```

refactor(api): 使用常量替代硬编码字符串

- 在health_check接口中使用ApiResponseKey.STATUS和ApiStatus.OK常量
- 替换硬编码的状态返回值为枚举常量

refactor(core): 配置模块错误信息统一使用常量

- 从constants模块导入ConfigErrorDetail并替换CORS_ORIGINS和LEGACY_ALLOWED_QUERIES的验证错误信息
- 配置类中的默认值使用constants中定义的常量

feat(constants): 添加API响应、安全错误和配置错误常量类

- 新增ApiResponseKey用于API状态键名
- 新增ApiStatus用于API状态值
- 新增SecurityErrorDetail用于安全认证错误详情
- 新增ConfigErrorDetail用于配置验证错误详情
- 添加DEFAULT_MODEL_PROVIDER和DEFAULT_OPENCLAW_ACTION_JSON常量

refactor(security): 安全认证模块使用错误常量

- 将硬编码的安全错误信息替换为SecurityErrorDetail常量
- 包括API密钥、审批密钥和审计密钥的相关错误信息

refactor(ai-agent): AI代理适配器改进错误处理

- 将HTTP状态码替换为FastAPI状态常量
- 添加OpenClaw工具和操作的错误常量
- 修复健康检查和工具调用中的状态码比较逻辑
- 添加AIToolAuditKey用于工具审计键名

feat(ai-agent): 扩展AI代理常量定义

- 新增AIToolAuditKey用于工具审计字段
- 添加OpenClaw相关的错误常量如OPENCLAW_CHAT_PROVIDER_REQUIRED等
- 添加UNSUPPORTED_AI_SKILL_TEMPLATE模板字符串

refactor(approvals): 审批模块常量化重构

- 新增ApprovalPayloadKey用于审批载荷字段
- 添加approval_action函数和APPROVAL_ACTION_SEPARATOR分隔符
- 使用常量替换字面量值

feat(audit): 审计模块新增飞书事件动作类型

- 添加FEISHU_WEBHOOK_EVENT和FEISHU_LONG_CONNECTION_EVENT审计动作

refactor(business): 业务模块全面常量化

- 新增BusinessDomain枚举包含所有业务域
- 添加BusinessResponseKey、BusinessPayloadKey等常量类
- 重构DOMAIN_MODELS为frozenset以提高性能
- 添加normalize_domain等辅助函数用于域标准化
- 使用常量替换路由和业务服务中的硬编码字符串
- 添加业务错误常量和字段验证模板

refactor(feishu): 飞书客户端错误处理优化

- 将HTTP状态码替换为FastAPI标准状态常量
- 改进错误处理的一致性

refactor(approvals): 审批服务使用新常量结构

- 使用ApprovalPayloadKey常量重构载荷字段
- 使用approval_action函数统一动作命名格式
- 优化高风险域判断逻辑
```

app/core/config.py

@@ -5,9 +5,12 @@ from typing import Any
 from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-from app.core.constants import ActorValue
-
-DEFAULT_MODEL_PROVIDER = "noop"
+from app.core.constants import (
+    ActorValue,
+    ConfigErrorDetail,
+    DEFAULT_MODEL_PROVIDER,
+    DEFAULT_OPENCLAW_ACTION_JSON,
+)
 
 
 class Settings(BaseSettings):
@@ -48,7 +51,9 @@ class Settings(BaseSettings):
     openclaw_api_key: str | None = None
     openclaw_gateway_token: str | None = None
     openclaw_allowed_tools: list[str] = Field(default_factory=list)
-    openclaw_allowed_actions: list[str] = Field(default_factory=lambda: ["json"])
+    openclaw_allowed_actions: list[str] = Field(
+        default_factory=lambda: [DEFAULT_OPENCLAW_ACTION_JSON]
+    )
     hermes_base_url: str = "http://127.0.0.1:2073/v1"
     hermes_api_key: str | None = None
     hermes_model: str = "hermes-agent"
@@ -75,7 +80,7 @@ class Settings(BaseSettings):
         if text.startswith("["):
             data = json.loads(text)
             if not isinstance(data, list):
-                raise ValueError("CORS_ORIGINS must be a CSV string or JSON list")
+                raise ValueError(ConfigErrorDetail.CORS_ORIGINS_FORMAT)
             return [str(item).strip() for item in data if str(item).strip()]
         return [item.strip() for item in text.split(",") if item.strip()]
 
@@ -96,9 +101,9 @@ class Settings(BaseSettings):
         if isinstance(value, str):
             data = json.loads(value)
             if not isinstance(data, dict):
-                raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+                raise ValueError(ConfigErrorDetail.LEGACY_ALLOWED_QUERIES_FORMAT)
             return {str(key): str(item) for key, item in data.items()}
-        raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+        raise ValueError(ConfigErrorDetail.LEGACY_ALLOWED_QUERIES_FORMAT)
 
 
 @lru_cache

app/core/constants.py

@@ -17,4 +17,28 @@ class HttpHeader(StrEnum):
     X_APPROVAL_API_KEY = "X-Approval-API-Key"
 
 
+class ApiResponseKey(StrEnum):
+    STATUS = "status"
+
+
+class ApiStatus(StrEnum):
+    OK = "ok"
+
+
+class SecurityErrorDetail(StrEnum):
+    API_KEY_REQUIRED = "API_KEY is required"
+    INVALID_API_KEY = "Invalid API key"
+    APPROVAL_API_KEY_REQUIRED = "APPROVAL_API_KEY is required"
+    INVALID_APPROVAL_API_KEY = "Invalid approval API key"
+    AUDIT_API_KEY_REQUIRED = "AUDIT_API_KEY is required"
+    INVALID_AUDIT_API_KEY = "Invalid audit API key"
+
+
+class ConfigErrorDetail(StrEnum):
+    CORS_ORIGINS_FORMAT = "CORS_ORIGINS must be a CSV string or JSON list"
+    LEGACY_ALLOWED_QUERIES_FORMAT = "LEGACY_ALLOWED_QUERIES must be a JSON object"
+
+
 BEARER_TOKEN_TEMPLATE = "Bearer {token}"
+DEFAULT_MODEL_PROVIDER = "noop"
+DEFAULT_OPENCLAW_ACTION_JSON = "json"

app/core/security.py

@@ -4,7 +4,7 @@ from secrets import compare_digest
 from fastapi import Header, HTTPException, status
 
 from app.core.config import get_settings
-from app.core.constants import HttpHeader
+from app.core.constants import HttpHeader, SecurityErrorDetail
 
 
 @dataclass(frozen=True)
@@ -23,10 +23,13 @@ def require_api_key(
     if not settings.api_key:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="API_KEY is required",
+            detail=SecurityErrorDetail.API_KEY_REQUIRED,
         )
     if not x_api_key or not compare_digest(x_api_key, settings.api_key):
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=SecurityErrorDetail.INVALID_API_KEY,
+        )
     return ApiPrincipal(actor=settings.api_actor)
 
 
@@ -42,7 +45,7 @@ def require_approval_api_key(
     if not settings.approval_api_key:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="APPROVAL_API_KEY is required",
+            detail=SecurityErrorDetail.APPROVAL_API_KEY_REQUIRED,
         )
     if (
         not x_approval_api_key
@@ -50,7 +53,7 @@ def require_approval_api_key(
     ):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid approval API key",
+            detail=SecurityErrorDetail.INVALID_APPROVAL_API_KEY,
         )
     return ApiPrincipal(actor=settings.approval_api_actor)
 
@@ -67,11 +70,11 @@ def require_audit_api_key(
     if not settings.audit_api_key:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="AUDIT_API_KEY is required",
+            detail=SecurityErrorDetail.AUDIT_API_KEY_REQUIRED,
         )
     if not x_audit_api_key or not compare_digest(x_audit_api_key, settings.audit_api_key):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid audit API key",
+            detail=SecurityErrorDetail.INVALID_AUDIT_API_KEY,
         )
     return ApiPrincipal(actor=settings.audit_api_actor)