refactor: optimize structure, stability and runtime performance

db/security.py

@@ -3,13 +3,82 @@
 from __future__ import annotations
 
 from datetime import timedelta
-from typing import Any, Optional
-from typing import Dict
+from typing import Any, Dict, Optional
 
 import db_pool
 from db.utils import get_cst_now, get_cst_now_str
 
 
+_THREAT_EVENT_SELECT_COLUMNS = """
+    id,
+    threat_type,
+    score,
+    rule,
+    field_name,
+    matched,
+    value_preview,
+    ip,
+    user_id,
+    request_method,
+    request_path,
+    user_agent,
+    created_at
+"""
+
+
+def _normalize_page(page: int) -> int:
+    try:
+        page_i = int(page)
+    except Exception:
+        page_i = 1
+    return max(1, page_i)
+
+
+def _normalize_per_page(per_page: int, default: int = 20) -> int:
+    try:
+        value = int(per_page)
+    except Exception:
+        value = default
+    return max(1, min(200, value))
+
+
+def _normalize_limit(limit: int, default: int = 50) -> int:
+    try:
+        value = int(limit)
+    except Exception:
+        value = default
+    return max(1, min(200, value))
+
+
+def _row_value(row, key: str, index: int = 0, default=None):
+    if row is None:
+        return default
+    try:
+        return row[key]
+    except Exception:
+        try:
+            return row[index]
+        except Exception:
+            return default
+
+
+def _fetch_threat_events_history(where_clause: str, params: tuple[Any, ...], limit_i: int) -> list[dict]:
+    with db_pool.get_db() as conn:
+        cursor = conn.cursor()
+        cursor.execute(
+            f"""
+            SELECT
+                {_THREAT_EVENT_SELECT_COLUMNS}
+            FROM threat_events
+            WHERE {where_clause}
+            ORDER BY created_at DESC, id DESC
+            LIMIT ?
+            """,
+            tuple(params) + (limit_i,),
+        )
+        return [dict(r) for r in cursor.fetchall()]
+
+
 def record_login_context(user_id: int, ip_address: str, user_agent: str) -> Dict[str, bool]:
     """记录登录环境信息，返回是否新设备/新IP。"""
     user_id = int(user_id)
@@ -36,7 +105,7 @@ def record_login_context(user_id: int, ip_address: str, user_agent: str) -> Dict
                     SET last_seen = ?, last_ip = ?
                     WHERE id = ?
                     """,
-                    (now_str, ip_text, row["id"] if isinstance(row, dict) else row[0]),
+                    (now_str, ip_text, _row_value(row, "id", 0)),
                 )
             else:
                 cursor.execute(
@@ -61,7 +130,7 @@ def record_login_context(user_id: int, ip_address: str, user_agent: str) -> Dict
                     SET last_seen = ?
                     WHERE id = ?
                     """,
-                    (now_str, row["id"] if isinstance(row, dict) else row[0]),
+                    (now_str, _row_value(row, "id", 0)),
                 )
             else:
                 cursor.execute(
@@ -166,15 +235,8 @@ def _build_threat_events_where_clause(filters: Optional[dict]) -> tuple[str, lis
 
 def get_threat_events_list(page: int, per_page: int, filters: Optional[dict] = None) -> dict:
     """分页获取威胁事件。"""
-    try:
-        page_i = max(1, int(page))
-    except Exception:
-        page_i = 1
-    try:
-        per_page_i = int(per_page)
-    except Exception:
-        per_page_i = 20
-    per_page_i = max(1, min(200, per_page_i))
+    page_i = _normalize_page(page)
+    per_page_i = _normalize_per_page(per_page, default=20)
 
     where_sql, params = _build_threat_events_where_clause(filters)
     offset = (page_i - 1) * per_page_i
@@ -188,19 +250,7 @@ def get_threat_events_list(page: int, per_page: int, filters: Optional[dict] = N
         cursor.execute(
             f"""
             SELECT
-                id,
-                threat_type,
-                score,
-                rule,
-                field_name,
-                matched,
-                value_preview,
-                ip,
-                user_id,
-                request_method,
-                request_path,
-                user_agent,
-                created_at
+                {_THREAT_EVENT_SELECT_COLUMNS}
             FROM threat_events
             {where_sql}
             ORDER BY created_at DESC, id DESC
@@ -218,75 +268,20 @@ def get_ip_threat_history(ip: str, limit: int = 50) -> list[dict]:
     ip_text = str(ip or "").strip()[:64]
     if not ip_text:
         return []
-    try:
-        limit_i = max(1, min(200, int(limit)))
-    except Exception:
-        limit_i = 50
 
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        cursor.execute(
-            """
-            SELECT
-                id,
-                threat_type,
-                score,
-                rule,
-                field_name,
-                matched,
-                value_preview,
-                ip,
-                user_id,
-                request_method,
-                request_path,
-                user_agent,
-                created_at
-            FROM threat_events
-            WHERE ip = ?
-            ORDER BY created_at DESC, id DESC
-            LIMIT ?
-            """,
-            (ip_text, limit_i),
-        )
-        return [dict(r) for r in cursor.fetchall()]
+    limit_i = _normalize_limit(limit, default=50)
+    return _fetch_threat_events_history("ip = ?", (ip_text,), limit_i)
 
 
 def get_user_threat_history(user_id: int, limit: int = 50) -> list[dict]:
     """获取用户的威胁历史（最近limit条）。"""
     if user_id is None:
         return []
+
     try:
         user_id_int = int(user_id)
     except Exception:
         return []
-    try:
-        limit_i = max(1, min(200, int(limit)))
-    except Exception:
-        limit_i = 50
 
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        cursor.execute(
-            """
-            SELECT
-                id,
-                threat_type,
-                score,
-                rule,
-                field_name,
-                matched,
-                value_preview,
-                ip,
-                user_id,
-                request_method,
-                request_path,
-                user_agent,
-                created_at
-            FROM threat_events
-            WHERE user_id = ?
-            ORDER BY created_at DESC, id DESC
-            LIMIT ?
-            """,
-            (user_id_int, limit_i),
-        )
-        return [dict(r) for r in cursor.fetchall()]
+    limit_i = _normalize_limit(limit, default=50)
+    return _fetch_threat_events_history("user_id = ?", (user_id_int,), limit_i)