feat(demo): 重构 DEMO 模式，预置演示账号与业务数据，每次启动自动重置

安全加固：is_prod 排除 demo；ENV=production+demo 拒绝启动；验证码签名仅 debug 跳过；WinRM 统一走 settings.demo。演示账号：新增 demo-seed 预置 superadmin/siteadmin/user；登录页快速登录区。演示业务数据：新增 2c2a demo CLI；按 site_group_id 清理所有业务数据含用户手动创建的；每次启动自动重置。WinRM 假成功可见化：demo_mode 字段+启动横幅。

Author: trustedinster

app/api/v1/hosts.py

@@ -226,6 +226,11 @@ async def test_host_connection(
     client = await AsyncWinRMClient.from_host_config(host)
     try:
         res = await client.execute_command("whoami")
-        return {"success": res.success, "output": res.std_out.strip(), "error": res.std_err}
+        return {
+            "success": res.success,
+            "output": res.std_out.strip(),
+            "error": res.std_err,
+            "demo_mode": res.demo_mode,
+        }
     finally:
         await client.close()

app/auth/routes.py

@@ -271,6 +271,14 @@ async def send_email_code(
             error=send_result.error,
         )
         if settings.debug or settings.demo:
+            # demo/debug 模式：返回验证码以便演示流程继续，同时日志 warning 输出
+            log.warning(
+                "demo_email_code_revealed",
+                email=body.email,
+                code=result.code,
+                ttl=result.ttl,
+                mode="demo" if settings.demo else "debug",
+            )
             return SendEmailCodeResponse(
                 sent=False, expires_in=result.ttl, dev_code=result.code
             )

app/captcha/router.py

@@ -137,8 +137,9 @@ async def verify(request: Request):
     ts_header = request.headers.get("X-Captcha-Ts", "")
     sign_header = request.headers.get("X-Captcha-Sign", "")
 
-    # 开发 / 演示模式：签名缺失时跳过校验（便于 curl 调试）
-    skip_sign = (settings.debug or settings.demo) and not ts_header and not sign_header
+    # 开发模式：签名缺失时跳过校验（便于 curl 调试）
+    # 注意：demo 模式不跳过签名校验，演示应展示完整安全链路
+    skip_sign = settings.debug and not ts_header and not sign_header
 
     if skip_sign:
         sign_ok, sign_err = True, ""

app/cli/account.py

@@ -3,6 +3,7 @@
 用法：
     2c2a account createsuperuser              # 创建超级管理员
     2c2a account create                       # 创建普通用户
+    2c2a account demo-seed                    # 预置演示账号（超管/站点管理员/普通用户）
     2c2a account list                         # 列出用户
     2c2a account changepassword <username>    # 修改密码
     2c2a account activate <username>          # 启用账号
@@ -15,10 +16,11 @@
 """
 from __future__ import annotations
 
+import hashlib
 from datetime import datetime, timezone
 
 import typer
-from sqlalchemy import select
+from sqlalchemy import insert, select
 
 from app.cli.utils import (
     blake2b_prehash_interactive,
@@ -30,17 +32,163 @@
     success,
     warn,
 )
-from app.models.user import User, UserBan, UserProfile
+from app.models.tenant import SiteGroup
+from app.models.user import User, UserBan, UserProfile, user_site_group_admins, user_site_groups
 from app.security.password import hash_password
 
 account_app = typer.Typer(help="账户管理", no_args_is_help=True)
 
+# ── 演示账号配置 ──
+# 统一密码：demo123456（满足 ≥8 位要求）
+DEMO_PASSWORD = "demo123456"
+DEMO_ACCOUNTS = [
+    {
+        "username": "superadmin",
+        "email": "demo-superadmin@2c2a.local",
+        "is_superuser": True,
+        "is_staff": True,
+        "is_verified": True,
+        "label": "超级管理员",
+        "bind_tenant_admin": False,
+    },
+    {
+        "username": "siteadmin",
+        "email": "demo-siteadmin@2c2a.local",
+        "is_superuser": False,
+        "is_staff": True,
+        "is_verified": True,
+        "label": "站点管理员",
+        "bind_tenant_admin": True,
+    },
+    {
+        "username": "user",
+        "email": "demo-user@2c2a.local",
+        "is_superuser": False,
+        "is_staff": False,
+        "is_verified": True,
+        "label": "普通用户",
+        "bind_tenant_admin": False,
+    },
+]
+
 
 async def _get_user_by_username(session, username: str) -> User | None:
     result = await session.execute(select(User).where(User.username == username))
     return result.scalar_one_or_none()
 
 
+async def seed_demo_accounts() -> dict:
+    """预置演示账号与默认站点组。
+
+    幂等：已存在的账号跳过，未存在的创建。
+    供 CLI（``2c2a account demo-seed``）与 lifespan 启动钩子复用。
+
+    :returns: {"created": [用户名...], "skipped": [用户名...], "site_group": 站点名}
+    """
+    prehash = hashlib.blake2b(DEMO_PASSWORD.encode(), digest_size=64).hexdigest()
+    password_hash = hash_password(prehash)
+    created: list[str] = []
+    skipped: list[str] = []
+
+    async with db_session() as session:
+        # 1. 确保默认站点组存在（供 siteadmin 绑定）
+        site_group = (
+            await session.execute(select(SiteGroup).where(SiteGroup.slug == "demo"))
+        ).scalar_one_or_none()
+        if site_group is None:
+            site_group = SiteGroup(
+                name="演示站点",
+                slug="demo",
+                site_name="2c2a 演示站点",
+                is_active=True,
+            )
+            session.add(site_group)
+            await session.flush()
+
+        # 2. 创建/更新演示账号
+        for spec in DEMO_ACCOUNTS:
+            existing = await _get_user_by_username(session, spec["username"])
+            if existing is not None:
+                # 已存在则跳过（不覆盖密码/权限，避免破坏用户后续修改）
+                skipped.append(spec["username"])
+                continue
+            user = User(
+                username=spec["username"],
+                email=spec["email"],
+                password_hash=password_hash,
+                is_active=True,
+                is_staff=spec["is_staff"],
+                is_superuser=spec["is_superuser"],
+                is_verified=spec["is_verified"],
+            )
+            session.add(user)
+            await session.flush()
+            session.add(UserProfile(user_id=user.id))
+
+            # 直接操作关联表，避免 ORM 关系懒加载触发 MissingGreenlet
+            await session.execute(
+                insert(user_site_groups).values(
+                    user_id=user.id, site_group_id=site_group.id
+                )
+            )
+            if spec["bind_tenant_admin"]:
+                await session.execute(
+                    insert(user_site_group_admins).values(
+                        user_id=user.id, site_group_id=site_group.id
+                    )
+                )
+
+            created.append(spec["username"])
+
+    return {"created": created, "skipped": skipped, "site_group": "demo"}
+
+
+@account_app.command("demo-seed")
+def demo_seed(
+    force: bool = typer.Option(False, "--force", "-f", help="覆盖已存在的演示账号密码与权限"),
+):
+    """预置演示账号：superadmin / siteadmin / user（密码统一 demo123456）。
+
+    仅用于 demo/开发环境，生产环境禁止使用。
+    """
+    from app.core.config import settings
+
+    # 安全护栏：生产环境拒绝执行
+    if settings.is_prod:
+        error("生产环境禁止预置演示账号")
+        raise typer.Exit(1)
+
+    if force:
+        # --force 模式：先删除已存在的演示账号再重建
+        async def _wipe():
+            async with db_session() as session:
+                for spec in DEMO_ACCOUNTS:
+                    existing = await _get_user_by_username(session, spec["username"])
+                    if existing is not None:
+                        await session.delete(existing)
+
+        run_async(_wipe())
+
+    result = run_async(seed_demo_accounts())
+
+    from app.cli.utils import console
+
+    console.print()
+    console.print("[bold cyan]演示账号已预置[/bold cyan]")
+    console.print(f"  站点组: [green]演示站点 (slug=demo)[/green]")
+    console.print()
+    console.print(f"  {'用户名':<16} {'密码':<14} {'身份':<10} {'状态'}")
+    console.print(f"  {'-'*16} {'-'*14} {'-'*10} {'-'*8}")
+    for spec in DEMO_ACCOUNTS:
+        status = "新建" if spec["username"] in result["created"] else "已存在跳过"
+        console.print(
+            f"  [bold]{spec['username']:<16}[/bold] "
+            f"{DEMO_PASSWORD:<14} {spec['label']:<10} {status}"
+        )
+    console.print()
+    warn("演示密码为 demo123456，仅用于 demo/开发环境，禁止用于生产")
+
+
 @account_app.command("createsuperuser")
 def create_superuser(
     username: str = typer.Option(..., "--username", "-u", help="用户名"),
@@ -92,8 +240,6 @@ def _create_user(
         if len(password) < 8:
             error("密码至少 8 位")
             raise typer.Exit(1)
-        import hashlib
-
         prehash = hashlib.blake2b(password.encode(), digest_size=64).hexdigest()
     else:
         prehash = blake2b_prehash_interactive("密码")
@@ -176,8 +322,6 @@ def change_password(
         if len(password) < 8:
             error("密码至少 8 位")
             raise typer.Exit(1)
-        import hashlib
-
         prehash = hashlib.blake2b(password.encode(), digest_size=64).hexdigest()
     else:
         prehash = blake2b_prehash_interactive("新密码")

app/cli/demo.py

@@ -0,0 +1,110 @@
+"""演示数据管理命令。
+
+用法：
+    2c2a demo seed       # 仅预置演示业务数据（不清理，重复执行会叠加）
+    2c2a demo clean      # 清理所有演示业务数据
+    2c2a demo reset      # 清理 + 重建演示业务数据（推荐）
+    2c2a demo accounts   # 预置演示账号（superadmin/siteadmin/user）
+"""
+from __future__ import annotations
+
+import typer
+
+from app.cli.utils import console, error, run_async, success, warn
+
+demo_app = typer.Typer(help="演示数据管理", no_args_is_help=True)
+
+
+@demo_app.command("accounts")
+def accounts():
+    """预置演示账号：superadmin / siteadmin / user（密码 demo123456）。"""
+    from app.core.config import settings
+
+    if settings.is_prod:
+        error("生产环境禁止预置演示账号")
+        raise typer.Exit(1)
+
+    from app.cli.account import seed_demo_accounts
+
+    result = run_async(seed_demo_accounts())
+    created = result["created"]
+    skipped = result["skipped"]
+
+    console.print()
+    console.print("[bold cyan]演示账号[/bold cyan]")
+    console.print(f"  新建: {', '.join(created) if created else '无'}")
+    console.print(f"  跳过: {', '.join(skipped) if skipped else '无'}")
+    console.print()
+    warn("密码统一 demo123456，仅用于 demo/开发环境")
+
+
+@demo_app.command("seed")
+def seed():
+    """预置演示业务数据（不清理已有数据，重复执行会叠加）。"""
+    from app.core.config import settings
+
+    if settings.is_prod:
+        error("生产环境禁止预置演示数据")
+        raise typer.Exit(1)
+
+    from app.cli.demo_data import seed_demo_business_data
+
+    result = run_async(seed_demo_business_data())
+    created = result["created"]
+
+    console.print()
+    success("演示业务数据已预置")
+    for table, count in created.items():
+        console.print(f"  · {table:<20} 新建 {count} 条")
+
+
+@demo_app.command("clean")
+def clean():
+    """清理所有演示业务数据（按 [DEMO] 前缀精准删除）。"""
+    from app.core.config import settings
+
+    if settings.is_prod:
+        error("生产环境禁止操作演示数据")
+        raise typer.Exit(1)
+
+    from app.cli.demo_data import clean_demo_business_data
+
+    result = run_async(clean_demo_business_data())
+    deleted = result["deleted"]
+
+    console.print()
+    success("演示业务数据已清理")
+    total = 0
+    for table, count in deleted.items():
+        if count > 0:
+            console.print(f"  · {table:<20} 删除 {count} 条")
+            total += count
+    console.print(f"  合计删除 {total} 条")
+
+
+@demo_app.command("reset")
+def reset():
+    """清理 + 重建演示业务数据（推荐，保证环境干净）。"""
+    from app.core.config import settings
+
+    if settings.is_prod:
+        error("生产环境禁止操作演示数据")
+        raise typer.Exit(1)
+
+    from app.cli.demo_data import reset_demo_business_data
+
+    result = run_async(reset_demo_business_data())
+    cleaned = result["cleaned"]["deleted"]
+    created = result["seeded"]["created"]
+
+    console.print()
+    success("演示业务数据已重置")
+    console.print()
+    console.print("[bold]清理：[/bold]")
+    for table, count in cleaned.items():
+        if count > 0:
+            console.print(f"  · {table:<20} 删除 {count} 条")
+    console.print()
+    console.print("[bold]新建：[/bold]")
+    for table, count in created.items():
+        console.print(f"  · {table:<20} 新建 {count} 条")