logan
344c519209
P0-1 认证安全: - JWT secret 改为环境变量配置, 未设置则随机生成(重启失效) - 新增 LoginRateLimitMiddleware: 5次/分钟登录频率限制(滑动窗口) - 429 响应 + 前端 toast 提示 P0-2 操作审计日志: - 新增 OperationLog 模型 (user/username/action/resource/detail/ip) - 新增 AuditLogMiddleware 自动记录 POST/PUT/DELETE/PATCH 操作 - 新增 GET /audit-logs API (分页/过滤/统计) - 前端 AuditLogsPage 对接真实 API (字段/路径修正) P0-3 实例密码加密: - 已确认 crypto.py AES-256-GCM 加密存储, 无需修改 P1 前端错误提示: - 新增 useToast hook + ToastContainer 组件 - request.ts 拦截器: 4xx/5xx 错误 toast 显示后端 detail 信息 - 422 验证错误提取第一条 msg - 网络失败显示通用提示 1182 tests passed
41 lines
1.2 KiB
Python
41 lines
1.2 KiB
Python
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
from functools import lru_cache
|
|
|
|
|
|
import secrets
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
ENV: str = "development"
|
|
DEBUG: bool = True
|
|
|
|
# JWT secret: 生产环境必须通过环境变量设置
|
|
# 若未设置则每次启动随机生成（重启后旧 token 失效）
|
|
SECRET_KEY: str = ""
|
|
ACCESS_TOKEN_EXPIRE_MINUTES: int = 480 # 8小时
|
|
ALGORITHM: str = "HS256"
|
|
|
|
DATABASE_URL: str = "sqlite+aiosqlite:///./sqlite3.db"
|
|
|
|
ADMIN_USERNAME: str = "admin"
|
|
ADMIN_PASSWORD: str = "123456"
|
|
|
|
# CORS: production comma-separated origins (e.g. "https://sql.example.com,https://sql2.example.com")
|
|
CORS_ORIGINS: str = ""
|
|
|
|
# 登录频率限制: 每IP每分钟最多尝试次数
|
|
LOGIN_RATE_LIMIT: int = 10
|
|
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")
|
|
|
|
|
|
@lru_cache()
|
|
def get_settings() -> Settings:
|
|
s = Settings()
|
|
if not s.SECRET_KEY:
|
|
s.SECRET_KEY = secrets.token_urlsafe(32)
|
|
if s.ENV == "development":
|
|
import logging
|
|
logging.getLogger(__name__).info("SECRET_KEY 未设置，已自动生成（重启后失效）")
|
|
return s
|