【Dify精讲】第18章：企业级功能定制-CSDN博客

本文链接：https://blog.csdn.net/wiyi9891/article/details/148796779

在企业级AI应用的实际部署中，你很快就会发现开源版本的标准功能往往无法满足复杂的业务需求。作为一个在多家企业实施AI系统的老兵，我深知企业级定制的痛点和需求。今天，让我们一起深入Dify的企业级功能定制，看看如何在现有架构基础上实现SSO集成、数据隔离、审批流程和企业级监控。

一、SSO集成方案：统一身份认证的实现

1.1 现状分析：为什么需要SSO？

在我帮助企业部署Dify时，经常遇到这样的问题：“如果dify可以支持SSO，将大大减少账户管理的工作量”。确实，SSO支持在企业商业版本中可用，但对于需要自部署的企业来说，理解其实现原理至关重要。

让我们先看看Dify当前的认证架构：

# api/libs/login.py - 当前的认证机制
from flask_login import user_logged_in
from werkzeug.exceptions import Unauthorized
from models.account import Account, Tenant, TenantAccountJoin

def login_required(func):
    """
    确保当前用户已登录和认证的装饰器
    """
    @wraps(func)
    def decorated_view(*args, **kwargs):
        # 检查Bearer token认证
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            raise Unauthorized("Expected 'Bearer <api-key>' format.")
        
        # 提取并验证token
        auth_token = auth_header.split(' ')[1]
        
        # 管理员API密钥验证
        admin_api_key = dify_config.ADMIN_API_KEY
        if admin_api_key and admin_api_key == auth_token:
            workspace_id = request.headers.get("X-WORKSPACE-ID")
            if workspace_id:
                # 查找租户和账户关联
                tenant_account_join = (
                    db.session.query(Tenant, TenantAccountJoin)
                    .filter(Tenant.id == workspace_id)
                    .filter(TenantAccountJoin.tenant_id == Tenant.id)
                    .filter(TenantAccountJoin.role == "owner")
                    .one_or_none()
                )
                if tenant_account_join:
                    tenant, ta = tenant_account_join
                    account = db.session.query(Account).filter_by(id=ta.account_id).first()
                    # 设置当前用户上下文
                    g.current_user = account
                    g.current_tenant = tenant

1.2 SAML SSO集成实现

基于当前架构，我们可以扩展认证机制来支持SAML SSO。这里是一个完整的实现方案：

# api/libs/sso/saml_provider.py - SAML SSO提供者实现
import xml.etree.ElementTree as ET
from datetime import datetime, timedelta
from typing import Dict, Optional
from urllib.parse import urlparse
import base64
import zlib

class SAMLProvider:
    """SAML SSO提供者类"""
    
    def __init__(self, config: Dict[str, str]):
        self.idp_url = config.get('idp_url')           # 身份提供者URL
        self.sp_entity_id = config.get('sp_entity_id')  # 服务提供者实体ID
        self.x509_cert = config.get('x509_cert')       # X.509证书
        self.private_key = config.get('private_key')   # 私钥
        self.attribute_mapping = config.get('attribute_mapping', {})
    
    def generate_auth_request(self, relay_state: str = None) -> str:
        """生成SAML认证请求"""
        request_id = self._generate_unique_id()
        timestamp = datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')
        
        # 构建SAML AuthnRequest XML
        saml_request = f'''<?xml version="1.0" encoding="UTF-8"?>
        <samlp:AuthnRequest 
        </samlp:AuthnRequest>'''
        
        # 压缩和Base64编码
        compressed = zlib.compress(saml_request.encode('utf-8'))
        encoded = base64.b64encode(compressed).decode('utf-8')
        
        return encoded
    
    def process_saml_response(self, saml_response: str) -> Dict[str, any]:
        """处理SAML响应并提取用户信息"""
        try:
            # 解码SAML响应
            decoded_response = base64.b64decode(saml_response)
            root = ET.fromstring(decoded_response)
            
            # 验证签名（简化版本，生产环境需要完整验证）
            if not self._verify_signature(root):
                raise ValueError("SAML响应签名验证失败")
            
            # 提取用户属性
            user_info = self._extract_user_attributes(root)
            return user_info
            
        except Exception as e:
            raise ValueError(f"SAML响应处理失败: {str(e)}")
    
    def _extract_user_attributes(self, saml_root) -> Dict[str, str]:
        """从SAML响应中提取用户属性"""
        attributes = {}
        
        # 查找AttributeStatement节点
        for attr_stmt in saml_root.findall('.//saml:AttributeStatement', 
                                          {'saml': 'urn:oasis:names:tc:SAML:2.0:assertion'}):
            for attribute in attr_stmt.findall('.//saml:Attribute', 
                                             {'saml': 'urn:oasis:names:tc:SAML:2.0:assertion'}):
                attr_name = attribute.get('Name')
                attr_values = [val.text for val in attribute.findall('.//saml:AttributeValue', 
                                                                   {'saml': 'urn:oasis:names:tc:SAML:2.0:assertion'})]
                
                # 应用属性映射
                mapped_name = self.attribute_mapping.get(attr_name, attr_name)
                attributes[mapped_name] = attr_values[0] if attr_values else None
        
        return attributes

# api/controllers/console/auth/sso.py - SSO认证控制器
from flask import request, redirect, url_for, session
from flask_restful import Resource
from libs.sso.saml_provider import SAMLProvider
from models.account import Account, Tenant, TenantAccountJoin
from extensions.ext_database import db

class SAMLAuthResource(Resource):
    """SAML SSO认证资源"""
    
    def get(self):
        """发起SAML SSO认证"""
        # 从配置中获取SAML设置
        saml_config = current_app.config.get('SAML_CONFIG', {})
        if not saml_config:
            return {'error': '未配置SAML SSO'}, 400
        
        saml_provider = SAMLProvider(saml_config)
        
        # 生成认证请求
        auth_request = saml_provider.generate_auth_request()
        
        # 构建重定向URL
        redirect_url = (f"{saml_config['idp_url']}?"
                       f"SAMLRequest={auth_request}&"
                       f"RelayState={request.args.get('return_url', '')}")
        
        return redirect(redirect_url)
    
    def post(self):
        """处理SAML响应回调"""
        saml_response = request.form.get('SAMLResponse')
        relay_state = request.form.get('RelayState')
        
        if not saml_response:
            return {'error': '缺少SAML响应'}, 400
        
        try:
            # 处理SAML响应
            saml_config = current_app.config.get('SAML_CONFIG', {})
            saml_provider = SAMLProvider(saml_config)
            user_info = saml_provider.process_saml_response(saml_response)
            
            # 查找或创建用户
            account = self._find_or_create_user(user_info)
            
            # 设置用户会话
            login_user(account)
            
            # 重定向到原始URL或默认页面
            return redirect(relay_state or url_for('console.index'))
            
        except Exception as e:
            return {'error': f'SSO认证失败: {str(e)}'}, 400

1.3 OAuth 2.0/OIDC集成实现

对于更现代的企业环境，OIDC是更受欢迎的选择：

# api/libs/sso/oidc_provider.py - OIDC提供者实现
import jwt
import requests
from typing import Dict, Optional
from datetime import datetime

class OIDCProvider:
    """OpenID Connect提供者类"""
    
    def __init__(self, config: Dict[str, str]):
        self.issuer = config.get('issuer')
        self.client_id = config.get('client_id')
        self.client_secret = config.get('client_secret')
        self.redirect_uri = config.get('redirect_uri')
        self.scope = config.get('scope', 'openid email profile')
        
        # 获取OIDC配置
        self.discovery_document = self._get_discovery_document()
    
    def get_authorization_url(self, state: str = None) -> str:
        """生成授权URL"""
        params = {
            'response_type': 'code',
            'client_id': self.client_id,
            'redirect_uri': self.redirect_uri,
            'scope': self.scope,
            'state': state or self._generate_state()
        }
        
        auth_endpoint = self.discovery_document['authorization_endpoint']
        query_string = '&'.join([f"{k}={v}" for k, v in params.items()])
        
        return f"{auth_endpoint}?{query_string}"
    def verify_id_token(self, id_token: str) -> Dict[str, any]:
        """验证ID令牌"""
        # 获取公钥用于验证签名
        jwks_uri = self.discovery_document['jwks_uri']
        jwks = requests.get(jwks_uri).json()
        
        # 解码并验证JWT
        decoded_token = jwt.decode(
            id_token,
            jwks,
            algorithms=['RS256'],
            audience=self.client_id,
            issuer=self.issuer
        )
        
        return decoded_token

# api/models/sso_config.py - SSO配置模型
from extensions.ext_database import db
from sqlalchemy.dialects.postgresql import UUID
import uuid

class SSOConfig(db.Model):
    """SSO配置表"""
    __tablename__ = 'sso_configs'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    provider_type = db.Column(db.String(20), nullable=False)  # 'saml', 'oidc'
    is_enabled = db.Column(db.Boolean, default=False)
    
    # SAML特定配置
    idp_url = db.Column(db.Text)
    sp_entity_id = db.Column(db.String(255))
    x509_cert = db.Column(db.Text)
    
    # OIDC特定配置
    issuer = db.Column(db.String(255))
    client_id = db.Column(db.String(255))
    client_secret = db.Column(db.String(255))
    redirect_uri = db.Column(db.String(255))
    
    # 通用配置
    attribute_mapping = db.Column(db.JSON)  # 属性映射配置
    auto_provisioning = db.Column(db.Boolean, default=True)  # 自动创建用户
    default_role = db.Column(db.String(20), default='normal')  # 默认角色
    
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
    
    def to_dict(self):
        return {
            'id': str(self.id),
            'provider_type': self.provider_type,
            'is_enabled': self.is_enabled,
            'auto_provisioning': self.auto_provisioning,
            'default_role': self.default_role
        }

二、数据隔离实现：多租户架构的深度定制

2.1 租户隔离机制分析

Dify的多租户架构已经相当完善，但企业级应用往往需要更严格的数据隔离。让我们看看如何增强现有的隔离机制：

# api/libs/tenant_isolation.py - 增强的租户隔离机制
from functools import wraps
from flask import g, request
from models.account import Tenant, TenantAccountJoin
from extensions.ext_database import db

class TenantIsolationManager:
    """租户隔离管理器"""
    
    @staticmethod
    def get_current_tenant() -> Optional[Tenant]:
        """获取当前租户"""
        if hasattr(g, 'current_tenant'):
            return g.current_tenant
        return None
    
    @staticmethod
    def verify_tenant_access(tenant_id: str, required_role: str = None) -> bool:
        """验证租户访问权限"""
        current_user = getattr(g, 'current_user', None)
        if not current_user:
            return False
        # 检查角色权限
        if required_role:
            role_hierarchy = ['normal', 'editor', 'admin', 'owner']
            user_role_level = role_hierarchy.index(tenant_join.role)
            required_role_level = role_hierarchy.index(required_role)
            
            return user_role_level >= required_role_level
        
        return True
    
    @staticmethod
    def apply_tenant_filter(query, model_class):
        """为查询应用租户过滤器"""
        current_tenant = TenantIsolationManager.get_current_tenant()
        if not current_tenant:
            # 如果没有当前租户，返回空查询
            return query.filter(False)
        
        # 检查模型是否有tenant_id字段
        if hasattr(model_class, 'tenant_id'):
            return query.filter(model_class.tenant_id == current_tenant.id)
        
        return query

def tenant_required(required_role: str = None):
    """租户访问权限装饰器"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            # 从请求中获取租户ID
            tenant_id = (request.headers.get('X-Tenant-ID') or 
                        request.json.get('tenant_id') if request.json else None or
                        request.args.get('tenant_id'))
            
            if not tenant_id:
                return {'error': '缺少租户ID'}, 400
            
            # 验证租户访问权限
            if not TenantIsolationManager.verify_tenant_access(tenant_id, required_role):
                return {'error': '租户访问权限不足'}, 403
            
            # 设置当前租户上下文
            tenant = Tenant.query.filter_by(id=tenant_id).first()
            if not tenant:
                return {'error': '租户不存在'}, 404
            
            g.current_tenant = tenant
            
            return func(*args, **kwargs)
        return wrapper
    return decorator

# api/models/base.py - 增强的基础模型类
class TenantAwareModel(db.Model):
    """支持租户感知的基础模型"""
    __abstract__ = True
    
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    
    @classmethod
    def query_for_tenant(cls, tenant_id: str = None):
        """为指定租户查询数据"""
        if not tenant_id:
            current_tenant = TenantIsolationManager.get_current_tenant()
            tenant_id = current_tenant.id if current_tenant else None
        
        if not tenant_id:
            # 如果没有租户ID，返回空查询
            return cls.query.filter(False)
        
        return cls.query.filter(cls.tenant_id == tenant_id)
    
    def save(self):
        """保存时自动设置租户ID"""
        if not self.tenant_id:
            current_tenant = TenantIsolationManager.get_current_tenant()
            if current_tenant:
                self.tenant_id = current_tenant.id
        
        db.session.add(self)
        db.session.commit()
        return self

# 更新现有模型以支持增强的租户隔离
# api/models/app.py - 应用模型的租户隔离增强
class App(TenantAwareModel):
    """应用模型（已存在，这里展示如何增强）"""
    __tablename__ = 'apps'
    
    # ... 现有字段 ...
    
    @classmethod
    def get_by_id_and_tenant(cls, app_id: str, tenant_id: str = None):
        """根据ID和租户获取应用"""
        query = cls.query_for_tenant(tenant_id).filter(cls.id == app_id)
        return query.first()
    
    def can_access(self, user_id: str, action: str = 'read') -> bool:
        """检查用户是否可以访问此应用"""
        # 检查用户是否在同一租户中
        tenant_join = (
            db.session.query(TenantAccountJoin)
            .filter_by(account_id=user_id, tenant_id=self.tenant_id)
            .first()
        )

2.2 数据库级别的行级安全

对于更严格的数据隔离需求，我们可以利用PostgreSQL的行级安全（RLS）功能：

-- 为租户隔离启用行级安全
-- migrations/add_row_level_security.sql

-- 为apps表启用RLS
ALTER TABLE apps ENABLE ROW LEVEL SECURITY;

-- 创建租户隔离策略
CREATE POLICY tenant_isolation_policy ON apps
    FOR ALL TO application_role
    USING (tenant_id = current_setting('app.current_tenant_id')::uuid);

-- 为datasets表启用RLS
ALTER TABLE datasets ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON datasets
    FOR ALL TO application_role
    USING (tenant_id = current_setting('app.current_tenant_id')::uuid);

-- 创建安全上下文设置函数
CREATE OR REPLACE FUNCTION set_tenant_context(tenant_uuid uuid)
RETURNS void AS $$
BEGIN
    PERFORM set_config('app.current_tenant_id', tenant_uuid::text, true);
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;

# api/libs/database_security.py - 数据库安全上下文管理
from extensions.ext_database import db
from sqlalchemy import text

class DatabaseSecurityContext:
    """数据库安全上下文管理器"""
    
    @staticmethod
    def set_tenant_context(tenant_id: str):
        """设置当前租户上下文"""
        try:
            # 在数据库会话中设置租户上下文
            db.session.execute(
                text("SELECT set_tenant_context(:tenant_id)"),
                {'tenant_id': tenant_id}
            )
        except Exception as e:
            print(f"设置租户上下文失败: {e}")

# 中间件：自动设置数据库安全上下文
# api/middleware/tenant_context.py
from flask import g, request

class TenantContextMiddleware:
    """租户上下文中间件"""
    
    def __init__(self, app=None):
        self.app = app
        if app:
            self.init_app(app)
    
    def init_app(self, app):
        app.before_request(self.before_request)
        app.after_request(self.after_request)
    
    def before_request(self):
        """请求前设置租户上下文"""
    
    def after_request(self, response):
        """请求后清理上下文"""

三、审批流程定制：企业治理的核心

3.1 工作流审批引擎设计

企业环境中，AI应用的发布往往需要经过严格的审批流程。让我们设计一个灵活的审批引擎：

# api/models/approval.py - 审批流程模型
from enum import Enum
from extensions.ext_database import db
from sqlalchemy.dialects.postgresql import UUID, JSON
import uuid

class ApprovalStatus(Enum):
    PENDING = 'pending'      # 待审批
    APPROVED = 'approved'    # 已批准
    REJECTED = 'rejected'    # 已拒绝
    CANCELLED = 'cancelled'  # 已取消

class ApprovalType(Enum):
    APP_PUBLISH = 'app_publish'           # 应用发布
    MODEL_CONFIG = 'model_config'         # 模型配置
    DATASET_UPLOAD = 'dataset_upload'     # 数据集上传
    USER_INVITE = 'user_invite'           # 用户邀请
    INTEGRATION_ADD = 'integration_add'   # 集成添加

class ApprovalRequest(db.Model):
    """审批请求"""
    __tablename__ = 'approval_requests'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    flow_id = db.Column(UUID, db.ForeignKey('approval_flows.id'), nullable=False)
    
    # 请求基本信息
    requester_id = db.Column(UUID, db.ForeignKey('accounts.id'), nullable=False)
    title = db.Column(db.String(200), nullable=False)
    description = db.Column(db.Text)
    approval_type = db.Column(db.Enum(ApprovalType), nullable=False)
    
    # 关联资源
    resource_type = db.Column(db.String(50))  # 'app', 'dataset', 'model'等
    resource_id = db.Column(UUID)
    
    # 请求数据（JSON格式，包含审批所需的详细信息）
    request_data = db.Column(JSON, nullable=False)
    
    # 状态和进度
    status = db.Column(db.Enum(ApprovalStatus), default=ApprovalStatus.PENDING)
    current_step = db.Column(db.Integer, default=1)
    
    # 时间戳
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
    approved_at = db.Column(db.DateTime)
    
    # 关联关系
    flow = db.relationship('ApprovalFlow')
    requester = db.relationship('Account')
    steps = db.relationship('ApprovalStep', back_populates='request')

# api/services/approval_service.py - 审批服务
class ApprovalService:
    """审批流程服务"""
    
    @staticmethod
    def create_approval_request(tenant_id: str, requester_id: str, 
                              approval_type: ApprovalType, title: str,
                              resource_type: str = None, resource_id: str = None,
                              request_data: dict = None) -> ApprovalRequest:
        """创建审批请求"""
        
        # 查找适用的审批流程
        flow = ApprovalFlow.query.filter_by(
            tenant_id=tenant_id,
            approval_type=approval_type,
            is_active=True
        ).first()
        
        if not flow:
            raise ValueError(f"未找到适用的审批流程: {approval_type.value}")
        
        # 检查是否满足自动批准条件
        if ApprovalService._check_auto_approve(flow, request_data or {}):
            status = ApprovalStatus.APPROVED
            current_step = len(flow.steps)
        else:
            status = ApprovalStatus.PENDING
            current_step = 1
        
        # 创建审批请求
        request = ApprovalRequest(
            tenant_id=tenant_id,
            flow_id=flow.id,
            requester_id=requester_id,
            title=title,
            approval_type=approval_type,
            resource_type=resource_type,
            resource_id=resource_id,
            request_data=request_data or {},
            status=status,
            current_step=current_step
        )
        
        db.session.add(request)
        
        # 创建审批步骤
        for step_config in flow.steps:
            step = ApprovalStep(
                request_id=request.id,
                step_number=step_config['step'],
                approver_role=step_config['role'],
                status=ApprovalStatus.APPROVED if status == ApprovalStatus.APPROVED 
                       else ApprovalStatus.PENDING if step_config['step'] == 1 
                       else ApprovalStatus.PENDING
            )
            db.session.add(step)
        
        db.session.commit()
        
        # 发送通知
        if status == ApprovalStatus.PENDING:
            ApprovalService._notify_approvers(request)
        
        return request
  
    @staticmethod
    def _verify_approver_permission(step: ApprovalStep, approver_id: str) -> bool:
        """验证审批人权限"""
        # 查询审批人在租户中的角色
        tenant_join = TenantAccountJoin.query.filter_by(
            account_id=approver_id,
            tenant_id=step.request.tenant_id
        ).first()
        
        if not tenant_join:
            return False
        
        # 检查角色是否匹配
        required_role = step.approver_role
        user_role = tenant_join.role
        
        # 角色层次检查
        role_hierarchy = ['normal', 'editor', 'admin', 'owner']
        try:
            user_level = role_hierarchy.index(user_role)
            required_level = role_hierarchy.index(required_role)
            return user_level >= required_level
        except ValueError:
            return False
# api/controllers/console/approval.py - 审批控制器
from flask import request, jsonify
class ApprovalRequestResource(Resource):
    """审批请求资源"""
    
    @login_required
    @tenant_required()
    def post(self):
        """创建审批请求"""
        data = request.get_json()
        
    
    @login_required
    @tenant_required()
    def get(self):
        """获取审批请求列表"""
        page = request.args.get('page', 1, type=int)
        per_page = request.args.get('per_page', 20, type=int)
        status = request.args.get('status')
        
        query = ApprovalRequest.query.filter_by(tenant_id=g.current_tenant.id)
        
        if status:
            query = query.filter_by(status=ApprovalStatus(status))
        
        requests = query.paginate(page=page, per_page=per_page)
        
        return {
            'data': [self._serialize_request(req) for req in requests.items],
            'total': requests.total,
            'page': page,
            'per_page': per_page
        }

class ApprovalActionResource(Resource):
    """审批操作资源"""
    
    @login_required
    @tenant_required()
    def post(self, request_id):
        """处理审批操作"""
        data = request.get_json()
        action = data.get('action')  # 'approve' or 'reject'
        comment = data.get('comment')
        
        if action not in ['approve', 'reject']:
            return {'error': '无效的操作'}, 400
        
        try:
            approval_request = ApprovalService.process_approval(
                request_id=request_id,
                approver_id=current_user.id,
                action=action,
                comment=comment
            )
            
            return {
                'id': str(approval_request.id),
                'status': approval_request.status.value,
                'message': f'审批操作已完成: {action}'
            }
            
        except Exception as e:
            return {'error': str(e)}, 400

3.2 通知系统集成

审批流程需要及时的通知机制：

# api/services/notification_service.py - 通知服务
from typing import List, Dict
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart

class NotificationService:
    """通知服务"""
    
    @staticmethod
    def notify_approval_request(request: ApprovalRequest, approvers: List[Account]):
        """通知审批请求"""
        subject = f"新的审批请求: {request.title}"
        
        for approver in approvers:
            NotificationService._send_email(
                to_email=approver.email,
                subject=subject,
                template='approval_request',
                context={
                    'approver_name': approver.name,
                    'request_title': request.title,
                    'requester_name': request.requester.name,
                    'approval_url': f"{current_app.config['WEB_URL']}/approvals/{request.id}"
                }
            )

四、企业级监控：全方位的可观测性

4.1 指标收集与分析

企业级应用需要全方位的监控能力，让我们设计一个完整的监控系统：

# api/models/metrics.py - 指标模型
class MetricType(Enum):
    COUNTER = 'counter'      # 计数器
    GAUGE = 'gauge'          # 仪表
    HISTOGRAM = 'histogram'  # 直方图
    TIMER = 'timer'          # 计时器

class SystemMetric(db.Model):
    """系统指标表"""
    __tablename__ = 'system_metrics'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    
    # 指标信息
    metric_name = db.Column(db.String(100), nullable=False)
    metric_type = db.Column(db.Enum(MetricType), nullable=False)
    value = db.Column(db.Float, nullable=False)
    
    # 标签和维度
    labels = db.Column(JSON)  # {"app_id": "xxx", "model": "gpt-4", "user_id": "yyy"}
    
    # 时间戳
    timestamp = db.Column(db.DateTime, default=datetime.utcnow, index=True)
    
    # 索引优化
    __table_args__ = (
        db.Index('idx_metrics_tenant_name_time', 'tenant_id', 'metric_name', 'timestamp'),
        db.Index('idx_metrics_labels_gin', 'labels', postgresql_using='gin'),
    )

class AuditLog(db.Model):
    """审计日志表"""
    __tablename__ = 'audit_logs'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    
    # 操作信息
    user_id = db.Column(UUID, db.ForeignKey('accounts.id'))
    action = db.Column(db.String(50), nullable=False)  # 'create', 'update', 'delete'
    resource_type = db.Column(db.String(50))  # 'app', 'dataset', 'model'
    resource_id = db.Column(UUID)
    
    # 详细信息
    description = db.Column(db.Text)
    ip_address = db.Column(db.String(45))
    user_agent = db.Column(db.String(255))
    
    # 变更详情
    old_values = db.Column(JSON)
    new_values = db.Column(JSON)
    
    # 时间戳
    timestamp = db.Column(db.DateTime, default=datetime.utcnow, index=True)
    
    # 关联关系
    user = db.relationship('Account')

# api/services/monitoring_service.py - 监控服务
import time
from functools import wraps
from collections import defaultdict
import threading

class MonitoringService:
    """监控服务"""
    
    @staticmethod
    def record_audit_log(tenant_id: str, user_id: str, action: str,
                        resource_type: str = None, resource_id: str = None,
                        description: str = None, old_values: dict = None,
                        new_values: dict = None):
        """记录审计日志"""
        
        # 获取请求信息
        ip_address = request.remote_addr if request else None
        user_agent = request.headers.get('User-Agent') if request else None
        
        audit_log = AuditLog(
            tenant_id=tenant_id,
            user_id=user_id,
            action=action,
            resource_type=resource_type,
            resource_id=resource_id,
            description=description,
            ip_address=ip_address,
            user_agent=user_agent,
            old_values=old_values,
            new_values=new_values
        )
        
        db.session.add(audit_log)
        db.session.commit()

def monitor_performance(metric_name: str, labels: dict = None):
    """性能监控装饰器"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            start_time = time.time()
            
            try:
                result = func(*args, **kwargs)
                # 记录成功指标
                return result
                
            except Exception as e:
                # 记录错误指标
                duration = time.time() - start_time
                tenant_id = getattr(g, 'current_tenant', {}).get('id') if hasattr(g, 'current_tenant') else None
                
                if tenant_id:
                    error_labels = (labels or {}).copy()
                    error_labels.update({
                        'function': func.__name__,
                        'status': 'error',
                        'error_type': type(e).__name__
                    })
                    
                    MonitoringService.record_metric(
                        tenant_id=str(tenant_id),
                        metric_name=f"{metric_name}_errors",
                        value=1,
                        metric_type=MetricType.COUNTER,
                        labels=error_labels
                    )
                
                raise
        
        return wrapper
    return decorator

# api/controllers/console/monitoring.py - 监控控制器
class MonitoringResource(Resource):
    """监控资源"""
    
    @login_required
    @tenant_required('admin')
    def get(self):
        """获取监控指标"""
        metric_name = request.args.get('metric_name')
        start_time = request.args.get('start_time')
        end_time = request.args.get('end_time')
        
        if not all([metric_name, start_time, end_time]):
            return {'error': '缺少必要参数'}, 400
        
        try:
            start_dt = datetime.fromisoformat(start_time)
            end_dt = datetime.fromisoformat(end_time)
            
            summary = MonitoringService.get_metrics_summary(
                tenant_id=str(g.current_tenant.id),
                metric_name=metric_name,
                start_time=start_dt,
                end_time=end_dt
            )
            
            return summary
            
        except Exception as e:
            return {'error': str(e)}, 400

class AuditLogResource(Resource):
    """审计日志资源"""
    
    @login_required
    @tenant_required('admin')
    def get(self):
        """获取审计日志"""
        return {
            'data': [
                {
                    'id': str(log.id),
                    'user_name': log.user.name if log.user else 'System',
                    'action': log.action,
                    'resource_type': log.resource_type,
                    'resource_id': str(log.resource_id) if log.resource_id else None,
                    'description': log.description,
                    'ip_address': log.ip_address,
                    'timestamp': log.timestamp.isoformat()
                }
                for log in logs.items
            ],
            'total': logs.total,
            'page': page,
            'per_page': per_page
        }

4.2 实时告警系统

企业级监控离不开智能告警系统：

# api/models/alert.py - 告警模型
class AlertSeverity(Enum):
    INFO = 'info'
    WARNING = 'warning'
    ERROR = 'error'
    CRITICAL = 'critical'

class AlertRule(db.Model):
    """告警规则表"""
    __tablename__ = 'alert_rules'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    
    # 规则基本信息
    name = db.Column(db.String(100), nullable=False)
    description = db.Column(db.Text)
    is_enabled = db.Column(db.Boolean, default=True)
    
    # 指标条件
    metric_name = db.Column(db.String(100), nullable=False)
    operator = db.Column(db.String(10), nullable=False)  # '>', '<', '>=', '<=', '=='
    threshold = db.Column(db.Float, nullable=False)
    time_window = db.Column(db.Integer, default=300)  # 时间窗口（秒）
    
    # 告警级别和频率控制
    severity = db.Column(db.Enum(AlertSeverity), default=AlertSeverity.WARNING)
    cooldown_period = db.Column(db.Integer, default=1800)  # 冷却期（秒）
    
    # 通知配置
    notification_channels = db.Column(JSON)  # ['email', 'webhook', 'slack']
    
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
# api/services/alert_service.py - 告警服务
import asyncio
from typing import List
import json

class AlertService:
    """告警服务"""
    
    # 告警状态缓存
    _active_alerts = {}
    
    @staticmethod
    def check_alert_rules(tenant_id: str):
        """检查告警规则"""
        rules = AlertRule.query.filter_by(
            tenant_id=tenant_id,
            is_enabled=True
        ).all()
        
        for rule in rules:
            AlertService._evaluate_rule(rule)
    @staticmethod
    def _is_in_cooldown(rule_key: str, cooldown_period: int) -> bool:
        """检查是否在冷却期内"""
        if rule_key not in AlertService._active_alerts:
            return False
        
        fired_at = AlertService._active_alerts[rule_key]['fired_at']
        return (datetime.utcnow() - fired_at).total_seconds() < cooldown_period
   
    @staticmethod
    def _send_email_alert(alert: Alert):
        """发送邮件告警"""
        # 获取租户管理员邮箱
        admin_emails = db.session.query(Account.email).join(
            TenantAccountJoin
        ).filter(
            TenantAccountJoin.tenant_id == alert.tenant_id,
            TenantAccountJoin.role.in_(['admin', 'owner'])
        ).all()
        
        for (email,) in admin_emails:
            NotificationService._send_email(
                to_email=email,
                subject=f"[{alert.severity.value.upper()}] {alert.title}",
                template='alert_notification',
                context={
                    'alert_title': alert.title,
                    'alert_message': alert.message,
                    'severity': alert.severity.value,
                    'fired_at': alert.fired_at.strftime('%Y-%m-%d %H:%M:%S')
                }
            )
# api/services/performance_analyzer.py - 性能分析服务
class PerformanceAnalyzer:
    """性能分析服务"""
    @staticmethod
    def _generate_recommendations(metrics: dict) -> List[dict]:
        """生成性能优化建议"""
        recommendations = []
        
        # 响应时间建议
        avg_response_time = metrics['response_time'].get('avg', 0)
        if avg_response_time > 2.0:
            recommendations.append({
                'type': 'performance',
                'priority': 'high',
                'title': '响应时间过长',
                'description': f'平均响应时间为 {avg_response_time:.2f} 秒，建议优化提示词或考虑使用更快的模型',
                'actions': [
                    '简化提示词模板',
                    '减少不必要的上下文',
                    '考虑使用GPT-3.5-turbo替代GPT-4',
                    '启用响应流式传输'
                ]
            })
        
        # 错误率建议
        error_count = metrics['error_rate'].get('sum', 0)
        request_count = metrics['request_count'].get('sum', 1)
        error_rate = error_count / request_count if request_count > 0 else 0
        
        if error_rate > 0.05:
            recommendations.append({
                'type': 'reliability',
                'priority': 'high',
                'title': '错误率较高',
                'description': f'错误率为 {error_rate*100:.1f}%，需要检查配置和处理逻辑',
                'actions': [
                    '检查模型配置是否正确',
                    '增加错误处理和重试机制',
                    '验证输入数据格式',
                    '检查API密钥和配额'
                ]
            })
        return recommendations

# api/tasks/monitoring_tasks.py - 定时监控任务
from celery import Celery

@celery.task
def check_all_tenant_alerts():
    """检查所有租户的告警规则"""
    tenants = Tenant.query.filter_by(status='active').all()
    
    for tenant in tenants:
        try:
            AlertService.check_alert_rules(str(tenant.id))
        except Exception as e:
            print(f"检查租户 {tenant.id} 告警规则失败: {e}")

@celery.task
def flush_metrics_cache():
    """刷新指标缓存到数据库"""
    for tenant_id in list(MonitoringService._metrics_cache.keys()):
        try:
            MonitoringService._flush_metrics(tenant_id)
        except Exception as e:
            print(f"刷新租户 {tenant_id} 指标缓存失败: {e}")

@celery.task
def generate_daily_reports():
    """生成每日监控报告"""
    tenants = Tenant.query.filter_by(status='active').all()
    
    for tenant in tenants:
        try:
            # 生成应用性能报告
            apps = App.query.filter_by(tenant_id=tenant.id).all()
            
            for app in apps:
                report = PerformanceAnalyzer.analyze_app_performance(
                    tenant_id=str(tenant.id),
                    app_id=str(app.id),
                    days=1
                )
                
                # 如果性能得分低于阈值，发送通知
                if report['performance_score'] < 70:
                    # 发送性能警告通知
                    pass
                    
        except Exception as e:
            print(f"生成租户 {tenant.id} 日报失败: {e}")

五、配置管理与最佳实践

5.1 企业级配置管理

# api/models/enterprise_config.py - 企业配置模型
class ConfigCategory(Enum):
    SSO = 'sso'
    SECURITY = 'security'
    MONITORING = 'monitoring'
    NOTIFICATION = 'notification'
    APPROVAL = 'approval'

class EnterpriseConfig(db.Model):
    """企业配置表"""
    __tablename__ = 'enterprise_configs'
    
    id = db.Column(UUID, primary_key=True, default=uuid.uuid4)
    tenant_id = db.Column(UUID, db.ForeignKey('tenants.id'), nullable=False)
    
    # 配置信息
    category = db.Column(db.Enum(ConfigCategory), nullable=False)
    key = db.Column(db.String(100), nullable=False)
    value = db.Column(JSON, nullable=False)
    
    # 元数据
    description = db.Column(db.Text)
    is_sensitive = db.Column(db.Boolean, default=False)  # 是否敏感配置
    
    # 版本控制
    version = db.Column(db.Integer, default=1)
    created_by = db.Column(UUID, db.ForeignKey('accounts.id'))
    
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
    
    # 唯一索引
    __table_args__ = (
        db.UniqueConstraint('tenant_id', 'category', 'key', name='uk_tenant_category_key'),
    )

# api/services/config_service.py - 配置服务
class ConfigService:
    """配置管理服务"""
    
    # 配置缓存
    _config_cache = {}
    _cache_lock = threading.Lock()
    
    @staticmethod
    def get_config(tenant_id: str, category: ConfigCategory, 
                   key: str, default=None):
        """获取配置值"""
        cache_key = f"{tenant_id}:{category.value}:{key}"
        
        # 先查缓存
        with ConfigService._cache_lock:
            if cache_key in ConfigService._config_cache:
                return ConfigService._config_cache[cache_key]
        
        # 查数据库
        config = EnterpriseConfig.query.filter_by(
            tenant_id=tenant_id,
            category=category,
            key=key
        ).first()
        
        value = config.value if config else default
        
        # 更新缓存
        with ConfigService._cache_lock:
            ConfigService._config_cache[cache_key] = value
        
        return value
    
    @staticmethod
    def get_all_configs(tenant_id: str, category: ConfigCategory = None) -> dict:
        """获取所有配置"""
        query = EnterpriseConfig.query.filter_by(tenant_id=tenant_id)
        
        if category:
            query = query.filter_by(category=category)
        
        configs = query.all()
        
        result = {}
        for config in configs:
            if config.category.value not in result:
                result[config.category.value] = {}
            
            # 敏感配置不返回具体值
            if config.is_sensitive:
                result[config.category.value][config.key] = '***'
            else:
                result[config.category.value][config.key] = config.value
        
        return result

5.2 部署与运维指南

最后，让我们总结一下企业级功能的部署最佳实践：

# docker-compose.enterprise.yml - 企业级部署配置
version: '3.8'

services:
  api:
    build: ./api
    environment:
      # 基础配置
      - FLASK_ENV=production
      # SSO配置
      - SSO_ENABLED=true
      # 监控配置
      - MONITORING_ENABLED=true
      # 安全配置
      - ADMIN_API_KEY=${ADMIN_API_KEY}
      # 邮件配置
      - MAIL_SERVER=${MAIL_SERVER}
    volumes:
      - ./logs:/app/logs
      - ./configs:/app/configs
    
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # 添加监控组件
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    volumes:
      - grafana_data:/var/lib/grafana

# deployment/health_check.py - 健康检查脚本
import requests
import sys
import time

def check_api_health():
    """检查API服务健康状态"""
    try:
        response = requests.get('http://localhost:5001/health', timeout=10)
        return response.status_code == 200
    except:
        return False

def check_database_health():
    """检查数据库连接"""
    try:
        from extensions.ext_database import db
        db.session.execute('SELECT 1')
        return True
    except:
        return False

def check_redis_health():
    """检查Redis连接"""
    try:
        import redis
        r = redis.Redis.from_url(os.getenv('REDIS_URL'))
        r.ping()
        return True
    except:
        return False

def main():
    """主健康检查"""
    checks = [
        ('API服务', check_api_health),
        ('数据库', check_database_health),
        ('Redis', check_redis_health)
    ]
    
    all_healthy = True
    
    for name, check_func in checks:
        if check_func():
            print(f"✓ {name} 健康")
        else:
            print(f"✗ {name} 异常")
            all_healthy = False
    
    sys.exit(0 if all_healthy else 1)

if __name__ == '__main__':
    main()