225 lines
8.5 KiB
Python
225 lines
8.5 KiB
Python
from pydantic import field_validator
|
||
from pydantic_settings import BaseSettings
|
||
from typing import Optional
|
||
from pathlib import Path
|
||
import os
|
||
|
||
# 已知弱/占位 JWT 密钥：启动时一律拒绝（勿再当作默认值）
|
||
_INSECURE_JWT_SECRET_KEYS = frozenset(
|
||
{
|
||
"",
|
||
"secret",
|
||
"changeme",
|
||
"change-me",
|
||
"your-secret-key",
|
||
"your-secret-key-change-in-production",
|
||
"your-secret-key-change-in-production-please-use-random-string",
|
||
}
|
||
)
|
||
_MIN_JWT_SECRET_KEY_LEN = 32
|
||
|
||
|
||
class Settings(BaseSettings):
|
||
"""应用配置"""
|
||
|
||
# 应用基础配置
|
||
APP_NAME: str = "zkxw 管理骨架"
|
||
DEBUG: bool = True
|
||
API_V1_PREFIX: str = "/api"
|
||
|
||
# 数据库配置
|
||
DATABASE_URL: str = "mysql+pymysql://root:password@localhost:3306/sanqiang"
|
||
|
||
# JWT配置（必须通过环境变量配置；禁止弱默认值）
|
||
SECRET_KEY: str = ""
|
||
ALGORITHM: str = "HS256"
|
||
ACCESS_TOKEN_EXPIRE_MINUTES: int = 30 * 24 * 60 # 30天
|
||
|
||
@field_validator("SECRET_KEY")
|
||
@classmethod
|
||
def secret_key_must_be_strong(cls, value: str) -> str:
|
||
key = (value or "").strip()
|
||
if key.lower() in _INSECURE_JWT_SECRET_KEYS or key in _INSECURE_JWT_SECRET_KEYS:
|
||
raise ValueError(
|
||
"SECRET_KEY 未配置或仍为弱占位值。"
|
||
"请在环境文件中设置至少 32 字符的随机密钥，例如："
|
||
'python -c "import secrets; print(secrets.token_urlsafe(48))"'
|
||
)
|
||
if len(key) < _MIN_JWT_SECRET_KEY_LEN:
|
||
raise ValueError(
|
||
f"SECRET_KEY 长度不足（当前 {len(key)}，至少 {_MIN_JWT_SECRET_KEY_LEN}）。"
|
||
"请使用 secrets.token_urlsafe(48) 等方式生成。"
|
||
)
|
||
return key
|
||
|
||
# CORS配置
|
||
BACKEND_CORS_ORIGINS: list = [
|
||
"http://localhost:5173", # art-design-pro 开发服务器
|
||
"http://localhost:8080",
|
||
"http://localhost:8081", # uni-app H5 端口被占用时常用
|
||
"http://localhost:8082",
|
||
"http://127.0.0.1:5173",
|
||
"http://127.0.0.1:8080",
|
||
"http://127.0.0.1:8081",
|
||
"http://127.0.0.1:8082",
|
||
"http://localhost:3000", # Web开发
|
||
"http://localhost:3006", # Web开发
|
||
"http://127.0.0.1:3000",
|
||
"http://127.0.0.1:3006",
|
||
]
|
||
|
||
# 文件存储配置
|
||
STORAGE_TYPE: str = "local" # local, qiniu, oss, minio
|
||
|
||
# 本地存储配置
|
||
LOCAL_UPLOAD_DIR: str = "uploads"
|
||
LOCAL_STORAGE_URL: str = "/uploads"
|
||
|
||
# Redis 配置（用于登录会话与 refreshToken 吊销）
|
||
# 未配置 REDIS_HOST 时，后端会保持兼容：仍然只校验 JWT，不强制会话吊销。
|
||
REDIS_HOST: str = ""
|
||
REDIS_PORT: int = 6379
|
||
REDIS_DB: int = 0
|
||
REDIS_PASSWORD: str = ""
|
||
REDIS_TIMEOUT_SEC: int = 30
|
||
REDIS_SSL_ENABLED: bool = False
|
||
|
||
# 七牛云存储配置 (生产环境推荐)
|
||
QINIU_ACCESS_KEY: str = ""
|
||
QINIU_SECRET_KEY: str = ""
|
||
QINIU_BUCKET: str = ""
|
||
QINIU_DOMAIN: str = ""
|
||
|
||
# 阿里云OSS配置 (可选)
|
||
OSS_ACCESS_KEY_ID: str = ""
|
||
OSS_ACCESS_KEY_SECRET: str = ""
|
||
OSS_BUCKET: str = ""
|
||
OSS_ENDPOINT: str = ""
|
||
OSS_DOMAIN: str = ""
|
||
|
||
# MinIO配置
|
||
MINIO_ENDPOINT: str = ""
|
||
MINIO_ACCESS_KEY: str = ""
|
||
MINIO_SECRET_KEY: str = ""
|
||
MINIO_BUCKET: str = ""
|
||
MINIO_SECURE: bool = False
|
||
MINIO_BASE_URL: str = ""
|
||
|
||
# 微信支付配置 (生产环境必需)
|
||
WXPAY_MCHID: str = "" # 商户号
|
||
WXPAY_APPID: str = "" # 公众号AppID
|
||
WXPAY_MINI_APPID: str = "" # 小程序AppID
|
||
WXPAY_API_KEY: str = "" # API密钥 (V2)
|
||
WXPAY_SANDBOX: bool = False # 是否使用沙箱环境
|
||
WXPAY_NOTIFY_URL: str = "https://your-domain.com/api/payment/notify" # 支付回调地址
|
||
WXPAY_REFUND_NOTIFY_URL: str = "https://your-domain.com/api/payment/refund-notify" # 退款回调地址
|
||
# V3 API 证书配置
|
||
WXPAY_CERT_PATH: str = "" # API证书(apiclient_cert.pem)路径
|
||
WXPAY_PRIVATE_KEY_PATH: str = "" # API私钥(apiclient_key.pem)路径
|
||
WXPAY_SERIAL_NO: str = "" # 证书序列号
|
||
|
||
# SSL证书配置 (退款必需)
|
||
WXPAY_SSL_CERT: str = "" # SSL证书路径
|
||
WXPAY_SSL_KEY: str = "" # SSL私钥路径
|
||
|
||
# 微信小程序配置
|
||
WXPAY_SECRET: str = "" # 小程序Secret
|
||
|
||
# 微信模板消息ID配置
|
||
WX_TEMPLATE_ORDER_STATUS: str = "" # 订单状态通知模板ID
|
||
WX_TEMPLATE_DELIVERY_NOTICE: str = "" # 配送通知模板ID
|
||
WX_TEMPLATE_PAYMENT_SUCCESS: str = "" # 支付成功通知模板ID
|
||
WX_TEMPLATE_REFUND_RESULT: str = "" # 退款结果通知模板ID
|
||
WX_TEMPLATE_DELIVERY_WARNING: str = "" # 配送时效预警模板ID
|
||
|
||
# 微信服务号（OA 审批/抄送通知）
|
||
# 总开关：false 时不发送审批/抄送/申请人进度模板消息（模板未就绪或微信能力不可用时关闭）
|
||
WX_MP_NOTIFY_ENABLED: bool = False
|
||
WX_MP_APPID: str = ""
|
||
WX_MP_SECRET: str = ""
|
||
WX_MP_TEMPLATE_APPROVAL: str = ""
|
||
WX_MP_TEMPLATE_CC: str = ""
|
||
WX_MP_TEMPLATE_APPLICANT_PROGRESS: str = ""
|
||
# 审批模板：申请事项/操作人(申请人)/当前环节/操作时间/申请类型(流程名)
|
||
# 生产字段：thing12 / thing18 / thing7 / time17 / thing8
|
||
WX_MP_TPL_FIELD_TITLE: str = "thing12"
|
||
WX_MP_TPL_FIELD_APPLICANT: str = "thing18"
|
||
WX_MP_TPL_FIELD_NODE: str = "thing7"
|
||
WX_MP_TPL_FIELD_TIME: str = "time17"
|
||
WX_MP_TPL_FIELD_PROCESS: str = "thing8"
|
||
# 抄送模板「OA抄送通知」：业务名称/申请人/申请时间/流程名称（无当前环节）
|
||
WX_MP_TPL_CC_FIELD_TITLE: str = "thing5"
|
||
WX_MP_TPL_CC_FIELD_APPLICANT: str = "thing2"
|
||
WX_MP_TPL_CC_FIELD_TIME: str = "time3"
|
||
WX_MP_TPL_CC_FIELD_PROCESS: str = "thing1"
|
||
# 申请人进度：业务名称/流程名称/审批人/审批结果(const)/审批时间
|
||
WX_MP_TPL_PROGRESS_FIELD_BUSINESS: str = "thing5"
|
||
WX_MP_TPL_PROGRESS_FIELD_PROCESS: str = "thing1"
|
||
WX_MP_TPL_PROGRESS_FIELD_APPROVER: str = "thing6"
|
||
WX_MP_TPL_PROGRESS_FIELD_RESULT: str = "const4"
|
||
WX_MP_TPL_PROGRESS_FIELD_TIME: str = "time11"
|
||
|
||
# 与 docs/sql/zkxw.sql 基线一致：登录按租户 + sys_user.user_no
|
||
DEFAULT_TENANT_NO: str = "zkxw"
|
||
# 已废弃：无角色用户固定为 guest，不可通过环境变量提升为 super_admin
|
||
WEB_AUTH_DEFAULT_ROLE: str = "guest"
|
||
|
||
# 登录 RSA：私钥 PEM（多实例建议配置同一私钥；留空则各 Worker 共用内置默认密钥 login_rsa_default.pem）
|
||
LOGIN_RSA_PRIVATE_KEY_PEM: str = ""
|
||
# 是否允许明文 username/password 登录（仅建议本地排障临时开启；生产务必 false）
|
||
LOGIN_ALLOW_PLAINTEXT_LOGIN: bool = False
|
||
# 加密载荷内时间戳允许偏差（秒），防简单重放
|
||
LOGIN_ENCRYPT_TS_SKEW_SEC: int = 300
|
||
|
||
# 临时文件目录
|
||
TEMP_FILE_DIR: str = "temp_files"
|
||
|
||
# 全量 API 请求日志（中间件写入 sys_api_request_log）
|
||
API_REQUEST_LOG_ENABLED: bool = True
|
||
API_REQUEST_LOG_MAX_BODY: int = 65536
|
||
API_REQUEST_LOG_MAX_BODY_BYTES: int = 131072
|
||
|
||
# Web API 请求/响应加密配置
|
||
API_ENCRYPT_ENABLED: bool = False
|
||
API_ENCRYPT_FAIL_OPEN: bool = True
|
||
API_ENCRYPT_FIXED_SECRET: str = ""
|
||
API_ENCRYPT_TS_SKEW_SEC: int = 300
|
||
API_ENCRYPT_NONCE_TTL_SEC: int = 300
|
||
WX_QR_SESSION_TTL_SEC: int = 180
|
||
WX_QR_ENV_VERSION: str = "release" # release | trial | develop
|
||
WX_QR_PAGE: str = "pages/login/web-qr/index"
|
||
API_ENCRYPT_EXCLUDE_PATHS: str = (
|
||
"/,"
|
||
"/health,"
|
||
"/docs,"
|
||
"/openapi.json,"
|
||
"/api/web/auth/login-rsa-public-key,"
|
||
"/api/web/auth/login,"
|
||
"/api/web/auth/refresh-token,"
|
||
"/api/mini/auth/wechat-login,"
|
||
"/api/web/admin/attachment/upload,"
|
||
"/api/web/admin/products/upload-image,"
|
||
"/api/web/admin/categories/upload-image,"
|
||
"/api/web/admin/users/upload-avatar,"
|
||
"/api/web/auth/upload-avatar,"
|
||
"/api/invoice/download,"
|
||
"/api/web/auth/wx-qr/create,"
|
||
"/api/web/auth/wx-qr/status,"
|
||
"/api/mini/auth/web-qr-scanned,"
|
||
"/api/mini/auth/web-qr-confirm"
|
||
)
|
||
|
||
# 中国节假日日历（ailcc）同步
|
||
CN_HOLIDAY_API_BASE: str = "https://holiday.ailcc.com"
|
||
CN_HOLIDAY_HTTP_TIMEOUT_SEC: int = 15
|
||
CN_HOLIDAY_HTTP_RETRIES: int = 2
|
||
|
||
class Config:
|
||
# 支持通过 ENV_FILE 指定环境文件；未指定时回退到 backend/.env
|
||
_default_env_file = Path(__file__).resolve().parents[2] / ".env"
|
||
env_file = os.getenv("ENV_FILE", str(_default_env_file))
|
||
case_sensitive = True
|
||
|
||
|
||
settings = Settings()
|