rssWorkFlow/backend/app/services/settings_service.py

"""Application settings management service."""
from typing import Any

from cryptography.fernet import Fernet, InvalidToken
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.config import settings
from app.core.logging import get_logger
from app.models.setting import AppSetting

logger = get_logger(__name__)

EDITABLE_SETTINGS = {
    "RSSKEEPER_BASE_URL": {"description": "rssKeeper 服务地址", "sensitive": False},
    "OPENAI_API_KEY": {"description": "LLM API Key", "sensitive": True},
    "OPENAI_BASE_URL": {"description": "LLM API 基础地址", "sensitive": False},
    "OPENAI_MODEL": {"description": "LLM 模型名", "sensitive": False},
    "OPENAI_TIMEOUT": {"description": "LLM 调用超时（秒）", "sensitive": False},
    "OPENAI_MAX_RETRIES": {"description": "LLM 最大重试次数", "sensitive": False},
    "SUMMARIZE_INTERVAL_MINUTES": {"description": "摘要任务间隔（分钟）", "sensitive": False},
    "TAG_SCORE_INTERVAL_MINUTES": {"description": "分类/打分/去重任务间隔（分钟）", "sensitive": False},
    "DAILY_BRIEF_HOUR": {"description": "每日简报生成小时", "sensitive": False},
    "DAILY_BRIEF_MINUTE": {"description": "每日简报生成分钟", "sensitive": False},
    "TITLE_SIMILARITY_THRESHOLD": {"description": "标题相似度阈值", "sensitive": False},
    "CONTENT_SIMILARITY_THRESHOLD": {"description": "内容相似度阈值", "sensitive": False},
    "MAX_AI_SUMMARY_LENGTH": {"description": "AI 摘要最大长度", "sensitive": False},
    "MIN_ORIGINAL_SUMMARY_LENGTH": {"description": "原始摘要最小长度", "sensitive": False},
    "BRIEF_TOP_N_PER_CATEGORY": {"description": "简报每分类显示文章数", "sensitive": False},
    "LOG_LEVEL": {"description": "日志级别", "sensitive": False},
    "API_TOKEN": {"description": "API 鉴权 Token（为空时不启用）", "sensitive": True},
    "CORS_ALLOWED_ORIGINS": {"description": "CORS 允许来源（逗号分隔）", "sensitive": False},
}

# Prefix to detect encrypted values
_ENC_PREFIX = "enc:"


def _get_fernet() -> Fernet | None:
    """Get Fernet instance if encryption key is configured."""
    key = settings.SETTINGS_ENCRYPTION_KEY
    if not key:
        return None
    try:
        return Fernet(key.encode() if isinstance(key, str) else key)
    except Exception as exc:
        logger.error("SETTINGS_ENCRYPTION_KEY 无效: %s", exc)
        return None


def _encrypt(value: str) -> str:
    """Encrypt a sensitive value if encryption is enabled."""
    if not value:
        return value
    fernet = _get_fernet()
    if fernet is None:
        return value
    return _ENC_PREFIX + fernet.encrypt(value.encode()).decode()


def _decrypt(value: str) -> str:
    """Decrypt a sensitive value if it was encrypted."""
    if not value or not value.startswith(_ENC_PREFIX):
        return value
    fernet = _get_fernet()
    if fernet is None:
        logger.warning("发现加密配置值但 SETTINGS_ENCRYPTION_KEY 未配置，无法解密")
        return value
    try:
        ciphertext = value[len(_ENC_PREFIX):].encode()
        return fernet.decrypt(ciphertext).decode()
    except InvalidToken:
        logger.warning("配置值解密失败（token 无效）")
        return value
    except Exception as exc:
        logger.error("配置值解密失败: %s", exc)
        return value


def _get_env_default(key: str) -> str:
    """Get default value from environment/settings."""
    value = getattr(settings, key, "")
    return str(value) if value is not None else ""


def _mask_sensitive(value: str) -> str:
    """Mask sensitive value for display."""
    if not value:
        return ""
    if len(value) <= 8:
        return "*" * len(value)
    return f"{value[:4]}...{value[-4:]}"


async def init_default_settings(db: AsyncSession) -> None:
    """Initialize default settings from environment if table is empty."""
    result = await db.execute(select(AppSetting))
    existing = result.scalars().first()
    if existing:
        return

    for key, meta in EDITABLE_SETTINGS.items():
        default_value = _get_env_default(key)
        stored_value = _encrypt(default_value) if meta["sensitive"] else default_value
        db.add(
            AppSetting(
                key=key,
                value=stored_value,
                description=meta["description"],
                is_sensitive=meta["sensitive"],
            )
        )

    await db.commit()
    logger.info("已初始化默认配置项: %d 条", len(EDITABLE_SETTINGS))


async def _get_raw_setting(db: AsyncSession, key: str) -> AppSetting | None:
    """Get setting row from DB."""
    result = await db.execute(select(AppSetting).where(AppSetting.key == key))
    return result.scalar_one_or_none()


async def get_setting(db: AsyncSession, key: str, default: Any = None) -> Any:
    """Get decrypted setting value from DB or env default."""
    setting = await _get_raw_setting(db, key)
    if setting:
        return _decrypt(setting.value) if setting.is_sensitive else setting.value
    return _get_env_default(key) if default is None else default


async def set_setting(db: AsyncSession, key: str, value: str) -> bool:
    """Update a setting (encrypt sensitive values)."""
    if key not in EDITABLE_SETTINGS:
        return False

    meta = EDITABLE_SETTINGS[key]
    stored_value = _encrypt(str(value)) if meta["sensitive"] else str(value)

    setting = await _get_raw_setting(db, key)
    if setting:
        setting.value = stored_value
    else:
        setting = AppSetting(
            key=key,
            value=stored_value,
            description=meta["description"],
            is_sensitive=meta["sensitive"],
        )
        db.add(setting)

    await db.commit()
    logger.info("配置已更新: %s", key)
    return True


async def list_settings(db: AsyncSession, mask_sensitive: bool = True) -> list[dict[str, Any]]:
    """List all settings."""
    result = await db.execute(select(AppSetting))
    db_settings = {s.key: s for s in result.scalars().all()}

    output = []
    for key, meta in EDITABLE_SETTINGS.items():
        setting = db_settings.get(key)
        is_sensitive = meta["sensitive"]

        if setting:
            raw_value = setting.value
            updated_at = setting.updated_at.isoformat() if setting.updated_at else None
        else:
            raw_value = _get_env_default(key)
            updated_at = None

        decrypted_value = _decrypt(raw_value) if is_sensitive else raw_value

        if is_sensitive and mask_sensitive:
            display_value = _mask_sensitive(decrypted_value)
            is_masked = True
        else:
            display_value = decrypted_value
            is_masked = False

        output.append({
            "key": key,
            "value": display_value,
            "real_value": decrypted_value if not mask_sensitive else None,
            "description": meta["description"],
            "is_sensitive": is_sensitive,
            "is_masked": is_masked,
            "updated_at": updated_at,
        })

    return output


async def apply_db_settings_to_config(db: AsyncSession) -> None:
    """Apply DB settings to runtime config."""
    for key in EDITABLE_SETTINGS:
        db_value = await get_setting(db, key)
        if db_value is None or db_value == "":
            continue

        field_info = settings.model_fields.get(key)
        if field_info is None:
            continue

        target_type = field_info.annotation
        try:
            if target_type is int:
                converted = int(db_value)
            elif target_type is float:
                converted = float(db_value)
            elif target_type is bool:
                converted = db_value.lower() in ("true", "1", "yes")
            else:
                converted = db_value
            setattr(settings, key, converted)
        except Exception as exc:
            logger.error("应用配置 %s=%s 失败: %s", key, db_value, exc)
            raise ValueError(f"配置项 {key} 的值无效: {db_value}") from exc


async def reset_settings(db: AsyncSession) -> None:
    """Reset all settings to env defaults."""
    for key in EDITABLE_SETTINGS:
        await set_setting(db, key, _get_env_default(key))
    logger.info("配置已重置为环境变量默认值")