浅念
6880ff1b97
后端: - POST /api/auth/login:admin 账密(Settings 默认 admin/admin123, ADMIN_USER/ADMIN_PASSWORD 可覆盖)换取共享 api_token,免 token 中间件 - 防爆破:同 IP 15min 窗口内 5 次失败锁 15min(429),成功登录清零 - 错误信息统一「用户名或密码错误」(防用户名枚举) - 测试 7 个新增(TDD),全量 500 绿 前端: - LoginView + 路由守卫(未登录跳 /login,回跳 redirect) - axios 请求拦截器自动带 Bearer;401 清登录态回登录页 - 媒体直链统一 mediaUrl() 带 ?token=(img/audio 标签发不了 header), 替换 4 处裸拼;downloadBlob 手动带头 - isLoggedIn 按 key 存在判定 — 后端鉴权关闭时空 token 不锁死登录页 - MainLayout 侧栏底部退出登录 compose:两份编排透传 ADMIN_USER/ADMIN_PASSWORD(默认 admin/admin123) Co-Authored-By: Claude Code <noreply@anthropic.com>
107 lines
3.8 KiB
Python
107 lines
3.8 KiB
Python
"""FastAPI app for the yunke data-mirror viewing API.
|
|
|
|
Run locally with::
|
|
|
|
uvicorn app.api.main:app --reload
|
|
|
|
Includes:
|
|
* ``GET /api/health`` -> ``{"status": "ok"}`` liveness probe.
|
|
* ``GET /api/customers`` (see :mod:`app.api.routers.customer`).
|
|
* ``GET /api/media/{media_hash}`` (see :mod:`app.api.routers.media`).
|
|
* ``GET /api/departments`` / ``/api/staff`` / ``/api/accounts``
|
|
(see :mod:`app.api.routers.organization`).
|
|
* ``GET /api/messages`` (see :mod:`app.api.routers.messages`).
|
|
* ``GET /api/moments`` (see :mod:`app.api.routers.moments`).
|
|
* ``GET /api/groups`` / ``/api/groups/{room_id}/members``
|
|
(see :mod:`app.api.routers.groups`).
|
|
* ``GET /api/calls`` (see :mod:`app.api.routers.calls`).
|
|
* ``GET /api/sms`` (see :mod:`app.api.routers.sms`).
|
|
* ``GET /api/voice-clips`` (see :mod:`app.api.routers.voice_clips`).
|
|
* ``GET /api/sync/status`` (see :mod:`app.api.routers.sync`).
|
|
* ``GET /api/search`` (see :mod:`app.api.routers.search`).
|
|
* ``GET /api/export/chat-html`` (see :mod:`app.api.routers.export`).
|
|
* ``GET /api/staff-stats`` (see :mod:`app.api.routers.staff_stats`).
|
|
|
|
CORS is configured to read explicit allowed origins from ``Settings.cors_origins``
|
|
(comma-separated ``CORS_ORIGINS`` env var). Empty (default) falls back to the dev
|
|
origin ``http://localhost:5173``; set ``CORS_ORIGINS=https://app.example.com`` in
|
|
prod. Never wildcard — see the comment near ``add_middleware`` below.
|
|
|
|
Auth (Task 2.9): a single shared-token dependency (:func:`app.api.auth.require_auth`)
|
|
is applied globally on the app. Trust model: when ``Settings.api_token`` is
|
|
empty (the default) auth is disabled — we trust the network boundary (this is a
|
|
local/intranet tool). When a token is configured, every request must present it
|
|
via ``Authorization: Bearer <token>`` or ``?token=``. ``/api/health`` is exempt
|
|
so liveness probes work without the token. See :mod:`app.api.auth`.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from fastapi import Depends, FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
|
|
from app.api.auth import require_auth
|
|
from app.api.routers import (
|
|
calls,
|
|
customer,
|
|
export,
|
|
groups,
|
|
login,
|
|
media,
|
|
messages,
|
|
moments,
|
|
organization,
|
|
search,
|
|
sessions,
|
|
sms,
|
|
staff_chat_stats,
|
|
staff_stats,
|
|
sync,
|
|
voice_clips,
|
|
)
|
|
from app.config import get_settings
|
|
|
|
app = FastAPI(title="yunke data mirror", dependencies=[Depends(require_auth)])
|
|
|
|
# CORS: read explicit allowed origins from Settings (``CORS_ORIGINS`` env var,
|
|
# comma-separated). Empty -> dev fallback (``http://localhost:5173``). Never
|
|
# ``*`` — wildcard CORS on an authenticated API is an open door even without
|
|
# credentials, since the middleware would reflect any attacker-controlled
|
|
# origin back in ``Access-Control-Allow-Origin``.
|
|
_settings = get_settings()
|
|
_cors = _settings.cors_origins.strip()
|
|
if _cors:
|
|
_origins = [o.strip() for o in _cors.split(",") if o.strip()]
|
|
else:
|
|
_origins = [] # empty = deny all cross-origin (safest default)
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=_origins or ["http://localhost:5173"], # dev fallback
|
|
allow_methods=["GET", "PATCH", "POST"],
|
|
allow_headers=["*"],
|
|
allow_credentials=False,
|
|
)
|
|
|
|
app.include_router(customer.router)
|
|
app.include_router(login.router)
|
|
app.include_router(media.router)
|
|
app.include_router(organization.router)
|
|
app.include_router(messages.router)
|
|
app.include_router(moments.router)
|
|
app.include_router(groups.router)
|
|
app.include_router(calls.router)
|
|
app.include_router(sms.router)
|
|
app.include_router(staff_chat_stats.router)
|
|
app.include_router(staff_stats.router)
|
|
app.include_router(sync.router)
|
|
app.include_router(search.router)
|
|
app.include_router(sessions.router)
|
|
app.include_router(export.router)
|
|
app.include_router(voice_clips.router)
|
|
|
|
|
|
@app.get("/api/health")
|
|
async def health() -> dict[str, str]:
|
|
"""Trivial liveness probe."""
|
|
return {"status": "ok"}
|