fix(security): P0 - JWT密钥强制环境变量，拒绝默认值

apps/api/app/config.py

@@ -1,6 +1,7 @@
 import os
 from typing import Optional
 
+from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -24,10 +25,34 @@ class Settings(BaseSettings):
     AUTO_CREATE_SCHEMA: bool = False
 
     REDIS_URL: str = "redis://localhost:6379/0"
-    REDIS_MAX_CONNECTIONS: int = 50
-    ENABLE_REDIS_SESSIONS: bool = False
+    REDIS_MAX_CONNECTION: int = 50
+    ENABLE_REDIS_SESSION: bool = False
 
-    JWT_SECRET_KEY: str = "your-secret-key-change-in-production"
+    # JWT secret key - MUST be set via environment variable, no default allowed
+    JWT_SECRET_KEY: Optional[str] = None
+
+    @field_validator("JWT_SECRET_KEY", mode="before")
+    @classmethod
+    def validate_jwt_secret_key(cls, v):
+        if v is None or v == "":
+            raise ValueError(
+                "JWT_SECRET_KEY must be set via environment variable. "
+                "Do not use default value in production!"
+            )
+        # Block known insecure default values
+        insecure_defaults = [
+            "your-secret-key-change-in-production",
+            "your-secret-key",
+            "secret",
+            "changeme",
+            "password",
+        ]
+        if v.lower() in [d.lower() for d in insecure_defaults]:
+            raise ValueError(
+                f"JWT_SECRET_KEY '{v}' is insecure. "
+                "Please set a strong random secret via environment variable."
+            )
+        return v
 
     ENABLE_EMAIL_DELIVERY: bool = False
     SMTP_HOST: str = "smtp.gmail.com"
@@ -35,7 +60,7 @@ class Settings(BaseSettings):
     SMTP_USER: str = ""
     SMTP_PASSWORD: str = ""
     SMTP_FROM_EMAIL: str = ""
-    SMTP_FROM_NAME: str = "小虾 SaaS"
+    SMTP_FRON_NAME: str = "小虾 SaaS"
     SMTP_USE_TLS: bool = True
 
     CELERY_BROKER_URL: str = "redis://localhost:6379/0"