JiuContinent
ae5990eaef
feat(core): 添加API认证主体配置和安全验证 - 在Settings中添加api_actor字段，用于标识API调用方身份 - 创建ApiPrincipal数据类来表示服务主体 - 修改require_api_key函数返回认证的服务主体信息 - 更新配置文件引入ActorValue常量 feat(ai_agent): 增强OpenClaw工具调用的安全性检查 - 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项 - 添加CSV列表解析验证器 - 实现工具和操作权限检查方法_ensure_tool_allowed - 在工具调用前验证允许的工具和操作类型 feat(security): 强化API密钥认证和审计安全性 - 更新require_api_key函数在缺少API_KEY时抛出异常 - 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息 - 替换硬编码的ActorValue.API为动态的principal.actor feat(audit): 实现安全审计负载脱敏处理 - 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS - 实现审计安全负载处理函数_audit_safe_payload - 支持深度遍历、文本截断、序列限制和敏感信息脱敏 - 在AI服务的审计日志中应用安全负载处理 feat(approval): 完善审批流程的申请人身份验证 - 更新审批创建接口使用认证主体作为申请人 - 使用utc_now替换datetime.utcnow确保时间一致性 - 修复审批逻辑中的条件判断问题 feat(business): 加强业务领域高风险操作的审批控制 - 为高风险域创建统一的审批验证方法_ensure_approved - 在创建和更新操作中强制要求审批票证 - 为项目同步功能添加认证主体参数 feat(config): 统一时间处理使用UTC时间函数 - 创建并使用utc_now函数替代datetime.utcnow - 在审批、审计、业务、遗留数据等模块中更新时间戳处理 feat(constants): 扩展风险事件类型和报告指标 - 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES - 为报告模块添加外部开放和高风险事件指标 refactor(feishu): 增强飞书验证令牌安全检查 - 确保飞书验证令牌配置存在时才接受请求 - 修正令牌验证逻辑以提高安全性 ```
80 lines
2.9 KiB
Python
80 lines
2.9 KiB
Python
from functools import lru_cache
|
|
|
|
from pydantic import Field, field_validator
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
from app.core.constants import ActorValue
|
|
|
|
DEFAULT_MODEL_PROVIDER = "noop"
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
"""Runtime settings loaded from environment variables and `.env`."""
|
|
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
|
|
|
|
app_name: str = "Company AI Management Platform"
|
|
app_env: str = "local"
|
|
debug: bool = False
|
|
api_prefix: str = "/api/v1"
|
|
api_key: str | None = None
|
|
api_actor: str = ActorValue.API
|
|
cors_origins: list[str] = Field(default_factory=lambda: ["*"])
|
|
|
|
database_url: str = "mysql+pymysql://root:password@127.0.0.1:3306/company_ai?charset=utf8mb4"
|
|
legacy_database_url: str | None = None
|
|
legacy_project_query: str | None = None
|
|
legacy_project_code_prefix: str = "LEGACY"
|
|
redis_url: str = "redis://127.0.0.1:6379/0"
|
|
|
|
feishu_base_url: str = "https://open.feishu.cn/open-apis"
|
|
feishu_app_id: str | None = None
|
|
feishu_app_secret: str | None = None
|
|
feishu_verification_token: str | None = None
|
|
feishu_encrypt_key: str | None = None
|
|
feishu_default_chat_id: str | None = None
|
|
|
|
model_provider: str = DEFAULT_MODEL_PROVIDER
|
|
openclaw_base_url: str = "http://127.0.0.1:2070"
|
|
openclaw_http_url: str | None = None
|
|
openclaw_ws_url: str | None = None
|
|
openclaw_api_key: str | None = None
|
|
openclaw_gateway_token: str | None = None
|
|
openclaw_allowed_tools: list[str] = Field(default_factory=list)
|
|
openclaw_allowed_actions: list[str] = Field(default_factory=lambda: ["json"])
|
|
hermes_base_url: str = "http://127.0.0.1:2073/v1"
|
|
hermes_api_key: str | None = None
|
|
hermes_model: str = "hermes-agent"
|
|
hermes_session_id: str | None = None
|
|
direct_llm_base_url: str = "https://api.openai.com/v1"
|
|
direct_llm_api_key: str | None = None
|
|
direct_llm_model: str = "gpt-4.1-mini"
|
|
|
|
scheduler_enabled: bool = False
|
|
daily_brief_cron_hour: int = 9
|
|
daily_brief_cron_minute: int = 0
|
|
weekly_project_report_day_of_week: str = "mon"
|
|
weekly_project_report_cron_hour: int = 9
|
|
weekly_project_report_cron_minute: int = 30
|
|
|
|
@field_validator("cors_origins", mode="before")
|
|
@classmethod
|
|
def parse_cors_origins(cls, value: str | list[str]) -> list[str]:
|
|
if isinstance(value, list):
|
|
return value
|
|
return [item.strip() for item in value.split(",") if item.strip()]
|
|
|
|
@field_validator("openclaw_allowed_tools", "openclaw_allowed_actions", mode="before")
|
|
@classmethod
|
|
def parse_csv_list(cls, value: str | list[str]) -> list[str]:
|
|
if isinstance(value, list):
|
|
return value
|
|
return [item.strip() for item in value.split(",") if item.strip()]
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
"""Return cached application settings."""
|
|
|
|
return Settings()
|