30 Commits

Author	SHA1	Message	Date
灵应	1b4532cd9c	fix(ci): 修复 PR #185 微信同步登录 Validate 失败 ... - black 格式化 wechat_sync_use_case.py - isort 排序 auth.py imports - bandit: try_except_pass 改为 logger.debug 根因：PR #185 合并时未通过代码质量检查（black/isort）， 导致 CI Validate 步骤在代码检查阶段即失败。	2026-07-07 00:49:14 +08:00
CI Test	46d98f369d	feat(auth): 新增微信同步登录接口wechat-sync（内部系统级接口，支持openid查找/创建用户并返回SaaS token）	2026-07-06 22:10:33 +08:00
灵应	e25fd86171	style: 后端代码isort import排序	2026-07-03 18:56:16 +08:00
灵应	8935196fcd	style: 后端代码black格式化	2026-07-03 18:49:54 +08:00
xiaoxia	dfb41452cb	Merge pull request '[P1 Hotfix] 修复登录故障 - password_hasher导入错误' (#180) from hotfix/fix-login-p1-import-error into develop	2026-07-03 09:42:48 +08:00
CI Test	3f8091e597	fix(security): 删除 decode_token_unsafe() 方法，消除不安全的 JWT 解码	2026-07-03 09:42:21 +08:00
灵应	ed3ab22b88	fix: 修复登录P1故障 - password_hasher导入错误 ... 根因：login_use_case.py 第14行错误地导入了模块而非实例 - 错误: from packages.application.auth import password_hasher - 正确: from packages.application.auth.password_hasher import password_hasher 这导致调用 password_hasher.verify_password() 时抛出 AttributeError: module 'packages.application.auth.password_hasher' has no attribute 'verify_password' 异常被 except Exception 捕获后返回 'Login failed: ...'，最终显示为 '邮箱或密码错误'，所有用户均无法登录。 修复后导入正确的 PasswordHasher 实例，登录功能恢复正常。 P1 紧急修复	2026-07-03 08:34:06 +08:00
xiaoxia	1217d8cef0	style: apply isort formatting to pass CI validation (#129)	2026-06-30 18:17:44 +08:00
xiaoxia	52ff2f80ad	style: apply black formatting to pass CI validation (#126)	2026-06-30 17:23:08 +08:00
xiaoxia	6142b2478a	fix: 修复 login_use_case.py 的 jwt_service 导入路径（P0 登录401） (#67)	2026-06-28 10:10:40 +08:00
CI Test	e90076f794	feat(auth): implement refresh token mechanism ... - Add /auth/refresh endpoint for token renewal - Login response now includes refresh_token - Update JWT defaults: access_token 15min, refresh_token 7days - Reuse existing RefreshTokenUseCase with Redis session store	2026-06-27 22:57:25 +08:00
API文档维护Agent	e3fb518ab2	refactor: remove all workspace_id references from codebase ... - Remove workspace_id from Pydantic models in project_management routes - Remove workspace_id from SQLAlchemy and SQLite project management repos - Remove workspace_id from worker tasks (storage keys, entity creation) - Remove workspace_id from video dedup and title usage modules - Remove workspace_id from generation and ingest worker tasks - Clean workspace_id from all test files and scripts - Remove workspace-specific test files (list_workspaces, workspace repos) Task: #14 workspace_id 残留清理	2026-06-27 22:52:09 +08:00
CI Test	9d54b3e586	fix: correct all import paths for jwt_service and password_hasher (move from domain to application)	2026-06-27 21:41:56 +08:00
CI Test	e1efbdaf6e	fix: resolve circular import for password_hasher/password_validator in auth __init__	2026-06-27 21:33:51 +08:00
CI Test	5b47d1adb7	fix: 修复 password_reset_use_case 循环导入问题	2026-06-27 21:30:57 +08:00
CI Test	02992a3fcd	P2-2: Move auth services from domain to application layer ... - Move jwt_service.py from packages/domain/auth to packages/application/auth - Move password_hasher.py from packages/domain/auth to packages/application/auth - Update all import paths in use cases and tests	2026-06-27 19:23:56 +08:00
XiaoXia Bot	0b990017ca	fix(security): 删除 .env.production 并清理硬编码密码 ... - 删除 .env.production（含占位符密钥，已从版本控制移除） - scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取 - infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量 - packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符	2026-06-27 18:10:52 +08:00
Audit Bot	2c6d920bcb	fix(#25): 移除硬编码 localhost:3000 ... - 添加 APP_BASE_URL 配置项到 Settings - auth.py 中改用 settings.APP_BASE_URL - register_user_use_case.py 和 password_reset_use_case.py 移除默认值 - base_url 参数改为必须由调用方传入 - 更新 .env.example 添加 APP_BASE_URL	2026-06-27 17:20:17 +08:00
Audit Bot	793104c8e7	fix(#12): 实现 refresh token 查找功能 ... - 完善 _find_session_by_refresh_token() 方法 - 使用 session_store.get_session_by_refresh_token() 直接查询 - 利用 Redis 反向索引实现 O(1) 查找复杂度	2026-06-27 17:20:17 +08:00
xiaoxia	f687b4207f	feat: add download_url field to generated video APIs (#20)	2026-06-26 21:13:18 +08:00
xiaoxia	b326e4a249	fix(P1-2): implement token refresh use case with session verification	2026-06-26 17:52:34 +08:00
Xiaoxia AI	ea92092d12	chore(security): triage bandit findings	2026-06-21 13:38:46 +08:00
Xiaoxia AI	b78a290bdd	feat(auth): add verification and password reset routes	2026-06-21 10:40:56 +08:00
Xiaoxia AI	93271f7dda	refactor(auth): route simple auth through use cases	2026-06-21 08:22:49 +08:00
Xiaoxia AI	bfbaddbd9a	style: normalize python formatting gates	2026-06-21 06:52:19 +08:00
Xiaoxia AI	0e93d2e71f	refactor(domain): move auth infrastructure to adapters	2026-06-21 00:46:56 +08:00
Xiaoxia AI	5e047972cd	fix(phase7): resolve remaining TODOs - session_id in JWT and repository injection	2026-06-19 09:47:20 +08:00
Xiaoxia AI	e46cda2416	feat(auth): add password reset functionality ... - Implement RequestPasswordResetUseCase to generate reset token - Send password reset email with 1-hour expiration - Implement ResetPasswordUseCase to verify token and update password - Security: return success even if user not exists (avoid enumeration) - Validate new password strength before reset - Clear reset token after successful password change - Add 9 comprehensive unit tests (all passed) Phase 4 Task 8/68 completed	2026-06-17 01:25:53 +08:00
Xiaoxia AI	f0d0edf449	feat(auth): add login, logout and refresh token use cases ... - Implement LoginUseCase with password verification and JWT token generation - Generate user_auth token (without workspace) for initial login - Create session with refresh_token in Redis - Track last_login_at and last_login_ip - Implement LogoutUseCase for single device or all devices - Add RefreshTokenUseCase placeholder (to be implemented) - Add 9 comprehensive unit tests (all passed) Phase 4 Task 7/68 completed	2026-06-17 01:24:45 +08:00
Xiaoxia AI	e9e874404c	feat(auth): add user registration with email verification ... - Implement RegisterUserUseCase with password validation and email verification - Implement VerifyEmailUseCase for email confirmation - Add UserRepository interface and InMemoryUserRepository implementation - Support duplicate email/username checking - Generate verification tokens and send verification emails - Add 9 comprehensive unit tests (all passed) Phase 4 Task 6/68 completed	2026-06-17 01:20:40 +08:00