feat: implement caching for default password check in user profile

apps/users/serializers/user.py

@@ -8,6 +8,7 @@
 """
 
 import datetime
+import hashlib
 import json
 import os
 import re
@@ -61,6 +62,7 @@
 VERIFY_CODE_EXPIRE_SECONDS = 10 * 60
 # 达到错误上限后的锁定冷却时长
 VERIFY_CODE_LOCKOUT_SECONDS = 10 * 60
+DEFAULT_PASSWORD_CHECK_CACHE_TIMEOUT = 7 * 24 * 60 * 60
 
 
 def _raise_verify_code_limit():
@@ -228,6 +230,17 @@ def get_workspace_list_by_user(user_id):
     return [{"id": "default", "name": "default"}]
 
 
+def _is_default_password(default_password: str, hashed_password: str):
+    cache_version = Cache_Version.USER.get_version()
+    digest = hashlib.sha256(f"{default_password}\0{hashed_password}".encode()).hexdigest()
+    cache_key = Cache_Version.USER.get_key(user_id=f"default-password:{digest}")
+    is_default = cache.get(cache_key, version=cache_version)
+    if is_default is None:
+        is_default = password_verify(default_password, hashed_password)
+        cache.set(cache_key, is_default, timeout=DEFAULT_PASSWORD_CHECK_CACHE_TIMEOUT, version=cache_version)
+    return is_default
+
+
 class UserProfileSerializer(serializers.Serializer):
     @staticmethod
     def profile(user: User, auth: Auth):
@@ -261,7 +274,7 @@ def profile(user: User, auth: Auth):
             "source": user.source,
             "role": list(auth.roles),
             "permissions": auth.permissions,
-            "is_edit_password": password_verify(CONFIG.get("DEFAULT_PASSWORD", "MaxKB@123.."), user.password)
+            "is_edit_password": _is_default_password(CONFIG.get("DEFAULT_PASSWORD", "MaxKB@123.."), user.password)
             if user.source == "LOCAL"
             else False,
             "language": user.language,

apps/users/tests/__init__.py

@@ -0,0 +1 @@
+

apps/users/tests/test_profile.py

@@ -0,0 +1,59 @@
+from unittest.mock import patch
+
+import uuid_utils.compat as uuid
+from django.core.cache import cache
+from django.test import SimpleTestCase, override_settings
+
+from common.auth.struct.auth import Auth
+from users.models import User
+from users.serializers.user import UserProfileSerializer
+
+
+@override_settings(
+    CACHES={
+        "default": {
+            "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+            "LOCATION": "user-profile-tests",
+        }
+    }
+)
+class UserProfilePasswordCacheTests(SimpleTestCase):
+    def setUp(self):
+        cache.clear()
+        self.user = User(
+            id=uuid.uuid4(),
+            username="profile-user",
+            nick_name="Profile User",
+            email="profile@example.com",
+            password="hash-v1",
+            role="USER",
+            source="LOCAL",
+            language="en-US",
+        )
+        self.auth = Auth(roles=set(), permissions={})
+
+    def _profile(self):
+        with (
+            patch("users.serializers.user.DatabaseModelManage.get_model", return_value=None),
+            patch("users.serializers.user.get_workspace_list_by_user", return_value=[]),
+        ):
+            return UserProfileSerializer().profile(self.user, self.auth)
+
+    def test_profile_caches_default_password_check_for_same_hash(self):
+        with patch("users.serializers.user.password_verify", return_value=True) as verify_password:
+            first = self._profile()
+            second = self._profile()
+
+        self.assertTrue(first["is_edit_password"])
+        self.assertTrue(second["is_edit_password"])
+        verify_password.assert_called_once()
+
+    def test_profile_rechecks_when_password_hash_changes(self):
+        with patch("users.serializers.user.password_verify", side_effect=[True, False]) as verify_password:
+            first = self._profile()
+            self.user.password = "hash-v2"
+            second = self._profile()
+
+        self.assertTrue(first["is_edit_password"])
+        self.assertFalse(second["is_edit_password"])
+        self.assertEqual(verify_password.call_count, 2)