yingqing/core/backend/apps/accounts/models.py

import uuid

from django.contrib.auth.models import AbstractUser
from django.db import models

from apps.common.models import TimeStampedModel


class User(AbstractUser):
    class Status(models.TextChoices):
        ACTIVE = "active", "Active"
        DISABLED = "disabled", "Disabled"

    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
    status = models.CharField(max_length=24, choices=Status.choices, default=Status.ACTIVE)
    phone = models.CharField(max_length=32, blank=True)
    avatar_url = models.URLField(blank=True)
    # 平台超级管理员:凌驾于团队 owner 之上的跨团队后台权限(发开团队码 / 管所有团队 / 治理)。
    # 与团队解耦 —— 平台超管可不属于任何团队(get_current_team 对其返回 None,前端登录直落 /admin)。
    is_platform_admin = models.BooleanField(default=False)

    @property
    def is_disabled(self) -> bool:
        return self.status == self.Status.DISABLED


class Team(TimeStampedModel):
    class Status(models.TextChoices):
        ACTIVE = "active", "Active"
        DISABLED = "disabled", "Disabled"

    name = models.CharField(max_length=128)
    status = models.CharField(max_length=24, choices=Status.choices, default=Status.ACTIVE)
    owner = models.ForeignKey(User, on_delete=models.PROTECT, related_name="owned_teams")

    def __str__(self) -> str:
        return self.name


def _default_notify() -> dict:
    return {"n-export": True, "n-fail": True, "n-quota": True, "n-login": True}


def _default_creation() -> dict:
    return {"template": "pain", "duration": "60", "subtitle": "big-variety", "bgm": "kapian", "transition": "fade"}


def _default_display() -> dict:
    return {"appearance": "system", "language": "zh", "density": "standard"}


class UserPreference(TimeStampedModel):
    """用户设置:通知策略 / 两步验证 / 创作默认 / 显示偏好。服务端持久化(替代前端 localStorage)。"""

    user = models.OneToOneField(User, on_delete=models.CASCADE, related_name="preference")
    notify = models.JSONField(default=_default_notify, blank=True)
    two_factor_enabled = models.BooleanField(default=False)
    creation_defaults = models.JSONField(default=_default_creation, blank=True)
    display = models.JSONField(default=_default_display, blank=True)

    def __str__(self) -> str:
        return f"prefs/{self.user}"


class LoginSession(TimeStampedModel):
    """登录会话记录:每次登录写一条(设备 UA / IP / 时间),供设置页「在用设备」展示与下线。"""

    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="login_sessions")
    user_agent = models.CharField(max_length=400, blank=True)
    ip_address = models.GenericIPAddressField(null=True, blank=True)
    last_seen_at = models.DateTimeField(auto_now=True)
    revoked_at = models.DateTimeField(null=True, blank=True)

    class Meta:
        ordering = ["-last_seen_at"]


class TeamMember(TimeStampedModel):
    class Role(models.TextChoices):
        OWNER = "owner", "Owner"
        ADMIN = "admin", "Admin"
        MEMBER = "member", "Member"
        VIEWER = "viewer", "Viewer"

    class Status(models.TextChoices):
        ACTIVE = "active", "Active"
        INVITED = "invited", "Invited"
        DISABLED = "disabled", "Disabled"

    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="members")
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="team_memberships")
    role = models.CharField(max_length=24, choices=Role.choices, default=Role.MEMBER)
    status = models.CharField(max_length=24, choices=Status.choices, default=Status.ACTIVE)
    # 三档成员额度(均 0=不限):每日 / 每月 / 累计总额。团队页可设,reserve 时逐档管控(PMC#17/#18)。
    daily_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, default=0)
    monthly_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, default=0)
    total_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, default=0)

    class Meta:
        unique_together = [("team", "user")]

    def __str__(self) -> str:
        return f"{self.team} / {self.user} / {self.role}"


def _gen_invite_code() -> str:
    import secrets
    import string

    alphabet = "".join(c for c in (string.ascii_uppercase + string.digits) if c not in "O0I1")
    block = lambda: "".join(secrets.choice(alphabet) for _ in range(4))  # noqa: E731
    return f"TEAM-{block()}-{block()}"


def _default_invite_expiry():
    from datetime import timedelta

    from django.utils import timezone

    return timezone.now() + timedelta(days=7)


class Invitation(TimeStampedModel):
    """邀请码 · 两类(kind):
    - join_team(团管/超管发):绑定某团队,新用户凭码注册即加入该团队当成员(幂等、不重复发额度)。
    - create_team(平台超管发):不绑团队,新用户凭码注册 = 开新团队 + 当 owner(发试用额度)。
    注册必须有码(取消「空码开团队」),前端先验码再展开对应表单。"""

    class Status(models.TextChoices):
        PENDING = "pending", "Pending"
        USED = "used", "Used"
        REVOKED = "revoked", "Revoked"
        EXPIRED = "expired", "Expired"

    class Kind(models.TextChoices):
        JOIN_TEAM = "join_team", "Join Team"
        CREATE_TEAM = "create_team", "Create Team"

    kind = models.CharField(max_length=16, choices=Kind.choices, default=Kind.JOIN_TEAM)
    # join_team 必绑团队;create_team 开团队前无团队,故可空。
    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="invitations", null=True, blank=True)
    code = models.CharField(max_length=32, unique=True, default=_gen_invite_code)
    role = models.CharField(max_length=24, choices=TeamMember.Role.choices, default=TeamMember.Role.MEMBER)
    email = models.EmailField(blank=True)
    monthly_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, default=0)
    created_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True, related_name="created_invitations")
    expires_at = models.DateTimeField(default=_default_invite_expiry)
    used_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True, related_name="used_invitations")
    used_at = models.DateTimeField(null=True, blank=True)
    status = models.CharField(max_length=16, choices=Status.choices, default=Status.PENDING)

    class Meta:
        indexes = [models.Index(fields=["team", "status"])]

    @property
    def is_valid(self) -> bool:
        from django.utils import timezone

        return self.status == self.Status.PENDING and self.expires_at > timezone.now()

    def __str__(self) -> str:
        return f"{self.team} / {self.code} / {self.status}"


class AdminAuditLog(TimeStampedModel):
    """平台超管操作审计:谁(operator)在什么时间对哪个对象(target)做了什么(action),
    可选 before/after 快照。operator_name 单独存档,即使账号被删审计仍可读。所有跨团队
    后台写操作(发码 / 启停团队 / 改密 / 调额 / 改模型等)都应经 log_admin_action() 落一条。"""

    operator = models.ForeignKey(
        User, on_delete=models.SET_NULL, null=True, blank=True, related_name="admin_audit_logs"
    )
    operator_name = models.CharField(max_length=150, blank=True)
    action = models.CharField(max_length=48)
    target_type = models.CharField(max_length=32, blank=True)
    target_id = models.CharField(max_length=64, blank=True)
    target_name = models.CharField(max_length=200, blank=True)
    before = models.JSONField(null=True, blank=True)
    after = models.JSONField(null=True, blank=True)
    ip_address = models.GenericIPAddressField(null=True, blank=True)

    class Meta:
        ordering = ["-created_at"]
        indexes = [
            models.Index(fields=["action"]),
            models.Index(fields=["-created_at"]),
        ]

    def __str__(self) -> str:
        return f"{self.operator_name} / {self.action} / {self.target_type}:{self.target_id}"