
|
item["rp"] = round(remaining, 2)
|
|
remaining -= item["pr"]
|
|
|
|
debt.schedule_data = schedule
|
|
debt.paid_periods = paid_periods
|
|
|
|
await db.commit()
|
|
|
|
|
|
async def migrate_account_names():
|
|
async with async_session() as db:
|
|
result = await db.execute(select(User))
|
|
users = result.scalars().all()
|
|
for u in users:
|
|
if "@" in u.email:
|
|
u.email = u.email.split("@")[0]
|
|
await db.commit()
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
await seed_admin()
|
|
await migrate_add_real_email()
|
|
await migrate_account_names()
|
|
await migrate_debt_data()
|
|
from app.services.scheduler import start_scheduler, check_upcoming_repayments
|
|
start_scheduler()
|
|
await check_upcoming_repayments()
|
|
yield
|
|
from app.services.scheduler import scheduler
|
|
scheduler.shutdown()
|
|
|
|
|
|
app = FastAPI(title=settings.PROJECT_NAME, lifespan=lifespan)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.CORS_ORIGINS,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
|
|
@app.middleware("http")
|
|
async def rate_limit_middleware(request: Request, call_next):
|
|
from app.core.rate_limit import is_ip_blocked, get_remaining_seconds
|
|
ip = request.client.host if request.client else "unknown"
|
|
if is_ip_blocked(ip):
|
|
remaining = get_remaining_seconds(ip)
|
|
return JSONResponse(status_code=429, content={"detail": f"登录失败次数过多，请 {remaining} 秒后再试", "retry_after": remaining})
|
|
return await call_next(request)
|
|
|
|
app.include_router(auth.router, prefix=settings.API_V1_PREFIX)
|
|
app.include_router(loans.router, prefix=settings.API_V1_PREFIX)
|
|
app.include_router(debts.router, prefix=settings.API_V1_PREFIX)
|
|
app.include_router(repayments.router, prefix=settings.API_V1_PREFIX)
|
|
app.include_router(admin.router, prefix=settings.API_V1_PREFIX)
|
|
app.include_router(notifications.router, prefix=settings.API_V1_PREFIX)
|
|
|
|
|
|
@app.get("/health")
|
|
async def health():
|
|
return {"status": "ok"}
|