342 lines
15 KiB
Python
342 lines
15 KiB
Python
 
|
# -*- coding: utf-8 -*-
|
|||
|
|
"""模型注册表 HTTP 服务 —— issue #182 [E1]（PRD 5.3 服务化）。
|
|||
|
|
|
|||
|
|
标准库 http.server（零依赖，对齐 core/auth/auth_api.py 风格），暴露：
|
|||
|
|
|
|||
|
|
- GET /api/v1/registry/models 列表（?stage= 过滤）→ 200
|
|||
|
|
- POST /api/v1/registry/models 注册新版本（写） → 201
|
|||
|
|
- POST /api/v1/registry/models/<name>/<ver>/promote 阶段提升（写）→ 200
|
|||
|
|
- POST /api/v1/registry/models/<name>/rollback 回滚（写） → 200
|
|||
|
|
|
|||
|
|
鉴权双轨：
|
|||
|
|
- FBA 轨：`Authorization: Bearer <FBA JWT>`（FBA_TOKEN_SECRET_KEY 配置时启用），
|
|||
|
|
写操作要求权限码 `iaop:admin` 或 `iaop:studio`（回源 FBA /auth/codes）；
|
|||
|
|
- 降级轨：core/auth 会话 token（iaop_session），写操作要求 engineer/admin 角色。
|
|||
|
|
|
|||
|
|
数据：服务端 JSON 持久化（REGISTRY_DATA_DIR 可挂卷）；首次启动种子 4 条演示模型。
|
|||
|
|
|
|||
|
|
运行：python -m core.model_framework.registry_api（默认 :8002 绑定 127.0.0.1）
|
|||
|
|
nginx 反代约定见 deploy/fba/README.md（/api/v1/registry/ → 本服务）。
|
|||
|
|
"""
|
|||
|
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
import importlib.util
|
|||
|
|
import json
|
|||
|
|
import os
|
|||
|
|
import sys
|
|||
|
|
from http import HTTPStatus
|
|||
|
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
|||
|
|
from typing import Any, Dict, List, Optional, Tuple
|
|||
|
|
|
|||
|
|
|
|||
|
|
def _load_package(name: str, path: str) -> None:
|
|||
|
|
"""连字符目录 → 可导入包（core/model-framework → model_framework；core/auth → auth）。"""
|
|||
|
|
if name in sys.modules:
|
|||
|
|
return
|
|||
|
|
init_py = os.path.join(path, "__init__.py")
|
|||
|
|
spec = importlib.util.spec_from_file_location(
|
|||
|
|
name, init_py, submodule_search_locations=[path])
|
|||
|
|
module = importlib.util.module_from_spec(spec)
|
|||
|
|
sys.modules[name] = module
|
|||
|
|
spec.loader.exec_module(module)
|
|||
|
|
|
|||
|
|
|
|||
|
|
_PKG_DIR = os.path.dirname(os.path.abspath(__file__)) # core/model-framework
|
|||
|
|
_CORE_DIR = os.path.dirname(_PKG_DIR) # core
|
|||
|
|
_load_package("model_framework", _PKG_DIR)
|
|||
|
|
_load_package("auth", os.path.join(_CORE_DIR, "auth"))
|
|||
|
|
|
|||
|
|
from model_framework.template_registry import ( # noqa: E402
|
|||
|
|
ModelTemplate, Stage, TemplateRegistry, TemplateRegistryError,
|
|||
|
|
next_stage,
|
|||
|
|
)
|
|||
|
|
from auth.fba_jwt import FbaAuth, FbaAuthError # noqa: E402
|
|||
|
|
from auth.users import UserStore # noqa: E402
|
|||
|
|
from auth.session import parse_token # noqa: E402
|
|||
|
|
|
|||
|
|
WRITE_CODES = {"iaop:admin", "iaop:studio"} # FBA 权限码（写操作）
|
|||
|
|
FALLBACK_WRITE_ROLES = ("engineer", "admin") # 降级轨角色
|
|||
|
|
|
|||
|
|
# 种子模型（对齐前端 models.vue 演示数据，首次启动初始化）
|
|||
|
|
SEED_MODELS: List[Dict[str, Any]] = [
|
|||
|
|
{"name": "quality_forecast", "version": "v2.1.0", "stage": "prod",
|
|||
|
|
"backbone": "quality_forecast", "description": "TiCl4 纯度预测（GBDT）"},
|
|||
|
|
{"name": "quality_forecast", "version": "v2.2.0", "stage": "staging",
|
|||
|
|
"backbone": "quality_forecast", "description": "TiCl4 纯度预测（DNN）"},
|
|||
|
|
{"name": "anomaly_detection", "version": "v1.4.0", "stage": "prod",
|
|||
|
|
"backbone": "anomaly_detection", "description": "炉温异常检测（iForest）"},
|
|||
|
|
{"name": "cross_process_optimizer", "version": "v1.1.0", "stage": "dev",
|
|||
|
|
"backbone": "cross_process_opt", "description": "跨工序寻优"},
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
|
|||
|
|
class RegistryError(Exception):
|
|||
|
|
def __init__(self, status: int, message: str) -> None:
|
|||
|
|
super().__init__(message)
|
|||
|
|
self.status = status
|
|||
|
|
self.message = message
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ---------------------------------------------------------------------------
|
|||
|
|
# 服务
|
|||
|
|
# ---------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
class RegistryService:
|
|||
|
|
"""持有 TemplateRegistry 与数据文件路径（进程级单例，handler 共享）。"""
|
|||
|
|
|
|||
|
|
def __init__(self, data_file: str,
|
|||
|
|
user_store: Optional[UserStore] = None) -> None:
|
|||
|
|
self.data_file = data_file
|
|||
|
|
os.makedirs(os.path.dirname(data_file) or ".", exist_ok=True)
|
|||
|
|
self.registry = self._load_or_seed()
|
|||
|
|
self.fba: Optional[FbaAuth] = FbaAuth.from_env()
|
|||
|
|
# 降级轨用户源：默认 bootstrap admin（admin/change-me-now，id=1）；
|
|||
|
|
# 测试/生产可注入共享 UserStore（与 auth_api 同源）。
|
|||
|
|
self._store = user_store
|
|||
|
|
if self._store is None:
|
|||
|
|
self._store = UserStore()
|
|||
|
|
self._store.ensure_bootstrap_admin("admin", "change-me-now")
|
|||
|
|
|
|||
|
|
def _load_or_seed(self) -> TemplateRegistry:
|
|||
|
|
if os.path.exists(self.data_file):
|
|||
|
|
return TemplateRegistry.load(self.data_file)
|
|||
|
|
reg = TemplateRegistry()
|
|||
|
|
for m in SEED_MODELS:
|
|||
|
|
stage = Stage.from_str(m["stage"])
|
|||
|
|
reg.register(ModelTemplate(
|
|||
|
|
name=m["name"], version=m["version"], backbone=m["backbone"],
|
|||
|
|
description=m.get("description", ""), stage=stage,
|
|||
|
|
))
|
|||
|
|
reg.set_stage(m["name"], m["version"], stage)
|
|||
|
|
self._save(reg)
|
|||
|
|
return reg
|
|||
|
|
|
|||
|
|
def _save(self, reg: Optional[TemplateRegistry] = None) -> None:
|
|||
|
|
(reg or self.registry).save(self.data_file)
|
|||
|
|
|
|||
|
|
# ---- 鉴权 ----------------------------------------------------------
|
|||
|
|
def auth(self, headers: Dict[str, str]) -> Tuple[str, Any]:
|
|||
|
|
"""校验请求身份，返回 (mode, principal)；失败抛 RegistryError(401)。"""
|
|||
|
|
authorization = (headers.get("Authorization") or "").strip()
|
|||
|
|
if self.fba is not None and authorization.startswith("Bearer "):
|
|||
|
|
try:
|
|||
|
|
claims = self.fba.verify(authorization)
|
|||
|
|
codes = self.fba.get_codes(authorization)
|
|||
|
|
return ("fba", {"user": claims.get("sub"), "codes": codes})
|
|||
|
|
except FbaAuthError as exc:
|
|||
|
|
raise RegistryError(exc.status, exc.message)
|
|||
|
|
# 降级轨：core/auth 会话 token
|
|||
|
|
token = authorization[7:].strip() if authorization.startswith("Bearer ") else ""
|
|||
|
|
if not token:
|
|||
|
|
cookie = (headers.get("Cookie") or "").split(";")
|
|||
|
|
for part in cookie:
|
|||
|
|
k, _, v = part.strip().partition("=")
|
|||
|
|
if k == "iaop_session":
|
|||
|
|
token = v
|
|||
|
|
sess = parse_token(token) if token else None
|
|||
|
|
if sess is None:
|
|||
|
|
raise RegistryError(HTTPStatus.UNAUTHORIZED, "未登录或会话已过期")
|
|||
|
|
user = self._store.get(sess.user_id)
|
|||
|
|
if user is None or not user.active:
|
|||
|
|
raise RegistryError(HTTPStatus.UNAUTHORIZED, "账号不可用")
|
|||
|
|
return ("fallback", user)
|
|||
|
|
|
|||
|
|
def require_write(self, mode: str, principal: Any) -> None:
|
|||
|
|
"""写操作权限守卫：FBA 权限码或降级角色。"""
|
|||
|
|
if mode == "fba":
|
|||
|
|
codes = principal.get("codes") or set()
|
|||
|
|
if not codes.intersection(WRITE_CODES):
|
|||
|
|
raise RegistryError(
|
|||
|
|
HTTPStatus.FORBIDDEN,
|
|||
|
|
"权限不足：需要 iaop:admin 或 iaop:studio 权限码")
|
|||
|
|
return
|
|||
|
|
role = getattr(principal, "role", "")
|
|||
|
|
if role not in FALLBACK_WRITE_ROLES:
|
|||
|
|
raise RegistryError(
|
|||
|
|
HTTPStatus.FORBIDDEN,
|
|||
|
|
f"权限不足：当前角色 {role or 'unknown'} 不可执行写操作")
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ---------------------------------------------------------------------------
|
|||
|
|
# HTTP Handler
|
|||
|
|
# ---------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
class RegistryAPIHandler(BaseHTTPRequestHandler):
|
|||
|
|
server: "RegistryHTTPServer"
|
|||
|
|
|
|||
|
|
def log_message(self, fmt: str, *args: Any) -> None:
|
|||
|
|
print(f"[registry] {self.address_string()} {fmt % args}", flush=True)
|
|||
|
|
|
|||
|
|
# ---- 路由 ------------------------------------------------------------
|
|||
|
|
def _route(self) -> None:
|
|||
|
|
parts = [p for p in (self.path.split("?", 1)[0]).split("/") if p]
|
|||
|
|
# 期望：api/v1/registry/models[...]
|
|||
|
|
if len(parts) < 4 or parts[:4] != ["api", "v1", "registry", "models"]:
|
|||
|
|
raise RegistryError(HTTPStatus.NOT_FOUND, "未找到路由")
|
|||
|
|
tail = parts[4:]
|
|||
|
|
if self.command == "GET" and not tail:
|
|||
|
|
self._list_models()
|
|||
|
|
elif self.command == "POST" and not tail:
|
|||
|
|
self._register()
|
|||
|
|
elif (self.command == "POST" and len(tail) == 3
|
|||
|
|
and tail[2] == "promote"):
|
|||
|
|
self._promote(tail[0], tail[1])
|
|||
|
|
elif (self.command == "POST" and len(tail) == 2
|
|||
|
|
and tail[1] == "rollback"):
|
|||
|
|
self._rollback(tail[0])
|
|||
|
|
else:
|
|||
|
|
raise RegistryError(HTTPStatus.NOT_FOUND, "未找到路由")
|
|||
|
|
|
|||
|
|
def _read_body(self) -> Dict[str, Any]:
|
|||
|
|
try:
|
|||
|
|
length = int(self.headers.get("Content-Length") or 0)
|
|||
|
|
except ValueError:
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "Content-Length 非法")
|
|||
|
|
if length <= 0:
|
|||
|
|
return {}
|
|||
|
|
raw = self.rfile.read(length)
|
|||
|
|
try:
|
|||
|
|
return json.loads(raw.decode("utf-8") or "{}")
|
|||
|
|
except (ValueError, UnicodeDecodeError):
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "请求体不是合法 JSON")
|
|||
|
|
|
|||
|
|
# ---- GET /api/v1/registry/models -------------------------------------
|
|||
|
|
def _list_models(self) -> None:
|
|||
|
|
stage_filter = self._query("stage")
|
|||
|
|
mode, principal = self.server.svc.auth(self.headers) # 读接口也要求登录
|
|||
|
|
reg = self.server.svc.registry
|
|||
|
|
out: List[Dict[str, Any]] = []
|
|||
|
|
for name in sorted(reg.list_names()):
|
|||
|
|
for ver in reg.list_versions(name):
|
|||
|
|
tpl = reg.get(name, version=ver)
|
|||
|
|
if stage_filter and tpl.stage.value != stage_filter:
|
|||
|
|
continue
|
|||
|
|
out.append(tpl.to_dict())
|
|||
|
|
self._json(HTTPStatus.OK, {
|
|||
|
|
"models": out,
|
|||
|
|
"auth_mode": mode,
|
|||
|
|
"user": principal.get("user") if mode == "fba"
|
|||
|
|
else getattr(principal, "username", None),
|
|||
|
|
})
|
|||
|
|
|
|||
|
|
# ---- POST /api/v1/registry/models ------------------------------------
|
|||
|
|
def _register(self) -> None:
|
|||
|
|
mode, principal = self.server.svc.auth(self.headers)
|
|||
|
|
self.server.svc.require_write(mode, principal)
|
|||
|
|
body = self._read_body()
|
|||
|
|
name = (body.get("name") or "").strip()
|
|||
|
|
version = (body.get("version") or "").strip()
|
|||
|
|
if not name or not version:
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "name / version 必填")
|
|||
|
|
try:
|
|||
|
|
stage = Stage.from_str((body.get("stage") or "dev"))
|
|||
|
|
except ValueError:
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "stage 非法（dev/staging/prod）")
|
|||
|
|
tpl = ModelTemplate(
|
|||
|
|
name=name, version=version,
|
|||
|
|
backbone=(body.get("backbone") or "generic"),
|
|||
|
|
description=(body.get("description") or ""),
|
|||
|
|
stage=stage,
|
|||
|
|
)
|
|||
|
|
try:
|
|||
|
|
self.server.svc.registry.register(tpl)
|
|||
|
|
self.server.svc.registry.set_stage(name, version, stage)
|
|||
|
|
except TemplateRegistryError as exc:
|
|||
|
|
raise RegistryError(HTTPStatus.CONFLICT, str(exc))
|
|||
|
|
self.server.svc._save()
|
|||
|
|
self._json(HTTPStatus.CREATED, {"ok": True, "model": tpl.to_dict()})
|
|||
|
|
|
|||
|
|
# ---- POST .../{name}/{version}/promote --------------------------------
|
|||
|
|
def _promote(self, name: str, version: str) -> None:
|
|||
|
|
mode, principal = self.server.svc.auth(self.headers)
|
|||
|
|
self.server.svc.require_write(mode, principal)
|
|||
|
|
try:
|
|||
|
|
tpl = self.server.svc.registry.promote(name, version)
|
|||
|
|
except TemplateRegistryError as exc:
|
|||
|
|
raise RegistryError(HTTPStatus.CONFLICT, str(exc))
|
|||
|
|
self.server.svc._save()
|
|||
|
|
self._json(HTTPStatus.OK, {"ok": True, "model": tpl.to_dict()})
|
|||
|
|
|
|||
|
|
# ---- POST .../{name}/rollback -----------------------------------------
|
|||
|
|
def _rollback(self, name: str) -> None:
|
|||
|
|
mode, principal = self.server.svc.auth(self.headers)
|
|||
|
|
self.server.svc.require_write(mode, principal)
|
|||
|
|
body = self._read_body()
|
|||
|
|
stage_str = (body.get("stage") or "prod")
|
|||
|
|
version = (body.get("version") or "").strip()
|
|||
|
|
if not version:
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "version 必填")
|
|||
|
|
try:
|
|||
|
|
stage = Stage.from_str(stage_str)
|
|||
|
|
except ValueError:
|
|||
|
|
raise RegistryError(HTTPStatus.BAD_REQUEST, "stage 非法")
|
|||
|
|
try:
|
|||
|
|
tpl = self.server.svc.registry.rollback(name, stage, version)
|
|||
|
|
except TemplateRegistryError as exc:
|
|||
|
|
raise RegistryError(HTTPStatus.CONFLICT, str(exc))
|
|||
|
|
self.server.svc._save()
|
|||
|
|
ptrs = self.server.svc.registry._stage_pointers.get(name, {})
|
|||
|
|
self._json(HTTPStatus.OK, {
|
|||
|
|
"ok": True, "model": tpl.to_dict(), "stage": stage.value,
|
|||
|
|
"pointers": {st.value: ver for st, ver in ptrs.items()},
|
|||
|
|
})
|
|||
|
|
|
|||
|
|
# ---- 辅助 -------------------------------------------------------------
|
|||
|
|
def _query(self, key: str) -> Optional[str]:
|
|||
|
|
query = self.path.split("?", 1)[1] if "?" in self.path else ""
|
|||
|
|
for pair in query.split("&"):
|
|||
|
|
k, _, v = pair.partition("=")
|
|||
|
|
if k == key:
|
|||
|
|
return v
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
def _json(self, status: int, payload: Dict[str, Any]) -> None:
|
|||
|
|
data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
|
|||
|
|
self.send_response(status)
|
|||
|
|
self.send_header("Content-Type", "application/json; charset=utf-8")
|
|||
|
|
self.send_header("Content-Length", str(len(data)))
|
|||
|
|
self.end_headers()
|
|||
|
|
self.wfile.write(data)
|
|||
|
|
|
|||
|
|
# ---- 入口 -------------------------------------------------------------
|
|||
|
|
def do_GET(self) -> None:
|
|||
|
|
self._dispatch()
|
|||
|
|
|
|||
|
|
def do_POST(self) -> None:
|
|||
|
|
self._dispatch()
|
|||
|
|
|
|||
|
|
def _dispatch(self) -> None:
|
|||
|
|
try:
|
|||
|
|
self._route()
|
|||
|
|
except RegistryError as exc:
|
|||
|
|
self._json(exc.status, {"code": exc.status, "msg": exc.message})
|
|||
|
|
except Exception as exc: # noqa: BLE001
|
|||
|
|
self._json(HTTPStatus.INTERNAL_SERVER_ERROR,
|
|||
|
|
{"code": 500, "msg": f"服务器内部错误: {exc}"})
|
|||
|
|
|
|||
|
|
|
|||
|
|
class RegistryHTTPServer(ThreadingHTTPServer):
|
|||
|
|
daemon_threads = True
|
|||
|
|
|
|||
|
|
def __init__(self, addr: Tuple[str, int], svc: RegistryService) -> None:
|
|||
|
|
self.svc = svc
|
|||
|
|
super().__init__(addr, RegistryAPIHandler)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def make_server(port: int = 8002, data_dir: str = "",
|
|||
|
|
user_store: Optional[UserStore] = None) -> RegistryHTTPServer:
|
|||
|
|
data_dir = data_dir or os.environ.get(
|
|||
|
|
"REGISTRY_DATA_DIR", os.path.join("deploy", "data", "registry"))
|
|||
|
|
data_file = os.path.join(data_dir, "registry.json")
|
|||
|
|
svc = RegistryService(data_file, user_store=user_store)
|
|||
|
|
return RegistryHTTPServer(("127.0.0.1", port), svc)
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
port = int(os.environ.get("REGISTRY_PORT", "8002"))
|
|||
|
|
server = make_server(port)
|
|||
|
|
print(f"[registry] 模型注册表服务监听 :{port} "
|
|||
|
|
f"（data={server.svc.data_file}，fba_auth={server.svc.fba is not None}）",
|
|||
|
|
flush=True)
|
|||
|
|
server.serve_forever()
|