```

feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```

app/core/config.py

@@ -1,4 +1,6 @@
+import json
 from functools import lru_cache
+from typing import Any
 
 from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -19,11 +21,14 @@ class Settings(BaseSettings):
     api_prefix: str = "/api/v1"
     api_key: str | None = None
     api_actor: str = ActorValue.API
+    approval_api_key: str | None = None
+    approval_api_actor: str = ActorValue.APPROVER
     cors_origins: list[str] = Field(default_factory=lambda: ["*"])
 
     database_url: str = "mysql+pymysql://root:password@127.0.0.1:3306/company_ai?charset=utf8mb4"
     legacy_database_url: str | None = None
     legacy_project_query: str | None = None
+    legacy_allowed_queries: dict[str, str] = Field(default_factory=dict)
     legacy_project_code_prefix: str = "LEGACY"
     redis_url: str = "redis://127.0.0.1:6379/0"
 
@@ -71,6 +76,20 @@ class Settings(BaseSettings):
             return value
         return [item.strip() for item in value.split(",") if item.strip()]
 
+    @field_validator("legacy_allowed_queries", mode="before")
+    @classmethod
+    def parse_legacy_allowed_queries(cls, value: Any) -> dict[str, str]:
+        if value is None or value == "":
+            return {}
+        if isinstance(value, dict):
+            return {str(key): str(item) for key, item in value.items()}
+        if isinstance(value, str):
+            data = json.loads(value)
+            if not isinstance(data, dict):
+                raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+            return {str(key): str(item) for key, item in data.items()}
+        raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+
 
 @lru_cache
 def get_settings() -> Settings:

app/core/constants.py

@@ -3,6 +3,7 @@ from enum import StrEnum
 
 class ActorValue(StrEnum):
     API = "api"
+    APPROVER = "approver"
     SYSTEM = "system"
     SCHEDULER = "scheduler"
     FEISHU = "feishu"
@@ -10,6 +11,8 @@ class ActorValue(StrEnum):
 
 class HttpHeader(StrEnum):
     AUTHORIZATION = "Authorization"
+    X_API_KEY = "X-API-Key"
+    X_APPROVAL_API_KEY = "X-Approval-API-Key"
 
 
 BEARER_TOKEN_TEMPLATE = "Bearer {token}"

app/core/database.py

@@ -1,15 +1,10 @@
 from collections.abc import Generator
 
 from sqlalchemy import create_engine
-from sqlalchemy.orm import DeclarativeBase, Session, sessionmaker
+from sqlalchemy.orm import Session, sessionmaker
 
 from app.core.config import get_settings
-
-
-class Base(DeclarativeBase):
-    """Base class for SQLAlchemy ORM models."""
-
-    pass
+from app.core.db_base import Base
 
 
 settings = get_settings()

app/core/db_base.py

@@ -0,0 +1,7 @@
+from sqlalchemy.orm import DeclarativeBase
+
+
+class Base(DeclarativeBase):
+    """Base class for SQLAlchemy ORM models."""
+
+    pass

app/core/security.py

@@ -1,8 +1,10 @@
 from dataclasses import dataclass
+from secrets import compare_digest
 
 from fastapi import Header, HTTPException, status
 
 from app.core.config import get_settings
+from app.core.constants import HttpHeader
 
 
 @dataclass(frozen=True)
@@ -12,7 +14,9 @@ class ApiPrincipal:
     actor: str
 
 
-def require_api_key(x_api_key: str | None = Header(default=None)) -> ApiPrincipal:
+def require_api_key(
+    x_api_key: str | None = Header(default=None, alias=HttpHeader.X_API_KEY),
+) -> ApiPrincipal:
     """Validate the internal API key header and return its service principal."""
 
     settings = get_settings()
@@ -21,6 +25,31 @@ def require_api_key(x_api_key: str | None = Header(default=None)) -> ApiPrincipa
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
             detail="API_KEY is required",
         )
-    if x_api_key != settings.api_key:
+    if not x_api_key or not compare_digest(x_api_key, settings.api_key):
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
     return ApiPrincipal(actor=settings.api_actor)
+
+
+def require_approval_api_key(
+    x_approval_api_key: str | None = Header(
+        default=None,
+        alias=HttpHeader.X_APPROVAL_API_KEY,
+    ),
+) -> ApiPrincipal:
+    """Validate the approval API key and return the approval principal."""
+
+    settings = get_settings()
+    if not settings.approval_api_key:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="APPROVAL_API_KEY is required",
+        )
+    if (
+        not x_approval_api_key
+        or not compare_digest(x_approval_api_key, settings.approval_api_key)
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid approval API key",
+        )
+    return ApiPrincipal(actor=settings.approval_api_actor)