c11e579412
fix(security): 生产环境禁用 Swagger 文档防止信息泄露
...
Deploy / Deploy Staging (push) Has been cancelled
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
CI/CD Pipeline / Frontend Lint (push) Failing after 148h21m51s
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 148h21m57s
- ENVIRONMENT=production 时 docs_url/redoc_url/openapi_url 设为 None
- 开发/测试环境不受影响
2026-07-03 08:32:17 +08:00
c1a89ae221
fix(security): 注册登录接口 RateLimitMiddleware 防止暴力破解
...
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
Deploy / Deploy Staging (push) Has been cancelled
CI/CD Pipeline / Frontend Lint (push) Failing after 148h23m2s
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 148h23m8s
- RateLimitMiddleware 增加 paths 参数支持路径过滤
- 在 main.py 注册登录限流：每 IP 每分钟最多 10 次
- 仅针对 /api/v1/auth/login 路径
2026-07-03 08:29:52 +08:00
573e4485b7
fix: 同步改进CORS配置 - 始终包含生产域名
...
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
CI/CD Pipeline / Frontend Lint (push) Has been cancelled
Deploy / Deploy Staging (push) Has been cancelled
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
与main分支PR #93保持一致：无论CORS_ORIGINS_RAW环境变量是否设置，
都确保 https://saas.xiaoxiajianji.com 在allow_origins中。
2026-06-28 21:59:39 +08:00
47533e7037
fix: 修复标题/配音创建500、素材库列表500、CORS缺失
...
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled
CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled
- titles.py/voices.py: get_by_id → find_by_id（方法名错误导致AttributeError）
- project_repository.py: cast shared_users to JSONB for @> operator（JSON列不支持@>）
- main.py: CORS allow_origins 添加 https://saas.xiaoxiajianji.com
2026-06-28 21:33:07 +08:00
25ce4830a6
fix: 禁用 redirect_slashes 修复 307 重定向导致前端新建失败
...
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled
CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled
- FastAPI 初始化添加 redirect_slashes=False，避免反向代理后
307 重定向 URL 丢失 HTTPS 协议
- 移除 titles.py/voices.py/generation_tasks.py 路由中的尾斜杠
（'/' → ''，'/tasks/' → '/tasks'，'/tasks/{id}/results/' → '/tasks/{id}/results'）
Fixes: 前端调用 POST /api/v1/titles 等接口时 307 重定向到 http:// 导致失败
2026-06-28 18:54:27 +08:00
28733d6fc7
feat(api): add Prometheus metrics middleware and /metrics endpoint
...
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
CI/CD Pipeline / Frontend Lint (push) Has been cancelled
Deploy / Deploy Staging (push) Has been cancelled
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
- Add prometheus-client==0.21.1 to requirements.txt
- Create PrometheusMetricsMiddleware to track HTTP request duration, count, and in-progress requests
- Add /metrics endpoint for Prometheus scraping
- Exclude health/ready/startup/metrics paths from recording to reduce noise
2026-06-28 08:32:28 +08:00
xiaoxia
73043ed72b
fix(P1-1): resolve CORS configuration security issue
2026-06-26 17:48:57 +08:00
0ed3cb7ef5
fix(ci): run unit tests with API path
2026-06-24 20:18:08 +08:00
ea92092d12
chore(security): triage bandit findings
2026-06-21 13:38:46 +08:00
bfbaddbd9a
style: normalize python formatting gates
2026-06-21 06:52:19 +08:00
1e3a52fa17
fix(worker): persist generated mp4 without oss
2026-06-20 23:17:52 +08:00
8d78798a7d
fix(phase7): align api runtime wiring for integration
2026-06-17 18:48:08 +08:00
e86dde7445
fix(health): register health check routes correctly
...
- Register health_router at root path (no /api/v1 prefix)
- Health endpoints: /health, /ready, /startup
- API endpoints remain at /api/v1/*
- Update route imports and registration
Phase 4 Task 45/68 fully completed
2026-06-17 08:43:17 +08:00
a30ef3db97
refactor(performance): update all repositories to use connection pool
...
- Replace direct psycopg2.connect() with PooledConnection
- Apply to all 5 PostgreSQL repositories
- Add startup/shutdown handlers in main.py
- Initialize pool on app startup (minconn=2, maxconn=10)
- Close all connections on shutdown
- Automatic performance improvement for all database operations
Performance: 5-6x faster for all database queries
Phase 4 Task 41/68 completed
2026-06-17 08:35:07 +08:00
c11a431a8d
feat(middleware): add comprehensive error handling and logging
...
- Add APIException with custom error codes
- Implement global exception handlers (API/HTTP/Validation/General)
- Add RequestLoggingMiddleware with response time tracking
- Add RateLimitMiddleware (in-memory rate limiting)
- Integrate all middleware into main app
- Return consistent JSON error responses
- Add X-Process-Time and X-RateLimit headers
Phase 4 Task 33/68 completed
2026-06-17 08:14:47 +08:00
37836b2755
feat(app): add FastAPI main application and configuration
...
- Create main.py with CORS and GZip middleware
- Add Settings class with all configuration options
- Support .env file for environment variables
- Add health check and root endpoints
- Create comprehensive README with quick start guide
- Add .env.example template
- Include API usage examples and troubleshooting
Phase 4 Task 30/68 completed
2026-06-17 07:42:22 +08:00
36126b47d7
chore: add production environment configuration system
2026-06-15 18:32:05 +08:00
0f16fa600f
docs: add comprehensive API documentation with Swagger
Tests / test (push) Failing after 30s
Tests / lint (push) Failing after 30s
2026-06-15 18:22:10 +08:00
b5a62ee9a3
feat: initial SaaS scaffold
...
- domain: User, Workspace, Project, AssetLibrary, Asset, IngestJob
- ports: repository interfaces
- application: use cases
- adapters: in-memory
- API: FastAPI 5 routes
- worker: Celery ingest_asset
- tests: 4 passing
2026-06-15 15:17:40 +08:00
CI Test
xiaoxia