41 Commits

Author	SHA1	Message	Date
saas-backend-agent	5ca64898b7	feat(#1719): 微信账号绑定/解绑三接口（GET bind/url、POST bind、DELETE bind）+ /me 返回 wechat_bound ... - WechatBindUseCase：绑定到当前登录账号不建新号；openid/unionid 已绑其他账号 409；已绑同一微信幂等 - WechatUnbindUseCase：解绑前守卫——必须有已验证手机或真实已验证邮箱（随机密码 hash/占位邮箱不算兜底，口径同 binding_complete） - /auth/me 增加 wechat_bound 字段，供设置页判断绑定状态 - state 复用 RedisStateStore CSRF 校验；22 个新单测，diff coverage 100%	2026-09-05 21:31:44 +08:00
saas-backend-agent	f11b71361d	feat(#1718): 微信 state 存储 Redis 化 + 回调 UA 日志 + 中文昵称 UTF-8 修复 ... - state store 改 Redis（复用 celery Redis，key 前缀 wechat:state:， TTL 10 分钟）：SET NX EX 写入，Lua 脚本原子 GET+DEL 一次性消费 （兼容 Redis <6.2 无 GETDEL）；Redis 不可用时自动降级内存，登录不中断； 容器重启/多实例后 state 不丢，修复 worker 扩容后回调 state 失效 - /wechat/callback 加可观测日志：User-Agent（识别 MicroMessenger 微信内置浏览器）、state 校验结果、失败上下文，便于排查回调停滞 - 修复微信中文昵称乱码：sns/oauth2/access_token 与 sns/userinfo 响应在 .json() 前显式 encoding=utf-8（微信响应头不带 charset， requests 默认 ISO-8859-1 解码导致中文乱码） - 15 个新单测（全 mock/fake，CI 无 redis 也覆盖）：Redis state 存取/一次性消费/eval 降级/异常降级内存/ping 失败降级、中文昵称 UTF-8 解析、errcode 透传、callback 路由日志分支、工厂降级分支	2026-09-05 20:45:02 +08:00
xiaoxia	8a6d51f6c3	fix(auth): 微信OAuth服务工厂改为真单例，修复回调state必校验失败 (#1718) (#1719) ... Co-authored-by: xiaoxia <dev@xiaoxiajianji.com> Co-committed-by: xiaoxia <dev@xiaoxiajianji.com>	2026-09-05 17:17:07 +08:00
xiaoxia	b055200d0b	refactor: 替换废弃的datetime.utcnow()为datetime.now(timezone.utc) (#805)	2026-07-24 08:03:17 +08:00
xiaoxia	4208b5d940	fix(#781): 替换print为logging，统一日志输出规范 (#804)	2026-07-24 08:03:14 +08:00
xiaoxia	20909e2058	fix: 修复ai_tasks.py中3个ruff F401未使用import (#792)	2026-07-24 00:20:28 +08:00
xiaoxia	d92909321c	refactor(#777): 修复Domain层依赖Adapters的DDD违规（4处） (#789)	2026-07-23 23:54:56 +08:00
xiaoxia	9f69fde30b	fix(#558): 微信登录3个后端修复 - 验证码500 + 绑定500 + state校验 (#684) ... fix(#558): 微信登录3个后端修复 - 验证码500 + 绑定500 + state校验	2026-07-21 17:51:48 +08:00
xiaoxia	269723ced2	feat(#558): 微信登录 + 绑定手机号邮箱完整后端实现 (#670) ... Co-authored-by: xiaoxia <dev@xiaoxiajianji.com> Co-committed-by: xiaoxia <dev@xiaoxiajianji.com>	2026-07-21 09:21:01 +08:00
xiaoxia	531aacb57e	fix(code-quality): 第二批 - B904 raise-without-from 批量修复 (71个) (#353)	2026-07-15 11:51:45 +08:00
CI Bot	9c6c477f55	fix(backend): Phase 1 后端代码清理与修复 ... P0 关键修复: - P0-1: 注册接口添加 RateLimitMiddleware 限流保护 - P0-3: /metrics 端点添加 JWT 认证（移除匿名访问） - P0-4: 修复 Celery 任务名冲突（generation_task vs generate_video） - P1-5: JWT logout token 黑名单机制 P1 修复: - P1-1: forgot_password 硬编码 localhost → 使用 settings.APP_BASE_URL - P1-2: generation.py 直接创建 DB 连接 → 使用依赖注入 - P1-6: Image.open() 未关闭 → 统一使用 with 语句 - P1-7: 订阅续费事务修复 P2 代码质量: - P2-1: 修复 EditingMode 枚举重复定义 → 统一引用 shared 包 - P2-2: 修复 SMTP_FRON_NAME → SMTP_FROM_NAME 拼写 - P2-3: UserModel subscription_quota 类型统一为 float - P2-4: .env.production DATABASE_MAX_OVERFLOW 30 → 10 - 清理 15 处 except:pass（保留 2 处有注释说明的） - 禁用 SVG 上传（XSS 风险） - 删除 decode_token_unsafe() 不安全函数 - 简化 /ready 端点 - 删除 8 处死代码、10 个空文件/模块 - 合并 3 对 100% 重复函数 - 对齐 6 个废弃环境变量 v2 修复（代码审查后）: - 修复密码重置路由路径: /password/forgot → /forgot-password, /password/reset → /reset-password（与前端 API 对齐） - 合并 _check_project_access: asset_libraries.py 和 edit_plans.py 中的重复函数统一到 _helpers.py（含空字符串守卫 + 中文错误信息） - 顺手修复: HTTPException 统一从 fastapi 导入（替换 starlette 导入） - OSS_ENDPOINT 拼写修复拆分为单独 PR，本 PR 不包含	2026-07-13 13:50:52 +08:00
灵应	1b4532cd9c	fix(ci): 修复 PR #185 微信同步登录 Validate 失败 ... - black 格式化 wechat_sync_use_case.py - isort 排序 auth.py imports - bandit: try_except_pass 改为 logger.debug 根因：PR #185 合并时未通过代码质量检查（black/isort）， 导致 CI Validate 步骤在代码检查阶段即失败。	2026-07-07 00:49:14 +08:00
CI Test	46d98f369d	feat(auth): 新增微信同步登录接口wechat-sync（内部系统级接口，支持openid查找/创建用户并返回SaaS token）	2026-07-06 22:10:33 +08:00
灵应	e25fd86171	style: 后端代码isort import排序	2026-07-03 18:56:16 +08:00
灵应	8935196fcd	style: 后端代码black格式化	2026-07-03 18:49:54 +08:00
xiaoxia	dfb41452cb	Merge pull request '[P1 Hotfix] 修复登录故障 - password_hasher导入错误' (#180) from hotfix/fix-login-p1-import-error into develop	2026-07-03 09:42:48 +08:00
CI Test	3f8091e597	fix(security): 删除 decode_token_unsafe() 方法，消除不安全的 JWT 解码	2026-07-03 09:42:21 +08:00
灵应	ed3ab22b88	fix: 修复登录P1故障 - password_hasher导入错误 ... 根因：login_use_case.py 第14行错误地导入了模块而非实例 - 错误: from packages.application.auth import password_hasher - 正确: from packages.application.auth.password_hasher import password_hasher 这导致调用 password_hasher.verify_password() 时抛出 AttributeError: module 'packages.application.auth.password_hasher' has no attribute 'verify_password' 异常被 except Exception 捕获后返回 'Login failed: ...'，最终显示为 '邮箱或密码错误'，所有用户均无法登录。 修复后导入正确的 PasswordHasher 实例，登录功能恢复正常。 P1 紧急修复	2026-07-03 08:34:06 +08:00
xiaoxia	1217d8cef0	style: apply isort formatting to pass CI validation (#129)	2026-06-30 18:17:44 +08:00
xiaoxia	52ff2f80ad	style: apply black formatting to pass CI validation (#126)	2026-06-30 17:23:08 +08:00
xiaoxia	6142b2478a	fix: 修复 login_use_case.py 的 jwt_service 导入路径（P0 登录401） (#67)	2026-06-28 10:10:40 +08:00
CI Test	e90076f794	feat(auth): implement refresh token mechanism ... - Add /auth/refresh endpoint for token renewal - Login response now includes refresh_token - Update JWT defaults: access_token 15min, refresh_token 7days - Reuse existing RefreshTokenUseCase with Redis session store	2026-06-27 22:57:25 +08:00
API文档维护Agent	e3fb518ab2	refactor: remove all workspace_id references from codebase ... - Remove workspace_id from Pydantic models in project_management routes - Remove workspace_id from SQLAlchemy and SQLite project management repos - Remove workspace_id from worker tasks (storage keys, entity creation) - Remove workspace_id from video dedup and title usage modules - Remove workspace_id from generation and ingest worker tasks - Clean workspace_id from all test files and scripts - Remove workspace-specific test files (list_workspaces, workspace repos) Task: #14 workspace_id 残留清理	2026-06-27 22:52:09 +08:00
CI Test	9d54b3e586	fix: correct all import paths for jwt_service and password_hasher (move from domain to application)	2026-06-27 21:41:56 +08:00
CI Test	e1efbdaf6e	fix: resolve circular import for password_hasher/password_validator in auth __init__	2026-06-27 21:33:51 +08:00
CI Test	5b47d1adb7	fix: 修复 password_reset_use_case 循环导入问题	2026-06-27 21:30:57 +08:00
CI Test	02992a3fcd	P2-2: Move auth services from domain to application layer ... - Move jwt_service.py from packages/domain/auth to packages/application/auth - Move password_hasher.py from packages/domain/auth to packages/application/auth - Update all import paths in use cases and tests	2026-06-27 19:23:56 +08:00
XiaoXia Bot	0b990017ca	fix(security): 删除 .env.production 并清理硬编码密码 ... - 删除 .env.production（含占位符密钥，已从版本控制移除） - scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取 - infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量 - packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符	2026-06-27 18:10:52 +08:00
Audit Bot	2c6d920bcb	fix(#25): 移除硬编码 localhost:3000 ... - 添加 APP_BASE_URL 配置项到 Settings - auth.py 中改用 settings.APP_BASE_URL - register_user_use_case.py 和 password_reset_use_case.py 移除默认值 - base_url 参数改为必须由调用方传入 - 更新 .env.example 添加 APP_BASE_URL	2026-06-27 17:20:17 +08:00
Audit Bot	793104c8e7	fix(#12): 实现 refresh token 查找功能 ... - 完善 _find_session_by_refresh_token() 方法 - 使用 session_store.get_session_by_refresh_token() 直接查询 - 利用 Redis 反向索引实现 O(1) 查找复杂度	2026-06-27 17:20:17 +08:00
xiaoxia	f687b4207f	feat: add download_url field to generated video APIs (#20)	2026-06-26 21:13:18 +08:00
xiaoxia	b326e4a249	fix(P1-2): implement token refresh use case with session verification	2026-06-26 17:52:34 +08:00
Xiaoxia AI	ea92092d12	chore(security): triage bandit findings	2026-06-21 13:38:46 +08:00
Xiaoxia AI	b78a290bdd	feat(auth): add verification and password reset routes	2026-06-21 10:40:56 +08:00
Xiaoxia AI	93271f7dda	refactor(auth): route simple auth through use cases	2026-06-21 08:22:49 +08:00
Xiaoxia AI	bfbaddbd9a	style: normalize python formatting gates	2026-06-21 06:52:19 +08:00
Xiaoxia AI	0e93d2e71f	refactor(domain): move auth infrastructure to adapters	2026-06-21 00:46:56 +08:00
Xiaoxia AI	5e047972cd	fix(phase7): resolve remaining TODOs - session_id in JWT and repository injection	2026-06-19 09:47:20 +08:00
Xiaoxia AI	e46cda2416	feat(auth): add password reset functionality ... - Implement RequestPasswordResetUseCase to generate reset token - Send password reset email with 1-hour expiration - Implement ResetPasswordUseCase to verify token and update password - Security: return success even if user not exists (avoid enumeration) - Validate new password strength before reset - Clear reset token after successful password change - Add 9 comprehensive unit tests (all passed) Phase 4 Task 8/68 completed	2026-06-17 01:25:53 +08:00
Xiaoxia AI	f0d0edf449	feat(auth): add login, logout and refresh token use cases ... - Implement LoginUseCase with password verification and JWT token generation - Generate user_auth token (without workspace) for initial login - Create session with refresh_token in Redis - Track last_login_at and last_login_ip - Implement LogoutUseCase for single device or all devices - Add RefreshTokenUseCase placeholder (to be implemented) - Add 9 comprehensive unit tests (all passed) Phase 4 Task 7/68 completed	2026-06-17 01:24:45 +08:00
Xiaoxia AI	e9e874404c	feat(auth): add user registration with email verification ... - Implement RegisterUserUseCase with password validation and email verification - Implement VerifyEmailUseCase for email confirmation - Add UserRepository interface and InMemoryUserRepository implementation - Support duplicate email/username checking - Generate verification tokens and send verification emails - Add 9 comprehensive unit tests (all passed) Phase 4 Task 6/68 completed	2026-06-17 01:20:40 +08:00