From c04b57a1f823e9a4d5f089bb4e211968977cbc7d Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Fri, 26 Jun 2026 17:43:35 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20P0=20-=20JWT=E5=AF=86=E9=92=A5?=
 =?UTF-8?q?=E5=BC=BA=E5=88=B6=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F=EF=BC=8C?=
 =?UTF-8?q?=E6=8B=92=E7=BB=9D=E9=BB=98=E8=AE=A4=E5=80=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/api/app/config.py | 33 +++++++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/apps/api/app/config.py b/apps/api/app/config.py
index 7c5808d85..5872a14d2 100644
--- a/apps/api/app/config.py
+++ b/apps/api/app/config.py
@@ -1,6 +1,7 @@
 import os
 from typing import Optional
 
+from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -24,10 +25,34 @@ class Settings(BaseSettings):
     AUTO_CREATE_SCHEMA: bool = False
 
     REDIS_URL: str = "redis://localhost:6379/0"
-    REDIS_MAX_CONNECTIONS: int = 50
-    ENABLE_REDIS_SESSIONS: bool = False
+    REDIS_MAX_CONNECTION: int = 50
+    ENABLE_REDIS_SESSION: bool = False
 
-    JWT_SECRET_KEY: str = "your-secret-key-change-in-production"
+    # JWT secret key - MUST be set via environment variable, no default allowed
+    JWT_SECRET_KEY: Optional[str] = None
+
+    @field_validator("JWT_SECRET_KEY", mode="before")
+    @classmethod
+    def validate_jwt_secret_key(cls, v):
+        if v is None or v == "":
+            raise ValueError(
+                "JWT_SECRET_KEY must be set via environment variable. "
+                "Do not use default value in production!"
+            )
+        # Block known insecure default values
+        insecure_defaults = [
+            "your-secret-key-change-in-production",
+            "your-secret-key",
+            "secret",
+            "changeme",
+            "password",
+        ]
+        if v.lower() in [d.lower() for d in insecure_defaults]:
+            raise ValueError(
+                f"JWT_SECRET_KEY '{v}' is insecure. "
+                "Please set a strong random secret via environment variable."
+            )
+        return v
 
     ENABLE_EMAIL_DELIVERY: bool = False
     SMTP_HOST: str = "smtp.gmail.com"
@@ -35,7 +60,7 @@ class Settings(BaseSettings):
     SMTP_USER: str = ""
     SMTP_PASSWORD: str = ""
     SMTP_FROM_EMAIL: str = ""
-    SMTP_FROM_NAME: str = "小虾 SaaS"
+    SMTP_FRON_NAME: str = "小虾 SaaS"
     SMTP_USE_TLS: bool = True
 
     CELERY_BROKER_URL: str = "redis://localhost:6379/0"