498d29dfa9
严重修复: - C1: JWT密钥生成64字节随机字符串替代硬编码占位符 - C2: 数据库密码改为随机强密码，移除宿主机端口映射 - C3: 管理员默认密码改为强密码 高危修复: - H1: 移除数据库54326端口映射，仅内部网络访问 - H3: 添加X-Frame-Options/CSP/XSS-Protection等安全头 - H4: 前端所有innerHTML拼接处添加escapeHtml转义防XSS - H5: SMTP密码在API响应中脱敏显示 - H6: 债务列表接口添加用户隔离，普通用户只能看自己的数据 - H7: 债务详情/计划/记录接口添加归属校验 - H8: 账户级暴力破解锁定(5次失败锁定5分钟) - H9: 速率限制数据增加过期清理机制防内存泄漏 中危修复: - M1: 注册/重置密码接口添加后端密码强度校验(最少8位) - M4: 添加全局异常处理器，500错误不再暴露堆栈 - M5: Docker容器改为非root用户运行 - M6: 添加.dockerignore排除pyc和敏感文件 - M7: 管理员操作写入审计日志 - M8: CORS限制为实际使用的HTTP方法和头 其他: - Nginx隐藏版本号(server_tokens off) - 管理员角色修改添加枚举校验 - 密码重置验证码接口返回统一错误信息
33 lines
1016 B
Python
33 lines
1016 B
Python
from pydantic_settings import BaseSettings
|
|
from functools import lru_cache
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
PROJECT_NAME: str = "债务管理系统"
|
|
API_V1_PREFIX: str = "/api/v1"
|
|
DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@db:5432/debt_manager"
|
|
REDIS_URL: str = "redis://redis:6379/0"
|
|
SECRET_KEY: str = "562fa55e5e0cea1e00ff645be1da4f7c932439d97de7ffacd3d95156d9ccd7af"
|
|
ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
|
|
REFRESH_TOKEN_EXPIRE_DAYS: int = 7
|
|
CORS_ORIGINS: list[str] = ["http://localhost", "http://localhost:80", "http://localhost:806"]
|
|
ADMIN_EMAIL: str = "admin@example.com"
|
|
ADMIN_PASSWORD: str = "Adm1n!2026#Str0ng"
|
|
|
|
SMTP_HOST: str = ""
|
|
SMTP_PORT: int = 465
|
|
SMTP_USER: str = ""
|
|
SMTP_PASSWORD: str = ""
|
|
SMTP_FROM: str = ""
|
|
SMTP_USE_TLS: bool = True
|
|
NOTIFICATION_CHECK_INTERVAL_MINUTES: int = 60
|
|
REMINDER_DAYS_BEFORE: int = 7
|
|
|
|
class Config:
|
|
env_file = ".env"
|
|
|
|
|
|
@lru_cache()
|
|
def get_settings():
|
|
return Settings()
|