Remove Linux Do OAuth2 login (#994)

* Fix operation log queue status management

* Fix lint

.dockerignore

@@ -3,7 +3,10 @@ __pycache__/
 .github/
 .idea/
 .vscode/
+.cursor/
 venv/
 .venv/
 .ruff_cache/
 .pytest_cache/
+.claude/
+.serena/

.gitignore

@@ -7,3 +7,5 @@ venv/
 .python-version
 .ruff_cache/
 .pytest_cache/
+.claude/
+.serena/

.pre-commit-config.yaml

@@ -1,13 +1,17 @@
+default_language_version:
+    python: '>= 3.10'
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
       - id: end-of-file-fixer
+      - id: check-json
       - id: check-yaml
       - id: check-toml
 
   - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: v0.14.0
+    rev: v0.14.10
     hooks:
       - id: ruff-check
         args:
@@ -17,7 +21,7 @@ repos:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.9.0
+    rev: 0.9.18
     hooks:
       - id: uv-lock
       - id: uv-export

CHANGELOG.md

@@ -1,3 +1,198 @@
+<a id="v1.12.1"></a>
+# [v1.12.1](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.12.1) - 2025-12-31
+
+## What's Changed
+* Update changelog for v1.12.0 by [@wu-clan](https://github.com/wu-clan) in [#963](https://github.com/fastapi-practices/fastapi_best_architecture/pull/963)
+* Update Grafana security and user default config by [@wu-clan](https://github.com/wu-clan) in [#964](https://github.com/fastapi-practices/fastapi_best_architecture/pull/964)
+* Rename the pre start script to migrate by [@wu-clan](https://github.com/wu-clan) in [#965](https://github.com/fastapi-practices/fastapi_best_architecture/pull/965)
+* Add code generation and notice SQL scripts by [@wu-clan](https://github.com/wu-clan) in [#966](https://github.com/fastapi-practices/fastapi_best_architecture/pull/966)
+* Fix support for special character passwords by [@wu-clan](https://github.com/wu-clan) in [#968](https://github.com/fastapi-practices/fastapi_best_architecture/pull/968)
+* Add an independent contribution document by [@wu-clan](https://github.com/wu-clan) in [#971](https://github.com/fastapi-practices/fastapi_best_architecture/pull/971)
+* Fix i18n target language error when concurrent by [@wu-clan](https://github.com/wu-clan) in [#970](https://github.com/fastapi-practices/fastapi_best_architecture/pull/970)
+* Add observability instrument for redis client by [@wu-clan](https://github.com/wu-clan) in [#972](https://github.com/fastapi-practices/fastapi_best_architecture/pull/972)
+* Add OTEL semantic specification metrics config by [@wu-clan](https://github.com/wu-clan) in [#973](https://github.com/fastapi-practices/fastapi_best_architecture/pull/973)
+* Fix case where the user agent was empty by [@wu-clan](https://github.com/wu-clan) in [#976](https://github.com/fastapi-practices/fastapi_best_architecture/pull/976)
+* Optimize login log database session calls by [@wu-clan](https://github.com/wu-clan) in [#977](https://github.com/fastapi-practices/fastapi_best_architecture/pull/977)
+* Add the auto init project CLI command by [@wu-clan](https://github.com/wu-clan) in [#978](https://github.com/fastapi-practices/fastapi_best_architecture/pull/978)
+* Bump dependencies and pre-commits by [@wu-clan](https://github.com/wu-clan) in [#979](https://github.com/fastapi-practices/fastapi_best_architecture/pull/979)
+* Add observability instrument for httpx request by [@wu-clan](https://github.com/wu-clan) in [#980](https://github.com/fastapi-practices/fastapi_best_architecture/pull/980)
+* Update git and docker ignore files by [@wu-clan](https://github.com/wu-clan) in [#981](https://github.com/fastapi-practices/fastapi_best_architecture/pull/981)
+
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.12.0...v1.12.1
+
+## Contributors
+
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.12.1]
+
+
+<a id="v1.12.0"></a>
+# [v1.12.0](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.12.0) - 2025-12-15
+
+## What's Changed
+* Update changelog for v1.11.2 by [@wu-clan](https://github.com/wu-clan) in [#942](https://github.com/fastapi-practices/fastapi_best_architecture/pull/942)
+* Update celery related docker container independence by [@wu-clan](https://github.com/wu-clan) in [#943](https://github.com/fastapi-practices/fastapi_best_architecture/pull/943)
+* Fix super value in update user permissions by [@wu-clan](https://github.com/wu-clan) in [#948](https://github.com/fastapi-practices/fastapi_best_architecture/pull/948)
+* Optimize data permission logic and usage by [@wu-clan](https://github.com/wu-clan) in [#947](https://github.com/fastapi-practices/fastapi_best_architecture/pull/947)
+* Update pre-commit to prek in pre-commit script by [@wu-clan](https://github.com/wu-clan) in [#949](https://github.com/fastapi-practices/fastapi_best_architecture/pull/949)
+* Optimize the coupling of user social plugin by [@wu-clan](https://github.com/wu-clan) in [#950](https://github.com/fastapi-practices/fastapi_best_architecture/pull/950)
+* Add the database primary key mode config by [@wu-clan](https://github.com/wu-clan) in [#953](https://github.com/fastapi-practices/fastapi_best_architecture/pull/953)
+* Optimize the coupling of code generation CLI by [@wu-clan](https://github.com/wu-clan) in [#951](https://github.com/fastapi-practices/fastapi_best_architecture/pull/951)
+* Add CLI init project database support by [@wu-clan](https://github.com/wu-clan) in [#952](https://github.com/fastapi-practices/fastapi_best_architecture/pull/952)
+* Update the init project database CLI to subcommand by [@wu-clan](https://github.com/wu-clan) in [#954](https://github.com/fastapi-practices/fastapi_best_architecture/pull/954)
+* Fix CLI command for code generation by [@wu-clan](https://github.com/wu-clan) in [#956](https://github.com/fastapi-practices/fastapi_best_architecture/pull/956)
+* Fix the IP address in the request log by [@wuyuemushi](https://github.com/wuyuemushi) in [#959](https://github.com/fastapi-practices/fastapi_best_architecture/pull/959)
+* Add the Grafana observability suite by [@wu-clan](https://github.com/wu-clan) in [#961](https://github.com/fastapi-practices/fastapi_best_architecture/pull/961)
+* Update the version number to 1.12.0 by [@wu-clan](https://github.com/wu-clan) in [#962](https://github.com/fastapi-practices/fastapi_best_architecture/pull/962)
+
+## New Contributors
+* [@wuyuemushi](https://github.com/wuyuemushi) made their first contribution in [#959](https://github.com/fastapi-practices/fastapi_best_architecture/pull/959)
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.2...v1.12.0
+
+## Contributors
+
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+<a href="https://github.com/wuyuemushi"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwuyuemushi.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wuyuemushi"></a>
+
+[Changes][v1.12.0]
+
+
+<a id="v1.11.2"></a>
+# [v1.11.2](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.11.2) - 2025-11-28
+
+## What's Changed
+* Update changelog for v1.11.1 by [@wu-clan](https://github.com/wu-clan) in [#923](https://github.com/fastapi-practices/fastapi_best_architecture/pull/923)
+* Fix typos in data rule sql scripts by [@wu-clan](https://github.com/wu-clan) in [#926](https://github.com/fastapi-practices/fastapi_best_architecture/pull/926)
+* Restore captcha uuid naming in the login params by [@wu-clan](https://github.com/wu-clan) in [#928](https://github.com/fastapi-practices/fastapi_best_architecture/pull/928)
+* Add distributed deployment support for snowflake ID by [@downdawn](https://github.com/downdawn) in [#927](https://github.com/fastapi-practices/fastapi_best_architecture/pull/927)
+* Add env reqs for plugin install and uninstall by [@wu-clan](https://github.com/wu-clan) in [#929](https://github.com/fastapi-practices/fastapi_best_architecture/pull/929)
+* Optimize the use of some LRU caches by [@wu-clan](https://github.com/wu-clan) in [#932](https://github.com/fastapi-practices/fastapi_best_architecture/pull/932)
+* Update the i18n language file init location by [@wu-clan](https://github.com/wu-clan) in [#934](https://github.com/fastapi-practices/fastapi_best_architecture/pull/934)
+* Fix get column types in code generation by [@wu-clan](https://github.com/wu-clan) in [#935](https://github.com/fastapi-practices/fastapi_best_architecture/pull/935)
+* Bump dependencies and pre-commits by [@wu-clan](https://github.com/wu-clan) in [#936](https://github.com/fastapi-practices/fastapi_best_architecture/pull/936)
+* Update the files interface filename to file by [@wu-clan](https://github.com/wu-clan) in [#937](https://github.com/fastapi-practices/fastapi_best_architecture/pull/937)
+* Update task application interface definitions by [@wu-clan](https://github.com/wu-clan) in [#938](https://github.com/fastapi-practices/fastapi_best_architecture/pull/938)
+* Update code generation interface definitions by [@wu-clan](https://github.com/wu-clan) in [#939](https://github.com/fastapi-practices/fastapi_best_architecture/pull/939)
+* Update the fba run CLI command output by [@wu-clan](https://github.com/wu-clan) in [#941](https://github.com/fastapi-practices/fastapi_best_architecture/pull/941)
+* Update the version number to 1.11.2 by [@wu-clan](https://github.com/wu-clan) in [#940](https://github.com/fastapi-practices/fastapi_best_architecture/pull/940)
+
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.1...v1.11.2
+
+## Contributors
+
+<a href="https://github.com/downdawn"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fdowndawn.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@downdawn"></a>
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.11.2]
+
+
+<a id="v1.11.1"></a>
+# [v1.11.1](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.11.1) - 2025-11-16
+
+## What's Changed
+* Update changelog for v1.11.0 by [@wu-clan](https://github.com/wu-clan) in [#917](https://github.com/fastapi-practices/fastapi_best_architecture/pull/917)
+* Fix missing table in alembic migration by [@wu-clan](https://github.com/wu-clan) in [#920](https://github.com/fastapi-practices/fastapi_best_architecture/pull/920)
+* Add user social binding and unbinding by [@wu-clan](https://github.com/wu-clan) in [#919](https://github.com/fastapi-practices/fastapi_best_architecture/pull/919)
+* Fix the user list query serialization by [@linrong](https://github.com/linrong) in [#921](https://github.com/fastapi-practices/fastapi_best_architecture/pull/921)
+* Update user and login security configs by [@wu-clan](https://github.com/wu-clan) in [#922](https://github.com/fastapi-practices/fastapi_best_architecture/pull/922)
+
+## New Contributors
+* [@linrong](https://github.com/linrong) made their first contribution in [#921](https://github.com/fastapi-practices/fastapi_best_architecture/pull/921)
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.0...v1.11.1
+
+## Contributors
+
+<a href="https://github.com/linrong"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Flinrong.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@linrong"></a>
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.11.1]
+
+
+<a id="v1.11.0"></a>
+# [v1.11.0](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.11.0) - 2025-11-12
+
+## What's Changed
+* Update changelog for v1.10.4 by [@wu-clan](https://github.com/wu-clan) in [#916](https://github.com/fastapi-practices/fastapi_best_architecture/pull/916)
+* Refactor foreign keys and relationships to pure logic by [@wu-clan](https://github.com/wu-clan) in [#901](https://github.com/fastapi-practices/fastapi_best_architecture/pull/901)
+
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.4...v1.11.0
+
+## Contributors
+
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.11.0]
+
+
+<a id="v1.10.4"></a>
+# [v1.10.4](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.10.4) - 2025-11-12
+
+## What's Changed
+* Update changelog for v1.10.3 by [@wu-clan](https://github.com/wu-clan) in [#895](https://github.com/fastapi-practices/fastapi_best_architecture/pull/895)
+* Bump fastapi oauth2 from 0.0.1 to 0.0.2 by [@wu-clan](https://github.com/wu-clan) in [#896](https://github.com/fastapi-practices/fastapi_best_architecture/pull/896)
+* Update the interface timing accuracy in log by [@wu-clan](https://github.com/wu-clan) in [#897](https://github.com/fastapi-practices/fastapi_best_architecture/pull/897)
+* Optimize redis batch get and delete operations by [@wu-clan](https://github.com/wu-clan) in [#899](https://github.com/fastapi-practices/fastapi_best_architecture/pull/899)
+* Update the time column type in the task by [@wu-clan](https://github.com/wu-clan) in [#900](https://github.com/fastapi-practices/fastapi_best_architecture/pull/900)
+* Add the user social independent enum file by [@wu-clan](https://github.com/wu-clan) in [#902](https://github.com/fastapi-practices/fastapi_best_architecture/pull/902)
+* Optimize the request params of the service layer by [@wu-clan](https://github.com/wu-clan) in [#903](https://github.com/fastapi-practices/fastapi_best_architecture/pull/903)
+* Optimize the data permission condition build by [@wu-clan](https://github.com/wu-clan) in [#904](https://github.com/fastapi-practices/fastapi_best_architecture/pull/904)
+* Fix response status codes in the request logs by [@wu-clan](https://github.com/wu-clan) in [#905](https://github.com/fastapi-practices/fastapi_best_architecture/pull/905)
+* Add dept validation to user updates by [@wu-clan](https://github.com/wu-clan) in [#906](https://github.com/fastapi-practices/fastapi_best_architecture/pull/906)
+* Update the version number to 1.10.4 by [@wu-clan](https://github.com/wu-clan) in [#907](https://github.com/fastapi-practices/fastapi_best_architecture/pull/907)
+* Fix typo in the data permission prompt by [@wu-clan](https://github.com/wu-clan) in [#909](https://github.com/fastapi-practices/fastapi_best_architecture/pull/909)
+* Fix user cache cleanup when operating data rules by [@wu-clan](https://github.com/wu-clan) in [#910](https://github.com/fastapi-practices/fastapi_best_architecture/pull/910)
+* Fix create and delete department validations by [@wu-clan](https://github.com/wu-clan) in [#911](https://github.com/fastapi-practices/fastapi_best_architecture/pull/911)
+* Fix the user menu sidebar parsing by [@wu-clan](https://github.com/wu-clan) in [#912](https://github.com/fastapi-practices/fastapi_best_architecture/pull/912)
+* Add user social unbinding account interface by [@wu-clan](https://github.com/wu-clan) in [#913](https://github.com/fastapi-practices/fastapi_best_architecture/pull/913)
+* Fix user cache cleanup when updating data scope by [@wu-clan](https://github.com/wu-clan) in [#915](https://github.com/fastapi-practices/fastapi_best_architecture/pull/915)
+* Fix dept and menu table subqueries by [@wu-clan](https://github.com/wu-clan) in [#914](https://github.com/fastapi-practices/fastapi_best_architecture/pull/914)
+
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.3...v1.10.4
+
+## Contributors
+
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.10.4]
+
+
+<a id="v1.10.3"></a>
+# [v1.10.3](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.10.3) - 2025-10-30
+
+## What's Changed
+* Update changelog for v1.10.2 by [@wu-clan](https://github.com/wu-clan) in [#873](https://github.com/fastapi-practices/fastapi_best_architecture/pull/873)
+* Fix docker default database env variables by [@wu-clan](https://github.com/wu-clan) in [#874](https://github.com/fastapi-practices/fastapi_best_architecture/pull/874)
+* Add port for fba sever in docker compose by [@wu-clan](https://github.com/wu-clan) in [#875](https://github.com/fastapi-practices/fastapi_best_architecture/pull/875)
+* Update the container naming in docker scripts by [@wu-clan](https://github.com/wu-clan) in [#876](https://github.com/fastapi-practices/fastapi_best_architecture/pull/876)
+* Fix the httpurl type compatibility with postgresql by [@wu-clan](https://github.com/wu-clan) in [#877](https://github.com/fastapi-practices/fastapi_best_architecture/pull/877)
+* Update the default length of user email column by [@wu-clan](https://github.com/wu-clan) in [#878](https://github.com/fastapi-practices/fastapi_best_architecture/pull/878)
+* Update the serializer of httpurl type by [@wu-clan](https://github.com/wu-clan) in [#879](https://github.com/fastapi-practices/fastapi_best_architecture/pull/879)
+* Fix the OAuth2 link acquisition in HTTPS by [@wu-clan](https://github.com/wu-clan) in [#881](https://github.com/fastapi-practices/fastapi_best_architecture/pull/881)
+* Add Google OAuth2 callback to opera log exclusion by [@wu-clan](https://github.com/wu-clan) in [#882](https://github.com/fastapi-practices/fastapi_best_architecture/pull/882)
+* Update the length style of the model columns by [@wu-clan](https://github.com/wu-clan) in [#883](https://github.com/fastapi-practices/fastapi_best_architecture/pull/883)
+* Bump dependencies to the latest version by [@wu-clan](https://github.com/wu-clan) in [#890](https://github.com/fastapi-practices/fastapi_best_architecture/pull/890)
+* Fix import in code generation api template by [@wu-clan](https://github.com/wu-clan) in [#891](https://github.com/fastapi-practices/fastapi_best_architecture/pull/891)
+* Fix celery compatibility with psycopg version by [@wu-clan](https://github.com/wu-clan) in [#892](https://github.com/fastapi-practices/fastapi_best_architecture/pull/892)
+* Fix the venv pip availability in Linux by [@wu-clan](https://github.com/wu-clan) in [#893](https://github.com/fastapi-practices/fastapi_best_architecture/pull/893)
+* Add the celery rabbitmq vhost config by [@wu-clan](https://github.com/wu-clan) in [#894](https://github.com/fastapi-practices/fastapi_best_architecture/pull/894)
+
+
+**Full Changelog**: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.2...v1.10.3
+
+## Contributors
+
+<a href="https://github.com/wu-clan"><img src="https://wsrv.nl/?url=https%3A%2F%2Fgithub.com%2Fwu-clan.png&w=128&h=128&fit=cover&mask=circle" width="64" height="64" alt="@wu-clan"></a>
+
+[Changes][v1.10.3]
+
+
 <a id="v1.10.2"></a>
 # [v1.10.2](https://github.com/fastapi-practices/fastapi_best_architecture/releases/tag/v1.10.2) - 2025-10-21
 
@@ -1058,6 +1253,13 @@
 [Changes][v1.0.0]
 
 
+[v1.12.1]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.12.0...v1.12.1
+[v1.12.0]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.2...v1.12.0
+[v1.11.2]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.1...v1.11.2
+[v1.11.1]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.11.0...v1.11.1
+[v1.11.0]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.4...v1.11.0
+[v1.10.4]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.3...v1.10.4
+[v1.10.3]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.2...v1.10.3
 [v1.10.2]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.1...v1.10.2
 [v1.10.1]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.10.0...v1.10.1
 [v1.10.0]: https://github.com/fastapi-practices/fastapi_best_architecture/compare/v1.9.0...v1.10.0

CONTRIBUTING.md

@@ -0,0 +1,62 @@
+## Backend
+
+1. Prerequisites
+
+    - Python >= 3.10
+    - Git
+    - [uv](https://docs.astral.sh/uv/getting-started/installation/)
+    - Fork this repository to your GitHub account
+
+2. Installation and setup
+
+   Clone your forked repository:
+
+   ```shell
+   git clone https://github.com/<your account>/fastapi_best_architecture.git
+   ```
+
+   Go to the root directory of the project, open the terminal, and run the following command:
+
+   ```sh
+   uv sync
+   ```
+
+3. Checkout
+
+   Checkout a new branch and make your changes
+
+   ```shell
+   git checkout -b your-new-feature-branch
+   ```
+
+4. Format and Lint
+
+   Auto-formatting and lint via `prek`
+
+   ```shell
+   prek run --all-files
+   ```
+
+5. Commit and push
+
+   Commit your changes and push your branch to the GitHub.
+
+6. PR
+
+   Create a PR via GitHub
+
+## Scripts
+
+> [!WARNING]
+>
+> The following script may not apply to the Windows platform
+>
+> It is recommended to execute under the backend directory, and chmod authorization may be required
+
+- `migrate.sh`: Perform automatic database migration
+
+- `scripts/format.sh`: Perform ruff format check
+
+- `scripts/lint.sh`: Perform prek formatting
+
+- `scripts/export.sh`: Execute uv export dependency package

Dockerfile

@@ -36,33 +36,49 @@ COPY --from=builder /fba /fba
 
 COPY --from=builder /usr/local /usr/local
 
-COPY deploy/backend/supervisord.conf /etc/supervisor/supervisord.conf
+COPY deploy/backend/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
 
 WORKDIR /fba/backend
 
 # === FastAPI server image ===
 FROM base_server AS fba_server
 
-COPY deploy/backend/fba_server.conf /etc/supervisor/conf.d/
+COPY deploy/backend/supervisor/fba_server.conf /etc/supervisor/conf.d/
 
 RUN mkdir -p /var/log/fba
 
 EXPOSE 8001
 
-CMD ["/usr/local/bin/granian", "main:app", "--interface", "asgi", "--host", "0.0.0.0", "--port","8000"]
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
 
-# === Celery server image ===
+# === Celery Worker image ===
-FROM base_server AS fba_celery
+FROM base_server AS fba_celery_worker
 
-COPY deploy/backend/fba_celery.conf /etc/supervisor/conf.d/
+COPY deploy/backend/supervisor/fba_celery_worker.conf /etc/supervisor/conf.d/
 
 RUN mkdir -p /var/log/fba
 
-RUN chmod +x celery-start.sh
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# === Celery Beat image ===
+FROM base_server AS fba_celery_beat
+
+COPY deploy/backend/supervisor/fba_celery_beat.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
+
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+# === Celery Flower image ===
+FROM base_server AS fba_celery_flower
+
+COPY deploy/backend/supervisor/fba_celery_flower.conf /etc/supervisor/conf.d/
+
+RUN mkdir -p /var/log/fba
 
 EXPOSE 8555
 
-CMD ["./celery-start.sh"]
+CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
 
 # Build image
 FROM ${SERVER_TYPE}

backend/.env.example

@@ -13,8 +13,6 @@ REDIS_PASSWORD=''
 REDIS_DATABASE=0
 # Token
 TOKEN_SECRET_KEY='1VkVF75nsNABBjK_7-qz7GtzNy3AMvktc9TCPwKczCk'
-# Opera Log
-OPERA_LOG_ENCRYPT_SECRET_KEY='d77b25790a804c2b4a339dd0207941e4cefa5751935a33735bc73bb7071a005b'
 # [ App ] task
 # Celery
 CELERY_BROKER_REDIS_DATABASE=1
@@ -28,8 +26,6 @@ OAUTH2_GITHUB_CLIENT_ID='test'
 OAUTH2_GITHUB_CLIENT_SECRET='test'
 OAUTH2_GOOGLE_CLIENT_ID='test'
 OAUTH2_GOOGLE_CLIENT_SECRET='test'
-OAUTH2_LINUX_DO_CLIENT_ID='test'
-OAUTH2_LINUX_DO_CLIENT_SECRET='test'
 # [ Plugin ] email
 EMAIL_USERNAME=''
 EMAIL_PASSWORD=''

backend/README.md

@@ -16,68 +16,3 @@
    ```shell
    docker run -d -p 8000:8000 --name fba_server fba_backend_independent
    ```
-
-## Contributing
-
-1. Prerequisites
-
-    - Python >= 3.10
-    - Git
-    - [uv](https://docs.astral.sh/uv/getting-started/installation/)
-    - Fork this repository to your GitHub account
-
-2. Installation and setup
-
-   Clone your forked repository:
-
-   ```shell
-   git clone https://github.com/<your account>/fastapi_best_architecture.git
-   ```
-
-   Go to the root directory of the project, open the terminal, and run the following command:
-
-   ```sh
-   uv sync --frozen
-   ```
-
-3. Checkout
-
-   Checkout a new branch and make your changes
-
-   ```shell
-   git checkout -b your-new-feature-branch
-   ```
-
-4. Format and Lint
-
-   Auto-formatting and lint via `pre-commit`
-
-   ```shell
-   pre-commit run --all-files
-   ```
-
-5. Commit and push
-
-   Commit your changes and push your branch to the GitHub.
-
-6. PR
-
-   Create a PR via GitHub
-
-## Scripts
-
-> [!WARNING]
->
-> The following script may not apply to the Windows platform
->
-> It is recommended to execute under the backend directory, and chmod authorization may be required
-
-- `pre_start.sh`: Perform automatic database migration
-
-- `celery-start.sh`: For celery docker script, implementation is not recommended
-
-- `scripts/format.sh`: Perform ruff format check
-
-- `scripts/lint.sh`: Perform pre-commit formatting
-
-- `scripts/export.sh`: Execute uv export dependency package

backend/__init__.py

@@ -1,7 +1,17 @@
-from backend.common.i18n import i18n
+import sqlalchemy as sa
 
-__version__ = '1.10.2'
+from backend.utils.import_parse import get_all_models
+
+# import all models for auto create db tables
+for cls in get_all_models():
+    if isinstance(cls, sa.Table):
+        table_name = cls.name
+        if table_name not in globals():
+            globals()[table_name] = cls
+    else:
+        class_name = cls.__name__
+        if class_name not in globals():
+            globals()[class_name] = cls
 
 
-# 初始化 i18n
+__version__ = '1.12.0'
-i18n.load_locales()

backend/alembic/env.py

@@ -8,17 +8,9 @@ from sqlalchemy import pool
 from sqlalchemy.engine import Connection
 from sqlalchemy.ext.asyncio import async_engine_from_config
 
-from backend.app import get_app_models
 from backend.common.model import MappedBase
 from backend.core import path_conf
 from backend.database.db import SQLALCHEMY_DATABASE_URL
-from backend.plugin.tools import get_plugin_models
-
-# import models
-for cls in get_app_models() + get_plugin_models():
-    class_name = cls.__name__
-    if class_name not in globals():
-        globals()[class_name] = cls
 
 if not os.path.exists(path_conf.ALEMBIC_VERSION_DIR):
     os.makedirs(path_conf.ALEMBIC_VERSION_DIR)

backend/app/__init__.py

@@ -1,28 +0,0 @@
-import os.path
-
-from backend.core.path_conf import BASE_PATH
-from backend.utils.import_parse import get_model_objects
-
-
-def get_app_models() -> list[type]:
-    """获取 app 所有模型类"""
-    app_path = BASE_PATH / 'app'
-    list_dirs = os.listdir(app_path)
-
-    apps = [d for d in list_dirs if os.path.isdir(os.path.join(app_path, d)) and d != '__pycache__']
-
-    objs = []
-    for app in apps:
-        module_path = f'backend.app.{app}.model'
-        obj = get_model_objects(module_path)
-        if obj:
-            objs.extend(obj)
-
-    return objs
-
-
-# import all app models for auto create db tables
-for cls in get_app_models():
-    class_name = cls.__name__
-    if class_name not in globals():
-        globals()[class_name] = cls

backend/app/admin/api/v1/auth/auth.py

@@ -20,7 +20,7 @@ async def login_swagger(
     db: CurrentSessionTransaction, obj: Annotated[HTTPBasicCredentials, Depends()]
 ) -> GetSwaggerToken:
     token, user = await auth_service.swagger_login(db=db, obj=obj)
-    return GetSwaggerToken(access_token=token, user=user)
+    return GetSwaggerToken(access_token=token, user=user)  # type: ignore
 
 
 @router.post(

backend/app/admin/api/v1/auth/captcha.py

@@ -1,4 +1,4 @@
-from uuid import uuid4
+import uuid
 
 from fast_captcha import img_captcha
 from fastapi import APIRouter, Depends
@@ -8,7 +8,9 @@ from starlette.concurrency import run_in_threadpool
 from backend.app.admin.schema.captcha import GetCaptchaDetail
 from backend.common.response.response_schema import ResponseSchemaModel, response_base
 from backend.core.conf import settings
+from backend.database.db import CurrentSession
 from backend.database.redis import redis_client
+from backend.utils.dynamic_config import load_login_config
 
 router = APIRouter()
 
@@ -18,17 +20,19 @@ router = APIRouter()
     summary='获取登录验证码',
     dependencies=[Depends(RateLimiter(times=5, seconds=10))],
 )
-async def get_captcha() -> ResponseSchemaModel[GetCaptchaDetail]:
+async def get_captcha(db: CurrentSession) -> ResponseSchemaModel[GetCaptchaDetail]:
-    """
+    await load_login_config(db)
-    此接口可能存在性能损耗，尽管是异步接口，但是验证码生成是IO密集型任务，使用线程池尽量减少性能损耗
+    img, code = await run_in_threadpool(img_captcha, img_byte='base64')
-    """
+    captcha_uuid = str(uuid.uuid4())
-    img_type: str = 'base64'
-    img, code = await run_in_threadpool(img_captcha, img_byte=img_type)
-    uuid = str(uuid4())
     await redis_client.set(
-        f'{settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{uuid}',
+        f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{captcha_uuid}',
         code,
-        ex=settings.CAPTCHA_LOGIN_EXPIRE_SECONDS,
+        ex=settings.LOGIN_CAPTCHA_EXPIRE_SECONDS,
+    )
+    data = GetCaptchaDetail(
+        is_enabled=settings.LOGIN_CAPTCHA_ENABLED,
+        expire_seconds=settings.LOGIN_CAPTCHA_EXPIRE_SECONDS,
+        uuid=captcha_uuid,
+        image=img,
     )
-    data = GetCaptchaDetail(uuid=uuid, img_type=img_type, image=img)
     return response_base.success(data=data)

backend/app/admin/api/v1/monitor/online.py

@@ -18,7 +18,7 @@ router = APIRouter()
 async def get_sessions(
     username: Annotated[str | None, Query(description='用户名')] = None,
 ) -> ResponseSchemaModel[list[GetTokenDetail]]:
-    token_keys = await redis_client.keys(f'{settings.TOKEN_REDIS_PREFIX}:*')
+    token_keys = await redis_client.get_prefix(f'{settings.TOKEN_REDIS_PREFIX}:*')
     online_clients = await redis_client.smembers(settings.TOKEN_ONLINE_REDIS_PREFIX)
     data: list[GetTokenDetail] = []
 

backend/app/admin/api/v1/sys/__init__.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter
 from backend.app.admin.api.v1.sys.data_rule import router as data_rule_router
 from backend.app.admin.api.v1.sys.data_scope import router as data_scope_router
 from backend.app.admin.api.v1.sys.dept import router as dept_router
-from backend.app.admin.api.v1.sys.files import router as file_router
+from backend.app.admin.api.v1.sys.file import router as file_router
 from backend.app.admin.api.v1.sys.menu import router as menu_router
 from backend.app.admin.api.v1.sys.plugin import router as plugin_router
 from backend.app.admin.api.v1.sys.role import router as role_router

backend/app/admin/api/v1/sys/dept.py

@@ -1,12 +1,14 @@
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, Path, Query, Request
+from fastapi import APIRouter, Depends, Path, Query
+from sqlalchemy import ColumnElement
 
+from backend.app.admin.model import Dept
 from backend.app.admin.schema.dept import CreateDeptParam, GetDeptDetail, GetDeptTree, UpdateDeptParam
 from backend.app.admin.service.dept_service import dept_service
 from backend.common.response.response_schema import ResponseModel, ResponseSchemaModel, response_base
 from backend.common.security.jwt import DependsJwtAuth
-from backend.common.security.permission import RequestPermission
+from backend.common.security.permission import DataPermissionFilter, RequestPermission
 from backend.common.security.rbac import DependsRBAC
 from backend.database.db import CurrentSession, CurrentSessionTransaction
 
@@ -24,13 +26,15 @@ async def get_dept(
 @router.get('', summary='获取部门树', dependencies=[DependsJwtAuth])
 async def get_dept_tree(
     db: CurrentSession,
-    request: Request,
+    data_filter: Annotated[ColumnElement[bool], Depends(DataPermissionFilter(Dept))],
     name: Annotated[str | None, Query(description='部门名称')] = None,
     leader: Annotated[str | None, Query(description='部门负责人')] = None,
     phone: Annotated[str | None, Query(description='联系电话')] = None,
     status: Annotated[int | None, Query(description='状态')] = None,
 ) -> ResponseSchemaModel[list[GetDeptTree]]:
-    dept = await dept_service.get_tree(db=db, request=request, name=name, leader=leader, phone=phone, status=status)
+    dept = await dept_service.get_tree(
+        db=db, data_filter=data_filter, name=name, leader=leader, phone=phone, status=status
+    )
     return response_base.success(data=dept)
 
 

backend/app/admin/api/v1/sys/file.py

@@ -13,7 +13,7 @@ router = APIRouter()
 
 @router.post(
     '/upload',
-    summary='文件上传',
+    summary='本地文件上传',
     dependencies=[
         Depends(RequestPermission('sys:file:upload')),
         DependsRBAC,

backend/app/admin/api/v1/sys/user.py

@@ -102,7 +102,7 @@ async def update_user_permission(
 async def update_user_password(
     db: CurrentSessionTransaction, request: Request, obj: ResetPasswordParam
 ) -> ResponseModel:
-    count = await user_service.update_password(db=db, request=request, obj=obj)
+    count = await user_service.update_password(db=db, user_id=request.user.id, obj=obj)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -126,7 +126,7 @@ async def update_user_nickname(
     request: Request,
     nickname: Annotated[str, Body(embed=True, description='用户昵称')],
 ) -> ResponseModel:
-    count = await user_service.update_nickname(db=db, request=request, nickname=nickname)
+    count = await user_service.update_nickname(db=db, user_id=request.user.id, nickname=nickname)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -138,7 +138,7 @@ async def update_user_avatar(
     request: Request,
     avatar: Annotated[str, Body(embed=True, description='用户头像地址')],
 ) -> ResponseModel:
-    count = await user_service.update_avatar(db=db, request=request, avatar=avatar)
+    count = await user_service.update_avatar(db=db, user_id=request.user.id, avatar=avatar)
     if count > 0:
         return response_base.success()
     return response_base.fail()
@@ -151,7 +151,7 @@ async def update_user_email(
     captcha: Annotated[str, Body(embed=True, description='邮箱验证码')],
     email: Annotated[str, Body(embed=True, description='用户邮箱')],
 ) -> ResponseModel:
-    count = await user_service.update_email(db=db, request=request, captcha=captcha, email=email)
+    count = await user_service.update_email(db=db, user_id=request.user.id, captcha=captcha, email=email)
     if count > 0:
         return response_base.success()
     return response_base.fail()

backend/app/admin/crud/crud_data_rule.py

@@ -33,7 +33,7 @@ class CRUDDataRule(CRUDPlus[DataRule]):
         if name is not None:
             filters['name__like'] = f'%{name}%'
 
-        return await self.select_order('id', load_strategies={'scopes': 'noload'}, **filters)
+        return await self.select_order('id', **filters)
 
     async def get_by_name(self, db: AsyncSession, name: str) -> DataRule | None:
         """

backend/app/admin/crud/crud_data_scope.py

@@ -1,11 +1,18 @@
 from collections.abc import Sequence
+from typing import Any
 
-from sqlalchemy import Select, select
+from sqlalchemy import Select, delete, insert
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
-from backend.app.admin.model import DataRule, DataScope
+from backend.app.admin.model import DataRule, DataScope, data_scope_rule
-from backend.app.admin.schema.data_scope import CreateDataScopeParam, UpdateDataScopeParam, UpdateDataScopeRuleParam
+from backend.app.admin.schema.data_scope import (
+    CreateDataScopeParam,
+    CreateDataScopeRuleParam,
+    UpdateDataScopeParam,
+    UpdateDataScopeRuleParam,
+)
+from backend.utils.serializers import select_join_serialize
 
 
 class CRUDDataScope(CRUDPlus[DataScope]):
@@ -31,7 +38,7 @@ class CRUDDataScope(CRUDPlus[DataScope]):
         """
         return await self.select_model_by_column(db, name=name)
 
-    async def get_with_relation(self, db: AsyncSession, pk: int) -> DataScope:
+    async def get_join(self, db: AsyncSession, pk: int) -> Any:
         """
         获取数据范围关联数据
 
@@ -39,7 +46,16 @@ class CRUDDataScope(CRUDPlus[DataScope]):
         :param pk: 范围 ID
         :return:
         """
-        return await self.select_model(db, pk, load_strategies=['rules'])
+        result = await self.select_models(
+            db,
+            id=pk,
+            join_conditions=[
+                JoinConfig(model=data_scope_rule, join_on=data_scope_rule.c.data_scope_id == self.model.id),
+                JoinConfig(model=DataRule, join_on=DataRule.id == data_scope_rule.c.data_rule_id, fill_result=True),
+            ],
+        )
+
+        return select_join_serialize(result, relationships=['DataScope-m2m-DataRule:rules'])
 
     async def get_all(self, db: AsyncSession) -> Sequence[DataScope]:
         """
@@ -65,7 +81,7 @@ class CRUDDataScope(CRUDPlus[DataScope]):
         if status is not None:
             filters['status'] = status
 
-        return await self.select_order('id', load_strategies={'rules': 'noload', 'roles': 'noload'}, **filters)
+        return await self.select_order('id', **filters)
 
     async def create(self, db: AsyncSession, obj: CreateDataScopeParam) -> None:
         """
@@ -88,7 +104,8 @@ class CRUDDataScope(CRUDPlus[DataScope]):
         """
         return await self.update_model(db, pk, obj)
 
-    async def update_rules(self, db: AsyncSession, pk: int, rule_ids: UpdateDataScopeRuleParam) -> int:
+    @staticmethod
+    async def update_rules(db: AsyncSession, pk: int, rule_ids: UpdateDataScopeRuleParam) -> int:
         """
         更新数据范围规则
 
@@ -97,11 +114,16 @@ class CRUDDataScope(CRUDPlus[DataScope]):
         :param rule_ids: 数据规则 ID 列表
         :return:
         """
-        current_data_scope = await self.get_with_relation(db, pk)
+        data_scope_rule_stmt = delete(data_scope_rule).where(data_scope_rule.c.data_scope_id == pk)
-        stmt = select(DataRule).where(DataRule.id.in_(rule_ids.rules))
+        await db.execute(data_scope_rule_stmt)
-        rules = await db.execute(stmt)
+
-        current_data_scope.rules = rules.scalars().all()
+        data_scope_rule_data = [
-        return len(current_data_scope.rules)
+            CreateDataScopeRuleParam(data_scope_id=pk, data_rule_id=rule_id).model_dump() for rule_id in rule_ids.rules
+        ]
+        data_scope_rule_stmt = insert(data_scope_rule)
+        await db.execute(data_scope_rule_stmt, data_scope_rule_data)
+
+        return len(rule_ids.rules)
 
     async def delete(self, db: AsyncSession, pks: list[int]) -> int:
         """

backend/app/admin/crud/crud_dept.py

@@ -1,12 +1,13 @@
 from collections.abc import Sequence
+from typing import Any
 
-from fastapi import Request
+from sqlalchemy import ColumnElement
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
-from backend.app.admin.model import Dept
+from backend.app.admin.model import Dept, User
 from backend.app.admin.schema.dept import CreateDeptParam, UpdateDeptParam
-from backend.common.security.permission import filter_data_permission
+from backend.utils.serializers import select_join_serialize
 
 
 class CRUDDept(CRUDPlus[Dept]):
@@ -34,8 +35,8 @@ class CRUDDept(CRUDPlus[Dept]):
 
     async def get_all(
         self,
-        request: Request,
         db: AsyncSession,
+        data_filter: ColumnElement[bool],
         name: str | None,
         leader: str | None,
         phone: str | None,
@@ -44,8 +45,8 @@ class CRUDDept(CRUDPlus[Dept]):
         """
         获取所有部门
 
-        :param request: FastAPI 请求对象
         :param db: 数据库会话
+        :param data_filter: 请求用户
         :param name: 部门名称
         :param leader: 负责人
         :param phone: 联系电话
@@ -63,8 +64,7 @@ class CRUDDept(CRUDPlus[Dept]):
         if status is not None:
             filters['status'] = status
 
-        data_filtered = await filter_data_permission(db, request)
+        return await self.select_models_order(db, 'sort', 'desc', data_filter, **filters)
-        return await self.select_models_order(db, 'sort', 'desc', data_filtered, **filters)
 
     async def create(self, db: AsyncSession, obj: CreateDeptParam) -> None:
         """
@@ -97,7 +97,7 @@ class CRUDDept(CRUDPlus[Dept]):
         """
         return await self.delete_model_by_column(db, id=dept_id, logical_deletion=True, deleted_flag_column='del_flag')
 
-    async def get_with_relation(self, db: AsyncSession, dept_id: int) -> Dept | None:
+    async def get_join(self, db: AsyncSession, dept_id: int) -> Any | None:
         """
         获取部门及关联数据
 
@@ -105,7 +105,12 @@ class CRUDDept(CRUDPlus[Dept]):
         :param dept_id: 部门 ID
         :return:
         """
-        return await self.select_model(db, dept_id, load_strategies=['users'])
+        result = await self.select_model(
+            db,
+            dept_id,
+            join_conditions=[JoinConfig(model=User, join_on=User.dept_id == self.model.id, fill_result=True)],
+        )
+        return select_join_serialize(result, relationships=['Dept-o2m-User'])
 
     async def get_children(self, db: AsyncSession, dept_id: int) -> Sequence[Dept | None]:
         """
@@ -115,7 +120,7 @@ class CRUDDept(CRUDPlus[Dept]):
         :param dept_id: 部门 ID
         :return:
         """
-        return await self.select_models(db, parent_id=dept_id, del_flag=0)
+        return await self.select_models(db, parent_id=dept_id, del_flag=False)
 
 
 dept_dao: CRUDDept = CRUDDept(Dept)

backend/app/admin/crud/crud_menu.py

@@ -1,9 +1,10 @@
 from collections.abc import Sequence
 
+from sqlalchemy import delete
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy_crud_plus import CRUDPlus
 
-from backend.app.admin.model import Menu
+from backend.app.admin.model import Menu, role_menu
 from backend.app.admin.schema.menu import CreateMenuParam, UpdateMenuParam
 
 
@@ -92,9 +93,12 @@ class CRUDMenu(CRUDPlus[Menu]):
         :param menu_id: 菜单 ID
         :return:
         """
+        role_menu_stmt = delete(role_menu).where(role_menu.c.menu_id == menu_id)
+        await db.execute(role_menu_stmt)
+
         return await self.delete_model(db, menu_id)
 
-    async def get_children(self, db: AsyncSession, menu_id: int) -> list[Menu | None]:
+    async def get_children(self, db: AsyncSession, menu_id: int) -> Sequence[Menu | None]:
         """
         获取子菜单列表
 
@@ -102,8 +106,7 @@ class CRUDMenu(CRUDPlus[Menu]):
         :param menu_id: 菜单 ID
         :return:
         """
-        menu = await self.select_model(db, menu_id, load_strategies=['children'])
+        return await self.select_models(db, parent_id=menu_id)
-        return menu.children
 
 
 menu_dao: CRUDMenu = CRUDMenu(Menu)

backend/app/admin/crud/crud_role.py

@@ -1,16 +1,20 @@
 from collections.abc import Sequence
+from typing import Any
 
-from sqlalchemy import Select, select
+from sqlalchemy import Select, delete, insert, select
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy_crud_plus import CRUDPlus
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
 
-from backend.app.admin.model import DataScope, Menu, Role
+from backend.app.admin.model import DataScope, Menu, Role, role_data_scope, role_menu
 from backend.app.admin.schema.role import (
+    CreateRoleMenuParam,
     CreateRoleParam,
+    CreateRoleScopeParam,
     UpdateRoleMenuParam,
     UpdateRoleParam,
     UpdateRoleScopeParam,
 )
+from backend.utils.serializers import select_join_serialize
 
 
 class CRUDRole(CRUDPlus[Role]):
@@ -26,7 +30,20 @@ class CRUDRole(CRUDPlus[Role]):
         """
         return await self.select_model(db, role_id)
 
-    async def get_with_relation(self, db: AsyncSession, role_id: int) -> Role | None:
+    @staticmethod
+    async def get_menus(db: AsyncSession, role_id: int) -> Sequence[Menu] | None:
+        """
+        获取角色菜单
+
+        :param db: 数据库会话
+        :param role_id: 角色 ID
+        :return:
+        """
+        menu_stmt = select(Menu).join(role_menu, Menu.id == role_menu.c.menu_id).where(role_menu.c.role_id == role_id)
+        result = await db.execute(menu_stmt)
+        return result.scalars().all()
+
+    async def get_join(self, db: AsyncSession, role_id: int) -> Any:
         """
         获取角色及关联数据
 
@@ -34,7 +51,18 @@ class CRUDRole(CRUDPlus[Role]):
         :param role_id: 角色 ID
         :return:
         """
-        return await self.select_model(db, role_id, load_strategies=['menus', 'scopes'])
+        result = await self.select_models(
+            db,
+            id=role_id,
+            join_conditions=[
+                JoinConfig(model=role_menu, join_on=role_menu.c.role_id == self.model.id),
+                JoinConfig(model=Menu, join_on=Menu.id == role_menu.c.menu_id, fill_result=True),
+                JoinConfig(model=role_data_scope, join_on=role_data_scope.c.role_id == self.model.id),
+                JoinConfig(model=DataScope, join_on=DataScope.id == role_data_scope.c.data_scope_id, fill_result=True),
+            ],
+        )
+
+        return select_join_serialize(result, relationships=['Role-m2m-Menu', 'Role-m2m-DataScope:scopes'])
 
     async def get_all(self, db: AsyncSession) -> Sequence[Role]:
         """
@@ -61,15 +89,7 @@ class CRUDRole(CRUDPlus[Role]):
         if status is not None:
             filters['status'] = status
 
-        return await self.select_order(
+        return await self.select_order('id', **filters)
-            'id',
-            load_strategies={
-                'users': 'noload',
-                'menus': 'noload',
-                'scopes': 'noload',
-            },
-            **filters,
-        )
 
     async def get_by_name(self, db: AsyncSession, name: str) -> Role | None:
         """
@@ -102,7 +122,8 @@ class CRUDRole(CRUDPlus[Role]):
         """
         return await self.update_model(db, role_id, obj)
 
-    async def update_menus(self, db: AsyncSession, role_id: int, menu_ids: UpdateRoleMenuParam) -> int:
+    @staticmethod
+    async def update_menus(db: AsyncSession, role_id: int, menu_ids: UpdateRoleMenuParam) -> int:
         """
         更新角色菜单
 
@@ -111,13 +132,19 @@ class CRUDRole(CRUDPlus[Role]):
         :param menu_ids: 菜单 ID 列表
         :return:
         """
-        current_role = await self.get_with_relation(db, role_id)
+        role_menu_stmt = delete(role_menu).where(role_menu.c.role_id == role_id)
-        stmt = select(Menu).where(Menu.id.in_(menu_ids.menus))
+        await db.execute(role_menu_stmt)
-        menus = await db.execute(stmt)
-        current_role.menus = menus.scalars().all()
-        return len(current_role.menus)
 
-    async def update_scopes(self, db: AsyncSession, role_id: int, scope_ids: UpdateRoleScopeParam) -> int:
+        role_menu_data = [
+            CreateRoleMenuParam(role_id=role_id, menu_id=menu_id).model_dump() for menu_id in menu_ids.menus
+        ]
+        role_menu_stmt = insert(role_menu)
+        await db.execute(role_menu_stmt, role_menu_data)
+
+        return len(menu_ids.menus)
+
+    @staticmethod
+    async def update_scopes(db: AsyncSession, role_id: int, scope_ids: UpdateRoleScopeParam) -> int:
         """
         更新角色数据范围
 
@@ -126,11 +153,16 @@ class CRUDRole(CRUDPlus[Role]):
         :param scope_ids: 权限范围 ID 列表
         :return:
         """
-        current_role = await self.get_with_relation(db, role_id)
+        role_scope_stmt = delete(role_data_scope).where(role_data_scope.c.role_id == role_id)
-        stmt = select(DataScope).where(DataScope.id.in_(scope_ids.scopes))
+        await db.execute(role_scope_stmt)
-        scopes = await db.execute(stmt)
+
-        current_role.scopes = scopes.scalars().all()
+        role_scope_data = [
-        return len(current_role.scopes)
+            CreateRoleScopeParam(role_id=role_id, data_scope_id=scope_id).model_dump() for scope_id in scope_ids.scopes
+        ]
+        role_scope_stmt = insert(role_data_scope)
+        await db.execute(role_scope_stmt, role_scope_data)
+
+        return len(scope_ids.scopes)
 
     async def delete(self, db: AsyncSession, role_ids: list[int]) -> int:
         """

backend/app/admin/crud/crud_user.py

@@ -1,18 +1,32 @@
+from typing import Any
+
 import bcrypt
 
-from sqlalchemy import select
+from sqlalchemy import Select, delete, insert, select
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import noload, selectinload
+from sqlalchemy_crud_plus import CRUDPlus, JoinConfig
-from sqlalchemy.sql import Select
-from sqlalchemy_crud_plus import CRUDPlus
 
-from backend.app.admin.model import Dept, Role, User
+from backend.app.admin.model import (
+    DataRule,
+    DataScope,
+    Dept,
+    Menu,
+    Role,
+    User,
+    data_scope_rule,
+    role_data_scope,
+    role_menu,
+    user_role,
+)
 from backend.app.admin.schema.user import (
     AddOAuth2UserParam,
     AddUserParam,
+    AddUserRoleParam,
     UpdateUserParam,
 )
-from backend.common.security.jwt import get_hash_password
+from backend.app.admin.utils.password_security import get_hash_password
+from backend.utils.import_parse import import_module_cached
+from backend.utils.serializers import select_join_serialize
 from backend.utils.timezone import timezone
 
 
@@ -49,15 +63,47 @@ class CRUDUser(CRUDPlus[User]):
         """
         return await self.select_model_by_column(db, nickname=nickname)
 
-    async def update_login_time(self, db: AsyncSession, username: str) -> int:
+    async def check_email(self, db: AsyncSession, email: str) -> User | None:
         """
-        更新用户最后登录时间
+        检查邮箱是否已被绑定
 
         :param db: 数据库会话
-        :param username: 用户名
+        :param email: 电子邮箱
         :return:
         """
-        return await self.update_model_by_column(db, {'last_login_time': timezone.now()}, username=username)
+        return await self.select_model_by_column(db, email=email)
+
+    async def get_select(self, dept: int | None, username: str | None, phone: str | None, status: int | None) -> Select:
+        """
+        获取用户列表查询表达式
+
+        :param dept: 部门 ID
+        :param username: 用户名
+        :param phone: 电话号码
+        :param status: 用户状态
+        :return:
+        """
+        filters = {}
+
+        if dept:
+            filters['dept_id'] = dept
+        if username:
+            filters['username__like'] = f'%{username}%'
+        if phone:
+            filters['phone__like'] = f'%{phone}%'
+        if status is not None:
+            filters['status'] = status
+
+        return await self.select_order(
+            'id',
+            'desc',
+            join_conditions=[
+                JoinConfig(model=Dept, join_on=Dept.id == self.model.dept_id, fill_result=True),
+                JoinConfig(model=user_role, join_on=user_role.c.user_id == self.model.id),
+                JoinConfig(model=Role, join_on=Role.id == user_role.c.role_id, fill_result=True),
+            ],
+            **filters,
+        )
 
     async def add(self, db: AsyncSession, obj: AddUserParam) -> None:
         """
@@ -69,15 +115,20 @@ class CRUDUser(CRUDPlus[User]):
         """
         salt = bcrypt.gensalt()
         obj.password = get_hash_password(obj.password, salt)
+
         dict_obj = obj.model_dump(exclude={'roles'})
         dict_obj.update({'salt': salt})
         new_user = self.model(**dict_obj)
-
-        stmt = select(Role).where(Role.id.in_(obj.roles))
-        roles = await db.execute(stmt)
-        new_user.roles = roles.scalars().all()
-
         db.add(new_user)
+        await db.flush()
+
+        role_stmt = select(Role).where(Role.id.in_(obj.roles))
+        result = await db.execute(role_stmt)
+        roles = result.scalars().all()
+
+        user_role_data = [AddUserRoleParam(user_id=new_user.id, role_id=role.id).model_dump() for role in roles]
+        user_role_stmt = insert(user_role)
+        await db.execute(user_role_stmt, user_role_data)
 
     async def add_by_oauth2(self, db: AsyncSession, obj: AddOAuth2UserParam) -> None:
         """
@@ -90,32 +141,63 @@ class CRUDUser(CRUDPlus[User]):
         dict_obj = obj.model_dump()
         dict_obj.update({'is_staff': True, 'salt': None})
         new_user = self.model(**dict_obj)
-
-        stmt = select(Role)
-        role = await db.execute(stmt)
-        new_user.roles = [role.scalars().first()]  # 默认绑定第一个角色
-
         db.add(new_user)
+        await db.flush()
 
-    async def update(self, db: AsyncSession, input_user: User, obj: UpdateUserParam) -> int:
+        role_stmt = select(Role)
+        result = await db.execute(role_stmt)
+        role = result.scalars().first()  # 默认绑定第一个角色
+
+        user_role_stmt = insert(user_role).values(AddUserRoleParam(user_id=new_user.id, role_id=role.id).model_dump())
+        await db.execute(user_role_stmt)
+
+    async def update(self, db: AsyncSession, user_id: int, obj: UpdateUserParam) -> int:
         """
         更新用户信息
 
         :param db: 数据库会话
-        :param input_user: 用户 ID
+        :param user_id: 用户 ID
         :param obj: 更新用户参数
         :return:
         """
         role_ids = obj.roles
         del obj.roles
 
-        count = await self.update_model(db, input_user.id, obj)
+        count = await self.update_model(db, user_id, obj)
+
+        role_stmt = select(Role).where(Role.id.in_(role_ids))
+        result = await db.execute(role_stmt)
+        roles = result.scalars().all()
+
+        user_role_stmt = delete(user_role).where(user_role.c.user_id == user_id)
+        await db.execute(user_role_stmt)
+
+        user_role_data = [AddUserRoleParam(user_id=user_id, role_id=role.id).model_dump() for role in roles]
+        user_role_stmt = insert(user_role)
+        await db.execute(user_role_stmt, user_role_data)
 
-        stmt = select(Role).where(Role.id.in_(role_ids))
-        roles = await db.execute(stmt)
-        input_user.roles = roles.scalars().all()
         return count
 
+    async def update_login_time(self, db: AsyncSession, username: str) -> int:
+        """
+        更新用户上次登录时间
+
+        :param db: 数据库会话
+        :param username: 用户名
+        :return:
+        """
+        return await self.update_model_by_column(db, {'last_login_time': timezone.now()}, username=username)
+
+    async def update_password_changed_time(self, db: AsyncSession, user_id: int) -> int:
+        """
+        更新用户上次密码变更时间
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        return await self.update_model(db, user_id, {'last_password_changed_time': timezone.now()})
+
     async def update_nickname(self, db: AsyncSession, user_id: int, nickname: str) -> int:
         """
         更新用户昵称
@@ -149,26 +231,6 @@ class CRUDUser(CRUDPlus[User]):
         """
         return await self.update_model(db, user_id, {'email': email})
 
-    async def delete(self, db: AsyncSession, user_id: int) -> int:
-        """
-        删除用户
-
-        :param db: 数据库会话
-        :param user_id: 用户 ID
-        :return:
-        """
-        return await self.delete_model(db, user_id)
-
-    async def check_email(self, db: AsyncSession, email: str) -> User | None:
-        """
-        检查邮箱是否已被绑定
-
-        :param db: 数据库会话
-        :param email: 电子邮箱
-        :return:
-        """
-        return await self.select_model_by_column(db, email=email)
-
     async def reset_password(self, db: AsyncSession, pk: int, password: str) -> int:
         """
         重置用户密码
@@ -180,38 +242,7 @@ class CRUDUser(CRUDPlus[User]):
         """
         salt = bcrypt.gensalt()
         new_pwd = get_hash_password(password, salt)
-        return await self.update_model(db, pk, {'password': new_pwd, 'salt': salt})
+        return await self.update_model(db, pk, {'password': new_pwd, 'salt': salt}, flush=True)
-
-    async def get_select(self, dept: int | None, username: str | None, phone: str | None, status: int | None) -> Select:
-        """
-        获取用户列表查询表达式
-
-        :param dept: 部门 ID
-        :param username: 用户名
-        :param phone: 电话号码
-        :param status: 用户状态
-        :return:
-        """
-        filters = {}
-
-        if dept:
-            filters['dept_id'] = dept
-        if username:
-            filters['username__like'] = f'%{username}%'
-        if phone:
-            filters['phone__like'] = f'%{phone}%'
-        if status is not None:
-            filters['status'] = status
-
-        return await self.select_order(
-            'id',
-            'desc',
-            load_options=[
-                selectinload(self.model.dept).options(noload(Dept.parent), noload(Dept.children), noload(Dept.users)),
-                selectinload(self.model.roles).options(noload(Role.users), noload(Role.menus), noload(Role.scopes)),
-            ],
-            **filters,
-        )
 
     async def set_super(self, db: AsyncSession, user_id: int, *, is_super: bool) -> int:
         """
@@ -257,13 +288,34 @@ class CRUDUser(CRUDPlus[User]):
         """
         return await self.update_model(db, user_id, {'is_multi_login': multi_login})
 
-    async def get_with_relation(
+    async def delete(self, db: AsyncSession, user_id: int) -> int:
+        """
+        删除用户
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        user_role_stmt = delete(user_role).where(user_role.c.user_id == user_id)
+        await db.execute(user_role_stmt)
+
+        try:
+            user_social = import_module_cached('backend.plugin.oauth2.crud.crud_user_social')
+            user_social_dao = user_social.user_social_dao
+        except (ImportError, AttributeError):
+            pass
+        else:
+            await user_social_dao.delete_by_user_id(db, user_id)
+
+        return await self.delete_model(db, user_id)
+
+    async def get_join(
         self,
         db: AsyncSession,
         *,
         user_id: int | None = None,
         username: str | None = None,
-    ) -> User | None:
+    ) -> Any | None:
         """
         获取用户关联信息
 
@@ -279,12 +331,32 @@ class CRUDUser(CRUDPlus[User]):
         if username:
             filters['username'] = username
 
-        return await self.select_model_by_column(
+        result = await self.select_models(
             db,
-            load_options=[selectinload(self.model.roles).options(selectinload(Role.menus), selectinload(Role.scopes))],
+            join_conditions=[
-            load_strategies=['dept'],
+                JoinConfig(model=Dept, join_on=Dept.id == self.model.dept_id, fill_result=True),
+                JoinConfig(model=user_role, join_on=user_role.c.user_id == self.model.id),
+                JoinConfig(model=Role, join_on=Role.id == user_role.c.role_id, fill_result=True),
+                JoinConfig(model=role_menu, join_on=role_menu.c.role_id == Role.id),
+                JoinConfig(model=Menu, join_on=Menu.id == role_menu.c.menu_id, fill_result=True),
+                JoinConfig(model=role_data_scope, join_on=role_data_scope.c.role_id == Role.id),
+                JoinConfig(model=DataScope, join_on=DataScope.id == role_data_scope.c.data_scope_id, fill_result=True),
+                JoinConfig(model=data_scope_rule, join_on=data_scope_rule.c.data_scope_id == DataScope.id),
+                JoinConfig(model=DataRule, join_on=DataRule.id == data_scope_rule.c.data_rule_id, fill_result=True),
+            ],
             **filters,
         )
 
+        return select_join_serialize(
+            result,
+            relationships=[
+                'User-m2o-Dept',
+                'User-m2m-Role',
+                'Role-m2m-Menu',
+                'Role-m2m-DataScope:scopes',
+                'DataScope-m2m-DataRule:rules',
+            ],
+        )
+
 
 user_dao: CRUDUser = CRUDUser(User)

backend/app/admin/crud/crud_user_password_history.py

@@ -0,0 +1,34 @@
+from collections.abc import Sequence
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy_crud_plus import CRUDPlus
+
+from backend.app.admin.model.user_password_history import UserPasswordHistory
+from backend.app.admin.schema.user_password_history import CreateUserPasswordHistoryParam
+
+
+class CRUDUserPasswordHistory(CRUDPlus[UserPasswordHistory]):
+    """用户密码历史记录数据库操作类"""
+
+    async def create(self, db: AsyncSession, obj: CreateUserPasswordHistoryParam) -> None:
+        """
+        创建密码历史记录
+
+        :param db: 数据库会话
+        :param obj: 创建密码历史记录参数
+        :return:
+        """
+        await self.create_model(db, obj)
+
+    async def get_by_user_id(self, db: AsyncSession, user_id: int) -> Sequence[UserPasswordHistory]:
+        """
+        获取用户的密码历史记录
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        return await self.select_models_order(db, 'id', 'desc', self.model.user_id == user_id)
+
+
+user_password_history_dao: CRUDUserPasswordHistory = CRUDUserPasswordHistory(UserPasswordHistory)

backend/app/admin/model/__init__.py

@@ -2,7 +2,12 @@ from backend.app.admin.model.data_rule import DataRule as DataRule
 from backend.app.admin.model.data_scope import DataScope as DataScope
 from backend.app.admin.model.dept import Dept as Dept
 from backend.app.admin.model.login_log import LoginLog as LoginLog
+from backend.app.admin.model.m2m import data_scope_rule as data_scope_rule
+from backend.app.admin.model.m2m import role_data_scope as role_data_scope
+from backend.app.admin.model.m2m import role_menu as role_menu
+from backend.app.admin.model.m2m import user_role as user_role
 from backend.app.admin.model.menu import Menu as Menu
 from backend.app.admin.model.opera_log import OperaLog as OperaLog
 from backend.app.admin.model.role import Role as Role
 from backend.app.admin.model.user import User as User
+from backend.app.admin.model.user_password_history import UserPasswordHistory as UserPasswordHistory

backend/app/admin/model/data_rule.py

@@ -1,17 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_data_scope_rule
 from backend.common.model import Base, id_key
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import DataScope
-
 
 class DataRule(Base):
     """数据规则表"""
@@ -20,13 +12,10 @@ class DataRule(Base):
 
     id: Mapped[id_key] = mapped_column(init=False)
     name: Mapped[str] = mapped_column(sa.String(512), unique=True, comment='名称')
-    model: Mapped[str] = mapped_column(sa.String(64), comment='SQLA 模型名，对应 DATA_PERMISSION_MODELS 键名')
+    model: Mapped[str] = mapped_column(sa.String(64), comment='模型名称')
     column: Mapped[str] = mapped_column(sa.String(32), comment='模型字段名')
     operator: Mapped[int] = mapped_column(comment='运算符（0：and、1：or）')
     expression: Mapped[int] = mapped_column(
         comment='表达式（0：==、1：!=、2：>、3：>=、4：<、5：<=、6：in、7：not_in）',
     )
     value: Mapped[str] = mapped_column(sa.String(256), comment='规则值')
-
-    # 数据范围规则多对多
-    scopes: Mapped[list[DataScope]] = relationship(init=False, secondary=sys_data_scope_rule, back_populates='rules')

backend/app/admin/model/data_scope.py

@@ -1,17 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_data_scope_rule, sys_role_data_scope
 from backend.common.model import Base, id_key
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import DataRule, Role
-
 
 class DataScope(Base):
     """数据范围表"""
@@ -21,9 +13,3 @@ class DataScope(Base):
     id: Mapped[id_key] = mapped_column(init=False)
     name: Mapped[str] = mapped_column(sa.String(64), unique=True, comment='名称')
     status: Mapped[int] = mapped_column(default=1, comment='状态（0停用 1正常）')
-
-    # 数据范围规则多对多
-    rules: Mapped[list[DataRule]] = relationship(init=False, secondary=sys_data_scope_rule, back_populates='scopes')
-
-    # 角色数据范围多对多
-    roles: Mapped[list[Role]] = relationship(init=False, secondary=sys_role_data_scope, back_populates='scopes')

backend/app/admin/model/dept.py

@@ -1,16 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
 from backend.common.model import Base, id_key
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import User
-
 
 class Dept(Base):
     """部门表"""
@@ -26,12 +19,5 @@ class Dept(Base):
     status: Mapped[int] = mapped_column(default=1, comment='部门状态(0停用 1正常)')
     del_flag: Mapped[bool] = mapped_column(default=False, comment='删除标志（0删除 1存在）')
 
-    # 父级部门一对多
+    # 父级部门
-    parent_id: Mapped[int | None] = mapped_column(
+    parent_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, index=True, comment='父部门ID')
-        sa.BigInteger, sa.ForeignKey('sys_dept.id', ondelete='SET NULL'), default=None, index=True, comment='父部门ID'
-    )
-    parent: Mapped[Dept | None] = relationship(init=False, back_populates='children', remote_side=[id])
-    children: Mapped[list[Dept] | None] = relationship(init=False, back_populates='parent')
-
-    # 部门用户一对多
-    users: Mapped[list[User]] = relationship(init=False, back_populates='dept')

backend/app/admin/model/login_log.py

@@ -21,7 +21,7 @@ class LoginLog(DataClassBase):
     country: Mapped[str | None] = mapped_column(sa.String(64), comment='国家')
     region: Mapped[str | None] = mapped_column(sa.String(64), comment='地区')
     city: Mapped[str | None] = mapped_column(sa.String(64), comment='城市')
-    user_agent: Mapped[str] = mapped_column(sa.String(256), comment='请求头')
+    user_agent: Mapped[str | None] = mapped_column(sa.String(256), comment='请求头')
     os: Mapped[str | None] = mapped_column(sa.String(64), comment='操作系统')
     browser: Mapped[str | None] = mapped_column(sa.String(64), comment='浏览器')
     device: Mapped[str | None] = mapped_column(sa.String(64), comment='设备')

backend/app/admin/model/m2m.py

@@ -2,62 +2,38 @@ import sqlalchemy as sa
 
 from backend.common.model import MappedBase
 
-sys_user_role = sa.Table(
+# 用户角色表
+user_role = sa.Table(
     'sys_user_role',
     MappedBase.metadata,
     sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    sa.Column(
+    sa.Column('user_id', sa.BigInteger, primary_key=True, comment='用户ID'),
-        'user_id', sa.BigInteger, sa.ForeignKey('sys_user.id', ondelete='CASCADE'), primary_key=True, comment='用户ID'
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色ID'),
-    ),
-    sa.Column(
-        'role_id', sa.BigInteger, sa.ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色ID'
-    ),
 )
 
-sys_role_menu = sa.Table(
+# 角色菜单表
+role_menu = sa.Table(
     'sys_role_menu',
     MappedBase.metadata,
     sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    sa.Column(
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色ID'),
-        'role_id', sa.BigInteger, sa.ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色ID'
+    sa.Column('menu_id', sa.BigInteger, primary_key=True, comment='菜单ID'),
-    ),
-    sa.Column(
-        'menu_id', sa.BigInteger, sa.ForeignKey('sys_menu.id', ondelete='CASCADE'), primary_key=True, comment='菜单ID'
-    ),
 )
 
-sys_role_data_scope = sa.Table(
+# 角色数据范围表
+role_data_scope = sa.Table(
     'sys_role_data_scope',
     MappedBase.metadata,
     sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键 ID'),
-    sa.Column(
+    sa.Column('role_id', sa.BigInteger, primary_key=True, comment='角色 ID'),
-        'role_id', sa.BigInteger, sa.ForeignKey('sys_role.id', ondelete='CASCADE'), primary_key=True, comment='角色 ID'
+    sa.Column('data_scope_id', sa.BigInteger, primary_key=True, comment='数据范围 ID'),
-    ),
-    sa.Column(
-        'data_scope_id',
-        sa.BigInteger,
-        sa.ForeignKey('sys_data_scope.id', ondelete='CASCADE'),
-        primary_key=True,
-        comment='数据范围 ID',
-    ),
 )
 
-sys_data_scope_rule = sa.Table(
+# 数据范围规则表
+data_scope_rule = sa.Table(
     'sys_data_scope_rule',
     MappedBase.metadata,
     sa.Column('id', sa.BigInteger, primary_key=True, unique=True, index=True, autoincrement=True, comment='主键ID'),
-    sa.Column(
+    sa.Column('data_scope_id', sa.BigInteger, primary_key=True, comment='数据范围 ID'),
-        'data_scope_id',
+    sa.Column('data_rule_id', sa.BigInteger, primary_key=True, comment='数据规则 ID'),
-        sa.BigInteger,
-        sa.ForeignKey('sys_data_scope.id', ondelete='CASCADE'),
-        primary_key=True,
-        comment='数据范围 ID',
-    ),
-    sa.Column(
-        'data_rule_id',
-        sa.BigInteger,
-        sa.ForeignKey('sys_data_rule.id', ondelete='CASCADE'),
-        primary_key=True,
-        comment='数据规则 ID',
-    ),
 )

backend/app/admin/model/menu.py

@@ -1,17 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_role_menu
 from backend.common.model import Base, UniversalText, id_key
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import Role
-
 
 class Menu(Base):
     """菜单表"""
@@ -33,12 +25,5 @@ class Menu(Base):
     link: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='外链地址')
     remark: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='备注')
 
-    # 父级菜单一对多
+    # 父级菜单
-    parent_id: Mapped[int | None] = mapped_column(
+    parent_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, index=True, comment='父菜单ID')
-        sa.BigInteger, sa.ForeignKey('sys_menu.id', ondelete='SET NULL'), default=None, index=True, comment='父菜单ID'
-    )
-    parent: Mapped[Menu | None] = relationship(init=False, back_populates='children', remote_side=[id])
-    children: Mapped[list[Menu] | None] = relationship(init=False, back_populates='parent')
-
-    # 菜单角色多对多
-    roles: Mapped[list[Role]] = relationship(init=False, secondary=sys_role_menu, back_populates='menus')

backend/app/admin/model/opera_log.py

@@ -23,7 +23,7 @@ class OperaLog(DataClassBase):
     country: Mapped[str | None] = mapped_column(sa.String(64), comment='国家')
     region: Mapped[str | None] = mapped_column(sa.String(64), comment='地区')
     city: Mapped[str | None] = mapped_column(sa.String(64), comment='城市')
-    user_agent: Mapped[str] = mapped_column(sa.String(512), comment='请求头')
+    user_agent: Mapped[str | None] = mapped_column(sa.String(512), comment='请求头')
     os: Mapped[str | None] = mapped_column(sa.String(64), comment='操作系统')
     browser: Mapped[str | None] = mapped_column(sa.String(64), comment='浏览器')
     device: Mapped[str | None] = mapped_column(sa.String(64), comment='设备')

backend/app/admin/model/role.py

@@ -1,17 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_role_data_scope, sys_role_menu, sys_user_role
 from backend.common.model import Base, UniversalText, id_key
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import DataScope, Menu, User
-
 
 class Role(Base):
     """角色表"""
@@ -23,12 +15,3 @@ class Role(Base):
     status: Mapped[int] = mapped_column(default=1, comment='角色状态（0停用 1正常）')
     is_filter_scopes: Mapped[bool] = mapped_column(default=True, comment='过滤数据权限(0否 1是)')
     remark: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='备注')
-
-    # 角色用户多对多
-    users: Mapped[list[User]] = relationship(init=False, secondary=sys_user_role, back_populates='roles')
-
-    # 角色菜单多对多
-    menus: Mapped[list[Menu]] = relationship(init=False, secondary=sys_role_menu, back_populates='roles')
-
-    # 角色数据范围多对多
-    scopes: Mapped[list[DataScope]] = relationship(init=False, secondary=sys_role_data_scope, back_populates='roles')

backend/app/admin/model/user.py

@@ -1,20 +1,13 @@
-from __future__ import annotations
-
 from datetime import datetime
-from typing import TYPE_CHECKING
 
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
-from backend.app.admin.model.m2m import sys_user_role
 from backend.common.model import Base, TimeZone, id_key
 from backend.database.db import uuid4_str
 from backend.utils.timezone import timezone
 
-if TYPE_CHECKING:
-    from backend.app.admin.model import Dept, Role
-
 
 class User(Base):
     """用户表"""
@@ -36,14 +29,11 @@ class User(Base):
     is_multi_login: Mapped[bool] = mapped_column(default=False, comment='是否重复登陆(0否 1是)')
     join_time: Mapped[datetime] = mapped_column(TimeZone, init=False, default_factory=timezone.now, comment='注册时间')
     last_login_time: Mapped[datetime | None] = mapped_column(
-        TimeZone, init=False, onupdate=timezone.now, comment='上次登录'
+        TimeZone, init=False, onupdate=timezone.now, comment='上次登录时间'
+    )
+    last_password_changed_time: Mapped[datetime | None] = mapped_column(
+        TimeZone, init=False, default_factory=timezone.now, comment='上次密码变更时间'
     )
 
-    # 部门用户一对多
+    # 逻辑外键
-    dept_id: Mapped[int | None] = mapped_column(
+    dept_id: Mapped[int | None] = mapped_column(sa.BigInteger, default=None, comment='部门关联ID')
-        sa.BigInteger, sa.ForeignKey('sys_dept.id', ondelete='SET NULL'), default=None, comment='部门关联ID'
-    )
-    dept: Mapped[Dept | None] = relationship(init=False, back_populates='users')
-
-    # 用户角色多对多
-    roles: Mapped[list[Role]] = relationship(init=False, secondary=sys_user_role, back_populates='users')

backend/app/admin/model/user_password_history.py

@@ -0,0 +1,24 @@
+from datetime import datetime
+
+import sqlalchemy as sa
+
+from sqlalchemy.orm import Mapped, mapped_column
+
+from backend.common.model import DataClassBase, TimeZone, id_key
+from backend.utils.timezone import timezone
+
+
+class UserPasswordHistory(DataClassBase):
+    """用户密码历史记录表"""
+
+    __tablename__ = 'sys_user_password_history'
+
+    id: Mapped[id_key] = mapped_column(init=False)
+    user_id: Mapped[int] = mapped_column(sa.BigInteger, index=True, comment='用户 ID')
+    password: Mapped[str] = mapped_column(sa.String(256), comment='历史密码')
+    created_time: Mapped[datetime] = mapped_column(
+        TimeZone,
+        init=False,
+        default_factory=timezone.now,
+        comment='创建时间',
+    )

backend/app/admin/schema/captcha.py

@@ -6,6 +6,7 @@ from backend.common.schema import SchemaBase
 class GetCaptchaDetail(SchemaBase):
     """验证码详情"""
 
+    is_enabled: bool = Field(description='是否启用')
+    expire_seconds: int = Field(description='过期秒数')
     uuid: str = Field(description='图片唯一标识')
-    img_type: str = Field(description='图片类型')
     image: str = Field(description='图片内容')

backend/app/admin/schema/data_rule.py

@@ -34,7 +34,7 @@ class DeleteDataRuleParam(SchemaBase):
 class GetDataRuleDetail(DataRuleSchemaBase):
     """数据规则详情"""
 
-    model_config = ConfigDict(from_attributes=True)
+    model_config = ConfigDict(from_attributes=True, frozen=True)
 
     id: int = Field(description='规则 ID')
     created_time: datetime = Field(description='创建时间')
@@ -45,4 +45,4 @@ class GetDataRuleColumnDetail(SchemaBase):
     """数据规则可用模型字段详情"""
 
     key: str = Field(description='字段名')
-    comment: str = Field(description='字段评论')
+    comment: str | None = Field(description='字段评论')

backend/app/admin/schema/data_scope.py

@@ -22,6 +22,13 @@ class UpdateDataScopeParam(DataScopeBase):
     """更新数据范围参数"""
 
 
+class CreateDataScopeRuleParam(SchemaBase):
+    """创建数据范围规则参数"""
+
+    data_scope_id: int = Field(description='数据范围 ID')
+    data_rule_id: int = Field(description='数据规则 ID')
+
+
 class UpdateDataScopeRuleParam(SchemaBase):
     """更新数据范围规则参数"""
 
@@ -47,4 +54,4 @@ class GetDataScopeDetail(DataScopeBase):
 class GetDataScopeWithRelationDetail(GetDataScopeDetail):
     """数据范围关联详情"""
 
-    rules: list[GetDataRuleDetail] = Field([], description='数据规则列表')
+    rules: list[GetDataRuleDetail | None] = Field([], description='数据规则列表')

backend/app/admin/schema/login_log.py

@@ -15,7 +15,7 @@ class LoginLogSchemaBase(SchemaBase):
     country: str | None = Field(None, description='国家')
     region: str | None = Field(None, description='地区')
     city: str | None = Field(None, description='城市')
-    user_agent: str = Field(description='用户代理')
+    user_agent: str | None = Field(description='用户代理')
     browser: str | None = Field(None, description='浏览器')
     os: str | None = Field(None, description='操作系统')
     device: str | None = Field(None, description='设备')

backend/app/admin/schema/opera_log.py

@@ -19,7 +19,7 @@ class OperaLogSchemaBase(SchemaBase):
     country: str | None = Field(None, description='国家')
     region: str | None = Field(None, description='地区')
     city: str | None = Field(None, description='城市')
-    user_agent: str = Field(description='用户代理')
+    user_agent: str | None = Field(description='用户代理')
     os: str | None = Field(None, description='操作系统')
     browser: str | None = Field(None, description='浏览器')
     device: str | None = Field(None, description='设备')

backend/app/admin/schema/role.py

@@ -2,7 +2,7 @@ from datetime import datetime
 
 from pydantic import ConfigDict, Field
 
-from backend.app.admin.schema.data_scope import GetDataScopeDetail
+from backend.app.admin.schema.data_scope import GetDataScopeWithRelationDetail
 from backend.app.admin.schema.menu import GetMenuDetail
 from backend.common.enums import StatusType
 from backend.common.schema import SchemaBase
@@ -31,12 +31,26 @@ class DeleteRoleParam(SchemaBase):
     pks: list[int] = Field(description='角色 ID 列表')
 
 
+class CreateRoleMenuParam(SchemaBase):
+    """创建角色菜单参数"""
+
+    role_id: int = Field(description='角色 ID')
+    menu_id: int = Field(description='菜单 ID')
+
+
 class UpdateRoleMenuParam(SchemaBase):
     """更新角色菜单参数"""
 
     menus: list[int] = Field(description='菜单 ID 列表')
 
 
+class CreateRoleScopeParam(SchemaBase):
+    """创建角色数据范围参数"""
+
+    role_id: int = Field(description='角色 ID')
+    data_scope_id: int = Field(description='数据范围 ID')
+
+
 class UpdateRoleScopeParam(SchemaBase):
     """更新角色数据范围参数"""
 
@@ -57,4 +71,4 @@ class GetRoleWithRelationDetail(GetRoleDetail):
     """角色关联详情"""
 
     menus: list[GetMenuDetail | None] = Field([], description='菜单详情列表')
-    scopes: list[GetDataScopeDetail | None] = Field([], description='数据范围列表')
+    scopes: list[GetDataScopeWithRelationDetail | None] = Field([], description='数据范围列表')

backend/app/admin/schema/token.py

@@ -30,6 +30,7 @@ class GetNewToken(AccessTokenBase):
 class GetLoginToken(AccessTokenBase):
     """获取登录令牌"""
 
+    password_expire_days_remaining: int | None = Field(None, description='密码过期剩余天数')
     user: GetUserInfoDetail = Field(description='用户信息')
 
 

backend/app/admin/schema/user.py

@@ -20,8 +20,8 @@ class AuthSchemaBase(SchemaBase):
 class AuthLoginParam(AuthSchemaBase):
     """用户登录参数"""
 
-    uuid: str = Field(description='验证码 UUID')
+    uuid: str | None = Field(None, description='验证码 UUID')
-    captcha: str = Field(description='验证码')
+    captcha: str | None = Field(None, description='验证码')
 
 
 class AddUserParam(AuthSchemaBase):
@@ -34,6 +34,13 @@ class AddUserParam(AuthSchemaBase):
     roles: list[int] = Field(description='角色 ID 列表')
 
 
+class AddUserRoleParam(SchemaBase):
+    """添加用户角色"""
+
+    user_id: int = Field(description='用户 ID')
+    role_id: int = Field(description='角色 ID')
+
+
 class AddOAuth2UserParam(AuthSchemaBase):
     """添加 OAuth2 用户参数"""
 

backend/app/admin/schema/user_password_history.py

@@ -0,0 +1,14 @@
+from pydantic import Field
+
+from backend.common.schema import SchemaBase
+
+
+class UserPasswordHistoryBase(SchemaBase):
+    """用户历史密码记录基础模型"""
+
+    user_id: int = Field(description='用户 ID')
+    password: str = Field(description='历史密码')
+
+
+class CreateUserPasswordHistoryParam(UserPasswordHistoryBase):
+    """创建用户历史密码记录"""

backend/app/admin/service/auth_service.py

@@ -9,6 +9,8 @@ from backend.app.admin.model import User
 from backend.app.admin.schema.token import GetLoginToken, GetNewToken
 from backend.app.admin.schema.user import AuthLoginParam
 from backend.app.admin.service.login_log_service import login_log_service
+from backend.app.admin.service.user_password_history_service import password_security_service
+from backend.app.admin.utils.password_security import password_verify
 from backend.common.context import ctx
 from backend.common.enums import LoginLogStatusType
 from backend.common.exception import errors
@@ -21,11 +23,11 @@ from backend.common.security.jwt import (
     create_refresh_token,
     get_token,
     jwt_decode,
-    password_verify,
 )
 from backend.core.conf import settings
 from backend.database.db import uuid4_str
 from backend.database.redis import redis_client
+from backend.utils.dynamic_config import load_login_config
 from backend.utils.timezone import timezone
 
 
@@ -33,7 +35,7 @@ class AuthService:
     """认证服务类"""
 
     @staticmethod
-    async def user_verify(db: AsyncSession, username: str, password: str) -> User:
+    async def user_verify(db: AsyncSession, username: str, password: str) -> tuple[User, int | None]:
         """
         验证用户名和密码
 
@@ -46,15 +48,19 @@ class AuthService:
         if not user:
             raise errors.NotFoundError(msg='用户名或密码有误')
 
-        if user.password is None:
+        await password_security_service.check_status(user.id, user.status)
-            raise errors.AuthorizationError(msg='用户名或密码有误')
+
-        if not password_verify(password, user.password):
+        if user.password is None or not password_verify(password, user.password):
+            await password_security_service.handle_login_failure(db, user.id)
             raise errors.AuthorizationError(msg='用户名或密码有误')
 
-        if not user.status:
+        days_remaining = await password_security_service.check_password_expiry_status(
-            raise errors.AuthorizationError(msg='用户已被锁定, 请联系统管理员')
+            db, user.last_password_changed_time
+        )
 
-        return user
+        await password_security_service.handle_login_success(user.id)
+
+        return user, days_remaining
 
     async def swagger_login(self, *, db: AsyncSession, obj: HTTPBasicCredentials) -> tuple[str, User]:
         """
@@ -64,15 +70,15 @@ class AuthService:
         :param obj: 登录凭证
         :return:
         """
-        user = await self.user_verify(db, obj.username, obj.password)
+        user, _ = await self.user_verify(db, obj.username, obj.password)
         await user_dao.update_login_time(db, obj.username)
-        access_token = await create_access_token(
+        access_token_data = await create_access_token(
             user.id,
             multi_login=user.is_multi_login,
             # extra info
             swagger=True,
         )
-        return access_token.access_token, user
+        return access_token_data.access_token, user
 
     async def login(
         self,
@@ -86,7 +92,6 @@ class AuthService:
         用户登录
 
         :param db: 数据库会话
-        :param request: 请求对象
         :param response: 响应对象
         :param obj: 登录参数
         :param background_tasks: 后台任务
@@ -94,16 +99,22 @@ class AuthService:
         """
         user = None
         try:
-            user = await self.user_verify(db, obj.username, obj.password)
+            user, days_remaining = await self.user_verify(db, obj.username, obj.password)
-            captcha_code = await redis_client.get(f'{settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{obj.uuid}')
+
-            if not captcha_code:
+            await load_login_config(db)
-                raise errors.RequestError(msg=t('error.captcha.expired'))
+            if settings.LOGIN_CAPTCHA_ENABLED:
-            if captcha_code.lower() != obj.captcha.lower():
+                if not obj.uuid or not obj.captcha:
-                raise errors.CustomError(error=CustomErrorCode.CAPTCHA_ERROR)
+                    raise errors.RequestError(msg=t('error.captcha.invalid'))
-            await redis_client.delete(f'{settings.CAPTCHA_LOGIN_REDIS_PREFIX}:{obj.uuid}')
+                captcha_code = await redis_client.get(f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{obj.uuid}')
+                if not captcha_code:
+                    raise errors.RequestError(msg=t('error.captcha.expired'))
+                if captcha_code.lower() != obj.captcha.lower():
+                    raise errors.CustomError(error=CustomErrorCode.CAPTCHA_ERROR)
+                await redis_client.delete(f'{settings.LOGIN_CAPTCHA_REDIS_PREFIX}:{obj.uuid}')
+
             await user_dao.update_login_time(db, obj.username)
             await db.refresh(user)
-            access_token = await create_access_token(
+            access_token_data = await create_access_token(
                 user.id,
                 multi_login=user.is_multi_login,
                 # extra info
@@ -115,16 +126,16 @@ class AuthService:
                 browser=ctx.browser,
                 device=ctx.device,
             )
-            refresh_token = await create_refresh_token(
+            refresh_token_data = await create_refresh_token(
-                access_token.session_uuid,
+                access_token_data.session_uuid,
                 user.id,
                 multi_login=user.is_multi_login,
             )
             response.set_cookie(
                 key=settings.COOKIE_REFRESH_TOKEN_KEY,
-                value=refresh_token.refresh_token,
+                value=refresh_token_data.refresh_token,
                 max_age=settings.COOKIE_REFRESH_TOKEN_EXPIRE_SECONDS,
-                expires=timezone.to_utc(refresh_token.refresh_token_expire_time),
+                expires=timezone.to_utc(refresh_token_data.refresh_token_expire_time),
                 httponly=True,
             )
         except errors.NotFoundError as e:
@@ -135,7 +146,6 @@ class AuthService:
                 log.error('登陆错误: 用户密码有误')
             task = BackgroundTask(
                 login_log_service.create,
-                db=db,
                 user_uuid=user.uuid if user else uuid4_str(),
                 username=obj.username,
                 login_time=timezone.now(),
@@ -149,7 +159,6 @@ class AuthService:
         else:
             background_tasks.add_task(
                 login_log_service.create,
-                db=db,
                 user_uuid=user.uuid,
                 username=obj.username,
                 login_time=timezone.now(),
@@ -157,9 +166,10 @@ class AuthService:
                 msg=t('success.login.success'),
             )
             data = GetLoginToken(
-                access_token=access_token.access_token,
+                access_token=access_token_data.access_token,
-                access_token_expire_time=access_token.access_token_expire_time,
+                access_token_expire_time=access_token_data.access_token_expire_time,
-                session_uuid=access_token.session_uuid,
+                session_uuid=access_token_data.session_uuid,
+                password_expire_days_remaining=days_remaining,
                 user=user,  # type: ignore
             )
             return data
@@ -208,7 +218,7 @@ class AuthService:
             raise errors.NotFoundError(msg='用户不存在')
         if not user.status:
             raise errors.AuthorizationError(msg='用户已被锁定, 请联系统管理员')
-        if not user.is_multi_login and await redis_client.keys(match=f'{settings.TOKEN_REDIS_PREFIX}:{user.id}:*'):
+        if not user.is_multi_login and await redis_client.get_prefix(f'{settings.TOKEN_REDIS_PREFIX}:{user.id}:*'):
             raise errors.ForbiddenError(msg='此用户已在异地登录，请重新登录并及时修改密码')
         new_token = await create_new_token(
             refresh_token,
@@ -254,7 +264,7 @@ class AuthService:
         await redis_client.delete(f'{settings.TOKEN_REDIS_PREFIX}:{user_id}:{session_uuid}')
         await redis_client.delete(f'{settings.TOKEN_EXTRA_INFO_REDIS_PREFIX}:{user_id}:{session_uuid}')
         if refresh_token:
-            await redis_client.delete(f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}:{refresh_token}')
+            await redis_client.delete(f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}:{session_uuid}')
 
 
 auth_service: AuthService = AuthService()

backend/app/admin/service/data_rule_service.py

@@ -1,6 +1,7 @@
 from collections.abc import Sequence
 from typing import Any
 
+from sqlalchemy import Table
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from backend.app.admin.crud.crud_data_rule import data_rule_dao
@@ -11,10 +12,11 @@ from backend.app.admin.schema.data_rule import (
     GetDataRuleColumnDetail,
     UpdateDataRuleParam,
 )
+from backend.app.admin.utils.cache import user_cache_manager
 from backend.common.exception import errors
 from backend.common.pagination import paging_data
+from backend.common.security.permission import get_data_permission_models
 from backend.core.conf import settings
-from backend.utils.import_parse import dynamic_import_data_model
 
 
 class DataRuleService:
@@ -38,7 +40,8 @@ class DataRuleService:
     @staticmethod
     async def get_models() -> list[str]:
         """获取所有数据规则可用模型"""
-        return list(settings.DATA_PERMISSION_MODELS.keys())
+        model_exclude = ['DataScope', 'DataRule', 'sys_role_data_scope', 'sys_data_scope_rule']
+        return [m for m in list(get_data_permission_models().keys()) if m not in model_exclude]
 
     @staticmethod
     async def get_columns(model: str) -> list[GetDataRuleColumnDetail]:
@@ -48,13 +51,15 @@ class DataRuleService:
         :param model: 模型名称
         :return:
         """
-        if model not in settings.DATA_PERMISSION_MODELS:
+        available_models = get_data_permission_models()
+        if model not in available_models:
             raise errors.NotFoundError(msg='数据规则可用模型不存在')
-        model_ins = dynamic_import_data_model(settings.DATA_PERMISSION_MODELS[model])
+        model_ins = available_models[model]
 
+        table = model_ins if isinstance(model_ins, Table) else model_ins.__table__
         model_columns = [
             GetDataRuleColumnDetail(key=column.key, comment=column.comment)
-            for column in model_ins.__table__.columns
+            for column in table.columns
             if column.key not in settings.DATA_PERMISSION_COLUMN_EXCLUDE
         ]
         return model_columns
@@ -113,6 +118,7 @@ class DataRuleService:
         if data_rule.name != obj.name and await data_rule_dao.get_by_name(db, obj.name):
             raise errors.ConflictError(msg='数据规则已存在')
         count = await data_rule_dao.update(db, pk, obj)
+        await user_cache_manager.clear_by_data_rule_id(db, [pk])
         return count
 
     @staticmethod
@@ -125,6 +131,7 @@ class DataRuleService:
         :return:
         """
         count = await data_rule_dao.delete(db, obj.pks)
+        await user_cache_manager.clear_by_data_rule_id(db, obj.pks)
         return count
 
 

backend/app/admin/service/data_scope_service.py

@@ -11,10 +11,9 @@ from backend.app.admin.schema.data_scope import (
     UpdateDataScopeParam,
     UpdateDataScopeRuleParam,
 )
+from backend.app.admin.utils.cache import user_cache_manager
 from backend.common.exception import errors
 from backend.common.pagination import paging_data
-from backend.core.conf import settings
-from backend.database.redis import redis_client
 
 
 class DataScopeService:
@@ -57,7 +56,7 @@ class DataScopeService:
         :return:
         """
 
-        data_scope = await data_scope_dao.get_with_relation(db, pk)
+        data_scope = await data_scope_dao.get_join(db, pk)
         if not data_scope:
             raise errors.NotFoundError(msg='数据范围不存在')
         return data_scope
@@ -105,9 +104,7 @@ class DataScopeService:
         if data_scope.name != obj.name and await data_scope_dao.get_by_name(db, obj.name):
             raise errors.ConflictError(msg='数据范围已存在')
         count = await data_scope_dao.update(db, pk, obj)
-        for role in await data_scope.awaitable_attrs.roles:
+        await user_cache_manager.clear_by_data_scope_id(db, [pk])
-            for user in await role.awaitable_attrs.users:
-                await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
@@ -115,11 +112,13 @@ class DataScopeService:
         """
         更新数据范围规则
 
+        :param db: 数据库会话
         :param pk: 范围 ID
         :param rule_ids: 规则 ID 列表
         :return:
         """
         count = await data_scope_dao.update_rules(db, pk, rule_ids)
+        await user_cache_manager.clear_by_data_scope_id(db, [pk])
         return count
 
     @staticmethod
@@ -132,12 +131,7 @@ class DataScopeService:
         :return:
         """
         count = await data_scope_dao.delete(db, obj.pks)
-        for pk in obj.pks:
+        await user_cache_manager.clear_by_data_scope_id(db, obj.pks)
-            data_rule = await data_scope_dao.get(db, pk)
-            if data_rule:
-                for role in await data_rule.awaitable_attrs.roles:
-                    for user in await role.awaitable_attrs.users:
-                        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
 

backend/app/admin/service/dept_service.py

@@ -1,6 +1,6 @@
 from typing import Any
 
-from fastapi import Request
+from sqlalchemy import ColumnElement
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from backend.app.admin.crud.crud_dept import dept_dao
@@ -34,7 +34,7 @@ class DeptService:
     async def get_tree(
         *,
         db: AsyncSession,
-        request: Request,
+        data_filter: ColumnElement[bool],
         name: str | None,
         leader: str | None,
         phone: str | None,
@@ -44,15 +44,14 @@ class DeptService:
         获取部门树形结构
 
         :param db: 数据库会话
-        :param request: FastAPI 请求对象
+        :param data_filter: 请求用户
         :param name: 部门名称
         :param leader: 部门负责人
         :param phone: 联系电话
         :param status: 状态
         :return:
         """
-
+        dept_select = await dept_dao.get_all(db, data_filter, name, leader, phone, status)
-        dept_select = await dept_dao.get_all(request, db, name, leader, phone, status)
         tree_data = get_tree_data(dept_select)
         return tree_data
 
@@ -68,7 +67,7 @@ class DeptService:
         dept = await dept_dao.get_by_name(db, obj.name)
         if dept:
             raise errors.ConflictError(msg='部门名称已存在')
-        if obj.parent_id:
+        if obj.parent_id is not None:
             parent_dept = await dept_dao.get(db, obj.parent_id)
             if not parent_dept:
                 raise errors.NotFoundError(msg='父级部门不存在')
@@ -107,7 +106,9 @@ class DeptService:
         :param pk: 部门 ID
         :return:
         """
-        dept = await dept_dao.get_with_relation(db, pk)
+        dept = await dept_dao.get_join(db, pk)
+        if not dept:
+            raise errors.NotFoundError(msg='部门不存在')
         if dept.users:
             raise errors.ConflictError(msg='部门下存在用户，无法删除')
         children = await dept_dao.get_children(db, pk)

backend/app/admin/service/login_log_service.py

@@ -8,6 +8,7 @@ from backend.app.admin.schema.login_log import CreateLoginLogParam, DeleteLoginL
 from backend.common.context import ctx
 from backend.common.log import log
 from backend.common.pagination import paging_data
+from backend.database.db import async_db_session
 
 
 class LoginLogService:
@@ -30,7 +31,6 @@ class LoginLogService:
     @staticmethod
     async def create(
         *,
-        db: AsyncSession,
         user_uuid: str,
         username: str,
         login_time: datetime,
@@ -40,7 +40,6 @@ class LoginLogService:
         """
         创建登录日志
 
-        :param db: 数据库会话
         :param user_uuid: 用户 UUID
         :param username: 用户名
         :param login_time: 登录时间
@@ -64,7 +63,9 @@ class LoginLogService:
                 msg=msg,
                 login_time=login_time,
             )
-            await login_log_dao.create(db, obj)
+            # 为后台任务创建独立数据库会话
+            async with async_db_session.begin() as db:
+                await login_log_dao.create(db, obj)
         except Exception as e:
             log.error(f'登录日志创建失败: {e}')
 

backend/app/admin/service/menu_service.py

@@ -6,9 +6,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from backend.app.admin.crud.crud_menu import menu_dao
 from backend.app.admin.model import Menu
 from backend.app.admin.schema.menu import CreateMenuParam, UpdateMenuParam
+from backend.app.admin.utils.cache import user_cache_manager
 from backend.common.exception import errors
-from backend.core.conf import settings
-from backend.database.redis import redis_client
 from backend.utils.build_tree import get_tree_data, get_vben5_tree_data
 
 
@@ -54,7 +53,7 @@ class MenuService:
         :param request: FastAPI 请求对象
         :return:
         """
-
+        menu_data = None
         if request.user.is_superuser:
             menu_data = await menu_dao.get_sidebar(db, None)
         else:
@@ -64,8 +63,11 @@ class MenuService:
                 for role in roles:
                     menu_ids.update(menu.id for menu in role.menus)
                 menu_data = await menu_dao.get_sidebar(db, list(menu_ids))
-        menu_tree = get_vben5_tree_data(menu_data)
+
-        return menu_tree
+        if menu_data:
+            return get_vben5_tree_data(menu_data)
+
+        return []
 
     @staticmethod
     async def create(*, db: AsyncSession, obj: CreateMenuParam) -> None:
@@ -109,9 +111,7 @@ class MenuService:
         if obj.parent_id == menu.id:
             raise errors.ForbiddenError(msg='禁止关联自身为父级')
         count = await menu_dao.update(db, pk, obj)
-        for role in await menu.awaitable_attrs.roles:
+        await user_cache_manager.clear_by_menu_id(db, [pk])
-            for user in await role.awaitable_attrs.users:
-                await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
@@ -127,12 +127,9 @@ class MenuService:
         children = await menu_dao.get_children(db, pk)
         if children:
             raise errors.ConflictError(msg='菜单下存在子菜单，无法删除')
-        menu = await menu_dao.get(db, pk)
         count = await menu_dao.delete(db, pk)
-        if menu:
+        if count:
-            for role in await menu.awaitable_attrs.roles:
+            await user_cache_manager.clear_by_menu_id(db, [pk])
-                for user in await role.awaitable_attrs.users:
-                    await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
 

backend/app/admin/service/plugin_service.py

@@ -48,6 +48,8 @@ class PluginService:
         :param repo_url: git 仓库地址
         :return:
         """
+        if settings.ENVIRONMENT != 'dev':
+            raise errors.RequestError(msg='禁止在非开发环境下安装插件')
         if type == PluginType.zip:
             if not file:
                 raise errors.RequestError(msg='ZIP 压缩包不能为空')
@@ -64,6 +66,8 @@ class PluginService:
         :param plugin: 插件名称
         :return:
         """
+        if settings.ENVIRONMENT != 'dev':
+            raise errors.RequestError(msg='禁止在非开发环境下卸载插件')
         plugin_dir = anyio.Path(PLUGIN_DIR / plugin)
         if not await plugin_dir.exists():
             raise errors.NotFoundError(msg='插件不存在')

backend/app/admin/service/role_service.py

@@ -14,10 +14,9 @@ from backend.app.admin.schema.role import (
     UpdateRoleParam,
     UpdateRoleScopeParam,
 )
+from backend.app.admin.utils.cache import user_cache_manager
 from backend.common.exception import errors
 from backend.common.pagination import paging_data
-from backend.core.conf import settings
-from backend.database.redis import redis_client
 from backend.utils.build_tree import get_tree_data
 
 
@@ -34,7 +33,7 @@ class RoleService:
         :return:
         """
 
-        role = await role_dao.get_with_relation(db, pk)
+        role = await role_dao.get_join(db, pk)
         if not role:
             raise errors.NotFoundError(msg='角色不存在')
         return role
@@ -74,10 +73,11 @@ class RoleService:
         :return:
         """
 
-        role = await role_dao.get_with_relation(db, pk)
+        role = await role_dao.get(db, pk)
         if not role:
             raise errors.NotFoundError(msg='角色不存在')
-        menu_tree = get_tree_data(role.menus) if role.menus else []
+        menus = await role_dao.get_menus(db, pk)
+        menu_tree = get_tree_data(menus) if menus else []
         return menu_tree
 
     @staticmethod
@@ -90,7 +90,7 @@ class RoleService:
         :return:
         """
 
-        role = await role_dao.get_with_relation(db, pk)
+        role = await role_dao.get_join(db, pk)
         if not role:
             raise errors.NotFoundError(msg='角色不存在')
         scope_ids = [scope.id for scope in role.scopes]
@@ -128,8 +128,7 @@ class RoleService:
         if role.name != obj.name and await role_dao.get_by_name(db, obj.name):
             raise errors.ConflictError(msg='角色已存在')
         count = await role_dao.update(db, pk, obj)
-        for user in await role.awaitable_attrs.users:
+        await user_cache_manager.clear_by_role_id(db, [pk])
-            await redis_client.delete_prefix(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
@@ -151,8 +150,7 @@ class RoleService:
             if not menu:
                 raise errors.NotFoundError(msg='菜单不存在')
         count = await role_dao.update_menus(db, pk, menu_ids)
-        for user in await role.awaitable_attrs.users:
+        await user_cache_manager.clear_by_role_id(db, [pk])
-            await redis_client.delete_prefix(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
@@ -174,8 +172,7 @@ class RoleService:
             if not scope:
                 raise errors.NotFoundError(msg='数据范围不存在')
         count = await role_dao.update_scopes(db, pk, scope_ids)
-        for user in await role.awaitable_attrs.users:
+        await user_cache_manager.clear_by_role_id(db, [pk])
-            await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
@@ -189,11 +186,7 @@ class RoleService:
         """
 
         count = await role_dao.delete(db, obj.pks)
-        for pk in obj.pks:
+        await user_cache_manager.clear_by_role_id(db, obj.pks)
-            role = await role_dao.get(db, pk)
-            if role:
-                for user in await role.awaitable_attrs.users:
-                    await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
 

backend/app/admin/service/user_password_history_service.py

@@ -0,0 +1,118 @@
+import math
+
+from datetime import datetime, timedelta
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.app.admin.crud.crud_user_password_history import user_password_history_dao
+from backend.app.admin.schema.user_password_history import CreateUserPasswordHistoryParam
+from backend.common.exception import errors
+from backend.core.conf import settings
+from backend.database.redis import redis_client
+from backend.utils.dynamic_config import load_user_security_config
+from backend.utils.timezone import timezone
+
+
+class UserPasswordHistoryService:
+    """用户密码历史服务类"""
+
+    @staticmethod
+    async def check_status(user_id: int, user_status: int) -> None:
+        """
+        检查用户状态
+
+        :param user_id: 用户 ID
+        :param user_status: 用户状态
+        :return:
+        """
+        if not user_status:
+            raise errors.AuthorizationError(msg='用户已被锁定, 请联系统管理员')
+
+        locked_until_str = await redis_client.get(f'{settings.USER_LOCK_REDIS_PREFIX}:{user_id}')
+
+        if locked_until_str:
+            locked_until = timezone.from_str(locked_until_str)
+            now = timezone.now()
+            if locked_until > now:
+                remaining_minutes = math.ceil((locked_until - now).total_seconds() / 60)
+                raise errors.AuthorizationError(msg=f'账号已被锁定，请在 {remaining_minutes} 分钟后重试')
+
+            await redis_client.delete(f'{settings.USER_LOCK_REDIS_PREFIX}:{user_id}')
+            await redis_client.delete(f'{settings.LOGIN_FAILURE_PREFIX}:{user_id}')
+
+    @staticmethod
+    async def handle_login_failure(db: AsyncSession, user_id: int) -> None:
+        """
+        处理登录失败
+
+        :param db: 数据库会话
+        :param user_id: 用户 ID
+        :return:
+        """
+        await load_user_security_config(db)
+
+        if settings.USER_LOCK_THRESHOLD == 0:
+            return
+
+        failure_count = await redis_client.get(f'{settings.LOGIN_FAILURE_PREFIX}:{user_id}')
+        failure_count = int(failure_count) if failure_count else 0
+        failure_count += 1
+        await redis_client.set(f'{settings.LOGIN_FAILURE_PREFIX}:{user_id}', str(failure_count))
+
+        if failure_count >= settings.USER_LOCK_THRESHOLD:
+            locked_until = timezone.now() + timedelta(seconds=settings.USER_LOCK_SECONDS)
+            await redis_client.set(f'{settings.USER_LOCK_REDIS_PREFIX}:{user_id}', timezone.to_str(locked_until))
+            raise errors.AuthorizationError(msg='登录失败次数过多，账号已被锁定')
+
+    @staticmethod
+    async def check_password_expiry_status(db: AsyncSession, password_changed_time: datetime) -> int | None:
+        """
+        检查密码过期状态
+
+        :param db: 数据库会话
+        :param password_changed_time: 密码修改时间
+        :return:
+        """
+        await load_user_security_config(db)
+
+        if settings.USER_PASSWORD_EXPIRY_DAYS == 0:
+            return None
+
+        if not password_changed_time:
+            raise errors.AuthorizationError(msg='密码已过期，请修改密码后重新登录')
+
+        expiry_time = password_changed_time + timedelta(days=settings.USER_PASSWORD_EXPIRY_DAYS)
+        days_remaining = (expiry_time - timezone.now()).days
+
+        if days_remaining < 0:
+            raise errors.AuthorizationError(msg='密码已过期，请修改密码后重新登录')
+
+        if days_remaining <= settings.USER_PASSWORD_REMINDER_DAYS:
+            return days_remaining
+
+        return None
+
+    @staticmethod
+    async def handle_login_success(user_id: int) -> None:
+        """
+        处理登录成功
+
+        :param user_id: 用户 ID
+        :return:
+        """
+        await redis_client.delete(f'{settings.USER_LOCK_REDIS_PREFIX}:{user_id}')
+        await redis_client.delete(f'{settings.LOGIN_FAILURE_PREFIX}:{user_id}')
+
+    @staticmethod
+    async def save_password_history(db: AsyncSession, obj: CreateUserPasswordHistoryParam) -> None:
+        """
+        保存密码历史记录
+
+        :param db: 数据库会话
+        :param obj: 创建密码历史记录参数
+        :return:
+        """
+        await user_password_history_dao.create(db, obj)
+
+
+password_security_service: UserPasswordHistoryService = UserPasswordHistoryService()

backend/app/admin/service/user_service.py

@@ -15,14 +15,18 @@ from backend.app.admin.schema.user import (
     ResetPasswordParam,
     UpdateUserParam,
 )
+from backend.app.admin.schema.user_password_history import CreateUserPasswordHistoryParam
+from backend.app.admin.service.user_password_history_service import password_security_service
+from backend.app.admin.utils.password_security import password_verify, validate_new_password
 from backend.common.context import ctx
 from backend.common.enums import UserPermissionType
 from backend.common.exception import errors
 from backend.common.pagination import paging_data
 from backend.common.response.response_code import CustomErrorCode
-from backend.common.security.jwt import get_token, jwt_decode, password_verify
+from backend.common.security.jwt import get_token, jwt_decode
 from backend.core.conf import settings
 from backend.database.redis import redis_client
+from backend.utils.serializers import select_join_serialize
 
 
 class UserService:
@@ -38,7 +42,7 @@ class UserService:
         :param username: 用户名
         :return:
         """
-        user = await user_dao.get_with_relation(db, user_id=pk, username=username)
+        user = await user_dao.get_join(db, user_id=pk, username=username)
         if not user:
             raise errors.NotFoundError(msg='用户不存在')
         return user
@@ -52,7 +56,7 @@ class UserService:
         :param pk: 用户 ID
         :return:
         """
-        user = await user_dao.get_with_relation(db, user_id=pk)
+        user = await user_dao.get_join(db, user_id=pk)
         if not user:
             raise errors.NotFoundError(msg='用户不存在')
         return user.roles
@@ -70,7 +74,12 @@ class UserService:
         :return:
         """
         user_select = await user_dao.get_select(dept=dept, username=username, phone=phone, status=status)
-        return await paging_data(db, user_select)
+        data = await paging_data(db, user_select)
+        if data['items']:
+            serialized_items = select_join_serialize(data['items'], relationships=['User-m2o-Dept', 'User-m2m-Role'])
+            # 确保返回的是列表，即使只有一个元素
+            data['items'] = [serialized_items] if not isinstance(serialized_items, list) else serialized_items
+        return data
 
     @staticmethod
     async def create(*, db: AsyncSession, obj: AddUserParam) -> None:
@@ -103,15 +112,17 @@ class UserService:
         :param obj: 用户更新参数
         :return:
         """
-        user = await user_dao.get_with_relation(db, user_id=pk)
+        user = await user_dao.get_join(db, user_id=pk)
         if not user:
             raise errors.NotFoundError(msg='用户不存在')
         if obj.username != user.username and await user_dao.get_by_username(db, obj.username):
             raise errors.ConflictError(msg='用户名已注册')
+        if obj.dept_id and obj.dept_id != user.dept_id and not await dept_dao.get(db, dept_id=obj.dept_id):
+            raise errors.NotFoundError(msg='部门不存在')
         for role_id in obj.roles:
             if not await role_dao.get(db, role_id):
                 raise errors.NotFoundError(msg='角色不存在')
-        count = await user_dao.update(db, user, obj)
+        count = await user_dao.update(db, user.id, obj)
         await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
@@ -133,7 +144,7 @@ class UserService:
                     raise errors.NotFoundError(msg='用户不存在')
                 if pk == request.user.id:
                     raise errors.ForbiddenError(msg='禁止修改自身权限')
-                count = await user_dao.set_super(db, pk, is_super=not user.status)
+                count = await user_dao.set_super(db, pk, is_super=not user.is_superuser)
             case UserPermissionType.staff:
                 user = await user_dao.get(db, pk)
                 if not user:
@@ -189,7 +200,14 @@ class UserService:
         user = await user_dao.get(db, pk)
         if not user:
             raise errors.NotFoundError(msg='用户不存在')
+
+        await validate_new_password(db, user.id, password)
         count = await user_dao.reset_password(db, user.id, password)
+
+        history_obj = CreateUserPasswordHistoryParam(user_id=user.id, password=user.password)
+        await password_security_service.save_password_history(db, history_obj)
+        await user_dao.update_password_changed_time(db, user.id)
+
         key_prefix = [
             f'{settings.TOKEN_REDIS_PREFIX}:{user.id}',
             f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user.id}',
@@ -200,93 +218,83 @@ class UserService:
         return count
 
     @staticmethod
-    async def update_nickname(*, db: AsyncSession, request: Request, nickname: str) -> int:
+    async def update_nickname(*, db: AsyncSession, user_id: int, nickname: str) -> int:
         """
         更新当前用户昵称
 
         :param db: 数据库会话
-        :param request: FastAPI 请求对象
+        :param user_id: 用户 ID
         :param nickname: 用户昵称
         :return:
         """
-        token = get_token(request)
+        count = await user_dao.update_nickname(db, user_id, nickname)
-        token_payload = jwt_decode(token)
+        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}')
-        user = await user_dao.get(db, token_payload.id)
-        if not user:
-            raise errors.NotFoundError(msg='用户不存在')
-        count = await user_dao.update_nickname(db, token_payload.id, nickname)
-        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
-    async def update_avatar(*, db: AsyncSession, request: Request, avatar: str) -> int:
+    async def update_avatar(*, db: AsyncSession, user_id: int, avatar: str) -> int:
         """
         更新当前用户头像
 
         :param db: 数据库会话
-        :param request: FastAPI 请求对象
+        :param user_id: 用户 ID
         :param avatar: 头像地址
         :return:
         """
-        token = get_token(request)
+        count = await user_dao.update_avatar(db, user_id, avatar)
-        token_payload = jwt_decode(token)
+        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}')
-        user = await user_dao.get(db, token_payload.id)
-        if not user:
-            raise errors.NotFoundError(msg='用户不存在')
-        count = await user_dao.update_avatar(db, token_payload.id, avatar)
-        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
         return count
 
     @staticmethod
-    async def update_email(*, db: AsyncSession, request: Request, captcha: str, email: str) -> int:
+    async def update_email(*, db: AsyncSession, user_id: int, captcha: str, email: str) -> int:
         """
         更新当前用户邮箱
 
         :param db: 数据库会话
-        :param request: FastAPI 请求对象
+        :param user_id: 用户 ID
         :param captcha: 邮箱验证码
         :param email: 邮箱
         :return:
         """
-        token = get_token(request)
-        token_payload = jwt_decode(token)
-        user = await user_dao.get(db, token_payload.id)
-        if not user:
-            raise errors.NotFoundError(msg='用户不存在')
         captcha_code = await redis_client.get(f'{settings.EMAIL_CAPTCHA_REDIS_PREFIX}:{ctx.ip}')
         if not captcha_code:
             raise errors.RequestError(msg='验证码已失效，请重新获取')
         if captcha != captcha_code:
             raise errors.CustomError(error=CustomErrorCode.CAPTCHA_ERROR)
         await redis_client.delete(f'{settings.EMAIL_CAPTCHA_REDIS_PREFIX}:{ctx.ip}')
-        count = await user_dao.update_email(db, token_payload.id, email)
+        count = await user_dao.update_email(db, user_id, email)
-        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}')
+        await redis_client.delete(f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}')
         return count
 
     @staticmethod
-    async def update_password(*, db: AsyncSession, request: Request, obj: ResetPasswordParam) -> int:
+    async def update_password(*, db: AsyncSession, user_id: int, obj: ResetPasswordParam) -> int:
         """
         更新当前用户密码
 
         :param db: 数据库会话
-        :param request: FastAPI 请求对象
+        :param user_id: 用户 ID
         :param obj: 密码重置参数
         :return:
         """
-        token = get_token(request)
+        user = await user_dao.get(db, user_id)
-        token_payload = jwt_decode(token)
+
-        user = await user_dao.get(db, token_payload.id)
+        if user.password and not password_verify(obj.old_password, user.password):
-        if not user:
-            raise errors.NotFoundError(msg='用户不存在')
-        if not password_verify(obj.old_password, user.password):
             raise errors.RequestError(msg='原密码错误')
+
         if obj.new_password != obj.confirm_password:
-            raise errors.RequestError(msg='密码输入不一致')
+            raise errors.RequestError(msg='两次密码输入不一致')
-        count = await user_dao.reset_password(db, user.id, obj.new_password)
+
+        await validate_new_password(db, user_id, obj.new_password)
+        count = await user_dao.reset_password(db, user_id, obj.new_password)
+
+        history_obj = CreateUserPasswordHistoryParam(user_id=user.id, password=user.password)
+        await password_security_service.save_password_history(db, history_obj)
+        await user_dao.update_password_changed_time(db, user.id)
+
         key_prefix = [
-            f'{settings.TOKEN_REDIS_PREFIX}:{user.id}',
+            f'{settings.TOKEN_REDIS_PREFIX}:{user_id}',
-            f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user.id}',
+            f'{settings.TOKEN_REFRESH_REDIS_PREFIX}:{user_id}',
-            f'{settings.JWT_USER_REDIS_PREFIX}:{user.id}',
+            f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}',
         ]
         for prefix in key_prefix:
             await redis_client.delete_prefix(prefix)

backend/app/admin/utils/cache.py

@@ -0,0 +1,98 @@
+from collections.abc import Sequence
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.app.admin.model import data_scope_rule, role_data_scope, role_menu, user_role
+from backend.core.conf import settings
+from backend.database.redis import redis_client
+
+
+class UserCacheManager:
+    """用户缓存管理"""
+
+    @staticmethod
+    async def clear(user_ids: Sequence[int]) -> None:
+        """
+        清理用户缓存
+
+        :param user_ids: 用户 ID 列表
+        :return:
+        """
+        if user_ids:
+            await redis_client.delete(*[f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}' for user_id in user_ids])
+
+    async def clear_by_role_id(self, db: AsyncSession, role_ids: list[int]) -> None:
+        """
+        通过角色 ID 清理用户缓存
+
+        :param db: 数据库会话
+        :param role_ids: 角色 ID 列表
+        :return:
+        """
+        stmt = select(user_role.c.user_id).where(user_role.c.role_id.in_(role_ids)).distinct()
+        result = await db.execute(stmt)
+        user_ids = result.scalars().all()
+
+        await self.clear(user_ids)
+
+    async def clear_by_menu_id(self, db: AsyncSession, menu_ids: list[int]) -> None:
+        """
+        通过菜单 ID 清理用户缓存
+
+        :param db: 数据库会话
+        :param menu_ids: 菜单 ID 列表
+        :return:
+        """
+        stmt = (
+            select(user_role.c.user_id)
+            .join(role_menu, user_role.c.role_id == role_menu.c.role_id)
+            .where(role_menu.c.menu_id.in_(menu_ids))
+            .distinct()
+        )
+        result = await db.execute(stmt)
+        user_ids = result.scalars().all()
+
+        await self.clear(user_ids)
+
+    async def clear_by_data_scope_id(self, db: AsyncSession, scope_ids: list[int]) -> None:
+        """
+        通过数据范围 ID 清理用户缓存
+
+        :param db: 数据库会话
+        :param scope_ids: 数据范围 ID 列表
+        :return:
+        """
+        stmt = (
+            select(user_role.c.user_id)
+            .join(role_data_scope, user_role.c.role_id == role_data_scope.c.role_id)
+            .where(role_data_scope.c.data_scope_id.in_(scope_ids))
+            .distinct()
+        )
+        result = await db.execute(stmt)
+        user_ids = result.scalars().all()
+
+        await self.clear(user_ids)
+
+    async def clear_by_data_rule_id(self, db: AsyncSession, rule_ids: list[int]) -> None:
+        """
+        通过数据规则 ID 清理用户缓存
+
+        :param db: 数据库会话
+        :param rule_ids: 数据规则 ID 列表
+        :return:
+        """
+        stmt = (
+            select(user_role.c.user_id)
+            .join(role_data_scope, user_role.c.role_id == role_data_scope.c.role_id)
+            .join(data_scope_rule, role_data_scope.c.data_scope_id == data_scope_rule.c.data_scope_id)
+            .where(data_scope_rule.c.data_rule_id.in_(rule_ids))
+            .distinct()
+        )
+        result = await db.execute(stmt)
+        user_ids = result.scalars().all()
+
+        await self.clear(user_ids)
+
+
+user_cache_manager: UserCacheManager = UserCacheManager()

backend/app/admin/utils/password_security.py

@@ -0,0 +1,68 @@
+from pwdlib import PasswordHash
+from pwdlib.hashers.bcrypt import BcryptHasher
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.app.admin.crud.crud_user_password_history import user_password_history_dao
+from backend.common.exception import errors
+from backend.core.conf import settings
+from backend.utils.dynamic_config import load_user_security_config
+from backend.utils.re_verify import is_has_letter, is_has_number, is_has_special_char
+
+password_hash = PasswordHash((BcryptHasher(),))
+
+
+def get_hash_password(password: str, salt: bytes | None) -> str:
+    """
+    使用哈希算法加密密码
+
+    :param password: 密码
+    :param salt: 盐值
+    :return:
+    """
+    return password_hash.hash(password, salt=salt)
+
+
+def password_verify(plain_password: str, hashed_password: str) -> bool:
+    """
+    密码验证
+
+    :param plain_password: 待验证的密码
+    :param hashed_password: 哈希密码
+    :return:
+    """
+    return password_hash.verify(plain_password, hashed_password)
+
+
+async def validate_new_password(db: AsyncSession, user_id: int, new_password: str) -> None:
+    """
+    验证新密码
+
+    :param db: 数据库会话
+    :param user_id: 用户ID
+    :param new_password: 新密码
+    :return:
+    """
+    await load_user_security_config(db)
+
+    if len(new_password) < settings.USER_PASSWORD_MIN_LENGTH:
+        raise errors.RequestError(msg=f'密码长度不能少于 {settings.USER_PASSWORD_MIN_LENGTH} 个字符')
+
+    if len(new_password) > settings.USER_PASSWORD_MAX_LENGTH:
+        raise errors.RequestError(msg=f'密码长度不能超过 {settings.USER_PASSWORD_MAX_LENGTH} 个字符')
+
+    if not is_has_number(new_password):
+        raise errors.RequestError(msg='密码必须包含数字')
+
+    if not is_has_letter(new_password):
+        raise errors.RequestError(msg='密码必须包含字母')
+
+    if settings.USER_PASSWORD_REQUIRE_SPECIAL_CHAR and not is_has_special_char(new_password):
+        raise errors.RequestError(msg='密码必须包含特殊字符（如：!@#$%）')
+
+    password_history = await user_password_history_dao.get_by_user_id(db, user_id)
+
+    for hist in password_history[: settings.USER_PASSWORD_HISTORY_CHECK_COUNT]:
+        if password_verify(new_password, hist.password):
+            raise errors.RequestError(
+                msg=f'新密码不能与最近 {settings.USER_PASSWORD_HISTORY_CHECK_COUNT} 次使用的密码相同'
+            )

backend/app/task/README.md

@@ -16,8 +16,7 @@
 如果你想对任务进行目录层级划分，使任务结构更加清晰，你可以新建任意目录，但必须注意的是
 
 1. 在 `backend/app/task/tasks` 目录下新建 python 包目录
-2. 新建目录后，务必更新 `conf.py` 配置中的 `CELERY_TASKS_PACKAGES`，将新建目录模块路径添加到此列表
+2. 在新建目录下，务必添加 `tasks.py` 文件，并在此文件中编写相关任务代码
-3. 在新建目录下，务必添加 `tasks.py` 文件，并在此文件中编写相关任务代码
 
 ## 消息代理
 

backend/app/task/api/router.py

@@ -5,8 +5,8 @@ from backend.app.task.api.v1.result import router as task_result_router
 from backend.app.task.api.v1.scheduler import router as task_scheduler_router
 from backend.core.conf import settings
 
-v1 = APIRouter(prefix=f'{settings.FASTAPI_API_V1_PATH}/tasks', tags=['任务'])
+v1 = APIRouter(prefix=settings.FASTAPI_API_V1_PATH, tags=['任务'])
 
-v1.include_router(task_control_router)
+v1.include_router(task_control_router, prefix='/tasks')
-v1.include_router(task_result_router, prefix='/results')
+v1.include_router(task_result_router, prefix='/task-results')
 v1.include_router(task_scheduler_router, prefix='/schedulers')

backend/app/task/api/v1/scheduler.py

@@ -117,8 +117,8 @@ async def delete_task_scheduler(
 
 
 @router.post(
-    '/{pk}/executions',
+    '/{pk}/execute',
-    summary='手动执行任务',
+    summary='执行任务',
     dependencies=[
         Depends(RequestPermission('sys:task:exec')),
         DependsRBAC,

backend/app/task/celery.py

@@ -1,9 +1,11 @@
 import os
+import urllib.parse
 
 import celery
 import celery_aio_pool
 
 from backend.app.task.tasks.beat import LOCAL_BEAT_SCHEDULE
+from backend.common.enums import DataBaseType
 from backend.core.conf import settings
 from backend.core.path_conf import BASE_PATH
 
@@ -27,12 +29,12 @@ def init_celery() -> celery.Celery:
     celery.app.trace.build_tracer = celery_aio_pool.build_async_tracer
     celery.app.trace.reset_worker_optimizations()
 
-    broker_url = f'amqp://{settings.CELERY_RABBITMQ_USERNAME}:{settings.CELERY_RABBITMQ_PASSWORD}@{settings.CELERY_RABBITMQ_HOST}:{settings.CELERY_RABBITMQ_PORT}/{settings.CELERY_RABBITMQ_VHOST}'
+    broker_url = f'amqp://{settings.CELERY_RABBITMQ_USERNAME}:{urllib.parse.quote(settings.CELERY_RABBITMQ_PASSWORD)}@{settings.CELERY_RABBITMQ_HOST}:{settings.CELERY_RABBITMQ_PORT}/{settings.CELERY_RABBITMQ_VHOST}'
     if settings.CELERY_BROKER == 'redis':
-        broker_url = f'redis://:{settings.REDIS_PASSWORD}@{settings.REDIS_HOST}:{settings.REDIS_PORT}/{settings.CELERY_BROKER_REDIS_DATABASE}'
+        broker_url = f'redis://:{urllib.parse.quote(settings.REDIS_PASSWORD)}@{settings.REDIS_HOST}:{settings.REDIS_PORT}/{settings.CELERY_BROKER_REDIS_DATABASE}'
 
-    result_backend = f'db+postgresql+psycopg://{settings.DATABASE_USER}:{settings.DATABASE_PASSWORD}@{settings.DATABASE_HOST}:{settings.DATABASE_PORT}/{settings.DATABASE_SCHEMA}'
+    result_backend = f'db+postgresql+psycopg://{settings.DATABASE_USER}:{urllib.parse.quote(settings.DATABASE_PASSWORD)}@{settings.DATABASE_HOST}:{settings.DATABASE_PORT}/{settings.DATABASE_SCHEMA}'
-    if settings.DATABASE_TYPE == 'mysql':
+    if DataBaseType.mysql == settings.DATABASE_TYPE:
         result_backend = result_backend.replace('postgresql+psycopg', 'mysql+pymysql')
 
     # https://docs.celeryq.dev/en/stable/userguide/configuration.html
@@ -51,6 +53,8 @@ def init_celery() -> celery.Celery:
         task_track_started=True,
         enable_utc=False,
         timezone=settings.DATETIME_TIMEZONE,
+        worker_send_task_events=True,
+        task_send_sent_event=True,
     )
 
     # 在 Celery 中设置此参数无效

backend/app/task/model/result.py

@@ -1,11 +1,10 @@
-from datetime import datetime, timezone
-
 import sqlalchemy as sa
 
 from celery import states
 from sqlalchemy.types import PickleType
 
-from backend.common.model import MappedBase
+from backend.common.model import MappedBase, TimeZone
+from backend.utils.timezone import timezone
 
 """
 重写 celery.backends.database.models 内部所有模型，适配 fba 创建表和 alembic 迁移
@@ -23,9 +22,9 @@ class Task(MappedBase):
     status = sa.Column(sa.String(64), default=states.PENDING)
     result = sa.Column(PickleType, nullable=True)
     date_done = sa.Column(
-        sa.DateTime,
+        TimeZone,
-        default=datetime.now(timezone.utc),
+        default=timezone.now,
-        onupdate=datetime.now(timezone.utc),
+        onupdate=timezone.now,
         nullable=True,
     )
     traceback = sa.Column(sa.Text, nullable=True)
@@ -87,7 +86,7 @@ class TaskSet(MappedBase):
     id = sa.Column(sa.Integer, sa.Sequence('taskset_id_sequence'), autoincrement=True, primary_key=True)
     taskset_id = sa.Column(sa.String(155), unique=True)
     result = sa.Column(PickleType, nullable=True)
-    date_done = sa.Column(sa.DateTime, default=datetime.now(timezone.utc), nullable=True)
+    date_done = sa.Column(TimeZone, default=timezone.now, nullable=True)
 
     def __init__(self, taskset_id, result) -> None:  # noqa: ANN001
         self.taskset_id = taskset_id

backend/celery-start.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-# work && beat
-celery -A backend.app.task.celery worker -l info -P gevent -c 100 &
-
-# beat
-celery -A backend.app.task.celery beat -l info &
-
-# flower
-celery -A backend.app.task.celery flower --port=8555 --basic-auth=admin:123456

backend/cli.py

@@ -1,32 +1,42 @@
 import asyncio
+import re
+import secrets
 import subprocess
+import sys
 
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Annotated, Literal
 
+import anyio
 import cappa
 import granian
 
 from cappa.output import error_format
 from rich.panel import Panel
-from rich.prompt import IntPrompt
+from rich.prompt import IntPrompt, Prompt
 from rich.table import Table
 from rich.text import Text
 from sqlalchemy import text
+from sqlalchemy.ext.asyncio import create_async_engine
 from watchfiles import PythonFilter
 
 from backend import __version__
 from backend.common.enums import DataBaseType, PrimaryKeyType
 from backend.common.exception.errors import BaseExceptionError
 from backend.core.conf import settings
-from backend.database.db import async_db_session
+from backend.core.path_conf import (
-from backend.plugin.code_generator.schema.code import ImportParam
+    ENV_EXAMPLE_FILE_PATH,
-from backend.plugin.code_generator.service.business_service import gen_business_service
+    ENV_FILE_PATH,
-from backend.plugin.code_generator.service.code_service import gen_service
+    MYSQL_SCRIPT_DIR,
-from backend.plugin.tools import get_plugin_sql
+    POSTGRESQL_SCRIPT_DIR,
-from backend.utils._await import run_await
+)
+from backend.database.db import async_db_session, create_tables, drop_tables
+from backend.database.redis import redis_client
+from backend.plugin.tools import get_plugin_sql, get_plugins
 from backend.utils.console import console
 from backend.utils.file_ops import install_git_plugin, install_zip_plugin, parse_sql_script
+from backend.utils.import_parse import import_module_cached
 
 output_help = '\n更多信息，尝试 "[cyan]--help[/]"'
 
@@ -38,6 +48,213 @@ class CustomReloadFilter(PythonFilter):
         super().__init__(extra_extensions=['.json', '.yaml', '.yml'])
 
 
+def setup_env_file() -> bool:
+    if not ENV_EXAMPLE_FILE_PATH.exists():
+        console.print('.env.example 文件不存在', style='red')
+        return False
+
+    try:
+        env_content = Path(ENV_EXAMPLE_FILE_PATH).read_text(encoding='utf-8')
+        console.print('配置数据库连接信息...', style='white')
+        db_type = Prompt.ask('数据库类型', choices=['mysql', 'postgresql'], default='postgresql')
+        db_host = Prompt.ask('数据库主机', default='127.0.0.1')
+        db_port = Prompt.ask('数据库端口', default='5432' if db_type == 'postgresql' else '3306')
+        db_user = Prompt.ask('数据库用户名', default='postgres' if db_type == 'postgresql' else 'root')
+        db_password = Prompt.ask('数据库密码', password=True, default='123456')
+
+        console.print('配置 Redis 连接信息...', style='white')
+        redis_host = Prompt.ask('Redis 主机', default='127.0.0.1')
+        redis_port = Prompt.ask('Redis 端口', default='6379')
+        redis_password = Prompt.ask('Redis 密码（留空表示无密码）', password=True, default='')
+        redis_db = Prompt.ask('Redis 数据库编号', default='0')
+
+        console.print('生成 Token 密钥...', style='white')
+        token_secret = secrets.token_urlsafe(32)
+
+        console.print('写入 .env 文件...', style='white')
+        env_content = env_content.replace("DATABASE_TYPE='postgresql'", f"DATABASE_TYPE='{db_type}'")
+        settings.DATABASE_TYPE = db_type
+        env_content = env_content.replace("DATABASE_HOST='127.0.0.1'", f"DATABASE_HOST='{db_host}'")
+        settings.DATABASE_HOST = db_host
+        env_content = env_content.replace('DATABASE_PORT=5432', f'DATABASE_PORT={db_port}')
+        settings.DATABASE_PORT = db_port
+        env_content = env_content.replace("DATABASE_USER='postgres'", f"DATABASE_USER='{db_user}'")
+        settings.DATABASE_USER = db_user
+        env_content = env_content.replace("DATABASE_PASSWORD='123456'", f"DATABASE_PASSWORD='{db_password}'")
+        settings.DATABASE_PASSWORD = db_password
+        env_content = env_content.replace("REDIS_HOST='127.0.0.1'", f"REDIS_HOST='{redis_host}'")
+        settings.REDIS_HOST = redis_host
+        env_content = env_content.replace('REDIS_PORT=6379', f'REDIS_PORT={redis_port}')
+        settings.REDIS_PORT = redis_port
+        env_content = env_content.replace("REDIS_PASSWORD=''", f"REDIS_PASSWORD='{redis_password}'")
+        settings.REDIS_PASSWORD = redis_password
+        env_content = env_content.replace('REDIS_DATABASE=0', f'REDIS_DATABASE={redis_db}')
+        settings.REDIS_DATABASE = redis_db
+        env_content = re.sub(r"TOKEN_SECRET_KEY='[^']*'", f"TOKEN_SECRET_KEY='{token_secret}'", env_content)
+        settings.TOKEN_SECRET_KEY = token_secret
+
+        Path(ENV_FILE_PATH).write_text(env_content, encoding='utf-8')
+        console.print('.env 文件创建成功', style='green')
+    except Exception as e:
+        console.print(f'.env 文件创建失败: {e}', style='red')
+        return False
+    else:
+        return True
+
+
+async def create_database_if_not_exists() -> bool:
+    from sqlalchemy import URL
+
+    try:
+        terminate_sql = None
+        if DataBaseType.mysql == settings.DATABASE_TYPE:
+            url = URL.create(
+                drivername='mysql+asyncmy',
+                username=settings.DATABASE_USER,
+                password=settings.DATABASE_PASSWORD,
+                host=settings.DATABASE_HOST,
+                port=settings.DATABASE_PORT,
+            )
+            check_sql = f"SHOW DATABASES LIKE '{settings.DATABASE_SCHEMA}'"
+            drop_sql = f'DROP DATABASE IF EXISTS `{settings.DATABASE_SCHEMA}`'
+            create_sql = (
+                f'CREATE DATABASE `{settings.DATABASE_SCHEMA}` CHARACTER SET {settings.DATABASE_CHARSET} '
+                f'COLLATE {settings.DATABASE_CHARSET}_unicode_ci'
+            )
+        else:
+            url = URL.create(
+                drivername='postgresql+asyncpg',
+                username=settings.DATABASE_USER,
+                password=settings.DATABASE_PASSWORD,
+                host=settings.DATABASE_HOST,
+                port=settings.DATABASE_PORT,
+                database='postgres',
+            )
+            check_sql = f"SELECT 1 FROM pg_database WHERE datname = '{settings.DATABASE_SCHEMA}'"
+            terminate_sql = (
+                f'SELECT pg_terminate_backend(pid) FROM pg_stat_activity '
+                f"WHERE datname = '{settings.DATABASE_SCHEMA}' AND pid <> pg_backend_pid()"
+            )
+            drop_sql = f'DROP DATABASE IF EXISTS {settings.DATABASE_SCHEMA}'
+            create_sql = f'CREATE DATABASE {settings.DATABASE_SCHEMA}'
+
+        engine = create_async_engine(url, isolation_level='AUTOCOMMIT')
+
+        try:
+            async with engine.connect() as conn:
+                result = await conn.execute(text(check_sql))
+                exists = result.fetchone() is not None
+
+                console.print(f'重建 {settings.DATABASE_SCHEMA} 数据库...', style='white')
+                if exists:
+                    if terminate_sql:
+                        await conn.execute(text(terminate_sql))
+                    await conn.execute(text(drop_sql))
+                await conn.execute(text(create_sql))
+                console.print('数据库创建成功', style='green')
+        finally:
+            await engine.dispose()
+    except Exception as e:
+        console.print(f'数据库创建失败: {e}', style='red')
+        return False
+    else:
+        return True
+
+
+async def auto_init() -> None:
+    """自动化初始化流程"""
+    console.print('\n[bold cyan]步骤 1/3:[/] 配置环境变量', style='bold')
+    panel_content = Text()
+    panel_content.append('【环境变量配置】', style='bold green')
+    panel_content.append('\n\n  • 数据库连接信息')
+    panel_content.append('\n  • Redis 连接信息')
+    panel_content.append('\n  • Token 密钥（自动生成）')
+
+    console.print(Panel(panel_content, title=f'fba (v{__version__}) - 环境变量', border_style='cyan', padding=(1, 2)))
+    if not setup_env_file():
+        raise cappa.Exit('.env 文件配置失败', code=1)
+
+    console.print('\n[bold cyan]步骤 2/3:[/] 数据库创建', style='bold')
+    panel_content = Text()
+    panel_content.append('【数据库配置】', style='bold green')
+    panel_content.append('\n\n  • 类型: ')
+    panel_content.append(f'{settings.DATABASE_TYPE}', style='yellow')
+    panel_content.append('\n  • 数据库：')
+    panel_content.append(f'{settings.DATABASE_SCHEMA}', style='yellow')
+    panel_content.append('\n  • 主机：')
+    panel_content.append(f'{settings.DATABASE_HOST}:{settings.DATABASE_PORT}', style='yellow')
+
+    console.print(Panel(panel_content, title=f'fba (v{__version__}) - 数据库', border_style='cyan', padding=(1, 2)))
+    ok = Prompt.ask('即将[red]新建/重建数据库[/red]，确认继续吗？', choices=['y', 'n'], default='n')
+
+    if ok.lower() == 'y':
+        if not await create_database_if_not_exists():
+            raise cappa.Exit('数据库创建失败', code=1)
+    else:
+        console.print('已取消数据库操作', style='yellow')
+
+    console.print('\n[bold cyan]步骤 3/3:[/] 初始化数据库表和数据', style='bold')
+    await init()
+
+
+async def init() -> None:
+    panel_content = Text()
+    panel_content.append('【数据库配置】', style='bold green')
+    panel_content.append('\n\n  • 类型: ')
+    panel_content.append(f'{settings.DATABASE_TYPE}', style='yellow')
+    panel_content.append('\n  • 数据库：')
+    panel_content.append(f'{settings.DATABASE_SCHEMA}', style='yellow')
+    panel_content.append('\n  • 主机：')
+    panel_content.append(f'{settings.DATABASE_HOST}:{settings.DATABASE_PORT}', style='yellow')
+    panel_content.append('\n  • 主键模式：')
+    panel_content.append(
+        f'{settings.DATABASE_PK_MODE}',
+        style='yellow',
+    )
+    pk_details = panel_content.from_markup(
+        '[link=https://fastapi-practices.github.io/fastapi_best_architecture_docs/backend/reference/pk.html]（了解详情）[/]'
+    )
+    panel_content.append(pk_details)
+    panel_content.append('\n\n【Redis 配置】', style='bold green')
+    panel_content.append('\n\n  • 数据库：')
+    panel_content.append(f'{settings.REDIS_DATABASE}', style='yellow')
+    plugins = get_plugins()
+    panel_content.append('\n\n【已安装插件】', style='bold green')
+    panel_content.append('\n\n  • ')
+    if plugins:
+        panel_content.append(f'{", ".join(plugins)}', style='yellow')
+    else:
+        panel_content.append('无', style='dim')
+
+    console.print(Panel(panel_content, title=f'fba (v{__version__}) - 初始化', border_style='cyan', padding=(1, 2)))
+    ok = Prompt.ask(
+        '即将[red]新建/重建数据库表[/red]并[red]执行所有数据库脚本[/red]，确认继续吗？', choices=['y', 'n'], default='n'
+    )
+
+    if ok.lower() == 'y':
+        console.print('开始初始化...', style='white')
+        try:
+            console.print('清理 Redis 缓存', style='white')
+            await redis_client.delete_prefix(settings.JWT_USER_REDIS_PREFIX)
+            await redis_client.delete_prefix(settings.TOKEN_EXTRA_INFO_REDIS_PREFIX)
+            await redis_client.delete_prefix(settings.TOKEN_REDIS_PREFIX)
+            await redis_client.delete_prefix(settings.TOKEN_REFRESH_REDIS_PREFIX)
+            console.print('重建数据库表', style='white')
+            await drop_tables()
+            await create_tables()
+            console.print('执行 SQL 脚本', style='white')
+            sql_scripts = await get_sql_scripts()
+            for sql_script in sql_scripts:
+                console.print(f'正在执行：{sql_script}', style='white')
+                await execute_sql_scripts(sql_script, is_init=True)
+            console.print('初始化成功', style='green')
+            console.print('\n快试试 [bold cyan]fba run[/bold cyan] 启动服务吧~')
+        except Exception as e:
+            raise cappa.Exit(f'初始化失败：{e}', code=1)
+    else:
+        console.print('已取消初始化操作', style='yellow')
+
+
 def run(host: str, port: int, reload: bool, workers: int) -> None:  # noqa: FBT001
     url = f'http://{host}:{port}'
     docs_url = url + settings.FASTAPI_DOCS_URL
@@ -45,16 +262,32 @@ def run(host: str, port: int, reload: bool, workers: int) -> None:  # noqa: FBT0
     openapi_url = url + (settings.FASTAPI_OPENAPI_URL or '')
 
     panel_content = Text()
-    panel_content.append(f'当前版本: v{__version__}')
+    panel_content.append('Python 版本：', style='bold cyan')
-    panel_content.append(f'\n服务地址: {url}')
+    panel_content.append(f'{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}', style='white')
-    panel_content.append('\n官方文档: https://fastapi-practices.github.io/fastapi_best_architecture_docs/')
+
+    panel_content.append('\nAPI 请求地址: ', style='bold cyan')
+    panel_content.append(f'{url}{settings.FASTAPI_API_V1_PATH}', style='blue')
+
+    panel_content.append('\n\n环境模式：', style='bold green')
+    env_style = 'yellow' if settings.ENVIRONMENT == 'dev' else 'green'
+    panel_content.append(f'{settings.ENVIRONMENT.upper()}', style=env_style)
+
+    plugins = get_plugins()
+    panel_content.append('\n已安装插件：', style='bold green')
+    if plugins:
+        panel_content.append(f'{", ".join(plugins)}', style='yellow')
+    else:
+        panel_content.append('无', style='white')
 
     if settings.ENVIRONMENT == 'dev':
-        panel_content.append(f'\n\n📖 Swagger 文档: {docs_url}', style='yellow')
+        panel_content.append(f'\n\n📖 Swagger 文档: {docs_url}', style='bold magenta')
-        panel_content.append(f'\n📚 Redoc   文档: {redoc_url}', style='blue')
+        panel_content.append(f'\n📚 Redoc   文档: {redoc_url}', style='bold magenta')
-        panel_content.append(f'\n📡 OpenAPI JSON: {openapi_url}', style='green')
+        panel_content.append(f'\n📡 OpenAPI JSON: {openapi_url}', style='bold magenta')
 
-    console.print(Panel(panel_content, title='fba 服务信息', border_style='purple', padding=(1, 2)))
+    panel_content.append('\n🌐 架构官方文档: ', style='bold magenta')
+    panel_content.append('https://fastapi-practices.github.io/fastapi_best_architecture_docs/')
+
+    console.print(Panel(panel_content, title=f'fba (v{__version__})', border_style='purple', padding=(1, 2)))
     granian.Granian(
         target='backend.main:app',
         interface='asgi',
@@ -107,7 +340,7 @@ async def install_plugin(
         raise cappa.Exit('path 和 repo_url 不能同时指定', code=1)
 
     plugin_name = None
-    console.print(Text('开始安装插件...', style='bold cyan'))
+    console.print('开始安装插件...', style='bold cyan')
 
     try:
         if path:
@@ -115,18 +348,40 @@ async def install_plugin(
         if repo_url:
             plugin_name = await install_git_plugin(repo_url=repo_url)
 
-        console.print(Text(f'插件 {plugin_name} 安装成功', style='bold green'))
+        console.print(f'插件 {plugin_name} 安装成功', style='bold green')
 
         sql_file = await get_plugin_sql(plugin_name, db_type, pk_type)
         if sql_file and not no_sql:
-            console.print(Text('开始自动执行插件 SQL 脚本...', style='bold cyan'))
+            console.print('开始自动执行插件 SQL 脚本...', style='bold cyan')
             await execute_sql_scripts(sql_file)
 
     except Exception as e:
         raise cappa.Exit(e.msg if isinstance(e, BaseExceptionError) else str(e), code=1)
 
 
-async def execute_sql_scripts(sql_scripts: str) -> None:
+async def get_sql_scripts() -> list[str]:
+    sql_scripts = []
+    db_script_dir = MYSQL_SCRIPT_DIR if DataBaseType.mysql == settings.DATABASE_TYPE else POSTGRESQL_SCRIPT_DIR
+    main_sql_file = (
+        db_script_dir / 'init_test_data.sql'
+        if PrimaryKeyType.autoincrement == settings.DATABASE_PK_MODE
+        else db_script_dir / 'init_snowflake_test_data.sql'
+    )
+
+    main_sql_path = anyio.Path(main_sql_file)
+    if await main_sql_path.exists():
+        sql_scripts.append(str(main_sql_file))
+
+    plugins = get_plugins()
+    for plugin in plugins:
+        plugin_sql = await get_plugin_sql(plugin, settings.DATABASE_TYPE, settings.DATABASE_PK_MODE)
+        if plugin_sql:
+            sql_scripts.append(str(plugin_sql))
+
+    return sql_scripts
+
+
+async def execute_sql_scripts(sql_scripts: str, *, is_init: bool = False) -> None:
     async with async_db_session.begin() as db:
         try:
             stmts = await parse_sql_script(sql_scripts)
@@ -135,7 +390,8 @@ async def execute_sql_scripts(sql_scripts: str) -> None:
         except Exception as e:
             raise cappa.Exit(f'SQL 脚本执行失败：{e}', code=1)
 
-    console.print(Text('SQL 脚本已执行完成', style='bold green'))
+    if not is_init:
+        console.print('SQL 脚本已执行完成', style='bold green')
 
 
 async def import_table(
@@ -143,18 +399,27 @@ async def import_table(
     table_schema: str,
     table_name: str,
 ) -> None:
+    from backend.plugin.code_generator.schema.code import ImportParam
+    from backend.plugin.code_generator.service.code_service import gen_service
+
     try:
         obj = ImportParam(app=app, table_schema=table_schema, table_name=table_name)
         async with async_db_session.begin() as db:
             await gen_service.import_business_and_model(db=db, obj=obj)
+        console.log('代码生成业务和模型列导入成功', style='bold green')
+        console.log('\n快试试 [bold cyan]fba codegen[/bold cyan] 生成代码吧~')
     except Exception as e:
         raise cappa.Exit(e.msg if isinstance(e, BaseExceptionError) else str(e), code=1)
 
 
-def generate() -> None:
+async def generate() -> None:
+    from backend.plugin.code_generator.service.business_service import gen_business_service
+    from backend.plugin.code_generator.service.code_service import gen_service
+
     try:
         ids = []
-        results = run_await(gen_business_service.get_all)()
+        async with async_db_session() as db:
+            results = await gen_business_service.get_all(db=db)
 
         if not results:
             raise cappa.Exit('[red]暂无可用的代码生成业务！请先通过 import 命令导入！[/]')
@@ -175,14 +440,30 @@ def generate() -> None:
             )
 
         console.print(table)
-        business = IntPrompt.ask('请从中选择一个业务编号', choices=[str(_id) for _id in ids])
+        business = IntPrompt.ask('请从中选择一个业务编号', choices=[str(id_) for id_ in ids])
 
-        gen_path = run_await(gen_service.generate)(pk=business)
+        async with async_db_session.begin() as db:
+            gen_path = await gen_service.generate(db=db, pk=business)
     except Exception as e:
         raise cappa.Exit(e.msg if isinstance(e, BaseExceptionError) else str(e), code=1)
 
-    console.print(Text('\n代码已生成完毕', style='bold green'))
+    console.print('\n代码已生成完成', style='bold green')
-    console.print(Text('\n详情请查看：'), Text(gen_path, style='bold magenta'))
+    console.print(Text('\n详情请查看：'), Text(str(gen_path), style='bold magenta'))
+
+
+@cappa.command(help='初始化 fba 项目', default_long=True)
+@dataclass
+class Init:
+    auto: Annotated[
+        bool,
+        cappa.Arg(default=False, help='自动化初始化模式：自动创建 .env、安装依赖、创建数据库并初始化表结构'),
+    ]
+
+    async def __call__(self) -> None:
+        if self.auto:
+            await auto_init()
+        else:
+            await init()
 
 
 @cappa.command(help='运行 API 服务', default_long=True)
@@ -276,7 +557,7 @@ class Add:
     ]
     db_type: Annotated[
         DataBaseType,
-        cappa.Arg(default='mysql', help='执行插件 SQL 脚本的数据库类型'),
+        cappa.Arg(default='postgresql', help='执行插件 SQL 脚本的数据库类型'),
     ]
     pk_type: Annotated[
         PrimaryKeyType,
@@ -303,17 +584,29 @@ class Import:
         cappa.Arg(short='tn', help='数据库表名'),
     ]
 
+    def __post_init__(self) -> None:
+        try:
+            import_module_cached('backend.plugin.code_generator')
+        except ImportError:
+            raise cappa.Exit('代码生成插件不存在，请先安装此插件')
+
     async def __call__(self) -> None:
         await import_table(self.app, self.table_schema, self.table_name)
 
 
 @cappa.command(name='codegen', help='代码生成（体验完整功能，请自行部署 fba vben 前端工程）', default_long=True)
 @dataclass
-class CodeGenerate:
+class CodeGenerator:
     subcmd: cappa.Subcommands[Import | None] = None
 
-    def __call__(self) -> None:
+    def __post_init__(self) -> None:
-        generate()
+        try:
+            import_module_cached('backend.plugin.code_generator')
+        except ImportError:
+            raise cappa.Exit('代码生成插件不存在，请先安装此插件')
+
+    async def __call__(self) -> None:
+        await generate()
 
 
 @cappa.command(help='一个高效的 fba 命令行界面', default_long=True)
@@ -323,7 +616,7 @@ class FbaCli:
         str,
         cappa.Arg(value_name='PATH', default='', show_default=False, help='在事务中执行 SQL 脚本'),
     ]
-    subcmd: cappa.Subcommands[Run | Celery | Add | CodeGenerate | None] = None
+    subcmd: cappa.Subcommands[Init | Run | Celery | Add | CodeGenerator | None] = None
 
     async def __call__(self) -> None:
         if self.sql:

backend/common/context.py

@@ -13,12 +13,13 @@ class TypedContextProtocol(Protocol):
     region: str | None
     city: str | None
 
-    user_agent: str
+    user_agent: str | None
     os: str | None
     browser: str | None
     device: str | None
 
     permission: str | None
+    language: str
 
 
 class TypedContext(TypedContextProtocol, _Context):

backend/common/dataclasses.py

@@ -17,7 +17,7 @@ class IpInfo:
 
 @dataclasses.dataclass
 class UserAgentInfo:
-    user_agent: str
+    user_agent: str | None
     os: str | None
     browser: str | None
     device: str | None
@@ -70,6 +70,6 @@ class UploadUrl:
 class SnowflakeInfo:
     timestamp: int
     datetime: str
-    cluster_id: int
+    datacenter_id: int
-    node_id: int
+    worker_id: int
     sequence: int

backend/common/enums.py

@@ -103,14 +103,6 @@ class StatusType(IntEnum):
     enable = 1
 
 
-class UserSocialType(StrEnum):
-    """用户社交类型"""
-
-    github = 'GitHub'
-    google = 'Google'
-    linux_do = 'LinuxDo'
-
-
 class FileType(StrEnum):
     """文件类型"""
 

backend/common/exception/exception_handler.py

@@ -2,6 +2,7 @@ from fastapi import FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from pydantic import ValidationError
 from starlette.exceptions import HTTPException
+from starlette.middleware.cors import CORSMiddleware
 from uvicorn.protocols.http.h11_impl import STATUS_PHRASES
 
 from backend.common.context import ctx
@@ -75,7 +76,7 @@ async def _validation_exception_handler(exc: RequestValidationError | Validation
     return MsgSpecJSONResponse(status_code=StandardResponseCode.HTTP_422, content=content)
 
 
-def register_exception(app: FastAPI) -> None:
+def register_exception(app: FastAPI) -> None:  # noqa: C901
     @app.exception_handler(HTTPException)
     async def http_exception_handler(request: Request, exc: HTTPException):
         """
@@ -194,3 +195,55 @@ def register_exception(app: FastAPI) -> None:
             status_code=StandardResponseCode.HTTP_500,
             content=content,
         )
+
+    if settings.MIDDLEWARE_CORS:
+
+        @app.exception_handler(StandardResponseCode.HTTP_500)
+        async def cors_custom_code_500_exception_handler(request: Request, exc: BaseExceptionError | Exception):
+            """
+            跨域自定义 500 异常处理
+
+            :param request: FastAPI 请求对象
+            :param exc: 自定义异常
+            :return:
+            """
+            if isinstance(exc, BaseExceptionError):
+                content = {
+                    'code': exc.code,
+                    'msg': exc.msg,
+                    'data': exc.data,
+                }
+            else:
+                if settings.ENVIRONMENT == 'dev':
+                    content = {
+                        'code': StandardResponseCode.HTTP_500,
+                        'msg': str(exc),
+                        'data': None,
+                    }
+                else:
+                    res = response_base.fail(res=CustomResponseCode.HTTP_500)
+                    content = res.model_dump()
+            content.update(trace_id=get_request_trace_id())
+            response = MsgSpecJSONResponse(
+                status_code=exc.code if isinstance(exc, BaseExceptionError) else StandardResponseCode.HTTP_500,
+                content=content,
+                background=exc.background if isinstance(exc, BaseExceptionError) else None,
+            )
+            origin = request.headers.get('origin')
+            if origin:
+                cors = CORSMiddleware(
+                    app=app,
+                    allow_origins=settings.CORS_ALLOWED_ORIGINS,
+                    allow_credentials=True,
+                    allow_methods=['*'],
+                    allow_headers=['*'],
+                    expose_headers=settings.CORS_EXPOSE_HEADERS,
+                )
+                response.headers.update(cors.simple_headers)
+                has_cookie = 'cookie' in request.headers
+                if cors.allow_all_origins and has_cookie:
+                    response.headers['Access-Control-Allow-Origin'] = origin
+                elif not cors.allow_all_origins and cors.is_allowed_origin(origin=origin):
+                    response.headers['Access-Control-Allow-Origin'] = origin
+                    response.headers.add_vary_header('Origin')
+            return response

backend/common/i18n.py

@@ -6,6 +6,9 @@ from typing import Any
 
 import yaml
 
+from starlette_context.errors import ContextDoesNotExistError
+
+from backend.common.context import ctx
 from backend.core.conf import settings
 from backend.core.path_conf import LOCALE_DIR
 
@@ -15,7 +18,20 @@ class I18n:
 
     def __init__(self) -> None:
         self.locales: dict[str, dict[str, Any]] = {}
-        self.current_language: str = settings.I18N_DEFAULT_LANGUAGE
+        self.load_locales()
+
+    @property
+    def current_language(self) -> str:
+        """获取当前请求的语言"""
+        try:
+            return ctx.language
+        except (AttributeError, LookupError, ContextDoesNotExistError):
+            return settings.I18N_DEFAULT_LANGUAGE
+
+    @current_language.setter
+    def current_language(self, language: str) -> None:
+        """设置当前请求的语言"""
+        ctx.language = language
 
     def load_locales(self) -> None:
         """加载语言文本"""

backend/common/log.py

@@ -47,6 +47,13 @@ def default_formatter(record: logging.LogRecord) -> str:
     return settings.LOG_FORMAT if settings.LOG_FORMAT.endswith('\n') else f'{settings.LOG_FORMAT}\n'
 
 
+def request_id_filter(record: logging.LogRecord) -> logging.LogRecord:
+    """请求 ID 过滤器"""
+    rid = get_request_trace_id()
+    record['request_id'] = rid[: settings.TRACE_ID_LOG_LENGTH]
+    return record
+
+
 def setup_logging() -> None:
     """
     设置日志处理器
@@ -75,12 +82,6 @@ def setup_logging() -> None:
     # 移除 loguru 默认处理器
     logger.remove()
 
-    # request_id 过滤器
-    def request_id_filter(record: logging.LogRecord) -> logging.LogRecord:
-        rid = get_request_trace_id()
-        record['request_id'] = rid[: settings.TRACE_ID_LOG_LENGTH]
-        return record
-
     # 配置 loguru 处理器
     logger.configure(
         handlers=[

backend/common/model.py

@@ -6,6 +6,7 @@ from sqlalchemy.dialects.mysql import LONGTEXT
 from sqlalchemy.ext.asyncio import AsyncAttrs
 from sqlalchemy.orm import DeclarativeBase, Mapped, MappedAsDataclass, declared_attr, mapped_column
 
+from backend.common.enums import DataBaseType, PrimaryKeyType
 from backend.core.conf import settings
 from backend.utils.snowflake import snowflake
 from backend.utils.timezone import timezone
@@ -23,15 +24,11 @@ id_key = Annotated[
         autoincrement=True,
         sort_order=-999,
         comment='主键 ID',
-    ),
+    )
-]
+    if PrimaryKeyType.autoincrement == settings.DATABASE_PK_MODE
-
+    # 雪花算法 Mapped 类型主键
-
+    # 详情：https://fastapi-practices.github.io/fastapi_best_architecture_docs/backend/reference/pk.html
-# 雪花算法 Mapped 类型主键，使用方法与 id_key 相同
+    else mapped_column(
-# 详情：https://fastapi-practices.github.io/fastapi_best_architecture_docs/backend/reference/pk.html
-snowflake_id_key = Annotated[
-    int,
-    mapped_column(
         BigInteger,
         primary_key=True,
         unique=True,
@@ -46,7 +43,7 @@ snowflake_id_key = Annotated[
 class UniversalText(TypeDecorator[str]):
     """PostgreSQL、MySQL 兼容性（长）文本类型"""
 
-    impl = LONGTEXT if settings.DATABASE_TYPE == 'mysql' else Text
+    impl = LONGTEXT if DataBaseType.mysql == settings.DATABASE_TYPE else Text
     cache_ok = True
 
     def process_bind_param(self, value: str | None, dialect) -> str | None:  # noqa: ANN001

backend/common/prometheus/instruments.py

@@ -0,0 +1,35 @@
+from prometheus_client import Counter, Gauge, Histogram
+
+from backend.core.conf import settings
+
+PROMETHEUS_INFO_GAUGE = (
+    Gauge(name='fba_app_info', documentation='fba 应用信息', labelnames=['app_name'])
+    .labels(app_name=settings.GRAFANA_APP_NAME)
+    .inc()
+)
+
+PROMETHEUS_REQUEST_IN_PROGRESS_GAUGE = Gauge(
+    'fba_request_in_progress',
+    '按方法和路径统计请求的衡量',
+    ['app_name', 'method', 'path'],
+)
+
+PROMETHEUS_REQUEST_COUNTER = Counter('fba_request_total', '按方法和路径统计请求总数', ['app_name', 'method', 'path'])
+
+PROMETHEUS_RESPONSE_COUNTER = Counter(
+    'fba_response_total',
+    '按方法、路径和状态码统计响应总数',
+    ['app_name', 'method', 'path', 'status_code'],
+)
+
+PROMETHEUS_EXCEPTION_COUNTER = Counter(
+    'fba_exception_total',
+    '按方法，路径和异常类型统计异常总数',
+    ['app_name', 'method', 'path', 'exception_type'],
+)
+
+PROMETHEUS_REQUEST_COST_TIME_HISTOGRAM = Histogram(
+    'fba_request_cost_time',
+    '按方法和路径划分请求耗时的直方图（以 ms 为单位）',
+    ['app_name', 'method', 'path'],
+)

backend/common/queue.py

@@ -2,6 +2,8 @@ import asyncio
 
 from asyncio import Queue
 
+from backend.common.log import log
+
 
 async def batch_dequeue(queue: Queue, max_items: int, timeout: float) -> list:
     """
@@ -23,5 +25,7 @@ async def batch_dequeue(queue: Queue, max_items: int, timeout: float) -> list:
         await asyncio.wait_for(collector(), timeout=timeout)
     except asyncio.TimeoutError:
         pass
+    except Exception as e:
+        log.error(f'队列批量获取失败: {e}')
 
     return items

backend/common/schema.py

@@ -3,6 +3,8 @@ from typing import Annotated, Any
 
 from pydantic import BaseModel, ConfigDict, EmailStr, Field, validate_email
 
+from backend.common.enums import PrimaryKeyType
+from backend.core.conf import settings
 from backend.utils.timezone import timezone
 
 CustomPhoneNumber = Annotated[str, Field(pattern=r'^1[3-9]\d{9}$')]
@@ -22,12 +24,22 @@ class SchemaBase(BaseModel):
     model_config = ConfigDict(
         use_enum_values=True,
         json_encoders={
-            datetime: lambda x: timezone.to_str(timezone.from_datetime(x))
+            datetime: lambda x: (
-            if x.tzinfo is not None and x.tzinfo != timezone.tz_info
+                timezone.to_str(timezone.from_datetime(x))
-            else timezone.to_str(x),
+                if x.tzinfo is not None and x.tzinfo != timezone.tz_info
+                else timezone.to_str(x)
+            ),
         },
     )
 
+    if PrimaryKeyType.snowflake == settings.DATABASE_PK_MODE:
+        from pydantic import field_serializer
+
+        # 详情：https://fastapi-practices.github.io/fastapi_best_architecture_docs/backend/reference/pk.html#%E6%B3%A8%E6%84%8F%E4%BA%8B%E9%A1%B9
+        @field_serializer('id', check_fields=False)
+        def serialize_id(self, value: int) -> str:
+            return str(value)
+
 
 def ser_string(value: Any) -> str | None:
     if value:

backend/common/security/jwt.py

@@ -1,16 +1,13 @@
 import json
+import uuid
 
 from datetime import timedelta
 from typing import Any
-from uuid import uuid4
 
-from fastapi import Depends, HTTPException, Request
+from fastapi import Depends, Request
 from fastapi.security import HTTPBearer
-from fastapi.security.http import HTTPAuthorizationCredentials
 from fastapi.security.utils import get_authorization_scheme_param
 from jose import ExpiredSignatureError, JWTError, jwt
-from pwdlib import PasswordHash
-from pwdlib.hashers.bcrypt import BcryptHasher
 from pydantic_core import from_json
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -18,56 +15,13 @@ from backend.app.admin.model import User
 from backend.app.admin.schema.user import GetUserInfoWithRelationDetail
 from backend.common.dataclasses import AccessToken, NewToken, RefreshToken, TokenPayload
 from backend.common.exception import errors
-from backend.common.exception.errors import TokenError
 from backend.core.conf import settings
 from backend.database.db import async_db_session
 from backend.database.redis import redis_client
-from backend.utils.serializers import select_as_dict
 from backend.utils.timezone import timezone
 
-
+# JWT dependency injection
-class CustomHTTPBearer(HTTPBearer):
+DependsJwtAuth = Depends(HTTPBearer())
-    """
-    自定义 HTTPBearer 认证类
-
-    Issues: https://github.com/fastapi/fastapi/issues/10177
-    """
-
-    async def __call__(self, request: Request) -> HTTPAuthorizationCredentials | None:
-        try:
-            return await super().__call__(request)
-        except HTTPException as e:
-            if e.status_code == 403:
-                raise TokenError
-            raise
-
-
-# JWT authorizes dependency injection
-DependsJwtAuth = Depends(CustomHTTPBearer())
-
-password_hash = PasswordHash((BcryptHasher(),))
-
-
-def get_hash_password(password: str, salt: bytes | None) -> str:
-    """
-    使用哈希算法加密密码
-
-    :param password: 密码
-    :param salt: 盐值
-    :return:
-    """
-    return password_hash.hash(password, salt=salt)
-
-
-def password_verify(plain_password: str, hashed_password: str) -> bool:
-    """
-    密码验证
-
-    :param plain_password: 待验证的密码
-    :param hashed_password: 哈希密码
-    :return:
-    """
-    return password_hash.verify(plain_password, hashed_password)
 
 
 def jwt_encode(payload: dict[str, Any]) -> str:
@@ -120,7 +74,7 @@ async def create_access_token(user_id: int, *, multi_login: bool, **kwargs) -> A
     :return:
     """
     expire = timezone.now() + timedelta(seconds=settings.TOKEN_EXPIRE_SECONDS)
-    session_uuid = str(uuid4())
+    session_uuid = str(uuid.uuid4())
     access_token = jwt_encode({
         'session_uuid': session_uuid,
         'exp': timezone.to_utc(expire).timestamp(),
@@ -246,7 +200,7 @@ async def get_current_user(db: AsyncSession, pk: int) -> User:
     """
     from backend.app.admin.crud.crud_user import user_dao
 
-    user = await user_dao.get_with_relation(db, user_id=pk)
+    user = await user_dao.get_join(db, user_id=pk)
     if not user:
         raise errors.TokenError(msg='Token 无效')
     if not user.status:
@@ -297,7 +251,7 @@ async def jwt_authentication(token: str) -> GetUserInfoWithRelationDetail:
     if not cache_user:
         async with async_db_session() as db:
             current_user = await get_current_user(db, user_id)
-            user = GetUserInfoWithRelationDetail(**select_as_dict(current_user))
+            user = GetUserInfoWithRelationDetail.model_validate(current_user)
             await redis_client.setex(
                 f'{settings.JWT_USER_REDIS_PREFIX}:{user_id}',
                 settings.TOKEN_EXPIRE_SECONDS,

backend/common/security/permission.py

@@ -1,13 +1,15 @@
+from typing import Any
+
 from fastapi import Request
-from sqlalchemy import ColumnElement, and_, or_
+from sqlalchemy import Alias, ColumnElement, Table, and_, or_
-from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm.util import AliasedClass
+from sqlalchemy_crud_plus.types import Model
 
-from backend.app.admin.crud.crud_data_scope import data_scope_dao
 from backend.common.context import ctx
 from backend.common.enums import RoleDataRuleExpressionType, RoleDataRuleOperatorType
 from backend.common.exception import errors
 from backend.core.conf import settings
-from backend.utils.import_parse import dynamic_import_data_model
+from backend.utils.import_parse import get_all_models
 
 
 class RequestPermission:
@@ -42,86 +44,95 @@ class RequestPermission:
             ctx.permission = self.value
 
 
-async def filter_data_permission(db: AsyncSession, request: Request) -> ColumnElement[bool]:  # noqa: C901
+def get_data_permission_models() -> dict[str, object]:
+    """获取所有可用于数据权限的模型"""
+    return {getattr(model, '__name__', str(model)): model for model in get_all_models()}
+
+
+def filter_data_permission(  # noqa: C901
+    request: Request, *models: type[Model] | AliasedClass | Alias | Table
+) -> ColumnElement[bool]:
     """
     过滤数据权限，控制用户可见数据范围
 
     使用场景：
         - 控制用户能看到哪些数据
 
-    :param db: 数据库会话
     :param request: FastAPI 请求对象
+    :param models: 需要应用数据权限的模型类
     :return:
     """
-    # 是否过滤数据权限
+    # 超级管理员不过滤
     if request.user.is_superuser:
         return or_(1 == 1)
 
+    # 角色未启用数据权限过滤
     for role in request.user.roles:
         if not role.is_filter_scopes:
             return or_(1 == 1)
 
-    # 获取数据范围
+    # 获取数据规则
-    data_scope_ids = set()
+    data_rules = set()
     for role in request.user.roles:
         for scope in role.scopes:
             if scope.status:
-                data_scope_ids.add(scope.id)
+                data_rules.update(scope.rules)
 
-    # 无规则用户不做过滤
+    if not data_rules:
-    if not list(data_scope_ids):
         return or_(1 == 1)
 
-    # 获取数据范围规则
+    # 获取目标模型
-    unique_data_rules = {}
+    model_map = (
-    for data_scope_id in list(data_scope_ids):
+        {getattr(model, '__name__', str(model)): model for model in models} if models else get_data_permission_models()
-        data_scope_with_relation = await data_scope_dao.get_with_relation(db, data_scope_id)
+    )
-        for rule in data_scope_with_relation.rules:
-            unique_data_rules[rule.id] = rule
-
-    # 转换为列表
-    data_rule_list = list(unique_data_rules.values())
 
     where_and_list = []
     where_or_list = []
 
-    for data_rule in data_rule_list:
+    for data_rule in data_rules:
-        # 验证规则模型
+        target_model = model_map.get(data_rule.model)
-        rule_model = data_rule.model
+        if target_model is None:
-        if rule_model not in settings.DATA_PERMISSION_MODELS:
+            continue
-            raise errors.NotFoundError(msg='数据规则模型不存在')
-        model_ins = dynamic_import_data_model(settings.DATA_PERMISSION_MODELS[rule_model])
 
-        # 验证规则列
+        table = target_model if isinstance(target_model, Table) else target_model.__table__
-        model_columns = [
+        rule_column = data_rule.column
-            key for key in model_ins.__table__.columns.keys() if key not in settings.DATA_PERMISSION_COLUMN_EXCLUDE
+        if rule_column not in table.columns.keys():
-        ]
+            continue
-        column = data_rule.column
+        if rule_column in settings.DATA_PERMISSION_COLUMN_EXCLUDE:
-        if column not in model_columns:
+            continue
-            raise errors.NotFoundError(msg='数据规则模型列不存在')
 
         # 构建过滤条件
-        column_obj = getattr(model_ins, column)
+        column_obj = (
-        rule_expression = data_rule.expression
+            getattr(target_model, rule_column) if not isinstance(target_model, Table) else table.columns[rule_column]
+        )
+        column_type = table.columns[rule_column].type.python_type
+
+        def cast_value(value: Any) -> Any:
+            """类型转换"""
+            try:
+                return column_type(value) if column_type is not str else value
+            except (ValueError, TypeError):
+                return value
+
         condition = None
-        match rule_expression:
+        match data_rule.expression:
             case RoleDataRuleExpressionType.eq:
-                condition = column_obj == data_rule.value
+                condition = column_obj == cast_value(data_rule.value)
             case RoleDataRuleExpressionType.ne:
-                condition = column_obj != data_rule.value
+                condition = column_obj != cast_value(data_rule.value)
             case RoleDataRuleExpressionType.gt:
-                condition = column_obj > data_rule.value
+                condition = column_obj > cast_value(data_rule.value)
             case RoleDataRuleExpressionType.ge:
-                condition = column_obj >= data_rule.value
+                condition = column_obj >= cast_value(data_rule.value)
             case RoleDataRuleExpressionType.lt:
-                condition = column_obj < data_rule.value
+                condition = column_obj < cast_value(data_rule.value)
             case RoleDataRuleExpressionType.le:
-                condition = column_obj <= data_rule.value
+                condition = column_obj <= cast_value(data_rule.value)
             case RoleDataRuleExpressionType.in_:
-                values = data_rule.value.split(',') if isinstance(data_rule.value, str) else data_rule.value
+                values = [cast_value(v.strip()) for v in data_rule.value.split(',')]
                 condition = column_obj.in_(values)
             case RoleDataRuleExpressionType.not_in:
-                values = data_rule.value.split(',') if isinstance(data_rule.value, str) else data_rule.value
+                values = [cast_value(v.strip()) for v in data_rule.value.split(',')]
                 condition = column_obj.not_in(values)
 
         # 根据运算符添加到对应列表
@@ -140,3 +151,24 @@ async def filter_data_permission(db: AsyncSession, request: Request) -> ColumnEl
         where_list.append(or_(*where_or_list))
 
     return or_(*where_list) if where_list else or_(1 == 1)
+
+
+# 此函数是为了简化调用方式，但目前无法正常工作: https://github.com/fastapi/fastapi/discussions/14438
+# def DataPermissionFilter(*models: type[Model] | AliasedClass | Alias | Table) -> type[ColumnElement[bool]]:
+#     """
+#     指定模型的数据权限过滤器
+#
+#     :param models: 模型类（可选，支持多个）
+#     :return:
+#     """
+#     return Annotated[ColumnElement[bool], Depends(partial(filter_data_permission, *models))]
+
+
+class DataPermissionFilter:
+    """指定模型的数据权限过滤器"""
+
+    def __init__(self, *models: type[Model] | AliasedClass | Alias | Table) -> None:
+        self.models = models
+
+    async def __call__(self, request: Request) -> ColumnElement[bool]:
+        return filter_data_permission(request, *self.models)

backend/common/socketio/server.py

@@ -1,3 +1,5 @@
+import urllib.parse
+
 import socketio
 
 from backend.common.log import log
@@ -8,7 +10,7 @@ from backend.database.redis import redis_client
 # 创建 Socket.IO 服务器实例
 sio = socketio.AsyncServer(
     client_manager=socketio.AsyncRedisManager(
-        f'redis://:{settings.REDIS_PASSWORD}@{settings.REDIS_HOST}:{settings.REDIS_PORT}/{settings.REDIS_DATABASE}',
+        f'redis://:{urllib.parse.quote(settings.REDIS_PASSWORD)}@{settings.REDIS_HOST}:{settings.REDIS_PORT}/{settings.REDIS_DATABASE}',
     ),
     async_mode='asgi',
     cors_allowed_origins=settings.CORS_ALLOWED_ORIGINS,

backend/core/conf.py

@@ -1,3 +1,5 @@
+import shutil
+
 from functools import lru_cache
 from re import Pattern
 from typing import Any, Literal
@@ -5,14 +7,14 @@ from typing import Any, Literal
 from pydantic import model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-from backend.core.path_conf import BASE_PATH
+from backend.core.path_conf import ENV_EXAMPLE_FILE_PATH, ENV_FILE_PATH
 
 
 class Settings(BaseSettings):
     """全局配置"""
 
     model_config = SettingsConfigDict(
-        env_file=f'{BASE_PATH}/.env',
+        env_file=ENV_FILE_PATH,
         env_file_encoding='utf-8',
         extra='ignore',
         case_sensitive=True,
@@ -23,7 +25,7 @@ class Settings(BaseSettings):
 
     # FastAPI
     FASTAPI_API_V1_PATH: str = '/api/v1'
-    FASTAPI_TITLE: str = 'FastAPI'
+    FASTAPI_TITLE: str = 'fba'
     FASTAPI_DESCRIPTION: str = 'FastAPI Best Architecture'
     FASTAPI_DOCS_URL: str = '/docs'
     FASTAPI_REDOC_URL: str = '/redoc'
@@ -42,6 +44,7 @@ class Settings(BaseSettings):
     DATABASE_POOL_ECHO: bool | Literal['debug'] = False
     DATABASE_SCHEMA: str = 'fba'
     DATABASE_CHARSET: str = 'utf8mb4'
+    DATABASE_PK_MODE: Literal['autoincrement', 'snowflake'] = 'autoincrement'
 
     # .env Redis
     REDIS_HOST: str
@@ -52,6 +55,15 @@ class Settings(BaseSettings):
     # Redis
     REDIS_TIMEOUT: int = 5
 
+    # .env Snowflake
+    SNOWFLAKE_DATACENTER_ID: int | None = None
+    SNOWFLAKE_WORKER_ID: int | None = None
+
+    # Snowflake
+    SNOWFLAKE_REDIS_PREFIX: str = 'fba:snowflake'
+    SNOWFLAKE_HEARTBEAT_INTERVAL_SECONDS: int = 30
+    SNOWFLAKE_NODE_TTL_SECONDS: int = 60
+
     # .env Token
     TOKEN_SECRET_KEY: str  # 密钥 secrets.token_urlsafe(32)
 
@@ -70,6 +82,23 @@ class Settings(BaseSettings):
         rf'^{FASTAPI_API_V1_PATH}/monitors/(redis|server)$',
     ]
 
+    # 用户安全
+    USER_LOCK_REDIS_PREFIX: str = 'fba:user:lock'
+    USER_LOCK_THRESHOLD: int = 5  # 用户密码错误锁定阈值，0 表示禁用锁定
+    USER_LOCK_SECONDS: int = 60 * 5  # 5 分钟
+    USER_PASSWORD_EXPIRY_DAYS: int = 365  # 用户密码有效期，0 表示永不过期
+    USER_PASSWORD_REMINDER_DAYS: int = 7  # 用户密码到期提醒，0 表示不提醒
+    USER_PASSWORD_HISTORY_CHECK_COUNT: int = 3
+    USER_PASSWORD_MIN_LENGTH: int = 6
+    USER_PASSWORD_MAX_LENGTH: int = 32
+    USER_PASSWORD_REQUIRE_SPECIAL_CHAR: bool = False
+
+    # 登录
+    LOGIN_CAPTCHA_ENABLED: bool = True
+    LOGIN_CAPTCHA_REDIS_PREFIX: str = 'fba:login:captcha'
+    LOGIN_CAPTCHA_EXPIRE_SECONDS: int = 60 * 5  # 5 分钟
+    LOGIN_FAILURE_PREFIX: str = 'fba:login:failure'
+
     # JWT
     JWT_USER_REDIS_PREFIX: str = 'fba:user'
 
@@ -84,14 +113,7 @@ class Settings(BaseSettings):
     COOKIE_REFRESH_TOKEN_KEY: str = 'fba_refresh_token'
     COOKIE_REFRESH_TOKEN_EXPIRE_SECONDS: int = 60 * 60 * 24 * 7  # 7 天
 
-    # 验证码
-    CAPTCHA_LOGIN_REDIS_PREFIX: str = 'fba:login:captcha'
-    CAPTCHA_LOGIN_EXPIRE_SECONDS: int = 60 * 5  # 3 分钟
-
     # 数据权限
-    DATA_PERMISSION_MODELS: dict[str, str] = {  # 允许进行数据过滤的 SQLA 模型，它必须以模块字符串的方式定义
-        '部门': 'backend.app.admin.model.Dept',
-    }
     DATA_PERMISSION_COLUMN_EXCLUDE: list[str] = [  # 排除允许进行数据过滤的 SQLA 模型列
         'id',
         'sort',
@@ -162,9 +184,6 @@ class Settings(BaseSettings):
     LOG_ACCESS_FILENAME: str = 'fba_access.log'
     LOG_ERROR_FILENAME: str = 'fba_error.log'
 
-    # .env 操作日志
-    OPERA_LOG_ENCRYPT_SECRET_KEY: str  # 密钥 os.urandom(32), 需使用 bytes.hex() 方法转换为 str
-
     # 操作日志
     OPERA_LOG_PATH_EXCLUDE: list[str] = [
         '/favicon.ico',
@@ -174,10 +193,8 @@ class Settings(BaseSettings):
         f'{FASTAPI_API_V1_PATH}/auth/login/swagger',
         f'{FASTAPI_API_V1_PATH}/oauth2/github/callback',
         f'{FASTAPI_API_V1_PATH}/oauth2/google/callback',
-        f'{FASTAPI_API_V1_PATH}/oauth2/linux-do/callback',
     ]
-    OPERA_LOG_ENCRYPT_TYPE: int = 1  # 0: AES (性能损耗); 1: md5; 2: ItsDangerous; 3: 不加密, others: 替换为 ******
+    OPERA_LOG_REDACT_KEYS: list[str] = [
-    OPERA_LOG_ENCRYPT_KEY_INCLUDE: list[str] = [  # 将加密接口入参参数对应的值
         'password',
         'old_password',
         'new_password',
@@ -195,6 +212,11 @@ class Settings(BaseSettings):
     # I18n 配置
     I18N_DEFAULT_LANGUAGE: str = 'zh-CN'
 
+    # Grafana
+    GRAFANA_METRICS: bool = False
+    GRAFANA_APP_NAME: str = 'fba_server'
+    GRAFANA_OTLP_GRPC_ENDPOINT: str = 'fba_alloy:4317'
+
     ##################################################
     # [ App ] task
     ##################################################
@@ -227,12 +249,14 @@ class Settings(BaseSettings):
     OAUTH2_GITHUB_CLIENT_SECRET: str
     OAUTH2_GOOGLE_CLIENT_ID: str
     OAUTH2_GOOGLE_CLIENT_SECRET: str
-    OAUTH2_LINUX_DO_CLIENT_ID: str
-    OAUTH2_LINUX_DO_CLIENT_SECRET: str
 
     # 基础配置
-    OAUTH2_BACKEND_BASE_URL: str = 'http://127.0.0.1:8000'
+    OAUTH2_STATE_REDIS_PREFIX: str = 'fba:oauth2:state'
-    OAUTH2_FRONTEND_REDIRECT_URI: str = 'http://localhost:5173/oauth2/callback'
+    OAUTH2_STATE_EXPIRE_SECONDS: int = 60 * 3  # 3 分钟
+    OAUTH2_GITHUB_REDIRECT_URI: str = 'http://127.0.0.1:8000/api/v1/oauth2/github/callback'
+    OAUTH2_GOOGLE_REDIRECT_URI: str = 'http://127.0.0.1:8000/api/v1/oauth2/google/callback'
+    OAUTH2_FRONTEND_LOGIN_REDIRECT_URI: str = 'http://localhost:5173/oauth2/callback'
+    OAUTH2_FRONTEND_BINDING_REDIRECT_URI: str = 'http://localhost:5173/profile'
 
     ##################################################
     # [ Plugin ] email
@@ -266,6 +290,8 @@ class Settings(BaseSettings):
 @lru_cache
 def get_settings() -> Settings:
     """获取全局配置单例"""
+    if not ENV_FILE_PATH.exists():
+        shutil.copy(ENV_EXAMPLE_FILE_PATH, ENV_FILE_PATH)
     return Settings()
 
 

backend/core/path_conf.py

@@ -3,6 +3,12 @@ from pathlib import Path
 # 项目根目录
 BASE_PATH = Path(__file__).resolve().parent.parent
 
+# 环境变量文件
+ENV_FILE_PATH = BASE_PATH / '.env'
+
+# 环境变量示例文件
+ENV_EXAMPLE_FILE_PATH = BASE_PATH / '.env.example'
+
 # alembic 迁移文件存放路径
 ALEMBIC_VERSION_DIR = BASE_PATH / 'alembic' / 'versions'
 
@@ -20,3 +26,9 @@ PLUGIN_DIR = BASE_PATH / 'plugin'
 
 # 国际化文件目录
 LOCALE_DIR = BASE_PATH / 'locale'
+
+# MySQL 脚本目录
+MYSQL_SCRIPT_DIR = BASE_PATH / 'sql' / 'mysql'
+
+# PostgreSQL 脚本目录
+POSTGRESQL_SCRIPT_DIR = BASE_PATH / 'sql' / 'postgresql'

backend/core/registrar.py

@@ -9,10 +9,10 @@ import socketio
 from fastapi import Depends, FastAPI
 from fastapi_limiter import FastAPILimiter
 from fastapi_pagination import add_pagination
+from prometheus_client import make_asgi_app
 from starlette.middleware.authentication import AuthenticationMiddleware
 from starlette.middleware.cors import CORSMiddleware
 from starlette.staticfiles import StaticFiles
-from starlette.types import ASGIApp
 from starlette_context.middleware import ContextMiddleware
 from starlette_context.plugins import RequestIdPlugin
 
@@ -33,7 +33,10 @@ from backend.plugin.tools import build_final_router
 from backend.utils.demo_site import demo_site
 from backend.utils.health_check import ensure_unique_route_names, http_limit_callback
 from backend.utils.openapi import simplify_operation_ids
+from backend.utils.otel import init_otel
 from backend.utils.serializers import MsgSpecJSONResponse
+from backend.utils.snowflake import snowflake
+from backend.utils.trace_id import OtelTraceIdPlugin
 
 
 @asynccontextmanager
@@ -57,11 +60,17 @@ async def register_init(app: FastAPI) -> AsyncGenerator[None, None]:
         http_callback=http_limit_callback,
     )
 
+    # 初始化 snowflake 节点
+    await snowflake.init()
+
     # 创建操作日志任务
     create_task(OperaLogMiddleware.consumer())
 
     yield
 
+    # 释放 snowflake 节点
+    await snowflake.shutdown()
+
     # 关闭 redis 连接
     await redis_client.aclose()
 
@@ -69,22 +78,7 @@ async def register_init(app: FastAPI) -> AsyncGenerator[None, None]:
 def register_app() -> FastAPI:
     """注册 FastAPI 应用"""
 
-    class MyFastAPI(FastAPI):
+    app = FastAPI(
-        if settings.MIDDLEWARE_CORS:
-            # Related issues
-            # https://github.com/fastapi/fastapi/discussions/7847
-            # https://github.com/fastapi/fastapi/discussions/8027
-            def build_middleware_stack(self) -> ASGIApp:
-                return CORSMiddleware(
-                    super().build_middleware_stack(),
-                    allow_origins=settings.CORS_ALLOWED_ORIGINS,
-                    allow_credentials=True,
-                    allow_methods=['*'],
-                    allow_headers=['*'],
-                    expose_headers=settings.CORS_EXPOSE_HEADERS,
-                )
-
-    app = MyFastAPI(
         title=settings.FASTAPI_TITLE,
         version=__version__,
         description=settings.FASTAPI_DESCRIPTION,
@@ -104,6 +98,9 @@ def register_app() -> FastAPI:
     register_page(app)
     register_exception(app)
 
+    if settings.GRAFANA_METRICS:
+        register_metrics(app)
+
     return app
 
 
@@ -157,15 +154,29 @@ def register_middleware(app: FastAPI) -> None:
     app.add_middleware(AccessMiddleware)
 
     # ContextVar
+    plugins = [OtelTraceIdPlugin()] if settings.GRAFANA_METRICS else [RequestIdPlugin(validate=True)]
     app.add_middleware(
         ContextMiddleware,
-        plugins=[RequestIdPlugin(validate=True)],
+        plugins=plugins,
         default_error_response=MsgSpecJSONResponse(
             content={'code': StandardResponseCode.HTTP_400, 'msg': 'BAD_REQUEST', 'data': None},
             status_code=StandardResponseCode.HTTP_400,
         ),
     )
 
+    # CORS
+    # https://github.com/fastapi-practices/fastapi_best_architecture/pull/789/changes
+    # https://github.com/open-telemetry/opentelemetry-python-contrib/issues/4031
+    if settings.MIDDLEWARE_CORS:
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=settings.CORS_ALLOWED_ORIGINS,
+            allow_credentials=True,
+            allow_methods=['*'],
+            allow_headers=['*'],
+            expose_headers=settings.CORS_EXPOSE_HEADERS,
+        )
+
 
 def register_router(app: FastAPI) -> None:
     """
@@ -211,3 +222,16 @@ def register_socket_app(app: FastAPI) -> None:
         socketio_path='/ws/socket.io',
     )
     app.mount('/ws', socket_app)
+
+
+def register_metrics(app: FastAPI) -> None:
+    """
+    注册指标
+
+    :param app: FastAPI 应用实例
+    :return:
+    """
+    metrics_app = make_asgi_app()
+    app.mount('/metrics', metrics_app)
+
+    init_otel(app)

backend/database/db.py

@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import (
     create_async_engine,
 )
 
+from backend.common.enums import DataBaseType
 from backend.common.log import log
 from backend.common.model import MappedBase
 from backend.core.conf import settings
@@ -26,14 +27,14 @@ def create_database_url(*, unittest: bool = False) -> URL:
     :return:
     """
     url = URL.create(
-        drivername='mysql+asyncmy' if settings.DATABASE_TYPE == 'mysql' else 'postgresql+asyncpg',
+        drivername='mysql+asyncmy' if DataBaseType.mysql == settings.DATABASE_TYPE else 'postgresql+asyncpg',
         username=settings.DATABASE_USER,
         password=settings.DATABASE_PASSWORD,
         host=settings.DATABASE_HOST,
         port=settings.DATABASE_PORT,
         database=settings.DATABASE_SCHEMA if not unittest else f'{settings.DATABASE_SCHEMA}_test',
     )
-    if settings.DATABASE_TYPE == 'mysql':
+    if DataBaseType.mysql == settings.DATABASE_TYPE:
         url.update_query_dict({'charset': settings.DATABASE_CHARSET})
     return url
 
@@ -91,6 +92,12 @@ async def create_tables() -> None:
         await coon.run_sync(MappedBase.metadata.create_all)
 
 
+async def drop_tables() -> None:
+    """丢弃数据库表"""
+    async with async_engine.begin() as conn:
+        await conn.run_sync(MappedBase.metadata.drop_all)
+
+
 def uuid4_str() -> str:
     """数据库引擎 UUID 类型兼容性解决方案"""
     return str(uuid4())

backend/database/redis.py

@@ -38,26 +38,38 @@ class RedisCli(Redis):
             log.error('❌ 数据库 redis 连接异常 {}', e)
             sys.exit()
 
-    async def delete_prefix(self, prefix: str, exclude: str | list[str] | None = None) -> None:
+    async def delete_prefix(self, prefix: str, exclude: str | list[str] | None = None, batch_size: int = 1000) -> None:
         """
         删除指定前缀的所有 key
 
-        :param prefix: 前缀
+        :param prefix: 要删除的键前缀
-        :param exclude: 排除的 key
+        :param exclude: 要排除的键或键列表
+        :param batch_size: 批量删除的大小，避免一次性删除过多键导致 Redis 阻塞
         :return:
         """
-        keys = []
+        exclude_set = set(exclude) if isinstance(exclude, list) else {exclude} if isinstance(exclude, str) else set()
+        batch_keys = []
+
         async for key in self.scan_iter(match=f'{prefix}*'):
-            if isinstance(exclude, str):
+            if key not in exclude_set:
-                if key != exclude:
+                batch_keys.append(key)
-                    keys.append(key)
+
-            elif isinstance(exclude, list):
+                if len(batch_keys) >= batch_size:
-                if key not in exclude:
+                    await self.delete(*batch_keys)
-                    keys.append(key)
+                    batch_keys.clear()
-            else:
+
-                keys.append(key)
+        if batch_keys:
-        if keys:
+            await self.delete(*batch_keys)
-            await self.delete(*keys)
+
+    async def get_prefix(self, prefix: str, count: int = 100) -> list[str]:
+        """
+        获取指定前缀的所有 key
+
+        :param prefix: 要搜索的键前缀
+        :param count: 每次扫描批次的数量，值越大扫描速度越快，但会占用更多服务器资源
+        :return:
+        """
+        return [key async for key in self.scan_iter(match=f'{prefix}*', count=count)]
 
 
 # 创建 redis 客户端单例

backend/locale/en-US.json

@@ -2,6 +2,7 @@
   "error": {
     "captcha": {
       "error": "Captcha error",
+      "invalid": "Captcha is invalid, please try again",
       "expired": "Captcha has expired, please try again"
     },
     "language_not_found": "Current language pack is not initialized or does not exist"

backend/locale/zh-CN.yml

@@ -1,6 +1,7 @@
 error:
   captcha:
     error: 验证码错误
+    invalid: 验证码无效，请重新获取
     expired: 验证码已过期，请重新获取
   language_not_found: 当前语言包未初始化或不存在
 pydantic:

backend/middleware/access_middleware.py

@@ -32,12 +32,4 @@ class AccessMiddleware(BaseHTTPMiddleware):
 
         response = await call_next(request)
 
-        if request.method != 'OPTIONS':
-            log.debug('<-- 请求结束')
-
-            log.info(
-                f'{request.client.host: <15} | {request.method: <8} | {response.status_code: <6} | '
-                f'{path} | {(time.perf_counter() - perf_time) * 1000:.3f}ms',
-            )
-
         return response

backend/middleware/i18n_middleware.py

@@ -1,5 +1,4 @@
 from collections.abc import Callable
-from functools import lru_cache
 
 from fastapi import Request, Response
 from starlette.middleware.base import BaseHTTPMiddleware
@@ -7,7 +6,6 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from backend.common.i18n import i18n
 
 
-@lru_cache
 def get_current_language(request: Request) -> str | None:
     """
     获取当前请求的语言偏好

backend/middleware/opera_log_middleware.py

@@ -12,13 +12,19 @@ from starlette.requests import Request
 from backend.app.admin.schema.opera_log import CreateOperaLogParam
 from backend.app.admin.service.opera_log_service import opera_log_service
 from backend.common.context import ctx
-from backend.common.enums import OperaLogCipherType, StatusType
+from backend.common.enums import StatusType
 from backend.common.log import log
+from backend.common.prometheus.instruments import (
+    PROMETHEUS_EXCEPTION_COUNTER,
+    PROMETHEUS_REQUEST_COST_TIME_HISTOGRAM,
+    PROMETHEUS_REQUEST_COUNTER,
+    PROMETHEUS_REQUEST_IN_PROGRESS_GAUGE,
+    PROMETHEUS_RESPONSE_COUNTER,
+)
 from backend.common.queue import batch_dequeue
 from backend.common.response.response_code import StandardResponseCode
 from backend.core.conf import settings
 from backend.database.db import async_db_session
-from backend.utils.encrypt import AESCipher, ItsDCipher, Md5Cipher
 from backend.utils.trace_id import get_request_trace_id
 
 
@@ -43,6 +49,10 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
         else:
             method = request.method
             args = await self.get_request_args(request)
+            PROMETHEUS_REQUEST_IN_PROGRESS_GAUGE.labels(
+                app_name=settings.GRAFANA_APP_NAME, method=method, path=path
+            ).inc()
+            PROMETHEUS_REQUEST_COUNTER.labels(app_name=settings.GRAFANA_APP_NAME, method=method, path=path).inc()
 
             # 执行请求
             code = 200
@@ -51,7 +61,7 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
             error = None
             try:
                 response = await call_next(request)
-                elapsed = (time.perf_counter() - ctx.perf_time) * 1000
+                elapsed = round((time.perf_counter() - ctx.perf_time) * 1000, 3)
                 for e in [
                     '__request_http_exception__',
                     '__request_validation_exception__',
@@ -63,14 +73,34 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
                         code = exception.get('code')
                         msg = exception.get('msg')
                         log.error(f'请求异常: {msg}')
+                        PROMETHEUS_EXCEPTION_COUNTER.labels(
+                            app_name=settings.GRAFANA_APP_NAME,
+                            method=method,
+                            path=path,
+                            exception_type=type(e).__name__,
+                        ).inc()
                         break
             except Exception as e:
-                elapsed = (time.perf_counter() - ctx.perf_time) * 1000
+                elapsed = round((time.perf_counter() - ctx.perf_time) * 1000, 3)
                 code = getattr(e, 'code', StandardResponseCode.HTTP_500)  # 兼容 SQLAlchemy 异常用法
                 msg = getattr(e, 'msg', str(e))  # 不建议使用 traceback 模块获取错误信息，会暴漏代码信息
                 status = StatusType.disable
                 error = e
                 log.error(f'请求异常: {e!s}')
+                PROMETHEUS_EXCEPTION_COUNTER.labels(
+                    app_name=settings.GRAFANA_APP_NAME, method=method, path=path, exception_type=type(e).__name__
+                ).inc()
+            else:
+                PROMETHEUS_REQUEST_COST_TIME_HISTOGRAM.labels(
+                    app_name=settings.GRAFANA_APP_NAME, method=method, path=path
+                ).observe(elapsed, exemplar={'TraceID': get_request_trace_id()})
+            finally:
+                PROMETHEUS_RESPONSE_COUNTER.labels(
+                    app_name=settings.GRAFANA_APP_NAME, method=method, path=path, status_code=code
+                ).inc()
+                PROMETHEUS_REQUEST_IN_PROGRESS_GAUGE.labels(
+                    app_name=settings.GRAFANA_APP_NAME, method=method, path=path
+                ).dec()
 
             # 此信息只能在请求后获取
             route = request.scope.get('route')
@@ -86,6 +116,9 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
             log.debug(f'接口摘要：[{summary}]')
             log.debug(f'请求地址：[{ctx.ip}]')
             log.debug(f'请求参数：{args}')
+            log.info(f'{ctx.ip: <15} | {request.method: <8} | {code!s: <6} | {path} | {elapsed:.3f}ms')
+            if request.method != 'OPTIONS':
+                log.debug('<-- 请求结束')
 
             # 日志创建
             opera_log_in = CreateOperaLogParam(
@@ -174,20 +207,9 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
         :param args: 需要脱敏的参数字典
         :return:
         """
-        for key, value in args.items():
+        for key in args:
-            if key in settings.OPERA_LOG_ENCRYPT_KEY_INCLUDE:
+            if key in settings.OPERA_LOG_REDACT_KEYS:
-                match settings.OPERA_LOG_ENCRYPT_TYPE:
+                args[key] = '[REDACTED]'
-                    case OperaLogCipherType.aes:
-                        args[key] = (AESCipher(settings.OPERA_LOG_ENCRYPT_SECRET_KEY).encrypt(value)).hex()
-                    case OperaLogCipherType.md5:
-                        args[key] = Md5Cipher.encrypt(value)
-                    case OperaLogCipherType.itsdangerous:
-                        args[key] = ItsDCipher(settings.OPERA_LOG_ENCRYPT_SECRET_KEY).encrypt(value)
-                    case OperaLogCipherType.plan:
-                        pass
-                    case _:
-                        args[key] = '******'
-
         return args
 
     @classmethod
@@ -205,6 +227,8 @@ class OperaLogMiddleware(BaseHTTPMiddleware):
                         log.info('自动执行【操作日志批量创建】任务...')
                     async with async_db_session.begin() as db:
                         await opera_log_service.bulk_create(db=db, objs=logs)
+                except Exception as e:
+                    log.error(f'操作日志入库失败，丢失 {len(logs)} 条日志: {e}')
                 finally:
-                    if not cls.opera_log_queue.empty():
+                    for _ in range(len(logs)):
                         cls.opera_log_queue.task_done()

backend/plugin/code_generator/api/router.py

@@ -2,11 +2,11 @@ from fastapi import APIRouter
 
 from backend.core.conf import settings
 from backend.plugin.code_generator.api.v1.business import router as business_router
-from backend.plugin.code_generator.api.v1.code import router as gen_router
 from backend.plugin.code_generator.api.v1.column import router as column_router
+from backend.plugin.code_generator.api.v1.gen import router as gen_router
 
-v1 = APIRouter(prefix=f'{settings.FASTAPI_API_V1_PATH}/generates', tags=['代码生成'])
+v1 = APIRouter(prefix=f'{settings.FASTAPI_API_V1_PATH}/code-generation', tags=['代码生成'])
 
 v1.include_router(business_router, prefix='/businesses')
 v1.include_router(column_router, prefix='/columns')
-v1.include_router(gen_router, prefix='/codes')
+v1.include_router(gen_router, prefix='/generations')

backend/plugin/code_generator/api/v1/gen.py

@@ -37,7 +37,7 @@ async def import_table(db: CurrentSessionTransaction, obj: ImportParam) -> Respo
     return response_base.success()
 
 
-@router.get('/{pk}/previews', summary='代码生成预览', dependencies=[DependsJwtAuth])
+@router.get('/{pk}/preview', summary='代码生成预览', dependencies=[DependsJwtAuth])
 async def preview_code(
     db: CurrentSession, pk: Annotated[int, Path(description='业务 ID')]
 ) -> ResponseSchemaModel[dict[str, bytes]]:
@@ -54,7 +54,7 @@ async def get_generate_paths(
 
 
 @router.post(
-    '/{pk}/generation',
+    '/{pk}',
     summary='代码生成',
     description='文件磁盘写入，请谨慎操作',
     dependencies=[

backend/plugin/code_generator/crud/crud_business.py

@@ -52,7 +52,7 @@ class CRUDGenBusiness(CRUDPlus[GenBusiness]):
         if table_name is not None:
             filters['table_name__like'] = f'%{table_name}%'
 
-        return await self.select_order('id', 'desc', load_strategies={'gen_column': 'noload'}, **filters)
+        return await self.select_order('id', 'desc', **filters)
 
     async def create(self, db: AsyncSession, obj: CreateGenBusinessParam) -> None:
         """

backend/plugin/code_generator/crud/crud_code.py

@@ -3,6 +3,7 @@ from collections.abc import Sequence
 from sqlalchemy import Row, RowMapping, text
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from backend.common.enums import DataBaseType
 from backend.core.conf import settings
 
 
@@ -18,7 +19,7 @@ class CRUDGen:
         :param table_schema: 数据库 schema 名称
         :return:
         """
-        if settings.DATABASE_TYPE == 'mysql':
+        if DataBaseType.mysql == settings.DATABASE_TYPE:
             sql = """
             SELECT table_name AS table_name, table_comment AS table_comment
             FROM information_schema.tables
@@ -48,7 +49,7 @@ class CRUDGen:
         :param table_name: 表名
         :return:
         """
-        if settings.DATABASE_TYPE == 'mysql':
+        if DataBaseType.mysql == settings.DATABASE_TYPE:
             sql = """
             SELECT table_name AS table_name, table_comment AS table_comment
             FROM information_schema.tables
@@ -79,7 +80,7 @@ class CRUDGen:
         :param table_name: 表名
         :return:
         """
-        if settings.DATABASE_TYPE == 'mysql':
+        if DataBaseType.mysql == settings.DATABASE_TYPE:
             sql = """
             SELECT column_name AS column_name,
             CASE WHEN column_key = 'PRI' THEN 1 ELSE 0 END AS is_pk,

backend/plugin/code_generator/model/business.py

@@ -1,16 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
 from backend.common.model import Base, UniversalText, id_key
 
-if TYPE_CHECKING:
-    from backend.plugin.code_generator.model import GenColumn
-
 
 class GenBusiness(Base):
     """代码生成业务表"""
@@ -34,5 +27,3 @@ class GenBusiness(Base):
         sa.String(256), default=None, comment='代码生成路径（默认为 app 根路径）'
     )
     remark: Mapped[str | None] = mapped_column(UniversalText, default=None, comment='备注')
-    # 代码生成业务模型列一对多
-    gen_column: Mapped[list[GenColumn]] = relationship(init=False, back_populates='gen_business')

backend/plugin/code_generator/model/column.py

@@ -1,16 +1,9 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
 import sqlalchemy as sa
 
-from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.orm import Mapped, mapped_column
 
 from backend.common.model import DataClassBase, UniversalText, id_key
 
-if TYPE_CHECKING:
-    from backend.plugin.code_generator.model import GenBusiness
-
 
 class GenColumn(DataClassBase):
     """代码生成模型列表"""
@@ -28,8 +21,5 @@ class GenColumn(DataClassBase):
     is_pk: Mapped[bool] = mapped_column(default=False, comment='是否主键')
     is_nullable: Mapped[bool] = mapped_column(default=False, comment='是否可为空')
 
-    # 代码生成业务模型列一对多
+    # 逻辑外键
-    gen_business_id: Mapped[int] = mapped_column(
+    gen_business_id: Mapped[int] = mapped_column(sa.BigInteger, default=0, comment='代码生成业务ID')
-        sa.BigInteger, sa.ForeignKey('gen_business.id', ondelete='CASCADE'), default=0, comment='代码生成业务ID'
-    )
-    gen_business: Mapped[GenBusiness | None] = relationship(init=False, back_populates='gen_column')

backend/plugin/code_generator/plugin.toml

@@ -1,6 +1,6 @@
 [plugin]
 summary = '代码生成'
-version = '0.0.5'
+version = '0.0.7'
 description = '生成通用业务代码'
 author = 'wu-clan'
 

backend/plugin/code_generator/service/column_service.py

@@ -2,9 +2,11 @@ from collections.abc import Sequence
 
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from backend.common.enums import DataBaseType
 from backend.common.exception import errors
+from backend.core.conf import settings
 from backend.plugin.code_generator.crud.crud_column import gen_column_dao
-from backend.plugin.code_generator.enums import GenMySQLColumnType
+from backend.plugin.code_generator.enums import GenMySQLColumnType, GenPostgreSQLColumnType
 from backend.plugin.code_generator.model import GenColumn
 from backend.plugin.code_generator.schema.column import CreateGenColumnParam, UpdateGenColumnParam
 from backend.plugin.code_generator.utils.type_conversion import sql_type_to_pydantic
@@ -30,8 +32,11 @@ class GenColumnService:
 
     @staticmethod
     async def get_types() -> list[str]:
-        """获取所有 MySQL 列类型"""
+        """获取所有列类型"""
-        types = GenMySQLColumnType.get_member_keys()
+        if DataBaseType.mysql == settings.DATABASE_TYPE:
+            types = GenMySQLColumnType.get_member_keys()
+        else:
+            types = GenPostgreSQLColumnType.get_member_keys()
         types.sort()
         return types
 

backend/plugin/code_generator/sql/mysql/init.sql

@@ -0,0 +1,24 @@
+insert into gen_business (id, app_name, table_name, doc_comment, table_comment, class_name, schema_name, filename, default_datetime_column, api_version, gen_path, remark, created_time, updated_time)
+values (1, 'test', 'sys_opera_log', '操作日志表', '操作日志表', 'SysOperaLog', 'SysOperaLog', 'sys_opera_log', true, 'v1', null, null, '2025-12-15 15:30:33', null);
+
+insert into gen_column (id, name, comment, type, pd_type, `default`, sort, `length`, is_pk, is_nullable, gen_business_id)
+values
+(1, 'trace_id', '请求跟踪 ID', 'String', 'str', null, 2, 32, false, false, 1),
+(2, 'username', '用户名', 'String', 'str', null, 3, 64, false, true, 1),
+(3, 'method', '请求类型', 'String', 'str', null, 4, 32, false, false, 1),
+(4, 'title', '操作模块', 'String', 'str', null, 5, 256, false, false, 1),
+(5, 'path', '请求路径', 'String', 'str', null, 6, 512, false, false, 1),
+(6, 'ip', 'IP地址', 'String', 'str', null, 7, 64, false, false, 1),
+(7, 'country', '国家', 'String', 'str', null, 8, 64, false, true, 1),
+(8, 'region', '地区', 'String', 'str', null, 9, 64, false, true, 1),
+(9, 'city', '城市', 'String', 'str', null, 10, 64, false, true, 1),
+(10, 'user_agent', '请求头', 'String', 'str', null, 11, 512, false, false, 1),
+(11, 'os', '操作系统', 'String', 'str', null, 12, 64, false, true, 1),
+(12, 'browser', '浏览器', 'String', 'str', null, 13, 64, false, true, 1),
+(13, 'device', '设备', 'String', 'str', null, 14, 64, false, true, 1),
+(14, 'args', '请求参数', 'JSON', 'dict', null, 15, 0, false, true, 1),
+(15, 'status', '操作状态（0异常 1正常）', 'INTEGER', 'int', null, 16, 0, false, false, 1),
+(16, 'code', '操作状态码', 'String', 'str', null, 17, 32, false, false, 1),
+(17, 'msg', '提示消息', 'TEXT', 'str', null, 18, 0, false, true, 1),
+(18, 'cost_time', '请求耗时（ms）', 'String', 'str', null, 19, 0, false, false, 1),
+(19, 'opera_time', '操作时间', 'String', 'str', null, 20, 0, false, false, 1);

backend/plugin/code_generator/sql/mysql/init_snowflake.sql

@@ -0,0 +1,24 @@
+insert into gen_business (id, app_name, table_name, doc_comment, table_comment, class_name, schema_name, filename, default_datetime_column, api_version, gen_path, remark, created_time, updated_time)
+values (2112248797819043840, 'test', 'sys_opera_log', '操作日志表', '操作日志表', 'SysOperaLog', 'SysOperaLog', 'sys_opera_log', true, 'v1', null, null, '2025-12-15 15:30:33', null);
+
+insert into gen_column (id, name, comment, type, pd_type, `default`, sort, `length`, is_pk, is_nullable, gen_business_id)
+values
+(2112248797881958400, 'trace_id', '请求跟踪 ID', 'String', 'str', null, 2, 32, false, false, 2112248797819043840),
+(2112248797944872960, 'username', '用户名', 'String', 'str', null, 3, 64, false, true, 2112248797819043840),
+(2112248798007787520, 'method', '请求类型', 'String', 'str', null, 4, 32, false, false, 2112248797819043840),
+(2112248798070702080, 'title', '操作模块', 'String', 'str', null, 5, 256, false, false, 2112248797819043840),
+(2112248798133616640, 'path', '请求路径', 'String', 'str', null, 6, 512, false, false, 2112248797819043840),
+(2112248798196531200, 'ip', 'IP地址', 'String', 'str', null, 7, 64, false, false, 2112248797819043840),
+(2112248798259445760, 'country', '国家', 'String', 'str', null, 8, 64, false, true, 2112248797819043840),
+(2112248798322360320, 'region', '地区', 'String', 'str', null, 9, 64, false, true, 2112248797819043840),
+(2112248798385274880, 'city', '城市', 'String', 'str', null, 10, 64, false, true, 2112248797819043840),
+(2112248798448189440, 'user_agent', '请求头', 'String', 'str', null, 11, 512, false, false, 2112248797819043840),
+(2112248798511104000, 'os', '操作系统', 'String', 'str', null, 12, 64, false, true, 2112248797819043840),
+(2112248798574018560, 'browser', '浏览器', 'String', 'str', null, 13, 64, false, true, 2112248797819043840),
+(2112248798636933120, 'device', '设备', 'String', 'str', null, 14, 64, false, true, 2112248797819043840),
+(2112248798699847680, 'args', '请求参数', 'JSON', 'dict', null, 15, 0, false, true, 2112248797819043840),
+(2112248798762762240, 'status', '操作状态（0异常 1正常）', 'INTEGER', 'int', null, 16, 0, false, false, 2112248797819043840),
+(2112248798825676800, 'code', '操作状态码', 'String', 'str', null, 17, 32, false, false, 2112248797819043840),
+(2112248798888591360, 'msg', '提示消息', 'TEXT', 'str', null, 18, 0, false, true, 2112248797819043840),
+(2112248798951505920, 'cost_time', '请求耗时（ms）', 'String', 'str', null, 19, 0, false, false, 2112248797819043840),
+(2112248799014420480, 'opera_time', '操作时间', 'String', 'str', null, 20, 0, false, false, 2112248797819043840);